gnutls_reauth(3)

📦
version 3.8.13 · 7 versions
, in alpine 3.22, alpine 3.23, alpine 3.24, arch rolling, fedora 43, fedora 44, ubuntu stonking

💖 gnutls_reauth(3) — the gnutls manual, but make it cute 💖

okay bestie, buckle up, we're doing an API function today and she's lowkey a whole moment 🎀

✨ NAME ✨

gnutls_reauth — literally just an API function, that's the whole vibe 💅

✨ SYNOPSIS ✨

#include <gnutls/gnutls.h>

int gnutls_reauth(gnutls_session_t session, unsigned int flags);

🌸 ARGUMENTS 🌸

  • gnutls_session_t session — bestie it's a gnutls_session_t type, that's it, that's the whole description, no notes 🙈
  • unsigned int flags — must be zero. zero. nothing. nada. don't get creative with it fr fr

🦋 DESCRIPTION 🦋

so this function does the post-handshake authentication for TLS 1.3 ✨

the post-handshake authentication gets initiated by the server — the server is the one calling this function, main character energy 👑. and the clients respond when GNUTLS_E_REAUTH_REQUEST has been seen while they're receiving data.

now, the non-fatal errors this function is expected to throw at you are:

  • GNUTLS_E_INTERRUPTED
  • GNUTLS_E_AGAIN
  • and GNUTLS_E_GOT_APPLICATION_DATA — but only when you call it on the server side

the first two ones (GNUTLS_E_INTERRUPTED and GNUTLS_E_AGAIN) interrupt the authentication procedure because the transport layer got interrupted, periodt. and the third one happens because there was pending data sitting there before the peer initiated the re-authentication. in that case the server should read/process that data as unauthenticated and then retry calling gnutls_reauth() again 💪

🚨 important: when you call this function under TLS1.2 or earlier, or the peer didn't advertise post-handshake auth, it always fails with GNUTLS_E_INVALID_REQUEST. no exceptions bestie, it's giving hard no.

the verification of the received peer's certificate? that's delegated to the session or credentials verification callbacks 🫶. and a server can check whether post handshake authentication is supported by the client by checking the session flags with gnutls_session_get_flags() 👀

also — and this is the part people skip and then cry about 😭 — prior to calling this function on the server side, you must call gnutls_certificate_server_set_request() and set the expectations for the received certificate (request or require). if none are set, this function will return GNUTLS_E_INVALID_REQUEST 💀

and ngl, here's the tea: post handshake authentication is available irrespective of the initial negotiation type (PSK or certificate) 🌈. in all cases though, certificate credentials must be set to the session prior to calling this function — no cert credentials, no reauth, that's the rule ✋

🌟 RETURNS 🌟

GNUTLS_E_SUCCESS on a successful authentication 🎉, otherwise a negative error code 🙃

💜 REPORTING BUGS 💜

found a bug? tell the devs, they wanna know, no gatekeeping:

Copyright © 2001-2023 Free Software Foundation, Inc., and others.

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved. (iconic, honestly — free to copy, just keep the receipts 🧾)

🌈 SEE ALSO 🌈

the full documentation for gnutls is maintained as a Texinfo manual 📚. if the /usr/share/doc/gnutls/ directory does not contain the HTML form, go visit:

https://www.gnutls.org/manual/

that's the whole page bestie, you ate it 💅✨ this was gnutls version 3.8.13, and the page itself is gnutls_reauth(3) — mwah, go forth and reauth responsibly 🫶🎀🦋

📦 where this page comes from