GNUTLS_SRP_SET_SERVER_CREDENTIALS_FUNCTION(3)

💖 NAME 💖

gnutls_srp_set_server_credentials_function — it's an API function, bestie, straight out of the gnutls manual (the (3) library section, you know the vibe ✨).

---

🎀 SYNOPSIS 🎀

Like, here's the whole thing, no cap:

#include <gnutls/gnutls.h>

void
gnutls_srp_set_server_credentials_function(gnutls_srp_server_credentials_t
cred, gnutls_srp_server_credentials_function * func);

---

🌸 ARGUMENTS 🌸

• gnutls_srp_server_credentials_t cred — okay so this one is a gnutls_srp_server_credentials_t type. That's it, that's the whole description 💅
• gnutls_srp_server_credentials_function * func — and this is the callback function. The star of the show, honestly.

---

✨ DESCRIPTION ✨

So here's the tea: this function lets you set a callback that goes and fetches the user's SRP credentials. That's its whole job. It's giving "middle manager of credential retrieval."

And the callback's function form is literally this:

int (*callback)(gnutls_session_t, const char* username, gnutls_datum_t
*salt, gnutls_datum_t *verifier, gnutls_datum_t *generator,
gnutls_datum_t *prime);

Now, about that callback: username contains the actual username, obviously. And the salt, verifier, generator and prime? Yeah, those must be filled in using the gnutls_malloc(). But for convenience, prime and generator may also be one of the static parameters defined in gnutls.h. Slay, options! 🦋

Real talk though: initially, the data field is NULL in every gnutls_datum_t structure that the callback has to fill in. And when the callback is done, GnuTLS deallocates all of those buffers which are non-NULL — regardless of the return value. Yes bestie, regardless. Don't be out here thinking you got a say in it. 🙈

Okay this next part is important so pay attention. In order to prevent attackers from guessing valid usernames, if a user does not exist, g and n values should be filled in using a random user's parameters. In that case the callback must return the special value (1). Also go look at gnutls_srp_set_server_fake_salt_seed too, it's related. And if that whole thing is not required for your application, then just return a negative number from the callback to abort the handshake. Your call, your rules 💅

One more thing — the callback function will only be called once per handshake. And it should return 0 on success, while -1 indicates an error. Simple as that, fr fr.

---

🫶 REPORTING BUGS 🫶

Found a bug? Don't suffer in silence, tell the girlies at bugs@gnutls.org.

Home page: https://www.gnutls.org

---

👑 COPYRIGHT 👑

Copyright © 2001-2023 Free Software Foundation, Inc., and others.

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved. That's the legal bit and it's iconic of them to allow it, periodt. 🌈

---

🔥 SEE ALSO 🔥

The full documentation for gnutls is maintained as a Texinfo manual. If the /usr/share/doc/gnutls/ directory does not contain the HTML form, visit

https://www.gnutls.org/manual/

---

And that's the whole page, bestie!! This was the gnutls manual, version 3.8.13, and you officially know more about SRP server credential callbacks than 99% of the group chat. Go off, main character 🧚💜