GnuTLS

https://www.gnutls.org/manual/gnutls.html
Admin
GnuTLS is a free software implementation of the TLS, SSL, and DTLS protocols, providing a library...
Tokens:639,421
Snippets:3,423
Trust Score:9.6
Update:6 days ago
Show doc for...
Tokens:
Raw
### GnuTLS server setup with anti-replay protection and early data

Source: https://www.gnutls.org/manual/gnutls.html

Complete example of setting up a GnuTLS server with anti-replay protection and early data support. It includes a database add function stub, a handshake hook to retrieve early data, and the main setup with gnutls_anti_replay_init, gnutls_anti_replay_set_add_function, gnutls_anti_replay_set_ptr, gnutls_record_set_max_early_data_size, gnutls_anti_replay_enable, and gnutls_handshake_set_hook_function. The db_add_func must return GNUTLS_E_DB_ENTRY_EXISTS if the key already exists, otherwise store it and return 0.

```c
#define MAX_EARLY_DATA_SIZE 16384

static int
db_add_func(void *dbf, gnutls_datum_t key, gnutls_datum_t data)
{
    /* Return GNUTLS_E_DB_ENTRY_EXISTS, if KEY is found in the database.
     * Otherwise, store it and return 0.
     */
}

static int
handshake_hook_func(gnutls_session_t session, unsigned int htype,
                    unsigned when, unsigned int incoming, const gnutls_datum_t *msg)
{
    int ret;
    char buf[MAX_EARLY_DATA_SIZE];

    assert(htype == GNUTLS_HANDSHAKE_END_OF_EARLY_DATA);
    assert(when == GNUTLS_HOOK_POST);

    if (gnutls_session_get_flags(session) & GNUTLS_SFLAGS_EARLY_DATA) {
        ret = gnutls_record_recv_early_data(session, buf, sizeof(buf));
        assert(ret >= 0);
    }

    return ret;
}

int main(void)
{
  ...
  /* Initialize anti-replay measure, which can be shared
   * among multiple sessions.
   */
  gnutls_anti_replay_init(&anti_replay);

  /* Set the database back-end function for the anti-replay data. */
  gnutls_anti_replay_set_add_function(anti_replay, db_add_func);
  gnutls_anti_replay_set_ptr(anti_replay, NULL);

  ...

  gnutls_init(&server, GNUTLS_SERVER | GNUTLS_ENABLE_EARLY_DATA);
  gnutls_record_set_max_early_data_size(server, MAX_EARLY_DATA_SIZE);

  ...

  /* Set the anti-replay measure to the session.
   */
  gnutls_anti_replay_enable(server, anti_replay);
  ...

  /* Retrieve early data in a handshake hook;
   * you can also do that after handshake.
   */
  gnutls_handshake_set_hook_function(server, GNUTLS_HANDSHAKE_END_OF_EARLY_DATA,
                                     GNUTLS_HOOK_POST, handshake_hook_func);
  ...
}

```

--------------------------------

### Start gnutls-serv with PSK support

Source: https://www.gnutls.org/manual/gnutls.html

Starts an HTTP server with PSK authentication. Requires a password file created with psktool.

```bash
gnutls-serv --http --priority NORMAL:+ECDHE-PSK:+PSK \
            --pskpasswd psk-passwd.txt

```

--------------------------------

### Start gnutls-serv with SRP support

Source: https://www.gnutls.org/manual/gnutls.html

Starts an HTTP server with SRP authentication. Requires an SRP password file created with srptool.

```bash
gnutls-serv --http --priority NORMAL:+SRP-RSA:+SRP \
            --srppasswdconf srp-tpasswd.conf \
            --srppasswd srp-passwd.txt

```

--------------------------------

### Start gnutls-serv with raw public-key support

Source: https://www.gnutls.org/manual/gnutls.html

Starts an HTTP server with raw public-key certificates. Note that no identity information is linked to these keys, so authentication must be done via different means. Raw public-key certificates must be explicitly enabled via priority strings.

```bash
gnutls-serv --http --priority NORMAL:+CTYPE-CLI-RAWPK:+CTYPE-SRV-RAWPK \
            --rawpkfile srv.rawpk.pem \
            --rawpkkeyfile srv.key.pem

```

--------------------------------

### Start gnutls-serv with X.509 certificates

Source: https://www.gnutls.org/manual/gnutls.html

Starts the HTTPS server again, this time using the generated CA, server key, and server certificate for X.509 authentication.

```bash
$ gnutls-serv --http \
            --x509cafile x509-ca.pem \
            --x509keyfile x509-server-key.pem \
            --x509certfile x509-server.pem

```

--------------------------------

### Example certtool template file (cert.cfg)

Source: https://www.gnutls.org/manual/gnutls.html

An example template file for generating a certificate request or self-signed certificate, containing X.509 options and DN fields.

```text
# X.509 Certificate options
#
# DN options

# The organization of the subject.
organization = "Koko inc."

# The organizational unit of the subject.
unit = "sleeping dept."

# The locality of the subject.
# locality =

# The state of the certificate owner.
state = "Attiki"

# The country of the subject. Two letter code.
country = GR

# The common name of the certificate owner.
cn = "Cindy Lauper"

# A user id of the certificate owner.
#uid = "clauper"

```

--------------------------------

### Example Priority Strings

Source: https://www.gnutls.org/manual/gnutls.html

A list of example priority strings for GnuTLS, showing how to specify security levels, enable or disable ciphers, and control TLS versions. Each string is a configuration value used with gnutls-cli or priority functions.

```text
The system imposed security level:
    "SYSTEM"

The default priority without the HMAC-MD5:
    "NORMAL:-MD5"

Specifying RSA with AES-128-CBC:
    "NONE:+VERS-TLS-ALL:+MAC-ALL:+RSA:+AES-128-CBC:+SIGN-ALL:+COMP-NULL"

Specifying the defaults plus ARCFOUR-128:
    "NORMAL:+ARCFOUR-128"

Enabling the 128-bit secure ciphers, while disabling TLS 1.0:
    "SECURE128:-VERS-TLS1.0"

Enabling the 128-bit and 192-bit secure ciphers, while disabling all TLS versions
except TLS 1.2:
    "SECURE128:+SECURE192:-VERS-ALL:+VERS-TLS1.2"
```

--------------------------------

### Example implementation for sending and receiving 'Hello World' supplemental data

Source: https://www.gnutls.org/manual/gnutls.html

Example code showing how to send a 'Hello World' string in the supplemental data handshake message. The receive function allocates memory, copies the data, and frees it; the send function appends the message to the buffer. After implementing these, register the new supplemental data using gnutls_session_supplemental_register or gnutls_supplemental_register.

```c
int
_foobar_supp_recv_params(gnutls_session_t session, const opaque *data, size_t _data_size)
{
   uint8_t len = _data_size;
   unsigned char *msg;

   msg = gnutls_malloc(len);
   if (msg == NULL) return GNUTLS_E_MEMORY_ERROR;

   memcpy(msg, data, len);
   msg[len]='\0';

   /* do something with msg */
   gnutls_free(msg);

   return len;
}

int
_foobar_supp_send_params(gnutls_session_t session, gnutls_buffer_t buf)
{
   unsigned char *msg = "hello world";
   int len = strlen(msg);

   if (gnutls_buffer_append_data(buf, msg, len) < 0)
       abort();

   return len;
}

```

--------------------------------

### PSK TLS Client Example in C

Source: https://www.gnutls.org/manual/gnutls.html

A complete C program that connects to a server using PSK authentication. It requires GnuTLS 3.6.3 or later and uses the gnutls_psk_set_client_credentials function with a hex key. The example includes error handling and demonstrates the use of gnutls_set_default_priority_append with the '-KX-ALL:+ECDHE-PSK:+DHE-PSK:+PSK' priority string.

```c
/* This example code is placed in the public domain. */

#ifdef HAVE_CONFIG_H
#include <config.h>
#endif

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <unistd.h>
#include <assert.h>
#include <gnutls/gnutls.h>

/* A very basic TLS client, with PSK authentication.
 */

#define CHECK(x) assert((x) >= 0)
#define LOOP_CHECK(rval, cmd)                                             \
	do {                                                              \
		rval = cmd;                                               \
	} while (rval == GNUTLS_E_AGAIN || rval == GNUTLS_E_INTERRUPTED); \
	assert(rval >= 0)

#define MAX_BUF 1024
#define MSG "GET / HTTP/1.0\r\n\r\n"

extern int tcp_connect(void);
extern void tcp_close(int sd);

int main(void)
{
	int ret, sd, ii;
	gnutls_session_t session;
	char buffer[MAX_BUF + 1];
	const char *err;
	gnutls_psk_client_credentials_t pskcred;
	const gnutls_datum_t key = { (void *)"DEADBEEF", 8 };

	if (gnutls_check_version("3.6.3") == NULL) {
		fprintf(stderr,
			"GnuTLS 3.6.3 or later is required for this example\n");
		exit(1);
	}

	CHECK(gnutls_global_init());

	CHECK(gnutls_psk_allocate_client_credentials(&pskcred));
	CHECK(gnutls_psk_set_client_credentials(pskcred, "test", &key,
						GNUTLS_PSK_KEY_HEX));

	/* Initialize TLS session
	 */
	CHECK(gnutls_init(&session, GNUTLS_CLIENT));

	ret = gnutls_set_default_priority_append(
		session, "-KX-ALL:+ECDHE-PSK:+DHE-PSK:+PSK", &err, 0);

	/* Alternative for pre-3.6.3 versions:
	 * gnutls_priority_set_direct(session, "NORMAL:+ECDHE-PSK:+DHE-PSK:+PSK", &err)
	 */
	if (ret < 0) {
		if (ret == GNUTLS_E_INVALID_REQUEST) {
			fprintf(stderr, "Syntax error at: %s\n", err);
		}
		exit(1);
	}

	/* put the x509 credentials to the current session
	 */
	CHECK(gnutls_credentials_set(session, GNUTLS_CRD_PSK, pskcred));

	/* connect to the peer
	 */
	sd = tcp_connect();

	gnutls_transport_set_int(session, sd);
	gnutls_handshake_set_timeout(session, GNUTLS_DEFAULT_HANDSHAKE_TIMEOUT);

	/* Perform the TLS handshake
	 */
	do {
		ret = gnutls_handshake(session);
	} while (ret < 0 && gnutls_error_is_fatal(ret) == 0);

	if (ret < 0) {
		fprintf(stderr, "*** Handshake failed\n");
		gnutls_perror(ret);
		goto end;
	} else {
		char *desc;

		desc = gnutls_session_get_desc(session);
		printf("- Session info: %s\n", desc);
		gnutls_free(desc);
	}

	LOOP_CHECK(ret, gnutls_record_send(session, MSG, strlen(MSG)));

	LOOP_CHECK(ret, gnutls_record_recv(session, buffer, MAX_BUF));
	if (ret == 0) {
		printf("- Peer has closed the TLS connection\n");
		goto end;
	} else if (ret < 0 && gnutls_error_is_fatal(ret) == 0) {
		fprintf(stderr, "*** Warning: %s\n", gnutls_strerror(ret));
	} else if (ret < 0) {
		fprintf(stderr, "*** Error: %s\n", gnutls_strerror(ret));
		goto end;
	}

	if (ret > 0) {
		printf("- Received %d bytes: ", ret);
		for (ii = 0; ii < ret; ii++) {
			fputc(buffer[ii], stdout);
		}
		fputs("\n", stdout);
	}

	CHECK(gnutls_bye(session, GNUTLS_SHUT_RDWR));

end:

	tcp_close(sd);

	gnutls_deinit(session);

	gnutls_psk_free_client_credentials(pskcred);

	gnutls_global_deinit();

	return 0;
}

```

--------------------------------

### Start gnutls-serv with all authentication methods

Source: https://www.gnutls.org/manual/gnutls.html

Combines all earlier parameters (SRP, PSK, raw public keys, and X.509 with ECDSA) into a single server command.

```bash
gnutls-serv --http --priority NORMAL:+PSK:+SRP:+CTYPE-CLI-RAWPK:+CTYPE-SRV-RAWPK \
            --x509cafile x509-ca.pem \
            --x509keyfile x509-server-key.pem \
            --x509certfile x509-server.pem \
            --x509keyfile x509-server-key-ecc.pem \
            --x509certfile x509-server-ecc.pem \
            --srppasswdconf srp-tpasswd.conf \
            --srppasswd srp-passwd.txt \
            --pskpasswd psk-passwd.txt \
            --rawpkfile srv.rawpk.pem \
            --rawpkkeyfile srv.key.pem

```

--------------------------------

### SRP TLS client example in C

Source: https://www.gnutls.org/manual/gnutls.html

A complete C program that connects to a server using SRP authentication. It requires GnuTLS 3.1.4 or later and uses external functions tcp_connect, tcp_close, and check_alert. The client sets SRP and certificate credentials, performs a TLS handshake, sends a GET request, and prints the response.

```c
/* This example code is placed in the public domain. */

#ifdef HAVE_CONFIG_H
#include <config.h>
#endif

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <gnutls/gnutls.h>

/* Those functions are defined in other examples.
 */
extern void check_alert(gnutls_session_t session, int ret);
extern int tcp_connect(void);
extern void tcp_close(int sd);

#define MAX_BUF 1024
#define USERNAME "user"
#define PASSWORD "pass"
#define CAFILE "/etc/ssl/certs/ca-certificates.crt"
#define MSG "GET / HTTP/1.0\r\n\r\n"

int main(void)
{
	int ret;
	int sd, ii;
	gnutls_session_t session;
	char buffer[MAX_BUF + 1];
	gnutls_srp_client_credentials_t srp_cred;
	gnutls_certificate_credentials_t cert_cred;

	if (gnutls_check_version("3.1.4") == NULL) {
		fprintf(stderr,
			"GnuTLS 3.1.4 or later is required for this example\n");
		exit(1);
	}

	/* for backwards compatibility with gnutls < 3.3.0 */
	gnutls_global_init();

	gnutls_srp_allocate_client_credentials(&srp_cred);
	gnutls_certificate_allocate_credentials(&cert_cred);

	gnutls_certificate_set_x509_trust_file(cert_cred, CAFILE,
					       GNUTLS_X509_FMT_PEM);
	gnutls_srp_set_client_credentials(srp_cred, USERNAME, PASSWORD);

	/* connects to server
	 */
	sd = tcp_connect();

	/* Initialize TLS session
	 */
	gnutls_init(&session, GNUTLS_CLIENT);

	/* Set the priorities.
	 */
	gnutls_priority_set_direct(session, "NORMAL:+SRP:+SRP-RSA:+SRP-DSS",
				   NULL);

	/* put the SRP credentials to the current session
	 */
	gnutls_credentials_set(session, GNUTLS_CRD_SRP, srp_cred);
	gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, cert_cred);

	gnutls_transport_set_int(session, sd);
	gnutls_handshake_set_timeout(session, GNUTLS_DEFAULT_HANDSHAKE_TIMEOUT);

	/* Perform the TLS handshake
	 */
	do {
		ret = gnutls_handshake(session);
	} while (ret < 0 && gnutls_error_is_fatal(ret) == 0);

	if (ret < 0) {
		fprintf(stderr, "*** Handshake failed\n");
		gnutls_perror(ret);
		goto end;
	} else {
		char *desc;

		desc = gnutls_session_get_desc(session);
		printf("- Session info: %s\n", desc);
		gnutls_free(desc);
	}

	gnutls_record_send(session, MSG, strlen(MSG));

	ret = gnutls_record_recv(session, buffer, MAX_BUF);
	if (gnutls_error_is_fatal(ret) != 0 || ret == 0) {
		if (ret == 0) {
			printf("- Peer has closed the GnuTLS connection\n");
			goto end;
		} else {
			fprintf(stderr, "*** Error: %s\n",
				gnutls_strerror(ret));
			goto end;
		}
	} else
		check_alert(session, ret);

	if (ret > 0) {
		printf("- Received %d bytes: ", ret);
		for (ii = 0; ii < ret; ii++) {
			fputc(buffer[ii], stdout);
		}
		fputs("\n", stdout);
	}
	gnutls_bye(session, GNUTLS_SHUT_RDWR);

end:

	tcp_close(sd);

	gnutls_deinit(session);

	gnutls_srp_free_client_credentials(srp_cred);
	gnutls_certificate_free_credentials(cert_cred);

	gnutls_global_deinit();

	return 0;
}

```

--------------------------------

### DTLS client example in C using GnuTLS

Source: https://www.gnutls.org/manual/gnutls.html

Complete C program for a Datagram TLS client over UDP with X.509 authentication. It initializes GnuTLS, sets up credentials, performs a DTLS handshake, sends an HTTP GET request, receives the response, and cleans up. Requires GnuTLS 3.1.4 or later and uses system trusted CAs.

```c
/* This example code is placed in the public domain. */

#ifdef HAVE_CONFIG_H
#include <config.h>
#endif

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <assert.h>
#include <unistd.h>
#include <gnutls/gnutls.h>
#include <gnutls/dtls.h>

/* A very basic Datagram TLS client, over UDP with X.509 authentication.
 */

#define CHECK(x) assert((x) >= 0)
#define LOOP_CHECK(rval, cmd)                                             \
	do {                                                              \
		rval = cmd;                                               \
	} while (rval == GNUTLS_E_AGAIN || rval == GNUTLS_E_INTERRUPTED); \
	assert(rval >= 0)

#define MAX_BUF 1024
#define MSG "GET / HTTP/1.0\r\n\r\n"

extern int udp_connect(void);
extern void udp_close(int sd);
extern int verify_certificate_callback(gnutls_session_t session);

int main(void)
{
	int ret, sd, ii;
	gnutls_session_t session;
	char buffer[MAX_BUF + 1];
	gnutls_certificate_credentials_t xcred;

	if (gnutls_check_version("3.1.4") == NULL) {
		fprintf(stderr,
			"GnuTLS 3.1.4 or later is required for this example\n");
		exit(1);
	}

	/* for backwards compatibility with gnutls < 3.3.0 */
	CHECK(gnutls_global_init());

	/* X509 stuff */
	CHECK(gnutls_certificate_allocate_credentials(&xcred));

	/* sets the system trusted CAs for Internet PKI */
	CHECK(gnutls_certificate_set_x509_system_trust(xcred));

	/* Initialize TLS session */
	CHECK(gnutls_init(&session, GNUTLS_CLIENT | GNUTLS_DATAGRAM));

	/* Use default priorities */
	CHECK(gnutls_set_default_priority(session));

	/* put the x509 credentials to the current session */
	CHECK(gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred));
	CHECK(gnutls_server_name_set(session, GNUTLS_NAME_DNS,
				     "www.example.com",
				     strlen("www.example.com")));

	gnutls_session_set_verify_cert(session, "www.example.com", 0);

	/* connect to the peer */
	sd = udp_connect();

	gnutls_transport_set_int(session, sd);

	/* set the connection MTU */
	gnutls_dtls_set_mtu(session, 1000);
	/* gnutls_dtls_set_timeouts(session, 1000, 60000); */

	/* Perform the TLS handshake */
	do {
		ret = gnutls_handshake(session);
	} while (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN);
	/* Note that DTLS may also receive GNUTLS_E_LARGE_PACKET */

	if (ret < 0) {
		fprintf(stderr, "*** Handshake failed\n");
		gnutls_perror(ret);
		goto end;
	} else {
		char *desc;

		desc = gnutls_session_get_desc(session);
		printf("- Session info: %s\n", desc);
		gnutls_free(desc);
	}

	LOOP_CHECK(ret, gnutls_record_send(session, MSG, strlen(MSG)));

	LOOP_CHECK(ret, gnutls_record_recv(session, buffer, MAX_BUF));
	if (ret == 0) {
		printf("- Peer has closed the TLS connection\n");
		goto end;
	} else if (ret < 0 && gnutls_error_is_fatal(ret) == 0) {
		fprintf(stderr, "*** Warning: %s\n", gnutls_strerror(ret));
	} else if (ret < 0) {
		fprintf(stderr, "*** Error: %s\n", gnutls_strerror(ret));
		goto end;
	}

	if (ret > 0) {
		printf("- Received %d bytes: ", ret);
		for (ii = 0; ii < ret; ii++) {
			fputc(buffer[ii], stdout);
		}
		fputs("\n", stdout);
	}

	/* It is suggested not to use GNUTLS_SHUT_RDWR in DTLS
	 * connections because the peer's closure message might
	 * be lost */
	CHECK(gnutls_bye(session, GNUTLS_SHUT_WR));

end:

	udp_close(sd);

	gnutls_deinit(session);

	gnutls_certificate_free_credentials(xcred);

	gnutls_global_deinit();

	return 0;
}

```

--------------------------------

### Connect to STARTTLS services with gnutls-cli

Source: https://www.gnutls.org/manual/gnutls.html

Shows how to use gnutls-cli to connect to services that support STARTTLS, using the --starttls-proto option to specify the protocol (e.g., smtp) and --port for the port number.

```bash
$ gnutls-cli --starttls-proto smtp --port 25 localhost

```

--------------------------------

### gnutls_cipher_suite_info

Source: https://www.gnutls.org/manual/gnutls.html

Get information about supported cipher suites. Use the function iteratively to get information about all supported cipher suites.

```APIDOC
## gnutls_cipher_suite_info

### Description
Get information about supported cipher suites. Use the function iteratively to get information about all supported cipher suites.

### Function
`const char *` **gnutls_cipher_suite_info** `(size_t idx, unsigned char * cs_id, gnutls_kx_algorithm_t * kx, gnutls_cipher_algorithm_t * cipher, gnutls_mac_algorithm_t * mac, gnutls_protocol_t * min_version)`

### Parameters
- **idx** (size_t) - Required - Index of cipher suite to get information about, starts on 0.
- **cs_id** (unsigned char *) - Required - Output buffer with room for 2 bytes, indicating cipher suite value.
- **kx** (gnutls_kx_algorithm_t *) - Optional - Output variable indicating key exchange algorithm, or `NULL`.
- **cipher** (gnutls_cipher_algorithm_t *) - Optional - Output variable indicating cipher, or `NULL`.
- **mac** (gnutls_mac_algorithm_t *) - Optional - Output variable indicating MAC algorithm, or `NULL`.
- **min_version** (gnutls_protocol_t *) - Optional - Output variable indicating TLS protocol version, or `NULL`.

### Returns
The name of `idx` cipher suite, and set the information about the cipher suite in the output variables. If `idx` is out of bounds, `NULL` is returned.
```

--------------------------------

### Echo server with PSK authentication using GnuTLS

Source: https://www.gnutls.org/manual/gnutls.html

Initializes GnuTLS with PSK and certificate credentials, sets up a listening socket, accepts client connections, performs a TLS handshake, and echoes received data back. Includes a pre-3.6.3 equivalent for priority initialization. Requires prior setup of x509_cred and psk_cred credentials.

```c
	/* pre-3.6.3 equivalent:
	 * gnutls_priority_init(&priority_cache,
	 *                      "NORMAL:+PSK:+ECDHE-PSK:+DHE-PSK",
	 *                      NULL);
	 */
	gnutls_priority_init2(&priority_cache, "+ECDHE-PSK:+DHE-PSK:+PSK", NULL,
			      GNUTLS_PRIORITY_INIT_DEF_APPEND);

	gnutls_certificate_set_known_dh_params(x509_cred,
					       GNUTLS_SEC_PARAM_MEDIUM);

	/* Socket operations
	 */
	listen_sd = socket(AF_INET, SOCK_STREAM, 0);
	SOCKET_ERR(listen_sd, "socket");

	memset(&sa_serv, '\0', sizeof(sa_serv));
	sa_serv.sin_family = AF_INET;
	sa_serv.sin_addr.s_addr = INADDR_ANY;
	sa_serv.sin_port = htons(PORT); /* Server Port number */

	setsockopt(listen_sd, SOL_SOCKET, SO_REUSEADDR, (void *)&optval,
		   sizeof(int));

	err = bind(listen_sd, (struct sockaddr *)&sa_serv, sizeof(sa_serv));
	SOCKET_ERR(err, "bind");
	err = listen(listen_sd, 1024);
	SOCKET_ERR(err, "listen");

	printf("Server ready. Listening to port '%d'.\n\n", PORT);

	client_len = sizeof(sa_cli);
	for (;;) {
		gnutls_init(&session, GNUTLS_SERVER);
		gnutls_priority_set(session, priority_cache);
		gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE,
				       x509_cred);
		gnutls_credentials_set(session, GNUTLS_CRD_PSK, psk_cred);

		/* request client certificate if any.
		 */
		gnutls_certificate_server_set_request(session,
						      GNUTLS_CERT_REQUEST);

		sd = accept(listen_sd, (struct sockaddr *)&sa_cli, &client_len);

		printf("- connection from %s, port %d\n",
		       inet_ntop(AF_INET, &sa_cli.sin_addr, topbuf,
				 sizeof(topbuf)),
		       ntohs(sa_cli.sin_port));

		gnutls_transport_set_int(session, sd);
		LOOP_CHECK(ret, gnutls_handshake(session));
		if (ret < 0) {
			close(sd);
			gnutls_deinit(session);
			fprintf(stderr, "*** Handshake has failed (%s)\n\n",
				gnutls_strerror(ret));
			continue;
		}
		printf("- Handshake was completed\n");

		kx = gnutls_kx_get(session);
		if (kx == GNUTLS_KX_PSK || kx == GNUTLS_KX_DHE_PSK ||
		    kx == GNUTLS_KX_ECDHE_PSK) {
			printf("- User %s was connected\n",
			       gnutls_psk_server_get_username(session));
		}

		/* see the Getting peer's information example */
		/* print_info(session); */

		for (;;) {
			LOOP_CHECK(ret, gnutls_record_recv(session, buffer,
							   MAX_BUF));

			if (ret == 0) {
				printf("\n- Peer has closed the GnuTLS connection\n");
				break;
			} else if (ret < 0 && gnutls_error_is_fatal(ret) == 0) {
				fprintf(stderr, "*** Warning: %s\n",
					gnutls_strerror(ret));
			} else if (ret < 0) {
				fprintf(stderr,
					"\n*** Received corrupted "
					"data(%d). Closing the connection.\n\n",
					ret);
				break;
			} else if (ret > 0) {
				/* echo data back to the client
				 */
				gnutls_record_send(session, buffer, ret);
			}
		}
		printf("\n");
		/* do not wait for the peer to close the connection.
		 */
		LOOP_CHECK(ret, gnutls_bye(session, GNUTLS_SHUT_WR));

		close(sd);
		gnutls_deinit(session);
	}
	close(listen_sd);

	gnutls_certificate_free_credentials(x509_cred);
	gnutls_psk_free_server_credentials(psk_cred);

	gnutls_priority_deinit(priority_cache);

	gnutls_global_deinit();

	return 0;
}
```

--------------------------------

### False Start (GNUTLS_ENABLE_FALSE_START)

Source: https://www.gnutls.org/manual/gnutls.html

The False Start feature in GnuTLS enables early handshake termination to send data in a single round trip. This snippet documents how to enable and use it with gnutls_init and related functions.

```APIDOC
## [GNUTLS_FALSE_START] GNUTLS_ENABLE_FALSE_START

### Description
Use GNUTLS_ENABLE_FALSE_START as an option to gnutls_init to request an early return of the gnutls_handshake function, allowing the client to send data in a single round trip. After early return, transmit data with gnutls_record_send and receive data with gnutls_record_recv.

### Parameters
- **gnutls_init flag** - GNUTLS_ENABLE_FALSE_START - Used to enable false start.

### Notes
- To verify false start was used, call gnutls_session_get_flags and check for GNUTLS_SFLAGS_FALSE_START flag.
- False start is enabled for DHE and ECDHE key exchange methods only when negotiated parameters exceed GNUTLS_SEC_PARAM_HIGH and under (D)TLS 1.2 or later.

### Related Functions
- gnutls_handshake
- gnutls_record_send
- gnutls_record_recv
- gnutls_handshake_set_timeout
- gnutls_session_get_flags
```

--------------------------------

### gnutls_x509_ext_ct_scts_init

Source: https://www.gnutls.org/manual/gnutls.html

Initializes an SCT list.

```APIDOC
## gnutls_x509_ext_ct_scts_init

### Description
Initializes a Certificate Transparency SCT list.

### Function Signature
`int gnutls_x509_ext_ct_scts_init(gnutls_x509_ct_scts_t * scts)`

### Parameters
- **scts** (gnutls_x509_ct_scts_t *) - Required - The SCT list.

### Description Details
This function will initialize a Certificate Transparency SCT list.

### Returns
`GNUTLS_E_SUCCESS` (0) on success, otherwise a negative error value.
```

--------------------------------

### Generate a certificate request and private key with gnutls_x509_crq_sign2

Source: https://www.gnutls.org/manual/gnutls.html

Complete C example that initializes a certificate request and private key, generates an RSA key, sets the distinguished name, version, challenge password, associates the key, signs the request with gnutls_x509_crq_sign2, and exports both the request and private key in PEM format. The example is placed in the public domain and requires GnuTLS headers. Note that after signing, the request must be exported and re-imported to be fully functional.

```c
/* This example code is placed in the public domain. */

#ifdef HAVE_CONFIG_H
#include <config.h>
#endif

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <gnutls/gnutls.h>
#include <gnutls/x509.h>
#include <gnutls/abstract.h>
#include <time.h>

/* This example will generate a private key and a certificate
 * request.
 */

int main(void)
{
	gnutls_x509_crq_t crq;
	gnutls_x509_privkey_t key;
	unsigned char buffer[10 * 1024];
	size_t buffer_size = sizeof(buffer);
	unsigned int bits;

	gnutls_global_init();

	/* Initialize an empty certificate request, and
	 * an empty private key.
	 */
	gnutls_x509_crq_init(&crq);

	gnutls_x509_privkey_init(&key);

	/* Generate an RSA key of moderate security.
	 */
	bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_RSA,
					   GNUTLS_SEC_PARAM_MEDIUM);
	gnutls_x509_privkey_generate(key, GNUTLS_PK_RSA, bits, 0);

	/* Add stuff to the distinguished name
	 */
	gnutls_x509_crq_set_dn_by_oid(crq, GNUTLS_OID_X520_COUNTRY_NAME, 0,
				      "GR", 2);

	gnutls_x509_crq_set_dn_by_oid(crq, GNUTLS_OID_X520_COMMON_NAME, 0,
				      "Nikos", strlen("Nikos"));

	/* Set the request version.
	 */
	gnutls_x509_crq_set_version(crq, 1);

	/* Set a challenge password.
	 */
	gnutls_x509_crq_set_challenge_password(crq,
					       "something to remember here");

	/* Associate the request with the private key
	 */
	gnutls_x509_crq_set_key(crq, key);

	/* Self sign the certificate request.
	 */
	gnutls_x509_crq_sign2(crq, key, GNUTLS_DIG_SHA1, 0);

	/* Export the PEM encoded certificate request, and
	 * display it.
	 */
	gnutls_x509_crq_export(crq, GNUTLS_X509_FMT_PEM, buffer, &buffer_size);

	printf("Certificate Request: \n%s", buffer);

	/* Export the PEM encoded private key, and
	 * display it.
	 */
	buffer_size = sizeof(buffer);
	gnutls_x509_privkey_export(key, GNUTLS_X509_FMT_PEM, buffer,
				   &buffer_size);

	printf("\n\nPrivate key: \n%s", buffer);

	gnutls_x509_crq_deinit(crq);
	gnutls_x509_privkey_deinit(key);

	return 0;
}

```

--------------------------------

### gnutls_pkcs7_get_attr

Source: https://www.gnutls.org/manual/gnutls.html

Gets a PKCS #7 attribute from a list.

```APIDOC
## int gnutls_pkcs7_get_attr(gnutls_pkcs7_attrs_t list, unsigned idx, char ** oid, gnutls_datum_t * data, unsigned flags)

### Description
This function will get a PKCS `7` attribute from the provided list. The OID is a constant string, but data will be allocated and must be deinitialized by the caller.

### Function Signature
`int gnutls_pkcs7_get_attr(gnutls_pkcs7_attrs_t list, unsigned idx, char ** oid, gnutls_datum_t * data, unsigned flags)`

### Parameters
- **list** (gnutls_pkcs7_attrs_t) - Required - A list of existing attributes or `NULL` for the first one
- **idx** (unsigned) - Required - The index of the attribute to get
- **oid** (char **) - Required - The OID of the attribute (read-only)
- **data** (gnutls_datum_t *) - Required - The raw data of the attribute
- **flags** (unsigned) - Required - Zero or `GNUTLS_PKCS7_ATTR_ENCODE_OCTET_STRING`

### Returns
On success, `GNUTLS_E_SUCCESS` (0) is returned, otherwise a negative error value. `GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE` is returned if there are no data in the current index.

### Since
3.4.2
```

--------------------------------

### gnutls_x509_crt_get_subject_key_id

Source: https://www.gnutls.org/manual/gnutls.html

Gets the X.509v3 subject key identifier from a certificate.

```APIDOC
## gnutls_x509_crt_get_subject_key_id

### Description
This function returns the X.509v3 certificate’s subject key identifier. This is obtained by the X.509 Subject Key identifier extension field (2.5.29.14).

### Function
`int gnutls_x509_crt_get_subject_key_id(gnutls_x509_crt_t cert, void * ret, size_t * ret_size, unsigned int * critical)`

### Parameters
- **cert** (gnutls_x509_crt_t) - should contain a gnutls_x509_crt_t type
- **ret** (void *) - The place where the identifier will be copied
- **ret_size** (size_t *) - Holds the size of the result field.
- **critical** (unsigned int *) - will be non-zero if the extension is marked as critical (may be null)

### Returns
On success, `GNUTLS_E_SUCCESS` (0) is returned, `GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE` if the extension is not present, otherwise a negative error value.
```

--------------------------------

### Connect using raw public-key authentication with gnutls-cli

Source: https://www.gnutls.org/manual/gnutls.html

Demonstrates connecting to a server using raw public-key authentication by enabling raw public-key negotiation via priority strings. The command uses --rawpkkeyfile and --rawpkfile to provide the client's raw public key pair.

```bash
$ ./gnutls-cli -p 5556 localhost --priority NORMAL:-CTYPE-CLI-ALL:+CTYPE-CLI-RAWPK \
    --rawpkkeyfile cli.key.pem \
    --rawpkfile cli.rawpk.pem
Processed 1 client raw public key pair...
Resolving 'localhost'...
Connecting to '127.0.0.1:5556'...
- Successfully sent 1 certificate(s) to server.
- Server has requested a certificate.
- Certificate type: X.509
- Got a certificate list of 1 certificates.
- Certificate[0] info:
 - skipped
- Description: (TLS1.3-Raw Public Key-X.509)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM)
- Options:
- Handshake was completed
    
- Simple Client Mode:

```

--------------------------------

### gnutls_x509_key_purpose_init

Source: https://www.gnutls.org/manual/gnutls.html

Initializes a key purposes type.

```APIDOC
## gnutls_x509_key_purpose_init

### Description
This function will initialize an alternative names type.

### Signature
`int gnutls_x509_key_purpose_init(gnutls_x509_key_purposes_t * p)`

### Parameters
- **p** (gnutls_x509_key_purposes_t *) - Required - The key purposes

### Returns
On success, `GNUTLS_E_SUCCESS` (0) is returned, otherwise a negative error value.

### Since
3.3.0
```

--------------------------------

### gnutls_srtp_get_profile_name

Source: https://www.gnutls.org/manual/gnutls.html

Gets the string name for a given SRTP profile.

```APIDOC
## Function: gnutls_srtp_get_profile_name

### Description
Returns the name of an SRTP profile.

### Signature
`const char * gnutls_srtp_get_profile_name (gnutls_srtp_profile_t profile)`

### Parameters
- **profile** (gnutls_srtp_profile_t) - Required - The SRTP profile.

### Returns
Returns a string containing the profile name.
```

--------------------------------

### Start basic gnutls-serv HTTPS server with anonymous ciphersuites

Source: https://www.gnutls.org/manual/gnutls.html

Starts a simple HTTPS server using gnutls-serv with the --http option and a priority string that enables anonymous ciphersuites. This server only supports anonymous ciphersuites, which many TLS clients refuse to use.

```bash
gnutls-serv --http --priority "NORMAL:+ANON-ECDH:+ANON-DH"

```

--------------------------------

### gnutls_pkcs7_init

Source: https://www.gnutls.org/manual/gnutls.html

Initializes a PKCS7 structure.

```APIDOC
## gnutls_pkcs7_init

### Description
This function initializes a PKCS7 structure. PKCS7 structures usually contain lists of X.509 certificates and X.509 certificate revocation lists.

### Function
int gnutls_pkcs7_init(gnutls_pkcs7_t * pkcs7)

### Parameters
- **pkcs7** (gnutls_pkcs7_t *) - Required - A pointer to the type to be initialized.

### Returns
On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error value.
```

--------------------------------

### p11-kit configuration file to load OpenSC module

Source: https://www.gnutls.org/manual/gnutls.html

Example content for /etc/pkcs11/modules/opensc.module that instructs GnuTLS to load the OpenSC PKCS #11 module. Using such configuration files removes the need for additional initialization in GnuTLS, except for PIN and token callbacks.

```plaintext
module: /usr/lib/opensc-pkcs11.so

```

--------------------------------

### gnutls_tpm_key_list_get_url

Source: https://www.gnutls.org/manual/gnutls.html

Gets the URL of a key from the TPM key list by index.

```APIDOC
## gnutls_tpm_key_list_get_url

### Description
This function returns the URL of the key at the specified index in the list. If the index is out of bounds, `GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE` is returned.

### Function
int gnutls_tpm_key_list_get_url(gnutls_tpm_key_list_t list, unsigned int idx, char ** url, unsigned int flags)

### Parameters
- **list** (gnutls_tpm_key_list_t) - Required - A list of the keys.
- **idx** (unsigned int) - Required - The index of the key (starting from zero).
- **url** (char **) - Required - The URL to be returned.
- **flags** (unsigned int) - Required - Should be zero.

### Returns
On success, `GNUTLS_E_SUCCESS` (0) is returned, otherwise a negative error value. `GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE` may be returned if the index is out of bounds.

### Since
3.1.0
```

--------------------------------

### gnutls_x509_dn_init

Source: https://www.gnutls.org/manual/gnutls.html

Initializes a gnutls_x509_dn_t structure for use.

```APIDOC
## gnutls_x509_dn_init

### Description
Initializes a gnutls_x509_dn_t type.

### Function Signature
`int gnutls_x509_dn_init(gnutls_x509_dn_t * dn)`

### Parameters
- **dn** (gnutls_x509_dn_t *) - Required - The object to be initialized.

### Description Details
This function initializes a `gnutls_x509_dn_t` type. The object returned must be deallocated using `gnutls_x509_dn_deinit()`.

### Return Value
On success, `GNUTLS_E_SUCCESS` (0) is returned, otherwise a negative error value.

### Since
2.4.0
```

--------------------------------

### Starter template for GnuTLS extension functions

Source: https://www.gnutls.org/manual/gnutls.html

Provides the minimal implementations for the four required extension functions: recv_params, send_params, pack, and unpack. The recv_params function parses incoming extension data, send_params formats data for the wire, pack saves internal state for session resumption, and unpack restores it. Return 0 on success; use GNUTLS_E_UNEXPECTED_PACKET_LENGTH for mismatched length fields and GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER for invalid data.

```c
int
_gnutls_foobar_recv_params (gnutls_session_t session, const uint8_t * data,
                     size_t data_size)
{
  return 0;
}

int
_gnutls_foobar_send_params (gnutls_session_t session, gnutls_buffer_st* data)
{
  return 0;
}

int
_gnutls_foobar_pack (extension_priv_data_t epriv, gnutls_buffer_st * ps)
{
   /* Append the extension's internal state to buffer */
   return 0;
}

int
_gnutls_foobar_unpack (gnutls_buffer_st * ps, extension_priv_data_t * epriv)
{
   /* Read the internal state from buffer */
   return 0;
}

```
Tokens:
Raw