6.3 Session initialization

In the previous sections we have discussed the global initialization required for GnuTLS as well as the initialization required for each authentication method’s credentials (see Authentication). In this section we elaborate on the TLS or DTLS session initiation. Each session is initialized using gnutls_init which among others is used to specify the type of the connection (server or client), and the underlying protocol type, i.e., datagram (UDP) or reliable (TCP).

Function: int gnutls_init (gnutls_session_t * session, unsigned int flags)

session: is a pointer to a gnutls_session_t type.

flags: indicate if this session is to be used for server or client.

This function initializes the current session to null. Every session must be initialized before use, so internal structures can be allocated. This function allocates structures which can only be free’d by calling gnutls_deinit() . Returns GNUTLS_E_SUCCESS (0) on success.

flags can be one of GNUTLS_CLIENT , GNUTLS_SERVER , GNUTLS_DATAGRAM , GNUTLS_NONBLOCK or GNUTLS_NOSIGNAL (since 3.4.2).

The flag GNUTLS_NO_REPLAY_PROTECTION will disable any replay protection in DTLS mode. That must only used when replay protection is achieved using other means.

Note that since version 3.1.2 this function enables some common TLS extensions such as session tickets and OCSP certificate status request in client side by default. To prevent that use the GNUTLS_NO_EXTENSIONS flag.

Returns: GNUTLS_E_SUCCESS on success, or an error code.

After the session initialization details on the allowed ciphersuites and protocol versions should be set using the priority functions such as gnutls_priority_set_direct. We elaborate on them in Priority Strings. The credentials used for the key exchange method, such as certificates or usernames and passwords should also be associated with the session current session using gnutls_credentials_set.

Function: int gnutls_credentials_set (gnutls_session_t session, gnutls_credentials_type_t type, void * cred)

session: is a gnutls_session_t type.

type: is the type of the credentials

cred: the credentials to set

Sets the needed credentials for the specified type. Eg username, password - or public and private keys etc. The cred parameter is a structure that depends on the specified type and on the current session (client or server).

In order to minimize memory usage, and share credentials between several threads gnutls keeps a pointer to cred, and not the whole cred structure. Thus you will have to keep the structure allocated until you call gnutls_deinit() .

For GNUTLS_CRD_ANON , cred should be gnutls_anon_client_credentials_t in case of a client. In case of a server it should be gnutls_anon_server_credentials_t .

For GNUTLS_CRD_SRP , cred should be gnutls_srp_client_credentials_t in case of a client, and gnutls_srp_server_credentials_t , in case of a server.

For GNUTLS_CRD_CERTIFICATE , cred should be gnutls_certificate_credentials_t .

Returns: On success, GNUTLS_E_SUCCESS (0) is returned, otherwise a negative error code is returned.