[gnutls-help] TLS 1.3 post-handshake authentication vs. exceptions
nmav at gnutls.org
Sat Jun 8 19:32:09 CEST 2019
On Fri, Jun 7, 2019 at 1:04 PM Ludovic Courtès <ludo at gnu.org> wrote:
> AIUI, TLS 1.3 post-handshake authentication requests can happen anytime,
> and thus clients need to be ready to deal with GNUTLS_E_REAUTH_REQUEST
> at any time. In particular, ‘gnutls_record_recv’ might return this
> error, and the client has to call ‘gnutls_reauth’ at that point.
Right. A clarification, that these can happen only if the client or
server has explicitly enabled post-handshake authentication with the
corresponding gnutls_init() flag.
> In the Guile bindings, GnuTLS errors are mapped to Guile exceptions.
> The record layer is mapped to an I/O port, which is the abstraction used
> for file contents, sockets, etc. (similar to FILE* in C).
> The problem here is that you could get a GNUTLS_E_REAUTH_REQUEST
> exception in the middle of a read from an I/O ports. This breaks
> abstraction because the caller of that read call may not know that the
> port happens to be a GnuTLS record port.
That should be similar to GNUTLS_E_REHANDSHAKE error. I'm not sure if
that can be the right solution but there is the option of
More information about the Gnutls-help