glib2 1.2.5-x86-mingw32 → 1.2.6-x86-mingw32

data/vendor/local/share/info/gnutls.info-2

@@ -1,9 +1,9 @@
 This is gnutls.info, produced by makeinfo version 4.13 from gnutls.texi.
 
-This manual is last updated 17 November 2012 for version 3.1.5 of
-GnuTLS.
+This manual is last updated 21 March 2013 for version 3.1.10 of GnuTLS.
 
-Copyright (C) 2001-2012 Free Software Foundation, Inc.
+Copyright (C) 2001-2013 Free Software Foundation, Inc.\\ Copyright (C)
+2001-2013 Nikos Mavrogiannopoulos
 
      Permission is granted to copy, distribute and/or modify this
      document under the terms of the GNU Free Documentation License,
@@ -28,9 +28,118 @@ START-INFO-DIR-ENTRY
 END-INFO-DIR-ENTRY
 
 
-File: gnutls.info,  Node: Data transfer and termination,  Next: Handling alerts,  Prev: TLS handshake,  Up: How to use GnuTLS in applications
+File: gnutls.info,  Node: DTLS sessions,  Prev: Asynchronous operation,  Up: Setting up the transport layer
 
-8.7 Data transfer and termination
+6.5.2 DTLS sessions
+-------------------
+
+Because datagram TLS can operate over connections where the peer of a
+server cannot be reliably verified, functionality is available to
+prevent denial of service attacks. GnuTLS requires a server to generate
+a secret key that is used to sign a cookie(1).  That cookie is sent to
+the client using *note gnutls_dtls_cookie_send::, and the client must
+reply using the correct cookie. The server side should verify the
+initial message sent by client using *note gnutls_dtls_cookie_verify::.
+If successful the session should be initialized and associated with the
+cookie using *note gnutls_dtls_prestate_set::, before proceeding to the
+handshake.
+
+`INT *note gnutls_key_generate:: (gnutls_datum_t * KEY, unsigned int KEY_SIZE)'
+
+`INT *note gnutls_dtls_cookie_send:: (gnutls_datum_t* KEY, void* CLIENT_DATA, size_t CLIENT_DATA_SIZE, gnutls_dtls_prestate_st* PRESTATE, gnutls_transport_ptr_t PTR, gnutls_push_func PUSH_FUNC)'
+
+`INT *note gnutls_dtls_cookie_verify:: (gnutls_datum_t* KEY, void* CLIENT_DATA, size_t CLIENT_DATA_SIZE, void* _MSG, size_t MSG_SIZE, gnutls_dtls_prestate_st* PRESTATE)'
+
+`VOID *note gnutls_dtls_prestate_set:: (gnutls_session_t SESSION, gnutls_dtls_prestate_st* PRESTATE)'
+
+Note that the above apply to server side only and they are not
+mandatory to be used. Not using them, however, allows denial of service
+attacks.  The client side cookie handling is part of *note
+gnutls_handshake::.
+
+Datagrams are typically restricted by a maximum transfer unit (MTU).
+For that both client and server side should set the correct maximum
+transfer unit for the layer underneath GnuTLS. This will allow proper
+fragmentation of DTLS messages and prevent messages from being silently
+discarded by the transport layer. The "correct" maximum transfer unit
+can be obtained through a path MTU discovery mechanism [_RFC4821_].
+
+`VOID *note gnutls_dtls_set_mtu:: (gnutls_session_t SESSION, unsigned int MTU)'
+
+`UNSIGNED INT *note gnutls_dtls_get_mtu:: (gnutls_session_t SESSION)'
+
+`UNSIGNED INT *note gnutls_dtls_get_data_mtu:: (gnutls_session_t SESSION)'
+
+---------- Footnotes ----------
+
+(1) A key of 128 bits or 16 bytes should be sufficient for this purpose.
+
+
+File: gnutls.info,  Node: TLS handshake,  Next: Data transfer and termination,  Prev: Setting up the transport layer,  Up: How to use GnuTLS in applications
+
+6.6 TLS handshake
+=================
+
+Once a session has been initialized and a network connection has been
+set up, TLS and DTLS protocols perform a handshake. The handshake is
+the actual key exchange.
+
+ -- Function: int gnutls_handshake (gnutls_session_t SESSION)
+     SESSION: is a `gnutls_session_t'  structure.
+
+     This function does the handshake of the TLS/SSL protocol, and
+     initializes the TLS connection.
+
+     This function will fail if any problem is encountered, and will
+     return a negative error code. In case of a client, if the client
+     has asked to resume a session, but the server couldn't, then a
+     full handshake will be performed.
+
+     The non-fatal errors such as `GNUTLS_E_AGAIN'  and
+     `GNUTLS_E_INTERRUPTED'  interrupt the handshake procedure, which
+     should be resumed later.  Call this function again, until it
+     returns 0; cf.  `gnutls_record_get_direction()'  and
+     `gnutls_error_is_fatal()' .
+
+     If this function is called by a server after a rehandshake request
+     then `GNUTLS_E_GOT_APPLICATION_DATA'  or
+     `GNUTLS_E_WARNING_ALERT_RECEIVED'  may be returned.  Note that
+     these are non fatal errors, only in the specific case of a
+     rehandshake.  Their meaning is that the client rejected the
+     rehandshake request or in the case of
+     `GNUTLS_E_GOT_APPLICATION_DATA'  it might also mean that some data
+     were pending.
+
+     *Returns:* `GNUTLS_E_SUCCESS'  on success, otherwise a negative
+     error code.
+
+ -- Function: void gnutls_handshake_set_timeout (gnutls_session_t
+          SESSION, unsigned int MS)
+     SESSION: is a `gnutls_session_t'  structure.
+
+     MS: is a timeout value in milliseconds
+
+     This function sets the timeout for the handshake process to the
+     provided value. Use an  `ms' value of zero to disable timeout.
+
+     Note that in order for the timeout to be enforced
+     `gnutls_transport_set_pull_timeout_function()'  must be set (it is
+     set by default in most systems).
+
+The handshake process doesn't ensure the verification of the peer's
+identity. When certificates are in use, this can be done, either after
+the handshake is complete, or during the handshake if *note
+gnutls_certificate_set_verify_function:: has been used. In both cases
+the *note gnutls_certificate_verify_peers2:: function can be used to
+verify the peer's certificate (see *note Certificate authentication::
+for more information).
+
+`INT *note gnutls_certificate_verify_peers2:: (gnutls_session_t SESSION, unsigned int * STATUS)'
+
+
+File: gnutls.info,  Node: Data transfer and termination,  Next: Buffered data transfer,  Prev: TLS handshake,  Up: How to use GnuTLS in applications
+
+6.7 Data transfer and termination
 =================================
 
 Once the handshake is complete and peer's identity has been verified
@@ -211,9 +320,47 @@ can be deinitialized with the *note gnutls_deinit:: function.
      database if the session was terminated abnormally.
 
 
-File: gnutls.info,  Node: Handling alerts,  Next: Priority Strings,  Prev: Data transfer and termination,  Up: How to use GnuTLS in applications
+File: gnutls.info,  Node: Buffered data transfer,  Next: Handling alerts,  Prev: Data transfer and termination,  Up: How to use GnuTLS in applications
+
+6.8 Buffered data transfer
+==========================
 
-8.8 Handling alerts
+Although *note gnutls_record_send:: is sufficient to transmit data to
+the peer, when many small chunks of data are to be transmitted it is
+inefficient and wastes bandwidth due to the TLS record overhead. In
+that case it is preferrable to combine the small chunks before
+transmission. The following functions provide that functionality.
+
+ -- Function: void gnutls_record_cork (gnutls_session_t SESSION)
+     SESSION: is a `gnutls_session_t'  structure.
+
+     If called `gnutls_record_send()'  will no longer send partial
+     records.  All queued records will be sent when `gnutls_uncork()'
+     is called, or when the maximum record size is reached.
+
+     *Since:* 3.1.9
+
+ -- Function: int gnutls_record_uncork (gnutls_session_t SESSION,
+          unsigned int FLAGS)
+     SESSION: is a `gnutls_session_t'  structure.
+
+     FLAGS: Could be zero or `GNUTLS_RECORD_WAIT'
+
+     This resets the effect of `gnutls_cork()' , and flushes any pending
+     data. If the `GNUTLS_RECORD_WAIT'  flag is specified then this
+     function will block until the data is sent or a fatal error occurs
+     (i.e., the function will retry on `GNUTLS_E_AGAIN'  and
+     `GNUTLS_E_INTERRUPTED' ).
+
+     *Returns:* On success the number of transmitted data is returned,
+     or otherwise a negative error code.
+
+     *Since:* 3.1.9
+
+
+File: gnutls.info,  Node: Handling alerts,  Next: Priority Strings,  Prev: Buffered data transfer,  Up: How to use GnuTLS in applications
+
+6.9 Handling alerts
 ===================
 
 During a TLS connection alert messages may be exchanged by the two
@@ -295,8 +442,8 @@ The Alert Protocol::.
 
 File: gnutls.info,  Node: Priority Strings,  Next: Selecting cryptographic key sizes,  Prev: Handling alerts,  Up: How to use GnuTLS in applications
 
-8.9 Priority strings
-====================
+6.10 Priority strings
+=====================
 
 In order to specify cipher suite preferences on a TLS session there are
 priority functions that accept a string specifying the enabled for the
@@ -338,7 +485,7 @@ NONE            Means nothing is enabled.  This disables even
                protocols and compression methods. It should be
                followed by the algorithms to be enabled.
 
-Table 8.2: Supported initial keywords.
+Table 6.2: Supported initial keywords.
 
 Unless the initial keyword is "NONE" the defaults (in preference order)
 are for TLS protocols TLS 1.2, TLS1.1, TLS1.0, SSL3.0; for compression
@@ -404,7 +551,7 @@ Elliptic        CURVE-SECP192R1, CURVE-SECP224R1,
 curves         CURVE-SECP256R1, CURVE-SECP384R1,
                CURVE-SECP521R1. Catch all is CURVE-ALL.
 
-Table 8.3: The supported algorithm keywords in priority strings.
+Table 6.3: The supported algorithm keywords in priority strings.
 
 Note that the DHE key exchange methods are generally slower(2) than
 their elliptic curves counterpart (ECDHE). Moreover the plain
@@ -445,7 +592,7 @@ Keyword                          Description
                                  version record version in
                                  client hello.
 
-Table 8.4: Special priority string keywords.
+Table 6.4: Special priority string keywords.
 
 Keyword                          Description
 ------------------------------------------------------------------ 
@@ -499,7 +646,7 @@ Keyword                          Description
                                  the certificate chain.
 %VERIFY_ALLOW_X509_V1_CA_CRT      will allow V1 CAs in chains.
 
-Table 8.5: More priority string keywords.
+Table 6.5: More priority string keywords.
 
 Finally the ciphersuites enabled by any priority string can be listed
 using the `gnutls-cli' application (see *note gnutls-cli Invocation::),
@@ -534,7 +681,7 @@ key sizes:: for the acceptable security levels.
 
 File: gnutls.info,  Node: Selecting cryptographic key sizes,  Next: Advanced topics,  Prev: Priority Strings,  Up: How to use GnuTLS in applications
 
-8.10 Selecting cryptographic key sizes
+6.11 Selecting cryptographic key sizes
 ======================================
 
 Because many algorithms are involved in TLS, it is not easy to set a
@@ -562,7 +709,7 @@ bits    and SRP   key     parameter
 128     3248      256     `HIGH'         Long term protection
 256     15424     512     `ULTRA'        Foreseeable future
 
-Table 8.6: Key sizes and security parameters.
+Table 6.6: Key sizes and security parameters.
 
 The first column  provides a security parameter in a number of bits.
 This gives an indication of the number of combinations to be tried by
@@ -621,6 +768,8 @@ Those functions will convert a human understandable security parameter
 of `gnutls_sec_param_t' type, to a number of bits suitable for a public
 key algorithm.
 
+`CONST CHAR * *note gnutls_sec_param_get_name:: (gnutls_sec_param_t PARAM)'
+
 The following functions will set the minimum acceptable group size for
 Diffie-Hellman and SRP authentication.
 `VOID *note gnutls_dh_set_prime_bits:: (gnutls_session_t SESSION, unsigned int BITS)'
@@ -630,7 +779,7 @@ Diffie-Hellman and SRP authentication.
 
 File: gnutls.info,  Node: Advanced topics,  Prev: Selecting cryptographic key sizes,  Up: How to use GnuTLS in applications
 
-8.11 Advanced topics
+6.12 Advanced topics
 ====================
 
 * Menu:
@@ -646,7 +795,7 @@ File: gnutls.info,  Node: Advanced topics,  Prev: Selecting cryptographic key si
 
 File: gnutls.info,  Node: Session resumption,  Next: Certificate verification,  Up: Advanced topics
 
-8.11.1 Session resumption
+6.12.1 Session resumption
 -------------------------
 
 Client side
@@ -754,7 +903,7 @@ otherwise.
 
 File: gnutls.info,  Node: Certificate verification,  Next: Parameter generation,  Prev: Session resumption,  Up: Advanced topics
 
-8.11.2 Certificate verification
+6.12.2 Certificate verification
 -------------------------------
 
 In this section the functionality for additional certificate
@@ -762,7 +911,7 @@ verification methods is listed.  These methods are intended to be used
 in addition to normal PKI verification, in order to reduce the risk of
 a compromised CA being undetected.
 
-8.11.2.1 Trust on first use
+6.12.2.1 Trust on first use
 ...........................
 
 The GnuTLS library includes functionlity to use an SSH-like trust on
@@ -902,7 +1051,7 @@ should contain storage and retrieval functions and specified as below.
 
 `VOID *note gnutls_tdb_set_store_commitment_func:: (gnutls_tdb_t TDB, gnutls_tdb_store_commitment_func CSTORE)'
 
-8.11.2.2 DANE verification
+6.12.2.2 DANE verification
 ..........................
 
 Since the DANE library is not included in GnuTLS it requires programs
@@ -943,7 +1092,8 @@ below.
 
      SFLAGS: Flags for the the initialization of  `s' (if NULL)
 
-     VFLAGS: Verification flags; should be zero
+     VFLAGS: Verification flags; an OR'ed list of `dane_verify_flags_t'
+     .
 
      VERIFY: An OR'ed list of `dane_verify_status_t' .
 
@@ -954,6 +1104,9 @@ below.
      available for the DANE record then the verify flag
      `DANE_VERIFY_NO_DNSSEC_DATA'  is set.
 
+     Note that the CA constraint only applies for the directly
+     certifying CA and does not account for long CA chains.
+
      Due to the many possible options of DANE, there is no single threat
      model countered. When notifying the user about DANE verification
      results it may be better to mention: DANE verification did not
@@ -984,7 +1137,7 @@ by the verify functions to indicate the status of the verification.
 `DANE_VERIFY_NO_DANE_INFO'
      No DANE data were found in the DNS record.
 
-Figure 8.2: The DANE verification status flags.
+Figure 6.2: The DANE verification status flags.
 
 In order to generate a DANE TLSA entry to use in a DNS server you may
 use danetool (see *note danetool Invocation::).
@@ -992,7 +1145,7 @@ use danetool (see *note danetool Invocation::).
 
 File: gnutls.info,  Node: Parameter generation,  Next: Keying Material Exporters,  Prev: Certificate verification,  Up: Advanced topics
 
-8.11.3 Parameter generation
+6.12.3 Parameter generation
 ---------------------------
 
 Several TLS ciphersuites require additional parameters that need to be
@@ -1062,7 +1215,7 @@ interface is available using a callback function.
 
 File: gnutls.info,  Node: Keying Material Exporters,  Next: Channel Bindings,  Prev: Parameter generation,  Up: Advanced topics
 
-8.11.4 Keying material exporters
+6.12.4 Keying material exporters
 --------------------------------
 
 The TLS PRF can be used by other protocols to derive keys based on the
@@ -1087,7 +1240,7 @@ low-level TLS PRF interface called *note gnutls_prf_raw::.
 
 File: gnutls.info,  Node: Channel Bindings,  Next: Interoperability,  Prev: Keying Material Exporters,  Up: Advanced topics
 
-8.11.5 Channel bindings
+6.12.5 Channel bindings
 -----------------------
 
 In user authentication protocols (e.g., EAP or SASL mechanisms) it is
@@ -1128,7 +1281,7 @@ Note that it must be run after a successful TLS handshake.
 
 File: gnutls.info,  Node: Interoperability,  Next: Compatibility with the OpenSSL library,  Prev: Channel Bindings,  Up: Advanced topics
 
-8.11.6 Interoperability
+6.12.6 Interoperability
 -----------------------
 
 The TLS protocols support many ciphersuites, extensions and version
@@ -1160,7 +1313,7 @@ NORMAL:-VERS-TLS-ALL:+VERS-TLS1.0:+VERS-SSL3.0:-CIPHER-ALL:+ARCFOUR-128:%COMPAT
 
 File: gnutls.info,  Node: Compatibility with the OpenSSL library,  Prev: Interoperability,  Up: Advanced topics
 
-8.11.7 Compatibility with the OpenSSL library
+6.12.7 Compatibility with the OpenSSL library
 ---------------------------------------------
 
 To ease GnuTLS' integration with existing applications, a compatibility
@@ -1179,7 +1332,7 @@ compatibility layer include:
 
 File: gnutls.info,  Node: GnuTLS application examples,  Next: Using GnuTLS as a cryptographic library,  Prev: How to use GnuTLS in applications,  Up: Top
 
-9 GnuTLS application examples
+7 GnuTLS application examples
 *****************************
 
 In this chapter several examples of real-world use cases are listed.
@@ -1192,11 +1345,12 @@ no error checking.
 * Server examples::
 * OCSP example::
 * Miscellaneous examples::
+* XSSL examples::
 
 
 File: gnutls.info,  Node: Client examples,  Next: Server examples,  Up: GnuTLS application examples
 
-9.1 Client examples
+7.1 Client examples
 ===================
 
 This section contains examples of TLS and SSL clients, using GnuTLS.
@@ -1222,7 +1376,7 @@ example.
 
 File: gnutls.info,  Node: Simple client example with X.509 certificate support,  Next: Simple client example with SSH-style certificate verification,  Up: Client examples
 
-9.1.1 Simple client example with X.509 certificate support
+7.1.1 Simple client example with X.509 certificate support
 ----------------------------------------------------------
 
 Let's assume now that we want to create a TCP client which communicates
@@ -1245,7 +1399,7 @@ resumption.
 #include "examples.h"
 
 /* A very basic TLS client, with X.509 authentication and server certificate
- * verification. Note that error checking for missing files etc. is missing
+ * verification. Note that error checking for missing files etc. is omitted
  * for simplicity.
  */
 
@@ -1310,7 +1464,7 @@ int main (void)
    */
   sd = tcp_connect ();
 
-  gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) sd);
+  gnutls_transport_set_int (session, sd);
   gnutls_handshake_set_timeout (session, GNUTLS_DEFAULT_HANDSHAKE_TIMEOUT);
 
   /* Perform the TLS handshake
@@ -1329,7 +1483,11 @@ int main (void)
     }
   else
     {
-      printf ("- Handshake was completed\n");
+      char* desc;
+
+      desc = gnutls_session_get_desc(session);
+      printf ("- Session info: %s\n", desc);
+      gnutls_free(desc);
     }
 
   gnutls_record_send (session, MSG, strlen (MSG));
@@ -1340,18 +1498,25 @@ int main (void)
       printf ("- Peer has closed the TLS connection\n");
       goto end;
     }
+  else if (ret < 0 && gnutls_error_is_fatal (ret) == 0)
+    {
+      fprintf (stderr, "*** Warning: %s\n", gnutls_strerror (ret));
+    }
   else if (ret < 0)
     {
       fprintf (stderr, "*** Error: %s\n", gnutls_strerror (ret));
       goto end;
     }
 
-  printf ("- Received %d bytes: ", ret);
-  for (ii = 0; ii < ret; ii++)
+  if (ret > 0)
     {
-      fputc (buffer[ii], stdout);
+      printf ("- Received %d bytes: ", ret);
+      for (ii = 0; ii < ret; ii++)
+        {
+          fputc (buffer[ii], stdout);
+        }
+      fputs ("\n", stdout);
     }
-  fputs ("\n", stdout);
 
   gnutls_bye (session, GNUTLS_SHUT_RDWR);
 
@@ -1415,7 +1580,7 @@ _verify_certificate_callback (gnutls_session_t session)
 
 File: gnutls.info,  Node: Simple client example with SSH-style certificate verification,  Next: Simple client example with anonymous authentication,  Prev: Simple client example with X.509 certificate support,  Up: Client examples
 
-9.1.2 Simple client example with SSH-style certificate verification
+7.1.2 Simple client example with SSH-style certificate verification
 -------------------------------------------------------------------
 
 This is an alternative verification function that will use the X.509
@@ -1539,7 +1704,7 @@ _ssh_verify_certificate_callback (gnutls_session_t session)
 
 File: gnutls.info,  Node: Simple client example with anonymous authentication,  Next: Simple Datagram TLS client example,  Prev: Simple client example with SSH-style certificate verification,  Up: Client examples
 
-9.1.3 Simple client example with anonymous authentication
+7.1.3 Simple client example with anonymous authentication
 ---------------------------------------------------------
 
 The simplest client using TLS is the one that doesn't do any
@@ -1605,7 +1770,7 @@ main (void)
    */
   sd = tcp_connect ();
 
-  gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) sd);
+  gnutls_transport_set_int (session, sd);
   gnutls_handshake_set_timeout (session, GNUTLS_DEFAULT_HANDSHAKE_TIMEOUT);
 
   /* Perform the TLS handshake
@@ -1624,7 +1789,11 @@ main (void)
     }
   else
     {
-      printf ("- Handshake was completed\n");
+      char* desc;
+
+      desc = gnutls_session_get_desc(session);
+      printf ("- Session info: %s\n", desc);
+      gnutls_free(desc);
     }
 
   gnutls_record_send (session, MSG, strlen (MSG));
@@ -1635,18 +1804,25 @@ main (void)
       printf ("- Peer has closed the TLS connection\n");
       goto end;
     }
+  else if (ret < 0 && gnutls_error_is_fatal (ret) == 0)
+    {
+      fprintf (stderr, "*** Warning: %s\n", gnutls_strerror (ret));
+    }
   else if (ret < 0)
     {
       fprintf (stderr, "*** Error: %s\n", gnutls_strerror (ret));
       goto end;
     }
 
-  printf ("- Received %d bytes: ", ret);
-  for (ii = 0; ii < ret; ii++)
+  if (ret > 0)
     {
-      fputc (buffer[ii], stdout);
+      printf ("- Received %d bytes: ", ret);
+      for (ii = 0; ii < ret; ii++)
+        {
+          fputc (buffer[ii], stdout);
+        }
+      fputs ("\n", stdout);
     }
-  fputs ("\n", stdout);
 
   gnutls_bye (session, GNUTLS_SHUT_RDWR);
 
@@ -1666,7 +1842,7 @@ end:
 
 File: gnutls.info,  Node: Simple Datagram TLS client example,  Next: Obtaining session information,  Prev: Simple client example with anonymous authentication,  Up: Client examples
 
-9.1.4 Simple datagram TLS client example
+7.1.4 Simple datagram TLS client example
 ----------------------------------------
 
 This is a client that uses UDP to connect to a server. This is the DTLS
@@ -1739,7 +1915,7 @@ main (void)
   /* connect to the peer */
   sd = udp_connect ();
 
-  gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) sd);
+  gnutls_transport_set_int (session, sd);
 
   /* set the connection MTU */
   gnutls_dtls_set_mtu (session, 1000);
@@ -1750,7 +1926,8 @@ main (void)
     {
       ret = gnutls_handshake (session);
     }
-  while (ret < 0 && gnutls_error_is_fatal (ret) == 0);
+  while (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN);
+  /* Note that DTLS may also receive GNUTLS_E_LARGE_PACKET */
 
   if (ret < 0)
     {
@@ -1760,7 +1937,11 @@ main (void)
     }
   else
     {
-      printf ("- Handshake was completed\n");
+      char* desc;
+
+      desc = gnutls_session_get_desc(session);
+      printf ("- Session info: %s\n", desc);
+      gnutls_free(desc);
     }
 
   gnutls_record_send (session, MSG, strlen (MSG));
@@ -1771,18 +1952,25 @@ main (void)
       printf ("- Peer has closed the TLS connection\n");
       goto end;
     }
+  else if (ret < 0 && gnutls_error_is_fatal (ret) == 0)
+    {
+      fprintf (stderr, "*** Warning: %s\n", gnutls_strerror (ret));
+    }
   else if (ret < 0)
     {
       fprintf (stderr, "*** Error: %s\n", gnutls_strerror (ret));
       goto end;
     }
 
-  printf ("- Received %d bytes: ", ret);
-  for (ii = 0; ii < ret; ii++)
+  if (ret > 0)
     {
-      fputc (buffer[ii], stdout);
+      printf ("- Received %d bytes: ", ret);
+      for (ii = 0; ii < ret; ii++)
+        {
+          fputc (buffer[ii], stdout);
+        }
+      fputs ("\n", stdout);
     }
-  fputs ("\n", stdout);
 
   /* It is suggested not to use GNUTLS_SHUT_RDWR in DTLS
    * connections because the peer's closure message might
@@ -1805,7 +1993,7 @@ end:
 
 File: gnutls.info,  Node: Obtaining session information,  Next: Using a callback to select the certificate to use,  Prev: Simple Datagram TLS client example,  Up: Client examples
 
-9.1.5 Obtaining session information
+7.1.5 Obtaining session information
 -----------------------------------
 
 Most of the times it is desirable to know the security properties of
@@ -1950,7 +2138,7 @@ print_info (gnutls_session_t session)
 
 File: gnutls.info,  Node: Using a callback to select the certificate to use,  Next: Verifying a certificate,  Prev: Obtaining session information,  Up: Client examples
 
-9.1.6 Using a callback to select the certificate to use
+7.1.6 Using a callback to select the certificate to use
 -------------------------------------------------------
 
 There are cases where a client holds several certificate and key pairs,
@@ -2089,7 +2277,7 @@ main (void)
    */
   sd = tcp_connect ();
 
-  gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) sd);
+  gnutls_transport_set_int (session, sd);
 
   /* Perform the TLS handshake
    */
@@ -2103,7 +2291,11 @@ main (void)
     }
   else
     {
-      printf ("- Handshake was completed\n");
+      char* desc;
+
+      desc = gnutls_session_get_desc(session);
+      printf ("- Session info: %s\n", desc);
+      gnutls_free(desc);
     }
 
   gnutls_record_send (session, MSG, strlen (MSG));
@@ -2204,7 +2396,7 @@ cert_callback (gnutls_session_t session,
 
 File: gnutls.info,  Node: Verifying a certificate,  Next: Client using a smart card with TLS,  Prev: Using a callback to select the certificate to use,  Up: Client examples
 
-9.1.7 Verifying a certificate
+7.1.7 Verifying a certificate
 -----------------------------
 
 An example is listed below which uses the high level verification
@@ -2361,7 +2553,7 @@ print_details_func (gnutls_x509_crt_t cert,
 
 File: gnutls.info,  Node: Client using a smart card with TLS,  Next: Client with Resume capability example,  Prev: Verifying a certificate,  Up: Client examples
 
-9.1.8 Using a smart card with TLS
+7.1.8 Using a smart card with TLS
 ---------------------------------
 
 This example will demonstrate how to load keys and certificates from a
@@ -2483,7 +2675,7 @@ main (void)
    */
   sd = tcp_connect ();
 
-  gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) sd);
+  gnutls_transport_set_int (session, sd);
 
   /* Perform the TLS handshake
    */
@@ -2497,7 +2689,11 @@ main (void)
     }
   else
     {
-      printf ("- Handshake was completed\n");
+      char* desc;
+
+      desc = gnutls_session_get_desc(session);
+      printf ("- Session info: %s\n", desc);
+      gnutls_free(desc);
     }
 
   gnutls_record_send (session, MSG, strlen (MSG));
@@ -2540,7 +2736,7 @@ end:
 
 File: gnutls.info,  Node: Client with Resume capability example,  Next: Simple client example with SRP authentication,  Prev: Client using a smart card with TLS,  Up: Client examples
 
-9.1.9 Client with resume capability example
+7.1.9 Client with resume capability example
 -------------------------------------------
 
 This is a modification of the simple client example. Here we
@@ -2609,7 +2805,7 @@ main (void)
           free (session_data);
         }
 
-      gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) sd);
+      gnutls_transport_set_int (session, sd);
       gnutls_handshake_set_timeout (session, GNUTLS_DEFAULT_HANDSHAKE_TIMEOUT);
 
       /* Perform the TLS handshake
@@ -2667,18 +2863,25 @@ main (void)
           printf ("- Peer has closed the TLS connection\n");
           goto end;
         }
+      else if (ret < 0 && gnutls_error_is_fatal (ret) == 0)
+        {
+          fprintf (stderr, "*** Warning: %s\n", gnutls_strerror (ret));
+        }
       else if (ret < 0)
         {
           fprintf (stderr, "*** Error: %s\n", gnutls_strerror (ret));
           goto end;
         }
 
-      printf ("- Received %d bytes: ", ret);
-      for (ii = 0; ii < ret; ii++)
+      if (ret > 0)
         {
-          fputc (buffer[ii], stdout);
+          printf ("- Received %d bytes: ", ret);
+          for (ii = 0; ii < ret; ii++)
+            {
+              fputc (buffer[ii], stdout);
+            }
+          fputs ("\n", stdout);
         }
-      fputs ("\n", stdout);
 
       gnutls_bye (session, GNUTLS_SHUT_RDWR);
 
@@ -2700,7 +2903,7 @@ main (void)
 
 File: gnutls.info,  Node: Simple client example with SRP authentication,  Next: Simple client example in C++,  Prev: Client with Resume capability example,  Up: Client examples
 
-9.1.10 Simple client example with SRP authentication
+7.1.10 Simple client example with SRP authentication
 ----------------------------------------------------
 
 The following client is a very simple SRP TLS client which connects to
@@ -2768,7 +2971,7 @@ main (void)
   gnutls_credentials_set (session, GNUTLS_CRD_SRP, srp_cred);
   gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, cert_cred);
 
-  gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) sd);
+  gnutls_transport_set_int (session, sd);
   gnutls_handshake_set_timeout (session, GNUTLS_DEFAULT_HANDSHAKE_TIMEOUT);
 
   /* Perform the TLS handshake
@@ -2787,7 +2990,11 @@ main (void)
     }
   else
     {
-      printf ("- Handshake was completed\n");
+      char* desc;
+
+      desc = gnutls_session_get_desc(session);
+      printf ("- Session info: %s\n", desc);
+      gnutls_free(desc);
     }
 
   gnutls_record_send (session, MSG, strlen (MSG));
@@ -2837,7 +3044,7 @@ end:
 
 File: gnutls.info,  Node: Simple client example in C++,  Next: Helper functions for TCP connections,  Prev: Simple client example with SRP authentication,  Up: Client examples
 
-9.1.11 Simple client example using the C++ API
+7.1.11 Simple client example using the C++ API
 ----------------------------------------------
 
 The following client is a simple example of a client client utilizing
@@ -2944,7 +3151,7 @@ int main(void)
 
 File: gnutls.info,  Node: Helper functions for TCP connections,  Next: Helper functions for UDP connections,  Prev: Simple client example in C++,  Up: Client examples
 
-9.1.12 Helper functions for TCP connections
+7.1.12 Helper functions for TCP connections
 -------------------------------------------
 
 Those helper function abstract away TCP connection handling from the
@@ -3011,7 +3218,7 @@ tcp_close (int sd)
 
 File: gnutls.info,  Node: Helper functions for UDP connections,  Prev: Helper functions for TCP connections,  Up: Client examples
 
-9.1.13 Helper functions for UDP connections
+7.1.13 Helper functions for UDP connections
 -------------------------------------------
 
 The UDP helper functions abstract away UDP connection handling from the
@@ -3087,7 +3294,7 @@ udp_close (int sd)
 
 File: gnutls.info,  Node: Server examples,  Next: OCSP example,  Prev: Client examples,  Up: GnuTLS application examples
 
-9.2 Server examples
+7.2 Server examples
 ===================
 
 This section contains examples of TLS and SSL servers, using GnuTLS.
@@ -3103,7 +3310,7 @@ This section contains examples of TLS and SSL servers, using GnuTLS.
 
 File: gnutls.info,  Node: Echo server with X.509 authentication,  Next: Echo server with OpenPGP authentication,  Up: Server examples
 
-9.2.1 Echo server with X.509 authentication
+7.2.1 Echo server with X.509 authentication
 -------------------------------------------
 
 This example is a very simple echo server which supports X.509
@@ -3138,34 +3345,13 @@ authentication.
 #define PORT 5556               /* listen to 5556 port */
 
 /* These are global */
-gnutls_certificate_credentials_t x509_cred;
-gnutls_priority_t priority_cache;
-
-static gnutls_session_t
-initialize_tls_session (void)
-{
-  gnutls_session_t session;
-
-  gnutls_init (&session, GNUTLS_SERVER);
-
-  gnutls_priority_set (session, priority_cache);
-
-  gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, x509_cred);
-
-  /* We don't request any certificate from the client.
-   * If we did we would need to verify it.
-   */
-  gnutls_certificate_server_set_request (session, GNUTLS_CERT_IGNORE);
-
-  return session;
-}
-
 static gnutls_dh_params_t dh_params;
 
 static int
 generate_dh_params (void)
 {
-  int bits = gnutls_sec_param_to_pk_bits (GNUTLS_PK_DH, GNUTLS_SEC_PARAM_LOW);
+  unsigned int bits =
+    gnutls_sec_param_to_pk_bits (GNUTLS_PK_DH, GNUTLS_SEC_PARAM_LEGACY);
 
   /* Generate Diffie-Hellman parameters - for use with DHE
    * kx algorithms. When short bit length is used, it might
@@ -3182,6 +3368,8 @@ main (void)
 {
   int listen_sd;
   int sd, ret;
+  gnutls_certificate_credentials_t x509_cred;
+  gnutls_priority_t priority_cache;
   struct sockaddr_in sa_serv;
   struct sockaddr_in sa_cli;
   socklen_t client_len;
@@ -3238,7 +3426,13 @@ main (void)
   client_len = sizeof (sa_cli);
   for (;;)
     {
-      session = initialize_tls_session ();
+      gnutls_init (&session, GNUTLS_SERVER);
+      gnutls_priority_set (session, priority_cache);
+      gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, x509_cred);
+      /* We don't request any certificate from the client.
+       * If we did we would need to verify it.
+       */
+      gnutls_certificate_server_set_request (session, GNUTLS_CERT_IGNORE);
 
       sd = accept (listen_sd, (struct sockaddr *) & sa_cli, &client_len);
 
@@ -3246,7 +3440,7 @@ main (void)
               inet_ntop (AF_INET, &sa_cli.sin_addr, topbuf,
                          sizeof (topbuf)), ntohs (sa_cli.sin_port));
 
-      gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) sd);
+      gnutls_transport_set_int (session, sd);
 
       do
         {
@@ -3269,7 +3463,6 @@ main (void)
 
       for (;;)
         {
-          memset (buffer, 0, MAX_BUF + 1);
           ret = gnutls_record_recv (session, buffer, MAX_BUF);
 
           if (ret == 0)
@@ -3277,6 +3470,10 @@ main (void)
               printf ("\n- Peer has closed the GnuTLS connection\n");
               break;
             }
+          else if (ret < 0 && gnutls_error_is_fatal (ret) == 0)
+            {
+              fprintf (stderr, "*** Warning: %s\n", gnutls_strerror (ret));
+            }
           else if (ret < 0)
             {
               fprintf (stderr, "\n*** Received corrupted "
@@ -3287,7 +3484,7 @@ main (void)
             {
               /* echo data back to the client
                */
-              gnutls_record_send (session, buffer, strlen (buffer));
+              gnutls_record_send (session, buffer, ret);
             }
         }
       printf ("\n");
@@ -3313,7 +3510,7 @@ main (void)
 
 File: gnutls.info,  Node: Echo server with OpenPGP authentication,  Next: Echo server with SRP authentication,  Prev: Echo server with X.509 authentication,  Up: Server examples
 
-9.2.2 Echo server with OpenPGP authentication
+7.2.2 Echo server with OpenPGP authentication
 ---------------------------------------------
 
 The following example is an echo server which supports OpenPGP key
@@ -3350,15 +3547,15 @@ we separated them to keep these examples as simple as possible.
 #define SOCKET_ERR(err,s) if(err==-1) {perror(s);return(1);}
 #define MAX_BUF 1024
 #define PORT 5556               /* listen to 5556 port */
-#define DH_BITS 1024
 
 /* These are global */
-gnutls_certificate_credentials_t cred;
 gnutls_dh_params_t dh_params;
 
 static int
 generate_dh_params (void)
 {
+  unsigned int bits =
+    gnutls_sec_param_to_pk_bits (GNUTLS_PK_DH, GNUTLS_SEC_PARAM_LEGACY);
 
   /* Generate Diffie-Hellman parameters - for use with DHE
    * kx algorithms. These should be discarded and regenerated
@@ -3366,29 +3563,11 @@ generate_dh_params (void)
    * security requirements.
    */
   gnutls_dh_params_init (&dh_params);
-  gnutls_dh_params_generate2 (dh_params, DH_BITS);
+  gnutls_dh_params_generate2 (dh_params, bits);
 
   return 0;
 }
 
-static gnutls_session_t
-initialize_tls_session (void)
-{
-  gnutls_session_t session;
-
-  gnutls_init (&session, GNUTLS_SERVER);
-
-  gnutls_priority_set_direct (session, "NORMAL:+CTYPE-OPENPGP", NULL);
-
-  /* request client certificate if any.
-   */
-  gnutls_certificate_server_set_request (session, GNUTLS_CERT_REQUEST);
-
-  gnutls_dh_set_prime_bits (session, DH_BITS);
-
-  return session;
-}
-
 int
 main (void)
 {
@@ -3399,6 +3578,7 @@ main (void)
   socklen_t client_len;
   char topbuf[512];
   gnutls_session_t session;
+  gnutls_certificate_credentials_t cred;
   char buffer[MAX_BUF + 1];
   int optval = 1;
   char name[256];
@@ -3443,7 +3623,12 @@ main (void)
   client_len = sizeof (sa_cli);
   for (;;)
     {
-      session = initialize_tls_session ();
+      gnutls_init (&session, GNUTLS_SERVER);
+      gnutls_priority_set_direct (session, "NORMAL:+CTYPE-OPENPGP", NULL);
+
+      /* request client certificate if any.
+       */
+      gnutls_certificate_server_set_request (session, GNUTLS_CERT_REQUEST);
 
       sd = accept (listen_sd, (struct sockaddr *) & sa_cli, &client_len);
 
@@ -3451,7 +3636,7 @@ main (void)
               inet_ntop (AF_INET, &sa_cli.sin_addr, topbuf,
                          sizeof (topbuf)), ntohs (sa_cli.sin_port));
 
-      gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) sd);
+      gnutls_transport_set_int (session, sd);
       ret = gnutls_handshake (session);
       if (ret < 0)
         {
@@ -3468,7 +3653,6 @@ main (void)
 
       for (;;)
         {
-          memset (buffer, 0, MAX_BUF + 1);
           ret = gnutls_record_recv (session, buffer, MAX_BUF);
 
           if (ret == 0)
@@ -3476,6 +3660,10 @@ main (void)
               printf ("\n- Peer has closed the GnuTLS connection\n");
               break;
             }
+          else if (ret < 0 && gnutls_error_is_fatal (ret) == 0)
+            {
+              fprintf (stderr, "*** Warning: %s\n", gnutls_strerror (ret));
+            }
           else if (ret < 0)
             {
               fprintf (stderr, "\n*** Received corrupted "
@@ -3486,7 +3674,7 @@ main (void)
             {
               /* echo data back to the client
                */
-              gnutls_record_send (session, buffer, strlen (buffer));
+              gnutls_record_send (session, buffer, ret);
             }
         }
       printf ("\n");
@@ -3511,7 +3699,7 @@ main (void)
 
 File: gnutls.info,  Node: Echo server with SRP authentication,  Next: Echo server with anonymous authentication,  Prev: Echo server with OpenPGP authentication,  Up: Server examples
 
-9.2.3 Echo server with SRP authentication
+7.2.3 Echo server with SRP authentication
 -----------------------------------------
 
 This is a server which supports SRP authentication. It is also possible
@@ -3549,31 +3737,6 @@ separate for simplicity.
 #define MAX_BUF 1024
 #define PORT 5556               /* listen to 5556 port */
 
-/* These are global */
-gnutls_srp_server_credentials_t srp_cred;
-gnutls_certificate_credentials_t cert_cred;
-
-static gnutls_session_t
-initialize_tls_session (void)
-{
-  gnutls_session_t session;
-
-  gnutls_init (&session, GNUTLS_SERVER);
-
-  gnutls_priority_set_direct (session, "NORMAL:-KX-ALL:+SRP:+SRP-DSS:+SRP-RSA", NULL);
-
-  gnutls_credentials_set (session, GNUTLS_CRD_SRP, srp_cred);
-  /* for the certificate authenticated ciphersuites.
-   */
-  gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, cert_cred);
-
-  /* request client certificate if any.
-   */
-  gnutls_certificate_server_set_request (session, GNUTLS_CERT_IGNORE);
-
-  return session;
-}
-
 int
 main (void)
 {
@@ -3584,6 +3747,8 @@ main (void)
   socklen_t client_len;
   char topbuf[512];
   gnutls_session_t session;
+  gnutls_srp_server_credentials_t srp_cred;
+  gnutls_certificate_credentials_t cert_cred;
   char buffer[MAX_BUF + 1];
   int optval = 1;
   char name[256];
@@ -3627,7 +3792,17 @@ main (void)
   client_len = sizeof (sa_cli);
   for (;;)
     {
-      session = initialize_tls_session ();
+      gnutls_init (&session, GNUTLS_SERVER);
+      gnutls_priority_set_direct (session,
+        "NORMAL:-KX-ALL:+SRP:+SRP-DSS:+SRP-RSA", NULL);
+      gnutls_credentials_set (session, GNUTLS_CRD_SRP, srp_cred);
+      /* for the certificate authenticated ciphersuites.
+       */
+      gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, cert_cred);
+
+      /* request client certificate if any.
+       */
+      gnutls_certificate_server_set_request (session, GNUTLS_CERT_IGNORE);
 
       sd = accept (listen_sd, (struct sockaddr *) & sa_cli, &client_len);
 
@@ -3635,7 +3810,7 @@ main (void)
               inet_ntop (AF_INET, &sa_cli.sin_addr, topbuf,
                          sizeof (topbuf)), ntohs (sa_cli.sin_port));
 
-      gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) sd);
+      gnutls_transport_set_int (session, sd);
 
       do
         {
@@ -3658,7 +3833,6 @@ main (void)
 
       for (;;)
         {
-          memset (buffer, 0, MAX_BUF + 1);
           ret = gnutls_record_recv (session, buffer, MAX_BUF);
 
           if (ret == 0)
@@ -3666,6 +3840,10 @@ main (void)
               printf ("\n- Peer has closed the GnuTLS connection\n");
               break;
             }
+          else if (ret < 0 && gnutls_error_is_fatal (ret) == 0)
+            {
+              fprintf (stderr, "*** Warning: %s\n", gnutls_strerror (ret));
+            }
           else if (ret < 0)
             {
               fprintf (stderr, "\n*** Received corrupted "
@@ -3676,7 +3854,7 @@ main (void)
             {
               /* echo data back to the client
                */
-              gnutls_record_send (session, buffer, strlen (buffer));
+              gnutls_record_send (session, buffer, ret);
             }
         }
       printf ("\n");
@@ -3701,7 +3879,7 @@ main (void)
 
 File: gnutls.info,  Node: Echo server with anonymous authentication,  Next: DTLS echo server with X.509 authentication,  Prev: Echo server with SRP authentication,  Up: Server examples
 
-9.2.4 Echo server with anonymous authentication
+7.2.4 Echo server with anonymous authentication
 -----------------------------------------------
 
 This example server supports anonymous authentication, and could be
@@ -3731,40 +3909,22 @@ used to serve the example client for anonymous authentication.
 #define SOCKET_ERR(err,s) if(err==-1) {perror(s);return(1);}
 #define MAX_BUF 1024
 #define PORT 5556               /* listen to 5556 port */
-#define DH_BITS 1024
 
 /* These are global */
-gnutls_anon_server_credentials_t anoncred;
-
-static gnutls_session_t
-initialize_tls_session (void)
-{
-  gnutls_session_t session;
-
-  gnutls_init (&session, GNUTLS_SERVER);
-
-  gnutls_priority_set_direct (session, "NORMAL:+ANON-ECDH:+ANON-DH", NULL);
-
-  gnutls_credentials_set (session, GNUTLS_CRD_ANON, anoncred);
-
-  gnutls_dh_set_prime_bits (session, DH_BITS);
-
-  return session;
-}
-
 static gnutls_dh_params_t dh_params;
 
 static int
 generate_dh_params (void)
 {
-
+  unsigned int bits =
+    gnutls_sec_param_to_pk_bits (GNUTLS_PK_DH, GNUTLS_SEC_PARAM_LEGACY);
   /* Generate Diffie-Hellman parameters - for use with DHE
    * kx algorithms. These should be discarded and regenerated
    * once a day, once a week or once a month. Depending on the
    * security requirements.
    */
   gnutls_dh_params_init (&dh_params);
-  gnutls_dh_params_generate2 (dh_params, DH_BITS);
+  gnutls_dh_params_generate2 (dh_params, bits);
 
   return 0;
 }
@@ -3779,6 +3939,7 @@ main (void)
   socklen_t client_len;
   char topbuf[512];
   gnutls_session_t session;
+  gnutls_anon_server_credentials_t anoncred;
   char buffer[MAX_BUF + 1];
   int optval = 1;
 
@@ -3815,7 +3976,9 @@ main (void)
   client_len = sizeof (sa_cli);
   for (;;)
     {
-      session = initialize_tls_session ();
+      gnutls_init (&session, GNUTLS_SERVER);
+      gnutls_priority_set_direct (session, "NORMAL:+ANON-ECDH:+ANON-DH", NULL);
+      gnutls_credentials_set (session, GNUTLS_CRD_ANON, anoncred);
 
       sd = accept (listen_sd, (struct sockaddr *) & sa_cli, &client_len);
 
@@ -3823,7 +3986,7 @@ main (void)
               inet_ntop (AF_INET, &sa_cli.sin_addr, topbuf,
                          sizeof (topbuf)), ntohs (sa_cli.sin_port));
 
-      gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) ((ptrdiff_t) sd));
+      gnutls_transport_set_int (session, sd);
 
       do
         {
@@ -3846,7 +4009,6 @@ main (void)
 
       for (;;)
         {
-          memset (buffer, 0, MAX_BUF + 1);
           ret = gnutls_record_recv (session, buffer, MAX_BUF);
 
           if (ret == 0)
@@ -3854,6 +4016,10 @@ main (void)
               printf ("\n- Peer has closed the GnuTLS connection\n");
               break;
             }
+          else if (ret < 0 && gnutls_error_is_fatal (ret) == 0)
+            {
+              fprintf (stderr, "*** Warning: %s\n", gnutls_strerror (ret));
+            }
           else if (ret < 0)
             {
               fprintf (stderr, "\n*** Received corrupted "
@@ -3864,7 +4030,7 @@ main (void)
             {
               /* echo data back to the client
                */
-              gnutls_record_send (session, buffer, strlen (buffer));
+              gnutls_record_send (session, buffer, ret);
             }
         }
       printf ("\n");
@@ -3889,7 +4055,7 @@ main (void)
 
 File: gnutls.info,  Node: DTLS echo server with X.509 authentication,  Prev: Echo server with anonymous authentication,  Up: Server examples
 
-9.2.5 DTLS echo server with X.509 authentication
+7.2.5 DTLS echo server with X.509 authentication
 ------------------------------------------------
 
 This example is a very simple echo server using Datagram TLS and X.509
@@ -3942,7 +4108,6 @@ static ssize_t pull_func (gnutls_transport_ptr_t p, void *data, size_t size);
 static const char *human_addr (const struct sockaddr *sa, socklen_t salen,
                                char *buf, size_t buflen);
 static int wait_for_connection (int fd);
-static gnutls_session_t initialize_tls_session (void);
 static int generate_dh_params (void);
 
 /* Use global credentials and parameters to simplify
@@ -4070,7 +4235,10 @@ main (void)
       else
         continue;
 
-      session = initialize_tls_session ();
+      gnutls_init (&session, GNUTLS_SERVER | GNUTLS_DATAGRAM);
+      gnutls_priority_set (session, priority_cache);
+      gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, x509_cred);
+
       gnutls_dtls_prestate_set (session, &prestate);
       gnutls_dtls_set_mtu (session, mtu);
 
@@ -4088,7 +4256,10 @@ main (void)
         {
           ret = gnutls_handshake (session);
         }
-      while (ret < 0 && gnutls_error_is_fatal (ret) == 0);
+      while (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN);
+      /* Note that DTLS may also receive GNUTLS_E_LARGE_PACKET.
+       * In that case the MTU should be adjusted.
+       */
 
       if (ret < 0)
         {
@@ -4109,17 +4280,24 @@ main (void)
             }
           while (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED);
 
-          if (ret < 0)
+          if (ret < 0 && gnutls_error_is_fatal (ret) == 0)
+            {
+              fprintf (stderr, "*** Warning: %s\n", gnutls_strerror (ret));
+              continue;
+            }
+          else if (ret < 0)
             {
               fprintf (stderr, "Error in recv(): %s\n",
                        gnutls_strerror (ret));
               break;
             }
+
           if (ret == 0)
             {
               printf ("EOF\n\n");
               break;
             }
+
           buffer[ret] = 0;
           printf ("received[%.2x%.2x%.2x%.2x%.2x%.2x%.2x%.2x]: %s\n",
                   sequence[0], sequence[1], sequence[2], sequence[3],
@@ -4306,24 +4484,11 @@ human_addr (const struct sockaddr *sa, socklen_t salen,
   return save_buf;
 }
 
-static gnutls_session_t
-initialize_tls_session (void)
-{
-  gnutls_session_t session;
-
-  gnutls_init (&session, GNUTLS_SERVER | GNUTLS_DATAGRAM);
-
-  gnutls_priority_set (session, priority_cache);
-
-  gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, x509_cred);
-
-  return session;
-}
-
 static int
 generate_dh_params (void)
 {
-  int bits = gnutls_sec_param_to_pk_bits (GNUTLS_PK_DH, GNUTLS_SEC_PARAM_LOW);
+  int bits =
+    gnutls_sec_param_to_pk_bits (GNUTLS_PK_DH, GNUTLS_SEC_PARAM_LEGACY);
 
   /* Generate Diffie-Hellman parameters - for use with DHE
    * kx algorithms. When short bit length is used, it might
@@ -4338,7 +4503,7 @@ generate_dh_params (void)
 
 File: gnutls.info,  Node: OCSP example,  Next: Miscellaneous examples,  Prev: Server examples,  Up: GnuTLS application examples
 
-9.3 OCSP example
+7.3 OCSP example
 ================
 
 Generate OCSP request
@@ -4664,9 +4829,9 @@ get_data (void *buffer, size_t size, size_t nmemb, void *userp)
 }
 
 
-File: gnutls.info,  Node: Miscellaneous examples,  Prev: OCSP example,  Up: GnuTLS application examples
+File: gnutls.info,  Node: Miscellaneous examples,  Next: XSSL examples,  Prev: OCSP example,  Up: GnuTLS application examples
 
-9.4 Miscellaneous examples
+7.4 Miscellaneous examples
 ==========================
 
 * Menu:
@@ -4678,7 +4843,7 @@ File: gnutls.info,  Node: Miscellaneous examples,  Prev: OCSP example,  Up: GnuT
 
 File: gnutls.info,  Node: Checking for an alert,  Next: X.509 certificate parsing example,  Up: Miscellaneous examples
 
-9.4.1 Checking for an alert
+7.4.1 Checking for an alert
 ---------------------------
 
 This is a function that checks if an alert has been received in the
@@ -4726,7 +4891,7 @@ check_alert (gnutls_session_t session, int ret)
 
 File: gnutls.info,  Node: X.509 certificate parsing example,  Next: Listing the ciphersuites in a priority string,  Prev: Checking for an alert,  Up: Miscellaneous examples
 
-9.4.2 X.509 certificate parsing example
+7.4.2 X.509 certificate parsing example
 ---------------------------------------
 
 To demonstrate the X.509 parsing capabilities an example program is
@@ -4859,7 +5024,7 @@ print_x509_certificate_info (gnutls_session_t session)
 
 File: gnutls.info,  Node: Listing the ciphersuites in a priority string,  Prev: X.509 certificate parsing example,  Up: Miscellaneous examples
 
-9.4.3 Listing the ciphersuites in a priority string
+7.4.3 Listing the ciphersuites in a priority string
 ---------------------------------------------------
 
 This is a small program to list the enabled ciphersuites by a priority
@@ -4920,11 +5085,224 @@ int main(int argc, char** argv)
     print_cipher_suite_list (argv[1]);
 }
 
+
+File: gnutls.info,  Node: XSSL examples,  Prev: Miscellaneous examples,  Up: GnuTLS application examples
+
+7.5 XSSL examples
+=================
+
+XSSL is an experimental API available in the `gnutls-xssl' library and
+in `gnutls/xssl.h' header. It is intended to be a very simple to use
+API avoid the GnuTLS API. The API however has the following limitations
+   * It is applicable to blocking sockets only.
+
+   * The server verification is based on its DNS name.
+
+* Menu:
+
+* Example client with X.509 certificate authentication::
+* Example client with X.509 certificate authentication and TOFU::
+
+
+File: gnutls.info,  Node: Example client with X.509 certificate authentication,  Next: Example client with X.509 certificate authentication and TOFU,  Up: XSSL examples
+
+7.5.1 Example client with X.509 certificate authentication
+----------------------------------------------------------
+
+/* This example code is placed in the public domain. */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <gnutls/gnutls.h>
+#include <gnutls/xssl.h>
+#include "examples.h"
+
+/* A simple TLS client, with X.509 authentication. Certificate verification
+ * is explicit.
+ */
+
+extern int tcp_connect (void);
+extern void tcp_close (int sd);
+
+int main (void)
+{
+  int ret;
+  char *line = NULL;
+  size_t line_len;
+  xssl_cred_t cred;
+  xssl_t sb;
+  unsigned int status;
+  int fd;
+
+  gnutls_global_init ();
+
+  fd = tcp_connect ();
+
+  ret = xssl_cred_init(&cred, GNUTLS_VMETHOD_SYSTEM_CAS, NULL, 0);
+  if (ret < 0)
+    exit(1);
+
+  /* Initialize TLS session
+   */
+  ret = xssl_client_init(&sb, "www.example.com", NULL,
+                         (gnutls_transport_ptr_t)fd,
+			 NULL, cred, &status, 0);
+  if (ret < 0)
+    {
+      if (ret == GNUTLS_E_AUTH_ERROR)
+        {
+          gnutls_datum_t txt;
+
+          gnutls_certificate_verification_status_print(status, GNUTLS_CRT_X509,
+            &txt, 0);
+
+          fprintf(stderr, "Verification error (%x): %s\n", status, txt.data);
+          gnutls_free(txt.data);
+        }
+      exit(1);
+    }
+
+#define REQ "GET / HTTP/1.0\r\n"
+  ret = xssl_write(sb, REQ, sizeof(REQ)-1);
+  if (ret < 0)
+    exit(1);
+
+  do
+    {
+      ret = xssl_getline(sb, &line, &line_len);
+      if (ret < 0)
+        exit(1);
+
+      fprintf(stderr, "received: %s\n", line);
+    }
+  while (ret >= 0);
+
+  gnutls_free(line);
+
+  xssl_deinit(sb);
+
+  tcp_close (fd);
+
+  xssl_cred_deinit (cred);
+
+  gnutls_global_deinit ();
+}
+
+
+File: gnutls.info,  Node: Example client with X.509 certificate authentication and TOFU,  Prev: Example client with X.509 certificate authentication,  Up: XSSL examples
+
+7.5.2 Example client with X.509 certificate authentication and TOFU
+-------------------------------------------------------------------
+
+/* This example code is placed in the public domain. */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <gnutls/gnutls.h>
+#include <gnutls/xssl.h>
+#include "examples.h"
+
+/* A simple TLS client, with X.509 authentication. Certificate verification
+ * with a fixed CA, and trust on first use.
+ */
+
+extern int tcp_connect (void);
+extern void tcp_close (int sd);
+
+int main (void)
+{
+  int ret;
+  char *line = NULL;
+  size_t line_len;
+  xssl_cred_t cred;
+  xssl_t sb;
+  gnutls_cinput_st aux[2];
+  unsigned aux_size = 0;
+  unsigned int status;
+  int fd;
+
+  gnutls_global_init ();
+
+  fd = tcp_connect ();
+
+  aux[aux_size].type = GNUTLS_CINPUT_TYPE_FILE;
+  aux[aux_size].contents = GNUTLS_CINPUT_CAS;
+  aux[aux_size].fmt = GNUTLS_X509_FMT_PEM;
+  aux[aux_size].i1.file = "/path/to/ca/file";
+  aux_size++;
+
+  /* This may be skipped to use the default DB file */
+  aux[aux_size].type = GNUTLS_CINPUT_TYPE_FILE;
+  aux[aux_size].contents = GNUTLS_CINPUT_TOFU_DB;
+  aux[aux_size].i1.file = "/path/to/trust/db/file";
+  aux_size++;
+
+  ret = xssl_cred_init(&cred, GNUTLS_VMETHOD_GIVEN_CAS|GNUTLS_VMETHOD_TOFU,
+                       aux, aux_size);
+  if (ret < 0)
+    exit(1);
+
+  /* Initialize TLS session
+   */
+  ret = xssl_client_init(&sb, "www.example.com", NULL,
+                         (gnutls_transport_ptr_t)fd,
+			 NULL, cred, &status, 0);
+  if (ret < 0)
+    {
+      if (ret == GNUTLS_E_AUTH_ERROR)
+        {
+          gnutls_datum_t txt;
+
+          gnutls_certificate_verification_status_print(status, GNUTLS_CRT_X509,
+            &txt, 0);
+
+          fprintf(stderr, "Verification error (%x): %s\n", status, txt.data);
+          gnutls_free(txt.data);
+        }
+      exit(1);
+    }
+
+#define REQ "GET / HTTP/1.0\r\n"
+  ret = xssl_write(sb, REQ, sizeof(REQ)-1);
+  if (ret < 0)
+    exit(1);
+
+  do
+    {
+      ret = xssl_getline(sb, &line, &line_len);
+      if (ret < 0)
+        exit(1);
+
+      fprintf(stderr, "received: %s\n", line);
+    }
+  while (ret >= 0);
+
+  gnutls_free(line);
+
+  xssl_deinit(sb);
+
+  tcp_close (fd);
+
+  xssl_cred_deinit (cred);
+
+  gnutls_global_deinit ();
+}
+
 
 File: gnutls.info,  Node: Using GnuTLS as a cryptographic library,  Next: Other included programs,  Prev: GnuTLS application examples,  Up: Top
 
-10 Using GnuTLS as a cryptographic library
-******************************************
+8 Using GnuTLS as a cryptographic library
+*****************************************
 
 GnuTLS is not a low-level cryptographic library, i.e., it does not
 provide access to basic cryptographic primitives. However it abstracts
@@ -4934,15 +5312,15 @@ the random number generation.
 
 * Menu:
 
-* Symmetric cryptography::
+* Encryption algorithms::
 * Hash and HMAC functions::
 * Random number generation::
 
 
-File: gnutls.info,  Node: Symmetric cryptography,  Next: Hash and HMAC functions,  Up: Using GnuTLS as a cryptographic library
+File: gnutls.info,  Node: Encryption algorithms,  Next: Hash and HMAC functions,  Up: Using GnuTLS as a cryptographic library
 
-10.1 Symmetric cryptography
-===========================
+8.1 Encryption algorithms
+=========================
 
 The available functions to access symmetric crypto algorithms operations
 are shown below. The supported algorithms are the algorithms required
@@ -4967,10 +5345,10 @@ associated data and retrieve the authentication tag.
 `INT *note gnutls_cipher_tag:: (gnutls_cipher_hd_t HANDLE, void * TAG, size_t TAG_SIZE)'
 
 
-File: gnutls.info,  Node: Hash and HMAC functions,  Next: Random number generation,  Prev: Symmetric cryptography,  Up: Using GnuTLS as a cryptographic library
+File: gnutls.info,  Node: Hash and HMAC functions,  Next: Random number generation,  Prev: Encryption algorithms,  Up: Using GnuTLS as a cryptographic library
 
-10.2 Hash and HMAC functions
-============================
+8.2 Hash and HMAC functions
+===========================
 
 The available operations to access hash functions and hash-MAC (HMAC)
 algorithms are shown below. HMAC algorithms provided keyed hash
@@ -5004,11 +5382,13 @@ supported hash functions are the same as the HMAC algorithms.
 
 `INT *note gnutls_hash_fast:: (gnutls_digest_algorithm_t ALGORITHM, const void * TEXT, size_t TEXTLEN, void * DIGEST)'
 
+`INT *note gnutls_fingerprint:: (gnutls_digest_algorithm_t ALGO, const gnutls_datum_t * DATA, void * RESULT, size_t * RESULT_SIZE)'
+
 
 File: gnutls.info,  Node: Random number generation,  Prev: Hash and HMAC functions,  Up: Using GnuTLS as a cryptographic library
 
-10.3 Random number generation
-=============================
+8.3 Random number generation
+============================
 
 Access to the random number generator is provided using the *note
 gnutls_rnd:: function. It allows obtaining random data of various
@@ -5025,7 +5405,7 @@ levels.
 `GNUTLS_RND_KEY'
      Fatal in many sessions if broken.
 
-Figure 10.1: The random number levels.
+Figure 8.1: The random number levels.
 
  -- Function: int gnutls_rnd (gnutls_rnd_level_t LEVEL, void * DATA,
           size_t LEN)
@@ -5045,8 +5425,8 @@ Figure 10.1: The random number levels.
 
 File: gnutls.info,  Node: Other included programs,  Next: Internal architecture of GnuTLS,  Prev: Using GnuTLS as a cryptographic library,  Up: Top
 
-11 Other included programs
-**************************
+9 Other included programs
+*************************
 
 Included with GnuTLS are also a few command line tools that let you use
 the library for common tasks without writing an application.  The
@@ -5061,8 +5441,8 @@ applications are discussed in this chapter.
 
 File: gnutls.info,  Node: gnutls-cli Invocation,  Next: gnutls-serv Invocation,  Up: Other included programs
 
-11.1 Invoking gnutls-cli
-========================
+9.1 Invoking gnutls-cli
+=======================
 
 Simple client program to set up a TLS connection to some other computer.
 It sets up a TLS connection and forwards data from the standard input
@@ -5084,7 +5464,7 @@ platforms without a working `fork(2)' function.  The `PAGER'
 environment variable is used to select the program, defaulting to
 `more'.  Both will exit with a status code of 0.
 
-gnutls-cli - GnuTLS client - Ver. 3.1.5
+gnutls-cli - GnuTLS client - Ver. 3.1.10
 USAGE:  gnutls-cli [ -<flag> [<val>] | --<name>[{=| }<val>] ]... [hostname]
 
    -d, --debug=num            Enable debugging.
@@ -5141,11 +5521,13 @@ USAGE:  gnutls-cli [ -<flag> [<val>] | --<name>[{=| }<val>] ]... [hostname]
        --pskkey=str           PSK key (in hex) to use
    -p, --port=str             The port or service to connect to
        --insecure             Don't abort program if server certificate can't be validated
+       --ranges               Use length-hiding padding to prevent traffic analysis
        --benchmark-ciphers    Benchmark individual ciphers
        --benchmark-soft-ciphers  Benchmark individual software ciphers (no hw acceleration)
        --benchmark-tls-kx     Benchmark TLS key exchange methods
        --benchmark-tls-ciphers  Benchmark TLS ciphers
    -l, --list                 Print a list of the supported algorithms and modes
+       --disable-sni          Do not send a Server Name Indication (SNI)
    -v, --version[=arg]        Output version information and exit
    -h, --help                 Display extended usage information and exit
    -!, --more-help            Extended usage information passed thru pager
@@ -5251,6 +5633,13 @@ sets of ciphersuites such as PERFORMANCE, NORMAL, SECURE128, SECURE256.
 Check  the  GnuTLS  manual  on  section  "Priority strings" for more
 information on allowed keywords
 
+ranges option
+-------------
+
+This is the "use length-hiding padding to prevent traffic analysis"
+option.  When possible (e.g., when %NEW_PADDING is specified), use
+length-hiding padding to prevent traffic analysis.
+
 list option (-l)
 ----------------
 
@@ -5321,8 +5710,8 @@ To list the ciphersuites in a priority string:
 
 File: gnutls.info,  Node: gnutls-serv Invocation,  Next: gnutls-cli-debug Invocation,  Prev: gnutls-cli Invocation,  Up: Other included programs
 
-11.2 Invoking gnutls-serv
-=========================
+9.2 Invoking gnutls-serv
+========================
 
 Server program that listens to incoming TLS connections.
 
@@ -5342,7 +5731,7 @@ platforms without a working `fork(2)' function.  The `PAGER'
 environment variable is used to select the program, defaulting to
 `more'.  Both will exit with a status code of 0.
 
-gnutls-serv - GnuTLS server - Ver. 3.1.5
+gnutls-serv - GnuTLS server - Ver. 3.1.10
 USAGE:  gnutls-serv [ -<flag> [<val>] | --<name>[{=| }<val>] ]...
 
    -d, --debug=num            Enable debugging.
@@ -5600,8 +5989,8 @@ get this command:
 
 File: gnutls.info,  Node: gnutls-cli-debug Invocation,  Prev: gnutls-serv Invocation,  Up: Other included programs
 
-11.3 Invoking gnutls-cli-debug
-==============================
+9.3 Invoking gnutls-cli-debug
+=============================
 
 TLS debug client. It sets up multiple TLS connections to a server and
 queries its capabilities. It was created to assist in debugging GnuTLS,
@@ -5626,7 +6015,7 @@ platforms without a working `fork(2)' function.  The `PAGER'
 environment variable is used to select the program, defaulting to
 `more'.  Both will exit with a status code of 0.
 
-gnutls-cli-debug - GnuTLS debug client - Ver. 3.1.5
+gnutls-cli-debug - GnuTLS debug client - Ver. 3.1.10
 USAGE:  gnutls-cli-debug [ -<flag> [<val>] | --<name>[{=| }<val>] ]...
 
    -d, --debug=num            Enable debugging.
@@ -5729,7 +6118,7 @@ gnutls-cli-debug Examples
 
 File: gnutls.info,  Node: Internal architecture of GnuTLS,  Next: Upgrading from previous versions,  Prev: Other included programs,  Up: Top
 
-12 Internal Architecture of GnuTLS
+10 Internal Architecture of GnuTLS
 **********************************
 
 This chapter is to give a brief description of the way GnuTLS works.
@@ -5747,7 +6136,7 @@ to know what happens inside the black box.
 
 File: gnutls.info,  Node: The TLS Protocol,  Next: TLS Handshake Protocol,  Up: Internal architecture of GnuTLS
 
-12.1 The TLS Protocol
+10.1 The TLS Protocol
 =====================
 
 The main use case for the TLS protocol is shown in *note
@@ -5758,12 +6147,12 @@ with the peer and be able to exchange data.
 
 [image src="gnutls-client-server-use-case.png"]
 
-Figure 12.1: TLS protocol use case.
+Figure 10.1: TLS protocol use case.
 
 
 File: gnutls.info,  Node: TLS Handshake Protocol,  Next: TLS Authentication Methods,  Prev: The TLS Protocol,  Up: Internal architecture of GnuTLS
 
-12.2 TLS Handshake Protocol
+10.2 TLS Handshake Protocol
 ===========================
 
 The GnuTLS handshake protocol is implemented as a state machine that
@@ -5773,7 +6162,7 @@ fig:gnutls-handshake::.
 
 [image src="gnutls-handshake-state.png"]
 
-Figure 12.2: GnuTLS handshake state machine.
+Figure 10.2: GnuTLS handshake state machine.
 
 Also the way the input is processed varies per ciphersuite. Several
 implementations of the internal handlers are available and *note
@@ -5784,12 +6173,12 @@ illustrate the idea in *note fig:gnutls-handshake-sequence::.
 
 [image src="gnutls-handshake-sequence.png"]
 
-Figure 12.3: GnuTLS handshake process sequence.
+Figure 10.3: GnuTLS handshake process sequence.
 
 
 File: gnutls.info,  Node: TLS Authentication Methods,  Next: TLS Extension Handling,  Prev: TLS Handshake Protocol,  Up: Internal architecture of GnuTLS
 
-12.3 TLS Authentication Methods
+10.3 TLS Authentication Methods
 ===============================
 
 In GnuTLS authentication methods can be implemented quite easily.
@@ -5837,7 +6226,7 @@ its pointers has to be registered in `gnutls_algorithms.c' in the
 
 File: gnutls.info,  Node: TLS Extension Handling,  Next: Cryptographic Backend,  Prev: TLS Authentication Methods,  Up: Internal architecture of GnuTLS
 
-12.4 TLS Extension Handling
+10.4 TLS Extension Handling
 ===========================
 
 As with authentication methods, the TLS extensions handlers can be
@@ -5891,7 +6280,7 @@ make the extension be enabled by default.  Look at existing checks
     fi
     AM_CONDITIONAL(ENABLE_FOOBAR, test "$ac_enable_foobar" != "no")
 
-These lines should go in `lib/m4/hooks.m4'.
+These lines should go in `m4/hooks.m4'.
 
 Add IANA extension value to `extensions_t' in `gnutls_int.h'.
 .............................................................
@@ -6162,7 +6551,7 @@ Another way is to run capabilities check with:
 
 File: gnutls.info,  Node: Cryptographic Backend,  Prev: TLS Extension Handling,  Up: Internal architecture of GnuTLS
 
-12.5 Cryptographic Backend
+10.5 Cryptographic Backend
 ==========================
 
 Today most new processors, either for embedded or desktop systems
@@ -6176,7 +6565,7 @@ to accessing cryptographic operations as in *note fig:crypto-layers::.
 
 [image src="gnutls-crypto-layers.png"]
 
-Figure 12.4: GnuTLS cryptographic back-end design.
+Figure 10.4: GnuTLS cryptographic back-end design.
 
 The TLS layer uses a cryptographic provider layer, that will in turn
 either use the default crypto provider - a software crypto library, or
@@ -6785,6 +7174,10 @@ expressions.
                                           status (OCSP).
 -341        GNUTLS_E_OCSP_RESPONSE_ERROR  The OCSP response is
                                           invalid
+-342        GNUTLS_E_RANDOM_DEVICE_ERROR  Error in the system's
+                                          randomness device.
+-343        GNUTLS_E_AUTH_ERROR           Could not authenticate
+                                          peer.
 
 
 File: gnutls.info,  Node: Supported ciphersuites,  Next: API reference,  Prev: Error codes,  Up: Top
@@ -6797,37 +7190,19 @@ Ciphersuites
 
 Ciphersuite name                            TLS ID         Since
 -------------------------------------------------------------------------- 
-TLS_DH_ANON_ARCFOUR_MD5                     0x00 0x18      SSL3.0
-TLS_DH_ANON_3DES_EDE_CBC_SHA1               0x00 0x1B      SSL3.0
-TLS_DH_ANON_AES_128_CBC_SHA1                0x00 0x34      SSL3.0
-TLS_DH_ANON_AES_256_CBC_SHA1                0x00 0x3A      SSL3.0
-TLS_DH_ANON_CAMELLIA_128_CBC_SHA1           0x00 0x46      TLS1.0
-TLS_DH_ANON_CAMELLIA_256_CBC_SHA1           0x00 0x89      TLS1.0
-TLS_DH_ANON_AES_128_CBC_SHA256              0x00 0x6C      TLS1.2
-TLS_DH_ANON_AES_256_CBC_SHA256              0x00 0x6D      TLS1.2
-TLS_PSK_SHA_ARCFOUR_SHA1                    0x00 0x8A      TLS1.0
-TLS_PSK_SHA_3DES_EDE_CBC_SHA1               0x00 0x8B      TLS1.0
-TLS_PSK_SHA_AES_128_CBC_SHA1                0x00 0x8C      TLS1.0
-TLS_PSK_SHA_AES_256_CBC_SHA1                0x00 0x8D      TLS1.0
-TLS_PSK_AES_128_CBC_SHA256                  0x00 0xAE      TLS1.0
-TLS_PSK_AES_128_GCM_SHA256                  0x00 0xA8      TLS1.2
-TLS_PSK_NULL_SHA256                         0x00 0xB0      TLS1.0
-TLS_DHE_PSK_SHA_ARCFOUR_SHA1                0x00 0x8E      TLS1.0
-TLS_DHE_PSK_SHA_3DES_EDE_CBC_SHA1           0x00 0x8F      TLS1.0
-TLS_DHE_PSK_SHA_AES_128_CBC_SHA1            0x00 0x90      TLS1.0
-TLS_DHE_PSK_SHA_AES_256_CBC_SHA1            0x00 0x91      TLS1.0
-TLS_DHE_PSK_AES_128_CBC_SHA256              0x00 0xB2      TLS1.0
-TLS_DHE_PSK_AES_128_GCM_SHA256              0x00 0xAA      TLS1.2
-TLS_DHE_PSK_NULL_SHA256                     0x00 0xB4      TLS1.0
-TLS_SRP_SHA_3DES_EDE_CBC_SHA1               0xC0 0x1A      TLS1.0
-TLS_SRP_SHA_AES_128_CBC_SHA1                0xC0 0x1D      TLS1.0
-TLS_SRP_SHA_AES_256_CBC_SHA1                0xC0 0x20      TLS1.0
-TLS_SRP_SHA_DSS_3DES_EDE_CBC_SHA1           0xC0 0x1C      TLS1.0
-TLS_SRP_SHA_RSA_3DES_EDE_CBC_SHA1           0xC0 0x1B      TLS1.0
-TLS_SRP_SHA_DSS_AES_128_CBC_SHA1            0xC0 0x1F      TLS1.0
-TLS_SRP_SHA_RSA_AES_128_CBC_SHA1            0xC0 0x1E      TLS1.0
-TLS_SRP_SHA_DSS_AES_256_CBC_SHA1            0xC0 0x22      TLS1.0
-TLS_SRP_SHA_RSA_AES_256_CBC_SHA1            0xC0 0x21      TLS1.0
+TLS_RSA_NULL_MD5                            0x00 0x01      SSL3.0
+TLS_RSA_NULL_SHA1                           0x00 0x02      SSL3.0
+TLS_RSA_NULL_SHA256                         0x00 0x3B      TLS1.2
+TLS_RSA_ARCFOUR_SHA1                        0x00 0x05      SSL3.0
+TLS_RSA_ARCFOUR_MD5                         0x00 0x04      SSL3.0
+TLS_RSA_3DES_EDE_CBC_SHA1                   0x00 0x0A      SSL3.0
+TLS_RSA_AES_128_CBC_SHA1                    0x00 0x2F      SSL3.0
+TLS_RSA_AES_256_CBC_SHA1                    0x00 0x35      SSL3.0
+TLS_RSA_CAMELLIA_128_CBC_SHA1               0x00 0x41      TLS1.0
+TLS_RSA_CAMELLIA_256_CBC_SHA1               0x00 0x84      TLS1.0
+TLS_RSA_AES_128_CBC_SHA256                  0x00 0x3C      TLS1.2
+TLS_RSA_AES_256_CBC_SHA256                  0x00 0x3D      TLS1.2
+TLS_RSA_AES_128_GCM_SHA256                  0x00 0x9C      TLS1.2
 TLS_DHE_DSS_ARCFOUR_SHA1                    0x00 0x66      TLS1.0
 TLS_DHE_DSS_3DES_EDE_CBC_SHA1               0x00 0x13      SSL3.0
 TLS_DHE_DSS_AES_128_CBC_SHA1                0x00 0x32      SSL3.0
@@ -6843,27 +7218,8 @@ TLS_DHE_RSA_CAMELLIA_128_CBC_SHA1           0x00 0x45      TLS1.0
 TLS_DHE_RSA_CAMELLIA_256_CBC_SHA1           0x00 0x88      TLS1.0
 TLS_DHE_RSA_AES_128_CBC_SHA256              0x00 0x67      TLS1.2
 TLS_DHE_RSA_AES_256_CBC_SHA256              0x00 0x6B      TLS1.2
-TLS_RSA_NULL_MD5                            0x00 0x01      SSL3.0
-TLS_RSA_NULL_SHA1                           0x00 0x02      SSL3.0
-TLS_RSA_NULL_SHA256                         0x00 0x3B      TLS1.2
-TLS_RSA_EXPORT_ARCFOUR_40_MD5               0x00 0x03      SSL3.0
-TLS_RSA_ARCFOUR_SHA1                        0x00 0x05      SSL3.0
-TLS_RSA_ARCFOUR_MD5                         0x00 0x04      SSL3.0
-TLS_RSA_3DES_EDE_CBC_SHA1                   0x00 0x0A      SSL3.0
-TLS_RSA_AES_128_CBC_SHA1                    0x00 0x2F      SSL3.0
-TLS_RSA_AES_256_CBC_SHA1                    0x00 0x35      SSL3.0
-TLS_RSA_CAMELLIA_128_CBC_SHA1               0x00 0x41      TLS1.0
-TLS_RSA_CAMELLIA_256_CBC_SHA1               0x00 0x84      TLS1.0
-TLS_RSA_AES_128_CBC_SHA256                  0x00 0x3C      TLS1.2
-TLS_RSA_AES_256_CBC_SHA256                  0x00 0x3D      TLS1.2
-TLS_RSA_AES_128_GCM_SHA256                  0x00 0x9C      TLS1.2
 TLS_DHE_RSA_AES_128_GCM_SHA256              0x00 0x9E      TLS1.2
 TLS_DHE_DSS_AES_128_GCM_SHA256              0x00 0xA2      TLS1.2
-TLS_DH_ANON_AES_128_GCM_SHA256              0x00 0xA6      TLS1.2
-TLS_ECDH_ANON_NULL_SHA1                     0xC0 0x15      TLS1.0
-TLS_ECDH_ANON_3DES_EDE_CBC_SHA1             0xC0 0x17      TLS1.0
-TLS_ECDH_ANON_AES_128_CBC_SHA1              0xC0 0x18      TLS1.0
-TLS_ECDH_ANON_AES_256_CBC_SHA1              0xC0 0x19      TLS1.0
 TLS_ECDHE_RSA_NULL_SHA1                     0xC0 0x10      TLS1.0
 TLS_ECDHE_RSA_3DES_EDE_CBC_SHA1             0xC0 0x12      TLS1.0
 TLS_ECDHE_RSA_AES_128_CBC_SHA1              0xC0 0x13      TLS1.0
@@ -6876,6 +7232,9 @@ TLS_ECDHE_ECDSA_AES_128_CBC_SHA256          0xC0 0x23      TLS1.2
 TLS_ECDHE_RSA_AES_128_CBC_SHA256            0xC0 0x27      TLS1.2
 TLS_ECDHE_ECDSA_AES_128_GCM_SHA256          0xC0 0x2B      TLS1.2
 TLS_ECDHE_RSA_AES_128_GCM_SHA256            0xC0 0x2F      TLS1.2
+TLS_ECDHE_ECDSA_AES_256_GCM_SHA384          0xC0 0x2C      TLS1.2
+TLS_ECDHE_RSA_AES_256_GCM_SHA384            0xC0 0x30      TLS1.2
+TLS_ECDHE_ECDSA_AES_256_CBC_SHA384          0xC0 0x24      TLS1.2
 TLS_ECDHE_PSK_3DES_EDE_CBC_SHA1             0xC0 0x34      TLS1.0
 TLS_ECDHE_PSK_AES_128_CBC_SHA1              0xC0 0x35      TLS1.0
 TLS_ECDHE_PSK_AES_256_CBC_SHA1              0xC0 0x36      TLS1.0
@@ -6883,11 +7242,45 @@ TLS_ECDHE_PSK_AES_128_CBC_SHA256            0xC0 0x37      TLS1.0
 TLS_ECDHE_PSK_AES_256_CBC_SHA384            0xC0 0x38      TLS1.0
 TLS_ECDHE_PSK_NULL_SHA256                   0xC0 0x3A      TLS1.0
 TLS_ECDHE_PSK_NULL_SHA384                   0xC0 0x3B      TLS1.0
-TLS_ECDHE_ECDSA_AES_256_GCM_SHA384          0xC0 0x2C      TLS1.2
-TLS_ECDHE_RSA_AES_256_GCM_SHA384            0xC0 0x30      TLS1.2
-TLS_ECDHE_ECDSA_AES_256_CBC_SHA384          0xC0 0x24      TLS1.2
+TLS_PSK_SHA_ARCFOUR_SHA1                    0x00 0x8A      TLS1.0
+TLS_PSK_SHA_3DES_EDE_CBC_SHA1               0x00 0x8B      TLS1.0
+TLS_PSK_SHA_AES_128_CBC_SHA1                0x00 0x8C      TLS1.0
+TLS_PSK_SHA_AES_256_CBC_SHA1                0x00 0x8D      TLS1.0
+TLS_PSK_AES_128_CBC_SHA256                  0x00 0xAE      TLS1.0
+TLS_PSK_AES_128_GCM_SHA256                  0x00 0xA8      TLS1.2
+TLS_PSK_NULL_SHA256                         0x00 0xB0      TLS1.0
+TLS_DHE_PSK_SHA_ARCFOUR_SHA1                0x00 0x8E      TLS1.0
+TLS_DHE_PSK_SHA_3DES_EDE_CBC_SHA1           0x00 0x8F      TLS1.0
+TLS_DHE_PSK_SHA_AES_128_CBC_SHA1            0x00 0x90      TLS1.0
+TLS_DHE_PSK_SHA_AES_256_CBC_SHA1            0x00 0x91      TLS1.0
+TLS_DHE_PSK_AES_128_CBC_SHA256              0x00 0xB2      TLS1.0
+TLS_DHE_PSK_AES_128_GCM_SHA256              0x00 0xAA      TLS1.2
+TLS_DHE_PSK_NULL_SHA256                     0x00 0xB4      TLS1.0
 TLS_PSK_WITH_AES_256_GCM_SHA384             0x00 0xA9      TLS1.2
 TLS_DHE_PSK_WITH_AES_256_GCM_SHA384         0x00 0xAB      TLS1.2
+TLS_DH_ANON_ARCFOUR_MD5                     0x00 0x18      SSL3.0
+TLS_DH_ANON_3DES_EDE_CBC_SHA1               0x00 0x1B      SSL3.0
+TLS_DH_ANON_AES_128_CBC_SHA1                0x00 0x34      SSL3.0
+TLS_DH_ANON_AES_256_CBC_SHA1                0x00 0x3A      SSL3.0
+TLS_DH_ANON_CAMELLIA_128_CBC_SHA1           0x00 0x46      TLS1.0
+TLS_DH_ANON_CAMELLIA_256_CBC_SHA1           0x00 0x89      TLS1.0
+TLS_DH_ANON_AES_128_CBC_SHA256              0x00 0x6C      TLS1.2
+TLS_DH_ANON_AES_256_CBC_SHA256              0x00 0x6D      TLS1.2
+TLS_DH_ANON_AES_128_GCM_SHA256              0x00 0xA6      TLS1.2
+TLS_ECDH_ANON_NULL_SHA1                     0xC0 0x15      TLS1.0
+TLS_ECDH_ANON_3DES_EDE_CBC_SHA1             0xC0 0x17      TLS1.0
+TLS_ECDH_ANON_AES_128_CBC_SHA1              0xC0 0x18      TLS1.0
+TLS_ECDH_ANON_AES_256_CBC_SHA1              0xC0 0x19      TLS1.0
+TLS_SRP_SHA_3DES_EDE_CBC_SHA1               0xC0 0x1A      TLS1.0
+TLS_SRP_SHA_AES_128_CBC_SHA1                0xC0 0x1D      TLS1.0
+TLS_SRP_SHA_AES_256_CBC_SHA1                0xC0 0x20      TLS1.0
+TLS_SRP_SHA_DSS_3DES_EDE_CBC_SHA1           0xC0 0x1C      TLS1.0
+TLS_SRP_SHA_RSA_3DES_EDE_CBC_SHA1           0xC0 0x1B      TLS1.0
+TLS_SRP_SHA_DSS_AES_128_CBC_SHA1            0xC0 0x1F      TLS1.0
+TLS_SRP_SHA_RSA_AES_128_CBC_SHA1            0xC0 0x1E      TLS1.0
+TLS_SRP_SHA_DSS_AES_256_CBC_SHA1            0xC0 0x22      TLS1.0
+TLS_SRP_SHA_RSA_AES_256_CBC_SHA1            0xC0 0x21      TLS1.0
+TLS_RSA_EXPORT_ARCFOUR_40_MD5               0x00 0x03      SSL3.0
 
 Certificate types
 =================
@@ -6970,12 +7363,12 @@ Key exchange methods
 
 `DHE-RSA'
 
+`DHE-DSS'
+
 `ECDHE-RSA'
 
 `ECDHE-ECDSA'
 
-`DHE-DSS'
-
 `SRP-DSS'
 
 `SRP-RSA'
@@ -7061,6 +7454,7 @@ Appendix E API reference
 * Menu:
 
 * Core TLS API::
+* High level TLS API::
 * Datagram TLS API::
 * X509 certificate API::
 * OCSP API::
@@ -7074,7 +7468,7 @@ Appendix E API reference
 * Compatibility API::
 
 
-File: gnutls.info,  Node: Core TLS API,  Next: Datagram TLS API,  Up: API reference
+File: gnutls.info,  Node: Core TLS API,  Next: High level TLS API,  Up: API reference
 
 E.1 Core TLS API
 ================
@@ -7534,6 +7928,8 @@ gnutls_certificate_get_peers_subkey_id
      *Returns:* On success, `GNUTLS_E_SUCCESS'  (0) is returned,
      otherwise an error code is returned.
 
+     *Since:* 3.1.3
+
 gnutls_certificate_send_x509_rdn_sequence
 -----------------------------------------
 
@@ -7580,9 +7976,9 @@ gnutls_certificate_set_dh_params
      This function will set the Diffie-Hellman parameters for a
      certificate server to use. These parameters will be used in
      Ephemeral Diffie-Hellman cipher suites.  Note that only a pointer
-     to the parameters are stored in the certificate handle, so if you
-     deallocate the parameters before the certificate is deallocated,
-     you must change the parameters stored in the certificate first.
+     to the parameters are stored in the certificate handle, so you
+     must not deallocate the parameters before the certificate is
+     deallocated.
 
 gnutls_certificate_set_ocsp_status_request_file
 -----------------------------------------------
@@ -7606,6 +8002,8 @@ gnutls_certificate_set_ocsp_status_request_file
      *Returns:* On success, `GNUTLS_E_SUCCESS'  (0) is returned,
      otherwise a negative error code is returned.
 
+     *Since:* 3.1.3
+
 gnutls_certificate_set_ocsp_status_request_function
 ---------------------------------------------------
 
@@ -7638,6 +8036,8 @@ gnutls_certificate_set_ocsp_status_request_function
      *Returns:* On success, `GNUTLS_E_SUCCESS'  (0) is returned,
      otherwise a negative error code is returned.
 
+     *Since:* 3.1.3
+
 gnutls_certificate_set_params_function
 --------------------------------------
 
@@ -8483,13 +8883,22 @@ gnutls_db_check_entry
 
      SESSION_ENTRY: is the session data (not key)
 
-     Check if database entry has expired.  This function is to be used
-     when you want to clear unnecessary sessions which occupy space in
-     your backend.
+     This function has no effect.
 
      *Returns:* Returns `GNUTLS_E_EXPIRED' , if the database entry has
      expired or 0 otherwise.
 
+gnutls_db_check_entry_time
+--------------------------
+
+ -- Function: time_t gnutls_db_check_entry_time (gnutls_datum_t * ENTRY)
+     ENTRY: is a pointer to a `gnutls_datum_t'  structure.
+
+     This function returns the time that this entry was active.  It can
+     be used for database entry expiration.
+
+     *Returns:* The time this entry was created, or zero on error.
+
 gnutls_db_get_ptr
 -----------------
 
@@ -8725,6 +9134,8 @@ gnutls_dh_params_export2_pkcs3
      *Returns:* On success, `GNUTLS_E_SUCCESS'  (0) is returned,
      otherwise a negative error code is returned.
 
+     *Since:* 3.1.3
+
 gnutls_dh_params_export_pkcs3
 -----------------------------
 
@@ -8871,7 +9282,12 @@ gnutls_dh_set_prime_bits
      Note that values lower than 512 bits may allow decryption of the
      exchanged data.
 
-     This function has no effect in server side.
+     The function has no effect in server side.
+
+     Note that since 3.1.7 this function is deprecated. The minimum
+     number of bits is set by the priority string level.  Also this
+     function must be called after `gnutls_priority_set_direct()' or
+     the set value may be overriden by the selected priority options.
 
 gnutls_ecc_curve_get
 --------------------
@@ -8983,8 +9399,8 @@ gnutls_fingerprint
 
      This is the usual way to calculate a fingerprint of an X.509 DER
      encoded certificate.  Note however that the fingerprint of an
-     OpenPGP is not just a hash and cannot be calculated with this
-     function.
+     OpenPGP certificate is not just a hash and cannot be calculated
+     with this function.
 
      *Returns:* On success, `GNUTLS_E_SUCCESS'  (0) is returned,
      otherwise an error code is returned.
@@ -9274,6 +9690,28 @@ gnutls_handshake_set_private_extensions
      Enabling the private ciphersuites when talking to other than
      gnutls servers and clients may cause interoperability problems.
 
+gnutls_handshake_set_random
+---------------------------
+
+ -- Function: int gnutls_handshake_set_random (gnutls_session_t
+          SESSION, const gnutls_datum_t* RANDOM)
+     SESSION: is a `gnutls_session_t'  structure.
+
+     RANDOM: a random value of 32-bytes
+
+     This function will explicitly set the server or client hello
+     random value in the subsequent TLS handshake. The random value
+     should be a 32-byte value.
+
+     Note that this function should not normally be used as gnutls will
+     select automatically a random value for the handshake.
+
+     This function should not be used when resuming a session.
+
+     *Returns:* `GNUTLS_E_SUCCESS'  on success, or an error code.
+
+     Since 3.1.9
+
 gnutls_handshake_set_timeout
 ----------------------------
 
@@ -9287,7 +9725,8 @@ gnutls_handshake_set_timeout
      provided value. Use an  `ms' value of zero to disable timeout.
 
      Note that in order for the timeout to be enforced
-     `gnutls_transport_set_pull_timeout_function()'  must be set.
+     `gnutls_transport_set_pull_timeout_function()'  must be set (it is
+     set by default in most systems).
 
 gnutls_heartbeat_allowed
 ------------------------
@@ -9500,7 +9939,7 @@ gnutls_key_generate
 
      KEY_SIZE: The number of bytes of the key.
 
-     Generates a random key of  `key_bytes' size.
+     Generates a random key of  `key_size' bytes.
 
      *Returns:* On success, `GNUTLS_E_SUCCESS'  (0) is returned, or an
      error code.
@@ -9659,6 +10098,8 @@ gnutls_ocsp_status_request_enable_client
      *Returns:* On success, `GNUTLS_E_SUCCESS'  (0) is returned,
      otherwise a negative error code is returned.
 
+     *Since:* 3.1.3
+
 gnutls_ocsp_status_request_get
 ------------------------------
 
@@ -9676,6 +10117,8 @@ gnutls_ocsp_status_request_get
      *Returns:* On success, `GNUTLS_E_SUCCESS'  (0) is returned,
      otherwise a negative error code is returned.
 
+     *Since:* 3.1.3
+
 gnutls_ocsp_status_request_is_checked
 -------------------------------------
 
@@ -10493,6 +10936,50 @@ gnutls_random_art
      *Returns:* On success, `GNUTLS_E_SUCCESS'  (0) is returned,
      otherwise an error code is returned.
 
+gnutls_range_split
+------------------
+
+ -- Function: int gnutls_range_split (gnutls_session_t SESSION, const
+          gnutls_range_st * ORIG, gnutls_range_st * NEXT,
+          gnutls_range_st * REMAINDER)
+     SESSION: is a `gnutls_session_t'  structure
+
+     ORIG: is the original range provided by the user
+
+     NEXT: is the returned range that can be conveyed in a TLS record
+
+     REMAINDER: is the returned remaining range
+
+     This function should be used when it is required to hide the length
+     of very long data that cannot be directly provided to
+     `gnutls_record_send_range()' .  In that case this function should
+     be called with the desired length hiding range in  `orig' . The
+     returned  `next' value should then be used in the next call to
+     `gnutls_record_send_range()'  with the partial data.  That process
+     should be repeated until  `remainder' is (0,0).
+
+     *Returns:* 0 in case splitting succeeds, non zero in case of error.
+     Note that  `orig' is not changed, while the values of  `next' and
+     `remainder' are modified to store the resulting values.
+
+gnutls_record_can_use_length_hiding
+-----------------------------------
+
+ -- Function: int gnutls_record_can_use_length_hiding (gnutls_session_t
+          SESSION)
+     SESSION: is a `gnutls_session_t'  structure.
+
+     Returns true (1) if the current session supports length-hiding
+     padding, false (0) if the current session does not. Returns a
+     negative value in case of error.  If the session supports
+     length-hiding padding, you can invoke
+     `gnutls_range_send_message()'  to send a message whose length is
+     hidden in the given range. If the session does not support length
+     hiding padding, you can use the standard `gnutls_record_send()'
+     function, or `gnutls_range_send_message()' making sure that the
+     range is the same as the length of the message you are trying to
+     send.
+
 gnutls_record_check_pending
 ---------------------------
 
@@ -10506,6 +10993,18 @@ gnutls_record_check_pending
 
      *Returns:* Returns the size of the data or zero.
 
+gnutls_record_cork
+------------------
+
+ -- Function: void gnutls_record_cork (gnutls_session_t SESSION)
+     SESSION: is a `gnutls_session_t'  structure.
+
+     If called `gnutls_record_send()'  will no longer send partial
+     records.  All queued records will be sent when `gnutls_uncork()'
+     is called, or when the maximum record size is reached.
+
+     *Since:* 3.1.9
+
 gnutls_record_disable_padding
 -----------------------------
 
@@ -10518,8 +11017,8 @@ gnutls_record_disable_padding
      complain if a server pads the encrypted data.  This of course will
      disable protection against statistical attacks on the data.
 
-     Normally only servers that require maximum compatibility with
-     everything out there, need to call this function.
+     This functions is defunt since 3.1.7. Random padding is disabled
+     by default unless requested using `gnutls_range_send_message()' .
 
 gnutls_record_get_direction
 ---------------------------
@@ -10643,6 +11142,56 @@ gnutls_record_send
      number of bytes this function can send in a single call depends on
      the negotiated maximum record size.
 
+gnutls_record_send_range
+------------------------
+
+ -- Function: ssize_t gnutls_record_send_range (gnutls_session_t
+          SESSION, const void * DATA, size_t DATA_SIZE, const
+          gnutls_range_st * RANGE)
+     SESSION: is a `gnutls_session_t'  structure.
+
+     DATA: contains the data to send.
+
+     DATA_SIZE: is the length of the data.
+
+     RANGE: is the range of lengths in which the real data length must
+     be hidden.
+
+     This function operates like `gnutls_record_send()'  but, while
+     `gnutls_record_send()'  adds minimal padding to each TLS record,
+     this function uses the TLS extra-padding feature to conceal the
+     real data size within the range of lengths provided.  Some TLS
+     sessions do not support extra padding (e.g. stream ciphers in
+     standard TLS or SSL3 sessions). To know whether the current
+     session supports extra padding, and hence length hiding, use the
+     `gnutls_record_can_use_length_hiding()' function.
+
+     *Note_* This function currently is only limited to blocking
+     sockets.
+
+     *Returns:* The number of bytes sent (that is data_size in a
+     successful invocation), or a negative error code.
+
+gnutls_record_set_max_empty_records
+-----------------------------------
+
+ -- Function: void gnutls_record_set_max_empty_records
+          (gnutls_session_t SESSION, const unsigned int I)
+     SESSION: is a `gnutls_session_t'  structure.
+
+     I: is the desired value of maximum empty records that can be
+     accepted in a row.
+
+     Used to set the maximum number of empty fragments that can be
+     accepted in a row. Accepting many empty fragments is useful for
+     receiving length-hidden content, where empty fragments filled with
+     pad are sent to hide the real length of a message. However, a
+     malicious peer could send empty fragments to mount a DoS attack,
+     so as a safety measure, a maximum number of empty fragments is
+     accepted by default. If you know your application must accept a
+     given number of empty fragments in a row, you can use this
+     function to set the desired value.
+
 gnutls_record_set_max_size
 --------------------------
 
@@ -10667,6 +11216,45 @@ gnutls_record_set_max_size
      *Returns:* On success, `GNUTLS_E_SUCCESS'  (0) is returned,
      otherwise a negative error code is returned.
 
+gnutls_record_set_timeout
+-------------------------
+
+ -- Function: void gnutls_record_set_timeout (gnutls_session_t SESSION,
+          unsigned int MS)
+     SESSION: is a `gnutls_session_t'  structure.
+
+     MS: is a timeout value in milliseconds
+
+     This function sets the receive timeout for the record layer to the
+     provided value. Use an  `ms' value of zero to disable timeout (the
+     default).
+
+     Note that in order for the timeout to be enforced
+     `gnutls_transport_set_pull_timeout_function()'  must be set (it is
+     set by default in most systems).
+
+     *Since:* 3.1.7
+
+gnutls_record_uncork
+--------------------
+
+ -- Function: int gnutls_record_uncork (gnutls_session_t SESSION,
+          unsigned int FLAGS)
+     SESSION: is a `gnutls_session_t'  structure.
+
+     FLAGS: Could be zero or `GNUTLS_RECORD_WAIT'
+
+     This resets the effect of `gnutls_cork()' , and flushes any pending
+     data. If the `GNUTLS_RECORD_WAIT'  flag is specified then this
+     function will block until the data is sent or a fatal error occurs
+     (i.e., the function will retry on `GNUTLS_E_AGAIN'  and
+     `GNUTLS_E_INTERRUPTED' ).
+
+     *Returns:* On success the number of transmitted data is returned,
+     or otherwise a negative error code.
+
+     *Since:* 3.1.9
+
 gnutls_rehandshake
 ------------------
 
@@ -10847,6 +11435,17 @@ gnutls_session_enable_compatibility_mode
      Normally only servers that require maximum compatibility with
      everything out there, need to call this function.
 
+gnutls_session_force_valid
+--------------------------
+
+ -- Function: void gnutls_session_force_valid (gnutls_session_t SESSION)
+     SESSION: is a `gnutls_session_t'  structure.
+
+     Clears the invalid flag in a session. That means that sessions
+     were corrupt or invalid data were received can be re-used. Use
+     only when debugging or experimenting with the TLS protocol. Should
+     not be used in typical applications.
+
 gnutls_session_get_data
 -----------------------
 
@@ -10887,6 +11486,21 @@ gnutls_session_get_data2
      *Returns:* On success, `GNUTLS_E_SUCCESS'  (0) is returned,
      otherwise an error code is returned.
 
+gnutls_session_get_desc
+-----------------------
+
+ -- Function: char * gnutls_session_get_desc (gnutls_session_t SESSION)
+     SESSION: is a gnutls session
+
+     This function returns a string describing the current session.
+     The string is null terminated and allocated using
+     `gnutls_malloc()' .
+
+     *Returns:* a description of the protocols and algorithms in the
+     current session.
+
+     *Since:* 3.1.10
+
 gnutls_session_get_id
 ---------------------
 
@@ -11881,6 +12495,37 @@ gnutls_tdb_set_verify_func
      gnutls_tdb_verify_func(const char* db_name, const char* host,
      const char* service, const gnutls_datum_t* pubkey);
 
+gnutls_transport_get_int
+------------------------
+
+ -- Function: int gnutls_transport_get_int (gnutls_session_t SESSION)
+     SESSION: is a `gnutls_session_t'  structure.
+
+     Used to get the first argument of the transport function (like
+     PUSH and PULL).  This must have been set using
+     `gnutls_transport_set_int()' .
+
+     *Returns:* The first argument of the transport function.
+
+     *Since:* 3.1.9
+
+gnutls_transport_get_int2
+-------------------------
+
+ -- Function: void gnutls_transport_get_int2 (gnutls_session_t SESSION,
+          int * RECV_INT, int * SEND_INT)
+     SESSION: is a `gnutls_session_t'  structure.
+
+     RECV_INT: will hold the value for the pull function
+
+     SEND_INT: will hold the value for the push function
+
+     Used to get the arguments of the transport functions (like PUSH
+     and PULL).  These should have been set using
+     `gnutls_transport_set_int2()' .
+
+     *Since:* 3.1.9
+
 gnutls_transport_get_ptr
 ------------------------
 
@@ -11948,6 +12593,38 @@ gnutls_transport_set_errno_function
 
      *Since:* 2.12.0
 
+gnutls_transport_set_int
+------------------------
+
+ -- Function: void gnutls_transport_set_int (gnutls_session_t SESSION,
+          int I)
+     SESSION: is a `gnutls_session_t'  structure.
+
+     I: is the value.
+
+     Used to set the first argument of the transport function (for push
+     and pull callbacks) for berkeley style sockets.
+
+     *Since:* 3.1.9
+
+gnutls_transport_set_int2
+-------------------------
+
+ -- Function: void gnutls_transport_set_int2 (gnutls_session_t SESSION,
+          int RECV_INT, int SEND_INT)
+     SESSION: is a `gnutls_session_t'  structure.
+
+     RECV_INT: is the value for the pull function
+
+     SEND_INT: is the value for the push function
+
+     Used to set the first argument of the transport function (for push
+     and pull callbacks), when using the berkeley style sockets.  With
+     this function you can set two different pointers for receiving and
+     sending.
+
+     *Since:* 3.1.9
+
 gnutls_transport_set_ptr
 ------------------------
 
@@ -12013,7 +12690,7 @@ gnutls_transport_set_pull_timeout_function
      not suitable for the provided transport calls.  The callback
      function is used in DTLS only.
 
-     `gnutls_pull_timeout_func' is of the form, ssize_t
+     `gnutls_pull_timeout_func' is of the form, int
      (*gnutls_pull_timeout_func)(gnutls_transport_ptr_t, unsigned int
      ms);