.\" -*- mode: troff; coding: utf-8 -*-
.\" Automatically generated by Podwrapper::Man 1.20.0 (Pod::Simple 3.43)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" \*(C` and \*(C' are quotes in nroff, nothing in troff, for use with C<>.
.ie n \{\
.    ds C` ""
.    ds C' ""
'br\}
.el\{\
.    ds C`
.    ds C'
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\"
.\" If the F register is >0, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
.\" entries marked with X<> in POD.  Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.\"
.\" Avoid warning from groff about undefined register 'F'.
.de IX
..
.nr rF 0
.if \n(.g .if rF .nr rF 1
.if (\n(rF:(\n(.g==0)) \{\
.    if \nF \{\
.        de IX
.        tm Index:\\$1\t\\n%\t"\\$2"
..
.        if !\nF==2 \{\
.            nr % 0
.            nr F 2
.        \}
.    \}
.\}
.rr rF
.\" ========================================================================
.\"
.IX Title "nbd_opt_starttls 3"
.TH nbd_opt_starttls 3 2024-05-31 libnbd-1.20.0 LIBNBD
.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH NAME
nbd_opt_starttls \- request the server to initiate TLS
.SH SYNOPSIS
.IX Header "SYNOPSIS"
.Vb 1
\& #include <libnbd.h>
\&
\& int nbd_opt_starttls (
\&       struct nbd_handle *h
\&     );
.Ve
.SH DESCRIPTION
.IX Header "DESCRIPTION"
Request that the server initiate a secure TLS connection, by
sending \f(CW\*(C`NBD_OPT_STARTTLS\*(C'\fR.  This can only be used if
\&\fBnbd_set_opt_mode\fR\|(3) enabled option mode; furthermore, if you
use \fBnbd_set_tls\fR\|(3) to request anything other than the default
of \f(CW\*(C`LIBNBD_TLS_DISABLE\*(C'\fR, then libnbd will have already attempted
a TLS connection prior to allowing you control over option
negotiation.  This command is disabled if \fBnbd_supports_tls\fR\|(3)
reports false.
.PP
This function is mainly useful for integration testing of corner
cases in server handling; in particular, misuse of this function
when coupled with a server that is not careful about resetting
stateful commands such as \fBnbd_opt_structured_reply\fR\|(3) could
result in a security hole (see CVE\-2021\-3716 against nbdkit, for
example).  Thus, when security is a concern, you should instead
prefer to use \fBnbd_set_tls\fR\|(3) with \f(CW\*(C`LIBNBD_TLS_REQUIRE\*(C'\fR and
let libnbd negotiate TLS automatically.
.PP
This function returns true if the server replies with success,
false if the server replies with an error, and fails only if
the server does not reply (such as for a loss of connection,
which can include when the server rejects credentials supplied
during the TLS handshake).  Note that the NBD protocol documents
that requesting TLS after it is already enabled is a client
error; most servers will gracefully fail a second request, but
that does not downgrade a TLS session that has already been
established, as reported by \fBnbd_get_tls_negotiated\fR\|(3).
.SH "RETURN VALUE"
.IX Header "RETURN VALUE"
This call returns a boolean value.
.SH ERRORS
.IX Header "ERRORS"
On error \f(CW\-1\fR is returned.
.PP
Refer to "ERROR HANDLING" in \fBlibnbd\fR\|(3)
for how to get further details of the error.
.PP
The following parameters must not be NULL: \f(CW\*(C`h\*(C'\fR.
For more information see "Non-NULL parameters" in \fBlibnbd\fR\|(3).
.SH "HANDLE STATE"
.IX Header "HANDLE STATE"
nbd_opt_starttls
can be called when the handle is in the following state:
.PP
.Vb 8
\& ┌─────────────────────────────────────┬─────────────────────────┐
\& │ Handle created, before connecting   │ ❌ error                │
\& │ Connecting                          │ ❌ error                │
\& │ Connecting & handshaking (opt_mode) │ ✅ allowed              │
\& │ Connected to the server             │ ❌ error                │
\& │ Connection shut down                │ ❌ error                │
\& │ Handle dead                         │ ❌ error                │
\& └─────────────────────────────────────┴─────────────────────────┘
.Ve
.SH VERSION
.IX Header "VERSION"
This function first appeared in libnbd 1.16.
.PP
If you need to test if this function is available at compile time
check if the following macro is defined:
.PP
.Vb 1
\& #define LIBNBD_HAVE_NBD_OPT_STARTTLS 1
.Ve
.SH "SEE ALSO"
.IX Header "SEE ALSO"
\&\fBnbd_aio_opt_starttls\fR\|(3),
\&\fBnbd_create\fR\|(3),
\&\fBnbd_get_tls_negotiated\fR\|(3),
\&\fBnbd_opt_structured_reply\fR\|(3),
\&\fBnbd_set_opt_mode\fR\|(3),
\&\fBnbd_set_tls\fR\|(3),
\&\fBnbd_supports_tls\fR\|(3),
\&\fBlibnbd\fR\|(3).
.SH AUTHORS
.IX Header "AUTHORS"
Eric Blake
.PP
Richard W.M. Jones
.SH COPYRIGHT
.IX Header "COPYRIGHT"
Copyright Red Hat
.SH LICENSE
.IX Header "LICENSE"
This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2 of the License, or (at your option) any later version.
.PP
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
Lesser General Public License for more details.
.PP
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110\-1301 USA