#
# ssl 3.0 protocol
#

SSL3: module {

	PATH: con "/dis/lib/crypt/ssl3.dis";

	init: fn(): string;

	# SSL cipher suites

	NULL_WITH_NULL_NULL,
	RSA_WITH_NULL_MD5,
	RSA_WITH_NULL_SHA,
	RSA_EXPORT_WITH_RC4_40_MD5,
	RSA_WITH_RC4_128_MD5,
	RSA_WITH_RC4_128_SHA,
	RSA_EXPORT_WITH_RC2_CBC_40_MD5,
	RSA_WITH_IDEA_CBC_SHA,
	RSA_EXPORT_WITH_DES40_CBC_SHA,
	RSA_WITH_DES_CBC_SHA,
	RSA_WITH_3DES_EDE_CBC_SHA,
	DH_DSS_EXPORT_WITH_DES40_CBC_SHA,
	DH_DSS_WITH_DES_CBC_SHA,
	DH_DSS_WITH_3DES_EDE_CBC_SHA,
	DH_RSA_EXPORT_WITH_DES40_CBC_SHA,
	DH_RSA_WITH_DES_CBC_SHA,
	DH_RSA_WITH_3DES_EDE_CBC_SHA,
	DHE_DSS_EXPORT_WITH_DES40_CBC_SHA,
	DHE_DSS_WITH_DES_CBC_SHA,
	DHE_DSS_WITH_3DES_EDE_CBC_SHA,
	DHE_RSA_EXPORT_WITH_DES40_CBC_SHA,
	DHE_RSA_WITH_DES_CBC_SHA,
	DHE_RSA_WITH_3DES_EDE_CBC_SHA,
	DH_anon_EXPORT_WITH_RC4_40_MD5,
	DH_anon_WITH_RC4_128_MD5,
	DH_anon_EXPORT_WITH_DES40_CBC_SHA,
	DH_anon_WITH_DES_CBC_SHA,
	DH_anon_WITH_3DES_EDE_CBC_SHA,
	FORTEZZA_KEA_WITH_NULL_SHA,
	FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA,
	FORTEZZA_KEA_WITH_RC4_128_SHA 		: con iota;

	Authinfo: adt {
		suites: array of byte; # [2] x
		comprs: array of byte; # [1] x

		sk: ref PrivateKey; # for user certs 
		root_type: int; # root type of certs
		certs: list of array of byte; # x509 cert chain

		types: array of byte; # acceptable cert types
		dns: list of array of byte; # acceptable cert authorities
	};

	PrivateKey: adt {
		pick {
		RSA =>
			sk			: ref PKCS->RSAKey;
		DSS =>
			sk			: ref PKCS->DSSPrivateKey;
		DH =>
			sk			: ref PKCS->DHPrivateKey;
		}
	};

	Record: adt {
		content_type			: int;
		version			 	: array of byte; # [2]		
		data				: array of byte;
	};

	# key exchange algorithms

	KeyExAlg: adt {
		pick {
		NULL =>
		DH =>
			params			: ref PKCS->DHParams;
			sk			: ref PKCS->DHPrivateKey;			
			peer_params		: ref PKCS->DHParams;
			peer_pk			: ref PKCS->DHPublicKey;
			exch_pk			: ref PKCS->DHPublicKey;
		RSA =>
			sk	 		: ref PKCS->RSAKey; # for RSA key exchange
			export_key 		: ref PKCS->RSAKey; # server RSA temp key
			peer_pk			: ref PKCS->RSAKey; # temp key from server
		FORTEZZA_KEA =>	
			# not supported yet
		}
	};

	SigAlg: adt {
		pick {
		anon =>
		RSA =>
			sk	 		: ref PKCS->RSAKey; # for sign
			peer_pk			: ref PKCS->RSAKey; # for verify from peer cert
		DSS =>
			sk	 		: ref PKCS->DSSPrivateKey; # for sign
			peer_pk			: ref PKCS->DSSPublicKey; # for verify from peer cert
		FORTEZZA_KEA =>	# not supported yet
		}
	};

	CipherSpec: adt {
		is_exportable			: int;
	
		bulk_cipher_algorithm		: int;
		cipher_type			: int;
		key_material			: int;
		IV_size				: int;

		mac_algorithm			: int;
		hash_size			: int;		
	};

	# record format queue

	RecordQueue: adt {
		macState			: ref MacState;
		cipherState			: ref CipherState;

		length				: int;
		sequence_numbers		: array of int;
	
		data				: list of ref Record;
		fragment			: int;
		b, e				: int;

		new: fn(): ref RecordQueue;
		read: fn(q: self ref RecordQueue, ctx: ref Context, fd: ref Sys->FD): string;
		write: fn(q: self ref RecordQueue, ctx: ref Context, fd: ref Sys->FD, r: ref Record): string;
		calcmac: fn(q: self ref RecordQueue, ctx: ref Context, cntype: int, a: array of byte, ofs, n: int) : array of byte;
	};

	MacState: adt {
		hash_size			: int;
		pick {
		null =>
		md5 =>
			ds			: array of ref Keyring->DigestState;
		sha =>
			ds			: array of ref Keyring->DigestState;
		}
	};

	CipherState: adt {
		block_size			: int;
		pick {
		null =>
		rc4 =>
			es			: ref RC4state;
		descbc =>
			es			: ref Keyring->DESstate;
		ideacbc =>
			es			: ref Keyring->IDEAstate;
		}
	};

	RC4state: adt {
		state				: array of byte; # [256]
		x				: int;
		y				: int;
	};

	# context for processing both v2 and v3 protocols.

	Context: adt {
		c				: ref Sys->Connection;
		session				: ref SSLsession->Session;

		sel_keyx			: ref KeyExAlg;
		sel_sign			: ref SigAlg;
		sel_ciph			: ref CipherSpec;
		sel_cmpr			: int;

		local_info			: ref Authinfo;

		client_random			: array of byte; # [32]
		server_random			: array of byte; # [32]
		
		sha_state			: ref Keyring->DigestState;
		md5_state			: ref Keyring->DigestState;

		cw_mac				: array of byte;
		sw_mac				: array of byte;
		cw_key				: array of byte;
		sw_key				: array of byte;
		cw_IV				: array of byte;
		sw_IV				: array of byte;

		in_queue			: ref RecordQueue;
		out_queue			: ref RecordQueue;

		status				: int;
		state				: int;


		new: fn(): ref Context;
		client: fn(ctx: self ref Context, fd: ref Sys->FD, peer: string, ver: int, info: ref Authinfo): (string, int);
		server: fn(ctx: self ref Context, fd: ref Sys->FD, info: ref Authinfo, client_auth: int): string;
		use_devssl: fn(ctx: self ref Context);
		set_version: fn(ctx: self ref Context, vers: int): string;
		connect: fn(ctx: self ref Context, fd: ref Sys->FD): string;
		read: fn(ctx: self ref Context, a: array of byte, n: int): int;
		write: fn(ctx: self ref Context, a: array of byte, n: int): int;
	};
};