;; By Simon Josefsson 2001-12-01
;; See http://josefsson.org/emacs-security/

;; Simple test:
;;
;; (setq jas (open-ssl-stream "ssl" (current-buffer) "www.pdc.kth.se" 443))
;; (process-send-string jas "GET /\r\n\r\n")

(defconst gnutls-version "0.3.1")

(defconst gnutls-server 1)
(defconst gnutls-client 2)

(defconst gnutls-ssl3 1)
(defconst gnutls-tls1 2)

(defconst gnutls-cipher-null 1)
(defconst gnutls-cipher-arcfour 2)
(defconst gnutls-cipher-3des-cbc 3)
(defconst gnutls-cipher-rijndael-cbc 4)
(defconst gnutls-cipher-twofish-cbc 5)
(defconst gnutls-cipher-rijndael256-cbc 6)

(defconst gnutls-comp-null 1)
(defconst gnutls-comp-zlib 2)

(defconst gnutls-kx-x509pki-rsa 1)
(defconst gnutls-kx-x509pki-dhe-dss 2)
(defconst gnutls-kx-x509pki-dhe-rsa 3)
(defconst gnutls-kx-anon-dh 4)
(defconst gnutls-kx-srp 5)

(defconst gnutls-mac-null 1)
(defconst gnutls-mac-md5 2)
(defconst gnutls-mac-sha 3)

(defconst gnutls-x509pki 1)
(defconst gnutls-anon 2)
(defconst gnutls-srp 3)

(defconst gnutls-shut-rdwr 0)
(defconst gnutls-shut-wr 1)

(defconst gnutls-e-interrupted -52)
(defconst gnutls-e-again -28)

(defun open-ssl-stream (name buffer host service)
  "Open a SSL connection for a service to a host.
Returns a subprocess-object to represent the connection.
Input and output work as for subprocesses; `delete-process' closes it.
Args are NAME BUFFER HOST SERVICE.
NAME is name for process.  It is modified if necessary to make it unique.
BUFFER is the buffer (or buffer-name) to associate with the process.
 Process output goes at end of that buffer, unless you specify
 an output stream or filter function to handle the output.
 BUFFER may be also nil, meaning that this process is not associated
 with any buffer
Third arg is name of the host to connect to, or its IP address.
Fourth arg SERVICE is name of the service desired, or an integer
specifying a port number to connect to."
  (let ((proc (open-network-stream name buffer host service)))
    (message "err=%s" (gnutls-global-init))
    (message "err=%s" (gnutls-init proc gnutls-client))
    (message "err=%s"  (gnutls-protocol-set-priority proc 
						     gnutls-tls1 gnutls-ssl3))
    (message "err=%s"  (gnutls-cipher-set-priority proc 
						   gnutls-cipher-rijndael-cbc
						   gnutls-cipher-3des-cbc
						   gnutls-cipher-arcfour))
    (message "err=%s"  (gnutls-compression-set-priority proc 
							gnutls-comp-zlib
							gnutls-comp-null))
    (message "err=%s"  (gnutls-kx-set-priority proc 
					       gnutls-kx-x509pki-rsa
					       gnutls-kx-x509pki-dhe-rsa
					       gnutls-kx-srp
					       gnutls-kx-anon-dh))
    (message "err=%s"  (gnutls-mac-set-priority proc 
						gnutls-mac-sha
						gnutls-mac-md5))
    (message "err=%s"  (gnutls-cred-set proc gnutls-x509pki))
    (let ((ret gnutls-e-again))
      (while (or (eq ret gnutls-e-again)
		 (eq ret gnutls-e-interrupted))
	(message "err=%s" (setq ret (gnutls-handshake proc))))
      (if (< ret 0)
	  (progn
	    (message "Ouch, error return %d" ret)
	    (setq proc nil))
	(message "Handshake complete %d." ret)))
    proc))

(defvar starttls-host nil)

(defun starttls-negotiate (proc)
  (message "err=%s" (gnutls-global-init))
  (message "err=%s" (gnutls-init proc gnutls-client))
  (message "err=%s"  (gnutls-protocol-set-priority proc 
						   gnutls-tls1 gnutls-ssl3))
  (message "err=%s"  (gnutls-cipher-set-priority proc 
						 gnutls-cipher-rijndael-cbc
						 gnutls-cipher-3des-cbc
						 gnutls-cipher-arcfour))
  (message "err=%s"  (gnutls-compression-set-priority proc 
						      gnutls-comp-zlib
						      gnutls-comp-null))
  (message "err=%s"  (gnutls-kx-set-priority proc 
					     gnutls-kx-x509pki-rsa
					     gnutls-kx-x509pki-dhe-rsa
					     gnutls-kx-srp
					     gnutls-kx-anon-dh))
  (message "err=%s"  (gnutls-mac-set-priority proc 
					      gnutls-mac-sha
					      gnutls-mac-md5))
  (message "err=%s"  (gnutls-cred-set proc gnutls-x509pki))
  (let ((ret gnutls-e-again))
    (while (or (eq ret gnutls-e-again)
	       (eq ret gnutls-e-interrupted))
      (message "err=%s" (setq ret (gnutls-handshake proc))))
    (if (< ret 0)
	(progn
	  (message "Ouch, error return %d" ret)
	  (setq proc nil))
      (message "Handshake complete %d." ret)))
  proc)

(defun starttls-open-stream (name buffer host service)
  "Open a TLS connection for a service to a host.
Returns a subprocess-object to represent the connection.
Input and output work as for subprocesses; `delete-process' closes it.
Args are NAME BUFFER HOST SERVICE.
NAME is name for process.  It is modified if necessary to make it unique.
BUFFER is the buffer (or `buffer-name') to associate with the process.
 Process output goes at end of that buffer, unless you specify
 an output stream or filter function to handle the output.
 BUFFER may be also nil, meaning that this process is not associated
 with any buffer
Third arg is name of the host to connect to, or its IP address.
Fourth arg SERVICE is name of the service desired, or an integer
specifying a port number to connect to."
  (prog1
      (open-network-stream name buffer host service)
    (set (make-variable-buffer-local 'starttls-host) host)))

(provide 'ssl)
(provide 'gnutls)
(provide 'starttls)

;;; gnutls.el ends here