/*
 * NAME:
 *	sslfd - routines useful for SSL servers and clients
 *
 * DESCRIPTION:
 *	This library provides a routines that encapsulate much of the
 *	logic used by applications using Eric Young's SSLeay library.
 *	
 *	A server (such as 'SSLrshd') typically needs to call:
 *
 *	ssld_init("cert_file", "key_file", "cipher_list",
 *		"verify_flag", "init_flags");
 *
 *	and clients (such as 'SSLrsh') call:
 *
 *	sslc_init("cert_file", "key_file", "cipher_list",
 *		"verify_flag", "init_flags");
 *
 *	Both the above simply interface to
 *
 *	ssl_init("cert_file", "key_file", "cipher_list",
 *		"verify_flag", "verify_cb", "log_lev", "init_flags"): 
 *
 *	and provide appropriate callback and "log_lev" arguments.
 *	Each end must call:
 *	
 *	ssl_start("sock", "log_lev", "active")
 *
 *	with one side using "active" = 1 and the other "active" = 0.
 *	The end with "active" = 0 will call SSL_accept() and must
 *	always provide a certificate.  For applications where client
 *	to server authentication is most important, it makes sense to
 *	reverse the accept/connect roles at the SSL level.
 *	
 *	If bit 2 in "init_flags" is set, then the "key_file" will not be
 *	read until ssl_start() is called, it is often useful for
 *	clients that want to defer prompting the user for a pass
 *	phrase until it is known that the key is likely to be used.
 *
 *	The client cal ssl_start() via:
 *
 *	ssl_rcmd("ahost", "rport", "locuser", "remuser", "cmd",
 *		"fd2p");
 *
 *	which is analgous to rcmd(3), though reserved ports are not
 *	used and "fd2p" must be NULL. If "rport" is -1, then the
 *	routine will lookup ``SSLshell/tcp'' for itself.
 *
 *	The server for ssl_rcmd() is 'SSLrshd'.  If the client's
 *	certificate is valid,  it calls:
 *
 *	ssld_auth("hostname", "remuser", "locuser")
 *
 *	which calls get_x509_name(0, 0) to extract the common name
 *	(/CN) field from the client's certificate.  If the name
 *	contains any ``.'' its looked up via gethostbyname() and if
 *	found, the certificate is assumed to be a host cert.  In this
 *	case "hostname" must match the name in the certificate or
 *	permission is denied.  If the certificate is not a host cert,
 *	then  "hostname" (like "remuser") is only used for logging
 *	purposes. 
 *
 *	If not already rejected, ssld_auth() calls:
 *
 *	ssl_cert_ok("locuser", "ssl_auth_cert")
 *
 *	To lookup "ssl_auth_cert" in the  '/etc/ssl.users' file.  If
 *	the certificate is found and either "locuser" or 'root' is
 *	listed as a valid target user, permission is granted,
 *	otherwise it is denied. 
 *
 * NOTES:
 *
 *	The current version of SSLeay can be obtained from:
 *	'ftp://ftp.psy.uq.oz.au/pub/Crypto/SSL/SSLeay-x.xx.tar.gz'
 *
 *	The SSLeay FAQ by Tim Hudson <tjh@mincom.oz.au> can be found
 *	at 'http://www.psy.uq.oz.au/~ftp/Crypto'
 *
 *	Tim Hudson also maintains SSL patches for several
 *	applications.  The logic for the certificate permission checks
 *	using /etc/ssl.users in ssld_auth() is borrowed from Tim's
 *	verify callback routine from SSLtelnet.
 *	
 * AUTHOR:
 *	Simon J. Gerraty <sjg@quick.com.au>
 */
/*
 * RCSid:
 *	$Id: sslfd.h,v 1.5 1997/02/08 07:13:09 sjg Exp $
 *	
 *      @(#)Copyright (c) 1996 Simon J. Gerraty.
 *      
 *      This is free software.  It comes with NO WARRANTY.
 *      Permission to use, modify and distribute this source code 
 *      is granted subject to the following conditions.
 *      1/ that the above copyright notice and this notice 
 *      are preserved in all copies and that due credit be given 
 *      to the author.  
 *      2/ that any changes to this code are clearly commented 
 *      as such so that the author does not get blamed for bugs 
 *      other than his own.
 *      
 *      Please send copies of changes and bug-fixes to:
 *      sjg@quick.com.au
 */
#ifndef _SSLFD_H_
#define _SSLFD_H_

#include <sys/cdefs.h>

#include "extern.h"

EXTERN char	*ssl_verify_errcert INIT(= 0);
EXTERN char	*ssl_verify_err INIT(= 0);
EXTERN char	*ssl_auth_cert INIT(= 0);
EXTERN int	ssl_fd INIT(= -1);
EXTERN int	ssl_verify_flag INIT(= -1);
EXTERN char	*_path_ssl_users INIT(= 0);

#ifndef NEW
# define NEW(x) (x *)malloc(sizeof(x))
#endif
#endif /* _SSLFD_H_ */

__BEGIN_DECLS

/* copy.c */
int 	copy_net	 __P((int s1, int s2));
/* rwnet.c */
int 	recv_net	 __P((int fd, unsigned char *buf, int nbytes, int flags));
int 	send_net	 __P((int fd, unsigned char *buf, int nbytes, int flags));
int 	read_net	 __P((int fd, unsigned char *buf, int nbytes));
int 	write_net	 __P((int fd, unsigned char *buf, int nbytes));
/* ssl.c */
#ifdef HEADER_SSL_H
int 	set_sslcon	 __P((int fd, SSL *con));
SSL *	get_sslcon	 __P((int fd));
#endif
void 	ssl_err	 __P((int log_lev, char *fmt));
int 	ssl_init	 __P((const char *cert_file, const char *key_file, const char *cipher_list, int verify_flag, int (*verify_cb)(), int log_lev, int flags));
int 	ssl_start	 __P((int s, int log_lev, int active));
int 	ssl_start2	 __P((int s, int log_lev, int active));
char *	get_x509_name	 __P((char *buf, int bufsz));
int (*set_ssl_fail __P((int (*)()))) __P((int));
/* sslc.c */
const char *	setMyId	 __P((const char *myname));
int 	sslc_init	 __P((const char *cert_file, const char *key_file, const char *cipher_list, int verify_flag, int flags));
/* ssld.c */
int 	ssl_cert_ok	 __P((const char *user, const char *cert));
int 	ssld_init	 __P((const char *cert_file, const char *key_file, const char *cipher_list, int verify_flag, int flags));
int 	ssld_auth	 __P((const char *hostname, const char *remuser, const char *locuser));
/* sslrcmd.c */
int 	ssl_rcmd	 __P((char **ahost, int rport, const char *locuser, const char *remuser, const char *cmd, int *fd2p));

__END_DECLS
