(**************************************************************************)
(*                                                                        *)
(*  Transport Layer Security                                              *)
(*  Copyright (C) 2025   Peter Moylan                                     *)
(*                                                                        *)
(*  This program is free software: you can redistribute it and/or modify  *)
(*  it under the terms of the GNU General Public License as published by  *)
(*  the Free Software Foundation, either version 3 of the License, or     *)
(*  (at your option) any later version.                                   *)
(*                                                                        *)
(*  This program is distributed in the hope that it will be useful,       *)
(*  but WITHOUT ANY WARRANTY; without even the implied warranty of        *)
(*  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *)
(*  GNU General Public License for more details.                          *)
(*                                                                        *)
(*  You should have received a copy of the GNU General Public License     *)
(*  along with this program.  If not, see <http://www.gnu.org/licenses/>. *)
(*                                                                        *)
(*  To contact author:   http://www.pmoylan.org   peter@pmoylan.org       *)
(*                                                                        *)
(**************************************************************************)

DEFINITION MODULE TLSCertificates;

        (********************************************************)
        (*                                                      *)
        (*                   TLS certificates                   *)
        (*      For now I'm handling only RSA certificates      *)
        (*                                                      *)
        (*  Programmer:         P. Moylan                       *)
        (*  Started:            5 September 2018                *)
        (*  Last edited:        22 May 2025                     *)
        (*  Status:             OK so far                       *)
        (*                                                      *)
        (********************************************************)


FROM SYSTEM     IMPORT CARD8;
FROM VarStrings IMPORT ByteStringPtr;
FROM TransLog   IMPORT TransactionLogID;
FROM RSAKeys    IMPORT RSAKeyType;
FROM Domains    IMPORT Domain;


PROCEDURE SetINIname (name: ARRAY OF CHAR);

    (* Takes note of our INI name. *)

PROCEDURE SetSingleCertificateMode;

    (* Sets a mode where the domain name is ignored when fetching a     *)
    (* server certificate or private key, because the one certificate   *)
    (* is used for all domains.                                         *)

PROCEDURE AcceptCertificates (logID: TransactionLogID;
                        pdata: ByteStringPtr;  offset: CARDINAL;
                        VAR (*OUT*) key: RSAKeyType): BOOLEAN;

    (* Accepts a chain of certificates sent by the peer.  (But, in this *)
    (* version, we only look at the first one.)  The returned key       *)
    (* parameter is the public key.  It is the caller's responsibility  *)
    (* to deallocate pdata^.                                            *)

PROCEDURE AssembleCertificateChain (D: Domain;
                                    VAR (*OUT*) length: CARDINAL;
                                    VAR (*OUT*) pdata: ByteStringPtr;
                                    ID: TransactionLogID);

    (* Prepares the certificate data for transmission.                  *)

    (* The required format is a 3-byte total length; then, for each     *)
    (* certificate, a 3-byte length followed by the certificate itself. *)
    (* These are preceded by the 4-byte overhead required by the        *)
    (* handshake protocol.                                              *)

    (* That suggests that I need to define a new data type that allows  *)
    (* linking of nested structures, but for now I can't think of an    *)
    (* elegant way to do this.  And, since my present code works, it    *)
    (* might be best not to fix what is not broken.                     *)

PROCEDURE GetPrivateKeyName (D: Domain;  VAR (*OUT*) name: ARRAY OF CHAR);

    (* Returns the name of the private key for this domain. *)

PROCEDURE GetPrivateKey (D: Domain): RSAKeyType;

    (* Returns the private key for this domain. *)

END TLSCertificates.

