WL#2286 Compile MySQL w/YASSL support

yaSSL-0.9.7 library bundled.


BUILD/Makefile.am:
  compile-pentium-debug-yassl added to distribution.
Makefile.am:
  Added yassl_dir to SUBDIRS. It contains path to yassl distribution if --with-yassl
  specified. It is empty otherwise.
configure.in:
  yaSSL CHECK-function call.
extra/Makefile.am:
  yaSSL added to distribution.
include/violite.h:
  YASSL_MYSQL_COMPATIBLE macro must be defined to make yassl headers compatible.

13 files changed, 8231 insertions, 0 deletions

diff --git a/extra/yassl/src/Makefile.am b/extra/yassl/src/Makefile.am
new file mode 100644
index 00000000000..e0b8110b65c
--- /dev/null
+++ b/extra/yassl/src/Makefile.am
@@ -0,0 +1,8 @@
+INCLUDES = -I../include -I../taocrypt/include -I../mySTL
+
+noinst_LIBRARIES = libyassl.a
+libyassl_a_SOURCES = buffer.cpp cert_wrapper.cpp crypto_wrapper.cpp \
+	handshake.cpp lock.cpp log.cpp socket_wrapper.cpp ssl.cpp \
+	timer.cpp yassl_imp.cpp yassl_error.cpp yassl_int.cpp
+EXTRA_DIST = ../include/*.hpp ../include/openssl/*.h
+CXXFLAGS=`echo "@CXXFLAGS@" | sed 's/-fno-implicit-templates//'`
diff --git a/extra/yassl/src/buffer.cpp b/extra/yassl/src/buffer.cpp
new file mode 100644
index 00000000000..c97103c6f6d
--- /dev/null
+++ b/extra/yassl/src/buffer.cpp
@@ -0,0 +1,280 @@
+/* buffer.cpp                               
+ *
+ * Copyright (C) 2003 Sawtooth Consulting Ltd.
+ *
+ * This file is part of yaSSL.
+ *
+ * yaSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * yaSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
+ */
+
+
+/* yaSSL buffer header implements input/output buffers to simulate streaming
+ * with SSL types and sockets
+ */
+
+#include "runtime.hpp"
+#include "buffer.hpp"
+#include "yassl_types.hpp"
+
+namespace yaSSL {
+
+
+
+// Checking Policy should implement a check function that tests whether the
+// index is within the size limit of the array
+
+void Check::check(uint i, uint limit) 
+{ 
+    assert(i < limit);
+}
+
+
+void NoCheck::check(uint, uint) 
+{
+}
+
+
+/* input_buffer operates like a smart c style array with a checking option, 
+ * meant to be read from through [] with AUTO index or read().
+ * Should only write to at/near construction with assign() or raw (e.g., recv)
+ * followed by add_size with the number of elements added by raw write.
+ *
+ * Not using vector because need checked []access, offset, and the ability to
+ * write to the buffer bulk wise and have the correct size
+ */
+
+
+input_buffer::input_buffer() 
+    : size_(0), current_(0), buffer_(0), end_(0) 
+{}
+
+
+input_buffer::input_buffer(uint s) 
+    : size_(0), current_(0), buffer_(new (ys) byte[s]), end_(buffer_ + s)
+{}
+
+
+// with assign
+input_buffer::input_buffer(uint s, const byte* t, uint len) 
+    : size_(0), current_(0), buffer_(new (ys) byte[s]), end_(buffer_ + s) 
+{ 
+    assign(t, len); 
+}
+
+
+input_buffer::~input_buffer() 
+{ 
+    delete [] buffer_; 
+}
+
+
+// users can pass defualt zero length buffer and then allocate
+void input_buffer::allocate(uint s) 
+{ 
+    assert(!buffer_);       // find realloc error
+    buffer_ = new (ys) byte[s];
+    end_ = buffer_ + s; 
+}
+
+
+// for passing to raw writing functions at beginning, then use add_size
+byte* input_buffer::get_buffer() const 
+{ 
+    return buffer_; 
+}
+
+
+// after a raw write user can set new size
+// if you know the size before the write use assign()
+void input_buffer::add_size(uint i) 
+{ 
+    check(size_ + i-1, get_capacity()); 
+    size_ += i; 
+}
+
+
+uint input_buffer::get_capacity()  const 
+{ 
+    return end_ - buffer_; 
+}
+
+
+uint input_buffer::get_current()   const 
+{ 
+    return current_; 
+}
+
+
+uint input_buffer::get_size()      const 
+{ 
+    return size_; 
+}
+
+
+uint input_buffer::get_remaining() const 
+{ 
+    return size_ - current_; 
+}
+
+
+void input_buffer::set_current(uint i) 
+{
+    if (i)
+        check(i - 1, size_); 
+    current_ = i; 
+}
+
+
+// read only access through [], advance current
+// user passes in AUTO index for ease of use
+const byte& input_buffer::operator[](uint i) 
+{
+    assert (i == AUTO);
+    check(current_, size_);
+    return buffer_[current_++];
+}
+
+
+// end of input test
+bool input_buffer::eof() 
+{ 
+    return current_ >= size_; 
+}
+
+
+// peek ahead
+byte input_buffer::peek() const
+{
+    return buffer_[current_];
+}
+
+
+// write function, should use at/near construction
+void input_buffer::assign(const byte* t, uint s)
+{
+    check(current_, get_capacity());
+    add_size(s);
+    memcpy(&buffer_[current_], t, s);
+}
+
+
+// use read to query input, adjusts current
+void input_buffer::read(byte* dst, uint length)
+{
+    check(current_ + length - 1, size_);
+    memcpy(dst, &buffer_[current_], length);
+    current_ += length;
+}
+
+
+
+/* output_buffer operates like a smart c style array with a checking option.
+ * Meant to be written to through [] with AUTO index or write().
+ * Size (current) counter increases when written to. Can be constructed with 
+ * zero length buffer but be sure to allocate before first use. 
+ * Don't use add write for a couple bytes, use [] instead, way less overhead.
+ * 
+ * Not using vector because need checked []access and the ability to
+ * write to the buffer bulk wise and retain correct size
+ */
+
+
+output_buffer::output_buffer() 
+    : current_(0), buffer_(0), end_(0) 
+{}
+
+
+// with allocate
+output_buffer::output_buffer(uint s) 
+    : current_(0), buffer_(new (ys) byte[s]), end_(buffer_ + s) 
+{}
+
+
+// with assign
+output_buffer::output_buffer(uint s, const byte* t, uint len) 
+    : current_(0), buffer_(new (ys) byte[s]), end_(buffer_+ s) 
+{ 
+    write(t, len); 
+}
+
+
+output_buffer::~output_buffer() 
+{ 
+    delete [] buffer_; 
+}
+
+
+uint output_buffer::get_size() const 
+{ 
+    return current_; 
+}
+
+
+uint output_buffer::get_capacity() const 
+{ 
+    return end_ - buffer_; 
+}
+
+
+void output_buffer::set_current(uint c) 
+{ 
+    check(c, get_capacity()); 
+    current_ = c; 
+}
+
+
+// users can pass defualt zero length buffer and then allocate
+void output_buffer::allocate(uint s) 
+{ 
+    assert(!buffer_);   // find realloc error
+    buffer_ = new (ys) byte[s]; end_ = buffer_ + s; 
+}
+
+
+// for passing to reading functions when finished
+const byte* output_buffer::get_buffer() const 
+{ 
+    return buffer_; 
+}
+
+
+// allow write access through [], update current
+// user passes in AUTO as index for ease of use
+byte& output_buffer::operator[](uint i) 
+{
+    assert(i == AUTO);
+    check(current_, get_capacity());
+    return buffer_[current_++];
+}
+
+
+// end of output test
+bool output_buffer::eof() 
+{ 
+    return current_ >= get_capacity(); 
+}
+
+
+void output_buffer::write(const byte* t, uint s)
+{
+    check(current_ + s - 1, get_capacity()); 
+    memcpy(&buffer_[current_], t, s);
+    current_ += s;
+}
+
+
+
+} // naemspace
+
diff --git a/extra/yassl/src/cert_wrapper.cpp b/extra/yassl/src/cert_wrapper.cpp
new file mode 100644
index 00000000000..ab3cb471990
--- /dev/null
+++ b/extra/yassl/src/cert_wrapper.cpp
@@ -0,0 +1,318 @@
+/* cert_wrapper.cpp                          
+ *
+ * Copyright (C) 2003 Sawtooth Consulting Ltd.
+ *
+ * This file is part of yaSSL.
+ *
+ * yaSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * yaSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
+ */
+
+
+/*  The certificate wrapper source implements certificate management functions
+ *
+ */
+
+#include "runtime.hpp"
+#include "cert_wrapper.hpp"
+#include "yassl_int.hpp"
+
+#if defined(USE_CML_LIB)
+    #include "cmapi_cpp.h"
+#else
+    #include "asn.hpp"
+    #include "file.hpp"
+#endif // USE_CML_LIB
+
+
+namespace yaSSL {
+
+
+x509::x509(uint sz) : length_(sz), buffer_(new (ys) opaque[sz]) 
+{
+}
+
+
+x509::~x509() 
+{ 
+    delete [] buffer_; 
+}
+
+
+x509::x509(const x509& that) : length_(that.length_),
+                               buffer_(new (ys) opaque[length_])
+{
+    memcpy(buffer_, that.buffer_, length_);
+}
+
+
+void x509::Swap(x509& that)
+{
+    mySTL::swap(length_, that.length_);
+    mySTL::swap(buffer_, that.buffer_);
+}
+
+
+x509& x509::operator=(const x509& that)
+{
+    x509 temp(that);
+    Swap(temp);
+    return *this;
+}
+
+
+uint x509::get_length() const
+{ 
+    return length_; 
+}
+
+
+const opaque* x509::get_buffer() const
+{ 
+    return buffer_; 
+}
+
+
+opaque* x509::use_buffer()
+{ 
+    return buffer_; 
+}
+
+
+//CertManager
+CertManager::CertManager()
+    : peerX509_(0), verifyPeer_(false), failNoCert_(false), sendVerify_(false)
+{}
+
+
+CertManager::~CertManager()
+{
+    delete peerX509_;
+
+    mySTL::for_each(signers_.begin(), signers_.end(), del_ptr_zero()) ;
+
+    mySTL::for_each(peerList_.begin(), peerList_.end(), del_ptr_zero()) ;
+
+    mySTL::for_each(list_.begin(), list_.end(), del_ptr_zero()) ;
+}
+
+
+bool CertManager::verifyPeer() const
+{
+    return verifyPeer_;
+}
+
+
+bool CertManager::failNoCert() const
+{
+    return failNoCert_;
+}
+
+
+bool CertManager::sendVerify() const
+{
+    return sendVerify_;
+}
+
+
+void CertManager::setVerifyPeer()
+{
+    verifyPeer_ = true;
+}
+
+
+void CertManager::setFailNoCert()
+{
+    failNoCert_ = true;
+}
+
+
+void CertManager::setSendVerify()
+{
+    sendVerify_ = true;
+}
+
+
+void CertManager::AddPeerCert(x509* x)
+{ 
+    peerList_.push_back(x);  // take ownership
+}
+
+
+void CertManager::CopySelfCert(const x509* x)
+{
+    if (x)
+        list_.push_back(new (ys) x509(*x));
+}
+
+
+// add to signers
+int CertManager::CopyCaCert(const x509* x)
+{
+    TaoCrypt::Source source(x->get_buffer(), x->get_length());
+    TaoCrypt::CertDecoder cert(source, true, &signers_);
+
+    if (!cert.GetError().What()) {
+        const TaoCrypt::PublicKey& key = cert.GetPublicKey();
+        signers_.push_back(new (ys) TaoCrypt::Signer(key.GetKey(), key.size(),
+                                        cert.GetCommonName(), cert.GetHash()));
+    }
+    return cert.GetError().What();
+}
+
+
+const x509* CertManager::get_cert() const
+{ 
+    return list_.front();
+}
+
+
+const opaque* CertManager::get_peerKey() const
+{ 
+    return peerPublicKey_.get_buffer();
+}
+
+
+X509* CertManager::get_peerX509() const
+{
+    return peerX509_;
+}
+
+
+SignatureAlgorithm CertManager::get_peerKeyType() const
+{
+    return peerKeyType_;
+}
+
+
+SignatureAlgorithm CertManager::get_keyType() const
+{
+    return keyType_;
+}
+
+
+uint CertManager::get_peerKeyLength() const
+{ 
+    return peerPublicKey_.get_size();
+}
+
+
+const opaque* CertManager::get_privateKey() const
+{ 
+    return privateKey_.get_buffer();
+}
+
+
+uint CertManager::get_privateKeyLength() const
+{ 
+    return privateKey_.get_size();
+}
+
+
+// Validate the peer's certificate list, from root to peer (last to first)
+int CertManager::Validate()
+{
+    CertList::iterator last  = peerList_.rbegin();  // fix this
+    int count = peerList_.size();
+
+    while ( count > 1 ) {
+        TaoCrypt::Source source((*last)->get_buffer(), (*last)->get_length());
+        TaoCrypt::CertDecoder cert(source, true, &signers_);
+
+        if (int err = cert.GetError().What())
+            return err;
+
+        const TaoCrypt::PublicKey& key = cert.GetPublicKey();
+        signers_.push_back(new (ys) TaoCrypt::Signer(key.GetKey(), key.size(),
+                                        cert.GetCommonName(), cert.GetHash()));
+        --last;
+        --count;
+    }
+
+    if (count) {
+        // peer's is at the front
+        TaoCrypt::Source source((*last)->get_buffer(), (*last)->get_length());
+        TaoCrypt::CertDecoder cert(source, true, &signers_);
+
+        if (int err = cert.GetError().What())
+            return err;
+
+        uint sz = cert.GetPublicKey().size();
+        peerPublicKey_.allocate(sz);
+        peerPublicKey_.assign(cert.GetPublicKey().GetKey(), sz);
+
+        if (cert.GetKeyType() == TaoCrypt::RSAk)
+            peerKeyType_ = rsa_sa_algo;
+        else
+            peerKeyType_ = dsa_sa_algo;
+
+        int iSz = cert.GetIssuer() ? strlen(cert.GetIssuer()) + 1 : 0;
+        int sSz = cert.GetCommonName() ? strlen(cert.GetCommonName()) + 1 : 0;
+        peerX509_ = new (ys) X509(cert.GetIssuer(), iSz, cert.GetCommonName(),
+                                  sSz);
+    }
+    return 0;
+}
+
+
+// Set the private key
+int CertManager::SetPrivateKey(const x509& key)
+{
+    privateKey_.allocate(key.get_length());
+    privateKey_.assign(key.get_buffer(), key.get_length());
+
+    // set key type
+    if (x509* cert = list_.front()) {
+        TaoCrypt::Source source(cert->get_buffer(), cert->get_length());
+        TaoCrypt::CertDecoder cert(source, false);
+        cert.DecodeToKey();
+        if (int err = cert.GetError().What())
+            return err;
+        if (cert.GetKeyType() == TaoCrypt::RSAk)
+            keyType_ = rsa_sa_algo;
+        else
+            keyType_ = dsa_sa_algo;
+    }
+    return 0;
+}
+
+
+#if defined(USE_CML_LIB)
+
+// Get the peer's certificate, extract and save public key
+void CertManager::SetPeerKey()
+{
+    // first cert is the peer's
+    x509* main = peerList_.front();
+
+    Bytes_struct cert;
+    cert.num  = main->get_length();
+    cert.data = main->set_buffer();
+
+    CML::Certificate cm(cert);
+    const CML::ASN::Cert& raw = cm.base();
+    CTIL::CSM_Buffer key = raw.pubKeyInfo.key;
+
+    uint sz;
+    opaque* key_buffer = reinterpret_cast<opaque*>(key.Get(sz));
+    peerPublicKey_.allocate(sz);
+    peerPublicKey_.assign(key_buffer, sz);
+}
+
+
+#endif // USE_CML_LIB
+
+
+
+} // namespace
diff --git a/extra/yassl/src/crypto_wrapper.cpp b/extra/yassl/src/crypto_wrapper.cpp
new file mode 100644
index 00000000000..72822430a51
--- /dev/null
+++ b/extra/yassl/src/crypto_wrapper.cpp
@@ -0,0 +1,970 @@
+/* crypto_wrapper.cpp  
+ *
+ * Copyright (C) 2003 Sawtooth Consulting Ltd.
+ *
+ * This file is part of yaSSL.
+ *
+ * yaSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * yaSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
+ */
+
+/*  The crypto wrapper source implements the policies for the cipher
+ *  components used by SSL.
+ *
+ *  The implementation relies on a specfic library, taoCrypt.
+ */
+
+#if !defined(USE_CRYPTOPP_LIB)
+
+#include "runtime.hpp"
+#include "crypto_wrapper.hpp"
+#include "cert_wrapper.hpp"
+
+#include "md5.hpp"
+#include "sha.hpp"
+#include "ripemd.hpp"
+#include "hmac.hpp"
+#include "modes.hpp"
+#include "des.hpp"
+#include "arc4.hpp"
+#include "aes.hpp"
+#include "rsa.hpp"
+#include "dsa.hpp"
+#include "dh.hpp"
+#include "random.hpp"
+#include "file.hpp"
+#include "coding.hpp"
+
+
+namespace yaSSL {
+
+
+// MD5 Implementation
+struct MD5::MD5Impl {
+    TaoCrypt::MD5 md5_;
+    MD5Impl() {}
+    explicit MD5Impl(const TaoCrypt::MD5& md5) : md5_(md5) {}
+};
+
+
+MD5::MD5() : pimpl_(new (ys) MD5Impl) {}
+
+
+MD5::~MD5() { delete pimpl_; }
+
+
+MD5::MD5(const MD5& that) : Digest(), pimpl_(new (ys) 
+                                             MD5Impl(that.pimpl_->md5_)) {}
+
+
+MD5& MD5::operator=(const MD5& that)
+{
+    pimpl_->md5_ = that.pimpl_->md5_;
+    return *this;
+}
+
+
+uint MD5::get_digestSize() const
+{
+    return MD5_LEN;
+}
+
+
+uint MD5::get_padSize() const
+{
+    return PAD_MD5;
+}
+
+
+// Fill out with MD5 digest from in that is sz bytes, out must be >= digest sz
+void MD5::get_digest(byte* out, const byte* in, unsigned int sz)
+{
+    pimpl_->md5_.Update(in, sz);
+    pimpl_->md5_.Final(out);
+}
+
+// Fill out with MD5 digest from previous updates
+void MD5::get_digest(byte* out)
+{
+    pimpl_->md5_.Final(out);
+}
+
+
+// Update the current digest
+void MD5::update(const byte* in, unsigned int sz)
+{
+    pimpl_->md5_.Update(in, sz);
+}
+
+
+// SHA Implementation
+struct SHA::SHAImpl {
+    TaoCrypt::SHA sha_;
+    SHAImpl() {}
+    explicit SHAImpl(const TaoCrypt::SHA& sha) : sha_(sha) {}
+};
+
+
+SHA::SHA() : pimpl_(new (ys) SHAImpl) {}
+
+
+SHA::~SHA() { delete pimpl_; }
+
+
+SHA::SHA(const SHA& that) : Digest(), pimpl_(new (ys)
+                                             SHAImpl(that.pimpl_->sha_)) {}
+
+SHA& SHA::operator=(const SHA& that)
+{
+    pimpl_->sha_ = that.pimpl_->sha_;
+    return *this;
+}
+
+
+uint SHA::get_digestSize() const
+{
+    return SHA_LEN;
+}
+
+
+uint SHA::get_padSize() const
+{
+    return PAD_SHA;
+}
+
+
+// Fill out with SHA digest from in that is sz bytes, out must be >= digest sz
+void SHA::get_digest(byte* out, const byte* in, unsigned int sz)
+{
+    pimpl_->sha_.Update(in, sz);
+    pimpl_->sha_.Final(out);
+}
+
+
+// Fill out with SHA digest from previous updates
+void SHA::get_digest(byte* out)
+{
+    pimpl_->sha_.Final(out);
+}
+
+
+// Update the current digest
+void SHA::update(const byte* in, unsigned int sz)
+{
+    pimpl_->sha_.Update(in, sz);
+}
+
+
+// RMD-160 Implementation
+struct RMD::RMDImpl {
+    TaoCrypt::RIPEMD160 rmd_;
+    RMDImpl() {}
+    explicit RMDImpl(const TaoCrypt::RIPEMD160& rmd) : rmd_(rmd) {}
+};
+
+
+RMD::RMD() : pimpl_(new (ys) RMDImpl) {}
+
+
+RMD::~RMD() { delete pimpl_; }
+
+
+RMD::RMD(const RMD& that) : Digest(), pimpl_(new (ys)
+                                             RMDImpl(that.pimpl_->rmd_)) {}
+
+RMD& RMD::operator=(const RMD& that)
+{
+    pimpl_->rmd_ = that.pimpl_->rmd_;
+    return *this;
+}
+
+
+uint RMD::get_digestSize() const
+{
+    return RMD_LEN;
+}
+
+
+uint RMD::get_padSize() const
+{
+    return PAD_RMD;
+}
+
+
+// Fill out with RMD digest from in that is sz bytes, out must be >= digest sz
+void RMD::get_digest(byte* out, const byte* in, unsigned int sz)
+{
+    pimpl_->rmd_.Update(in, sz);
+    pimpl_->rmd_.Final(out);
+}
+
+
+// Fill out with RMD digest from previous updates
+void RMD::get_digest(byte* out)
+{
+    pimpl_->rmd_.Final(out);
+}
+
+
+// Update the current digest
+void RMD::update(const byte* in, unsigned int sz)
+{
+    pimpl_->rmd_.Update(in, sz);
+}
+
+
+// HMAC_MD5 Implementation
+struct HMAC_MD5::HMAC_MD5Impl {
+    TaoCrypt::HMAC<TaoCrypt::MD5> mac_;
+    HMAC_MD5Impl() {}
+};
+
+
+HMAC_MD5::HMAC_MD5(const byte* secret, unsigned int len) 
+    : pimpl_(new (ys) HMAC_MD5Impl) 
+{
+    pimpl_->mac_.SetKey(secret, len);
+}
+
+
+HMAC_MD5::~HMAC_MD5() { delete pimpl_; }
+
+
+uint HMAC_MD5::get_digestSize() const
+{
+    return MD5_LEN;
+}
+
+
+uint HMAC_MD5::get_padSize() const
+{
+    return PAD_MD5;
+}
+
+
+// Fill out with MD5 digest from in that is sz bytes, out must be >= digest sz
+void HMAC_MD5::get_digest(byte* out, const byte* in, unsigned int sz)
+{
+    pimpl_->mac_.Update(in, sz);
+    pimpl_->mac_.Final(out);
+}
+
+// Fill out with MD5 digest from previous updates
+void HMAC_MD5::get_digest(byte* out)
+{
+    pimpl_->mac_.Final(out);
+}
+
+
+// Update the current digest
+void HMAC_MD5::update(const byte* in, unsigned int sz)
+{
+    pimpl_->mac_.Update(in, sz);
+}
+
+
+// HMAC_SHA Implementation
+struct HMAC_SHA::HMAC_SHAImpl {
+    TaoCrypt::HMAC<TaoCrypt::SHA> mac_;
+    HMAC_SHAImpl() {}
+};
+
+
+HMAC_SHA::HMAC_SHA(const byte* secret, unsigned int len) 
+    : pimpl_(new (ys) HMAC_SHAImpl) 
+{
+    pimpl_->mac_.SetKey(secret, len);
+}
+
+
+HMAC_SHA::~HMAC_SHA() { delete pimpl_; }
+
+
+uint HMAC_SHA::get_digestSize() const
+{
+    return SHA_LEN;
+}
+
+
+uint HMAC_SHA::get_padSize() const
+{
+    return PAD_SHA;
+}
+
+
+// Fill out with SHA digest from in that is sz bytes, out must be >= digest sz
+void HMAC_SHA::get_digest(byte* out, const byte* in, unsigned int sz)
+{
+    pimpl_->mac_.Update(in, sz);
+    pimpl_->mac_.Final(out);
+}
+
+// Fill out with SHA digest from previous updates
+void HMAC_SHA::get_digest(byte* out)
+{
+    pimpl_->mac_.Final(out);
+}
+
+
+// Update the current digest
+void HMAC_SHA::update(const byte* in, unsigned int sz)
+{
+    pimpl_->mac_.Update(in, sz);
+}
+
+
+
+// HMAC_RMD Implementation
+struct HMAC_RMD::HMAC_RMDImpl {
+    TaoCrypt::HMAC<TaoCrypt::RIPEMD160> mac_;
+    HMAC_RMDImpl() {}
+};
+
+
+HMAC_RMD::HMAC_RMD(const byte* secret, unsigned int len) 
+    : pimpl_(new (ys) HMAC_RMDImpl) 
+{
+    pimpl_->mac_.SetKey(secret, len);
+}
+
+
+HMAC_RMD::~HMAC_RMD() { delete pimpl_; }
+
+
+uint HMAC_RMD::get_digestSize() const
+{
+    return RMD_LEN;
+}
+
+
+uint HMAC_RMD::get_padSize() const
+{
+    return PAD_RMD;
+}
+
+
+// Fill out with RMD digest from in that is sz bytes, out must be >= digest sz
+void HMAC_RMD::get_digest(byte* out, const byte* in, unsigned int sz)
+{
+    pimpl_->mac_.Update(in, sz);
+    pimpl_->mac_.Final(out);
+}
+
+// Fill out with RMD digest from previous updates
+void HMAC_RMD::get_digest(byte* out)
+{
+    pimpl_->mac_.Final(out);
+}
+
+
+// Update the current digest
+void HMAC_RMD::update(const byte* in, unsigned int sz)
+{
+    pimpl_->mac_.Update(in, sz);
+}
+
+
+struct DES::DESImpl {
+    TaoCrypt::DES_CBC_Encryption encryption;
+    TaoCrypt::DES_CBC_Decryption decryption;
+};
+
+
+DES::DES() : pimpl_(new (ys) DESImpl) {}
+
+DES::~DES() { delete pimpl_; }
+
+
+void DES::set_encryptKey(const byte* k, const byte* iv)
+{
+    pimpl_->encryption.SetKey(k, DES_KEY_SZ, iv);
+}
+
+
+void DES::set_decryptKey(const byte* k, const byte* iv)
+{
+    pimpl_->decryption.SetKey(k, DES_KEY_SZ, iv);
+}
+
+// DES encrypt plain of length sz into cipher
+void DES::encrypt(byte* cipher, const byte* plain, unsigned int sz)
+{
+    pimpl_->encryption.Process(cipher, plain, sz);
+}
+
+
+// DES decrypt cipher of length sz into plain
+void DES::decrypt(byte* plain, const byte* cipher, unsigned int sz)
+{
+    pimpl_->decryption.Process(plain, cipher, sz);
+}
+
+
+struct DES_EDE::DES_EDEImpl {
+    TaoCrypt::DES_EDE3_CBC_Encryption encryption;
+    TaoCrypt::DES_EDE3_CBC_Decryption decryption;
+};
+
+
+DES_EDE::DES_EDE() : pimpl_(new (ys) DES_EDEImpl) {}
+
+DES_EDE::~DES_EDE() { delete pimpl_; }
+
+
+void DES_EDE::set_encryptKey(const byte* k, const byte* iv)
+{
+    pimpl_->encryption.SetKey(k, DES_EDE_KEY_SZ, iv);
+}
+
+
+void DES_EDE::set_decryptKey(const byte* k, const byte* iv)
+{
+    pimpl_->decryption.SetKey(k, DES_EDE_KEY_SZ, iv);
+}
+
+
+// 3DES encrypt plain of length sz into cipher
+void DES_EDE::encrypt(byte* cipher, const byte* plain, unsigned int sz)
+{
+    pimpl_->encryption.Process(cipher, plain, sz);
+}
+
+
+// 3DES decrypt cipher of length sz into plain
+void DES_EDE::decrypt(byte* plain, const byte* cipher, unsigned int sz)
+{
+    pimpl_->decryption.Process(plain, cipher, sz);
+}
+
+
+// Implementation of alledged RC4
+struct RC4::RC4Impl {
+    TaoCrypt::ARC4::Encryption encryption;
+    TaoCrypt::ARC4::Decryption decryption;
+};
+
+
+RC4::RC4() : pimpl_(new (ys) RC4Impl) {}
+
+RC4::~RC4() { delete pimpl_; }
+
+
+void RC4::set_encryptKey(const byte* k, const byte*)
+{
+    pimpl_->encryption.SetKey(k, RC4_KEY_SZ);
+}
+
+
+void RC4::set_decryptKey(const byte* k, const byte*)
+{
+    pimpl_->decryption.SetKey(k, RC4_KEY_SZ);
+}
+
+
+// RC4 encrypt plain of length sz into cipher
+void RC4::encrypt(byte* cipher, const byte* plain, unsigned int sz)
+{
+    pimpl_->encryption.Process(cipher, plain, sz);
+}
+
+
+// RC4 decrypt cipher of length sz into plain
+void RC4::decrypt(byte* plain, const byte* cipher, unsigned int sz)
+{
+    pimpl_->decryption.Process(plain, cipher, sz);
+}
+
+
+
+// Implementation of AES
+struct AES::AESImpl {
+    TaoCrypt::AES_CBC_Encryption encryption;
+    TaoCrypt::AES_CBC_Decryption decryption;
+    unsigned int keySz_;
+
+    AESImpl(unsigned int ks) : keySz_(ks) {}
+};
+
+
+AES::AES(unsigned int ks) : pimpl_(new (ys) AESImpl(ks)) {}
+
+AES::~AES() { delete pimpl_; }
+
+
+int AES::get_keySize() const
+{
+    return pimpl_->keySz_;
+}
+
+
+void AES::set_encryptKey(const byte* k, const byte* iv)
+{
+    pimpl_->encryption.SetKey(k, pimpl_->keySz_, iv);
+}
+
+
+void AES::set_decryptKey(const byte* k, const byte* iv)
+{
+    pimpl_->decryption.SetKey(k, pimpl_->keySz_, iv);
+}
+
+
+// AES encrypt plain of length sz into cipher
+void AES::encrypt(byte* cipher, const byte* plain, unsigned int sz)
+{
+    pimpl_->encryption.Process(cipher, plain, sz);
+}
+
+
+// AES decrypt cipher of length sz into plain
+void AES::decrypt(byte* plain, const byte* cipher, unsigned int sz)
+{
+    pimpl_->decryption.Process(plain, cipher, sz);
+}
+
+
+struct RandomPool::RandomImpl {
+    TaoCrypt::RandomNumberGenerator RNG_;
+};
+
+RandomPool::RandomPool() : pimpl_(new (ys) RandomImpl) {}
+
+RandomPool::~RandomPool() { delete pimpl_; }
+
+int RandomPool::GetError() const
+{
+    return pimpl_->RNG_.GetError(); 
+}
+
+void RandomPool::Fill(opaque* dst, uint sz) const
+{
+    pimpl_->RNG_.GenerateBlock(dst, sz);
+}
+
+
+// Implementation of DSS Authentication
+struct DSS::DSSImpl {
+    void SetPublic (const byte*, unsigned int);
+    void SetPrivate(const byte*, unsigned int);
+    TaoCrypt::DSA_PublicKey publicKey_;
+    TaoCrypt::DSA_PrivateKey privateKey_;
+};
+
+
+// Decode and store the public key
+void DSS::DSSImpl::SetPublic(const byte* key, unsigned int sz)
+{
+    TaoCrypt::Source source(key, sz);
+    publicKey_.Initialize(source);
+}
+
+
+// Decode and store the public key
+void DSS::DSSImpl::SetPrivate(const byte* key, unsigned int sz)
+{
+    TaoCrypt::Source source(key, sz);
+    privateKey_.Initialize(source);
+    publicKey_ = TaoCrypt::DSA_PublicKey(privateKey_);
+
+}
+
+
+// Set public or private key
+DSS::DSS(const byte* key, unsigned int sz, bool publicKey) 
+    : pimpl_(new (ys) DSSImpl)
+{
+    if (publicKey) 
+        pimpl_->SetPublic(key, sz);
+    else
+        pimpl_->SetPrivate(key, sz);
+}
+
+
+DSS::~DSS()
+{
+    delete pimpl_;
+}
+
+
+uint DSS::get_signatureLength() const
+{
+    return pimpl_->publicKey_.SignatureLength();
+}
+
+
+// DSS Sign message of length sz into sig
+void DSS::sign(byte* sig,  const byte* sha_digest, unsigned int /* shaSz */,
+               const RandomPool& random)
+{
+    using namespace TaoCrypt;
+
+    DSA_Signer signer(pimpl_->privateKey_);
+    signer.Sign(sha_digest, sig, random.pimpl_->RNG_);
+}
+
+
+// DSS Verify message of length sz against sig, is it correct?
+bool DSS::verify(const byte* sha_digest, unsigned int /* shaSz */,
+                 const byte* sig, unsigned int /* sigSz */)
+{
+    using namespace TaoCrypt;
+
+    DSA_Verifier ver(pimpl_->publicKey_);
+    return ver.Verify(sha_digest, sig);
+}
+
+
+// Implementation of RSA key interface
+struct RSA::RSAImpl {
+    void SetPublic (const byte*, unsigned int);
+    void SetPrivate(const byte*, unsigned int);
+    TaoCrypt::RSA_PublicKey publicKey_;
+    TaoCrypt::RSA_PrivateKey privateKey_;
+};
+
+
+// Decode and store the public key
+void RSA::RSAImpl::SetPublic(const byte* key, unsigned int sz)
+{
+    TaoCrypt::Source source(key, sz);
+    publicKey_.Initialize(source);
+}
+
+
+// Decode and store the private key
+void RSA::RSAImpl::SetPrivate(const byte* key, unsigned int sz)
+{
+    TaoCrypt::Source source(key, sz);
+    privateKey_.Initialize(source);
+    publicKey_ = TaoCrypt::RSA_PublicKey(privateKey_);
+}
+
+
+// Set public or private key
+RSA::RSA(const byte* key, unsigned int sz, bool publicKey) 
+    : pimpl_(new (ys) RSAImpl)
+{
+    if (publicKey) 
+        pimpl_->SetPublic(key, sz);
+    else
+        pimpl_->SetPrivate(key, sz);
+}
+
+RSA::~RSA()
+{
+    delete pimpl_;
+}
+
+
+// get cipher text length, varies on key size
+unsigned int RSA::get_cipherLength() const
+{
+    return pimpl_->publicKey_.FixedCiphertextLength();
+}
+
+
+// get signautre length, varies on key size
+unsigned int RSA::get_signatureLength() const
+{
+    return get_cipherLength();
+}
+
+
+// RSA Sign message of length sz into sig
+void RSA::sign(byte* sig,  const byte* message, unsigned int sz,
+               const RandomPool& random)
+{
+    TaoCrypt::RSAES_Decryptor dec(pimpl_->privateKey_);
+    dec.SSL_Sign(message, sz, sig, random.pimpl_->RNG_);
+}
+
+
+// RSA Verify message of length sz against sig
+bool RSA::verify(const byte* message, unsigned int sz, const byte* sig,
+                 unsigned int)
+{
+    TaoCrypt::RSAES_Encryptor enc(pimpl_->publicKey_);
+    return enc.SSL_Verify(message, sz, sig);
+}
+
+
+// RSA public encrypt plain of length sz into cipher
+void RSA::encrypt(byte* cipher, const byte* plain, unsigned int sz,
+                  const RandomPool& random)
+{
+  
+    TaoCrypt::RSAES_Encryptor enc(pimpl_->publicKey_);
+    enc.Encrypt(plain, sz, cipher, random.pimpl_->RNG_);
+}
+
+
+// RSA private decrypt cipher of length sz into plain
+void RSA::decrypt(byte* plain, const byte* cipher, unsigned int sz,
+                  const RandomPool& random)
+{
+    TaoCrypt::RSAES_Decryptor dec(pimpl_->privateKey_);
+    dec.Decrypt(cipher, sz, plain, random.pimpl_->RNG_);
+}
+
+
+struct Integer::IntegerImpl {
+    TaoCrypt::Integer int_;
+
+    IntegerImpl() {}
+    explicit IntegerImpl(const TaoCrypt::Integer& i) : int_(i) {}
+};
+
+Integer::Integer() : pimpl_(new (ys) IntegerImpl) {}
+
+Integer::~Integer() { delete pimpl_; }
+
+
+
+Integer::Integer(const Integer& other) : pimpl_(new (ys) 
+                                               IntegerImpl(other.pimpl_->int_))
+{}
+
+
+Integer& Integer::operator=(const Integer& that)
+{
+    pimpl_->int_ = that.pimpl_->int_;
+
+    return *this;
+}
+
+
+void Integer::assign(const byte* num, unsigned int sz)
+{
+    pimpl_->int_ = TaoCrypt::Integer(num, sz);
+}
+
+
+struct DiffieHellman::DHImpl {
+    TaoCrypt::DH                     dh_;
+    TaoCrypt::RandomNumberGenerator& ranPool_;
+    byte* publicKey_;
+    byte* privateKey_;
+    byte* agreedKey_;
+
+    DHImpl(TaoCrypt::RandomNumberGenerator& r) : ranPool_(r), publicKey_(0),
+                                               privateKey_(0), agreedKey_(0) {}
+    ~DHImpl() {delete[] agreedKey_; delete[] privateKey_; delete[] publicKey_;}
+
+    DHImpl(const DHImpl& that) : dh_(that.dh_), ranPool_(that.ranPool_),
+                                 publicKey_(0), privateKey_(0), agreedKey_(0)
+    {
+        uint length = dh_.GetByteLength();
+        AllocKeys(length, length, length);
+    }
+
+    void AllocKeys(unsigned int pubSz, unsigned int privSz, unsigned int agrSz)
+    {
+        publicKey_  = new (ys) byte[pubSz];
+        privateKey_ = new (ys) byte[privSz];
+        agreedKey_  = new (ys) byte[agrSz];
+    }
+};
+
+
+
+/*
+// server Side DH, server's view
+DiffieHellman::DiffieHellman(const char* file, const RandomPool& random)
+    : pimpl_(new (ys) DHImpl(random.pimpl_->RNG_))
+{
+    using namespace TaoCrypt;
+    Source source;
+    FileSource(file, source);
+    if (source.size() == 0)
+        return; // TODO add error state, and force check
+    HexDecoder hd(source);
+
+    pimpl_->dh_.Initialize(source);
+
+    uint length = pimpl_->dh_.GetByteLength();
+
+    pimpl_->AllocKeys(length, length, length);
+    pimpl_->dh_.GenerateKeyPair(pimpl_->ranPool_, pimpl_->privateKey_,
+                                                  pimpl_->publicKey_);
+}
+*/
+
+
+// server Side DH, client's view
+DiffieHellman::DiffieHellman(const byte* p, unsigned int pSz, const byte* g,
+                             unsigned int gSz, const byte* pub,
+                             unsigned int pubSz, const RandomPool& random)
+    : pimpl_(new (ys) DHImpl(random.pimpl_->RNG_))
+{
+    using TaoCrypt::Integer;
+
+    pimpl_->dh_.Initialize(Integer(p, pSz).Ref(), Integer(g, gSz).Ref());
+    pimpl_->publicKey_ = new (ys) opaque[pubSz];
+    memcpy(pimpl_->publicKey_, pub, pubSz);
+}
+
+
+// Server Side DH, server's view
+DiffieHellman::DiffieHellman(const Integer& p, const Integer& g,
+                             const RandomPool& random)
+: pimpl_(new (ys) DHImpl(random.pimpl_->RNG_))
+{
+    using TaoCrypt::Integer;
+
+    pimpl_->dh_.Initialize(p.pimpl_->int_, g.pimpl_->int_);
+
+    uint length = pimpl_->dh_.GetByteLength();
+
+    pimpl_->AllocKeys(length, length, length);
+    pimpl_->dh_.GenerateKeyPair(pimpl_->ranPool_, pimpl_->privateKey_,
+                                                  pimpl_->publicKey_);
+}
+
+DiffieHellman::~DiffieHellman() { delete pimpl_; }
+
+
+// Client side and view, use server that for p and g
+DiffieHellman::DiffieHellman(const DiffieHellman& that) 
+    : pimpl_(new (ys) DHImpl(*that.pimpl_))
+{   
+    pimpl_->dh_.GenerateKeyPair(pimpl_->ranPool_, pimpl_->privateKey_,
+                                                  pimpl_->publicKey_);
+}
+
+
+DiffieHellman& DiffieHellman::operator=(const DiffieHellman& that)
+{
+    pimpl_->dh_ = that.pimpl_->dh_;
+    pimpl_->dh_.GenerateKeyPair(pimpl_->ranPool_, pimpl_->privateKey_,
+                                                  pimpl_->publicKey_);
+    return *this;
+}
+
+
+void DiffieHellman::makeAgreement(const byte* other)
+{
+    pimpl_->dh_.Agree(pimpl_->agreedKey_, pimpl_->privateKey_, other); 
+}
+
+
+uint DiffieHellman::get_agreedKeyLength() const
+{
+    return pimpl_->dh_.GetByteLength();
+}
+
+
+const byte* DiffieHellman::get_agreedKey() const
+{
+    return pimpl_->agreedKey_;
+}
+
+
+const byte* DiffieHellman::get_publicKey() const
+{
+    return pimpl_->publicKey_;
+}
+
+
+void DiffieHellman::set_sizes(int& pSz, int& gSz, int& pubSz) const
+{
+    using TaoCrypt::Integer;
+    Integer p = pimpl_->dh_.GetP();
+    Integer g = pimpl_->dh_.GetG();
+
+    pSz   = p.ByteCount();
+    gSz   = g.ByteCount();
+    pubSz = pimpl_->dh_.GetByteLength();
+}
+
+
+void DiffieHellman::get_parms(byte* bp, byte* bg, byte* bpub) const
+{
+    using TaoCrypt::Integer;
+    Integer p = pimpl_->dh_.GetP();
+    Integer g = pimpl_->dh_.GetG();
+
+    p.Encode(bp, p.ByteCount());
+    g.Encode(bg, g.ByteCount());
+    memcpy(bpub, pimpl_->publicKey_, pimpl_->dh_.GetByteLength());
+}
+
+
+// convert PEM file to DER x509 type
+x509* PemToDer(const char* fname, CertType type)
+{
+    using namespace TaoCrypt;
+
+    char header[80];
+    char footer[80];
+
+    if (type == Cert) {
+        strncpy(header, "-----BEGIN CERTIFICATE-----", sizeof(header));
+        strncpy(footer, "-----END CERTIFICATE-----", sizeof(footer));
+    } else {
+        strncpy(header, "-----BEGIN RSA PRIVATE KEY-----", sizeof(header));
+        strncpy(footer, "-----END RSA PRIVATE KEY-----", sizeof(header));
+    }
+
+    FILE* file = fopen(fname, "rb");
+    if (!file)
+        return 0;
+
+    long begin = -1;
+    long end   = 0;
+    bool foundEnd = false;
+
+    char line[80];
+
+    while(fgets(line, sizeof(line), file))
+        if (strncmp(header, line, strlen(header)) == 0) {
+            begin = ftell(file);
+            break;
+        }
+
+    while(fgets(line, sizeof(line), file))
+        if (strncmp(footer, line, strlen(footer)) == 0) {
+            foundEnd = true;
+            break;
+        }
+        else
+            end = ftell(file);
+
+    if (begin == -1 || !foundEnd) {
+        fclose(file);
+        return 0;
+    }
+
+    input_buffer tmp(end - begin);
+    fseek(file, begin, SEEK_SET);
+    size_t bytes = fread(tmp.get_buffer(), end - begin, 1, file);
+    if (bytes != 1) {
+        fclose(file);
+        return 0;
+    }
+    
+    Source der(tmp.get_buffer(), end - begin);
+    Base64Decoder b64Dec(der);
+
+    uint sz = der.size();
+    mySTL::auto_ptr<x509> x(new (ys) x509(sz));
+    memcpy(x->use_buffer(), der.get_buffer(), sz);
+
+    fclose(file);
+    return x.release();
+}
+
+
+} // namespace
+
+#endif // !USE_CRYPTOPP_LIB
diff --git a/extra/yassl/src/handshake.cpp b/extra/yassl/src/handshake.cpp
new file mode 100644
index 00000000000..35c4cbd4922
--- /dev/null
+++ b/extra/yassl/src/handshake.cpp
@@ -0,0 +1,1011 @@
+/* handshake.cpp                                
+ *
+ * Copyright (C) 2003 Sawtooth Consulting Ltd.
+ *
+ * This file is part of yaSSL.
+ *
+ * yaSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * yaSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
+ */
+
+
+/* The handshake source implements functions for creating and reading
+ * the various handshake messages.
+ */
+
+#include "runtime.hpp"
+#include "handshake.hpp"
+#include "yassl_int.hpp"
+
+
+namespace yaSSL {
+
+using mySTL::min;
+
+
+// Build a client hello message from cipher suites and compression method
+void buildClientHello(SSL& ssl, ClientHello& hello,
+                      CompressionMethod compression = no_compression)
+{
+    ssl.getCrypto().get_random().Fill(hello.random_, RAN_LEN);
+    if (ssl.getSecurity().get_resuming()) {
+        hello.id_len_ = ID_LEN;
+        memcpy(hello.session_id_, ssl.getSecurity().get_resume().GetID(),
+               ID_LEN);
+    }
+    else 
+        hello.id_len_ = 0;
+    hello.suite_len_ = ssl.getSecurity().get_parms().suites_size_;
+    memcpy(hello.cipher_suites_, ssl.getSecurity().get_parms().suites_,
+           hello.suite_len_);
+    hello.comp_len_ = 1;                   
+    hello.compression_methods_ = compression;   
+
+    hello.set_length(sizeof(ProtocolVersion) +
+                     RAN_LEN +
+                     hello.id_len_    + sizeof(hello.id_len_) +
+                     hello.suite_len_ + sizeof(hello.suite_len_) +
+                     hello.comp_len_  + sizeof(hello.comp_len_));
+}
+
+
+// Build a server hello message
+void buildServerHello(SSL& ssl, ServerHello& hello)
+{
+    if (ssl.getSecurity().get_resuming()) {
+        memcpy(hello.random_,ssl.getSecurity().get_connection().server_random_,
+               RAN_LEN);
+        memcpy(hello.session_id_, ssl.getSecurity().get_resume().GetID(),
+               ID_LEN);
+    }
+    else {
+        ssl.getCrypto().get_random().Fill(hello.random_, RAN_LEN);
+        ssl.getCrypto().get_random().Fill(hello.session_id_, ID_LEN);
+    }
+    hello.id_len_ = ID_LEN;
+    ssl.set_sessionID(hello.session_id_);
+
+    hello.cipher_suite_[0] = ssl.getSecurity().get_parms().suite_[0];
+    hello.cipher_suite_[1] = ssl.getSecurity().get_parms().suite_[1];
+    hello.compression_method_ = no_compression;
+
+    hello.set_length(sizeof(ProtocolVersion) + RAN_LEN + ID_LEN +
+                     sizeof(hello.id_len_) + SUITE_LEN + SIZEOF_ENUM);
+}
+
+
+// add handshake from buffer into md5 and sha hashes, use handshake header
+void hashHandShake(SSL& ssl, const input_buffer& input, uint sz)
+{
+    const opaque* buffer = input.get_buffer() + input.get_current() - 
+                           HANDSHAKE_HEADER;
+    sz += HANDSHAKE_HEADER;
+    ssl.useHashes().use_MD5().update(buffer, sz);
+    ssl.useHashes().use_SHA().update(buffer, sz);
+}
+
+
+// locals
+namespace {
+
+// Write a plaintext record to buffer
+void buildOutput(output_buffer& buffer, const RecordLayerHeader& rlHdr, 
+                 const Message& msg)
+{
+    buffer.allocate(RECORD_HEADER + rlHdr.length_);
+    buffer << rlHdr << msg;
+}
+
+
+// Write a plaintext record to buffer
+void buildOutput(output_buffer& buffer, const RecordLayerHeader& rlHdr, 
+                 const HandShakeHeader& hsHdr, const HandShakeBase& shake)
+{
+    buffer.allocate(RECORD_HEADER + rlHdr.length_);
+    buffer << rlHdr << hsHdr << shake;
+}
+
+
+// Build Record Layer header for Message without handshake header
+void buildHeader(SSL& ssl, RecordLayerHeader& rlHeader, const Message& msg)
+{
+    ProtocolVersion pv = ssl.getSecurity().get_connection().version_;
+    rlHeader.type_ = msg.get_type();
+    rlHeader.version_.major_ = pv.major_;
+    rlHeader.version_.minor_ = pv.minor_;
+    rlHeader.length_ = msg.get_length();
+}
+
+
+// Build HandShake and RecordLayer Headers for handshake output
+void buildHeaders(SSL& ssl, HandShakeHeader& hsHeader,
+                  RecordLayerHeader& rlHeader, const HandShakeBase& shake)
+{
+    int sz = shake.get_length();
+
+    hsHeader.set_type(shake.get_type());
+    hsHeader.set_length(sz);
+
+    ProtocolVersion pv = ssl.getSecurity().get_connection().version_;
+    rlHeader.type_ = handshake;
+    rlHeader.version_.major_ = pv.major_;
+    rlHeader.version_.minor_ = pv.minor_;
+    rlHeader.length_ = sz + HANDSHAKE_HEADER;
+}
+
+
+// add handshake from buffer into md5 and sha hashes, exclude record header
+void hashHandShake(SSL& ssl, const output_buffer& output)
+{
+    uint sz = output.get_size() - RECORD_HEADER;
+
+    const opaque* buffer = output.get_buffer() + RECORD_HEADER;
+
+    ssl.useHashes().use_MD5().update(buffer, sz);
+    ssl.useHashes().use_SHA().update(buffer, sz);
+}
+
+
+// calculate MD5 hash for finished
+void buildMD5(SSL& ssl, Finished& fin, const opaque* sender)
+{
+
+    opaque md5_result[MD5_LEN];
+    opaque md5_inner[SIZEOF_SENDER + SECRET_LEN + PAD_MD5];
+    opaque md5_outer[SECRET_LEN + PAD_MD5 + MD5_LEN];
+
+    const opaque* master_secret = 
+        ssl.getSecurity().get_connection().master_secret_;
+
+    // make md5 inner
+    memcpy(md5_inner, sender, SIZEOF_SENDER);
+    memcpy(&md5_inner[SIZEOF_SENDER], master_secret, SECRET_LEN);
+    memcpy(&md5_inner[SIZEOF_SENDER + SECRET_LEN], PAD1, PAD_MD5);
+
+    ssl.useHashes().use_MD5().get_digest(md5_result, md5_inner,
+                                         sizeof(md5_inner));
+
+    // make md5 outer
+    memcpy(md5_outer, master_secret, SECRET_LEN);
+    memcpy(&md5_outer[SECRET_LEN], PAD2, PAD_MD5);
+    memcpy(&md5_outer[SECRET_LEN + PAD_MD5], md5_result, MD5_LEN);
+
+    ssl.useHashes().use_MD5().get_digest(fin.set_md5(), md5_outer,
+                                         sizeof(md5_outer));
+}
+
+
+// calculate SHA hash for finished
+void buildSHA(SSL& ssl, Finished& fin, const opaque* sender)
+{
+    
+    opaque sha_result[SHA_LEN];
+    opaque sha_inner[SIZEOF_SENDER + SECRET_LEN + PAD_SHA];
+    opaque sha_outer[SECRET_LEN + PAD_SHA + SHA_LEN];
+
+    const opaque* master_secret = 
+        ssl.getSecurity().get_connection().master_secret_;
+
+     // make sha inner
+    memcpy(sha_inner, sender, SIZEOF_SENDER);
+    memcpy(&sha_inner[SIZEOF_SENDER], master_secret, SECRET_LEN);
+    memcpy(&sha_inner[SIZEOF_SENDER + SECRET_LEN], PAD1, PAD_SHA);
+
+    ssl.useHashes().use_SHA().get_digest(sha_result, sha_inner,
+                                         sizeof(sha_inner));
+
+    // make sha outer
+    memcpy(sha_outer, master_secret, SECRET_LEN);
+    memcpy(&sha_outer[SECRET_LEN], PAD2, PAD_SHA);
+    memcpy(&sha_outer[SECRET_LEN + PAD_SHA], sha_result, SHA_LEN);
+
+    ssl.useHashes().use_SHA().get_digest(fin.set_sha(), sha_outer,
+                                         sizeof(sha_outer));
+}
+
+
+// decrypt input message in place, store size in case needed later
+void decrypt_message(SSL& ssl, input_buffer& input, uint sz)
+{
+    input_buffer plain(sz);
+    opaque*      cipher = input.get_buffer() + input.get_current();
+
+    ssl.useCrypto().use_cipher().decrypt(plain.get_buffer(), cipher, sz);
+    memcpy(cipher, plain.get_buffer(), sz);
+    ssl.useSecurity().use_parms().encrypt_size_ = sz;
+}
+
+
+// write headers, handshake hash, mac, pad, and encrypt
+void cipherFinished(SSL& ssl, Finished& fin, output_buffer& output)
+{
+    uint digestSz = ssl.getCrypto().get_digest().get_digestSize();
+    uint finishedSz = ssl.isTLS() ? TLS_FINISHED_SZ : FINISHED_SZ;
+    uint sz  = RECORD_HEADER + HANDSHAKE_HEADER + finishedSz + digestSz;
+    uint pad = 0;
+    if (ssl.getSecurity().get_parms().cipher_type_ == block) {
+        sz += 1;       // pad byte
+        uint blockSz = ssl.getCrypto().get_cipher().get_blockSize();
+        pad = (sz - RECORD_HEADER) % blockSz;
+        pad = blockSz - pad;
+        sz += pad;
+    }
+
+    RecordLayerHeader rlHeader;
+    HandShakeHeader   hsHeader;
+    buildHeaders(ssl, hsHeader, rlHeader, fin);
+    rlHeader.length_ = sz - RECORD_HEADER;   // record header includes mac
+                                             // and pad, hanshake doesn't
+    output.allocate(sz);
+    output << rlHeader << hsHeader << fin;
+    
+    hashHandShake(ssl, output);
+    opaque digest[SHA_LEN];                  // max size
+    if (ssl.isTLS())
+        TLS_hmac(ssl, digest, output.get_buffer() + RECORD_HEADER,
+                 output.get_size() - RECORD_HEADER, handshake);
+    else
+        hmac(ssl, digest, output.get_buffer() + RECORD_HEADER,
+             output.get_size() - RECORD_HEADER, handshake);
+    output.write(digest, digestSz);
+
+    if (ssl.getSecurity().get_parms().cipher_type_ == block)
+        for (uint i = 0; i <= pad; i++) output[AUTO] = pad;   // pad byte gets
+                                                              // pad value too
+    input_buffer cipher(rlHeader.length_);
+    ssl.useCrypto().use_cipher().encrypt(cipher.get_buffer(),
+       output.get_buffer() + RECORD_HEADER, output.get_size() - RECORD_HEADER);
+    output.set_current(RECORD_HEADER);
+    output.write(cipher.get_buffer(), cipher.get_capacity());
+}
+
+
+// build an encrypted data or alert message for output
+void buildMessage(SSL& ssl, output_buffer& output, const Message& msg)
+{
+    uint digestSz = ssl.getCrypto().get_digest().get_digestSize();
+    uint sz  = RECORD_HEADER + msg.get_length() + digestSz;                
+    uint pad = 0;
+    if (ssl.getSecurity().get_parms().cipher_type_ == block) {
+        sz += 1;       // pad byte
+        uint blockSz = ssl.getCrypto().get_cipher().get_blockSize();
+        pad = (sz - RECORD_HEADER) % blockSz;
+        pad = blockSz - pad;
+        sz += pad;
+    }
+
+    RecordLayerHeader rlHeader;
+    buildHeader(ssl, rlHeader, msg);
+    rlHeader.length_ = sz - RECORD_HEADER;   // record header includes mac
+                                             // and pad, hanshake doesn't
+    output.allocate(sz);
+    output << rlHeader << msg;
+    
+    opaque digest[SHA_LEN];                  // max size
+    if (ssl.isTLS())
+        TLS_hmac(ssl, digest, output.get_buffer() + RECORD_HEADER,
+                 output.get_size() - RECORD_HEADER, msg.get_type());
+    else
+        hmac(ssl, digest, output.get_buffer() + RECORD_HEADER,
+             output.get_size() - RECORD_HEADER, msg.get_type());
+    output.write(digest, digestSz);
+
+    if (ssl.getSecurity().get_parms().cipher_type_ == block)
+        for (uint i = 0; i <= pad; i++) output[AUTO] = pad; // pad byte gets
+                                                              // pad value too
+    input_buffer cipher(rlHeader.length_);
+    ssl.useCrypto().use_cipher().encrypt(cipher.get_buffer(),
+       output.get_buffer() + RECORD_HEADER, output.get_size() - RECORD_HEADER);
+    output.set_current(RECORD_HEADER);
+    output.write(cipher.get_buffer(), cipher.get_capacity());
+}
+
+
+// build alert message
+void buildAlert(SSL& ssl, output_buffer& output, const Alert& alert)
+{
+    if (ssl.getSecurity().get_parms().pending_ == false) // encrypted
+        buildMessage(ssl, output, alert);
+    else {
+        RecordLayerHeader rlHeader;
+        buildHeader(ssl, rlHeader, alert);
+        buildOutput(output, rlHeader, alert);
+    }
+}
+
+
+// build TLS finished message
+void buildFinishedTLS(SSL& ssl, Finished& fin, const opaque* sender) 
+{
+    opaque handshake_hash[FINISHED_SZ];
+
+    ssl.useHashes().use_MD5().get_digest(handshake_hash);
+    ssl.useHashes().use_SHA().get_digest(&handshake_hash[MD5_LEN]);
+
+    const opaque* side;
+    if ( strncmp((const char*)sender, (const char*)client, SIZEOF_SENDER) == 0)
+        side = tls_client;
+    else
+        side = tls_server;
+
+    PRF(fin.set_md5(), TLS_FINISHED_SZ, 
+        ssl.getSecurity().get_connection().master_secret_, SECRET_LEN, 
+        side, FINISHED_LABEL_SZ, 
+        handshake_hash, FINISHED_SZ);
+
+    fin.set_length(TLS_FINISHED_SZ);  // shorter length for TLS
+}
+
+
+// compute p_hash for MD5 or SHA-1 for TLSv1 PRF
+void p_hash(output_buffer& result, const output_buffer& secret,
+            const output_buffer& seed, MACAlgorithm hash)
+{
+    uint   len = hash == md5 ? MD5_LEN : SHA_LEN;
+    uint   times = result.get_capacity() / len;
+    uint   lastLen = result.get_capacity() % len;
+    opaque previous[SHA_LEN];  // max size
+    opaque current[SHA_LEN];   // max size
+    mySTL::auto_ptr<Digest> hmac;
+
+    if (lastLen) times += 1;
+
+    if (hash == md5)
+        hmac.reset(new (ys) HMAC_MD5(secret.get_buffer(), secret.get_size()));
+    else
+        hmac.reset(new (ys) HMAC_SHA(secret.get_buffer(), secret.get_size()));
+                                                                   // A0 = seed
+    hmac->get_digest(previous, seed.get_buffer(), seed.get_size());// A1
+    uint lastTime = times - 1;
+
+    for (uint i = 0; i < times; i++) {
+        hmac->update(previous, len);  
+        hmac->get_digest(current, seed.get_buffer(), seed.get_size());
+
+        if (lastLen && (i == lastTime))
+            result.write(current, lastLen);
+        else {
+            result.write(current, len);
+            //memcpy(previous, current, len);
+            hmac->get_digest(previous, previous, len);
+        }
+    }
+}
+
+
+// calculate XOR for TLSv1 PRF
+void get_xor(byte *digest, uint digLen, output_buffer& md5,
+             output_buffer& sha)
+{
+    for (uint i = 0; i < digLen; i++) 
+        digest[i] = md5[AUTO] ^ sha[AUTO];
+}
+
+
+// build MD5 part of certificate verify
+void buildMD5_CertVerify(SSL& ssl, byte* digest)
+{
+    opaque md5_result[MD5_LEN];
+    opaque md5_inner[SECRET_LEN + PAD_MD5];
+    opaque md5_outer[SECRET_LEN + PAD_MD5 + MD5_LEN];
+
+    const opaque* master_secret = 
+        ssl.getSecurity().get_connection().master_secret_;
+
+    // make md5 inner
+    memcpy(md5_inner, master_secret, SECRET_LEN);
+    memcpy(&md5_inner[SECRET_LEN], PAD1, PAD_MD5);
+
+    ssl.useHashes().use_MD5().get_digest(md5_result, md5_inner,
+                                         sizeof(md5_inner));
+
+    // make md5 outer
+    memcpy(md5_outer, master_secret, SECRET_LEN);
+    memcpy(&md5_outer[SECRET_LEN], PAD2, PAD_MD5);
+    memcpy(&md5_outer[SECRET_LEN + PAD_MD5], md5_result, MD5_LEN);
+
+    ssl.useHashes().use_MD5().get_digest(digest, md5_outer, sizeof(md5_outer));
+}
+
+
+// build SHA part of certificate verify
+void buildSHA_CertVerify(SSL& ssl, byte* digest)
+{
+    opaque sha_result[SHA_LEN];
+    opaque sha_inner[SECRET_LEN + PAD_SHA];
+    opaque sha_outer[SECRET_LEN + PAD_SHA + SHA_LEN];
+
+    const opaque* master_secret = 
+        ssl.getSecurity().get_connection().master_secret_;
+
+     // make sha inner
+    memcpy(sha_inner, master_secret, SECRET_LEN);
+    memcpy(&sha_inner[SECRET_LEN], PAD1, PAD_SHA);
+
+    ssl.useHashes().use_SHA().get_digest(sha_result, sha_inner,
+                                         sizeof(sha_inner));
+
+    // make sha outer
+    memcpy(sha_outer, master_secret, SECRET_LEN);
+    memcpy(&sha_outer[SECRET_LEN], PAD2, PAD_SHA);
+    memcpy(&sha_outer[SECRET_LEN + PAD_SHA], sha_result, SHA_LEN);
+
+    ssl.useHashes().use_SHA().get_digest(digest, sha_outer, sizeof(sha_outer));
+}
+
+
+} // namespace for locals
+
+
+// some clients still send sslv2 client hello
+void ProcessOldClientHello(input_buffer& input, SSL& ssl)
+{
+    byte b0 = input[AUTO];
+    byte b1 = input[AUTO];
+
+    uint16 sz = ((b0 & 0x7f) << 8) | b1;
+
+    // hashHandShake manually
+    const opaque* buffer = input.get_buffer() + input.get_current();
+    ssl.useHashes().use_MD5().update(buffer, sz);
+    ssl.useHashes().use_SHA().update(buffer, sz);
+
+    b1 = input[AUTO];  // does this value mean client_hello?
+
+    ClientHello ch;
+    ch.client_version_.major_ = input[AUTO];
+    ch.client_version_.minor_ = input[AUTO];
+
+    byte len[2];
+
+    input.read(len, sizeof(len));
+    ato16(len, ch.suite_len_);
+
+    input.read(len, sizeof(len));
+    uint16 sessionLen;
+    ato16(len, sessionLen);
+    ch.id_len_ = sessionLen;
+
+    input.read(len, sizeof(len));
+    uint16 randomLen;
+    ato16(len, randomLen);
+
+    int j = 0;
+    for (uint16 i = 0; i < ch.suite_len_; i += 3) {    
+        byte first = input[AUTO];
+        if (first)  // sslv2 type
+            input.read(len, SUITE_LEN); // skip
+        else {
+            input.read(&ch.cipher_suites_[j], SUITE_LEN);
+            j += SUITE_LEN;
+        }
+    }
+    ch.suite_len_ = j;
+
+    if (ch.id_len_)
+        input.read(ch.session_id_, ch.id_len_);
+
+    if (randomLen < RAN_LEN)
+        memset(ch.random_, 0, RAN_LEN - randomLen);
+    input.read(&ch.random_[RAN_LEN - randomLen], randomLen);
+ 
+
+    ch.Process(input, ssl);
+}
+
+
+// Build a finished message, see 7.6.9
+void buildFinished(SSL& ssl, Finished& fin, const opaque* sender) 
+{
+    // store current states, building requires get_digest which resets state
+    MD5 md5(ssl.getHashes().get_MD5());
+    SHA sha(ssl.getHashes().get_SHA());
+
+    if (ssl.isTLS())
+        buildFinishedTLS(ssl, fin, sender);
+    else {
+        buildMD5(ssl, fin, sender);
+        buildSHA(ssl, fin, sender);
+    }
+
+    // restore
+    ssl.useHashes().use_MD5() = md5;
+    ssl.useHashes().use_SHA() = sha;
+}
+
+
+/* compute SSLv3 HMAC into digest see
+ * buffer is of sz size and includes HandShake Header but not a Record Header
+ * verify means to check peers hmac
+*/
+void hmac(SSL& ssl, byte* digest, const byte* buffer, uint sz,
+          ContentType content, bool verify)
+{
+    Digest& mac = ssl.useCrypto().use_digest();
+    opaque inner[SHA_LEN + PAD_MD5 + SEQ_SZ + SIZEOF_ENUM + LENGTH_SZ];
+    opaque outer[SHA_LEN + PAD_MD5 + SHA_LEN]; 
+    opaque result[SHA_LEN];                              // max possible sizes
+    uint digestSz = mac.get_digestSize();              // actual sizes
+    uint padSz    = mac.get_padSize();
+    uint innerSz  = digestSz + padSz + SEQ_SZ + SIZEOF_ENUM + LENGTH_SZ;
+    uint outerSz  = digestSz + padSz + digestSz;
+
+    // data
+    const opaque* mac_secret = ssl.get_macSecret(verify);
+    opaque seq[SEQ_SZ] = { 0x00, 0x00, 0x00, 0x00 };
+    opaque length[LENGTH_SZ];
+    c16toa(sz, length);
+    c32toa(ssl.get_SEQIncrement(verify), &seq[sizeof(uint32)]);
+
+    // make inner
+    memcpy(inner, mac_secret, digestSz);
+    memcpy(&inner[digestSz], PAD1, padSz);
+    memcpy(&inner[digestSz + padSz], seq, SEQ_SZ);
+    inner[digestSz + padSz + SEQ_SZ] = content;
+    memcpy(&inner[digestSz + padSz + SEQ_SZ + SIZEOF_ENUM], length, LENGTH_SZ);
+
+    mac.update(inner, innerSz);
+    mac.get_digest(result, buffer, sz);      // append content buffer
+
+    // make outer
+    memcpy(outer, mac_secret, digestSz);
+    memcpy(&outer[digestSz], PAD2, padSz);
+    memcpy(&outer[digestSz + padSz], result, digestSz);
+
+    mac.get_digest(digest, outer, outerSz);
+}
+
+
+// TLS type HAMC
+void TLS_hmac(SSL& ssl, byte* digest, const byte* buffer, uint sz,
+              ContentType content, bool verify)
+{
+    mySTL::auto_ptr<Digest> hmac;
+    opaque seq[SEQ_SZ] = { 0x00, 0x00, 0x00, 0x00 };
+    opaque length[LENGTH_SZ];
+    opaque inner[SIZEOF_ENUM + VERSION_SZ + LENGTH_SZ]; // type + version + len
+
+    c16toa(sz, length);
+    c32toa(ssl.get_SEQIncrement(verify), &seq[sizeof(uint32)]);
+
+    MACAlgorithm algo = ssl.getSecurity().get_parms().mac_algorithm_;
+
+    if (algo == sha)
+        hmac.reset(new (ys) HMAC_SHA(ssl.get_macSecret(verify), SHA_LEN));
+    else if (algo == rmd)
+        hmac.reset(new (ys) HMAC_RMD(ssl.get_macSecret(verify), RMD_LEN));
+    else
+        hmac.reset(new (ys) HMAC_MD5(ssl.get_macSecret(verify), MD5_LEN));
+    
+    hmac->update(seq, SEQ_SZ);                                       // seq_num
+    inner[0] = content;                                              // type
+    inner[SIZEOF_ENUM] = ssl.getSecurity().get_connection().version_.major_;  
+    inner[SIZEOF_ENUM + SIZEOF_ENUM] = 
+        ssl.getSecurity().get_connection().version_.minor_;          // version
+    memcpy(&inner[SIZEOF_ENUM + VERSION_SZ], length, LENGTH_SZ);     // length
+    hmac->update(inner, sizeof(inner));
+    hmac->get_digest(digest, buffer, sz);                            // content
+}
+
+
+// compute TLSv1 PRF (pseudo random function using HMAC)
+void PRF(byte* digest, uint digLen, const byte* secret, uint secLen,
+         const byte* label, uint labLen, const byte* seed, uint seedLen)
+{
+    uint half = secLen / 2 + secLen % 2;
+
+    output_buffer md5_half(half);
+    output_buffer sha_half(half);
+    output_buffer labelSeed(labLen + seedLen);
+
+    md5_half.write(secret, half);
+    sha_half.write(secret + half - secLen % 2, half);
+    labelSeed.write(label, labLen);
+    labelSeed.write(seed, seedLen);
+
+    output_buffer md5_result(digLen);
+    output_buffer sha_result(digLen);
+
+    p_hash(md5_result, md5_half, labelSeed, md5);
+    p_hash(sha_result, sha_half, labelSeed, sha);
+
+    md5_result.set_current(0);
+    sha_result.set_current(0);
+    get_xor(digest, digLen, md5_result, sha_result);
+}
+
+
+// build certificate hashes
+void build_certHashes(SSL& ssl, Hashes& hashes)
+{
+    // store current states, building requires get_digest which resets state
+    MD5 md5(ssl.getHashes().get_MD5());
+    SHA sha(ssl.getHashes().get_SHA());
+
+    if (ssl.isTLS()) {
+        ssl.useHashes().use_MD5().get_digest(hashes.md5_);
+        ssl.useHashes().use_SHA().get_digest(hashes.sha_);
+    }
+    else {
+        buildMD5_CertVerify(ssl, hashes.md5_);
+        buildSHA_CertVerify(ssl, hashes.sha_);
+    }
+
+    // restore
+    ssl.useHashes().use_MD5() = md5;
+    ssl.useHashes().use_SHA() = sha;
+}
+
+
+mySTL::auto_ptr<input_buffer> null_buffer;
+
+// do process input requests
+mySTL::auto_ptr<input_buffer>
+DoProcessReply(SSL& ssl, mySTL::auto_ptr<input_buffer> buffered)
+{
+    ssl.getSocket().wait();                  // wait for input if blocking
+    uint ready = ssl.getSocket().get_ready();
+    if (!ready) return buffered;
+
+    // add buffered data if its there
+    uint buffSz = buffered.get() ? buffered.get()->get_size() : 0;
+    input_buffer buffer(buffSz + ready);
+    if (buffSz) {
+        buffer.assign(buffered.get()->get_buffer(), buffSz);
+        buffered = null_buffer;
+    }
+
+    // add new data
+    uint read  = ssl.getSocket().receive(buffer.get_buffer() + buffSz, ready);
+    buffer.add_size(read);
+    uint offset = 0;
+    const MessageFactory& mf = ssl.getFactory().getMessage();
+
+    // old style sslv2 client hello?
+    if (ssl.getSecurity().get_parms().entity_ == server_end &&
+                  ssl.getStates().getServer() == clientNull) 
+        if (buffer.peek() != handshake)
+            ProcessOldClientHello(buffer, ssl);
+
+    while(!buffer.eof()) {
+        // each record
+        RecordLayerHeader hdr;
+        buffer >> hdr;
+        ssl.verifyState(hdr);
+
+        // make sure we have enough input in buffer to process this record
+        if (hdr.length_ > buffer.get_remaining()) { 
+            uint sz = buffer.get_remaining() + RECORD_HEADER;
+            buffered.reset(new (ys) input_buffer(sz, buffer.get_buffer() +
+                           buffer.get_current() - RECORD_HEADER, sz));
+            break;
+        }
+
+        while (buffer.get_current() < hdr.length_ + RECORD_HEADER + offset) {
+            // each message in record
+            if (ssl.getSecurity().get_parms().pending_ == false) // cipher on
+                decrypt_message(ssl, buffer, hdr.length_);
+            mySTL::auto_ptr<Message> msg(mf.CreateObject(hdr.type_));
+            if (!msg.get()) {
+                ssl.SetError(factory_error);
+                return buffered = null_buffer;
+            }
+            buffer >> *msg;
+            msg->Process(buffer, ssl);
+            if (ssl.GetError()) return buffered = null_buffer;
+        }
+        offset += hdr.length_ + RECORD_HEADER;
+    }
+    return buffered;  // done, don't call again
+}
+
+
+// process input requests
+void processReply(SSL& ssl)
+{
+    if (ssl.GetError()) return;
+    mySTL::auto_ptr<input_buffer> buffered;
+
+    for (;;) {
+        mySTL::auto_ptr<input_buffer> tmp = DoProcessReply(ssl, buffered);
+        if (tmp.get())      // had only part of a record's data, call again
+            buffered = tmp;
+        else
+            break;
+    }
+}
+
+
+// send client_hello, no buffering
+void sendClientHello(SSL& ssl)
+{
+    ssl.verifyState(serverNull);
+    if (ssl.GetError()) return;
+
+    ClientHello       ch(ssl.getSecurity().get_connection().version_);
+    RecordLayerHeader rlHeader;
+    HandShakeHeader   hsHeader;
+    output_buffer     out;
+
+    buildClientHello(ssl, ch);
+    ssl.set_random(ch.get_random(), client_end);
+    buildHeaders(ssl, hsHeader, rlHeader, ch);
+    buildOutput(out, rlHeader, hsHeader, ch);
+    hashHandShake(ssl, out);
+
+    ssl.Send(out.get_buffer(), out.get_size());
+}
+
+
+// send client key exchange
+void sendClientKeyExchange(SSL& ssl, BufferOutput buffer)
+{
+    ssl.verifyState(serverHelloDoneComplete);
+    if (ssl.GetError()) return;
+
+    ClientKeyExchange ck(ssl);
+    ck.build(ssl);
+    ssl.makeMasterSecret();
+
+    RecordLayerHeader rlHeader;
+    HandShakeHeader   hsHeader;
+    mySTL::auto_ptr<output_buffer> out(new (ys) output_buffer);
+    buildHeaders(ssl, hsHeader, rlHeader, ck);
+    buildOutput(*out.get(), rlHeader, hsHeader, ck);
+    hashHandShake(ssl, *out.get());
+
+    if (buffer == buffered)
+        ssl.addBuffer(out.release());
+    else
+        ssl.Send(out->get_buffer(), out->get_size());
+}
+
+
+// send server key exchange
+void sendServerKeyExchange(SSL& ssl, BufferOutput buffer)
+{
+    if (ssl.GetError()) return;
+    ServerKeyExchange sk(ssl);
+    sk.build(ssl);
+
+    RecordLayerHeader rlHeader;
+    HandShakeHeader   hsHeader;
+    mySTL::auto_ptr<output_buffer> out(new (ys) output_buffer);
+    buildHeaders(ssl, hsHeader, rlHeader, sk);
+    buildOutput(*out.get(), rlHeader, hsHeader, sk);
+    hashHandShake(ssl, *out.get());
+
+    if (buffer == buffered)
+        ssl.addBuffer(out.release());
+    else
+        ssl.Send(out->get_buffer(), out->get_size());
+}
+
+
+// send change cipher
+void sendChangeCipher(SSL& ssl, BufferOutput buffer)
+{
+    if (ssl.getSecurity().get_parms().entity_ == server_end)
+        if (ssl.getSecurity().get_resuming())
+            ssl.verifyState(clientKeyExchangeComplete);
+        else
+            ssl.verifyState(clientFinishedComplete);
+    if (ssl.GetError()) return;
+
+    ChangeCipherSpec ccs;
+    RecordLayerHeader rlHeader;
+    buildHeader(ssl, rlHeader, ccs);
+    mySTL::auto_ptr<output_buffer> out(new (ys) output_buffer);
+    buildOutput(*out.get(), rlHeader, ccs);
+   
+    if (buffer == buffered)
+        ssl.addBuffer(out.release());
+    else
+        ssl.Send(out->get_buffer(), out->get_size());
+}
+
+
+// send finished
+void sendFinished(SSL& ssl, ConnectionEnd side, BufferOutput buffer)
+{
+    if (ssl.GetError()) return;
+
+    Finished fin;
+    buildFinished(ssl, fin, side == client_end ? client : server);
+    mySTL::auto_ptr<output_buffer> out(new (ys) output_buffer);
+    cipherFinished(ssl, fin, *out.get());                   // hashes handshake
+
+    if (ssl.getSecurity().get_resuming()) {
+        if (side == server_end)
+            buildFinished(ssl, ssl.useHashes().use_verify(), client); // client
+    }
+    else {
+        GetSessions().add(ssl);  // store session
+        if (side == client_end)
+            buildFinished(ssl, ssl.useHashes().use_verify(), server); // server
+    }   
+    ssl.useSecurity().use_connection().CleanMaster();
+
+    if (buffer == buffered)
+        ssl.addBuffer(out.release());
+    else
+        ssl.Send(out->get_buffer(), out->get_size());
+}
+
+
+// send data
+int sendData(SSL& ssl, const void* buffer, int sz)
+{
+    ssl.verfiyHandShakeComplete();
+    if (ssl.GetError()) return 0;
+    int sent = 0;
+
+    for (;;) {
+        int len = min(sz - sent, MAX_RECORD_SIZE);
+        output_buffer out;
+        const Data data(len, static_cast<const opaque*>(buffer) + sent);
+
+        buildMessage(ssl, out, data);
+        ssl.Send(out.get_buffer(), out.get_size());
+
+        if (ssl.GetError()) return 0;
+        sent += len;
+        if (sent == sz) break;
+    }
+    ssl.useLog().ShowData(sent, true);
+    return sent;
+}
+
+
+// send alert
+int sendAlert(SSL& ssl, const Alert& alert)
+{
+    output_buffer out;
+    buildAlert(ssl, out, alert);
+    ssl.Send(out.get_buffer(), out.get_size());
+
+    return alert.get_length();
+}
+
+
+// process input data
+int receiveData(SSL& ssl, Data& data)
+{
+    ssl.verfiyHandShakeComplete();
+    if (ssl.GetError()) return 0;
+
+    if (!ssl.bufferedData())
+        processReply(ssl);
+    ssl.fillData(data);
+    ssl.useLog().ShowData(data.get_length());
+
+    if (ssl.GetError()) return 0;
+    return data.get_length(); 
+}
+
+
+// send server hello
+void sendServerHello(SSL& ssl, BufferOutput buffer)
+{
+    if (ssl.getSecurity().get_resuming())
+        ssl.verifyState(clientKeyExchangeComplete);
+    else
+        ssl.verifyState(clientHelloComplete);
+    if (ssl.GetError()) return;
+
+    ServerHello       sh(ssl.getSecurity().get_connection().version_);
+    RecordLayerHeader rlHeader;
+    HandShakeHeader   hsHeader;
+    mySTL::auto_ptr<output_buffer> out(new (ys) output_buffer);
+
+    buildServerHello(ssl, sh);
+    ssl.set_random(sh.get_random(), server_end);
+    buildHeaders(ssl, hsHeader, rlHeader, sh);
+    buildOutput(*out.get(), rlHeader, hsHeader, sh);
+    hashHandShake(ssl, *out.get());
+
+    if (buffer == buffered)
+        ssl.addBuffer(out.release());
+    else
+        ssl.Send(out->get_buffer(), out->get_size());
+}
+
+
+// send server hello done
+void sendServerHelloDone(SSL& ssl, BufferOutput buffer)
+{
+    if (ssl.GetError()) return;
+
+    ServerHelloDone   shd;
+    RecordLayerHeader rlHeader;
+    HandShakeHeader   hsHeader;
+    mySTL::auto_ptr<output_buffer> out(new (ys) output_buffer);
+
+    buildHeaders(ssl, hsHeader, rlHeader, shd);
+    buildOutput(*out.get(), rlHeader, hsHeader, shd);
+    hashHandShake(ssl, *out.get());
+
+    if (buffer == buffered)
+        ssl.addBuffer(out.release());
+    else
+        ssl.Send(out->get_buffer(), out->get_size());
+}
+
+
+// send certificate
+void sendCertificate(SSL& ssl, BufferOutput buffer)
+{
+    if (ssl.GetError()) return;
+
+    Certificate       cert(ssl.getCrypto().get_certManager().get_cert());
+    RecordLayerHeader rlHeader;
+    HandShakeHeader   hsHeader;
+    mySTL::auto_ptr<output_buffer> out(new (ys) output_buffer);
+
+    buildHeaders(ssl, hsHeader, rlHeader, cert);
+    buildOutput(*out.get(), rlHeader, hsHeader, cert);
+    hashHandShake(ssl, *out.get());
+
+    if (buffer == buffered)
+        ssl.addBuffer(out.release());
+    else
+        ssl.Send(out->get_buffer(), out->get_size());
+}
+
+
+// send certificate request
+void sendCertificateRequest(SSL& ssl, BufferOutput buffer)
+{
+    if (ssl.GetError()) return;
+
+    CertificateRequest request;
+    request.Build();
+    RecordLayerHeader  rlHeader;
+    HandShakeHeader    hsHeader;
+    mySTL::auto_ptr<output_buffer> out(new (ys) output_buffer);
+
+    buildHeaders(ssl, hsHeader, rlHeader, request);
+    buildOutput(*out.get(), rlHeader, hsHeader, request);
+    hashHandShake(ssl, *out.get());
+
+    if (buffer == buffered)
+        ssl.addBuffer(out.release());
+    else
+        ssl.Send(out->get_buffer(), out->get_size());
+}
+
+
+// send certificate verify
+void sendCertificateVerify(SSL& ssl, BufferOutput buffer)
+{
+    if (ssl.GetError()) return;
+
+    CertificateVerify  verify;
+    verify.Build(ssl);
+    RecordLayerHeader  rlHeader;
+    HandShakeHeader    hsHeader;
+    mySTL::auto_ptr<output_buffer> out(new (ys) output_buffer);
+
+    buildHeaders(ssl, hsHeader, rlHeader, verify);
+    buildOutput(*out.get(), rlHeader, hsHeader, verify);
+    hashHandShake(ssl, *out.get());
+
+    if (buffer == buffered)
+        ssl.addBuffer(out.release());
+    else
+        ssl.Send(out->get_buffer(), out->get_size());
+}
+
+
+} // namespace
diff --git a/extra/yassl/src/lock.cpp b/extra/yassl/src/lock.cpp
new file mode 100644
index 00000000000..221ec0cdb4f
--- /dev/null
+++ b/extra/yassl/src/lock.cpp
@@ -0,0 +1,90 @@
+/* lock.cpp
+ *
+ * Copyright (C) 2003 Sawtooth Consulting Ltd.
+ *
+ * This file is part of yaSSL.
+ *
+ * yaSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * yaSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
+ */
+
+/*  Locking functions
+ */
+
+#include "runtime.hpp"
+#include "lock.hpp"
+
+
+namespace yaSSL {
+
+
+#ifdef MULTI_THREADED
+    #ifdef WIN32
+        
+        Mutex::Mutex()
+        {
+            InitializeCriticalSection(&cs_);
+        }
+
+
+        Mutex::~Mutex()
+        {
+            DeleteCriticalSection(&cs_);
+        }
+
+            
+        Mutex::Lock::Lock(Mutex& lm) : mutex_(lm)
+        {
+            EnterCriticalSection(&mutex_.cs_); 
+        }
+
+
+        Mutex::Lock::~Lock()
+        {
+            LeaveCriticalSection(&mutex_.cs_); 
+        }
+            
+    #else  // WIN32
+        
+        Mutex::Mutex()
+        {
+            pthread_mutex_init(&mutex_, 0);
+        }
+
+
+        Mutex::~Mutex()
+        {
+            pthread_mutex_destroy(&mutex_);
+        }
+
+
+        Mutex::Lock::Lock(Mutex& lm) : mutex_(lm)
+        {
+            pthread_mutex_lock(&mutex_.mutex_); 
+        }
+
+
+        Mutex::Lock::~Lock()
+        {
+            pthread_mutex_unlock(&mutex_.mutex_); 
+        }
+         
+
+    #endif // WIN32
+#endif // MULTI_THREADED
+
+
+
+} // namespace yaSSL
+
diff --git a/extra/yassl/src/log.cpp b/extra/yassl/src/log.cpp
new file mode 100644
index 00000000000..eb4776d3d19
--- /dev/null
+++ b/extra/yassl/src/log.cpp
@@ -0,0 +1,148 @@
+/* log.cpp
+ *
+ * Copyright (C) 2003 Sawtooth Consulting Ltd.
+ *
+ * This file is part of yaSSL.
+ *
+ * yaSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * yaSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
+ */
+
+/*  Debug logging functions
+ */
+
+#include "runtime.hpp"
+#include "log.hpp"
+
+#ifdef YASSL_LOG
+    #include <ctime>
+    #include <cstdio>
+    #include <cstring>
+#endif
+
+
+
+namespace yaSSL {
+
+
+#ifdef YASSL_LOG
+
+    enum { MAX_MSG = 81 };
+
+    Log::Log(const char* str)
+    {
+        log_ = fopen(str, "w");
+        Trace("********** Logger Attached **********");
+    }
+
+
+    Log::~Log()
+    {
+        Trace("********** Logger Detached **********");
+        fclose(log_);
+    }
+
+
+    // Trace a message
+    void Log::Trace(const char* str)
+    {
+        if (!log_) return;
+
+        time_t clicks = time(0);
+        char   timeStr[32];
+
+        // get rid of newline
+        strncpy(timeStr, ctime(&clicks), sizeof(timeStr));
+        unsigned int len = strlen(timeStr);
+        timeStr[len - 1] = 0;
+
+        char msg[MAX_MSG];
+
+        strncpy(msg, timeStr, sizeof(timeStr));
+        strncat(msg, ":", 1);
+        strncat(msg, str, MAX_MSG - sizeof(timeStr) - 2);
+        strncat(msg, "\n", 1);
+        msg[MAX_MSG - 1] = 0;
+
+        fputs(msg, log_);
+    }
+
+
+    #if defined(WIN32) || defined(__MACH__) || defined(__hpux__)
+    typedef int socklen_t;
+    #endif
+
+
+    // write tcp address
+    void Log::ShowTCP(socket_t fd, bool ended)
+    {
+        sockaddr_in peeraddr;
+        socklen_t   len = sizeof(peeraddr);
+        if (getpeername(fd, (sockaddr*)&peeraddr, &len) != 0)
+            return;
+
+        const char* p = reinterpret_cast<const char*>(&peeraddr.sin_addr);
+        char msg[MAX_MSG];
+        char number[16];
+    
+        if (ended)
+            strncpy(msg, "yaSSL conn DONE  w/ peer ", 26);
+        else
+            strncpy(msg, "yaSSL conn BEGUN w/ peer ", 26);
+        for (int i = 0; i < 4; ++i) {
+            sprintf(number, "%u", static_cast<unsigned short>(p[i]));
+            strncat(msg, number, 8);
+            if (i < 3)
+                strncat(msg, ".", 1);
+        }
+        strncat(msg, " port ", 8);
+        sprintf(number, "%d", htons(peeraddr.sin_port));
+        strncat(msg, number, 8);
+
+        msg[MAX_MSG - 1] = 0;
+        Trace(msg);
+    }
+
+
+    // log processed data
+    void Log::ShowData(uint bytes, bool sent)
+    {
+        char msg[MAX_MSG];
+        char number[16];
+
+        if (sent)
+            strncpy(msg, "Sent     ", 10); 
+        else
+            strncpy(msg, "Received ", 10);
+        sprintf(number, "%u", bytes);
+        strncat(msg, number, 8);
+        strncat(msg, " bytes of application data", 27);
+
+        msg[MAX_MSG - 1] = 0;
+        Trace(msg);
+    }
+
+
+#else // no YASSL_LOG
+
+
+    Log::Log(const char*) {}
+    Log::~Log() {}
+    void Log::Trace(const char*) {}
+    void Log::ShowTCP(socket_t, bool) {}
+    void Log::ShowData(uint, bool) {}
+
+
+#endif // YASSL_LOG
+} // namespace
diff --git a/extra/yassl/src/socket_wrapper.cpp b/extra/yassl/src/socket_wrapper.cpp
new file mode 100644
index 00000000000..0dd30e6b696
--- /dev/null
+++ b/extra/yassl/src/socket_wrapper.cpp
@@ -0,0 +1,168 @@
+/* socket_wrapper.cpp                           
+ *
+ * Copyright (C) 2003 Sawtooth Consulting Ltd.
+ *
+ * This file is part of yaSSL.
+ *
+ * yaSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * yaSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
+ */
+
+
+/* The socket wrapper source implements a Socket class that hides the 
+ * differences between Berkely style sockets and Windows sockets, allowing 
+ * transparent TCP access.
+ */
+
+
+#include "runtime.hpp"
+#include "socket_wrapper.hpp"
+#include "yassl_error.hpp"
+
+#ifndef WIN32
+    #include <errno.h>
+    #include <netdb.h>
+    #include <unistd.h>
+    #include <arpa/inet.h>
+    #include <netinet/in.h>
+    #include <sys/ioctl.h>
+    #include <string.h>
+#endif // WIN32
+
+#ifdef __sun
+    #include <sys/filio.h>
+#endif
+
+#ifdef WIN32
+    const int SOCKET_EINVAL = WSAEINVAL;
+    const int SOCKET_EWOULDBLOCK = WSAEWOULDBLOCK;
+#else
+    const int SOCKET_EINVAL = EINVAL;
+    const int SOCKET_EWOULDBLOCK = EWOULDBLOCK;
+#endif // WIN32
+
+
+namespace yaSSL {
+
+
+Socket::Socket(socket_t s) 
+    : socket_(s) 
+{}
+
+
+void Socket::set_fd(socket_t s)
+{
+    socket_ = s;
+}
+
+
+socket_t Socket::get_fd() const
+{
+    return socket_;
+}
+
+
+Socket::~Socket()
+{
+    closeSocket();
+}
+
+
+void Socket::closeSocket()
+{
+    if (socket_ != INVALID_SOCKET) {
+#ifdef WIN32
+        closesocket(socket_);
+#else
+        close(socket_);
+#endif
+        socket_ = INVALID_SOCKET;
+    }
+}
+
+
+uint Socket::get_ready() const
+{
+    unsigned long ready = 0;
+
+#ifdef WIN32
+    ioctlsocket(socket_, FIONREAD, &ready);
+#else
+    ioctl(socket_, FIONREAD, &ready);
+#endif
+
+    return ready;
+}
+
+
+uint Socket::send(const byte* buf, unsigned int sz, int flags) const
+{
+    assert(socket_ != INVALID_SOCKET);
+    int sent = ::send(socket_, reinterpret_cast<const char *>(buf), sz, flags);
+
+    if (sent == -1)
+        return 0;
+
+    return sent;
+}
+
+
+uint Socket::receive(byte* buf, unsigned int sz, int flags) const
+{
+    assert(socket_ != INVALID_SOCKET);
+    int recvd = ::recv(socket_, reinterpret_cast<char *>(buf), sz, flags);
+
+    if (recvd == -1) 
+        return 0;
+
+    return recvd;
+}
+
+
+// wait if blocking for input, or error
+void Socket::wait() const
+{
+    byte b;
+    receive(&b, 1, MSG_PEEK);
+}
+
+
+void Socket::shutDown(int how)
+{
+    assert(socket_ != INVALID_SOCKET);
+    shutdown(socket_, how);
+}
+
+
+int Socket::get_lastError()
+{
+#ifdef WIN32
+    return WSAGetLastError();
+#else
+    return errno;
+#endif
+}
+
+
+void Socket::set_lastError(int errorCode)
+{
+#ifdef WIN32
+    WSASetLastError(errorCode);
+#else
+    errno = errorCode;
+#endif
+}
+
+
+} // namespace
diff --git a/extra/yassl/src/ssl.cpp b/extra/yassl/src/ssl.cpp
new file mode 100644
index 00000000000..065b3c260bf
--- /dev/null
+++ b/extra/yassl/src/ssl.cpp
@@ -0,0 +1,1039 @@
+/* ssl.cpp                                
+ *
+ * Copyright (C) 2003 Sawtooth Consulting Ltd.
+ *
+ * This file is part of yaSSL.
+ *
+ * yaSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * yaSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
+ */
+
+/*  SSL source implements all openssl compatibility API functions
+ *
+ *  TODO: notes are mostly api additions to allow compilation with mysql
+ *  they don't affect normal modes but should be provided for completeness
+
+ *  stunnel functions at end of file
+ */
+
+
+
+
+/*  see man pages for function descriptions */
+
+#include "runtime.hpp"
+#include "openssl/ssl.h"
+#include "handshake.hpp"
+#include "yassl_int.hpp"
+#include <cstdio>
+
+
+namespace yaSSL {
+
+using mySTL::min;
+
+
+SSL_METHOD* SSLv3_method()
+{
+    return SSLv3_client_method();
+}
+
+
+SSL_METHOD* SSLv3_server_method()
+{
+    return new SSL_METHOD(server_end, ProtocolVersion(3,0));
+}
+
+
+SSL_METHOD* SSLv3_client_method()
+{
+    return new SSL_METHOD(client_end, ProtocolVersion(3,0));
+}
+
+
+SSL_METHOD* TLSv1_server_method()
+{
+    return new SSL_METHOD(server_end, ProtocolVersion(3,1));
+}
+
+
+SSL_METHOD* TLSv1_client_method()
+{
+    return new SSL_METHOD(client_end, ProtocolVersion(3,1));
+}
+
+
+SSL_METHOD* SSLv23_server_method()
+{
+    // compatibility only, no version 2 support
+    return SSLv3_server_method();
+}
+
+
+SSL_CTX* SSL_CTX_new(SSL_METHOD* method)
+{
+    return new SSL_CTX(method);
+}
+
+
+void SSL_CTX_free(SSL_CTX* ctx)
+{
+    delete ctx;
+}
+
+
+SSL* SSL_new(SSL_CTX* ctx)
+{
+    return new SSL(ctx);
+}
+
+
+void SSL_free(SSL* ssl)
+{
+    delete ssl;
+}
+
+
+int SSL_set_fd(SSL* ssl, int fd)
+{
+    ssl->useSocket().set_fd(fd);
+    return SSL_SUCCESS;
+}
+
+
+int SSL_connect(SSL* ssl)
+{
+    sendClientHello(*ssl);
+    processReply(*ssl);
+
+    if(ssl->getCrypto().get_certManager().sendVerify())
+        sendCertificate(*ssl);
+
+    if (!ssl->getSecurity().get_resuming())
+        sendClientKeyExchange(*ssl);
+
+    if(ssl->getCrypto().get_certManager().sendVerify())
+        sendCertificateVerify(*ssl);
+
+    sendChangeCipher(*ssl);
+    sendFinished(*ssl, client_end);
+    ssl->flushBuffer();
+    if (!ssl->getSecurity().get_resuming())
+        processReply(*ssl);
+
+    ssl->verifyState(serverFinishedComplete);
+    ssl->useLog().ShowTCP(ssl->getSocket().get_fd());
+
+    if (ssl->GetError())
+        return SSL_FATAL_ERROR;
+    return SSL_SUCCESS;
+}
+
+
+int SSL_write(SSL* ssl, const void* buffer, int sz)
+{
+    return sendData(*ssl, buffer, sz);
+}
+
+
+int SSL_read(SSL* ssl, void* buffer, int sz)
+{
+    Data data(min(sz, MAX_RECORD_SIZE), static_cast<opaque*>(buffer));
+    return receiveData(*ssl, data);
+}
+
+
+int SSL_accept(SSL* ssl)
+{
+    processReply(*ssl);
+    sendServerHello(*ssl);
+
+    if (!ssl->getSecurity().get_resuming()) {
+        sendCertificate(*ssl);
+
+        if (ssl->getSecurity().get_connection().send_server_key_)
+            sendServerKeyExchange(*ssl);
+
+        if(ssl->getCrypto().get_certManager().verifyPeer())
+            sendCertificateRequest(*ssl);
+
+        sendServerHelloDone(*ssl);
+        ssl->flushBuffer();
+
+        processReply(*ssl);
+    }
+    sendChangeCipher(*ssl);
+    sendFinished(*ssl, server_end);
+    ssl->flushBuffer();
+    if (ssl->getSecurity().get_resuming())
+        processReply(*ssl);
+
+    ssl->useLog().ShowTCP(ssl->getSocket().get_fd());
+
+    if (ssl->GetError())
+        return SSL_FATAL_ERROR;
+    return SSL_SUCCESS;
+}
+
+
+int SSL_do_handshake(SSL* ssl)
+{
+    if (ssl->getSecurity().get_parms().entity_ == client_end)
+        return SSL_connect(ssl);
+    else
+        return SSL_accept(ssl);
+}
+
+
+int SSL_clear(SSL* ssl)
+{
+    ssl->useSocket().closeSocket();
+    return SSL_SUCCESS;
+}
+
+
+int SSL_shutdown(SSL* ssl)
+{
+    Alert alert(warning, close_notify);
+    sendAlert(*ssl, alert);
+    ssl->useLog().ShowTCP(ssl->getSocket().get_fd(), true);
+    ssl->useSocket().closeSocket();
+
+    return SSL_SUCCESS;
+}
+
+
+SSL_SESSION* SSL_get_session(SSL* ssl)
+{
+    return GetSessions().lookup(
+        ssl->getSecurity().get_connection().sessionID_);
+}
+
+
+int SSL_set_session(SSL* ssl, SSL_SESSION* session)
+{
+    ssl->set_session(session);
+    return SSL_SUCCESS;
+}
+
+
+int SSL_session_reused(SSL* ssl)
+{
+    return ssl->getSecurity().get_resuming();
+}
+
+
+long SSL_SESSION_set_timeout(SSL_SESSION* sess, long t)
+{
+    if (!sess)
+        return SSL_ERROR_NONE;
+
+    sess->SetTimeOut(t);
+    return SSL_SUCCESS;
+}
+
+
+long SSL_get_default_timeout(SSL* /*ssl*/)
+{
+    return DEFAULT_TIMEOUT;
+}
+
+
+const char* SSL_get_cipher_name(SSL* ssl)
+{ 
+    return SSL_get_cipher(ssl); 
+}
+
+
+const char* SSL_get_cipher(SSL* ssl)
+{
+    return ssl->getSecurity().get_parms().cipher_name_;
+}
+
+
+// SSLv2 only, not implemented
+char* SSL_get_shared_ciphers(SSL* /*ssl*/, char* buf, int len)
+{
+    return strncpy(buf, "Not Implemented, SSLv2 only", len);
+}
+
+
+const char* SSL_get_cipher_list(SSL* ssl, int /*priority */)
+{
+    return ssl->getSecurity().get_parms().cipher_list_;
+}
+
+
+int SSL_CTX_set_cipher_list(SSL_CTX* ctx, const char* list)
+{
+    if (ctx->SetCipherList(list))
+        return SSL_SUCCESS;
+    else
+        return SSL_FAILURE;
+}
+
+
+const char* SSL_get_version(SSL* ssl)
+{
+    static const char* version3 =  "SSLv3";
+    static const char* version31 = "TLSv1";
+
+    return ssl->isTLS() ? version31 : version3;
+}
+
+const char* SSLeay_version(int)
+{
+    static const char* version = "SSLeay yaSSL compatibility";
+    return version;
+}
+
+
+int SSL_get_error(SSL* ssl, int /*previous*/)
+{
+    return ssl->getStates().What();
+}
+
+
+X509* SSL_get_peer_certificate(SSL* ssl)
+{
+    return ssl->getCrypto().get_certManager().get_peerX509();
+}
+
+
+void X509_free(X509* /*x*/)
+{
+    // peer cert set for deletion during destruction
+    // no need to delete now
+}
+
+
+X509* X509_STORE_CTX_get_current_cert(X509_STORE_CTX* ctx)
+{
+    return ctx->current_cert;
+}
+
+
+int X509_STORE_CTX_get_error(X509_STORE_CTX* ctx)
+{
+    return ctx->error;
+}
+
+
+int X509_STORE_CTX_get_error_depth(X509_STORE_CTX* ctx)
+{
+    return ctx->error_depth;
+}
+
+
+// copy name into buffer, at most sz bytes, if buffer is null
+// will malloc buffer, caller responsible for freeing
+char* X509_NAME_oneline(X509_NAME* name, char* buffer, int sz)
+{
+    if (!name->GetName()) return buffer;
+
+    int len    = strlen(name->GetName()) + 1;
+    int copySz = min(len, sz);
+
+    if (!buffer) {
+        buffer = (char*)malloc(len);
+        if (!buffer) return buffer;
+        copySz = len;
+    }
+
+    if (copySz == 0)
+        return buffer;
+
+    memcpy(buffer, name->GetName(), copySz - 1);
+    buffer[copySz - 1] = 0;
+
+    return buffer;
+}
+
+
+X509_NAME* X509_get_issuer_name(X509* x)
+{
+    return  x->GetIssuer();
+}
+
+
+X509_NAME* X509_get_subject_name(X509* x)
+{
+    return x->GetSubject();
+}
+
+
+void SSL_load_error_strings()   // compatibility only 
+{}
+
+
+void SSL_set_connect_state(SSL*)
+{
+    // already a client by default
+}
+
+
+void SSL_set_accept_state(SSL* ssl)
+{
+    ssl->useSecurity().use_parms().entity_ = server_end;
+}
+
+
+long SSL_get_verify_result(SSL*)
+{
+    // won't get here if not OK
+    return X509_V_OK;
+}
+
+
+long SSL_CTX_sess_set_cache_size(SSL_CTX* /*ctx*/, long /*sz*/)
+{
+    // unlimited size, can't set for now
+    return 0;
+}
+
+
+long SSL_CTX_get_session_cache_mode(SSL_CTX*)
+{
+    // always 0, unlimited size for now
+    return 0;
+}
+
+
+long SSL_CTX_set_tmp_dh(SSL_CTX* ctx, DH* dh)
+{
+    if (ctx->SetDH(*dh))
+        return SSL_SUCCESS;
+    else
+        return SSL_FAILURE;
+}
+
+
+int read_file(SSL_CTX* ctx, const char* file, int format, CertType type)
+{
+    if (format != SSL_FILETYPE_ASN1 && format != SSL_FILETYPE_PEM)
+        return SSL_BAD_FILETYPE;
+
+    FILE* input = fopen(file, "rb");
+    if (!input)
+        return SSL_BAD_FILE;
+
+    if (type == CA) {
+        x509* ptr = PemToDer(file, Cert);
+        if (!ptr) {
+            fclose(input);
+            return SSL_BAD_FILE;
+        }
+        ctx->AddCA(ptr);  // takes ownership
+    }
+    else {
+        x509*& x = (type == Cert) ? ctx->certificate_ : ctx->privateKey_;
+
+        if (format == SSL_FILETYPE_ASN1) {
+            fseek(input, 0, SEEK_END);
+            long sz = ftell(input);
+            rewind(input);
+            x = new (ys) x509(sz); // takes ownership
+            size_t bytes = fread(x->use_buffer(), sz, 1, input);
+            if (bytes != 1) {
+                fclose(input);
+                return SSL_BAD_FILE;
+            }
+        }
+        else {
+            x = PemToDer(file, type);
+            if (!x) {
+                fclose(input);
+                return SSL_BAD_FILE;
+            }
+        }
+    }
+    fclose(input);
+    return SSL_SUCCESS;
+}
+
+
+int SSL_CTX_use_certificate_file(SSL_CTX* ctx, const char* file, int format)
+{
+    return read_file(ctx, file, format, Cert);
+}
+
+
+int SSL_CTX_use_PrivateKey_file(SSL_CTX* ctx, const char* file, int format)
+{
+    return read_file(ctx, file, format, PrivateKey);
+}
+
+
+void SSL_CTX_set_verify(SSL_CTX* ctx, int mode, VerifyCallback /*vc*/)
+{
+    if (mode & SSL_VERIFY_PEER)
+        ctx->setVerifyPeer();
+
+    if (mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)
+        ctx->setFailNoCert();
+}
+
+
+int SSL_CTX_load_verify_locations(SSL_CTX* ctx, const char* file,
+                                  const char* /*path*/)
+{
+    // just files for now
+    return read_file(ctx, file, SSL_FILETYPE_PEM, CA);
+}
+
+
+int SSL_CTX_set_default_verify_paths(SSL_CTX* /*ctx*/)
+{
+    // TODO: figure out way to set/store default path, then call load_verify
+    return SSL_NOT_IMPLEMENTED;
+}
+
+
+int SSL_CTX_set_session_id_context(SSL_CTX*, const unsigned char*,
+                                    unsigned int)
+{
+    // No application specific context needed for yaSSL
+    return SSL_SUCCESS;
+}
+
+
+int SSL_CTX_check_private_key(SSL_CTX* /*ctx*/)
+{
+    // TODO: check private against public for RSA match
+    return SSL_NOT_IMPLEMENTED;
+}
+
+
+// TODO: all session stats
+long SSL_CTX_sess_accept(SSL_CTX* ctx)
+{
+    return ctx->GetStats().accept_;
+}
+
+
+long SSL_CTX_sess_connect(SSL_CTX* ctx)
+{
+    return ctx->GetStats().connect_;
+}
+
+
+long SSL_CTX_sess_accept_good(SSL_CTX* ctx)
+{
+    return ctx->GetStats().acceptGood_;
+}
+
+
+long SSL_CTX_sess_connect_good(SSL_CTX* ctx)
+{
+    return ctx->GetStats().connectGood_;
+}
+
+
+long SSL_CTX_sess_accept_renegotiate(SSL_CTX* ctx)
+{
+    return ctx->GetStats().acceptRenegotiate_;
+}
+
+
+long SSL_CTX_sess_connect_renegotiate(SSL_CTX* ctx)
+{
+    return ctx->GetStats().connectRenegotiate_;
+}
+
+
+long SSL_CTX_sess_hits(SSL_CTX* ctx)
+{
+    return ctx->GetStats().hits_;
+}
+
+
+long SSL_CTX_sess_cb_hits(SSL_CTX* ctx)
+{
+    return ctx->GetStats().cbHits_;
+}
+
+
+long SSL_CTX_sess_cache_full(SSL_CTX* ctx)
+{
+    return ctx->GetStats().cacheFull_;
+}
+
+
+long SSL_CTX_sess_misses(SSL_CTX* ctx)
+{
+    return ctx->GetStats().misses_;
+}
+
+
+long SSL_CTX_sess_timeouts(SSL_CTX* ctx)
+{
+    return ctx->GetStats().timeouts_;
+}
+
+
+long SSL_CTX_sess_number(SSL_CTX* ctx)
+{
+    return ctx->GetStats().number_;
+}
+
+
+long SSL_CTX_sess_get_cache_size(SSL_CTX* ctx)
+{
+    return ctx->GetStats().getCacheSize_;
+}
+// end session stats TODO:
+
+
+int SSL_CTX_get_verify_mode(SSL_CTX* ctx)
+{
+    return ctx->GetStats().verifyMode_;
+}
+
+
+int SSL_get_verify_mode(SSL* ssl)
+{
+    return ssl->getSecurity().GetContext()->GetStats().verifyMode_;
+}
+
+
+int SSL_CTX_get_verify_depth(SSL_CTX* ctx)
+{
+    return ctx->GetStats().verifyDepth_;
+}
+
+
+int SSL_get_verify_depth(SSL* ssl)
+{
+    return ssl->getSecurity().GetContext()->GetStats().verifyDepth_;
+}
+
+
+long SSL_CTX_set_options(SSL_CTX*, long)
+{
+    // TDOD:
+    return SSL_SUCCESS;
+}
+
+
+void SSL_CTX_set_info_callback(SSL_CTX*, void (*)())
+{
+    // TDOD:
+}
+
+
+void OpenSSL_add_all_algorithms()  // compatibility only
+{}
+
+
+DH* DH_new(void)
+{
+    DH* dh = new DH;
+    if (dh)
+        dh->p = dh->g = 0;
+    return dh;
+}
+
+
+void DH_free(DH* dh)
+{
+    delete dh->g;
+    delete dh->p;
+    delete dh;
+}
+
+
+// convert positive big-endian num of length sz into retVal, which may need to 
+// be created
+BIGNUM* BN_bin2bn(const unsigned char* num, int sz, BIGNUM* retVal)
+{
+    using mySTL::auto_ptr;
+    bool created = false;
+    auto_ptr<BIGNUM> bn;
+
+    if (!retVal) {
+        created = true;
+        bn.reset(new (ys) BIGNUM);
+        retVal = bn.get();
+    }
+
+    retVal->assign(num, sz);
+
+    if (created)
+        return bn.release();
+    else
+        return retVal;
+}
+
+
+unsigned long ERR_get_error_line_data(const char**, int*, const char**, int *)
+{
+    //return SSL_NOT_IMPLEMENTED;
+    return 0;
+}
+
+
+void ERR_print_errors_fp(FILE* /*fp*/)
+{
+    // need ssl access to implement TODO:
+    //fprintf(fp, "%s", ssl.get_states().errorString_.c_str());
+}
+
+
+char* ERR_error_string(unsigned long /*err*/, char* buffer)
+{
+    // TODO:
+    static char* msg = "Not Implemented";
+    if (buffer)
+        return strncpy(buffer, msg, strlen(msg));
+
+    return msg;
+}
+
+
+const char* X509_verify_cert_error_string(long /* error */)
+{
+    // TODO:
+    static const char* msg = "Not Implemented";
+    return msg;
+}
+
+
+const EVP_MD* EVP_md5(void)
+{
+    // TODO: FIX add to some list for destruction
+    return new MD5;
+}
+
+
+const EVP_CIPHER* EVP_des_ede3_cbc(void)
+{
+    // TODO: FIX add to some list for destruction
+    return new DES_EDE;
+}
+
+
+int EVP_BytesToKey(const EVP_CIPHER* type, const EVP_MD* md, const byte* salt,
+                   const byte* data, int sz, int count, byte* key, byte* iv)
+{
+    EVP_MD* myMD = const_cast<EVP_MD*>(md);
+    uint digestSz = myMD->get_digestSize();
+    byte digest[SHA_LEN];                   // max size
+
+    int keyLen    = type->get_keySize();
+    int ivLen     = type->get_ivSize();
+    int keyLeft   = keyLen;
+    int ivLeft    = ivLen;
+    int keyOutput = 0;
+
+    while (keyOutput < (keyLen + ivLen)) {
+        int digestLeft = digestSz;
+        // D_(i - 1)
+        if (keyOutput)                      // first time D_0 is empty
+            myMD->update(digest, digestSz);
+        // data
+        myMD->update(data, sz);
+        // salt
+        if (salt)
+            myMD->update(salt, EVP_SALT_SZ);
+        myMD->get_digest(digest);
+        // count
+        for (int j = 1; j < count; j++) {
+            myMD->update(digest, digestSz);
+            myMD->get_digest(digest);
+        }
+
+        if (keyLeft) {
+            int store = min(keyLeft, static_cast<int>(digestSz));
+            memcpy(&key[keyLen - keyLeft], digest, store);
+
+            keyOutput  += store;
+            keyLeft    -= store;
+            digestLeft -= store;
+        }
+
+        if (ivLeft && digestLeft) {
+            int store = min(ivLeft, digestLeft);
+            memcpy(&iv[ivLen - ivLeft], digest, store);
+
+            keyOutput += store;
+            ivLeft    -= store;
+        }
+    }
+    assert(keyOutput == (keyLen + ivLen));
+    return keyOutput;
+}
+
+
+
+void DES_set_key_unchecked(const_DES_cblock* key, DES_key_schedule* schedule)
+{
+    memcpy(schedule, key, sizeof(const_DES_cblock));
+}
+
+
+void DES_ede3_cbc_encrypt(const byte* input, byte* output, long sz,
+                          DES_key_schedule* ks1, DES_key_schedule* ks2,
+                          DES_key_schedule* ks3, DES_cblock* ivec, int enc)
+{
+    DES_EDE des;
+    byte key[DES_EDE_KEY_SZ];
+
+    memcpy(key, *ks1, DES_BLOCK);
+    memcpy(&key[DES_BLOCK], *ks2, DES_BLOCK);
+    memcpy(&key[DES_BLOCK * 2], *ks3, DES_BLOCK);
+
+    if (enc) {
+        des.set_encryptKey(key, *ivec);
+        des.encrypt(output, input, sz);
+    }
+    else {
+        des.set_decryptKey(key, *ivec);
+        des.decrypt(output, input, sz);
+    }
+}
+
+
+    // functions for stunnel
+
+    void RAND_screen()
+    {
+        // TODO:
+    }
+
+
+    const char* RAND_file_name(char*, size_t)
+    {
+        // TODO:
+        return 0;
+    }
+
+
+    int RAND_write_file(const char*)
+    {
+        // TODO:
+        return 0;
+    }
+
+
+    int RAND_load_file(const char*, long)
+    {
+        // TODO:
+        return 0;
+    }
+
+
+    void RSA_free(RSA*)
+    {
+        // TODO:
+    }
+
+
+    RSA* RSA_generate_key(int, unsigned long, void(*)(int, int, void*), void*)
+    {
+        //  TODO:
+        return 0;
+    }
+
+
+    int X509_LOOKUP_add_dir(X509_LOOKUP*, const char*, long)
+    {
+        // TODO:
+        return SSL_SUCCESS;
+    }
+
+
+    int X509_LOOKUP_load_file(X509_LOOKUP*, const char*, long)
+    {
+        // TODO:
+        return SSL_SUCCESS;
+    }
+
+
+    X509_LOOKUP_METHOD* X509_LOOKUP_hash_dir(void)
+    {
+        // TODO:
+        return 0;
+    }
+
+
+    X509_LOOKUP_METHOD* X509_LOOKUP_file(void)
+    {
+        // TODO:
+        return 0;
+    }
+
+
+    X509_LOOKUP* X509_STORE_add_lookup(X509_STORE*, X509_LOOKUP_METHOD*)
+    {
+        // TODO:
+        return 0;
+    }
+
+
+    int X509_STORE_get_by_subject(X509_STORE_CTX*, int, X509_NAME*, X509_OBJECT*)
+    {
+        // TODO:
+        return SSL_SUCCESS;
+    }
+
+
+    X509_STORE* X509_STORE_new(void)
+    {
+        // TODO:
+        return 0;
+    }
+
+    char* SSL_alert_type_string_long(int)
+    {
+        // TODO:
+        return 0;
+    }
+
+
+    char* SSL_alert_desc_string_long(int)
+    {
+        // TODO:
+        return 0;
+    }
+
+
+    char* SSL_state_string_long(SSL*)
+    {
+        // TODO:
+        return 0;
+    }
+
+
+    void SSL_CTX_set_tmp_rsa_callback(SSL_CTX*, RSA*(*)(SSL*, int, int))
+    {
+        // TDOD:
+    }
+
+
+    long SSL_CTX_set_session_cache_mode(SSL_CTX*, long)
+    {
+        // TDOD:
+        return SSL_SUCCESS;
+    }
+
+
+    long SSL_CTX_set_timeout(SSL_CTX*, long)
+    {
+        // TDOD:
+        return SSL_SUCCESS;
+    }
+
+
+    int SSL_CTX_use_certificate_chain_file(SSL_CTX*, const char*)
+    {
+        // TDOD:
+        return SSL_SUCCESS;
+    }
+
+
+    void SSL_CTX_set_default_passwd_cb(SSL_CTX*, pem_password_cb)
+    {
+        // TDOD:
+    }
+
+
+    int SSL_CTX_use_RSAPrivateKey_file(SSL_CTX*, const char*, int)
+    {
+        // TDOD:
+        return SSL_SUCCESS;
+    }
+
+
+    int SSL_set_rfd(SSL*, int)
+    {
+        return SSL_SUCCESS; // TODO:
+    }
+
+
+    int SSL_set_wfd(SSL*, int)
+    {
+        return SSL_SUCCESS; // TODO:
+    }
+
+
+    int SSL_pending(SSL*)
+    {
+        return SSL_SUCCESS; // TODO:
+    }
+
+
+    int SSL_want_read(SSL*)
+    {
+        return 0; // TODO:
+    }
+
+
+    int SSL_want_write(SSL*)
+    {
+        return 0; // TODO:
+    }
+
+
+    void SSL_set_shutdown(SSL*, int)
+    {
+        // TODO:
+    }
+
+
+    SSL_CIPHER* SSL_get_current_cipher(SSL*)
+    {
+        // TODO:
+        return 0;
+    }
+
+
+    char* SSL_CIPHER_description(SSL_CIPHER*, char*, int)
+    {
+        // TODO:
+        return 0;
+    }
+
+
+    void SSLeay_add_ssl_algorithms()  // compatibility only
+    {}
+
+
+    void ERR_remove_state(unsigned long)
+    {
+        // TODO:
+    }
+
+
+    int ERR_GET_REASON(int l)
+    {
+        return l & 0xfff;
+    }
+
+
+    unsigned long ERR_peek_error()
+    {
+        return 0;  // TODO:
+    }
+
+
+    unsigned long ERR_get_error()
+    {
+        return ERR_peek_error();
+    }
+
+
+    // end stunnel needs
+
+
+} // namespace
diff --git a/extra/yassl/src/timer.cpp b/extra/yassl/src/timer.cpp
new file mode 100644
index 00000000000..49e7bb36776
--- /dev/null
+++ b/extra/yassl/src/timer.cpp
@@ -0,0 +1,82 @@
+ /* timer.cpp                                
+ *
+ * Copyright (C) 2003 Sawtooth Consulting Ltd.
+ *
+ * This file is part of yaSSL.
+ *
+ * yaSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * yaSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
+ */
+
+/* timer.cpp implements a high res and low res timer
+ *
+*/
+
+#include "runtime.hpp"
+#include "timer.hpp"
+
+namespace yaSSL {
+
+#ifdef WIN32
+
+    #define WIN32_LEAN_AND_MEAN
+    #include <windows.h>
+
+    timer_d timer()
+    {
+        static bool          init(false);
+        static LARGE_INTEGER freq;
+    
+        if (!init) {
+            QueryPerformanceFrequency(&freq);
+            init = true;
+        }
+
+        LARGE_INTEGER count;
+        QueryPerformanceCounter(&count);
+
+        return static_cast<double>(count.QuadPart) / freq.QuadPart;
+    }
+
+
+    uint lowResTimer()
+    {
+        return static_cast<uint>(timer());
+    }
+
+#else // WIN32
+
+    #include <sys/time.h>
+
+    timer_d timer()
+    {
+        struct timeval tv;
+        gettimeofday(&tv, 0);
+
+        return static_cast<double>(tv.tv_sec) 
+             + static_cast<double>(tv.tv_usec) / 1000000;
+    }
+
+
+    uint lowResTimer()
+    {
+        struct timeval tv;
+        gettimeofday(&tv, 0);
+
+        return tv.tv_sec; 
+    }
+
+
+#endif // WIN32
+} // namespace yaSSL
diff --git a/extra/yassl/src/yassl_error.cpp b/extra/yassl/src/yassl_error.cpp
new file mode 100644
index 00000000000..c53aef2068d
--- /dev/null
+++ b/extra/yassl/src/yassl_error.cpp
@@ -0,0 +1,53 @@
+/* yassl_error.cpp                                
+ *
+ * Copyright (C) 2003 Sawtooth Consulting Ltd.
+ *
+ * This file is part of yaSSL.
+ *
+ * yaSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * yaSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
+ */
+
+
+/* yaSSL error implements and an exception class
+ */
+
+#include "runtime.hpp"
+#include "yassl_error.hpp"
+
+namespace yaSSL {
+
+
+Error::Error(const char* s, YasslError e, Library l) 
+    : mySTL::runtime_error(s), error_(e), lib_(l) 
+{
+}
+
+
+YasslError Error::get_number() const
+{
+    return error_;
+}
+
+
+Library Error::get_lib() const
+{
+
+    return lib_;
+}
+
+
+
+
+}  // namespace yaSSL
diff --git a/extra/yassl/src/yassl_imp.cpp b/extra/yassl/src/yassl_imp.cpp
new file mode 100644
index 00000000000..07310546b4c
--- /dev/null
+++ b/extra/yassl/src/yassl_imp.cpp
@@ -0,0 +1,2093 @@
+/* yassl_imp.cpp                                
+ *
+ * Copyright (C) 2003 Sawtooth Consulting Ltd.
+ *
+ * This file is part of yaSSL.
+ *
+ * yaSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * yaSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
+ */
+
+/*  yaSSL source implements all SSL.v3 secification structures.
+ */
+
+#include "runtime.hpp"
+#include "yassl_int.hpp"
+#include "handshake.hpp"
+
+#include "asn.hpp"  // provide crypto wrapper??
+
+
+namespace yaSSL {
+
+
+namespace { // locals
+
+bool isTLS(ProtocolVersion pv)
+{
+    if (pv.major_ >= 3 && pv.minor_ >= 1)
+        return true;
+
+    return false;
+}
+
+
+}  // namespace (locals)
+
+
+void hashHandShake(SSL&, const input_buffer&, uint);
+
+
+ProtocolVersion::ProtocolVersion(uint8 maj, uint8 min) 
+    : major_(maj), minor_(min) 
+{}
+
+
+// construct key exchange with known ssl parms
+void ClientKeyExchange::createKey(SSL& ssl)
+{
+    const ClientKeyFactory& ckf = ssl.getFactory().getClientKey();
+    client_key_ = ckf.CreateObject(ssl.getSecurity().get_parms().kea_);
+
+    if (!client_key_)
+        ssl.SetError(factory_error);
+}
+
+
+// construct key exchange with known ssl parms
+void ServerKeyExchange::createKey(SSL& ssl)
+{
+    const ServerKeyFactory& skf = ssl.getFactory().getServerKey();
+    server_key_ = skf.CreateObject(ssl.getSecurity().get_parms().kea_);
+
+    if (!server_key_)
+        ssl.SetError(factory_error);
+}
+
+
+// build/set PreMaster secret and encrypt, client side
+void EncryptedPreMasterSecret::build(SSL& ssl)
+{
+    opaque tmp[SECRET_LEN];
+    memset(tmp, 0, sizeof(tmp));
+    ssl.getCrypto().get_random().Fill(tmp, SECRET_LEN);
+    ProtocolVersion pv = ssl.getSecurity().get_connection().version_;
+    tmp[0] = pv.major_;
+    tmp[1] = pv.minor_;
+    ssl.set_preMaster(tmp, SECRET_LEN);
+
+    const CertManager& cert = ssl.getCrypto().get_certManager();
+    RSA rsa(cert.get_peerKey(), cert.get_peerKeyLength());
+    bool tls = ssl.isTLS();     // if TLS, put length for encrypted data
+    alloc(rsa.get_cipherLength() + (tls ? 2 : 0));
+    byte* holder = secret_;
+    if (tls) {
+        byte len[2];
+        c16toa(rsa.get_cipherLength(), len);
+        memcpy(secret_, len, sizeof(len));
+        holder += 2;
+    }
+    rsa.encrypt(holder, tmp, SECRET_LEN, ssl.getCrypto().get_random());
+}
+
+
+// build/set premaster and Client Public key, client side
+void ClientDiffieHellmanPublic::build(SSL& ssl)
+{
+    DiffieHellman& dhServer = ssl.useCrypto().use_dh();
+    DiffieHellman  dhClient(dhServer);
+
+    uint keyLength = dhClient.get_agreedKeyLength(); // pub and agree same
+
+    alloc(keyLength, true);
+    dhClient.makeAgreement(dhServer.get_publicKey());
+    c16toa(keyLength, Yc_);
+    memcpy(Yc_ + KEY_OFFSET, dhClient.get_publicKey(), keyLength);
+
+    ssl.set_preMaster(dhClient.get_agreedKey(), keyLength);
+}
+
+
+// build server exhange, server side
+void DH_Server::build(SSL& ssl)
+{
+    DiffieHellman& dhServer = ssl.useCrypto().use_dh();
+
+    int pSz, gSz, pubSz;
+    dhServer.set_sizes(pSz, gSz, pubSz);
+    dhServer.get_parms(parms_.alloc_p(pSz), parms_.alloc_g(gSz),
+                       parms_.alloc_pub(pubSz));
+
+    short sigSz = 0;
+    mySTL::auto_ptr<Auth> auth;
+    const CertManager& cert = ssl.getCrypto().get_certManager();
+    
+    if (ssl.getSecurity().get_parms().sig_algo_ == rsa_sa_algo)
+        auth.reset(new (ys) RSA(cert.get_privateKey(),
+                   cert.get_privateKeyLength(), false));
+    else {
+        auth.reset(new (ys) DSS(cert.get_privateKey(),
+                   cert.get_privateKeyLength(), false));
+        sigSz += DSS_ENCODED_EXTRA;
+    }
+    
+
+    sigSz += auth->get_signatureLength();
+
+
+    length_ = 8; // pLen + gLen + YsLen + SigLen
+    length_ += pSz + gSz + pubSz + sigSz;
+
+    output_buffer tmp(length_);
+    byte len[2];
+    // P
+    c16toa(pSz, len);
+    tmp.write(len, sizeof(len));
+    tmp.write(parms_.get_p(), pSz);
+    // G
+    c16toa(gSz, len);
+    tmp.write(len, sizeof(len));
+    tmp.write(parms_.get_g(), gSz);
+    // Ys
+    c16toa(pubSz, len);
+    tmp.write(len, sizeof(len));
+    tmp.write(parms_.get_pub(), pubSz);
+
+    // Sig
+    byte hash[FINISHED_SZ];
+    MD5  md5;
+    SHA  sha;
+    signature_ = new (ys) byte[sigSz];
+
+    const Connection& conn = ssl.getSecurity().get_connection();
+    // md5
+    md5.update(conn.client_random_, RAN_LEN);
+    md5.update(conn.server_random_, RAN_LEN);
+    md5.update(tmp.get_buffer(), tmp.get_size());
+    md5.get_digest(hash);
+
+    // sha
+    sha.update(conn.client_random_, RAN_LEN);
+    sha.update(conn.server_random_, RAN_LEN);
+    sha.update(tmp.get_buffer(), tmp.get_size());
+    sha.get_digest(&hash[MD5_LEN]);
+
+    if (ssl.getSecurity().get_parms().sig_algo_ == rsa_sa_algo)
+        auth->sign(signature_, hash, sizeof(hash),
+                   ssl.getCrypto().get_random());
+    else {
+        auth->sign(signature_, &hash[MD5_LEN], SHA_LEN,
+                   ssl.getCrypto().get_random());
+        byte encoded[DSS_SIG_SZ + DSS_ENCODED_EXTRA];
+        TaoCrypt::EncodeDSA_Signature(signature_, encoded);
+        memcpy(signature_, encoded, sizeof(encoded));
+    }
+
+    c16toa(sigSz, len);
+    tmp.write(len, sizeof(len));
+    tmp.write(signature_, sigSz);
+
+    // key message
+    keyMessage_ = new (ys) opaque[length_];
+    memcpy(keyMessage_, tmp.get_buffer(), tmp.get_size());
+}
+
+
+// read PreMaster secret and decrypt, server side
+void EncryptedPreMasterSecret::read(SSL& ssl, input_buffer& input)
+{
+    const CertManager& cert = ssl.getCrypto().get_certManager();
+    RSA rsa(cert.get_privateKey(), cert.get_privateKeyLength(), false);
+    uint16 cipherLen = rsa.get_cipherLength();
+    if (ssl.isTLS()) {
+        byte len[2];
+        input.read(len, sizeof(len));
+        ato16(len, cipherLen);
+    }
+    alloc(cipherLen);
+    input.read(secret_, length_);
+
+    opaque preMasterSecret[SECRET_LEN];
+    rsa.decrypt(preMasterSecret, secret_, length_, 
+                ssl.getCrypto().get_random());
+
+    ssl.set_preMaster(preMasterSecret, SECRET_LEN);
+    ssl.makeMasterSecret();
+}
+
+
+EncryptedPreMasterSecret::EncryptedPreMasterSecret()
+    : secret_(0), length_(0)
+{}
+
+
+EncryptedPreMasterSecret::~EncryptedPreMasterSecret()
+{
+    delete[] secret_;
+}
+
+
+int EncryptedPreMasterSecret::get_length() const
+{
+    return length_;
+}
+
+
+opaque* EncryptedPreMasterSecret::get_clientKey() const
+{
+    return secret_;
+}
+
+
+void EncryptedPreMasterSecret::alloc(int sz)
+{
+    length_ = sz;
+    secret_ = new (ys) opaque[sz];
+}
+
+
+// read client's public key, server side
+void ClientDiffieHellmanPublic::read(SSL& ssl, input_buffer& input)
+{
+    DiffieHellman& dh = ssl.useCrypto().use_dh();
+
+    uint16 keyLength;
+    byte tmp[2];
+    tmp[0] = input[AUTO];
+    tmp[1] = input[AUTO];
+    ato16(tmp, keyLength);
+
+    alloc(keyLength);
+    input.read(Yc_, length_);
+    dh.makeAgreement(Yc_);
+
+    ssl.set_preMaster(dh.get_agreedKey(), keyLength);
+    ssl.makeMasterSecret();
+}
+
+
+ClientDiffieHellmanPublic::ClientDiffieHellmanPublic()
+    : length_(0), Yc_(0)
+{}
+
+
+ClientDiffieHellmanPublic::~ClientDiffieHellmanPublic()
+{
+    delete[] Yc_;
+}
+
+
+int ClientDiffieHellmanPublic::get_length() const
+{
+    return length_;
+}
+
+
+opaque* ClientDiffieHellmanPublic::get_clientKey() const
+{
+    return Yc_;
+}
+
+
+void ClientDiffieHellmanPublic::alloc(int sz, bool offset) 
+{
+    length_ = sz + (offset ? KEY_OFFSET : 0); 
+    Yc_ = new (ys) opaque[length_];
+}
+
+
+// read server's p, g, public key and sig, client side
+void DH_Server::read(SSL& ssl, input_buffer& input)
+{
+    uint16 length, messageTotal = 6; // pSz + gSz + pubSz
+    byte tmp[2];
+
+    // p
+    tmp[0] = input[AUTO];
+    tmp[1] = input[AUTO];
+    ato16(tmp, length);
+    messageTotal += length;
+
+    input.read(parms_.alloc_p(length), length);
+
+    // g
+    tmp[0] = input[AUTO];
+    tmp[1] = input[AUTO];
+    ato16(tmp, length);
+    messageTotal += length;
+
+    input.read(parms_.alloc_g(length), length);
+
+    // pub
+    tmp[0] = input[AUTO];
+    tmp[1] = input[AUTO];
+    ato16(tmp, length);
+    messageTotal += length;
+
+    input.read(parms_.alloc_pub(length), length);
+
+    // save message for hash verify
+    input_buffer message(messageTotal);
+    input.set_current(input.get_current() - messageTotal);
+    input.read(message.get_buffer(), messageTotal);
+    message.add_size(messageTotal);
+
+    // signature
+    tmp[0] = input[AUTO];
+    tmp[1] = input[AUTO];
+    ato16(tmp, length);
+
+    signature_ = new (ys) byte[length];
+    input.read(signature_, length);
+
+    // verify signature
+    byte hash[FINISHED_SZ];
+    MD5  md5;
+    SHA  sha;
+
+    const Connection& conn = ssl.getSecurity().get_connection();
+    // md5
+    md5.update(conn.client_random_, RAN_LEN);
+    md5.update(conn.server_random_, RAN_LEN);
+    md5.update(message.get_buffer(), message.get_size());
+    md5.get_digest(hash);
+
+    // sha
+    sha.update(conn.client_random_, RAN_LEN);
+    sha.update(conn.server_random_, RAN_LEN);
+    sha.update(message.get_buffer(), message.get_size());
+    sha.get_digest(&hash[MD5_LEN]);
+
+    const CertManager& cert = ssl.getCrypto().get_certManager();
+    
+    if (ssl.getSecurity().get_parms().sig_algo_ == rsa_sa_algo) {
+        RSA rsa(cert.get_peerKey(), cert.get_peerKeyLength());
+        if (!rsa.verify(hash, sizeof(hash), signature_, length))
+            ssl.SetError(verify_error);
+    }
+    else {
+        byte decodedSig[DSS_SIG_SZ];
+        length = TaoCrypt::DecodeDSA_Signature(decodedSig, signature_, length);
+        
+        DSS dss(cert.get_peerKey(), cert.get_peerKeyLength());
+        if (!dss.verify(&hash[MD5_LEN], SHA_LEN, decodedSig, length))
+            ssl.SetError(verify_error);
+    }
+
+    // save input
+    ssl.useCrypto().SetDH(new (ys) DiffieHellman(parms_.get_p(),
+               parms_.get_pSize(), parms_.get_g(), parms_.get_gSize(),
+               parms_.get_pub(), parms_.get_pubSize(),
+               ssl.getCrypto().get_random()));
+}
+
+
+DH_Server::DH_Server()
+    : signature_(0), length_(0), keyMessage_(0)
+{}
+
+
+DH_Server::~DH_Server()
+{
+    delete[] keyMessage_;
+    delete[] signature_;
+}
+
+
+int DH_Server::get_length() const
+{
+    return length_;
+}
+
+
+opaque* DH_Server::get_serverKey() const
+{
+    return keyMessage_;
+}
+
+
+// set available suites
+Parameters::Parameters(ConnectionEnd ce, const Ciphers& ciphers, 
+                       ProtocolVersion pv) : entity_(ce)
+{
+    pending_ = true;	// suite not set yet
+
+    if (ciphers.setSuites_) {   // use user set list
+        suites_size_ = ciphers.suiteSz_;
+        memcpy(suites_, ciphers.suites_, ciphers.suiteSz_);
+        SetCipherNames();
+    }
+    else 
+        SetSuites(pv);  // defaults
+}
+
+
+void Parameters::SetSuites(ProtocolVersion pv)
+{
+    int i = 0;
+    // available suites, best first
+    // when adding more, make sure cipher_names is updated and
+    //      MAX_CIPHER_LIST is big enough
+
+    if (isTLS(pv)) {
+        suites_[i++] = 0x00;
+        suites_[i++] = TLS_DHE_RSA_WITH_AES_256_CBC_SHA;
+        suites_[i++] = 0x00;
+        suites_[i++] = TLS_DHE_DSS_WITH_AES_256_CBC_SHA;
+        suites_[i++] = 0x00;
+        suites_[i++] = TLS_RSA_WITH_AES_256_CBC_SHA;
+
+        suites_[i++] = 0x00;
+        suites_[i++] = TLS_RSA_WITH_AES_128_CBC_SHA;
+        suites_[i++] = 0x00;
+        suites_[i++] = TLS_DHE_RSA_WITH_AES_128_CBC_SHA;
+        suites_[i++] = 0x00;
+        suites_[i++] = TLS_DHE_DSS_WITH_AES_128_CBC_SHA;
+
+        suites_[i++] = 0x00;
+        suites_[i++] = TLS_RSA_WITH_AES_256_CBC_RMD160;
+        suites_[i++] = 0x00;
+        suites_[i++] = TLS_RSA_WITH_AES_128_CBC_RMD160;
+        suites_[i++] = 0x00;
+        suites_[i++] = TLS_RSA_WITH_3DES_EDE_CBC_RMD160;
+
+        suites_[i++] = 0x00;
+        suites_[i++] = TLS_DHE_RSA_WITH_AES_256_CBC_RMD160;
+        suites_[i++] = 0x00;
+        suites_[i++] = TLS_DHE_RSA_WITH_AES_128_CBC_RMD160;
+        suites_[i++] = 0x00;
+        suites_[i++] = TLS_DHE_RSA_WITH_3DES_EDE_CBC_RMD160;
+
+        suites_[i++] = 0x00;
+        suites_[i++] = TLS_DHE_DSS_WITH_AES_256_CBC_RMD160;
+        suites_[i++] = 0x00;
+        suites_[i++] = TLS_DHE_DSS_WITH_AES_128_CBC_RMD160;
+        suites_[i++] = 0x00;
+        suites_[i++] = TLS_DHE_DSS_WITH_3DES_EDE_CBC_RMD160;
+    }
+
+    suites_[i++] = 0x00;
+    suites_[i++] = SSL_RSA_WITH_RC4_128_SHA;  
+    suites_[i++] = 0x00;
+    suites_[i++] = SSL_RSA_WITH_RC4_128_MD5;
+
+    suites_[i++] = 0x00;
+    suites_[i++] = SSL_RSA_WITH_3DES_EDE_CBC_SHA;
+    suites_[i++] = 0x00;
+    suites_[i++] = SSL_RSA_WITH_DES_CBC_SHA;
+
+    suites_[i++] = 0x00;
+    suites_[i++] = SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA;  
+    suites_[i++] = 0x00;
+    suites_[i++] = SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA; 
+
+    suites_[i++] = 0x00;
+    suites_[i++] = SSL_DHE_RSA_WITH_DES_CBC_SHA;  
+    suites_[i++] = 0x00;
+    suites_[i++] = SSL_DHE_DSS_WITH_DES_CBC_SHA;
+
+    suites_size_ = i;
+
+    SetCipherNames();
+}
+
+
+void Parameters::SetCipherNames()
+{
+    const int suites = suites_size_ / 2;
+    int pos = 0;
+
+    for (int j = 0; j < suites; j++) {
+        int index = suites_[j*2 + 1];  // every other suite is suite id
+        int len = strlen(cipher_names[index]);
+        memcpy(&cipher_list_[pos], cipher_names[index], len);
+        pos += len;
+        cipher_list_[pos++] = ':';
+    }
+    if (suites)
+        cipher_list_[--pos] = 0;
+}
+
+
+// input operator for RecordLayerHeader, adjust stream
+input_buffer& operator>>(input_buffer& input, RecordLayerHeader& hdr)
+{
+    hdr.type_ = ContentType(input[AUTO]);
+    hdr.version_.major_ = input[AUTO];
+    hdr.version_.minor_ = input[AUTO];
+
+    // length
+    byte tmp[2];
+    tmp[0] = input[AUTO];
+    tmp[1] = input[AUTO];
+    ato16(tmp, hdr.length_);
+
+    return input;
+}
+
+
+// output operator for RecordLayerHeader
+output_buffer& operator<<(output_buffer& output, const RecordLayerHeader& hdr)
+{
+    output[AUTO] = hdr.type_;
+    output[AUTO] = hdr.version_.major_;
+    output[AUTO] = hdr.version_.minor_;
+    
+    // length
+    byte tmp[2];
+    c16toa(hdr.length_, tmp);
+    output[AUTO] = tmp[0];
+    output[AUTO] = tmp[1];
+
+    return output;
+}
+
+
+// virtual input operator for Messages
+input_buffer& operator>>(input_buffer& input, Message& msg)
+{
+    return msg.set(input);
+}
+
+// virtual output operator for Messages
+output_buffer& operator<<(output_buffer& output, const Message& msg)
+{
+    return msg.get(output);
+}
+
+
+// input operator for HandShakeHeader
+input_buffer& operator>>(input_buffer& input, HandShakeHeader& hs)
+{
+    hs.type_ = HandShakeType(input[AUTO]);
+
+    hs.length_[0] = input[AUTO];
+    hs.length_[1] = input[AUTO];
+    hs.length_[2] = input[AUTO];
+    
+    return input;
+}
+
+
+// output operator for HandShakeHeader
+output_buffer& operator<<(output_buffer& output, const HandShakeHeader& hdr)
+{
+    output[AUTO] = hdr.type_;
+    output.write(hdr.length_, sizeof(hdr.length_));
+    return output;
+}
+
+
+// HandShake Header Processing function
+void HandShakeHeader::Process(input_buffer& input, SSL& ssl)
+{
+    ssl.verifyState(*this);
+    const HandShakeFactory& hsf = ssl.getFactory().getHandShake();
+    mySTL::auto_ptr<HandShakeBase> hs(hsf.CreateObject(type_));
+    if (!hs.get()) {
+        ssl.SetError(factory_error);
+        return;
+    }
+    hashHandShake(ssl, input, c24to32(length_));
+
+    input >> *hs;
+    hs->Process(input, ssl);
+}
+
+
+ContentType HandShakeHeader::get_type() const
+{
+    return handshake;
+}
+
+
+uint16 HandShakeHeader::get_length() const
+{
+    return c24to32(length_);
+}
+
+
+HandShakeType HandShakeHeader::get_handshakeType() const
+{
+    return type_;
+}
+
+
+void HandShakeHeader::set_type(HandShakeType hst)
+{
+    type_ = hst;
+}
+
+
+void HandShakeHeader::set_length(uint32 u32)
+{
+    c32to24(u32, length_);
+}
+
+
+input_buffer& HandShakeHeader::set(input_buffer& in)
+{
+    return in >> *this;
+}
+
+
+output_buffer& HandShakeHeader::get(output_buffer& out) const
+{
+    return out << *this;
+}
+
+
+
+int HandShakeBase::get_length() const
+{
+    return length_;
+}
+
+
+void HandShakeBase::set_length(int l)
+{
+    length_ = l;
+}
+
+
+// for building buffer's type field
+HandShakeType HandShakeBase::get_type() const
+{
+    return no_shake;
+}
+
+
+input_buffer& HandShakeBase::set(input_buffer& in)
+{
+    return in;
+}
+
+ 
+output_buffer& HandShakeBase::get(output_buffer& out) const
+{
+    return out;
+}
+
+
+void HandShakeBase::Process(input_buffer&, SSL&) 
+{}
+
+
+input_buffer& HelloRequest::set(input_buffer& in)
+{
+    return in;
+}
+
+
+output_buffer& HelloRequest::get(output_buffer& out) const
+{
+    return out;
+}
+
+
+void HelloRequest::Process(input_buffer&, SSL&)
+{}
+
+
+HandShakeType HelloRequest::get_type() const
+{
+    return hello_request;
+}
+
+
+// input operator for CipherSpec
+input_buffer& operator>>(input_buffer& input, ChangeCipherSpec& cs)
+{
+    cs.type_ = CipherChoice(input[AUTO]);
+    return input; 
+}
+
+// output operator for CipherSpec
+output_buffer& operator<<(output_buffer& output, const ChangeCipherSpec& cs)
+{
+    output[AUTO] = cs.type_;
+    return output;
+}
+
+
+ChangeCipherSpec::ChangeCipherSpec() 
+    : type_(change_cipher_spec_choice)
+{}
+
+
+input_buffer& ChangeCipherSpec::set(input_buffer& in)
+{
+    return in >> *this;
+}
+
+
+output_buffer& ChangeCipherSpec::get(output_buffer& out) const
+{
+    return out << *this;
+}
+
+
+ContentType ChangeCipherSpec::get_type() const
+{
+    return change_cipher_spec;
+}
+
+
+uint16 ChangeCipherSpec::get_length() const
+{
+    return SIZEOF_ENUM;
+}
+
+
+// CipherSpec processing handler
+void ChangeCipherSpec::Process(input_buffer&, SSL& ssl)
+{
+    ssl.useSecurity().use_parms().pending_ = false;
+    if (ssl.getSecurity().get_resuming()) {
+        if (ssl.getSecurity().get_parms().entity_ == client_end)
+            buildFinished(ssl, ssl.useHashes().use_verify(), server); // server
+    }
+    else if (ssl.getSecurity().get_parms().entity_ == server_end)
+        buildFinished(ssl, ssl.useHashes().use_verify(), client);     // client
+}
+
+
+Alert::Alert(AlertLevel al, AlertDescription ad)
+    : level_(al), description_(ad)
+{}
+
+
+ContentType Alert::get_type() const
+{
+    return alert;
+}
+
+
+uint16 Alert::get_length() const
+{
+    return SIZEOF_ENUM * 2;
+}
+
+
+input_buffer& Alert::set(input_buffer& in)
+{
+    return in >> *this;
+}
+
+
+output_buffer& Alert::get(output_buffer& out) const
+{
+    return out << *this;
+}
+
+
+// input operator for Alert
+input_buffer& operator>>(input_buffer& input, Alert& a)
+{
+    a.level_ = AlertLevel(input[AUTO]);
+    a.description_ = AlertDescription(input[AUTO]);
+ 
+    return input;
+}
+
+
+// output operator for Alert
+output_buffer& operator<<(output_buffer& output, const Alert& a)
+{
+    output[AUTO] = a.level_;
+    output[AUTO] = a.description_;
+    return output;
+}
+
+
+// Alert processing handler
+void Alert::Process(input_buffer& input, SSL& ssl)
+{
+    if (ssl.getSecurity().get_parms().pending_ == false)  { // encrypted alert
+        int            aSz = get_length();  // alert size already read on input
+        opaque         verify[SHA_LEN];
+        const  opaque* data = input.get_buffer() + input.get_current() - aSz;
+
+        if (ssl.isTLS())
+            TLS_hmac(ssl, verify, data, aSz, alert, true);
+        else
+            hmac(ssl, verify, data, aSz, alert, true);
+
+        // read mac and fill
+        int    digestSz = ssl.getCrypto().get_digest().get_digestSize();
+        opaque mac[SHA_LEN];
+        input.read(mac, digestSz);
+
+        opaque fill;
+        int    padSz = ssl.getSecurity().get_parms().encrypt_size_ - aSz -
+                       digestSz;
+        for (int i = 0; i < padSz; i++) 
+            fill = input[AUTO];
+
+        // verify
+        if (memcmp(mac, verify, digestSz)) {
+            ssl.SetError(verify_error);
+            return;
+        }
+    }
+    if (level_ == fatal) {
+        ssl.useStates().useRecord()    = recordNotReady;
+        ssl.useStates().useHandShake() = handShakeNotReady;
+        ssl.SetError(YasslError(description_));
+    }
+}
+
+
+Data::Data()
+    : length_(0), buffer_(0), write_buffer_(0)
+{}
+
+
+Data::Data(uint16 len, opaque* b)
+    : length_(len), buffer_(b), write_buffer_(0)
+{}
+
+
+Data::Data(uint16 len, const opaque* w)
+    : length_(len), buffer_(0), write_buffer_(w)
+{}
+
+input_buffer& Data::set(input_buffer& in)
+{
+    return in;
+}
+
+
+output_buffer& Data::get(output_buffer& out) const
+{
+    return out << *this;
+}
+
+
+ContentType Data::get_type() const
+{
+    return application_data;
+}
+
+
+uint16 Data::get_length() const
+{
+    return length_;
+}
+
+
+const opaque* Data::get_buffer() const
+{
+    return write_buffer_;
+}
+
+
+void Data::set_length(uint16 l)
+{
+    length_ = l;
+}
+
+opaque* Data::set_buffer()
+{
+    return buffer_;
+}
+
+
+// output operator for Data
+output_buffer& operator<<(output_buffer& output, const Data& data)
+{
+    output.write(data.write_buffer_, data.length_);
+    return output;
+}
+
+
+// Process handler for Data
+void Data::Process(input_buffer& input, SSL& ssl)
+{
+    int msgSz = ssl.getSecurity().get_parms().encrypt_size_;
+    int pad   = 0, padByte = 0;
+    if (ssl.getSecurity().get_parms().cipher_type_ == block) {
+        pad = *(input.get_buffer() + input.get_current() + msgSz - 1);
+        padByte = 1;
+    }
+    int digestSz = ssl.getCrypto().get_digest().get_digestSize();
+    int dataSz = msgSz - digestSz - pad - padByte;   
+    opaque verify[SHA_LEN];
+
+    // read data
+    if (dataSz) {
+        input_buffer* data;
+        ssl.addData(data = new (ys) input_buffer(dataSz));
+        input.read(data->get_buffer(), dataSz);
+        data->add_size(dataSz);
+
+        if (ssl.isTLS())
+            TLS_hmac(ssl, verify, data->get_buffer(), dataSz, application_data,
+                     true);
+        else
+            hmac(ssl, verify, data->get_buffer(), dataSz, application_data,
+                 true);
+    }
+
+    // read mac and fill
+    opaque mac[SHA_LEN];
+    opaque fill;
+    input.read(mac, digestSz);
+    for (int i = 0; i < pad; i++) 
+        fill = input[AUTO];
+    if (padByte)
+        fill = input[AUTO];    
+
+    // verify
+    if (dataSz) {
+        if (memcmp(mac, verify, digestSz)) {
+            ssl.SetError(verify_error);
+            return;
+        }
+    }
+    else 
+        ssl.get_SEQIncrement(true);  // even though no data, increment verify
+}
+
+
+// virtual input operator for HandShakes
+input_buffer& operator>>(input_buffer& input, HandShakeBase& hs)
+{
+    return hs.set(input);
+}
+
+
+// virtual output operator for HandShakes
+output_buffer& operator<<(output_buffer& output, const HandShakeBase& hs)
+{
+    return hs.get(output);
+}
+
+
+Certificate::Certificate(const x509* cert) : cert_(cert) 
+{
+    set_length(cert_->get_length() + 2 * CERT_HEADER); // list and cert size
+}
+
+
+const opaque* Certificate::get_buffer() const
+{
+    return cert_->get_buffer(); 
+}
+
+
+// output operator for Certificate
+output_buffer& operator<<(output_buffer& output, const Certificate& cert)
+{
+    uint sz = cert.get_length() - 2 * CERT_HEADER;
+    opaque tmp[CERT_HEADER];
+
+    c32to24(sz + CERT_HEADER, tmp);
+    output.write(tmp, CERT_HEADER);
+    c32to24(sz, tmp);
+    output.write(tmp, CERT_HEADER);
+    output.write(cert.get_buffer(), sz);
+
+    return output;
+}
+
+
+// certificate processing handler
+void Certificate::Process(input_buffer& input, SSL& ssl)
+{
+    CertManager& cm = ssl.useCrypto().use_certManager();
+  
+    uint32 list_sz;
+    byte   tmp[3];
+
+    tmp[0] = input[AUTO];
+    tmp[1] = input[AUTO];
+    tmp[2] = input[AUTO];
+    c24to32(tmp, list_sz);
+    
+    while (list_sz) {
+        // cert size
+        uint32 cert_sz;
+        tmp[0] = input[AUTO];
+        tmp[1] = input[AUTO];
+        tmp[2] = input[AUTO];
+        c24to32(tmp, cert_sz);
+        
+        x509* myCert;
+        cm.AddPeerCert(myCert = new (ys) x509(cert_sz));
+        input.read(myCert->use_buffer(), myCert->get_length());
+
+        list_sz -= cert_sz + CERT_HEADER;
+    }
+    if (int err = cm.Validate())
+        ssl.SetError(YasslError(err));
+    else if (ssl.getSecurity().get_parms().entity_ == client_end)
+        ssl.useStates().useClient() = serverCertComplete;
+}
+
+
+Certificate::Certificate()
+    : cert_(0)
+{}
+
+
+input_buffer& Certificate::set(input_buffer& in)
+{
+    return in;
+}
+
+
+output_buffer& Certificate::get(output_buffer& out) const
+{
+    return out << *this;
+}
+
+
+HandShakeType Certificate::get_type() const
+{
+    return certificate;
+}
+
+
+ServerDHParams::ServerDHParams()
+    : pSz_(0), gSz_(0), pubSz_(0), p_(0), g_(0), Ys_(0)
+{}
+
+
+ServerDHParams::~ServerDHParams()
+{
+    delete[] Ys_;
+    delete[] g_;
+    delete[] p_;
+}
+
+
+int ServerDHParams::get_pSize() const
+{
+    return pSz_;
+}
+
+
+int ServerDHParams::get_gSize() const
+{
+    return gSz_;
+}
+
+
+int ServerDHParams::get_pubSize() const
+{
+    return pubSz_;
+}
+
+
+const opaque* ServerDHParams::get_p() const
+{
+    return p_;
+}
+
+
+const opaque* ServerDHParams::get_g() const
+{
+    return g_;
+}
+
+
+const opaque* ServerDHParams::get_pub() const
+{
+    return Ys_;
+}
+
+
+opaque* ServerDHParams::alloc_p(int sz)
+{
+    p_ = new (ys) opaque[pSz_ = sz];
+    return p_;
+}
+
+
+opaque* ServerDHParams::alloc_g(int sz)
+{
+    g_ = new (ys) opaque[gSz_ = sz];
+    return g_;
+}
+
+
+opaque* ServerDHParams::alloc_pub(int sz)
+{
+    Ys_ = new (ys) opaque[pubSz_ = sz];
+    return Ys_;
+}
+
+
+int ServerKeyBase::get_length() const
+{
+    return 0;
+}
+
+
+opaque* ServerKeyBase::get_serverKey() const
+{
+    return 0;
+}
+
+
+// input operator for ServerHello
+input_buffer& operator>>(input_buffer& input, ServerHello& hello)
+{ 
+    // Protocol
+    hello.server_version_.major_ = input[AUTO];
+    hello.server_version_.minor_ = input[AUTO];
+   
+    // Random
+    input.read(hello.random_, RAN_LEN);
+    
+    // Session
+    hello.id_len_ = input[AUTO];
+    input.read(hello.session_id_, ID_LEN);
+ 
+    // Suites
+    hello.cipher_suite_[0] = input[AUTO];
+    hello.cipher_suite_[1] = input[AUTO];
+   
+    // Compression
+    hello.compression_method_ = CompressionMethod(input[AUTO]);
+
+    return input;
+}
+
+
+// output operator for ServerHello
+output_buffer& operator<<(output_buffer& output, const ServerHello& hello)
+{
+    // Protocol
+    output[AUTO] = hello.server_version_.major_;
+    output[AUTO] = hello.server_version_.minor_;
+
+    // Random
+    output.write(hello.random_, RAN_LEN);
+
+    // Session
+    output[AUTO] = hello.id_len_;
+    output.write(hello.session_id_, ID_LEN);
+
+    // Suites
+    output[AUTO] = hello.cipher_suite_[0];
+    output[AUTO] = hello.cipher_suite_[1];
+
+    // Compression
+    output[AUTO] = hello.compression_method_;
+
+    return output;
+}
+
+
+// Server Hello processing handler
+void ServerHello::Process(input_buffer&, SSL& ssl)
+{
+    ssl.set_pending(cipher_suite_[1]);
+    ssl.set_random(random_, server_end);
+    ssl.set_sessionID(session_id_);
+
+    if (ssl.getSecurity().get_resuming())
+        if (memcmp(session_id_, ssl.getSecurity().get_resume().GetID(),
+                   ID_LEN) == 0) {
+            ssl.set_masterSecret(ssl.getSecurity().get_resume().GetSecret());
+            if (ssl.isTLS())
+                ssl.deriveTLSKeys();
+            else
+                ssl.deriveKeys();
+            ssl.useStates().useClient() = serverHelloDoneComplete;
+            return;
+        }
+        else {
+            ssl.useSecurity().set_resuming(false);
+            ssl.useLog().Trace("server denied resumption");
+        }
+    ssl.useStates().useClient() = serverHelloComplete;
+}
+
+
+ServerHello::ServerHello()
+{
+    memset(random_, 0, RAN_LEN);
+    memset(session_id_, 0, ID_LEN);
+}
+
+
+ServerHello::ServerHello(ProtocolVersion pv)
+    : server_version_(pv)
+{
+    memset(random_, 0, RAN_LEN);
+    memset(session_id_, 0, ID_LEN);
+}
+
+
+input_buffer& ServerHello::set(input_buffer& in)
+{
+    return in  >> *this;
+}
+
+
+output_buffer& ServerHello::get(output_buffer& out) const
+{
+    return out << *this;
+}
+
+
+HandShakeType ServerHello::get_type() const
+{
+    return server_hello;
+}
+
+
+const opaque* ServerHello::get_random() const
+{
+    return random_;
+}
+
+
+// Server Hello Done processing handler
+void ServerHelloDone::Process(input_buffer&, SSL& ssl)
+{
+    ssl.useStates().useClient() = serverHelloDoneComplete;
+}
+
+
+ServerHelloDone::ServerHelloDone()
+{
+    set_length(0);
+}
+
+
+input_buffer& ServerHelloDone::set(input_buffer& in)
+{
+    return in;
+}
+
+
+output_buffer& ServerHelloDone::get(output_buffer& out) const
+{
+    return out;
+}
+
+
+HandShakeType ServerHelloDone::get_type() const
+{
+    return server_hello_done;
+}
+
+
+int ClientKeyBase::get_length() const
+{
+    return 0;
+}
+
+
+opaque* ClientKeyBase::get_clientKey() const
+{
+    return 0;
+}
+
+
+// input operator for Client Hello
+input_buffer& operator>>(input_buffer& input, ClientHello& hello)
+{
+    // Protocol
+    hello.client_version_.major_ = input[AUTO];
+    hello.client_version_.minor_ = input[AUTO];
+
+    // Random
+    input.read(hello.random_, RAN_LEN);
+
+    // Session
+    hello.id_len_ = input[AUTO];
+    if (hello.id_len_) input.read(hello.session_id_, ID_LEN);
+    
+    // Suites
+    byte tmp[2];
+    tmp[0] = input[AUTO];
+    tmp[1] = input[AUTO];
+    ato16(tmp, hello.suite_len_);
+    input.read(hello.cipher_suites_, hello.suite_len_);
+
+    // Compression
+    hello.comp_len_ = input[AUTO];
+    hello.compression_methods_ = CompressionMethod(input[AUTO]);
+
+    return input;
+}
+
+
+// output operaotr for Client Hello
+output_buffer& operator<<(output_buffer& output, const ClientHello& hello)
+{ 
+    // Protocol
+    output[AUTO] = hello.client_version_.major_;
+    output[AUTO] = hello.client_version_.minor_;
+
+    // Random
+    output.write(hello.random_, RAN_LEN);
+
+    // Session
+    output[AUTO] = hello.id_len_;
+    if (hello.id_len_) output.write(hello.session_id_, ID_LEN);
+
+    // Suites
+    byte tmp[2];
+    c16toa(hello.suite_len_, tmp);
+    output[AUTO] = tmp[0];
+    output[AUTO] = tmp[1];
+    output.write(hello.cipher_suites_, hello.suite_len_);
+  
+    // Compression
+    output[AUTO] = hello.comp_len_;
+    output[AUTO] = hello.compression_methods_;
+
+    return output;
+}
+
+
+// Client Hello processing handler
+void ClientHello::Process(input_buffer&, SSL& ssl)
+{
+    if (ssl.isTLS() && client_version_.minor_ == 0) {
+        ssl.useSecurity().use_connection().TurnOffTLS();
+        ProtocolVersion pv = ssl.getSecurity().get_connection().version_;
+        ssl.useSecurity().use_parms().SetSuites(pv);  // reset w/ SSL suites
+    }
+    ssl.set_random(random_, client_end);
+
+    while (id_len_) {  // trying to resume
+        SSL_SESSION* session = GetSessions().lookup(session_id_);
+        if (!session)  {
+            ssl.useLog().Trace("session lookup failed");
+            break;
+        }
+        ssl.set_session(session);
+        ssl.useSecurity().set_resuming(true);
+        ssl.matchSuite(session->GetSuite(), SUITE_LEN);
+        ssl.set_pending(ssl.getSecurity().get_parms().suite_[1]);
+        ssl.set_masterSecret(session->GetSecret());
+
+        opaque serverRandom[RAN_LEN];
+        ssl.getCrypto().get_random().Fill(serverRandom, sizeof(serverRandom));
+        ssl.set_random(serverRandom, server_end);
+        if (ssl.isTLS())
+            ssl.deriveTLSKeys();
+        else
+            ssl.deriveKeys();
+        ssl.useStates().useServer() = clientKeyExchangeComplete;
+        return;
+    }
+    ssl.matchSuite(cipher_suites_, suite_len_);
+    ssl.set_pending(ssl.getSecurity().get_parms().suite_[1]);
+
+    ssl.useStates().useServer() = clientHelloComplete;
+}
+
+
+input_buffer& ClientHello::set(input_buffer& in)
+{
+    return in  >> *this;
+}
+
+
+output_buffer& ClientHello::get(output_buffer& out) const
+{
+    return out << *this;
+}
+
+
+HandShakeType ClientHello::get_type() const
+{
+    return client_hello;
+}
+
+
+const opaque* ClientHello::get_random() const
+{
+    return random_;
+}
+
+
+ClientHello::ClientHello()
+{
+    memset(random_, 0, RAN_LEN);
+}
+
+
+ClientHello::ClientHello(ProtocolVersion pv)
+    : client_version_(pv)
+{
+    memset(random_, 0, RAN_LEN);
+}
+
+
+// output operator for ServerKeyExchange
+output_buffer& operator<<(output_buffer& output, const ServerKeyExchange& sk)
+{
+    output.write(sk.getKey(), sk.getKeyLength());
+    return output;
+}
+
+
+// Server Key Exchange processing handler
+void ServerKeyExchange::Process(input_buffer& input, SSL& ssl)
+{
+    createKey(ssl);
+    if (ssl.GetError()) return;
+    server_key_->read(ssl, input);
+
+    ssl.useStates().useClient() = serverKeyExchangeComplete;
+}
+
+
+ServerKeyExchange::ServerKeyExchange(SSL& ssl)
+{
+    createKey(ssl);
+}
+
+
+ServerKeyExchange::ServerKeyExchange()
+    : server_key_(0)
+{}
+
+
+ServerKeyExchange::~ServerKeyExchange()
+{
+    delete server_key_;
+}
+
+
+void ServerKeyExchange::build(SSL& ssl) 
+{ 
+    server_key_->build(ssl); 
+    set_length(server_key_->get_length());
+}
+
+
+const opaque* ServerKeyExchange::getKey() const
+{
+    return server_key_->get_serverKey();
+}
+
+
+int ServerKeyExchange::getKeyLength() const
+{
+    return server_key_->get_length();
+}
+
+
+input_buffer& ServerKeyExchange::set(input_buffer& in)
+{
+    return in;      // process does
+}
+
+
+output_buffer& ServerKeyExchange::get(output_buffer& out) const
+{
+    return out << *this;
+}
+
+
+HandShakeType ServerKeyExchange::get_type() const
+{
+    return server_key_exchange;
+}
+
+
+// CertificateRequest 
+CertificateRequest::CertificateRequest()
+    : typeTotal_(0)
+{
+    memset(certificate_types_, 0, sizeof(certificate_types_));
+}
+
+
+CertificateRequest::~CertificateRequest()
+{
+
+    mySTL::for_each(certificate_authorities_.begin(),
+                  certificate_authorities_.end(),
+                  del_ptr_zero()) ;
+}
+
+
+void CertificateRequest::Build()
+{
+    certificate_types_[0] = rsa_sign;
+    certificate_types_[1] = dss_sign;
+
+    typeTotal_ = 2;
+
+    uint16 authCount = 0;
+    uint16 authSz = 0;
+  
+    for (int j = 0; j < authCount; j++) {
+        int sz = REQUEST_HEADER + MIN_DIS_SIZE;
+        DistinguishedName dn;
+        certificate_authorities_.push_back(dn = new (ys) byte[sz]);
+
+        opaque tmp[REQUEST_HEADER];
+        c16toa(MIN_DIS_SIZE, tmp);
+        memcpy(dn, tmp, sizeof(tmp));
+  
+        // fill w/ junk for now
+        memcpy(dn, tmp, MIN_DIS_SIZE);
+        authSz += sz;
+    }
+
+    set_length(SIZEOF_ENUM + typeTotal_ + REQUEST_HEADER + authSz);
+}
+
+
+input_buffer& CertificateRequest::set(input_buffer& in)
+{
+    return in >> *this;
+}
+
+
+output_buffer& CertificateRequest::get(output_buffer& out) const
+{
+    return out << *this;
+}
+
+
+// input operator for CertificateRequest
+input_buffer& operator>>(input_buffer& input, CertificateRequest& request)
+{
+    // types
+    request.typeTotal_ = input[AUTO];
+    for (int i = 0; i < request.typeTotal_; i++)
+        request.certificate_types_[i] = ClientCertificateType(input[AUTO]);
+
+    byte tmp[REQUEST_HEADER];
+    input.read(tmp, sizeof(tmp));
+    uint16 sz;
+    ato16(tmp, sz);
+
+    // authorities
+    while (sz) {
+        uint16 dnSz;
+        input.read(tmp, sizeof(tmp));
+        ato16(tmp, dnSz);
+        
+        DistinguishedName dn;
+        request.certificate_authorities_.push_back(dn = new (ys) 
+                                                  byte[REQUEST_HEADER + dnSz]);
+        memcpy(dn, tmp, REQUEST_HEADER);
+        input.read(&dn[REQUEST_HEADER], dnSz);
+
+        sz -= dnSz + REQUEST_HEADER;
+    }
+
+    return input;
+}
+
+
+// output operator for CertificateRequest
+output_buffer& operator<<(output_buffer& output,
+                          const CertificateRequest& request)
+{
+    // types
+    output[AUTO] = request.typeTotal_;
+    for (int i = 0; i < request.typeTotal_; i++)
+        output[AUTO] = request.certificate_types_[i];
+
+    // authorities
+    opaque tmp[REQUEST_HEADER];
+    c16toa(request.get_length() - SIZEOF_ENUM -
+           request.typeTotal_ - REQUEST_HEADER, tmp);
+    output.write(tmp, sizeof(tmp));
+
+    mySTL::list<DistinguishedName>::const_iterator first =
+                                    request.certificate_authorities_.begin();
+    mySTL::list<DistinguishedName>::const_iterator last =
+                                    request.certificate_authorities_.end();
+    while (first != last) {
+        uint16 sz;
+        ato16(*first, sz);
+        output.write(*first, sz + REQUEST_HEADER);
+
+        ++first;
+    }
+
+    return output;
+}
+
+
+// CertificateRequest processing handler
+void CertificateRequest::Process(input_buffer&, SSL& ssl)
+{
+    ssl.useCrypto().use_certManager().setSendVerify();
+}
+
+
+HandShakeType CertificateRequest::get_type() const
+{
+    return certificate_request;
+}
+
+
+// CertificateVerify 
+CertificateVerify::CertificateVerify() : signature_(0)
+{}
+
+
+CertificateVerify::~CertificateVerify()
+{
+    delete[] signature_;
+}
+
+
+void CertificateVerify::Build(SSL& ssl)
+{
+    build_certHashes(ssl, hashes_);
+
+    uint16 sz = 0;
+    byte   len[VERIFY_HEADER];
+    mySTL::auto_ptr<byte> sig;
+
+    // sign
+    const CertManager& cert = ssl.getCrypto().get_certManager();
+    if (cert.get_keyType() == rsa_sa_algo) {
+        RSA rsa(cert.get_privateKey(), cert.get_privateKeyLength(), false);
+
+        sz = rsa.get_cipherLength() + VERIFY_HEADER;
+        sig.reset(new (ys) byte[sz]);
+
+        c16toa(sz - VERIFY_HEADER, len);
+        memcpy(sig.get(), len, VERIFY_HEADER);
+        rsa.sign(sig.get() + VERIFY_HEADER, hashes_.md5_, sizeof(Hashes),
+                 ssl.getCrypto().get_random());
+    }
+    else {  // DSA
+        DSS dss(cert.get_privateKey(), cert.get_privateKeyLength(), false);
+
+        sz = DSS_SIG_SZ + DSS_ENCODED_EXTRA + VERIFY_HEADER;
+        sig.reset(new (ys) byte[sz]);
+
+        c16toa(sz - VERIFY_HEADER, len);
+        memcpy(sig.get(), len, VERIFY_HEADER);
+        dss.sign(sig.get() + VERIFY_HEADER, hashes_.sha_, SHA_LEN,
+                 ssl.getCrypto().get_random());
+
+        byte encoded[DSS_SIG_SZ + DSS_ENCODED_EXTRA];
+        TaoCrypt::EncodeDSA_Signature(sig.get() + VERIFY_HEADER, encoded);
+        memcpy(sig.get() + VERIFY_HEADER, encoded, sizeof(encoded));
+    }
+    set_length(sz);
+    signature_ = sig.release();
+}
+
+
+input_buffer& CertificateVerify::set(input_buffer& in)
+{
+    return in >> *this;
+}
+
+
+output_buffer& CertificateVerify::get(output_buffer& out) const
+{
+    return out << *this;
+}
+
+
+// input operator for CertificateVerify
+input_buffer& operator>>(input_buffer& input, CertificateVerify& request)
+{
+    byte tmp[VERIFY_HEADER];
+    input.read(tmp, sizeof(tmp));
+
+    uint16 sz = 0;
+    ato16(tmp, sz);
+    request.set_length(sz);
+
+    request.signature_ = new (ys) byte[sz];
+    input.read(request.signature_, sz);
+
+    return input;
+}
+
+
+// output operator for CertificateVerify
+output_buffer& operator<<(output_buffer& output,
+                          const CertificateVerify& verify)
+{
+    output.write(verify.signature_, verify.get_length());
+
+    return output;
+}
+
+
+// CertificateVerify processing handler
+void CertificateVerify::Process(input_buffer&, SSL& ssl)
+{
+    const Hashes&      hashVerify = ssl.getHashes().get_certVerify();
+    const CertManager& cert       = ssl.getCrypto().get_certManager();
+
+    if (cert.get_peerKeyType() == rsa_sa_algo) {
+        RSA rsa(cert.get_peerKey(), cert.get_peerKeyLength());
+
+        if (!rsa.verify(hashVerify.md5_, sizeof(hashVerify), signature_,
+                        get_length()))
+            ssl.SetError(verify_error);
+    }
+    else { // DSA
+        byte decodedSig[DSS_SIG_SZ];
+        TaoCrypt::DecodeDSA_Signature(decodedSig, signature_, get_length());
+        
+        DSS dss(cert.get_peerKey(), cert.get_peerKeyLength());
+        if (!dss.verify(hashVerify.sha_, SHA_LEN, decodedSig, get_length()))
+            ssl.SetError(verify_error);
+    }
+}
+
+
+HandShakeType CertificateVerify::get_type() const
+{
+    return certificate_verify;
+}
+
+
+// output operator for ClientKeyExchange
+output_buffer& operator<<(output_buffer& output, const ClientKeyExchange& ck)
+{
+    output.write(ck.getKey(), ck.getKeyLength());
+    return output;
+}
+
+
+// Client Key Exchange processing handler
+void ClientKeyExchange::Process(input_buffer& input, SSL& ssl)
+{
+    createKey(ssl);
+    if (ssl.GetError()) return;
+    client_key_->read(ssl, input);
+
+    if (ssl.getCrypto().get_certManager().verifyPeer())
+        build_certHashes(ssl, ssl.useHashes().use_certVerify());
+
+    ssl.useStates().useServer() = clientKeyExchangeComplete;
+}
+
+
+ClientKeyExchange::ClientKeyExchange(SSL& ssl)
+{
+    createKey(ssl);
+}
+
+
+ClientKeyExchange::ClientKeyExchange()
+    : client_key_(0)
+{}
+
+
+ClientKeyExchange::~ClientKeyExchange()
+{
+    delete client_key_;
+}
+
+
+void ClientKeyExchange::build(SSL& ssl) 
+{ 
+    client_key_->build(ssl); 
+    set_length(client_key_->get_length());
+}
+
+const opaque* ClientKeyExchange::getKey() const
+{
+    return client_key_->get_clientKey();
+}
+
+
+int ClientKeyExchange::getKeyLength() const
+{
+    return client_key_->get_length();
+}
+
+
+input_buffer& ClientKeyExchange::set(input_buffer& in)
+{
+    return in;
+}
+
+
+output_buffer& ClientKeyExchange::get(output_buffer& out) const
+{
+    return out << *this;
+}
+
+
+HandShakeType ClientKeyExchange::get_type() const
+{
+    return client_key_exchange;
+}
+
+
+// input operator for Finished
+input_buffer& operator>>(input_buffer& input, Finished&)
+{
+    /*  do in process */
+
+    return input; 
+}
+
+// output operator for Finished
+output_buffer& operator<<(output_buffer& output, const Finished& fin)
+{
+    if (fin.get_length() == FINISHED_SZ) {
+        output.write(fin.hashes_.md5_, MD5_LEN);
+        output.write(fin.hashes_.sha_, SHA_LEN);
+    }
+    else    // TLS_FINISHED_SZ
+        output.write(fin.hashes_.md5_, TLS_FINISHED_SZ);
+
+    return output;
+}
+
+
+// Finished processing handler
+void Finished::Process(input_buffer& input, SSL& ssl)
+{
+    // verify hashes
+    const  Finished& verify = ssl.getHashes().get_verify();
+    uint finishedSz = ssl.isTLS() ? TLS_FINISHED_SZ : FINISHED_SZ;
+
+    input.read(hashes_.md5_, finishedSz);
+
+    if (memcmp(&hashes_, &verify.hashes_, finishedSz)) {
+        ssl.SetError(verify_error);
+        return;
+    }
+
+    // read verify mac
+    opaque verifyMAC[SHA_LEN];
+    uint macSz = finishedSz + HANDSHAKE_HEADER;
+
+    if (ssl.isTLS())
+        TLS_hmac(ssl, verifyMAC, input.get_buffer() + input.get_current()
+                 - macSz, macSz, handshake, true);
+    else
+        hmac(ssl, verifyMAC, input.get_buffer() + input.get_current() - macSz,
+             macSz, handshake, true);
+
+    // read mac and fill
+    opaque mac[SHA_LEN];   // max size
+    int    digestSz = ssl.getCrypto().get_digest().get_digestSize();
+    input.read(mac, digestSz);
+
+    opaque fill;
+    int    padSz = ssl.getSecurity().get_parms().encrypt_size_ -
+                     HANDSHAKE_HEADER - finishedSz - digestSz;
+    for (int i = 0; i < padSz; i++) 
+        fill = input[AUTO];
+
+    // verify mac
+    if (memcmp(mac, verifyMAC, digestSz)) {
+        ssl.SetError(verify_error);
+        return;
+    }
+
+    // update states
+    ssl.useStates().useHandShake() = handShakeReady;
+    if (ssl.getSecurity().get_parms().entity_ == client_end)
+        ssl.useStates().useClient() = serverFinishedComplete;
+    else
+        ssl.useStates().useServer() = clientFinishedComplete;
+}
+
+
+Finished::Finished()
+{
+    set_length(FINISHED_SZ);
+}
+
+
+uint8* Finished::set_md5()
+{
+    return hashes_.md5_;
+}
+
+
+uint8* Finished::set_sha()
+{
+    return hashes_.sha_;
+}
+
+
+input_buffer& Finished::set(input_buffer& in)
+{
+    return in  >> *this;
+}
+
+
+output_buffer& Finished::get(output_buffer& out) const
+{
+    return out << *this;
+}
+
+
+HandShakeType Finished::get_type() const
+{
+    return finished;
+}
+
+
+void clean(volatile opaque* p, uint sz, RandomPool& ran)
+{
+    uint i(0);
+
+    for (i = 0; i < sz; ++i)
+        p[i] = 0;
+
+    ran.Fill(const_cast<opaque*>(p), sz);
+
+    for (i = 0; i < sz; ++i)
+        p[i] = 0;
+}
+
+
+
+Connection::Connection(ProtocolVersion v, RandomPool& ran)
+    : pre_master_secret_(0), sequence_number_(0), peer_sequence_number_(0),
+      pre_secret_len_(0), send_server_key_(false), master_clean_(false),
+      TLS_(v.major_ >= 3 && v.minor_ >= 1), version_(v), random_(ran) 
+{}
+
+
+Connection::~Connection() 
+{ 
+    CleanMaster(); CleanPreMaster(); delete[] pre_master_secret_;
+}
+
+
+void Connection::AllocPreSecret(uint sz) 
+{ 
+    pre_master_secret_ = new (ys) opaque[pre_secret_len_ = sz];
+}
+
+
+void Connection::TurnOffTLS()
+{
+    TLS_ = false;
+    version_.minor_ = 0;
+}
+
+
+// wipeout master secret
+void Connection::CleanMaster()
+{
+    if (!master_clean_) {
+        volatile opaque* p = master_secret_;
+        clean(p, SECRET_LEN, random_);
+        master_clean_ = true;
+    }
+}
+
+
+// wipeout pre master secret
+void Connection::CleanPreMaster()
+{
+    if (pre_master_secret_) {
+        volatile opaque* p = pre_master_secret_;
+        clean(p, pre_secret_len_, random_);
+
+        delete[] pre_master_secret_;
+        pre_master_secret_ = 0;
+    }
+}
+
+
+// Create functions for message factory
+Message* CreateCipherSpec() { return new (ys) ChangeCipherSpec; }
+Message* CreateAlert()      { return new (ys) Alert; }
+Message* CreateHandShake()  { return new (ys) HandShakeHeader; }
+Message* CreateData()       { return new (ys) Data; }
+
+// Create functions for handshake factory
+HandShakeBase* CreateHelloRequest()       { return new (ys) HelloRequest; }
+HandShakeBase* CreateClientHello()        { return new (ys) ClientHello; }
+HandShakeBase* CreateServerHello()        { return new (ys) ServerHello; }
+HandShakeBase* CreateCertificate()        { return new (ys) Certificate; }
+HandShakeBase* CreateServerKeyExchange()  { return new (ys) ServerKeyExchange;}
+HandShakeBase* CreateCertificateRequest() { return new (ys) 
+                                                    CertificateRequest; }
+HandShakeBase* CreateServerHelloDone()    { return new (ys) ServerHelloDone; }
+HandShakeBase* CreateCertificateVerify()  { return new (ys) CertificateVerify;}
+HandShakeBase* CreateClientKeyExchange()  { return new (ys) ClientKeyExchange;}
+HandShakeBase* CreateFinished()           { return new (ys) Finished; }
+
+// Create functions for server key exchange factory
+ServerKeyBase* CreateRSAServerKEA()       { return new (ys) RSA_Server; }
+ServerKeyBase* CreateDHServerKEA()        { return new (ys) DH_Server; }
+ServerKeyBase* CreateFortezzaServerKEA()  { return new (ys) Fortezza_Server; }
+
+// Create functions for client key exchange factory
+ClientKeyBase* CreateRSAClient()      { return new (ys) 
+                                                EncryptedPreMasterSecret; }
+ClientKeyBase* CreateDHClient()       { return new (ys) 
+                                                ClientDiffieHellmanPublic; }
+ClientKeyBase* CreateFortezzaClient() { return new (ys) FortezzaKeys; }
+
+
+// Constructor calls this to Register compile time callbacks
+void InitMessageFactory(MessageFactory& mf)
+{
+    mf.Reserve(4);
+    mf.Register(alert, CreateAlert);
+    mf.Register(change_cipher_spec, CreateCipherSpec);
+    mf.Register(handshake, CreateHandShake);
+    mf.Register(application_data, CreateData);
+}
+
+
+// Constructor calls this to Register compile time callbacks
+void InitHandShakeFactory(HandShakeFactory& hsf)
+{
+    hsf.Reserve(10);
+    hsf.Register(hello_request, CreateHelloRequest);
+    hsf.Register(client_hello, CreateClientHello);
+    hsf.Register(server_hello, CreateServerHello);
+    hsf.Register(certificate, CreateCertificate);
+    hsf.Register(server_key_exchange, CreateServerKeyExchange);
+    hsf.Register(certificate_request, CreateCertificateRequest);
+    hsf.Register(server_hello_done, CreateServerHelloDone);
+    hsf.Register(certificate_verify, CreateCertificateVerify);
+    hsf.Register(client_key_exchange, CreateClientKeyExchange);
+    hsf.Register(finished, CreateFinished);
+}
+
+
+// Constructor calls this to Register compile time callbacks
+void InitServerKeyFactory(ServerKeyFactory& skf)
+{
+    skf.Reserve(3);
+    skf.Register(rsa_kea, CreateRSAServerKEA);
+    skf.Register(diffie_hellman_kea, CreateDHServerKEA);
+    skf.Register(fortezza_kea, CreateFortezzaServerKEA);
+}
+
+
+// Constructor calls this to Register compile time callbacks
+void InitClientKeyFactory(ClientKeyFactory& ckf)
+{
+    ckf.Reserve(3);
+    ckf.Register(rsa_kea, CreateRSAClient);
+    ckf.Register(diffie_hellman_kea, CreateDHClient);
+    ckf.Register(fortezza_kea, CreateFortezzaClient);
+}
+
+
+} // namespace
diff --git a/extra/yassl/src/yassl_int.cpp b/extra/yassl/src/yassl_int.cpp
new file mode 100644
index 00000000000..d481194d2d7
--- /dev/null
+++ b/extra/yassl/src/yassl_int.cpp
@@ -0,0 +1,1971 @@
+/* yassl_int.cpp                                
+ *
+ * Copyright (C) 2003 Sawtooth Consulting Ltd.
+ *
+ * This file is part of yaSSL.
+ *
+ * yaSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * yaSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
+ */
+
+
+/* yaSSL internal source implements SSL supporting types not specified in the
+ * draft along with type conversion functions.
+ */
+
+#include "runtime.hpp"
+#include "yassl_int.hpp"
+#include "handshake.hpp"
+#include "timer.hpp"
+#include "openssl/ssl.h"  // for DH
+
+
+void* operator new(size_t sz, yaSSL::new_t)
+{
+    void* ptr = ::operator new(sz);
+
+    if (!ptr) abort();
+
+    return ptr;
+}
+
+void* operator new[](size_t sz, yaSSL::new_t n)
+{
+#if defined(_MSC_VER) && (_MSC_VER < 1300)
+    void* ptr = ::operator new(sz);         // no ::operator new[]
+#else
+    void* ptr = ::operator new[](sz);
+#endif
+
+    if (!ptr) abort();
+
+    return ptr;
+}
+
+
+namespace yaSSL {
+
+
+using mySTL::min;
+
+
+new_t ys;   // for library new
+
+
+// convert a 32 bit integer into a 24 bit one
+void c32to24(uint32 u32, uint24& u24)
+{
+    u24[0] = (u32 >> 16) & 0xff;
+    u24[1] = (u32 >>  8) & 0xff;
+    u24[2] =  u32 & 0xff;
+}
+
+
+// convert a 24 bit integer into a 32 bit one
+void c24to32(const uint24 u24, uint32& u32)
+{
+    u32 = 0;
+    u32 = (u24[0] << 16) | (u24[1] << 8) | u24[2];
+}
+
+
+// convert with return for ease of use
+uint32 c24to32(const uint24 u24)
+{
+    uint32 ret;
+    c24to32(u24, ret);
+
+    return ret;
+}
+
+
+// using a for opaque since underlying type is unsgined char and o is not a
+// good leading identifier
+
+// convert opaque to 16 bit integer
+void ato16(const opaque* c, uint16& u16)
+{
+    u16 = 0;
+    u16 = (c[0] << 8) | (c[1]);
+}
+
+
+// convert (copy) opaque to 24 bit integer
+void ato24(const opaque* c, uint24& u24)
+{
+    u24[0] = c[0];
+    u24[1] = c[1];
+    u24[2] = c[2];
+}
+
+
+// convert 16 bit integer to opaque
+void c16toa(uint16 u16, opaque* c)
+{
+    c[0] = (u16 >> 8) & 0xff;
+    c[1] =  u16 & 0xff;
+}
+
+
+// convert 24 bit integer to opaque
+void c24toa(const uint24 u24, opaque* c)
+{
+    c[0] =  u24[0]; 
+    c[1] =  u24[1];
+    c[2] =  u24[2];
+}
+
+
+// convert 32 bit integer to opaque
+void c32toa(uint32 u32, opaque* c)
+{
+    c[0] = (u32 >> 24) & 0xff;
+    c[1] = (u32 >> 16) & 0xff;
+    c[2] = (u32 >>  8) & 0xff;
+    c[3] =  u32 & 0xff;
+}
+
+
+States::States() : recordLayer_(recordReady), handshakeLayer_(preHandshake),
+           clientState_(serverNull),  serverState_(clientNull),
+           what_(no_error) {}
+
+const RecordLayerState& States::getRecord() const 
+{
+    return recordLayer_;
+}
+
+
+const HandShakeState& States::getHandShake() const
+{
+    return handshakeLayer_;
+}
+
+
+const ClientState& States::getClient() const
+{
+    return clientState_;
+}
+
+
+const ServerState& States::getServer() const
+{
+    return serverState_;
+}
+
+
+const char* States::getString() const
+{
+    return errorString_;
+}
+
+
+YasslError States::What() const
+{
+    return what_;
+}
+
+
+RecordLayerState& States::useRecord()
+{
+    return recordLayer_;
+}
+
+
+HandShakeState& States::useHandShake()
+{
+    return handshakeLayer_;
+}
+
+
+ClientState& States::useClient()
+{
+    return clientState_;
+}
+
+
+ServerState& States::useServer()
+{
+    return serverState_;
+}
+
+
+char* States::useString()
+{
+    return errorString_;
+}
+
+
+void States::SetError(YasslError ye)
+{
+    what_ = ye;
+}
+
+
+sslFactory::sslFactory() :           
+        messageFactory_(InitMessageFactory),
+        handShakeFactory_(InitHandShakeFactory),
+        serverKeyFactory_(InitServerKeyFactory),
+        clientKeyFactory_(InitClientKeyFactory) 
+{}
+
+
+const MessageFactory& sslFactory::getMessage() const
+{
+    return messageFactory_;
+}
+
+
+const HandShakeFactory& sslFactory::getHandShake() const
+{
+    return handShakeFactory_;
+}
+
+
+const ServerKeyFactory& sslFactory::getServerKey() const
+{
+    return serverKeyFactory_;
+}
+
+
+const ClientKeyFactory& sslFactory::getClientKey() const
+{
+    return clientKeyFactory_;
+}
+
+
+// extract context parameters and store
+SSL::SSL(SSL_CTX* ctx) 
+    : secure_(ctx->getMethod()->getVersion(), crypto_.use_random(),
+              ctx->getMethod()->getSide(), ctx->GetCiphers(), ctx)
+{
+    if (int err = crypto_.get_random().GetError()) {
+        SetError(YasslError(err));
+        return;
+    }
+
+    CertManager& cm = crypto_.use_certManager();
+    cm.CopySelfCert(ctx->getCert());
+
+    bool serverSide = secure_.use_parms().entity_ == server_end;
+
+    if (ctx->getKey()) {
+        if (int err = cm.SetPrivateKey(*ctx->getKey())) {
+            SetError(YasslError(err));
+            return;
+        }
+    }
+    else if (serverSide) {
+        SetError(no_key_file);
+        return;
+    }
+
+    if (ctx->getMethod()->verifyPeer())
+        cm.setVerifyPeer();
+    if (ctx->getMethod()->failNoCert())
+        cm.setFailNoCert();
+
+    if (serverSide)
+        crypto_.SetDH(ctx->GetDH_Parms());
+
+    const SSL_CTX::CertList& ca = ctx->GetCA_List();
+    SSL_CTX::CertList::const_iterator first(ca.begin());
+    SSL_CTX::CertList::const_iterator last(ca.end());
+
+    while (first != last) {
+        if (int err = cm.CopyCaCert(*first)) {
+            SetError(YasslError(err));
+            return;
+        }
+        ++first;
+    }
+}
+
+
+// store pending security parameters from Server Hello
+void SSL::set_pending(Cipher suite)
+{
+    Parameters& parms = secure_.use_parms();
+
+    switch (suite) {
+
+    case TLS_RSA_WITH_AES_256_CBC_SHA:
+        parms.bulk_cipher_algorithm_ = aes;
+        parms.mac_algorithm_         = sha;
+        parms.kea_                   = rsa_kea;
+        parms.hash_size_ = SHA_LEN;
+        parms.key_size_  = AES_256_KEY_SZ;
+        parms.iv_size_   = AES_BLOCK_SZ;
+        parms.cipher_type_ = block;
+        crypto_.setDigest(new (ys) SHA);
+        crypto_.setCipher(new (ys) AES(AES_256_KEY_SZ));
+        strncpy(parms.cipher_name_, cipher_names[TLS_RSA_WITH_AES_256_CBC_SHA],
+                MAX_SUITE_NAME);
+        break;
+
+    case TLS_RSA_WITH_AES_128_CBC_SHA:
+        parms.bulk_cipher_algorithm_ = aes;
+        parms.mac_algorithm_         = sha;
+        parms.kea_                   = rsa_kea;
+        parms.hash_size_ = SHA_LEN;
+        parms.key_size_  = AES_128_KEY_SZ;
+        parms.iv_size_   = AES_BLOCK_SZ;
+        parms.cipher_type_ = block;
+        crypto_.setDigest(new (ys) SHA);
+        crypto_.setCipher(new (ys) AES);
+        strncpy(parms.cipher_name_, cipher_names[TLS_RSA_WITH_AES_128_CBC_SHA],
+                MAX_SUITE_NAME);
+        break;
+
+    case SSL_RSA_WITH_3DES_EDE_CBC_SHA:
+        parms.bulk_cipher_algorithm_ = triple_des;
+        parms.mac_algorithm_         = sha;
+        parms.kea_                   = rsa_kea;
+        parms.hash_size_ = SHA_LEN;
+        parms.key_size_  = DES_EDE_KEY_SZ;
+        parms.iv_size_   = DES_IV_SZ;
+        parms.cipher_type_ = block;
+        crypto_.setDigest(new (ys) SHA);
+        crypto_.setCipher(new (ys) DES_EDE);
+        strncpy(parms.cipher_name_, cipher_names[SSL_RSA_WITH_3DES_EDE_CBC_SHA]
+                , MAX_SUITE_NAME);
+        break;
+
+    case SSL_RSA_WITH_DES_CBC_SHA:
+        parms.bulk_cipher_algorithm_ = des;
+        parms.mac_algorithm_         = sha;
+        parms.kea_                   = rsa_kea;
+        parms.hash_size_ = SHA_LEN;
+        parms.key_size_  = DES_KEY_SZ;
+        parms.iv_size_   = DES_IV_SZ;
+        parms.cipher_type_ = block;
+        crypto_.setDigest(new (ys) SHA);
+        crypto_.setCipher(new (ys) DES);
+        strncpy(parms.cipher_name_, cipher_names[SSL_RSA_WITH_DES_CBC_SHA],
+                MAX_SUITE_NAME);
+        break;
+
+    case SSL_RSA_WITH_RC4_128_SHA:
+        parms.bulk_cipher_algorithm_ = rc4;
+        parms.mac_algorithm_         = sha;
+        parms.kea_                   = rsa_kea;
+        parms.hash_size_ = SHA_LEN;
+        parms.key_size_  = RC4_KEY_SZ;
+        parms.iv_size_   = 0;
+        parms.cipher_type_ = stream;
+        crypto_.setDigest(new (ys) SHA);
+        crypto_.setCipher(new (ys) RC4);
+        strncpy(parms.cipher_name_, cipher_names[SSL_RSA_WITH_RC4_128_SHA],
+                MAX_SUITE_NAME);
+        break;
+
+    case SSL_RSA_WITH_RC4_128_MD5:
+        parms.bulk_cipher_algorithm_ = rc4;
+        parms.mac_algorithm_         = md5;
+        parms.kea_                   = rsa_kea;
+        parms.hash_size_ = MD5_LEN;
+        parms.key_size_  = RC4_KEY_SZ;
+        parms.iv_size_   = 0;
+        parms.cipher_type_ = stream;
+        crypto_.setDigest(new (ys) MD5);
+        crypto_.setCipher(new (ys) RC4);
+        strncpy(parms.cipher_name_, cipher_names[SSL_RSA_WITH_RC4_128_MD5],
+                MAX_SUITE_NAME);
+        break;
+
+    case SSL_DHE_RSA_WITH_DES_CBC_SHA:
+        parms.bulk_cipher_algorithm_ = des;
+        parms.mac_algorithm_         = sha;
+        parms.kea_                   = diffie_hellman_kea;
+        parms.sig_algo_              = rsa_sa_algo;
+        parms.hash_size_ = SHA_LEN;
+        parms.key_size_  = DES_KEY_SZ;
+        parms.iv_size_   = DES_IV_SZ;
+        parms.cipher_type_ = block;
+        secure_.use_connection().send_server_key_  = true; // eph
+        crypto_.setDigest(new (ys) SHA);
+        crypto_.setCipher(new (ys) DES);
+        strncpy(parms.cipher_name_, cipher_names[SSL_DHE_RSA_WITH_DES_CBC_SHA],
+                MAX_SUITE_NAME);
+        break;
+
+    case SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA:
+        parms.bulk_cipher_algorithm_ = triple_des;
+        parms.mac_algorithm_         = sha;
+        parms.kea_                   = diffie_hellman_kea;
+        parms.sig_algo_              = rsa_sa_algo;
+        parms.hash_size_ = SHA_LEN;
+        parms.key_size_  = DES_EDE_KEY_SZ;
+        parms.iv_size_   = DES_IV_SZ;
+        parms.cipher_type_ = block;
+        secure_.use_connection().send_server_key_  = true; // eph
+        crypto_.setDigest(new (ys) SHA);
+        crypto_.setCipher(new (ys) DES_EDE);
+        strncpy(parms.cipher_name_,
+              cipher_names[SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA], MAX_SUITE_NAME);
+        break;
+
+    case TLS_DHE_RSA_WITH_AES_256_CBC_SHA:
+        parms.bulk_cipher_algorithm_ = aes;
+        parms.mac_algorithm_         = sha;
+        parms.kea_                   = diffie_hellman_kea;
+        parms.sig_algo_              = rsa_sa_algo;
+        parms.hash_size_ = SHA_LEN;
+        parms.key_size_  = AES_256_KEY_SZ;
+        parms.iv_size_   = AES_BLOCK_SZ;
+        parms.cipher_type_ = block;
+        secure_.use_connection().send_server_key_  = true; // eph
+        crypto_.setDigest(new (ys) SHA);
+        crypto_.setCipher(new (ys) AES(AES_256_KEY_SZ));
+        strncpy(parms.cipher_name_,
+               cipher_names[TLS_DHE_RSA_WITH_AES_256_CBC_SHA], MAX_SUITE_NAME);
+        break;
+
+    case TLS_DHE_RSA_WITH_AES_128_CBC_SHA:
+        parms.bulk_cipher_algorithm_ = aes;
+        parms.mac_algorithm_         = sha;
+        parms.kea_                   = diffie_hellman_kea;
+        parms.sig_algo_              = rsa_sa_algo;
+        parms.hash_size_ = SHA_LEN;
+        parms.key_size_  = AES_128_KEY_SZ;
+        parms.iv_size_   = AES_BLOCK_SZ;
+        parms.cipher_type_ = block;
+        secure_.use_connection().send_server_key_  = true; // eph
+        crypto_.setDigest(new (ys) SHA);
+        crypto_.setCipher(new (ys) AES);
+        strncpy(parms.cipher_name_,
+               cipher_names[TLS_DHE_RSA_WITH_AES_128_CBC_SHA], MAX_SUITE_NAME);
+        break;
+
+    case SSL_DHE_DSS_WITH_DES_CBC_SHA:
+        parms.bulk_cipher_algorithm_ = des;
+        parms.mac_algorithm_         = sha;
+        parms.kea_                   = diffie_hellman_kea;
+        parms.sig_algo_              = dsa_sa_algo;
+        parms.hash_size_ = SHA_LEN;
+        parms.key_size_  = DES_KEY_SZ;
+        parms.iv_size_   = DES_IV_SZ;
+        parms.cipher_type_ = block;
+        secure_.use_connection().send_server_key_  = true; // eph
+        crypto_.setDigest(new (ys) SHA);
+        crypto_.setCipher(new (ys) DES);
+        strncpy(parms.cipher_name_, cipher_names[SSL_DHE_DSS_WITH_DES_CBC_SHA],
+                MAX_SUITE_NAME);
+        break;
+
+    case SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA:
+        parms.bulk_cipher_algorithm_ = triple_des;
+        parms.mac_algorithm_         = sha;
+        parms.kea_                   = diffie_hellman_kea;
+        parms.sig_algo_              = dsa_sa_algo;
+        parms.hash_size_ = SHA_LEN;
+        parms.key_size_  = DES_EDE_KEY_SZ;
+        parms.iv_size_   = DES_IV_SZ;
+        parms.cipher_type_ = block;
+        secure_.use_connection().send_server_key_  = true; // eph
+        crypto_.setDigest(new (ys) SHA);
+        crypto_.setCipher(new (ys) DES_EDE);
+        strncpy(parms.cipher_name_,
+              cipher_names[SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA], MAX_SUITE_NAME);
+        break;
+
+    case TLS_DHE_DSS_WITH_AES_256_CBC_SHA:
+        parms.bulk_cipher_algorithm_ = aes;
+        parms.mac_algorithm_         = sha;
+        parms.kea_                   = diffie_hellman_kea;
+        parms.sig_algo_              = dsa_sa_algo;
+        parms.hash_size_ = SHA_LEN;
+        parms.key_size_  = AES_256_KEY_SZ;
+        parms.iv_size_   = AES_BLOCK_SZ;
+        parms.cipher_type_ = block;
+        secure_.use_connection().send_server_key_  = true; // eph
+        crypto_.setDigest(new (ys) SHA);
+        crypto_.setCipher(new (ys) AES(AES_256_KEY_SZ));
+        strncpy(parms.cipher_name_,
+               cipher_names[TLS_DHE_DSS_WITH_AES_256_CBC_SHA], MAX_SUITE_NAME);
+        break;
+
+    case TLS_DHE_DSS_WITH_AES_128_CBC_SHA:
+        parms.bulk_cipher_algorithm_ = aes;
+        parms.mac_algorithm_         = sha;
+        parms.kea_                   = diffie_hellman_kea;
+        parms.sig_algo_              = dsa_sa_algo;
+        parms.hash_size_ = SHA_LEN;
+        parms.key_size_  = AES_128_KEY_SZ;
+        parms.iv_size_   = AES_BLOCK_SZ;
+        parms.cipher_type_ = block;
+        secure_.use_connection().send_server_key_  = true; // eph
+        crypto_.setDigest(new (ys) SHA);
+        crypto_.setCipher(new (ys) AES);
+        strncpy(parms.cipher_name_,
+               cipher_names[TLS_DHE_DSS_WITH_AES_128_CBC_SHA], MAX_SUITE_NAME);
+        break;
+
+    case TLS_RSA_WITH_AES_256_CBC_RMD160:
+        parms.bulk_cipher_algorithm_ = aes;
+        parms.mac_algorithm_         = rmd;
+        parms.kea_                   = rsa_kea;
+        parms.hash_size_ = RMD_LEN;
+        parms.key_size_  = AES_256_KEY_SZ;
+        parms.iv_size_   = AES_BLOCK_SZ;
+        parms.cipher_type_ = block;
+        crypto_.setDigest(new (ys) RMD);
+        crypto_.setCipher(new (ys) AES(AES_256_KEY_SZ));
+        strncpy(parms.cipher_name_,
+                cipher_names[TLS_RSA_WITH_AES_256_CBC_RMD160], MAX_SUITE_NAME);
+        break;
+
+    case TLS_RSA_WITH_AES_128_CBC_RMD160:
+        parms.bulk_cipher_algorithm_ = aes;
+        parms.mac_algorithm_         = rmd;
+        parms.kea_                   = rsa_kea;
+        parms.hash_size_ = RMD_LEN;
+        parms.key_size_  = AES_128_KEY_SZ;
+        parms.iv_size_   = AES_BLOCK_SZ;
+        parms.cipher_type_ = block;
+        crypto_.setDigest(new (ys) RMD);
+        crypto_.setCipher(new (ys) AES);
+        strncpy(parms.cipher_name_,
+                cipher_names[TLS_RSA_WITH_AES_128_CBC_RMD160], MAX_SUITE_NAME);
+        break;
+
+    case TLS_RSA_WITH_3DES_EDE_CBC_RMD160:
+        parms.bulk_cipher_algorithm_ = triple_des;
+        parms.mac_algorithm_         = rmd;
+        parms.kea_                   = rsa_kea;
+        parms.hash_size_ = RMD_LEN;
+        parms.key_size_  = DES_EDE_KEY_SZ;
+        parms.iv_size_   = DES_IV_SZ;
+        parms.cipher_type_ = block;
+        crypto_.setDigest(new (ys) RMD);
+        crypto_.setCipher(new (ys) DES_EDE);
+        strncpy(parms.cipher_name_,
+               cipher_names[TLS_RSA_WITH_3DES_EDE_CBC_RMD160], MAX_SUITE_NAME);
+        break;
+
+    case TLS_DHE_RSA_WITH_3DES_EDE_CBC_RMD160:
+        parms.bulk_cipher_algorithm_ = triple_des;
+        parms.mac_algorithm_         = rmd;
+        parms.kea_                   = diffie_hellman_kea;
+        parms.sig_algo_              = rsa_sa_algo;
+        parms.hash_size_ = RMD_LEN;
+        parms.key_size_  = DES_EDE_KEY_SZ;
+        parms.iv_size_   = DES_IV_SZ;
+        parms.cipher_type_ = block;
+        secure_.use_connection().send_server_key_  = true; // eph
+        crypto_.setDigest(new (ys) RMD);
+        crypto_.setCipher(new (ys) DES_EDE);
+        strncpy(parms.cipher_name_,
+                cipher_names[TLS_DHE_RSA_WITH_3DES_EDE_CBC_RMD160],
+                MAX_SUITE_NAME);
+        break;
+
+    case TLS_DHE_RSA_WITH_AES_256_CBC_RMD160:
+        parms.bulk_cipher_algorithm_ = aes;
+        parms.mac_algorithm_         = rmd;
+        parms.kea_                   = diffie_hellman_kea;
+        parms.sig_algo_              = rsa_sa_algo;
+        parms.hash_size_ = RMD_LEN;
+        parms.key_size_  = AES_256_KEY_SZ;
+        parms.iv_size_   = AES_BLOCK_SZ;
+        parms.cipher_type_ = block;
+        secure_.use_connection().send_server_key_  = true; // eph
+        crypto_.setDigest(new (ys) RMD);
+        crypto_.setCipher(new (ys) AES(AES_256_KEY_SZ));
+        strncpy(parms.cipher_name_,
+                cipher_names[TLS_DHE_RSA_WITH_AES_256_CBC_RMD160],
+                MAX_SUITE_NAME);
+        break;
+
+    case TLS_DHE_RSA_WITH_AES_128_CBC_RMD160:
+        parms.bulk_cipher_algorithm_ = aes;
+        parms.mac_algorithm_         = rmd;
+        parms.kea_                   = diffie_hellman_kea;
+        parms.sig_algo_              = rsa_sa_algo;
+        parms.hash_size_ = RMD_LEN;
+        parms.key_size_  = AES_128_KEY_SZ;
+        parms.iv_size_   = AES_BLOCK_SZ;
+        parms.cipher_type_ = block;
+        secure_.use_connection().send_server_key_  = true; // eph
+        crypto_.setDigest(new (ys) RMD);
+        crypto_.setCipher(new (ys) AES);
+        strncpy(parms.cipher_name_,
+                cipher_names[TLS_DHE_RSA_WITH_AES_128_CBC_RMD160],
+                MAX_SUITE_NAME);
+        break;
+
+    case TLS_DHE_DSS_WITH_3DES_EDE_CBC_RMD160:
+        parms.bulk_cipher_algorithm_ = triple_des;
+        parms.mac_algorithm_         = rmd;
+        parms.kea_                   = diffie_hellman_kea;
+        parms.sig_algo_              = dsa_sa_algo;
+        parms.hash_size_ = RMD_LEN;
+        parms.key_size_  = DES_EDE_KEY_SZ;
+        parms.iv_size_   = DES_IV_SZ;
+        parms.cipher_type_ = block;
+        secure_.use_connection().send_server_key_  = true; // eph
+        crypto_.setDigest(new (ys) RMD);
+        crypto_.setCipher(new (ys) DES_EDE);
+        strncpy(parms.cipher_name_,
+                cipher_names[TLS_DHE_DSS_WITH_3DES_EDE_CBC_RMD160],
+                MAX_SUITE_NAME);
+        break;
+
+    case TLS_DHE_DSS_WITH_AES_256_CBC_RMD160:
+        parms.bulk_cipher_algorithm_ = aes;
+        parms.mac_algorithm_         = rmd;
+        parms.kea_                   = diffie_hellman_kea;
+        parms.sig_algo_              = dsa_sa_algo;
+        parms.hash_size_ = RMD_LEN;
+        parms.key_size_  = AES_256_KEY_SZ;
+        parms.iv_size_   = AES_BLOCK_SZ;
+        parms.cipher_type_ = block;
+        secure_.use_connection().send_server_key_  = true; // eph
+        crypto_.setDigest(new (ys) RMD);
+        crypto_.setCipher(new (ys) AES(AES_256_KEY_SZ));
+        strncpy(parms.cipher_name_,
+                cipher_names[TLS_DHE_DSS_WITH_AES_256_CBC_RMD160],
+                MAX_SUITE_NAME);
+        break;
+
+    case TLS_DHE_DSS_WITH_AES_128_CBC_RMD160:
+        parms.bulk_cipher_algorithm_ = aes;
+        parms.mac_algorithm_         = rmd;
+        parms.kea_                   = diffie_hellman_kea;
+        parms.sig_algo_              = dsa_sa_algo;
+        parms.hash_size_ = RMD_LEN;
+        parms.key_size_  = AES_128_KEY_SZ;
+        parms.iv_size_   = AES_BLOCK_SZ;
+        parms.cipher_type_ = block;
+        secure_.use_connection().send_server_key_  = true; // eph
+        crypto_.setDigest(new (ys) RMD);
+        crypto_.setCipher(new (ys) AES);
+        strncpy(parms.cipher_name_,
+                cipher_names[TLS_DHE_DSS_WITH_AES_128_CBC_RMD160],
+                MAX_SUITE_NAME);
+        break;
+
+    default:
+        SetError(unknown_cipher);
+    }
+}
+
+
+// store peer's random
+void SSL::set_random(const opaque* random, ConnectionEnd sender)
+{
+    if (sender == client_end)
+        memcpy(secure_.use_connection().client_random_, random, RAN_LEN);
+    else
+        memcpy(secure_.use_connection().server_random_, random, RAN_LEN);
+}
+
+
+// store client pre master secret
+void SSL::set_preMaster(const opaque* pre, uint sz)
+{
+    secure_.use_connection().AllocPreSecret(sz);
+    memcpy(secure_.use_connection().pre_master_secret_, pre, sz);
+}
+
+
+// store master secret
+void SSL::set_masterSecret(const opaque* sec)
+{
+    memcpy(secure_.use_connection().master_secret_, sec, SECRET_LEN);
+}
+
+// store server issued id
+void SSL::set_sessionID(const opaque* sessionID)
+{
+    memcpy(secure_.use_connection().sessionID_, sessionID, ID_LEN);
+}
+
+
+// store error 
+void SSL::SetError(YasslError ye)
+{
+    states_.SetError(ye);
+    //strncpy(states_.useString(), e.what(), mySTL::named_exception::NAME_SIZE);
+    // TODO: add string here
+}
+
+
+// locals
+namespace {
+
+// DeriveKeys and MasterSecret helper sets prefix letters
+static bool setPrefix(opaque* sha_input, int i)
+{
+    switch (i) {
+    case 0:
+        memcpy(sha_input, "A", 1);
+        break;
+    case 1:
+        memcpy(sha_input, "BB", 2);
+        break;
+    case 2:
+        memcpy(sha_input, "CCC", 3);
+        break;
+    case 3:
+        memcpy(sha_input, "DDDD", 4);
+        break;
+    case 4:
+        memcpy(sha_input, "EEEEE", 5);
+        break;
+    case 5:
+        memcpy(sha_input, "FFFFFF", 6);
+        break;
+    case 6:
+        memcpy(sha_input, "GGGGGGG", 7);
+        break;
+    default:
+        return false;  // prefix_error
+    }
+    return true;
+}
+
+
+const char handshake_order[] = "Out of order HandShake Message!";
+
+
+} // namespcae for locals
+
+
+void SSL::order_error()
+{
+    SetError(out_of_order);
+}
+
+
+// Create and store the master secret see page 32, 6.1
+void SSL::makeMasterSecret()
+{
+    if (isTLS())
+        makeTLSMasterSecret();
+    else {
+        opaque sha_output[SHA_LEN];
+
+        const uint& preSz = secure_.get_connection().pre_secret_len_;
+        output_buffer md5_input(preSz + SHA_LEN);
+        output_buffer sha_input(PREFIX + preSz + 2 * RAN_LEN);
+
+        MD5 md5;
+        SHA sha;
+
+        md5_input.write(secure_.get_connection().pre_master_secret_, preSz);
+
+        for (int i = 0; i < MASTER_ROUNDS; ++i) {
+            opaque prefix[PREFIX];
+            if (!setPrefix(prefix, i)) {
+                SetError(prefix_error);
+                return;
+            }
+
+            sha_input.set_current(0);
+            sha_input.write(prefix, i + 1);
+
+            sha_input.write(secure_.get_connection().pre_master_secret_,preSz);
+            sha_input.write(secure_.get_connection().client_random_, RAN_LEN);
+            sha_input.write(secure_.get_connection().server_random_, RAN_LEN);
+            sha.get_digest(sha_output, sha_input.get_buffer(),
+                           sha_input.get_size());
+
+            md5_input.set_current(preSz);
+            md5_input.write(sha_output, SHA_LEN);
+            md5.get_digest(&secure_.use_connection().master_secret_[i*MD5_LEN],
+                           md5_input.get_buffer(), md5_input.get_size());
+        }
+        deriveKeys();
+    }
+    secure_.use_connection().CleanPreMaster();
+}
+
+
+// create TLSv1 master secret
+void SSL::makeTLSMasterSecret()
+{
+    opaque seed[SEED_LEN];
+    
+    memcpy(seed, secure_.get_connection().client_random_, RAN_LEN);
+    memcpy(&seed[RAN_LEN], secure_.get_connection().server_random_, RAN_LEN);
+
+    PRF(secure_.use_connection().master_secret_, SECRET_LEN,
+        secure_.get_connection().pre_master_secret_,
+        secure_.get_connection().pre_secret_len_,
+        master_label, MASTER_LABEL_SZ, 
+        seed, SEED_LEN);
+
+    deriveTLSKeys();
+}
+
+
+// derive mac, write, and iv keys for server and client, see page 34, 6.2.2
+void SSL::deriveKeys()
+{
+    int length = 2 * secure_.get_parms().hash_size_ + 
+                 2 * secure_.get_parms().key_size_  +
+                 2 * secure_.get_parms().iv_size_;
+    int rounds = length / MD5_LEN + ((length % MD5_LEN) ? 1 : 0);
+    input_buffer key_data(rounds * MD5_LEN);
+
+    opaque sha_output[SHA_LEN];
+    opaque md5_input[SECRET_LEN + SHA_LEN];
+    opaque sha_input[KEY_PREFIX + SECRET_LEN + 2 * RAN_LEN];
+  
+    MD5 md5;
+    SHA sha;
+
+    memcpy(md5_input, secure_.get_connection().master_secret_, SECRET_LEN);
+
+    for (int i = 0; i < rounds; ++i) {
+        int j = i + 1;
+        if (!setPrefix(sha_input, i)) {
+            SetError(prefix_error);
+            return;
+        }
+
+        memcpy(&sha_input[j], secure_.get_connection().master_secret_,
+               SECRET_LEN);
+        memcpy(&sha_input[j+SECRET_LEN],
+               secure_.get_connection().server_random_, RAN_LEN);
+        memcpy(&sha_input[j + SECRET_LEN + RAN_LEN],
+               secure_.get_connection().client_random_, RAN_LEN);
+        sha.get_digest(sha_output, sha_input,
+                       sizeof(sha_input) - KEY_PREFIX + j);
+
+        memcpy(&md5_input[SECRET_LEN], sha_output, SHA_LEN);
+        md5.get_digest(key_data.get_buffer() + i * MD5_LEN,
+                       md5_input, sizeof(md5_input));
+    }
+    storeKeys(key_data.get_buffer());
+}
+
+
+// derive mac, write, and iv keys for server and client
+void SSL::deriveTLSKeys()
+{
+    int length = 2 * secure_.get_parms().hash_size_ + 
+                 2 * secure_.get_parms().key_size_  +
+                 2 * secure_.get_parms().iv_size_;
+    opaque       seed[SEED_LEN];
+    input_buffer key_data(length);
+
+    memcpy(seed, secure_.get_connection().server_random_, RAN_LEN);
+    memcpy(&seed[RAN_LEN], secure_.get_connection().client_random_, RAN_LEN);
+
+    PRF(key_data.get_buffer(), length, secure_.get_connection().master_secret_,
+        SECRET_LEN, key_label, KEY_LABEL_SZ, seed, SEED_LEN);
+
+    storeKeys(key_data.get_buffer());
+}
+
+
+// store mac, write, and iv keys for client and server
+void SSL::storeKeys(const opaque* key_data)
+{
+    int sz = secure_.get_parms().hash_size_;
+    memcpy(secure_.use_connection().client_write_MAC_secret_, key_data, sz);
+    int i = sz;
+    memcpy(secure_.use_connection().server_write_MAC_secret_,&key_data[i], sz);
+    i += sz;
+
+    sz = secure_.get_parms().key_size_;
+    memcpy(secure_.use_connection().client_write_key_, &key_data[i], sz);
+    i += sz;
+    memcpy(secure_.use_connection().server_write_key_, &key_data[i], sz);
+    i += sz;
+
+    sz = secure_.get_parms().iv_size_;
+    memcpy(secure_.use_connection().client_write_IV_, &key_data[i], sz);
+    i += sz;
+    memcpy(secure_.use_connection().server_write_IV_, &key_data[i], sz);
+
+    setKeys();
+}
+
+
+// set encrypt/decrypt keys and ivs
+void SSL::setKeys()
+{
+    Connection& conn = secure_.use_connection();
+
+    if (secure_.get_parms().entity_ == client_end) {
+        crypto_.use_cipher().set_encryptKey(conn.client_write_key_, 
+                                            conn.client_write_IV_);
+        crypto_.use_cipher().set_decryptKey(conn.server_write_key_,
+                                            conn.server_write_IV_);
+    }
+    else {
+        crypto_.use_cipher().set_encryptKey(conn.server_write_key_,
+                                            conn.server_write_IV_);
+        crypto_.use_cipher().set_decryptKey(conn.client_write_key_,
+                                            conn.client_write_IV_);
+    }
+}
+
+
+
+// local functors
+namespace {
+
+struct SumData {
+    uint total_;
+    SumData() : total_(0) {}
+    void operator()(input_buffer* data) { total_ += data->get_remaining(); }
+};
+
+
+struct SumBuffer {
+    uint total_;
+    SumBuffer() : total_(0) {}
+    void operator()(output_buffer* buffer) { total_ += buffer->get_size(); }
+};
+
+} // namespace for locals
+
+
+uint SSL::bufferedData()
+{
+    return mySTL::for_each(buffers_.getData().begin(),buffers_.getData().end(),
+                           SumData()).total_;
+}
+
+
+// use input buffer to fill data
+void SSL::fillData(Data& data)
+{
+    if (GetError()) return;
+    uint dataSz   = data.get_length();        // input, data size to fill
+    uint elements = buffers_.getData().size();
+
+    data.set_length(0);                         // output, actual data filled
+    dataSz = min(dataSz, bufferedData());
+
+    for (uint i = 0; i < elements; i++) {
+        input_buffer* front = buffers_.getData().front();
+        uint frontSz = front->get_remaining();
+        uint readSz  = min(dataSz - data.get_length(), frontSz);
+
+        front->read(data.set_buffer() + data.get_length(), readSz);
+        data.set_length(data.get_length() + readSz);
+
+        if (readSz == frontSz) {
+            buffers_.useData().pop_front();
+            delete front;
+        }
+        if (data.get_length() == dataSz)
+            break;
+    }
+}
+
+
+// flush output buffer
+void SSL::flushBuffer()
+{
+    if (GetError()) return;
+
+    uint sz = mySTL::for_each(buffers_.getHandShake().begin(),
+                            buffers_.getHandShake().end(),
+                            SumBuffer()).total_;
+    output_buffer out(sz);
+    uint elements = buffers_.getHandShake().size();
+
+    for (uint i = 0; i < elements; i++) {
+        output_buffer* front = buffers_.getHandShake().front();
+        out.write(front->get_buffer(), front->get_size());
+
+        buffers_.useHandShake().pop_front();
+        delete front;
+    }
+    Send(out.get_buffer(), out.get_size());
+}
+
+
+void SSL::Send(const byte* buffer, uint sz)
+{
+    if (socket_.send(buffer, sz) != sz)
+        SetError(send_error);
+}
+
+
+// get sequence number, if verify get peer's
+uint SSL::get_SEQIncrement(bool verify) 
+{ 
+    if (verify)
+        return secure_.use_connection().peer_sequence_number_++; 
+    else
+        return secure_.use_connection().sequence_number_++; 
+}
+
+
+const byte* SSL::get_macSecret(bool verify)
+{
+    if ( (secure_.get_parms().entity_ == client_end && !verify) ||
+         (secure_.get_parms().entity_ == server_end &&  verify) )
+        return secure_.get_connection().client_write_MAC_secret_;
+    else
+        return secure_.get_connection().server_write_MAC_secret_;
+}
+
+
+void SSL::verifyState(const RecordLayerHeader& rlHeader)
+{
+    if (GetError()) return;
+
+    if (states_.getRecord() == recordNotReady || 
+            (rlHeader.type_ == application_data &&        // data and handshake
+             states_.getHandShake() != handShakeReady) )  // isn't complete yet
+              SetError(record_layer);
+}
+
+
+void SSL::verifyState(const HandShakeHeader& hsHeader)
+{
+    if (GetError()) return;
+
+    if (states_.getHandShake() == handShakeNotReady) {
+        SetError(handshake_layer);
+        return;
+    }
+
+    if (secure_.get_parms().entity_ == client_end)
+        verifyClientState(hsHeader.get_handshakeType());
+    else
+        verifyServerState(hsHeader.get_handshakeType());
+}
+
+
+void SSL::verifyState(ClientState cs)
+{
+    if (GetError()) return;
+    if (states_.getClient() != cs) order_error();
+}
+
+
+void SSL::verifyState(ServerState ss)
+{
+    if (GetError()) return;
+    if (states_.getServer() != ss) order_error();
+}
+
+
+void SSL::verfiyHandShakeComplete()
+{
+    if (GetError()) return;
+    if (states_.getHandShake() != handShakeReady) order_error();
+}
+
+
+void SSL::verifyClientState(HandShakeType hsType)
+{
+    if (GetError()) return;
+
+    switch(hsType) {
+    case server_hello :
+        if (states_.getClient() != serverNull)
+            order_error();
+        break;
+    case certificate :
+        if (states_.getClient() != serverHelloComplete)
+            order_error();
+        break;
+    case server_key_exchange :
+        if (states_.getClient() != serverCertComplete)
+            order_error();
+        break;
+    case certificate_request :
+        if (states_.getClient() != serverCertComplete &&
+            states_.getClient() != serverKeyExchangeComplete)
+            order_error();
+        break;
+    case server_hello_done :
+        if (states_.getClient() != serverCertComplete &&
+            states_.getClient() != serverKeyExchangeComplete)
+            order_error();
+        break;
+    case finished :
+        if (states_.getClient() != serverHelloDoneComplete || 
+            secure_.get_parms().pending_)    // no change
+                order_error();          // cipher yet
+        break;
+    default :
+        order_error();
+    };
+}
+
+
+void SSL::verifyServerState(HandShakeType hsType)
+{
+    if (GetError()) return;
+
+    switch(hsType) {
+    case client_hello :
+        if (states_.getServer() != clientNull)
+            order_error();
+        break;
+    case certificate :
+        if (states_.getServer() != clientHelloComplete)
+            order_error();
+        break;
+    case client_key_exchange :
+        if (states_.getServer() != clientHelloComplete)
+            order_error();
+        break;
+    case certificate_verify :
+        if (states_.getServer() != clientKeyExchangeComplete)
+            order_error();
+        break;
+    case finished :
+        if (states_.getServer() != clientKeyExchangeComplete || 
+            secure_.get_parms().pending_)    // no change
+                order_error();               // cipher yet
+        break;
+    default :
+        order_error();
+    };
+}
+
+
+// try to find a suite match
+void SSL::matchSuite(const opaque* peer, uint length)
+{
+    if (length == 0 || (length % 2) != 0) {
+        SetError(bad_input);
+        return;
+    }
+
+    // start with best, if a match we are good, Ciphers are at odd index
+    // since all SSL and TLS ciphers have 0x00 first byte
+    for (uint i = 1; i < secure_.get_parms().suites_size_; i += 2)
+        for (uint j = 1; j < length; j+= 2)
+            if (secure_.use_parms().suites_[i] == peer[j]) {
+                secure_.use_parms().suite_[0] = 0x00;
+                secure_.use_parms().suite_[1] = peer[j];
+                return;
+            }
+
+    SetError(match_error);
+}
+
+
+void SSL::set_session(SSL_SESSION* s) 
+{ 
+    if (s && GetSessions().lookup(s->GetID(), &secure_.use_resume()))
+        secure_.set_resuming(true);
+}
+
+
+const Crypto& SSL::getCrypto() const
+{
+    return crypto_;
+}
+
+
+const Security& SSL::getSecurity() const
+{
+    return secure_;
+}
+
+
+const States& SSL::getStates() const
+{
+    return states_;
+}
+
+
+const sslHashes& SSL::getHashes() const
+{
+    return hashes_;
+}
+
+
+const sslFactory& SSL::getFactory() const
+{
+    return GetSSL_Factory();
+}
+
+
+const Socket& SSL::getSocket() const
+{
+    return socket_;
+}
+
+
+YasslError SSL::GetError() const
+{
+    return states_.What();
+}
+
+
+Crypto& SSL::useCrypto()
+{
+    return crypto_;
+}
+
+
+Security& SSL::useSecurity()
+{
+    return secure_;
+}
+
+
+States& SSL::useStates()
+{
+    return states_;
+}
+
+
+sslHashes& SSL::useHashes()
+{
+    return hashes_;
+}
+
+
+Socket& SSL::useSocket()
+{
+    return socket_;
+}
+
+
+Log& SSL::useLog()
+{
+    return log_;
+}
+
+
+bool SSL::isTLS() const
+{
+    return secure_.get_connection().TLS_;
+}
+
+
+void SSL::addData(input_buffer* data)
+{
+    buffers_.useData().push_back(data);
+}
+
+
+void SSL::addBuffer(output_buffer* b)
+{
+    buffers_.useHandShake().push_back(b);
+}
+
+
+// store connection parameters
+SSL_SESSION::SSL_SESSION(const SSL& ssl, RandomPool& ran) 
+    : timeout_(DEFAULT_TIMEOUT), random_(ran)
+{
+    const Connection& conn = ssl.getSecurity().get_connection();
+
+    memcpy(sessionID_, conn.sessionID_, ID_LEN);
+    memcpy(master_secret_, conn.master_secret_, SECRET_LEN);
+    memcpy(suite_, ssl.getSecurity().get_parms().suite_, SUITE_LEN);
+
+    bornOn_ = lowResTimer();
+}
+
+
+// for resumption copy in ssl::parameters
+SSL_SESSION::SSL_SESSION(RandomPool& ran) 
+    : bornOn_(0), timeout_(0), random_(ran)
+{
+    memset(sessionID_, 0, ID_LEN);
+    memset(master_secret_, 0, SECRET_LEN);
+    memset(suite_, 0, SUITE_LEN);
+}
+
+
+SSL_SESSION& SSL_SESSION::operator=(const SSL_SESSION& that)
+{
+    memcpy(sessionID_, that.sessionID_, ID_LEN);
+    memcpy(master_secret_, that.master_secret_, SECRET_LEN);
+    memcpy(suite_, that.suite_, SUITE_LEN);
+    
+    bornOn_  = that.bornOn_;
+    timeout_ = that.timeout_;
+
+    return *this;
+}
+
+
+const opaque* SSL_SESSION::GetID() const
+{
+    return sessionID_;
+}
+
+
+const opaque* SSL_SESSION::GetSecret() const
+{
+    return master_secret_;
+}
+
+
+const Cipher* SSL_SESSION::GetSuite() const
+{
+    return suite_;
+}
+
+
+uint SSL_SESSION::GetBornOn() const
+{
+    return bornOn_;
+}
+
+
+uint SSL_SESSION::GetTimeOut() const
+{
+    return timeout_;
+}
+
+
+void SSL_SESSION::SetTimeOut(uint t)
+{
+    timeout_ = t;
+}
+
+
+extern void clean(volatile opaque*, uint, RandomPool&);
+
+
+// clean up secret data
+SSL_SESSION::~SSL_SESSION()
+{
+    volatile opaque* p = master_secret_;
+    clean(p, SECRET_LEN, random_);
+}
+
+
+Sessions& GetSessions()
+{
+    static Sessions instance; // simple singleton
+    return instance;
+}
+
+
+sslFactory& GetSSL_Factory()
+{   
+    static sslFactory instance; // simple singleton
+    return instance;
+}
+
+
+typedef Mutex::Lock Lock;
+
+ 
+void Sessions::add(const SSL& ssl) 
+{
+    Lock guard(mutex_);
+    list_.push_back(new (ys) SSL_SESSION(ssl, random_));
+}
+
+
+Sessions::~Sessions() 
+{ 
+    mySTL::for_each(list_.begin(), list_.end(), del_ptr_zero()); 
+}
+
+
+namespace { // locals
+
+typedef mySTL::list<SSL_SESSION*>::iterator iterator;
+
+struct sess_match {
+    const opaque* id_;
+    explicit sess_match(const opaque* p) : id_(p) {}
+
+    bool operator()(SSL_SESSION* sess)
+    {
+        if ( memcmp(sess->GetID(), id_, ID_LEN) == 0)
+            return true;
+        return false;
+    }
+};
+
+
+} // local namespace
+
+
+// lookup session by id, return a copy if space provided
+SSL_SESSION* Sessions::lookup(const opaque* id, SSL_SESSION* copy)
+{
+    Lock guard(mutex_);
+    iterator find = mySTL::find_if(list_.begin(), list_.end(), sess_match(id));
+
+    if (find != list_.end()) {
+        uint current = lowResTimer();
+        if ( ((*find)->GetBornOn() + (*find)->GetTimeOut()) < current) {
+            del_ptr_zero()(*find);
+            list_.erase(find);
+            return 0;
+        }
+        if (copy)
+            *copy = *(*find);
+        return *find;
+    }
+    return 0;
+}
+
+
+// remove a session by id
+void Sessions::remove(const opaque* id)
+{
+    Lock guard(mutex_);
+    iterator find = mySTL::find_if(list_.begin(), list_.end(), sess_match(id));
+
+    if (find != list_.end()) {
+        del_ptr_zero()(*find);
+        list_.erase(find);
+    }
+}
+
+
+SSL_METHOD::SSL_METHOD(ConnectionEnd ce, ProtocolVersion pv) 
+    : version_(pv), side_(ce), verifyPeer_(false), failNoCert_(false) 
+{}
+
+
+ProtocolVersion SSL_METHOD::getVersion() const
+{
+    return version_;
+}
+
+
+ConnectionEnd SSL_METHOD::getSide() const
+{
+    return side_;
+}
+
+
+void SSL_METHOD::setVerifyPeer()
+{
+    verifyPeer_ = true;
+}
+
+
+void SSL_METHOD::setFailNoCert()
+{
+    failNoCert_ = true;
+}
+
+
+bool SSL_METHOD::verifyPeer() const
+{
+    return verifyPeer_;
+}
+
+
+bool SSL_METHOD::failNoCert() const
+{
+    return failNoCert_;
+}
+
+
+SSL_CTX::SSL_CTX(SSL_METHOD* meth) 
+    : method_(meth), certificate_(0), privateKey_(0)
+{}
+
+
+SSL_CTX::~SSL_CTX()
+{
+    delete method_;
+    delete certificate_;
+    delete privateKey_;
+
+    mySTL::for_each(caList_.begin(), caList_.end(), del_ptr_zero());
+}
+
+
+void SSL_CTX::AddCA(x509* ca)
+{
+    caList_.push_back(ca);
+}
+
+
+const SSL_CTX::CertList& 
+SSL_CTX::GetCA_List() const
+{
+    return caList_;
+}
+
+
+const x509* SSL_CTX::getCert() const
+{
+    return certificate_;
+}
+
+
+const x509* SSL_CTX::getKey() const
+{
+    return privateKey_;
+}
+
+
+const SSL_METHOD* SSL_CTX::getMethod() const
+{
+    return method_;
+}
+
+
+const Ciphers& SSL_CTX::GetCiphers() const
+{
+    return ciphers_;
+}
+
+
+const DH_Parms& SSL_CTX::GetDH_Parms() const
+{
+    return dhParms_;
+}
+
+
+const Stats& SSL_CTX::GetStats() const
+{
+    return stats_;
+}
+
+
+void SSL_CTX::setVerifyPeer()
+{
+    method_->setVerifyPeer();
+}
+
+
+void SSL_CTX::setFailNoCert()
+{
+    method_->setFailNoCert();
+}
+
+
+bool SSL_CTX::SetDH(const DH& dh)
+{
+    dhParms_.p_ = dh.p->int_;
+    dhParms_.g_ = dh.g->int_;
+
+    return dhParms_.set_ = true;
+}
+
+
+bool SSL_CTX::SetCipherList(const char* list)
+{
+    if (!list)
+        return false;
+
+    bool ret = false;
+    char name[MAX_SUITE_NAME];
+
+    char  needle[] = ":";
+    char* haystack = const_cast<char*>(list);
+    char* prev;
+
+    const int suiteSz = sizeof(cipher_names) / sizeof(cipher_names[0]);
+    int idx = 0;
+
+    for(;;) {
+        int len;
+        prev = haystack;
+        haystack = strstr(haystack, needle);
+
+        if (!haystack)    // last cipher
+            len = min(sizeof(name), strlen(prev));
+        else
+            len = min(sizeof(name), (size_t)(haystack - prev));
+
+        strncpy(name, prev, len);
+        name[(len == sizeof(name)) ? len - 1 : len] = 0;
+
+        for (int i = 0; i < suiteSz; i++)
+            if (strncmp(name, cipher_names[i], sizeof(name)) == 0) {
+
+                ciphers_.suites_[idx++] = 0x00;  // first byte always zero
+                ciphers_.suites_[idx++] = i;
+
+                if (!ret) ret = true;   // found at least one
+                break;
+            }
+        if (!haystack) break;
+        haystack++;
+    }
+
+    if (ret) {
+        ciphers_.setSuites_ = true;
+        ciphers_.suiteSz_ = idx;
+    }
+
+    return ret;
+}
+
+
+void SSL_CTX::IncrementStats(StatsField fd)
+{
+
+    Lock guard(mutex_);
+    
+    switch (fd) {
+
+	case Accept:
+        ++stats_.accept_;
+        break;
+
+    case Connect:
+        ++stats_.connect_;
+        break;
+
+    case AcceptGood:
+        ++stats_.acceptGood_;
+        break;
+
+    case ConnectGood:
+        ++stats_.connectGood_;
+        break;
+
+    case AcceptRenegotiate:
+        ++stats_.acceptRenegotiate_;
+        break;
+
+    case ConnectRenegotiate:
+        ++stats_.connectRenegotiate_;
+        break;
+
+    case Hits:
+        ++stats_.hits_;
+        break;
+
+    case CbHits:
+        ++stats_.cbHits_;
+        break;
+
+    case CacheFull:
+        ++stats_.cacheFull_;
+        break;
+
+    case Misses:
+        ++stats_.misses_;
+        break;
+
+    case Timeouts:
+        ++stats_.timeouts_;
+        break;
+
+    case Number:
+        ++stats_.number_;
+        break;
+
+    case GetCacheSize:
+        ++stats_.getCacheSize_;
+        break;
+
+    case VerifyMode:
+        ++stats_.verifyMode_;
+        break;
+
+    case VerifyDepth:
+        ++stats_.verifyDepth_;
+        break;
+
+    default:
+        break;
+    }
+}
+
+
+Crypto::Crypto() 
+    : digest_(0), cipher_(0), dh_(0) 
+{}
+
+
+Crypto::~Crypto()
+{
+    delete dh_;
+    delete cipher_;
+    delete digest_;
+}
+
+
+const Digest& Crypto::get_digest() const
+{
+    return *digest_;
+}
+
+
+const BulkCipher& Crypto::get_cipher() const
+{
+    return *cipher_;
+}
+
+
+const DiffieHellman& Crypto::get_dh() const
+{
+    return *dh_;
+}
+
+
+const RandomPool& Crypto::get_random() const
+{
+    return random_;
+}
+
+
+const CertManager& Crypto::get_certManager() const
+{
+    return cert_;
+}
+
+
+      
+Digest& Crypto::use_digest()
+{
+    return *digest_;
+}
+
+
+BulkCipher& Crypto::use_cipher()
+{
+    return *cipher_;
+}
+
+
+DiffieHellman& Crypto::use_dh()
+{
+    return *dh_;
+}
+
+
+RandomPool& Crypto::use_random()
+{
+    return random_;
+}
+
+
+CertManager& Crypto::use_certManager()
+{
+    return cert_;
+}
+
+
+
+void Crypto::SetDH(DiffieHellman* dh)
+{
+    dh_ = dh;
+}
+
+
+void Crypto::SetDH(const DH_Parms& dh)
+{
+    if (dh.set_)
+        dh_ = new (ys) DiffieHellman(dh.p_, dh.g_, random_);
+}
+
+
+bool Crypto::DhSet()
+{
+    return dh_ != 0;
+}
+
+
+void Crypto::setDigest(Digest* digest)
+{
+    digest_ = digest;
+}
+
+
+void Crypto::setCipher(BulkCipher* c)
+{
+    cipher_ = c;
+}
+
+
+const MD5& sslHashes::get_MD5() const
+{
+    return md5HandShake_;
+}
+
+
+const SHA& sslHashes::get_SHA() const
+{
+    return shaHandShake_;
+}
+
+
+const Finished& sslHashes::get_verify() const
+{
+    return verify_;
+}
+
+
+const Hashes& sslHashes::get_certVerify() const
+{
+    return certVerify_;
+}
+
+
+MD5& sslHashes::use_MD5(){
+    return md5HandShake_;
+}
+
+
+SHA& sslHashes::use_SHA()
+{
+    return shaHandShake_;
+}
+
+
+Finished& sslHashes::use_verify()
+{
+    return verify_;
+}
+
+
+Hashes& sslHashes::use_certVerify()
+{
+    return certVerify_;
+}
+
+
+Buffers::~Buffers()
+{
+    mySTL::for_each(handShakeList_.begin(), handShakeList_.end(),
+                  del_ptr_zero()) ;
+    mySTL::for_each(dataList_.begin(), dataList_.end(),
+                  del_ptr_zero()) ;
+}
+
+
+const Buffers::inputList& Buffers::getData() const
+{
+    return dataList_;
+}
+
+
+const Buffers::outputList& Buffers::getHandShake() const
+{
+    return handShakeList_;
+}
+
+
+Buffers::inputList& Buffers::useData()
+{
+    return dataList_;
+}
+
+
+Buffers::outputList& Buffers::useHandShake()
+{
+    return handShakeList_;
+}
+
+
+Security::Security(ProtocolVersion pv, RandomPool& ran, ConnectionEnd ce,
+                   const Ciphers& ciphers, SSL_CTX* ctx)
+   : conn_(pv, ran), parms_(ce, ciphers, pv), resumeSession_(ran), ctx_(ctx),
+     resuming_(false)
+{}
+
+
+const Connection& Security::get_connection() const
+{
+    return conn_;
+}
+
+
+const SSL_CTX* Security::GetContext() const
+{
+    return ctx_;
+}
+
+
+const Parameters& Security::get_parms() const
+{
+    return parms_;
+}
+
+
+const SSL_SESSION& Security::get_resume() const
+{
+    return resumeSession_;
+}
+
+
+bool Security::get_resuming() const
+{
+    return resuming_;
+}
+
+
+Connection& Security::use_connection()
+{
+    return conn_;
+}
+
+
+Parameters& Security::use_parms()
+{
+    return parms_;
+}
+
+
+SSL_SESSION& Security::use_resume()
+{
+    return resumeSession_;
+}
+
+
+void Security::set_resuming(bool b)
+{
+    resuming_ = b;
+}
+
+
+X509_NAME::X509_NAME(const char* n, size_t sz)
+    : name_(0)
+{
+    if (sz) {
+        name_ = new (ys) char[sz];
+        memcpy(name_, n, sz);
+    }
+}
+
+
+X509_NAME::~X509_NAME()
+{
+    delete[] name_;
+}
+
+
+char* X509_NAME::GetName()
+{
+    return name_;
+}
+
+
+X509::X509(const char* i, size_t iSz, const char* s, size_t sSz)
+    : issuer_(i, iSz), subject_(s, sSz)
+{}
+   
+
+X509_NAME* X509::GetIssuer()
+{
+    return &issuer_;
+}
+
+
+X509_NAME* X509::GetSubject()
+{
+    return &subject_;
+}
+
+
+
+
+} // namespace