110 files changed, 36431 insertions, 0 deletions

diff --git a/src/daemon/https/tls/Makefile.am b/src/daemon/https/tls/Makefile.am
new file mode 100644
index 00000000..309080ea
--- /dev/null
+++ b/src/daemon/https/tls/Makefile.am
@@ -0,0 +1,73 @@
+SUBDIRS = .
+
+AM_CPPFLAGS = \
+-I$(top_srcdir)/src/daemon/https/includes \
+-I$(top_srcdir)/src/daemon/https/lgl \
+-I$(top_srcdir)/src/daemon/https/x509 \
+-I$(top_srcdir)/src/daemon/https/tls \
+-I$(top_srcdir)/src/daemon/https/openpgp \
+-I$(top_srcdir)/src/daemon/https/opencdk \
+-I$(GCRYPT_CPPFLAGS)
+
+noinst_LTLIBRARIES = libtls.la
+
+libtls_la_LDFLAGS = \
+ -L$(GCRYPT_LIB_PATH)
+ 
+libtls_la_SOURCES = \
+auth_anon.c \
+auth_cert.c \
+auth_dh_common.c \
+auth_dhe.c \
+auth_rsa.c \
+auth_rsa_export.c \
+debug.c \
+ext_cert_type.c \
+ext_inner_application.c \
+ext_max_record.c \
+ext_oprfi.c \
+ext_server_name.c \
+gnutls_alert.c \
+gnutls_algorithms.c \
+gnutls_anon_cred.c \
+gnutls_asn1_tab.c \
+gnutls_auth.c \
+gnutls_buffers.c \
+gnutls_cert.c \
+gnutls_cipher.c \
+gnutls_cipher_int.c \
+gnutls_compress.c \
+gnutls_compress_int.c \
+gnutls_constate.c \
+gnutls_datum.c \
+gnutls_db.c \
+gnutls_dh.c \
+gnutls_dh_primes.c \
+gnutls_errors.c \
+gnutls_extensions.c \
+gnutls_extra_hooks.c \
+gnutls_global.c \
+gnutls_handshake.c \
+gnutls_hash_int.c \
+gnutls_kx.c \
+gnutls_mem.c \
+gnutls_mpi.c \
+gnutls_num.c \
+gnutls_pk.c \
+gnutls_priority.c \
+gnutls_record.c \
+gnutls_rsa_export.c \
+gnutls_session.c \
+gnutls_session_pack.c \
+gnutls_sig.c \
+gnutls_state.c \
+gnutls_str.c \
+gnutls_supplemental.c \
+gnutls_ui.c \
+gnutls_v2_compat.c \
+gnutls_x509.c \
+pkix_asn1_tab.c \
+x509_b64.c
+
+# gnutlsxx.cpp
+
diff --git a/src/daemon/https/tls/auth_anon.c b/src/daemon/https/tls/auth_anon.c
new file mode 100644
index 00000000..18cad200
--- /dev/null
+++ b/src/daemon/https/tls/auth_anon.c
@@ -0,0 +1,178 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* This file contains the Anonymous Diffie Hellman key exchange part of
+ * the anonymous authentication. The functions here are used in the
+ * handshake.
+ */
+
+#include <gnutls_int.h>
+
+#ifdef ENABLE_ANON
+
+#include "gnutls_auth_int.h"
+#include "gnutls_errors.h"
+#include "gnutls_dh.h"
+#include "auth_anon.h"
+#include "gnutls_num.h"
+#include "gnutls_mpi.h"
+#include <gnutls_state.h>
+#include <auth_dh_common.h>
+
+static int gen_anon_server_kx (gnutls_session_t, opaque **);
+static int proc_anon_client_kx (gnutls_session_t, opaque *, size_t);
+static int proc_anon_server_kx (gnutls_session_t, opaque *, size_t);
+
+const mod_auth_st anon_auth_struct = {
+  "ANON",
+  NULL,
+  NULL,
+  gen_anon_server_kx,
+  _gnutls_gen_dh_common_client_kx,      /* this can be shared */
+  NULL,
+  NULL,
+
+  NULL,
+  NULL,                         /* certificate */
+  proc_anon_server_kx,
+  proc_anon_client_kx,
+  NULL,
+  NULL
+};
+
+static int
+gen_anon_server_kx (gnutls_session_t session, opaque ** data)
+{
+  mpi_t g, p;
+  const mpi_t *mpis;
+  int ret;
+  gnutls_dh_params_t dh_params;
+  gnutls_anon_server_credentials_t cred;
+
+  cred = (gnutls_anon_server_credentials_t)
+    _gnutls_get_cred (session->key, GNUTLS_CRD_ANON, NULL);
+  if (cred == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
+    }
+
+  dh_params =
+    _gnutls_get_dh_params (cred->dh_params, cred->params_func, session);
+  mpis = _gnutls_dh_params_to_mpi (dh_params);
+  if (mpis == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_NO_TEMPORARY_DH_PARAMS;
+    }
+
+  p = mpis[0];
+  g = mpis[1];
+
+  if ((ret =
+       _gnutls_auth_info_set (session, GNUTLS_CRD_ANON,
+                              sizeof (anon_auth_info_st), 1)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  _gnutls_dh_set_group (session, g, p);
+
+  ret = _gnutls_dh_common_print_server_kx (session, g, p, data, 0);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+    }
+
+  return ret;
+}
+
+
+static int
+proc_anon_client_kx (gnutls_session_t session, opaque * data,
+                     size_t _data_size)
+{
+  gnutls_anon_server_credentials_t cred;
+  int bits;
+  int ret;
+  mpi_t p, g;
+  gnutls_dh_params_t dh_params;
+  const mpi_t *mpis;
+
+  bits = _gnutls_dh_get_allowed_prime_bits (session);
+
+  cred = (gnutls_anon_server_credentials_t)
+    _gnutls_get_cred (session->key, GNUTLS_CRD_ANON, NULL);
+  if (cred == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
+    }
+
+  dh_params =
+    _gnutls_get_dh_params (cred->dh_params, cred->params_func, session);
+  mpis = _gnutls_dh_params_to_mpi (dh_params);
+  if (mpis == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_NO_TEMPORARY_DH_PARAMS;
+    }
+
+  p = mpis[0];
+  g = mpis[1];
+
+  ret = _gnutls_proc_dh_common_client_kx (session, data, _data_size, g, p);
+
+  return ret;
+
+}
+
+int
+proc_anon_server_kx (gnutls_session_t session, opaque * data,
+                     size_t _data_size)
+{
+
+  int ret;
+
+  /* set auth_info */
+  if ((ret =
+       _gnutls_auth_info_set (session, GNUTLS_CRD_ANON,
+                              sizeof (anon_auth_info_st), 1)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  ret = _gnutls_proc_dh_common_server_kx (session, data, _data_size, 0);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return 0;
+}
+
+#endif /* ENABLE_ANON */
diff --git a/src/daemon/https/tls/auth_anon.h b/src/daemon/https/tls/auth_anon.h
new file mode 100644
index 00000000..b1705f85
--- /dev/null
+++ b/src/daemon/https/tls/auth_anon.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* this is not to be included by gnutls_anon.c */
+#include <gnutls_auth.h>
+#include <auth_dh_common.h>
+
+typedef struct gnutls_anon_server_credentials_st
+{
+  gnutls_dh_params_t dh_params;
+  /* this callback is used to retrieve the DH or RSA
+   * parameters.
+   */
+  gnutls_params_function *params_func;
+} anon_server_credentials_st;
+
+typedef struct gnutls_anon_client_credentials_st
+{
+  int dummy;
+} anon_client_credentials_st;
+
+typedef struct anon_auth_info_st
+{
+  dh_info_st dh;
+} *anon_auth_info_t;
+
+typedef struct anon_auth_info_st anon_auth_info_st;
diff --git a/src/daemon/https/tls/auth_cert.c b/src/daemon/https/tls/auth_cert.c
new file mode 100644
index 00000000..43dcb777
--- /dev/null
+++ b/src/daemon/https/tls/auth_cert.c
@@ -0,0 +1,1781 @@
+/*
+ * Copyright (C) 2001, 2002, 2003, 2004, 2005, 2006, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* The certificate authentication functions which are needed in the handshake,
+ * and are common to RSA and DHE key exchange, are in this file.
+ */
+
+#include <gnutls_int.h>
+#include "gnutls_auth_int.h"
+#include "gnutls_errors.h"
+#include <gnutls_cert.h>
+#include <auth_cert.h>
+#include "gnutls_dh.h"
+#include "gnutls_num.h"
+#include "libtasn1.h"
+#include "gnutls_datum.h"
+#include <gnutls_pk.h>
+#include <gnutls_algorithms.h>
+#include <gnutls_global.h>
+#include <gnutls_record.h>
+#include <gnutls_sig.h>
+#include <gnutls_state.h>
+#include <gnutls_pk.h>
+#include <gnutls_x509.h>
+#include <gnutls_extra_hooks.h>
+#include "debug.h"
+
+static gnutls_cert *alloc_and_load_x509_certs (gnutls_x509_crt_t * certs,
+                                               unsigned);
+static gnutls_privkey *alloc_and_load_x509_key (gnutls_x509_privkey_t key);
+static gnutls_cert *alloc_and_load_pgp_certs (gnutls_openpgp_crt_t cert);
+static gnutls_privkey *alloc_and_load_pgp_key (const gnutls_openpgp_privkey_t
+                                               key);
+
+
+/* Copies data from a internal certificate struct (gnutls_cert) to 
+ * exported certificate struct (cert_auth_info_t)
+ */
+static int
+_gnutls_copy_certificate_auth_info (cert_auth_info_t info,
+                                    gnutls_cert * cert, int ncerts)
+{
+  /* Copy peer's information to auth_info_t
+   */
+  int ret, i, j;
+
+  if (ncerts == 0)
+    {
+      info->raw_certificate_list = NULL;
+      info->ncerts = 0;
+      return 0;
+    }
+
+  info->raw_certificate_list =
+    gnutls_calloc (1, sizeof (gnutls_datum_t) * ncerts);
+  if (info->raw_certificate_list == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  for (i = 0; i < ncerts; i++)
+    {
+      if (cert->raw.size > 0)
+        {
+          ret =
+            _gnutls_set_datum (&info->
+                               raw_certificate_list[i],
+                               cert[i].raw.data, cert[i].raw.size);
+          if (ret < 0)
+            {
+              gnutls_assert ();
+              goto clear;
+            }
+        }
+    }
+  info->ncerts = ncerts;
+
+  return 0;
+
+clear:
+
+  for (j = 0; j < i; j++)
+    _gnutls_free_datum (&info->raw_certificate_list[j]);
+
+  gnutls_free (info->raw_certificate_list);
+  info->raw_certificate_list = NULL;
+
+  return ret;
+}
+
+
+
+
+/* returns 0 if the algo_to-check exists in the pk_algos list,
+ * -1 otherwise.
+ */
+inline static int
+_gnutls_check_pk_algo_in_list (const gnutls_pk_algorithm_t *
+                               pk_algos, int pk_algos_length,
+                               gnutls_pk_algorithm_t algo_to_check)
+{
+  int i;
+  for (i = 0; i < pk_algos_length; i++)
+    {
+      if (algo_to_check == pk_algos[i])
+        {
+          return 0;
+        }
+    }
+  return -1;
+}
+
+
+/* Returns the issuer's Distinguished name in odn, of the certificate 
+ * specified in cert.
+ */
+static int
+_gnutls_cert_get_issuer_dn (gnutls_cert * cert, gnutls_datum_t * odn)
+{
+  ASN1_TYPE dn;
+  int len, result;
+  int start, end;
+
+  if ((result = asn1_create_element
+       (_gnutls_get_pkix (), "PKIX1.Certificate", &dn)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  result = asn1_der_decoding (&dn, cert->raw.data, cert->raw.size, NULL);
+  if (result != ASN1_SUCCESS)
+    {
+      /* couldn't decode DER */
+      gnutls_assert ();
+      asn1_delete_structure (&dn);
+      return _gnutls_asn2err (result);
+    }
+
+  result = asn1_der_decoding_startEnd (dn, cert->raw.data, cert->raw.size,
+                                       "tbsCertificate.issuer", &start, &end);
+
+  if (result != ASN1_SUCCESS)
+    {
+      /* couldn't decode DER */
+      gnutls_assert ();
+      asn1_delete_structure (&dn);
+      return _gnutls_asn2err (result);
+    }
+  asn1_delete_structure (&dn);
+
+  len = end - start + 1;
+
+  odn->size = len;
+  odn->data = &cert->raw.data[start];
+
+  return 0;
+}
+
+
+/* Locates the most appropriate x509 certificate using the
+ * given DN. If indx == -1 then no certificate was found.
+ *
+ * That is to guess which certificate to use, based on the 
+ * CAs and sign algorithms supported by the peer server.
+ */
+static int
+_find_x509_cert (const gnutls_certificate_credentials_t cred,
+                 opaque * _data, size_t _data_size,
+                 const gnutls_pk_algorithm_t * pk_algos,
+                 int pk_algos_length, int *indx)
+{
+  unsigned size;
+  gnutls_datum_t odn;
+  opaque *data = _data;
+  ssize_t data_size = _data_size;
+  unsigned i, j;
+  int result, cert_pk;
+
+  *indx = -1;
+
+  do
+    {
+
+      DECR_LENGTH_RET (data_size, 2, 0);
+      size = _gnutls_read_uint16 (data);
+      DECR_LENGTH_RET (data_size, size, 0);
+      data += 2;
+
+      for (i = 0; i < cred->ncerts; i++)
+        {
+          for (j = 0; j < cred->cert_list_length[i]; j++)
+            {
+              if ((result =
+                   _gnutls_cert_get_issuer_dn (&cred->
+                                               cert_list[i][j], &odn)) < 0)
+                {
+                  gnutls_assert ();
+                  return result;
+                }
+
+              if (odn.size != size)
+                continue;
+
+              /* If the DN matches and
+               * the *_SIGN algorithm matches
+               * the cert is our cert!
+               */
+              cert_pk = cred->cert_list[i][0].subject_pk_algorithm;
+
+              if ((memcmp (odn.data, data, size) == 0) &&
+                  (_gnutls_check_pk_algo_in_list
+                   (pk_algos, pk_algos_length, cert_pk) == 0))
+                {
+                  *indx = i;
+                  break;
+                }
+            }
+          if (*indx != -1)
+            break;
+        }
+
+      if (*indx != -1)
+        break;
+
+      /* move to next record */
+      data += size;
+
+    }
+  while (1);
+
+  return 0;
+
+}
+
+/* Locates the most appropriate openpgp cert
+ */
+static int
+_find_openpgp_cert (const gnutls_certificate_credentials_t cred,
+                    gnutls_pk_algorithm_t * pk_algos,
+                    int pk_algos_length, int *indx)
+{
+  unsigned i, j;
+
+  *indx = -1;
+
+  for (i = 0; i < cred->ncerts; i++)
+    {
+      for (j = 0; j < cred->cert_list_length[i]; j++)
+        {
+
+          /* If the *_SIGN algorithm matches
+           * the cert is our cert!
+           */
+          if ((_gnutls_check_pk_algo_in_list
+               (pk_algos, pk_algos_length,
+                cred->cert_list[i][0].subject_pk_algorithm) == 0)
+              && (cred->cert_list[i][0].cert_type == GNUTLS_CRT_OPENPGP))
+            {
+              *indx = i;
+              break;
+            }
+        }
+      if (*indx != -1)
+        break;
+    }
+
+  return 0;
+}
+
+/* Returns the number of issuers in the server's
+ * certificate request packet.
+ */
+static int
+get_issuers_num (gnutls_session_t session, opaque * data, ssize_t data_size)
+{
+  int issuers_dn_len = 0, result;
+  unsigned size;
+
+  /* Count the number of the given issuers;
+   * This is used to allocate the issuers_dn without
+   * using realloc().
+   */
+
+  if (data_size == 0 || data == NULL)
+    return 0;
+
+  if (data_size > 0)
+    do
+      {
+        /* This works like DECR_LEN() 
+         */
+        result = GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+        DECR_LENGTH_COM (data_size, 2, goto error);
+        size = _gnutls_read_uint16 (data);
+
+        result = GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+        DECR_LENGTH_COM (data_size, size, goto error);
+
+        data += 2;
+
+        if (size > 0)
+          {
+            issuers_dn_len++;
+            data += size;
+          }
+
+        if (data_size == 0)
+          break;
+
+      }
+    while (1);
+
+  return issuers_dn_len;
+
+error:
+  return result;
+}
+
+/* Returns the issuers in the server's certificate request
+ * packet.
+ */
+static int
+get_issuers (gnutls_session_t session,
+             gnutls_datum_t * issuers_dn, int issuers_len,
+             opaque * data, size_t data_size)
+{
+  int i;
+  unsigned size;
+
+  if (gnutls_certificate_type_get (session) != GNUTLS_CRT_X509)
+    return 0;
+
+  /* put the requested DNs to req_dn, only in case
+   * of X509 certificates.
+   */
+  if (issuers_len > 0)
+    {
+
+      for (i = 0; i < issuers_len; i++)
+        {
+          /* The checks here for the buffer boundaries
+           * are not needed since the buffer has been
+           * parsed above.
+           */
+          data_size -= 2;
+
+          size = _gnutls_read_uint16 (data);
+
+          data += 2;
+
+          issuers_dn[i].data = data;
+          issuers_dn[i].size = size;
+
+          data += size;
+        }
+    }
+
+  return 0;
+}
+
+/* Calls the client get callback.
+ */
+static int
+call_get_cert_callback (gnutls_session_t session,
+                        gnutls_datum_t * issuers_dn,
+                        int issuers_dn_length,
+                        gnutls_pk_algorithm_t * pk_algos, int pk_algos_length)
+{
+  unsigned i;
+  gnutls_cert *local_certs = NULL;
+  gnutls_privkey *local_key = NULL;
+  gnutls_retr_st st;
+  int ret;
+  gnutls_certificate_type_t type = gnutls_certificate_type_get (session);
+  gnutls_certificate_credentials_t cred;
+
+  cred = (gnutls_certificate_credentials_t)
+    _gnutls_get_cred (session->key, GNUTLS_CRD_CERTIFICATE, NULL);
+  if (cred == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
+    }
+
+  memset (&st, 0, sizeof (st));
+
+  if (session->security_parameters.entity == GNUTLS_SERVER)
+    {
+      ret = cred->server_get_cert_callback (session, &st);
+    }
+  else
+    {                           /* CLIENT */
+      ret =
+        cred->client_get_cert_callback (session,
+                                        issuers_dn, issuers_dn_length,
+                                        pk_algos, pk_algos_length, &st);
+    }
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  if (st.ncerts == 0)
+    return 0;                   /* no certificate was selected */
+
+  if (type != st.type)
+    {
+      gnutls_assert ();
+      ret = GNUTLS_E_INVALID_REQUEST;
+      goto cleanup;
+    }
+
+  if (type == GNUTLS_CRT_X509)
+    {
+      local_certs = alloc_and_load_x509_certs (st.cert.x509, st.ncerts);
+      if (local_certs != NULL)
+        local_key = alloc_and_load_x509_key (st.key.x509);
+
+    }
+  else
+    {                           /* PGP */
+      if (st.ncerts > 1)
+        {
+          gnutls_assert ();
+          ret = GNUTLS_E_INVALID_REQUEST;
+          goto cleanup;
+        }
+
+      local_certs = alloc_and_load_pgp_certs (st.cert.pgp);
+      if (local_certs != NULL)
+        local_key = alloc_and_load_pgp_key (st.key.pgp);
+
+    }
+
+  _gnutls_selected_certs_set (session, local_certs,
+                              (local_certs != NULL) ? st.ncerts : 0,
+                              local_key, 1);
+
+  ret = 0;
+
+cleanup:
+
+  if (st.type == GNUTLS_CRT_X509)
+    {
+      if (st.deinit_all)
+        {
+          for (i = 0; i < st.ncerts; i++)
+            {
+              gnutls_x509_crt_deinit (st.cert.x509[i]);
+            }
+          gnutls_free (st.cert.x509);
+          gnutls_x509_privkey_deinit (st.key.x509);
+        }
+    }
+  else
+    {
+      if (st.deinit_all)
+        {
+          if (_E_gnutls_openpgp_crt_deinit == NULL ||
+              _E_gnutls_openpgp_privkey_deinit == NULL)
+            {
+              gnutls_assert ();
+              return GNUTLS_E_INIT_LIBEXTRA;
+            }
+
+          _E_gnutls_openpgp_crt_deinit (st.cert.pgp);
+          _E_gnutls_openpgp_privkey_deinit (st.key.pgp);
+        }
+    }
+
+  return ret;
+}
+
+/* Finds the appropriate certificate depending on the cA Distinguished name
+ * advertized by the server. If none matches then returns 0 and -1 as index.
+ * In case of an error a negative value, is returned.
+ *
+ * 20020128: added ability to select a certificate depending on the SIGN
+ * algorithm (only in automatic mode).
+ */
+static int
+_select_client_cert (gnutls_session_t session,
+                     opaque * _data, size_t _data_size,
+                     gnutls_pk_algorithm_t * pk_algos, int pk_algos_length)
+{
+  int result;
+  int indx = -1;
+  gnutls_certificate_credentials_t cred;
+  opaque *data = _data;
+  ssize_t data_size = _data_size;
+  int issuers_dn_length;
+  gnutls_datum_t *issuers_dn = NULL;
+
+  cred = (gnutls_certificate_credentials_t)
+    _gnutls_get_cred (session->key, GNUTLS_CRD_CERTIFICATE, NULL);
+  if (cred == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
+    }
+
+  if (cred->client_get_cert_callback != NULL)
+    {
+
+      /* use a callback to get certificate 
+       */
+      if (session->security_parameters.cert_type != GNUTLS_CRT_X509)
+        issuers_dn_length = 0;
+      else
+        {
+          issuers_dn_length = get_issuers_num (session, data, data_size);
+          if (issuers_dn_length < 0)
+            {
+              gnutls_assert ();
+              return issuers_dn_length;
+            }
+
+          if (issuers_dn_length > 0)
+            {
+              issuers_dn =
+                gnutls_malloc (sizeof (gnutls_datum_t) * issuers_dn_length);
+              if (issuers_dn == NULL)
+                {
+                  gnutls_assert ();
+                  return GNUTLS_E_MEMORY_ERROR;
+                }
+
+              result =
+                get_issuers (session, issuers_dn, issuers_dn_length,
+                             data, data_size);
+              if (result < 0)
+                {
+                  gnutls_assert ();
+                  goto cleanup;
+                }
+            }
+        }
+
+      result =
+        call_get_cert_callback (session, issuers_dn, issuers_dn_length,
+                                pk_algos, pk_algos_length);
+      goto cleanup;
+
+    }
+  else
+    {
+      /* If we have no callbacks, try to guess.
+       */
+      result = 0;
+
+      if (session->security_parameters.cert_type == GNUTLS_CRT_X509)
+        result =
+          _find_x509_cert (cred, _data, _data_size,
+                           pk_algos, pk_algos_length, &indx);
+
+      if (session->security_parameters.cert_type == GNUTLS_CRT_OPENPGP)
+        result = _find_openpgp_cert (cred, pk_algos, pk_algos_length, &indx);
+
+
+      if (result < 0)
+        {
+          gnutls_assert ();
+          return result;
+        }
+
+      if (indx >= 0)
+        {
+          _gnutls_selected_certs_set (session,
+                                      &cred->cert_list[indx][0],
+                                      cred->cert_list_length[indx],
+                                      &cred->pkey[indx], 0);
+        }
+      else
+        {
+          _gnutls_selected_certs_set (session, NULL, 0, NULL, 0);
+        }
+
+      result = 0;
+    }
+
+cleanup:
+  gnutls_free (issuers_dn);
+  return result;
+
+}
+
+/* Generate client certificate
+ */
+
+int
+_gnutls_gen_x509_crt (gnutls_session_t session, opaque ** data)
+{
+  int ret, i;
+  opaque *pdata;
+  gnutls_cert *apr_cert_list;
+  gnutls_privkey *apr_pkey;
+  int apr_cert_list_length;
+
+  /* find the appropriate certificate 
+   */
+  if ((ret =
+       _gnutls_get_selected_cert (session, &apr_cert_list,
+                                  &apr_cert_list_length, &apr_pkey)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  ret = 3;
+  for (i = 0; i < apr_cert_list_length; i++)
+    {
+      ret += apr_cert_list[i].raw.size + 3;
+      /* hold size
+       * for uint24 */
+    }
+
+  /* if no certificates were found then send:
+   * 0B 00 00 03 00 00 00    // Certificate with no certs
+   * instead of:
+   * 0B 00 00 00          // empty certificate handshake
+   *
+   * ( the above is the whole handshake message, not 
+   * the one produced here )
+   */
+
+  (*data) = gnutls_malloc (ret);
+  pdata = (*data);
+
+  if (pdata == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+  _gnutls_write_uint24 (ret - 3, pdata);
+  pdata += 3;
+  for (i = 0; i < apr_cert_list_length; i++)
+    {
+      _gnutls_write_datum24 (pdata, apr_cert_list[i].raw);
+      pdata += (3 + apr_cert_list[i].raw.size);
+    }
+
+  return ret;
+}
+
+enum PGPKeyDescriptorType
+{ PGP_KEY_FINGERPRINT, PGP_KEY };
+
+int
+_gnutls_gen_openpgp_certificate (gnutls_session_t session, opaque ** data)
+{
+  int ret;
+  opaque *pdata;
+  gnutls_cert *apr_cert_list;
+  gnutls_privkey *apr_pkey;
+  int apr_cert_list_length;
+
+  /* find the appropriate certificate */
+  if ((ret =
+       _gnutls_get_selected_cert (session, &apr_cert_list,
+                                  &apr_cert_list_length, &apr_pkey)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  ret = 3 + 1 + 3;
+
+  if (apr_cert_list_length > 0)
+    ret += apr_cert_list[0].raw.size;
+
+  (*data) = gnutls_malloc (ret);
+  pdata = (*data);
+
+  if (pdata == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  _gnutls_write_uint24 (ret - 3, pdata);
+  pdata += 3;
+
+  *pdata = PGP_KEY;             /* whole key */
+  pdata++;
+
+  if (apr_cert_list_length > 0)
+    {
+      _gnutls_write_datum24 (pdata, apr_cert_list[0].raw);
+      pdata += (3 + apr_cert_list[0].raw.size);
+    }
+  else                          /* empty - no certificate */
+    _gnutls_write_uint24 (0, pdata);
+
+  return ret;
+}
+
+int
+_gnutls_gen_openpgp_certificate_fpr (gnutls_session_t session, opaque ** data)
+{
+  int ret, packet_size;
+  size_t fpr_size;
+  opaque *pdata;
+  gnutls_cert *apr_cert_list;
+  gnutls_privkey *apr_pkey;
+  int apr_cert_list_length;
+
+  /* find the appropriate certificate */
+  if ((ret =
+       _gnutls_get_selected_cert (session, &apr_cert_list,
+                                  &apr_cert_list_length, &apr_pkey)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  packet_size = 3 + 1;
+
+  /* Only v4 fingerprints are sent 
+   */
+  if (apr_cert_list_length > 0 && apr_cert_list[0].version == 4)
+    packet_size += 20 + 1;
+  else                          /* empty certificate case */
+    return _gnutls_gen_openpgp_certificate (session, data);
+
+  (*data) = gnutls_malloc (packet_size);
+  pdata = (*data);
+
+  if (pdata == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  _gnutls_write_uint24 (packet_size - 3, pdata);
+  pdata += 3;
+
+  *pdata = PGP_KEY_FINGERPRINT; /* key fingerprint */
+  pdata++;
+
+  *pdata = 20;
+  pdata++;
+
+  fpr_size = 20;
+
+  if (_E_gnutls_openpgp_fingerprint == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INIT_LIBEXTRA;
+    }
+
+  if ((ret =
+       _E_gnutls_openpgp_fingerprint (&apr_cert_list[0].raw, pdata,
+                                      &fpr_size)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return packet_size;
+}
+
+
+
+int
+_gnutls_gen_cert_client_certificate (gnutls_session_t session, opaque ** data)
+{
+  switch (session->security_parameters.cert_type)
+    {
+    case GNUTLS_CRT_OPENPGP:
+      if (_gnutls_openpgp_send_fingerprint (session) == 0)
+        return _gnutls_gen_openpgp_certificate (session, data);
+      else
+        return _gnutls_gen_openpgp_certificate_fpr (session, data);
+
+    case GNUTLS_CRT_X509:
+      return _gnutls_gen_x509_crt (session, data);
+
+    default:
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+}
+
+int
+_gnutls_gen_cert_server_certificate (gnutls_session_t session, opaque ** data)
+{
+  switch (session->security_parameters.cert_type)
+    {
+    case GNUTLS_CRT_OPENPGP:
+      return _gnutls_gen_openpgp_certificate (session, data);
+    case GNUTLS_CRT_X509:
+      return _gnutls_gen_x509_crt (session, data);
+    default:
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+}
+
+/* Process server certificate
+ */
+
+#define CLEAR_CERTS for(x=0;x<peer_certificate_list_size;x++) _gnutls_gcert_deinit(&peer_certificate_list[x])
+int
+_gnutls_proc_x509_server_certificate (gnutls_session_t session,
+                                      opaque * data, size_t data_size)
+{
+  int size, len, ret;
+  opaque *p = data;
+  cert_auth_info_t info;
+  gnutls_certificate_credentials_t cred;
+  ssize_t dsize = data_size;
+  int i, j, x;
+  gnutls_cert *peer_certificate_list;
+  int peer_certificate_list_size = 0;
+  gnutls_datum_t tmp;
+
+  cred = (gnutls_certificate_credentials_t)
+    _gnutls_get_cred (session->key, GNUTLS_CRD_CERTIFICATE, NULL);
+  if (cred == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
+    }
+
+
+  if ((ret =
+       _gnutls_auth_info_set (session, GNUTLS_CRD_CERTIFICATE,
+                              sizeof (cert_auth_info_st), 1)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  info = _gnutls_get_auth_info (session);
+
+  if (data == NULL || data_size == 0)
+    {
+      gnutls_assert ();
+      /* no certificate was sent */
+      return GNUTLS_E_NO_CERTIFICATE_FOUND;
+    }
+
+  DECR_LEN (dsize, 3);
+  size = _gnutls_read_uint24 (p);
+  p += 3;
+
+  /* some implementations send 0B 00 00 06 00 00 03 00 00 00
+   * instead of just 0B 00 00 03 00 00 00 as an empty certificate message.
+   */
+  if (size == 0 || size == 3)
+    {
+      gnutls_assert ();
+      /* no certificate was sent */
+      return GNUTLS_E_NO_CERTIFICATE_FOUND;
+    }
+
+  i = dsize;
+  while (i > 0)
+    {
+      DECR_LEN (dsize, 3);
+      len = _gnutls_read_uint24 (p);
+      p += 3;
+      DECR_LEN (dsize, len);
+      peer_certificate_list_size++;
+      p += len;
+      i -= len + 3;
+    }
+
+  if (peer_certificate_list_size == 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_NO_CERTIFICATE_FOUND;
+    }
+
+  /* Ok we now allocate the memory to hold the
+   * certificate list 
+   */
+
+  peer_certificate_list =
+    gnutls_malloc (sizeof (gnutls_cert) * (peer_certificate_list_size));
+
+  if (peer_certificate_list == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+  memset (peer_certificate_list, 0, sizeof (gnutls_cert) *
+          peer_certificate_list_size);
+
+  p = data + 3;
+
+  /* Now we start parsing the list (again).
+   * We don't use DECR_LEN since the list has
+   * been parsed before.
+   */
+
+  for (j = 0; j < peer_certificate_list_size; j++)
+    {
+      len = _gnutls_read_uint24 (p);
+      p += 3;
+
+      tmp.size = len;
+      tmp.data = p;
+
+      if ((ret =
+           _gnutls_x509_raw_cert_to_gcert (&peer_certificate_list
+                                           [j], &tmp,
+                                           CERT_ONLY_EXTENSIONS)) < 0)
+        {
+          gnutls_assert ();
+          goto cleanup;
+        }
+
+      p += len;
+    }
+
+
+  if ((ret =
+       _gnutls_copy_certificate_auth_info (info,
+                                           peer_certificate_list,
+                                           peer_certificate_list_size)) < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  if ((ret =
+       _gnutls_check_key_usage (&peer_certificate_list[0],
+                                gnutls_kx_get (session))) < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  ret = 0;
+
+cleanup:
+  CLEAR_CERTS;
+  gnutls_free (peer_certificate_list);
+  return ret;
+
+}
+
+#define CLEAR_CERTS for(x=0;x<peer_certificate_list_size;x++) _gnutls_gcert_deinit(&peer_certificate_list[x])
+int
+_gnutls_proc_openpgp_server_certificate (gnutls_session_t session,
+                                         opaque * data, size_t data_size)
+{
+  int size, ret, len;
+  opaque *p = data;
+  cert_auth_info_t info;
+  gnutls_certificate_credentials_t cred;
+  ssize_t dsize = data_size;
+  int i, x;
+  gnutls_cert *peer_certificate_list = NULL;
+  int peer_certificate_list_size = 0;
+  gnutls_datum_t tmp, akey = { NULL, 0 };
+
+  cred = (gnutls_certificate_credentials_t)
+    _gnutls_get_cred (session->key, GNUTLS_CRD_CERTIFICATE, NULL);
+  if (cred == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
+    }
+
+  if ((ret =
+       _gnutls_auth_info_set (session, GNUTLS_CRD_CERTIFICATE,
+                              sizeof (cert_auth_info_st), 1)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  info = _gnutls_get_auth_info (session);
+
+  if (data == NULL || data_size == 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_NO_CERTIFICATE_FOUND;
+    }
+
+  DECR_LEN (dsize, 3);
+  size = _gnutls_read_uint24 (p);
+  p += 3;
+
+  if (size == 0)
+    {
+      gnutls_assert ();
+      /* no certificate was sent */
+      return GNUTLS_E_NO_CERTIFICATE_FOUND;
+    }
+  i = dsize;
+
+  /* Read PGPKeyDescriptor */
+  DECR_LEN (dsize, 1);
+  if (*p == PGP_KEY_FINGERPRINT)
+    {                           /* the fingerprint */
+      p++;
+
+      DECR_LEN (dsize, 1);
+      len = (uint8_t) * p;
+      p++;
+
+      if (len != 20)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_OPENPGP_FINGERPRINT_UNSUPPORTED;
+        }
+
+      DECR_LEN (dsize, 20);
+
+      /* request the actual key from our database, or
+       * a key server or anything.
+       */
+      if (_E_gnutls_openpgp_request_key == NULL)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_INIT_LIBEXTRA;
+        }
+      if ((ret =
+           _E_gnutls_openpgp_request_key (session, &akey, cred, p, 20)) < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+      tmp = akey;
+      peer_certificate_list_size++;
+
+    }
+  else if (*p == PGP_KEY)
+    {                           /* the whole key */
+
+      p++;
+
+      /* Read the actual certificate */
+      DECR_LEN (dsize, 3);
+      len = _gnutls_read_uint24 (p);
+      p += 3;
+
+      if (len == 0)
+        {
+          gnutls_assert ();
+          /* no certificate was sent */
+          return GNUTLS_E_NO_CERTIFICATE_FOUND;
+        }
+
+      DECR_LEN (dsize, len);
+      peer_certificate_list_size++;
+
+      tmp.size = len;
+      tmp.data = p;
+
+    }
+  else
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNSUPPORTED_CERTIFICATE_TYPE;
+    }
+
+  /* ok we now have the peer's key in tmp datum
+   */
+
+  if (peer_certificate_list_size == 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+    }
+
+  peer_certificate_list =
+    gnutls_alloca (sizeof (gnutls_cert) * (peer_certificate_list_size));
+  if (peer_certificate_list == NULL)
+    {
+      gnutls_assert ();
+      ret = GNUTLS_E_MEMORY_ERROR;
+      goto cleanup;
+    }
+  memset (peer_certificate_list, 0, sizeof (gnutls_cert) *
+          peer_certificate_list_size);
+
+  if (_E_gnutls_openpgp_raw_key_to_gcert == NULL)
+    {
+      gnutls_assert ();
+      ret = GNUTLS_E_INIT_LIBEXTRA;
+      goto cleanup;
+    }
+
+  if ((ret =
+       _E_gnutls_openpgp_raw_key_to_gcert (&peer_certificate_list[0],
+                                           &tmp)) < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  if ((ret =
+       _gnutls_copy_certificate_auth_info (info,
+                                           peer_certificate_list,
+                                           peer_certificate_list_size)) < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  if ((ret =
+       _gnutls_check_key_usage (&peer_certificate_list[0],
+                                gnutls_kx_get (session))) < 0)
+    {
+      gnutls_assert ();
+      goto cleanup;
+    }
+
+  ret = 0;
+
+cleanup:
+
+  _gnutls_free_datum (&akey);
+  CLEAR_CERTS;
+  gnutls_afree (peer_certificate_list);
+  return ret;
+
+}
+
+int
+_gnutls_proc_cert_server_certificate (gnutls_session_t session,
+                                      opaque * data, size_t data_size)
+{
+  switch (session->security_parameters.cert_type)
+    {
+    case GNUTLS_CRT_OPENPGP:
+      return _gnutls_proc_openpgp_server_certificate (session,
+                                                      data, data_size);
+    case GNUTLS_CRT_X509:
+      return _gnutls_proc_x509_server_certificate (session, data, data_size);
+    default:
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+}
+
+#define MAX_SIGN_ALGOS 2
+typedef enum CertificateSigType
+{ RSA_SIGN = 1, DSA_SIGN
+} CertificateSigType;
+
+/* Checks if we support the given signature algorithm 
+ * (RSA or DSA). Returns the corresponding gnutls_pk_algorithm_t
+ * if true;
+ */
+inline static int
+_gnutls_check_supported_sign_algo (CertificateSigType algo)
+{
+  switch (algo)
+    {
+    case RSA_SIGN:
+      return GNUTLS_PK_RSA;
+    }
+
+  return -1;
+}
+
+int
+_gnutls_proc_cert_cert_req (gnutls_session_t session, opaque * data,
+                            size_t data_size)
+{
+  int size, ret;
+  opaque *p;
+  gnutls_certificate_credentials_t cred;
+  cert_auth_info_t info;
+  ssize_t dsize;
+  int i, j;
+  gnutls_pk_algorithm_t pk_algos[MAX_SIGN_ALGOS];
+  int pk_algos_length;
+  gnutls_protocol_t ver = gnutls_protocol_get_version (session);
+
+  cred = (gnutls_certificate_credentials_t)
+    _gnutls_get_cred (session->key, GNUTLS_CRD_CERTIFICATE, NULL);
+  if (cred == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
+    }
+
+  if ((ret =
+       _gnutls_auth_info_set (session, GNUTLS_CRD_CERTIFICATE,
+                              sizeof (cert_auth_info_st), 0)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  info = _gnutls_get_auth_info (session);
+
+  p = data;
+  dsize = data_size;
+
+  DECR_LEN (dsize, 1);
+  size = p[0];
+  p++;
+  /* check if the sign algorithm is supported.
+   */
+  pk_algos_length = j = 0;
+  for (i = 0; i < size; i++, p++)
+    {
+      DECR_LEN (dsize, 1);
+      if ((ret = _gnutls_check_supported_sign_algo (*p)) > 0)
+        {
+          if (j < MAX_SIGN_ALGOS)
+            {
+              pk_algos[j++] = ret;
+              pk_algos_length++;
+            }
+        }
+    }
+
+  if (pk_algos_length == 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNKNOWN_PK_ALGORITHM;
+    }
+
+  if (ver == GNUTLS_TLS1_2)
+    {
+      /* read supported hashes */
+      int hash_num;
+      DECR_LEN (dsize, 1);
+
+      hash_num = p[0] & 0xFF;
+      p++;
+
+      DECR_LEN (dsize, hash_num);
+      p += hash_num;
+    }
+
+  /* read the certificate authorities */
+  DECR_LEN (dsize, 2);
+  size = _gnutls_read_uint16 (p);
+  p += 2;
+
+  if (session->security_parameters.cert_type == GNUTLS_CRT_OPENPGP
+      && size != 0)
+    {
+      gnutls_assert ();         // size should be zero
+      return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+    }
+
+  DECR_LEN (dsize, size);
+
+  /* now we ask the user to tell which one
+   * he wants to use.
+   */
+  if ((ret =
+       _select_client_cert (session, p, size, pk_algos, pk_algos_length)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  /* We should reply with a certificate message, 
+   * even if we have no certificate to send.
+   */
+  session->key->certificate_requested = 1;
+
+  return 0;
+}
+
+int
+_gnutls_gen_cert_client_cert_vrfy (gnutls_session_t session, opaque ** data)
+{
+  int ret;
+  gnutls_cert *apr_cert_list;
+  gnutls_privkey *apr_pkey;
+  int apr_cert_list_length, size;
+  gnutls_datum_t signature;
+
+  *data = NULL;
+
+  /* find the appropriate certificate */
+  if ((ret =
+       _gnutls_get_selected_cert (session, &apr_cert_list,
+                                  &apr_cert_list_length, &apr_pkey)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  if (apr_cert_list_length > 0)
+    {
+      if ((ret =
+           _gnutls_tls_sign_hdata (session,
+                                   &apr_cert_list[0],
+                                   apr_pkey, &signature)) < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+    }
+  else
+    {
+      return 0;
+    }
+
+  *data = gnutls_malloc (signature.size + 2);
+  if (*data == NULL)
+    {
+      _gnutls_free_datum (&signature);
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+  size = signature.size;
+  _gnutls_write_uint16 (size, *data);
+
+  memcpy (&(*data)[2], signature.data, size);
+
+  _gnutls_free_datum (&signature);
+
+  return size + 2;
+}
+
+int
+_gnutls_proc_cert_client_cert_vrfy (gnutls_session_t session,
+                                    opaque * data, size_t data_size)
+{
+  int size, ret;
+  ssize_t dsize = data_size;
+  opaque *pdata = data;
+  gnutls_datum_t sig;
+  cert_auth_info_t info = _gnutls_get_auth_info (session);
+  gnutls_cert peer_cert;
+
+  if (info == NULL || info->ncerts == 0)
+    {
+      gnutls_assert ();
+      /* we need this in order to get peer's certificate */
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  DECR_LEN (dsize, 2);
+  size = _gnutls_read_uint16 (pdata);
+  pdata += 2;
+
+  DECR_LEN (dsize, size);
+
+  sig.data = pdata;
+  sig.size = size;
+
+  ret = _gnutls_raw_cert_to_gcert (&peer_cert,
+                                   session->security_parameters.cert_type,
+                                   &info->raw_certificate_list[0],
+                                   CERT_NO_COPY);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  if ((ret = _gnutls_verify_sig_hdata (session, &peer_cert, &sig)) < 0)
+    {
+      gnutls_assert ();
+      _gnutls_gcert_deinit (&peer_cert);
+      return ret;
+    }
+  _gnutls_gcert_deinit (&peer_cert);
+
+  return 0;
+}
+
+#define CERTTYPE_SIZE 3
+int
+_gnutls_gen_cert_server_cert_req (gnutls_session_t session, opaque ** data)
+{
+  gnutls_certificate_credentials_t cred;
+  int size;
+  opaque *pdata;
+  gnutls_protocol_t ver = gnutls_protocol_get_version (session);
+
+  /* Now we need to generate the RDN sequence. This is
+   * already in the CERTIFICATE_CRED structure, to improve
+   * performance.
+   */
+
+  cred = (gnutls_certificate_credentials_t)
+    _gnutls_get_cred (session->key, GNUTLS_CRD_CERTIFICATE, NULL);
+  if (cred == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
+    }
+
+  size = CERTTYPE_SIZE + 2;     /* 2 for gnutls_certificate_type_t + 2 for size of rdn_seq 
+                                 */
+
+  if (session->security_parameters.cert_type == GNUTLS_CRT_X509 &&
+      session->internals.ignore_rdn_sequence == 0)
+    size += cred->x509_rdn_sequence.size;
+
+  if (ver == GNUTLS_TLS1_2)
+    /* Need at least one byte to announce the number of supported hash
+       functions (see below).  */
+    size += 1;
+
+  (*data) = gnutls_malloc (size);
+  pdata = (*data);
+
+  if (pdata == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  pdata[0] = CERTTYPE_SIZE - 1;
+
+  pdata[1] = RSA_SIGN;
+  pdata[2] = DSA_SIGN;          /* only these for now */
+  pdata += CERTTYPE_SIZE;
+
+  if (ver == GNUTLS_TLS1_2)
+    {
+      /* Supported hashes (nothing for now -- FIXME). */
+      *pdata = 0;
+      pdata++;
+    }
+
+  if (session->security_parameters.cert_type == GNUTLS_CRT_X509 &&
+      session->internals.ignore_rdn_sequence == 0)
+    {
+      _gnutls_write_datum16 (pdata, cred->x509_rdn_sequence);
+      /* pdata += cred->x509_rdn_sequence.size + 2; */
+    }
+  else
+    {
+      _gnutls_write_uint16 (0, pdata);
+      /* pdata+=2; */
+    }
+
+  return size;
+}
+
+
+/* This function will return the appropriate certificate to use. 
+ * Fills in the apr_cert_list, apr_cert_list_length and apr_pkey.
+ * The return value is a negative value on error.
+ *
+ * It is normal to return 0 with no certificates in client side.
+ *
+ */
+int
+_gnutls_get_selected_cert (gnutls_session_t session,
+                           gnutls_cert ** apr_cert_list,
+                           int *apr_cert_list_length,
+                           gnutls_privkey ** apr_pkey)
+{
+  if (session->security_parameters.entity == GNUTLS_SERVER)
+    {
+
+      /* select_client_cert() has been called before.
+       */
+
+      *apr_cert_list = session->internals.selected_cert_list;
+      *apr_pkey = session->internals.selected_key;
+      *apr_cert_list_length = session->internals.selected_cert_list_length;
+
+      if (*apr_cert_list_length == 0 || *apr_cert_list == NULL)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
+        }
+
+    }
+  else
+    {                           /* CLIENT SIDE 
+                                 */
+
+      /* we have already decided which certificate
+       * to send.
+       */
+      *apr_cert_list = session->internals.selected_cert_list;
+      *apr_cert_list_length = session->internals.selected_cert_list_length;
+      *apr_pkey = session->internals.selected_key;
+
+    }
+
+  return 0;
+}
+
+/* converts the given x509 certificate to gnutls_cert* and allocates
+ * space for them.
+ */
+static gnutls_cert *
+alloc_and_load_x509_certs (gnutls_x509_crt_t * certs, unsigned ncerts)
+{
+  gnutls_cert *local_certs;
+  int ret = 0;
+  unsigned i, j;
+
+  if (certs == NULL)
+    return NULL;
+
+  local_certs = gnutls_malloc (sizeof (gnutls_cert) * ncerts);
+  if (local_certs == NULL)
+    {
+      gnutls_assert ();
+      return NULL;
+    }
+
+  for (i = 0; i < ncerts; i++)
+    {
+      ret = _gnutls_x509_crt_to_gcert (&local_certs[i], certs[i], 0);
+      if (ret < 0)
+        break;
+    }
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      for (j = 0; j < i; j++)
+        {
+          _gnutls_gcert_deinit (&local_certs[j]);
+        }
+      gnutls_free (local_certs);
+      return NULL;
+    }
+
+  return local_certs;
+}
+
+/* converts the given x509 key to gnutls_privkey* and allocates
+ * space for it.
+ */
+static gnutls_privkey *
+alloc_and_load_x509_key (gnutls_x509_privkey_t key)
+{
+  gnutls_privkey *local_key;
+  int ret = 0;
+
+  if (key == NULL)
+    return NULL;
+
+  local_key = gnutls_malloc (sizeof (gnutls_privkey));
+  if (local_key == NULL)
+    {
+      gnutls_assert ();
+      return NULL;
+    }
+
+  ret = _gnutls_x509_privkey_to_gkey (local_key, key);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return NULL;
+    }
+
+  return local_key;
+}
+
+/* converts the given pgp certificate to gnutls_cert* and allocates
+ * space for them.
+ */
+static gnutls_cert *
+alloc_and_load_pgp_certs (gnutls_openpgp_crt_t cert)
+{
+  gnutls_cert *local_certs;
+  int ret = 0;
+
+  if (cert == NULL)
+    return NULL;
+
+  local_certs = gnutls_malloc (sizeof (gnutls_cert));
+  if (local_certs == NULL)
+    {
+      gnutls_assert ();
+      return NULL;
+    }
+
+  if (_E_gnutls_openpgp_crt_to_gcert == NULL)
+    {
+      gnutls_assert ();
+      return NULL;
+    }
+
+  ret = _E_gnutls_openpgp_crt_to_gcert (local_certs, cert);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return NULL;
+    }
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      _gnutls_gcert_deinit (local_certs);
+      gnutls_free (local_certs);
+      return NULL;
+    }
+
+  return local_certs;
+}
+
+/* converts the given raw key to gnutls_privkey* and allocates
+ * space for it.
+ */
+static gnutls_privkey *
+alloc_and_load_pgp_key (const gnutls_openpgp_privkey_t key)
+{
+  gnutls_privkey *local_key;
+  int ret = 0;
+
+  if (key == NULL)
+    return NULL;
+
+  local_key = gnutls_malloc (sizeof (gnutls_privkey));
+  if (local_key == NULL)
+    {
+      gnutls_assert ();
+      return NULL;
+    }
+
+  if (_E_gnutls_openpgp_privkey_to_gkey == NULL)
+    {
+      gnutls_assert ();
+      return NULL;
+    }
+
+  ret = _E_gnutls_openpgp_privkey_to_gkey (local_key, key);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return NULL;
+    }
+
+  return local_key;
+}
+
+
+void
+_gnutls_selected_certs_deinit (gnutls_session_t session)
+{
+  if (session->internals.selected_need_free != 0)
+    {
+      int i;
+
+      for (i = 0; i < session->internals.selected_cert_list_length; i++)
+        {
+          _gnutls_gcert_deinit (&session->internals.selected_cert_list[i]);
+        }
+      gnutls_free (session->internals.selected_cert_list);
+      session->internals.selected_cert_list = NULL;
+      session->internals.selected_cert_list_length = 0;
+
+      _gnutls_gkey_deinit (session->internals.selected_key);
+      if (session->internals.selected_key)
+        {
+          gnutls_free (session->internals.selected_key);
+          session->internals.selected_key = NULL;
+        }
+    }
+
+  return;
+}
+
+void
+_gnutls_selected_certs_set (gnutls_session_t session,
+                            gnutls_cert * certs, int ncerts,
+                            gnutls_privkey * key, int need_free)
+{
+  _gnutls_selected_certs_deinit (session);
+
+  session->internals.selected_cert_list = certs;
+  session->internals.selected_cert_list_length = ncerts;
+  session->internals.selected_key = key;
+  session->internals.selected_need_free = need_free;
+
+}
+
+
+/* finds the most appropriate certificate in the cert list.
+ * The 'appropriate' is defined by the user.
+ *
+ * requested_algo holds the parameters required by the peer (RSA, DSA
+ * or -1 for any).
+ *
+ * Returns 0 on success and a negative value on error. The
+ * selected certificate will be in session->internals.selected_*.
+ *
+ */
+int
+_gnutls_server_select_cert (gnutls_session_t session,
+                            gnutls_pk_algorithm_t requested_algo)
+{
+  unsigned i;
+  int idx, ret;
+  gnutls_certificate_credentials_t cred;
+
+  cred = (gnutls_certificate_credentials_t)
+    _gnutls_get_cred (session->key, GNUTLS_CRD_CERTIFICATE, NULL);
+  if (cred == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
+    }
+
+  /* If the callback which retrieves certificate has been set,
+   * use it and leave.
+   */
+  if (cred->server_get_cert_callback != NULL)
+    return call_get_cert_callback (session, NULL, 0, NULL, 0);
+
+  /* Otherwise... */
+
+  ret = 0;
+  idx = -1;                     /* default is use no certificate */
+
+
+  for (i = 0; i < cred->ncerts; i++)
+    {
+      /* find one compatible certificate 
+       */
+      if (requested_algo == GNUTLS_PK_ANY ||
+          requested_algo == cred->cert_list[i][0].subject_pk_algorithm)
+        {
+          /* if cert type matches 
+           */
+          if (session->security_parameters.cert_type ==
+              cred->cert_list[i][0].cert_type)
+            {
+              idx = i;
+              break;
+            }
+        }
+    }
+
+  /* store the certificate pointer for future use, in the handshake.
+   * (This will allow not calling this callback again.)
+   */
+  if (idx >= 0 && ret == 0)
+    {
+      _gnutls_selected_certs_set (session,
+                                  &cred->cert_list[idx][0],
+                                  cred->cert_list_length[idx],
+                                  &cred->pkey[idx], 0);
+    }
+  else
+    /* Certificate does not support REQUESTED_ALGO.  */
+    ret = GNUTLS_E_INSUFFICIENT_CREDENTIALS;
+
+  return ret;
+}
+
+/* Frees the rsa_info_st structure.
+ */
+void
+_gnutls_free_rsa_info (rsa_info_st * rsa)
+{
+  _gnutls_free_datum (&rsa->modulus);
+  _gnutls_free_datum (&rsa->exponent);
+}
diff --git a/src/daemon/https/tls/auth_cert.h b/src/daemon/https/tls/auth_cert.h
new file mode 100644
index 00000000..86e0230f
--- /dev/null
+++ b/src/daemon/https/tls/auth_cert.h
@@ -0,0 +1,158 @@
+/*
+ * Copyright (C) 2002, 2003, 2004, 2005, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#ifndef AUTH_CERT_H
+# define AUTH_CERT_H
+
+# include "gnutls_cert.h"
+# include "gnutls_auth.h"
+# include "auth_dh_common.h"
+# include "x509.h"
+# include "openpgp.h"
+
+/* This structure may be complex, but it's the only way to
+ * support a server that has multiple certificates
+ */
+typedef struct gnutls_certificate_credentials_st
+{
+  gnutls_dh_params_t dh_params;
+  gnutls_rsa_params_t rsa_params;
+  /* this callback is used to retrieve the DH or RSA
+   * parameters.
+   */
+  gnutls_params_function *params_func;
+
+  gnutls_cert **cert_list;
+  /* contains a list of a list of certificates.
+   * eg (X509): [0] certificate1, certificate11, certificate111 
+   * (if more than one, one certificate certifies the one before)
+   *       [1] certificate2, certificate22, ...
+   */
+  unsigned *cert_list_length;
+  /* contains the number of the certificates in a
+   * row (should be 1 for OpenPGP keys).
+   */
+  unsigned ncerts;              /* contains the number of columns in cert_list.
+                                 * This is the same with the number of pkeys.
+                                 */
+
+  gnutls_privkey *pkey;
+  /* private keys. It contains ncerts private
+   * keys. pkey[i] corresponds to certificate in
+   * cert_list[i][0].
+   */
+
+  /* OpenPGP specific stuff */
+
+#ifndef KEYRING_HACK
+  gnutls_openpgp_keyring_t keyring;
+#else
+  gnutls_datum_t keyring;
+  int keyring_format;
+#endif
+
+  /* X509 specific stuff */
+
+  gnutls_x509_crt_t *x509_ca_list;
+  unsigned x509_ncas;           /* number of CAs in the ca_list 
+                                 */
+
+  gnutls_x509_crl_t *x509_crl_list;
+  unsigned x509_ncrls;          /* number of CRLs in the crl_list 
+                                 */
+
+  unsigned int verify_flags;    /* flags to be used at 
+                                 * certificate verification.
+                                 */
+  unsigned int verify_depth;
+  unsigned int verify_bits;
+
+  /* holds a sequence of the
+   * RDNs of the CAs above.
+   * This is better than
+   * generating on every handshake.
+   */
+  gnutls_datum_t x509_rdn_sequence;
+
+  gnutls_certificate_client_retrieve_function *client_get_cert_callback;
+  gnutls_certificate_server_retrieve_function *server_get_cert_callback;
+} certificate_credentials_st;
+
+typedef struct rsa_info_st
+{
+  gnutls_datum_t modulus;
+  gnutls_datum_t exponent;
+} rsa_info_st;
+
+typedef struct cert_auth_info_st
+{
+  int certificate_requested;    /* if the peer requested certificate
+                                 * this is non zero;
+                                 */
+
+  /* These (dh/rsa) are just copies from the credentials_t structure.
+   * They must be freed.
+   */
+  dh_info_st dh;
+  rsa_info_st rsa_export;
+
+  gnutls_datum_t *raw_certificate_list; /* holds the raw certificate of the
+                                         * peer.
+                                         */
+  unsigned int ncerts;          /* holds the size of the list above */
+} *cert_auth_info_t;
+
+typedef struct cert_auth_info_st cert_auth_info_st;
+
+void _gnutls_free_rsa_info (rsa_info_st * rsa);
+
+/* AUTH X509 functions */
+int _gnutls_gen_cert_server_certificate (gnutls_session_t, opaque **);
+int _gnutls_gen_cert_client_certificate (gnutls_session_t, opaque **);
+int _gnutls_gen_cert_client_cert_vrfy (gnutls_session_t, opaque **);
+int _gnutls_gen_cert_server_cert_req (gnutls_session_t, opaque **);
+int _gnutls_proc_cert_cert_req (gnutls_session_t, opaque *, size_t);
+int _gnutls_proc_cert_client_cert_vrfy (gnutls_session_t, opaque *, size_t);
+int _gnutls_proc_cert_server_certificate (gnutls_session_t, opaque *, size_t);
+int _gnutls_get_selected_cert (gnutls_session_t session,
+                               gnutls_cert ** apr_cert_list,
+                               int *apr_cert_list_length,
+                               gnutls_privkey ** apr_pkey);
+
+int _gnutls_server_select_cert (struct gnutls_session_int *,
+                                gnutls_pk_algorithm_t);
+void _gnutls_selected_certs_deinit (gnutls_session_t session);
+void _gnutls_selected_certs_set (gnutls_session_t session,
+                                 gnutls_cert * certs, int ncerts,
+                                 gnutls_privkey * key, int need_free);
+
+#define _gnutls_proc_cert_client_certificate _gnutls_proc_cert_server_certificate
+
+gnutls_rsa_params_t _gnutls_certificate_get_rsa_params (gnutls_rsa_params_t
+                                                        rsa_params,
+                                                        gnutls_params_function
+                                                        * func,
+                                                        gnutls_session_t);
+
+#endif
diff --git a/src/daemon/https/tls/auth_dh_common.c b/src/daemon/https/tls/auth_dh_common.c
new file mode 100644
index 00000000..f1b82bf9
--- /dev/null
+++ b/src/daemon/https/tls/auth_dh_common.c
@@ -0,0 +1,369 @@
+/*
+ * Copyright (C) 2002, 2003, 2004, 2005, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* This file contains common stuff in Ephemeral Diffie Hellman (DHE) and
+ * Anonymous DH key exchange(DHA). These are used in the handshake procedure 
+ * of the certificate and anoymous authentication.
+ */
+
+#include "gnutls_int.h"
+#include "gnutls_auth_int.h"
+#include "gnutls_errors.h"
+#include "gnutls_dh.h"
+#include "gnutls_num.h"
+#include "gnutls_sig.h"
+#include <gnutls_datum.h>
+#include <gnutls_x509.h>
+#include <gnutls_state.h>
+#include <auth_dh_common.h>
+#include <gnutls_algorithms.h>
+
+/* Frees the dh_info_st structure.
+ */
+void
+_gnutls_free_dh_info (dh_info_st * dh)
+{
+  dh->secret_bits = 0;
+  _gnutls_free_datum (&dh->prime);
+  _gnutls_free_datum (&dh->generator);
+  _gnutls_free_datum (&dh->public_key);
+}
+
+int
+_gnutls_proc_dh_common_client_kx (gnutls_session_t session,
+                                  opaque * data, size_t _data_size,
+                                  mpi_t g, mpi_t p)
+{
+  uint16_t n_Y;
+  size_t _n_Y;
+  int ret;
+  ssize_t data_size = _data_size;
+
+
+  DECR_LEN (data_size, 2);
+  n_Y = _gnutls_read_uint16 (&data[0]);
+  _n_Y = n_Y;
+
+  DECR_LEN (data_size, n_Y);
+  if (_gnutls_mpi_scan_nz (&session->key->client_Y, &data[2], &_n_Y))
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MPI_SCAN_FAILED;
+    }
+
+  _gnutls_dh_set_peer_public (session, session->key->client_Y);
+
+  session->key->KEY =
+    gnutls_calc_dh_key (session->key->client_Y, session->key->dh_secret, p);
+
+  if (session->key->KEY == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  _gnutls_mpi_release (&session->key->client_Y);
+  _gnutls_mpi_release (&session->key->dh_secret);
+
+
+  if (_gnutls_cipher_suite_get_kx_algo
+      (&session->security_parameters.current_cipher_suite)
+      != GNUTLS_KX_DHE_PSK)
+    {
+      ret = _gnutls_mpi_dprint (&session->key->key, session->key->KEY);
+    }
+  /* In DHE_PSK the key is set differently 
+  else                          
+    {
+      gnutls_datum_t tmp_dh_key;
+      ret = _gnutls_mpi_dprint (&tmp_dh_key, session->key->KEY);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      ret = _gnutls_set_psk_session_key (session, &tmp_dh_key);
+      _gnutls_free_datum (&tmp_dh_key);
+
+    }
+    */
+
+  _gnutls_mpi_release (&session->key->KEY);
+
+  if (ret < 0)
+    {
+      return ret;
+    }
+
+  return 0;
+}
+
+int
+_gnutls_gen_dh_common_client_kx (gnutls_session_t session, opaque ** data)
+{
+  mpi_t x = NULL, X = NULL;
+  size_t n_X;
+  int ret;
+
+  *data = NULL;
+
+  X = gnutls_calc_dh_secret (&x, session->key->client_g,
+                             session->key->client_p);
+  if (X == NULL || x == NULL)
+    {
+      gnutls_assert ();
+      ret = GNUTLS_E_MEMORY_ERROR;
+      goto error;
+    }
+
+  _gnutls_dh_set_secret_bits (session, _gnutls_mpi_get_nbits (x));
+
+  _gnutls_mpi_print (NULL, &n_X, X);
+  (*data) = gnutls_malloc (n_X + 2);
+  if (*data == NULL)
+    {
+      ret = GNUTLS_E_MEMORY_ERROR;
+      goto error;
+    }
+
+  _gnutls_mpi_print (&(*data)[2], &n_X, X);
+  _gnutls_mpi_release (&X);
+
+  _gnutls_write_uint16 (n_X, &(*data)[0]);
+
+  /* calculate the key after calculating the message */
+  session->key->KEY =
+    gnutls_calc_dh_key (session->key->client_Y, x, session->key->client_p);
+
+  _gnutls_mpi_release (&x);
+  if (session->key->KEY == NULL)
+    {
+      gnutls_assert ();
+      ret = GNUTLS_E_MEMORY_ERROR;
+      goto error;
+    }
+
+  /* THESE SHOULD BE DISCARDED */
+  _gnutls_mpi_release (&session->key->client_Y);
+  _gnutls_mpi_release (&session->key->client_p);
+  _gnutls_mpi_release (&session->key->client_g);
+
+  if (_gnutls_cipher_suite_get_kx_algo
+      (&session->security_parameters.current_cipher_suite)
+      != GNUTLS_KX_DHE_PSK)
+    {
+      ret = _gnutls_mpi_dprint (&session->key->key, session->key->KEY);
+    }
+  /* In DHE_PSK the key is set differently 
+  else                         
+    {
+      gnutls_datum_t tmp_dh_key;
+      ret = _gnutls_mpi_dprint (&tmp_dh_key, session->key->KEY);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          goto error;
+        }
+
+      ret = _gnutls_set_psk_session_key (session, &tmp_dh_key);
+      _gnutls_free_datum (&tmp_dh_key);
+
+    }*/
+
+  _gnutls_mpi_release (&session->key->KEY);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+
+  return n_X + 2;
+
+error:
+  _gnutls_mpi_release (&x);
+  _gnutls_mpi_release (&X);
+  gnutls_free (*data);
+  *data = NULL;
+  return ret;
+}
+
+int
+_gnutls_proc_dh_common_server_kx (gnutls_session_t session,
+                                  opaque * data, size_t _data_size, int psk)
+{
+  uint16_t n_Y, n_g, n_p;
+  size_t _n_Y, _n_g, _n_p;
+  uint8_t *data_p;
+  uint8_t *data_g;
+  uint8_t *data_Y;
+  int i, bits, psk_size, ret;
+  ssize_t data_size = _data_size;
+
+  i = 0;
+
+  if (psk != 0)
+    {
+      DECR_LEN (data_size, 2);
+      psk_size = _gnutls_read_uint16 (&data[i]);
+      DECR_LEN (data_size, psk_size);
+      i += 2 + psk_size;
+    }
+
+  DECR_LEN (data_size, 2);
+  n_p = _gnutls_read_uint16 (&data[i]);
+  i += 2;
+
+  DECR_LEN (data_size, n_p);
+  data_p = &data[i];
+  i += n_p;
+
+  DECR_LEN (data_size, 2);
+  n_g = _gnutls_read_uint16 (&data[i]);
+  i += 2;
+
+  DECR_LEN (data_size, n_g);
+  data_g = &data[i];
+  i += n_g;
+
+  DECR_LEN (data_size, 2);
+  n_Y = _gnutls_read_uint16 (&data[i]);
+  i += 2;
+
+  DECR_LEN (data_size, n_Y);
+  data_Y = &data[i];
+  i += n_Y;
+
+  _n_Y = n_Y;
+  _n_g = n_g;
+  _n_p = n_p;
+
+  if (_gnutls_mpi_scan_nz (&session->key->client_Y, data_Y, &_n_Y) != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MPI_SCAN_FAILED;
+    }
+
+  if (_gnutls_mpi_scan_nz (&session->key->client_g, data_g, &_n_g) != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MPI_SCAN_FAILED;
+    }
+  if (_gnutls_mpi_scan_nz (&session->key->client_p, data_p, &_n_p) != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MPI_SCAN_FAILED;
+    }
+
+  bits = _gnutls_dh_get_allowed_prime_bits (session);
+  if (bits < 0)
+    {
+      gnutls_assert ();
+      return bits;
+    }
+
+  if (_gnutls_mpi_get_nbits (session->key->client_p) < (size_t) bits)
+    {
+      /* the prime used by the peer is not acceptable
+       */
+      gnutls_assert ();
+      return GNUTLS_E_DH_PRIME_UNACCEPTABLE;
+    }
+
+  _gnutls_dh_set_group (session, session->key->client_g,
+                        session->key->client_p);
+  _gnutls_dh_set_peer_public (session, session->key->client_Y);
+
+  ret = n_Y + n_p + n_g + 6;
+  if (psk != 0)
+    ret += 2;
+
+  return ret;
+}
+
+/* If the psk flag is set, then an empty psk_identity_hint will
+ * be inserted */
+int
+_gnutls_dh_common_print_server_kx (gnutls_session_t session,
+                                   mpi_t g, mpi_t p, opaque ** data, int psk)
+{
+  mpi_t x, X;
+  size_t n_X, n_g, n_p;
+  int ret, data_size, pos;
+  uint8_t *pdata;
+
+  X = gnutls_calc_dh_secret (&x, g, p);
+  if (X == NULL || x == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  session->key->dh_secret = x;
+  _gnutls_dh_set_secret_bits (session, _gnutls_mpi_get_nbits (x));
+
+  _gnutls_mpi_print (NULL, &n_g, g);
+  _gnutls_mpi_print (NULL, &n_p, p);
+  _gnutls_mpi_print (NULL, &n_X, X);
+
+  data_size = n_g + n_p + n_X + 6;
+  if (psk != 0)
+    data_size += 2;
+
+  (*data) = gnutls_malloc (data_size);
+  if (*data == NULL)
+    {
+      _gnutls_mpi_release (&X);
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  pos = 0;
+  pdata = *data;
+
+  if (psk != 0)
+    {
+      _gnutls_write_uint16 (0, &pdata[pos]);
+      pos += 2;
+    }
+
+  _gnutls_mpi_print (&pdata[pos + 2], &n_p, p);
+  _gnutls_write_uint16 (n_p, &pdata[pos]);
+
+  pos += n_p + 2;
+
+  _gnutls_mpi_print (&pdata[pos + 2], &n_g, g);
+  _gnutls_write_uint16 (n_g, &pdata[pos]);
+
+  pos += n_g + 2;
+
+  _gnutls_mpi_print (&pdata[pos + 2], &n_X, X);
+  _gnutls_mpi_release (&X);
+
+  _gnutls_write_uint16 (n_X, &pdata[pos]);
+
+  ret = data_size;
+
+  return ret;
+}
diff --git a/src/daemon/https/tls/auth_dh_common.h b/src/daemon/https/tls/auth_dh_common.h
new file mode 100644
index 00000000..be0ad066
--- /dev/null
+++ b/src/daemon/https/tls/auth_dh_common.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#ifndef AUTH_DH_COMMON
+# define AUTH_DH_COMMON
+
+typedef struct
+{
+  int secret_bits;
+
+  gnutls_datum_t prime;
+  gnutls_datum_t generator;
+  gnutls_datum_t public_key;
+} dh_info_st;
+
+void _gnutls_free_dh_info (dh_info_st * dh);
+int _gnutls_gen_dh_common_client_kx (gnutls_session_t, opaque **);
+int _gnutls_proc_dh_common_client_kx (gnutls_session_t session,
+                                      opaque * data, size_t _data_size,
+                                      mpi_t p, mpi_t g);
+int _gnutls_dh_common_print_server_kx (gnutls_session_t, mpi_t g, mpi_t p,
+                                       opaque ** data, int psk);
+int _gnutls_proc_dh_common_server_kx (gnutls_session_t session,
+                                      opaque * data, size_t _data_size,
+                                      int psk);
+
+#endif
diff --git a/src/daemon/https/tls/auth_dhe.c b/src/daemon/https/tls/auth_dhe.c
new file mode 100644
index 00000000..0262bda3
--- /dev/null
+++ b/src/daemon/https/tls/auth_dhe.c
@@ -0,0 +1,276 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* This file contains everything for the Ephemeral Diffie Hellman (DHE)
+ * key exchange. This is used in the handshake procedure of the certificate
+ * authentication.
+ */
+
+#include "gnutls_int.h"
+#include "gnutls_auth_int.h"
+#include "gnutls_errors.h"
+#include "gnutls_dh.h"
+#include "gnutls_num.h"
+#include "gnutls_sig.h"
+#include <gnutls_datum.h>
+#include <auth_cert.h>
+#include <gnutls_x509.h>
+#include <gnutls_state.h>
+#include <auth_dh_common.h>
+
+static int gen_dhe_server_kx (gnutls_session_t, opaque **);
+static int proc_dhe_server_kx (gnutls_session_t, opaque *, size_t);
+static int proc_dhe_client_kx (gnutls_session_t, opaque *, size_t);
+
+const mod_auth_st dhe_rsa_auth_struct = {
+  "DHE_RSA",
+  _gnutls_gen_cert_server_certificate,
+  _gnutls_gen_cert_client_certificate,
+  gen_dhe_server_kx,
+  _gnutls_gen_dh_common_client_kx,
+  _gnutls_gen_cert_client_cert_vrfy,    /* gen client cert vrfy */
+  _gnutls_gen_cert_server_cert_req,     /* server cert request */
+
+  _gnutls_proc_cert_server_certificate,
+  _gnutls_proc_cert_client_certificate,
+  proc_dhe_server_kx,
+  proc_dhe_client_kx,
+  _gnutls_proc_cert_client_cert_vrfy,   /* proc client cert vrfy */
+  _gnutls_proc_cert_cert_req    /* proc server cert request */
+};
+
+const mod_auth_st dhe_dss_auth_struct = {
+  "DHE_DSS",
+  _gnutls_gen_cert_server_certificate,
+  _gnutls_gen_cert_client_certificate,
+  gen_dhe_server_kx,
+  _gnutls_gen_dh_common_client_kx,
+  _gnutls_gen_cert_client_cert_vrfy,    /* gen client cert vrfy */
+  _gnutls_gen_cert_server_cert_req,     /* server cert request */
+
+  _gnutls_proc_cert_server_certificate,
+  _gnutls_proc_cert_client_certificate,
+  proc_dhe_server_kx,
+  proc_dhe_client_kx,
+  _gnutls_proc_cert_client_cert_vrfy,   /* proc client cert vrfy */
+  _gnutls_proc_cert_cert_req    /* proc server cert request */
+};
+
+
+static int
+gen_dhe_server_kx (gnutls_session_t session, opaque ** data)
+{
+  mpi_t g, p;
+  const mpi_t *mpis;
+  int ret = 0, data_size;
+  int bits;
+  gnutls_cert *apr_cert_list;
+  gnutls_privkey *apr_pkey;
+  int apr_cert_list_length;
+  gnutls_datum_t signature, ddata;
+  gnutls_certificate_credentials_t cred;
+  gnutls_dh_params_t dh_params;
+
+  cred = (gnutls_certificate_credentials_t)
+    _gnutls_get_cred (session->key, GNUTLS_CRD_CERTIFICATE, NULL);
+  if (cred == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
+    }
+
+  bits = _gnutls_dh_get_allowed_prime_bits (session);
+
+  /* find the appropriate certificate */
+  if ((ret =
+       _gnutls_get_selected_cert (session, &apr_cert_list,
+                                  &apr_cert_list_length, &apr_pkey)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  dh_params =
+    _gnutls_get_dh_params (cred->dh_params, cred->params_func, session);
+  mpis = _gnutls_dh_params_to_mpi (dh_params);
+  if (mpis == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_NO_TEMPORARY_DH_PARAMS;
+    }
+
+  p = mpis[0];
+  g = mpis[1];
+
+  if ((ret = _gnutls_auth_info_set (session, GNUTLS_CRD_CERTIFICATE,
+                                    sizeof (cert_auth_info_st), 0)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  _gnutls_dh_set_group (session, g, p);
+
+  ret = _gnutls_dh_common_print_server_kx (session, g, p, data, 0);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+  data_size = ret;
+
+  /* Generate the signature. */
+
+  ddata.data = *data;
+  ddata.size = data_size;
+
+  if (apr_cert_list_length > 0)
+    {
+      if ((ret =
+           _gnutls_tls_sign_params (session, &apr_cert_list[0],
+                                    apr_pkey, &ddata, &signature)) < 0)
+        {
+          gnutls_assert ();
+          gnutls_free (*data);
+          return ret;
+        }
+    }
+  else
+    {
+      gnutls_assert ();
+      return data_size;         /* do not put a signature - ILLEGAL! */
+    }
+
+  *data = gnutls_realloc_fast (*data, data_size + signature.size + 2);
+  if (*data == NULL)
+    {
+      _gnutls_free_datum (&signature);
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  _gnutls_write_datum16 (&(*data)[data_size], signature);
+  data_size += signature.size + 2;
+
+  _gnutls_free_datum (&signature);
+
+  return data_size;
+}
+
+static int
+proc_dhe_server_kx (gnutls_session_t session, opaque * data,
+                    size_t _data_size)
+{
+  int sigsize;
+  gnutls_datum_t vparams, signature;
+  int ret;
+  cert_auth_info_t info = _gnutls_get_auth_info (session);
+  ssize_t data_size = _data_size;
+  gnutls_cert peer_cert;
+
+  if (info == NULL || info->ncerts == 0)
+    {
+      gnutls_assert ();
+      /* we need this in order to get peer's certificate */
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  ret = _gnutls_proc_dh_common_server_kx (session, data, _data_size, 0);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  /* VERIFY SIGNATURE */
+
+  vparams.size = ret;
+  vparams.data = data;
+
+  DECR_LEN (data_size, 2);
+  sigsize = _gnutls_read_uint16 (&data[vparams.size]);
+
+  DECR_LEN (data_size, sigsize);
+  signature.data = &data[vparams.size + 2];
+  signature.size = sigsize;
+
+  if ((ret =
+       _gnutls_raw_cert_to_gcert (&peer_cert,
+                                  session->security_parameters.cert_type,
+                                  &info->raw_certificate_list[0],
+                                  CERT_NO_COPY)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  ret = _gnutls_verify_sig_params (session, &peer_cert, &vparams, &signature);
+
+  _gnutls_gcert_deinit (&peer_cert);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return ret;
+}
+
+
+
+static int
+proc_dhe_client_kx (gnutls_session_t session, opaque * data,
+                    size_t _data_size)
+{
+  gnutls_certificate_credentials_t cred;
+  int ret;
+  mpi_t p, g;
+  const mpi_t *mpis;
+  gnutls_dh_params_t dh_params;
+
+  cred = (gnutls_certificate_credentials_t)
+    _gnutls_get_cred (session->key, GNUTLS_CRD_CERTIFICATE, NULL);
+  if (cred == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
+    }
+
+  dh_params =
+    _gnutls_get_dh_params (cred->dh_params, cred->params_func, session);
+  mpis = _gnutls_dh_params_to_mpi (dh_params);
+  if (mpis == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_NO_TEMPORARY_DH_PARAMS;
+    }
+
+  p = mpis[0];
+  g = mpis[1];
+
+  ret = _gnutls_proc_dh_common_client_kx (session, data, _data_size, g, p);
+
+  return ret;
+
+}
diff --git a/src/daemon/https/tls/auth_rsa.c b/src/daemon/https/tls/auth_rsa.c
new file mode 100644
index 00000000..4430009d
--- /dev/null
+++ b/src/daemon/https/tls/auth_rsa.c
@@ -0,0 +1,408 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* This file contains the RSA key exchange part of the certificate
+ * authentication.
+ */
+
+#include "gnutls_int.h"
+#include "gnutls_auth_int.h"
+#include "gnutls_errors.h"
+#include "gnutls_dh.h"
+#include "gnutls_num.h"
+#include "libtasn1.h"
+#include "gnutls_datum.h"
+#include "auth_cert.h"
+#include <gnutls_pk.h>
+#include <gnutls_algorithms.h>
+#include <gnutls_global.h>
+#include "debug.h"
+#include <gnutls_sig.h>
+#include <gnutls_x509.h>
+#include <gc.h>
+
+int _gnutls_gen_rsa_client_kx (gnutls_session_t, opaque **);
+int _gnutls_proc_rsa_client_kx (gnutls_session_t, opaque *, size_t);
+
+const mod_auth_st rsa_auth_struct = {
+  "RSA",
+  _gnutls_gen_cert_server_certificate,
+  _gnutls_gen_cert_client_certificate,
+  NULL,                         /* gen server kx */
+  _gnutls_gen_rsa_client_kx,
+  _gnutls_gen_cert_client_cert_vrfy,    /* gen client cert vrfy */
+  _gnutls_gen_cert_server_cert_req,     /* server cert request */
+
+  _gnutls_proc_cert_server_certificate,
+  _gnutls_proc_cert_client_certificate,
+  NULL,                         /* proc server kx */
+  _gnutls_proc_rsa_client_kx,   /* proc client kx */
+  _gnutls_proc_cert_client_cert_vrfy,   /* proc client cert vrfy */
+  _gnutls_proc_cert_cert_req    /* proc server cert request */
+};
+
+/* This function reads the RSA parameters from peer's certificate;
+ */
+int
+_gnutls_get_public_rsa_params (gnutls_session_t session,
+                               mpi_t params[MAX_PUBLIC_PARAMS_SIZE],
+                               int *params_len)
+{
+  int ret;
+  cert_auth_info_t info;
+  gnutls_cert peer_cert;
+  int i;
+
+  /* normal non export case */
+
+  info = _gnutls_get_auth_info (session);
+
+  if (info == NULL || info->ncerts == 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  ret =
+    _gnutls_raw_cert_to_gcert (&peer_cert,
+                               session->security_parameters.cert_type,
+                               &info->raw_certificate_list[0],
+                               CERT_ONLY_PUBKEY | CERT_NO_COPY);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+
+  /* EXPORT case: */
+  if (_gnutls_cipher_suite_get_kx_algo
+      (&session->security_parameters.current_cipher_suite)
+      == GNUTLS_KX_RSA_EXPORT
+      && _gnutls_mpi_get_nbits (peer_cert.params[0]) > 512)
+    {
+
+      _gnutls_gcert_deinit (&peer_cert);
+
+      if (session->key->rsa[0] == NULL || session->key->rsa[1] == NULL)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_INTERNAL_ERROR;
+        }
+
+      if (*params_len < 2)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_INTERNAL_ERROR;
+        }
+      *params_len = 2;
+      for (i = 0; i < *params_len; i++)
+        {
+          params[i] = _gnutls_mpi_copy (session->key->rsa[i]);
+        }
+
+      return 0;
+    }
+
+  /* end of export case */
+
+  if (*params_len < peer_cert.params_size)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+  *params_len = peer_cert.params_size;
+
+  for (i = 0; i < *params_len; i++)
+    {
+      params[i] = _gnutls_mpi_copy (peer_cert.params[i]);
+    }
+  _gnutls_gcert_deinit (&peer_cert);
+
+  return 0;
+}
+
+/* This function reads the RSA parameters from the private key
+ */
+int
+_gnutls_get_private_rsa_params (gnutls_session_t session,
+                                mpi_t ** params, int *params_size)
+{
+  int bits;
+  gnutls_certificate_credentials_t cred;
+  gnutls_rsa_params_t rsa_params;
+
+  cred = (gnutls_certificate_credentials_t)
+    _gnutls_get_cred (session->key, GNUTLS_CRD_CERTIFICATE, NULL);
+  if (cred == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
+    }
+
+  if (session->internals.selected_cert_list == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
+    }
+
+  bits =
+    _gnutls_mpi_get_nbits (session->internals.selected_cert_list[0].
+                           params[0]);
+
+  if (_gnutls_cipher_suite_get_kx_algo
+      (&session->security_parameters.current_cipher_suite)
+      == GNUTLS_KX_RSA_EXPORT && bits > 512)
+    {
+
+      rsa_params =
+        _gnutls_certificate_get_rsa_params (cred->rsa_params,
+                                            cred->params_func, session);
+      /* EXPORT case: */
+      if (rsa_params == NULL)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_NO_TEMPORARY_RSA_PARAMS;
+        }
+
+      /* In the export case, we do use temporary RSA params
+       * of 512 bits size. The params in the certificate are
+       * used to sign this temporary stuff.
+       */
+      *params_size = RSA_PRIVATE_PARAMS;
+      *params = rsa_params->params;
+
+      return 0;
+    }
+
+  /* non export cipher suites. */
+
+  *params_size = session->internals.selected_key->params_size;
+  *params = session->internals.selected_key->params;
+
+  return 0;
+}
+
+int
+_gnutls_proc_rsa_client_kx (gnutls_session_t session, opaque * data,
+                            size_t _data_size)
+{
+  gnutls_datum_t plaintext;
+  gnutls_datum_t ciphertext;
+  int ret, dsize;
+  mpi_t *params;
+  int params_len;
+  int randomize_key = 0;
+  ssize_t data_size = _data_size;
+
+  if (gnutls_protocol_get_version (session) == GNUTLS_SSL3)
+    {
+      /* SSL 3.0 
+       */
+      ciphertext.data = data;
+      ciphertext.size = data_size;
+    }
+  else
+    {
+      /* TLS 1.0
+       */
+      DECR_LEN (data_size, 2);
+      ciphertext.data = &data[2];
+      dsize = _gnutls_read_uint16 (data);
+
+      if (dsize != data_size)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+        }
+      ciphertext.size = dsize;
+    }
+
+  ret = _gnutls_get_private_rsa_params (session, &params, &params_len);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  ret = _gnutls_pkcs1_rsa_decrypt (&plaintext, &ciphertext, params, params_len, 2);     /* btype==2 */
+
+  if (ret < 0 || plaintext.size != TLS_MASTER_SIZE)
+    {
+      /* In case decryption fails then don't inform
+       * the peer. Just use a random key. (in order to avoid
+       * attack against pkcs-1 formating).
+       */
+      gnutls_assert ();
+      _gnutls_x509_log ("auth_rsa: Possible PKCS #1 format attack\n");
+      randomize_key = 1;
+    }
+  else
+    {
+      /* If the secret was properly formatted, then
+       * check the version number.
+       */
+      if (_gnutls_get_adv_version_major (session) != plaintext.data[0]
+          || _gnutls_get_adv_version_minor (session) != plaintext.data[1])
+        {
+          /* No error is returned here, if the version number check
+           * fails. We proceed normally.
+           * That is to defend against the attack described in the paper
+           * "Attacking RSA-based sessions in SSL/TLS" by Vlastimil Klima,
+           * Ondej Pokorny and Tomas Rosa.
+           */
+          gnutls_assert ();
+          _gnutls_x509_log
+            ("auth_rsa: Possible PKCS #1 version check format attack\n");
+        }
+    }
+
+  if (randomize_key != 0)
+    {
+      session->key->key.size = TLS_MASTER_SIZE;
+      session->key->key.data = gnutls_malloc (session->key->key.size);
+      if (session->key->key.data == NULL)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_MEMORY_ERROR;
+        }
+
+      /* we do not need strong random numbers here.
+       */
+      if (gc_nonce (session->key->key.data, session->key->key.size) != GC_OK)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_RANDOM_FAILED;
+        }
+
+    }
+  else
+    {
+      session->key->key.data = plaintext.data;
+      session->key->key.size = plaintext.size;
+    }
+
+  /* This is here to avoid the version check attack
+   * discussed above.
+   */
+  session->key->key.data[0] = _gnutls_get_adv_version_major (session);
+  session->key->key.data[1] = _gnutls_get_adv_version_minor (session);
+
+  return 0;
+}
+
+
+
+/* return RSA(random) using the peers public key 
+ */
+int
+_gnutls_gen_rsa_client_kx (gnutls_session_t session, opaque ** data)
+{
+  cert_auth_info_t auth = session->key->auth_info;
+  gnutls_datum_t sdata;         /* data to send */
+  mpi_t params[MAX_PUBLIC_PARAMS_SIZE];
+  int params_len = MAX_PUBLIC_PARAMS_SIZE;
+  int ret, i;
+  gnutls_protocol_t ver;
+
+  if (auth == NULL)
+    {
+      /* this shouldn't have happened. The proc_certificate
+       * function should have detected that.
+       */
+      gnutls_assert ();
+      return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
+    }
+
+  session->key->key.size = TLS_MASTER_SIZE;
+  session->key->key.data = gnutls_secure_malloc (session->key->key.size);
+
+  if (session->key->key.data == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  if (gc_pseudo_random (session->key->key.data,
+                        session->key->key.size) != GC_OK)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_RANDOM_FAILED;
+    }
+
+  ver = _gnutls_get_adv_version (session);
+
+  if (session->internals.rsa_pms_version[0] == 0)
+    {
+      session->key->key.data[0] = _gnutls_version_get_major (ver);
+      session->key->key.data[1] = _gnutls_version_get_minor (ver);
+    }
+  else
+    {                           /* use the version provided */
+      session->key->key.data[0] = session->internals.rsa_pms_version[0];
+      session->key->key.data[1] = session->internals.rsa_pms_version[1];
+    }
+
+  /* move RSA parameters to key (session).
+   */
+  if ((ret =
+       _gnutls_get_public_rsa_params (session, params, &params_len)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  if ((ret =
+       _gnutls_pkcs1_rsa_encrypt (&sdata, &session->key->key,
+                                  params, params_len, 2)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  for (i = 0; i < params_len; i++)
+    _gnutls_mpi_release (&params[i]);
+
+  if (gnutls_protocol_get_version (session) == GNUTLS_SSL3)
+    {
+      /* SSL 3.0 */
+      *data = sdata.data;
+      return sdata.size;
+    }
+  else
+    {                           /* TLS 1 */
+      *data = gnutls_malloc (sdata.size + 2);
+      if (*data == NULL)
+        {
+          _gnutls_free_datum (&sdata);
+          return GNUTLS_E_MEMORY_ERROR;
+        }
+      _gnutls_write_datum16 (*data, sdata);
+      ret = sdata.size + 2;
+      _gnutls_free_datum (&sdata);
+      return ret;
+    }
+
+}
diff --git a/src/daemon/https/tls/auth_rsa_export.c b/src/daemon/https/tls/auth_rsa_export.c
new file mode 100644
index 00000000..3c84121d
--- /dev/null
+++ b/src/daemon/https/tls/auth_rsa_export.c
@@ -0,0 +1,325 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* This file contains the RSA key exchange part of the certificate
+ * authentication.
+ */
+
+#include "gnutls_int.h"
+#include "gnutls_auth_int.h"
+#include "gnutls_errors.h"
+#include "gnutls_dh.h"
+#include "gnutls_num.h"
+#include "libtasn1.h"
+#include "gnutls_datum.h"
+#include "auth_cert.h"
+#include <gnutls_pk.h>
+#include <gnutls_algorithms.h>
+#include <gnutls_global.h>
+#include "debug.h"
+#include <gnutls_sig.h>
+#include <gnutls_x509.h>
+#include <gnutls_rsa_export.h>
+#include <gnutls_state.h>
+
+int _gnutls_gen_rsa_client_kx (gnutls_session_t, opaque **);
+int _gnutls_proc_rsa_client_kx (gnutls_session_t, opaque *, size_t);
+static int gen_rsa_export_server_kx (gnutls_session_t, opaque **);
+static int proc_rsa_export_server_kx (gnutls_session_t, opaque *, size_t);
+
+const mod_auth_st rsa_export_auth_struct = {
+  "RSA EXPORT",
+  _gnutls_gen_cert_server_certificate,
+  _gnutls_gen_cert_client_certificate,
+  gen_rsa_export_server_kx,
+  _gnutls_gen_rsa_client_kx,
+  _gnutls_gen_cert_client_cert_vrfy,    /* gen client cert vrfy */
+  _gnutls_gen_cert_server_cert_req,     /* server cert request */
+
+  _gnutls_proc_cert_server_certificate,
+  _gnutls_proc_cert_client_certificate,
+  proc_rsa_export_server_kx,
+  _gnutls_proc_rsa_client_kx,   /* proc client kx */
+  _gnutls_proc_cert_client_cert_vrfy,   /* proc client cert vrfy */
+  _gnutls_proc_cert_cert_req    /* proc server cert request */
+};
+
+static int
+gen_rsa_export_server_kx (gnutls_session_t session, opaque ** data)
+{
+  gnutls_rsa_params_t rsa_params;
+  const mpi_t *rsa_mpis;
+  size_t n_e, n_m;
+  uint8_t *data_e, *data_m;
+  int ret = 0, data_size;
+  gnutls_cert *apr_cert_list;
+  gnutls_privkey *apr_pkey;
+  int apr_cert_list_length;
+  gnutls_datum_t signature, ddata;
+  cert_auth_info_t info;
+  gnutls_certificate_credentials_t cred;
+
+  cred = (gnutls_certificate_credentials_t)
+    _gnutls_get_cred (session->key, GNUTLS_CRD_CERTIFICATE, NULL);
+  if (cred == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
+    }
+
+  /* find the appropriate certificate */
+  if ((ret =
+       _gnutls_get_selected_cert (session, &apr_cert_list,
+                                  &apr_cert_list_length, &apr_pkey)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  /* abort sending this message if we have a certificate
+   * of 512 bits or less.
+   */
+  if (apr_pkey && _gnutls_mpi_get_nbits (apr_pkey->params[0]) <= 512)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INT_RET_0;
+    }
+
+  rsa_params =
+    _gnutls_certificate_get_rsa_params (cred->rsa_params, cred->params_func,
+                                        session);
+  rsa_mpis = _gnutls_rsa_params_to_mpi (rsa_params);
+  if (rsa_mpis == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_NO_TEMPORARY_RSA_PARAMS;
+    }
+
+  if ((ret = _gnutls_auth_info_set (session, GNUTLS_CRD_CERTIFICATE,
+                                    sizeof (cert_auth_info_st), 0)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  info = _gnutls_get_auth_info (session);
+  _gnutls_rsa_export_set_pubkey (session, rsa_mpis[1], rsa_mpis[0]);
+
+  _gnutls_mpi_print (NULL, &n_m, rsa_mpis[0]);
+  _gnutls_mpi_print (NULL, &n_e, rsa_mpis[1]);
+
+  (*data) = gnutls_malloc (n_e + n_m + 4);
+  if (*data == NULL)
+    {
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  data_m = &(*data)[0];
+  _gnutls_mpi_print (&data_m[2], &n_m, rsa_mpis[0]);
+
+  _gnutls_write_uint16 (n_m, data_m);
+
+  data_e = &data_m[2 + n_m];
+  _gnutls_mpi_print (&data_e[2], &n_e, rsa_mpis[1]);
+
+  _gnutls_write_uint16 (n_e, data_e);
+
+  data_size = n_m + n_e + 4;
+
+
+  /* Generate the signature. */
+
+  ddata.data = *data;
+  ddata.size = data_size;
+
+  if (apr_cert_list_length > 0)
+    {
+      if ((ret =
+           _gnutls_tls_sign_params (session, &apr_cert_list[0],
+                                    apr_pkey, &ddata, &signature)) < 0)
+        {
+          gnutls_assert ();
+          gnutls_free (*data);
+          *data = NULL;
+          return ret;
+        }
+    }
+  else
+    {
+      gnutls_assert ();
+      return data_size;         /* do not put a signature - ILLEGAL! */
+    }
+
+  *data = gnutls_realloc_fast (*data, data_size + signature.size + 2);
+  if (*data == NULL)
+    {
+      _gnutls_free_datum (&signature);
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  _gnutls_write_datum16 (&((*data)[data_size]), signature);
+  data_size += signature.size + 2;
+
+  _gnutls_free_datum (&signature);
+
+  return data_size;
+}
+
+/* if the peer's certificate is of 512 bits or less, returns non zero.
+ */
+int
+_gnutls_peers_cert_less_512 (gnutls_session_t session)
+{
+  gnutls_cert peer_cert;
+  int ret;
+  cert_auth_info_t info = _gnutls_get_auth_info (session);
+
+  if (info == NULL || info->ncerts == 0)
+    {
+      gnutls_assert ();
+      /* we need this in order to get peer's certificate */
+      return 0;
+    }
+
+  if ((ret =
+       _gnutls_raw_cert_to_gcert (&peer_cert,
+                                  session->security_parameters.cert_type,
+                                  &info->raw_certificate_list[0],
+                                  CERT_NO_COPY)) < 0)
+    {
+      gnutls_assert ();
+      return 0;
+    }
+
+  if (peer_cert.subject_pk_algorithm != GNUTLS_PK_RSA)
+    {
+      gnutls_assert ();
+      _gnutls_gcert_deinit (&peer_cert);
+      return 0;
+    }
+
+  if (_gnutls_mpi_get_nbits (peer_cert.params[0]) <= 512)
+    {
+      _gnutls_gcert_deinit (&peer_cert);
+      return 1;
+    }
+
+  _gnutls_gcert_deinit (&peer_cert);
+
+  return 0;
+}
+
+static int
+proc_rsa_export_server_kx (gnutls_session_t session,
+                           opaque * data, size_t _data_size)
+{
+  uint16_t n_m, n_e;
+  size_t _n_m, _n_e;
+  uint8_t *data_m;
+  uint8_t *data_e;
+  int i, sigsize;
+  gnutls_datum_t vparams, signature;
+  int ret;
+  ssize_t data_size = _data_size;
+  cert_auth_info_t info;
+  gnutls_cert peer_cert;
+
+  info = _gnutls_get_auth_info (session);
+  if (info == NULL || info->ncerts == 0)
+    {
+      gnutls_assert ();
+      /* we need this in order to get peer's certificate */
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+
+  i = 0;
+
+  DECR_LEN (data_size, 2);
+  n_m = _gnutls_read_uint16 (&data[i]);
+  i += 2;
+
+  DECR_LEN (data_size, n_m);
+  data_m = &data[i];
+  i += n_m;
+
+  DECR_LEN (data_size, 2);
+  n_e = _gnutls_read_uint16 (&data[i]);
+  i += 2;
+
+  DECR_LEN (data_size, n_e);
+  data_e = &data[i];
+  i += n_e;
+
+  _n_e = n_e;
+  _n_m = n_m;
+
+  if (_gnutls_mpi_scan_nz (&session->key->rsa[0], data_m, &_n_m) != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MPI_SCAN_FAILED;
+    }
+
+  if (_gnutls_mpi_scan_nz (&session->key->rsa[1], data_e, &_n_e) != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MPI_SCAN_FAILED;
+    }
+
+  _gnutls_rsa_export_set_pubkey (session, session->key->rsa[1],
+                                 session->key->rsa[0]);
+
+  /* VERIFY SIGNATURE */
+
+  vparams.size = n_m + n_e + 4;
+  vparams.data = data;
+
+  DECR_LEN (data_size, 2);
+  sigsize = _gnutls_read_uint16 (&data[vparams.size]);
+
+  DECR_LEN (data_size, sigsize);
+  signature.data = &data[vparams.size + 2];
+  signature.size = sigsize;
+
+  if ((ret =
+       _gnutls_raw_cert_to_gcert (&peer_cert,
+                                  session->security_parameters.cert_type,
+                                  &info->raw_certificate_list[0],
+                                  CERT_NO_COPY)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  ret = _gnutls_verify_sig_params (session, &peer_cert, &vparams, &signature);
+
+  _gnutls_gcert_deinit (&peer_cert);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+    }
+
+  return ret;
+}
diff --git a/src/daemon/https/tls/debug.c b/src/daemon/https/tls/debug.c
new file mode 100644
index 00000000..2ea31577
--- /dev/null
+++ b/src/daemon/https/tls/debug.c
@@ -0,0 +1,128 @@
+/*
+ * Copyright (C) 2001, 2002, 2003, 2004, 2005, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include "gnutls_int.h"
+#include "gnutls_errors.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <gcrypt.h>
+
+#ifdef DEBUG
+
+
+void
+_gnutls_print_state (gnutls_session_t session)
+{
+
+  _gnutls_debug_log ("GNUTLS State:\n");
+  _gnutls_debug_log ("Connection End: %d\n",
+                     session->security_parameters.entity);
+  _gnutls_debug_log ("Cipher Algorithm: %d\n",
+                     session->security_parameters.read_bulk_cipher_algorithm);
+  _gnutls_debug_log ("MAC algorithm: %d\n",
+                     session->security_parameters.read_mac_algorithm);
+  _gnutls_debug_log ("Compression Algorithm: %d\n",
+                     session->security_parameters.read_compression_algorithm);
+  _gnutls_debug_log ("\n");
+
+}
+
+#endif
+
+const char *
+_gnutls_packet2str (content_type_t packet)
+{
+  switch (packet)
+    {
+    case GNUTLS_CHANGE_CIPHER_SPEC:
+      return "Change Cipher Spec";
+    case GNUTLS_ALERT:
+      return "Alert";
+    case GNUTLS_HANDSHAKE:
+      return "Handshake";
+    case GNUTLS_APPLICATION_DATA:
+      return "Application Data";
+    case GNUTLS_INNER_APPLICATION:
+      return "Inner Application";
+
+    default:
+      return "Unknown Packet";
+    }
+}
+
+const char *
+_gnutls_handshake2str (gnutls_handshake_description_t handshake)
+{
+
+  switch (handshake)
+    {
+    case GNUTLS_HANDSHAKE_HELLO_REQUEST:
+      return "HELLO REQUEST";
+      break;
+    case GNUTLS_HANDSHAKE_CLIENT_HELLO:
+      return "CLIENT HELLO";
+      break;
+    case GNUTLS_HANDSHAKE_SERVER_HELLO:
+      return "SERVER HELLO";
+      break;
+    case GNUTLS_HANDSHAKE_CERTIFICATE_PKT:
+      return "CERTIFICATE";
+      break;
+    case GNUTLS_HANDSHAKE_SERVER_KEY_EXCHANGE:
+      return "SERVER KEY EXCHANGE";
+      break;
+    case GNUTLS_HANDSHAKE_CERTIFICATE_REQUEST:
+      return "CERTIFICATE REQUEST";
+      break;
+    case GNUTLS_HANDSHAKE_SERVER_HELLO_DONE:
+      return "SERVER HELLO DONE";
+      break;
+    case GNUTLS_HANDSHAKE_CERTIFICATE_VERIFY:
+      return "CERTIFICATE VERIFY";
+      break;
+    case GNUTLS_HANDSHAKE_CLIENT_KEY_EXCHANGE:
+      return "CLIENT KEY EXCHANGE";
+      break;
+    case GNUTLS_HANDSHAKE_FINISHED:
+      return "FINISHED";
+      break;
+    case GNUTLS_HANDSHAKE_SUPPLEMENTAL:
+      return "SUPPLEMENTAL";
+      break;
+    default:
+      return "Unknown Handshake packet";
+
+    }
+}
+
+void
+_gnutls_dump_mpi (const char *prefix, mpi_t a)
+{
+  opaque buf[1024];
+  size_t n = sizeof buf;
+
+  if (gcry_mpi_print (GCRYMPI_FMT_HEX, buf, n, &n, a))
+    strcpy (buf, "[can't print value]");        /* Flawfinder: ignore */
+  _gnutls_hard_log ("MPI: length: %d\n\t%s%s\n", (n - 1) / 2, prefix, buf);
+}
diff --git a/src/daemon/https/tls/debug.h b/src/daemon/https/tls/debug.h
new file mode 100644
index 00000000..169bc21d
--- /dev/null
+++ b/src/daemon/https/tls/debug.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2000, 2001, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#ifdef DEBUG
+void _gnutls_print_state (gnutls_session_t session);
+#endif
+const char *_gnutls_packet2str (content_type_t packet);
+const char *_gnutls_handshake2str (gnutls_handshake_description_t handshake);
+void _gnutls_dump_mpi (const char *prefix, mpi_t a);
diff --git a/src/daemon/https/tls/defines.h b/src/daemon/https/tls/defines.h
new file mode 100644
index 00000000..a53ce2e4
--- /dev/null
+++ b/src/daemon/https/tls/defines.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#ifndef DEFINES_H
+# define DEFINES_H
+
+#if HAVE_CONFIG_H
+# include <config.h>
+#endif
+
+#include <stddef.h>
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <ctype.h>
+#include <limits.h>
+#include <stdint.h>
+
+#ifdef NO_SSIZE_T
+# define HAVE_SSIZE_T
+typedef int ssize_t;
+#endif
+
+#include <sys/types.h>
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/socket.h>
+#include <time.h>
+
+// TODO check if these should go into config.h
+#define SIZEOF_UNSIGNED_INT 4
+#define SIZEOF_UNSIGNED_LONG 8
+#define SIZEOF_UNSIGNED_LONG_INT SIZEOF_UNSIGNED_LONG
+
+/* some systems had problems with long long int, thus,
+ * it is not used.
+ */
+typedef struct
+{
+  unsigned char i[8];
+} uint64;
+
+#endif /* defines_h */
diff --git a/src/daemon/https/tls/ext_cert_type.c b/src/daemon/https/tls/ext_cert_type.c
new file mode 100644
index 00000000..f970e1fe
--- /dev/null
+++ b/src/daemon/https/tls/ext_cert_type.c
@@ -0,0 +1,243 @@
+/*
+ * Copyright (C) 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* This file contains the code the Certificate Type TLS extension.
+ * This extension is currently gnutls specific.
+ */
+
+#include "gnutls_int.h"
+#include "gnutls_errors.h"
+#include "gnutls_num.h"
+#include "ext_cert_type.h"
+#include <gnutls_state.h>
+#include <gnutls_num.h>
+
+inline static int _gnutls_num2cert_type (int num);
+inline static int _gnutls_cert_type2num (int record_size);
+
+/* 
+ * In case of a server: if a CERT_TYPE extension type is received then it stores
+ * into the session security parameters the new value. The server may use gnutls_session_certificate_type_get(),
+ * to access it.
+ *
+ * In case of a client: If a cert_types have been specified then we send the extension.
+ *
+ */
+
+int
+_gnutls_cert_type_recv_params (gnutls_session_t session,
+                               const opaque * data, size_t _data_size)
+{
+  int new_type = -1, ret, i;
+  ssize_t data_size = _data_size;
+
+  if (session->security_parameters.entity == GNUTLS_CLIENT)
+    {
+      if (data_size > 0)
+        {
+          if (data_size != 1)
+            {
+              gnutls_assert ();
+              return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+            }
+
+          new_type = _gnutls_num2cert_type (data[0]);
+
+          if (new_type < 0)
+            {
+              gnutls_assert ();
+              return new_type;
+            }
+
+          /* Check if we support this cert_type */
+          if ((ret =
+               _gnutls_session_cert_type_supported (session, new_type)) < 0)
+            {
+              gnutls_assert ();
+              return ret;
+            }
+
+          _gnutls_session_cert_type_set (session, new_type);
+        }
+    }
+  else
+    {                           /* SERVER SIDE - we must check if the sent cert type is the right one 
+                                 */
+      if (data_size > 1)
+        {
+          uint8_t len;
+
+          len = data[0];
+          DECR_LEN (data_size, len);
+
+          for (i = 0; i < len; i++)
+            {
+              new_type = _gnutls_num2cert_type (data[i + 1]);
+
+              if (new_type < 0)
+                continue;
+
+              /* Check if we support this cert_type */
+              if ((ret =
+                   _gnutls_session_cert_type_supported (session,
+                                                        new_type)) < 0)
+                {
+                  gnutls_assert ();
+                  continue;
+                }
+              else
+                break;
+              /* new_type is ok */
+            }
+
+          if (new_type < 0)
+            {
+              gnutls_assert ();
+              return GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER;
+            }
+
+          if ((ret =
+               _gnutls_session_cert_type_supported (session, new_type)) < 0)
+            {
+              gnutls_assert ();
+              /* The peer has requested unsupported certificate
+               * types. Instead of failing, procceed normally.
+               * (the ciphersuite selection would fail, or a
+               * non certificate ciphersuite will be selected).
+               */
+              return 0;
+            }
+
+          _gnutls_session_cert_type_set (session, new_type);
+        }
+
+
+    }
+
+  return 0;
+}
+
+/* returns data_size or a negative number on failure
+ */
+int
+_gnutls_cert_type_send_params (gnutls_session_t session, opaque * data,
+                               size_t data_size)
+{
+  unsigned len, i;
+
+  /* this function sends the client extension data (dnsname) */
+  if (session->security_parameters.entity == GNUTLS_CLIENT)
+    {
+
+      if (session->internals.priorities.cert_type.algorithms > 0)
+        {
+
+          len = session->internals.priorities.cert_type.algorithms;
+
+          if (len == 1 &&
+              session->internals.priorities.cert_type.priority[0] ==
+              GNUTLS_CRT_X509)
+            {
+              /* We don't use this extension if X.509 certificates
+               * are used.
+               */
+              return 0;
+            }
+
+          if (data_size < len + 1)
+            {
+              gnutls_assert ();
+              return GNUTLS_E_SHORT_MEMORY_BUFFER;
+            }
+
+          /* this is a vector!
+           */
+          data[0] = (uint8_t) len;
+
+          for (i = 0; i < len; i++)
+            {
+              data[i + 1] = _gnutls_cert_type2num (session->internals.
+                                                   priorities.cert_type.
+                                                   priority[i]);
+            }
+          return len + 1;
+        }
+
+    }
+  else
+    {                           /* server side */
+      if (session->security_parameters.cert_type != DEFAULT_CERT_TYPE)
+        {
+          len = 1;
+          if (data_size < len)
+            {
+              gnutls_assert ();
+              return GNUTLS_E_SHORT_MEMORY_BUFFER;
+            }
+
+          data[0] =
+            _gnutls_cert_type2num (session->security_parameters.cert_type);
+          return len;
+        }
+
+
+    }
+
+  return 0;
+}
+
+/* Maps numbers to record sizes according to the
+ * extensions draft.
+ */
+inline static int
+_gnutls_num2cert_type (int num)
+{
+  switch (num)
+    {
+    case 0:
+      return GNUTLS_CRT_X509;
+    case 1:
+      return GNUTLS_CRT_OPENPGP;
+    default:
+      return GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER;
+    }
+}
+
+/* Maps record size to numbers according to the
+ * extensions draft.
+ */
+inline static int
+_gnutls_cert_type2num (int cert_type)
+{
+  switch (cert_type)
+    {
+    case GNUTLS_CRT_X509:
+      return 0;
+    case GNUTLS_CRT_OPENPGP:
+      return 1;
+    default:
+      return GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER;
+    }
+
+}
diff --git a/src/daemon/https/tls/ext_cert_type.h b/src/daemon/https/tls/ext_cert_type.h
new file mode 100644
index 00000000..ea7cf219
--- /dev/null
+++ b/src/daemon/https/tls/ext_cert_type.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* Maps record size to numbers according to the
+ * extensions draft.
+ */
+int _gnutls_cert_type_recv_params (gnutls_session_t session,
+                                   const opaque * data, size_t data_size);
+int _gnutls_cert_type_send_params (gnutls_session_t session, opaque * data,
+                                   size_t);
diff --git a/src/daemon/https/tls/ext_inner_application.c b/src/daemon/https/tls/ext_inner_application.c
new file mode 100644
index 00000000..b86b7151
--- /dev/null
+++ b/src/daemon/https/tls/ext_inner_application.c
@@ -0,0 +1,147 @@
+/*
+ * Copyright (C) 2005, 2006 Free Software Foundation
+ *
+ * Author: Simon Josefsson
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA
+ *
+ */
+
+#include "gnutls_int.h"
+#include "gnutls_auth_int.h"
+#include "gnutls_errors.h"
+#include "gnutls_num.h"
+#include "ext_inner_application.h"
+
+#define NO 0
+#define YES 1
+
+int
+_gnutls_inner_application_recv_params (gnutls_session_t session,
+                                       const opaque * data, size_t data_size)
+{
+  tls_ext_st *ext = &session->security_parameters.extensions;
+
+  if (data_size != 1)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+    }
+
+  ext->gnutls_ia_peer_enable = 1;
+  ext->gnutls_ia_peer_allowskip = 0;
+
+  switch ((unsigned char) *data)
+    {
+    case NO:                   /* Peer's ia_on_resume == no */
+      ext->gnutls_ia_peer_allowskip = 1;
+      break;
+
+    case YES:
+      break;
+
+    default:
+      gnutls_assert ();
+    }
+
+  return 0;
+}
+
+
+/* returns data_size or a negative number on failure
+ */
+int
+_gnutls_inner_application_send_params (gnutls_session_t session,
+                                       opaque * data, size_t data_size)
+{
+  tls_ext_st *ext = &session->security_parameters.extensions;
+
+  /* Set ext->gnutls_ia_enable depending on whether we have a TLS/IA
+     credential in the session. */
+
+  if (session->security_parameters.entity == GNUTLS_CLIENT)
+    {
+      gnutls_ia_client_credentials_t cred = (gnutls_ia_client_credentials_t)
+        _gnutls_get_cred (session->key, GNUTLS_CRD_IA, NULL);
+
+      if (cred)
+        ext->gnutls_ia_enable = 1;
+    }
+  else
+    {
+      gnutls_ia_server_credentials_t cred = (gnutls_ia_server_credentials_t)
+        _gnutls_get_cred (session->key, GNUTLS_CRD_IA, NULL);
+
+      if (cred)
+        ext->gnutls_ia_enable = 1;
+    }
+
+  /* If we don't want gnutls_ia locally, or we are a server and the
+   * client doesn't want it, don't advertise TLS/IA support at all, as
+   * required. */
+
+  if (!ext->gnutls_ia_enable)
+    return 0;
+
+  if (session->security_parameters.entity == GNUTLS_SERVER &&
+      !ext->gnutls_ia_peer_enable)
+    return 0;
+
+  /* We'll advertise. Check if there's room in the hello buffer. */
+
+  if (data_size < 1)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_SHORT_MEMORY_BUFFER;
+    }
+
+  /* default: require new application phase */
+
+  *data = YES;
+
+  if (session->security_parameters.entity == GNUTLS_CLIENT)
+    {
+
+      /* Client: value follows local setting */
+
+      if (ext->gnutls_ia_allowskip)
+        *data = NO;
+    }
+  else
+    {
+
+      /* Server: value follows local setting and client's setting, but only
+       * if we are resuming.
+       *
+       * XXX Can server test for resumption at this stage?
+       *
+       * Ai! It seems that read_client_hello only calls parse_extensions if
+       * we're NOT resuming! That would make us automatically violate the IA
+       * draft; if we're resuming, we must first learn what the client wants
+       * -- IA or no IA -- and then prepare our response. Right now we'll
+       * always skip IA on resumption, because recv_ext isn't even called
+       * to record the peer's support for IA at all. Simon? */
+
+      if (ext->gnutls_ia_allowskip &&
+          ext->gnutls_ia_peer_allowskip &&
+          session->internals.resumed == RESUME_TRUE)
+        *data = NO;
+    }
+
+  return 1;
+}
diff --git a/src/daemon/https/tls/ext_inner_application.h b/src/daemon/https/tls/ext_inner_application.h
new file mode 100644
index 00000000..e75719e3
--- /dev/null
+++ b/src/daemon/https/tls/ext_inner_application.h
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2005 Free Software Foundation
+ *
+ * Author: Simon Josefsson
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+int _gnutls_inner_application_recv_params (gnutls_session_t session,
+                                           const opaque * data,
+                                           size_t data_size);
+int _gnutls_inner_application_send_params (gnutls_session_t session,
+                                           opaque * data, size_t);
diff --git a/src/daemon/https/tls/ext_max_record.c b/src/daemon/https/tls/ext_max_record.c
new file mode 100644
index 00000000..d0787483
--- /dev/null
+++ b/src/daemon/https/tls/ext_max_record.c
@@ -0,0 +1,196 @@
+/*
+ * Copyright (C) 2001, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* This file contains the code for the Max Record Size TLS extension.
+ */
+
+#include "gnutls_int.h"
+#include "gnutls_errors.h"
+#include "gnutls_num.h"
+#include <ext_max_record.h>
+
+/* 
+ * In case of a server: if a MAX_RECORD_SIZE extension type is received then it stores
+ * into the session the new value. The server may use gnutls_get_max_record_size(),
+ * in order to access it.
+ *
+ * In case of a client: If a different max record size (than the default) has
+ * been specified then it sends the extension.
+ *
+ */
+
+int
+_gnutls_max_record_recv_params (gnutls_session_t session,
+                                const opaque * data, size_t _data_size)
+{
+  ssize_t new_size;
+  ssize_t data_size = _data_size;
+
+  if (session->security_parameters.entity == GNUTLS_SERVER)
+    {
+      if (data_size > 0)
+        {
+          DECR_LEN (data_size, 1);
+
+          new_size = _gnutls_mre_num2record (data[0]);
+
+          if (new_size < 0)
+            {
+              gnutls_assert ();
+              return new_size;
+            }
+
+          session->security_parameters.max_record_send_size = new_size;
+          session->security_parameters.max_record_recv_size = new_size;
+        }
+    }
+  else
+    {                           /* CLIENT SIDE - we must check if the sent record size is the right one 
+                                 */
+      if (data_size > 0)
+        {
+
+          if (data_size != 1)
+            {
+              gnutls_assert ();
+              return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+            }
+
+          new_size = _gnutls_mre_num2record (data[0]);
+
+          if (new_size < 0
+              || new_size != session->internals.proposed_record_size)
+            {
+              gnutls_assert ();
+              return GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER;
+            }
+          else
+            {
+              session->security_parameters.max_record_recv_size =
+                session->internals.proposed_record_size;
+            }
+
+        }
+
+
+    }
+
+  return 0;
+}
+
+/* returns data_size or a negative number on failure
+ */
+int
+_gnutls_max_record_send_params (gnutls_session_t session, opaque * data,
+                                size_t data_size)
+{
+  uint16_t len;
+  /* this function sends the client extension data (dnsname) */
+  if (session->security_parameters.entity == GNUTLS_CLIENT)
+    {
+
+      if (session->internals.proposed_record_size != DEFAULT_MAX_RECORD_SIZE)
+        {
+          len = 1;
+          if (data_size < len)
+            {
+              gnutls_assert ();
+              return GNUTLS_E_SHORT_MEMORY_BUFFER;
+            }
+
+          data[0] =
+            (uint8_t) _gnutls_mre_record2num (session->internals.
+                                              proposed_record_size);
+          return len;
+        }
+
+    }
+  else
+    {                           /* server side */
+
+      if (session->security_parameters.max_record_recv_size !=
+          DEFAULT_MAX_RECORD_SIZE)
+        {
+          len = 1;
+          if (data_size < len)
+            {
+              gnutls_assert ();
+              return GNUTLS_E_SHORT_MEMORY_BUFFER;
+            }
+
+          data[0] =
+            (uint8_t) _gnutls_mre_record2num (session->
+                                              security_parameters.
+                                              max_record_recv_size);
+          return len;
+        }
+
+
+    }
+
+  return 0;
+}
+
+/* Maps numbers to record sizes according to the
+ * extensions draft.
+ */
+int
+_gnutls_mre_num2record (int num)
+{
+  switch (num)
+    {
+    case 1:
+      return 512;
+    case 2:
+      return 1024;
+    case 3:
+      return 2048;
+    case 4:
+      return 4096;
+    default:
+      return GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER;
+    }
+}
+
+/* Maps record size to numbers according to the
+ * extensions draft.
+ */
+int
+_gnutls_mre_record2num (uint16_t record_size)
+{
+  switch (record_size)
+    {
+    case 512:
+      return 1;
+    case 1024:
+      return 2;
+    case 2048:
+      return 3;
+    case 4096:
+      return 4;
+    default:
+      return GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER;
+    }
+
+}
diff --git a/src/daemon/https/tls/ext_max_record.h b/src/daemon/https/tls/ext_max_record.h
new file mode 100644
index 00000000..751bedc8
--- /dev/null
+++ b/src/daemon/https/tls/ext_max_record.h
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* Maps record size to numbers according to the
+ * extensions draft.
+ */
+int _gnutls_mre_num2record (int num);
+int _gnutls_mre_record2num (uint16_t record_size);
+int _gnutls_max_record_recv_params (gnutls_session_t session,
+                                    const opaque * data, size_t data_size);
+int _gnutls_max_record_send_params (gnutls_session_t session, opaque * data,
+                                    size_t);
diff --git a/src/daemon/https/tls/ext_oprfi.c b/src/daemon/https/tls/ext_oprfi.c
new file mode 100644
index 00000000..c862ad1c
--- /dev/null
+++ b/src/daemon/https/tls/ext_oprfi.c
@@ -0,0 +1,253 @@
+/*
+ * Copyright (C) 2007 Free Software Foundation
+ *
+ * Author: Simon Josefsson
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* Implementation of Opaque PRF Input:
+ * http://tools.ietf.org/id/draft-rescorla-tls-opaque-prf-input-00.txt
+ *
+ */
+
+#include <ext_oprfi.h>
+
+#include <gnutls_errors.h>
+#include <gnutls_num.h>
+
+int
+oprfi_recv_server (gnutls_session_t session,
+                   const opaque * data, size_t _data_size)
+{
+  ssize_t data_size = _data_size;
+  uint16_t len;
+  int ret;
+
+  if (!session->security_parameters.extensions.oprfi_cb)
+    {
+      gnutls_assert ();
+      return 0;
+    }
+
+  DECR_LEN (data_size, 2);
+  len = _gnutls_read_uint16 (data);
+  data += 2;
+
+  if (len != data_size)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+    }
+
+  /* Store incoming data. */
+  session->security_parameters.extensions.oprfi_client_len = len;
+  session->security_parameters.extensions.oprfi_client = gnutls_malloc (len);
+  if (!session->security_parameters.extensions.oprfi_client)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+  memcpy (session->security_parameters.extensions.oprfi_client, data, len);
+
+  return 0;
+}
+
+int
+oprfi_recv_client (gnutls_session_t session,
+                   const opaque * data, size_t _data_size)
+{
+  ssize_t data_size = _data_size;
+  uint16_t len;
+  int ret;
+
+  if (session->security_parameters.extensions.oprfi_client == NULL)
+    {
+      gnutls_assert ();
+      return 0;
+    }
+
+  DECR_LEN (data_size, 2);
+  len = _gnutls_read_uint16 (data);
+  data += 2;
+
+  if (len != data_size)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+    }
+
+  if (len != session->security_parameters.extensions.oprfi_client_len)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER;
+    }
+
+  /* Store incoming data. */
+  session->security_parameters.extensions.oprfi_server_len = len;
+  session->security_parameters.extensions.oprfi_server = gnutls_malloc (len);
+  if (!session->security_parameters.extensions.oprfi_server)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+  memcpy (session->security_parameters.extensions.oprfi_server, data, len);
+
+  return 0;
+}
+
+int
+_gnutls_oprfi_recv_params (gnutls_session_t session,
+                           const opaque * data, size_t data_size)
+{
+  if (session->security_parameters.entity == GNUTLS_CLIENT)
+    return oprfi_recv_client (session, data, data_size);
+  else
+    return oprfi_recv_server (session, data, data_size);
+}
+
+int
+oprfi_send_client (gnutls_session_t session, opaque * data, size_t _data_size)
+{
+  opaque *p = data;
+  ssize_t data_size = _data_size;
+  int oprf_size = session->security_parameters.extensions.oprfi_client_len;
+
+  if (oprf_size == 0)
+    return 0;
+
+  DECR_LENGTH_RET (data_size, 2, GNUTLS_E_SHORT_MEMORY_BUFFER);
+  _gnutls_write_uint16 (oprf_size, p);
+  p += 2;
+
+  DECR_LENGTH_RET (data_size, oprf_size, GNUTLS_E_SHORT_MEMORY_BUFFER);
+
+  memcpy (p, session->security_parameters.extensions.oprfi_client, oprf_size);
+
+  return 2 + oprf_size;
+}
+
+int
+oprfi_send_server (gnutls_session_t session, opaque * data, size_t _data_size)
+{
+  opaque *p = data;
+  int ret;
+  ssize_t data_size = _data_size;
+  size_t len;
+
+  if (!session->security_parameters.extensions.oprfi_client ||
+      !session->security_parameters.extensions.oprfi_cb)
+    return 0;
+
+  /* Allocate buffer for outgoing data. */
+  session->security_parameters.extensions.oprfi_server_len =
+    session->security_parameters.extensions.oprfi_client_len;
+  session->security_parameters.extensions.oprfi_server =
+    gnutls_malloc (session->security_parameters.extensions.oprfi_server_len);
+  if (!session->security_parameters.extensions.oprfi_server)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  /* Get outgoing data. */
+  ret = session->security_parameters.extensions.oprfi_cb
+    (session, session->security_parameters.extensions.oprfi_userdata,
+     session->security_parameters.extensions.oprfi_client_len,
+     session->security_parameters.extensions.oprfi_client,
+     session->security_parameters.extensions.oprfi_server);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      gnutls_free (session->security_parameters.extensions.oprfi_server);
+      return ret;
+    }
+
+  DECR_LENGTH_RET (data_size, 2, GNUTLS_E_SHORT_MEMORY_BUFFER);
+  _gnutls_write_uint16 (session->security_parameters.
+                        extensions.oprfi_server_len, p);
+  p += 2;
+
+  DECR_LENGTH_RET (data_size, session->security_parameters.
+                   extensions.oprfi_server_len, GNUTLS_E_SHORT_MEMORY_BUFFER);
+
+  memcpy (p, session->security_parameters.extensions.oprfi_server,
+          session->security_parameters.extensions.oprfi_server_len);
+
+  return 2 + session->security_parameters.extensions.oprfi_server_len;
+}
+
+int
+_gnutls_oprfi_send_params (gnutls_session_t session,
+                           opaque * data, size_t data_size)
+{
+  if (session->security_parameters.entity == GNUTLS_CLIENT)
+    return oprfi_send_client (session, data, data_size);
+  else
+    return oprfi_send_server (session, data, data_size);
+}
+
+/**
+ * gnutls_oprfi_enable_client:
+ * @session: is a #gnutls_session_t structure.
+ * @len: length of Opaque PRF data to use in client.
+ * @data: Opaque PRF data to use in client.
+ *
+ * Request that the client should attempt to negotiate the Opaque PRF
+ * Input TLS extension, using the given data as the client's Opaque
+ * PRF input.
+ *
+ * The data is copied into the session context after this call, so you
+ * may de-allocate it immediately after calling this function.
+ **/
+void
+gnutls_oprfi_enable_client (gnutls_session_t session,
+                            size_t len, unsigned char *data)
+{
+  session->security_parameters.extensions.oprfi_client_len = len;
+  session->security_parameters.extensions.oprfi_client = data;
+}
+
+/**
+ * gnutls_oprfi_enable_server:
+ * @session: is a #gnutls_session_t structure.
+ * @cb: function pointer to Opaque PRF extension server callback.
+ * @userdata: hook passed to callback function for passing application state.
+ *
+ * Request that the server should attempt to accept the Opaque PRF
+ * Input TLS extension.  If the client requests the extension, the
+ * provided callback @cb will be invoked.  The callback must have the
+ * following prototype:
+ *
+ * int callback (gnutls_session_t session, void *userdata,
+ *               size_t oprfi_len, const unsigned char *in_oprfi,
+ *               unsigned char *out_oprfi);
+ *
+ * The callback can inspect the client-provided data in the input
+ * parameters, and specify its own opaque prf input data in the output
+ * variable.  The function must return 0 on success, otherwise the
+ * handshake will be aborted.
+ **/
+void
+gnutls_oprfi_enable_server (gnutls_session_t session,
+                            gnutls_oprfi_callback_func cb, void *userdata)
+{
+  session->security_parameters.extensions.oprfi_cb = cb;
+  session->security_parameters.extensions.oprfi_userdata = userdata;
+}
diff --git a/src/daemon/https/tls/ext_oprfi.h b/src/daemon/https/tls/ext_oprfi.h
new file mode 100644
index 00000000..7f75be9c
--- /dev/null
+++ b/src/daemon/https/tls/ext_oprfi.h
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2007 Free Software Foundation
+ *
+ * Author: Simon Josefsson
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include <gnutls_int.h>
+
+int _gnutls_oprfi_recv_params (gnutls_session_t state,
+                               const opaque * data,
+                               size_t data_size);
+
+int _gnutls_oprfi_send_params (gnutls_session_t state,
+                               opaque * data,
+                               size_t data_size);
diff --git a/src/daemon/https/tls/ext_server_name.c b/src/daemon/https/tls/ext_server_name.c
new file mode 100644
index 00000000..bc6b4759
--- /dev/null
+++ b/src/daemon/https/tls/ext_server_name.c
@@ -0,0 +1,330 @@
+/*
+ * Copyright (C) 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include "gnutls_int.h"
+#include "gnutls_auth_int.h"
+#include "gnutls_errors.h"
+#include "gnutls_num.h"
+#include <ext_server_name.h>
+
+/* 
+ * In case of a server: if a NAME_DNS extension type is received then it stores
+ * into the session the value of NAME_DNS. The server may use gnutls_ext_get_server_name(),
+ * in order to access it.
+ *
+ * In case of a client: If a proper NAME_DNS extension type is found in the session then
+ * it sends the extension to the peer.
+ *
+ */
+
+int
+_gnutls_server_name_recv_params (gnutls_session_t session,
+                                 const opaque * data, size_t _data_size)
+{
+  int i;
+  const unsigned char *p;
+  uint16_t len, type;
+  ssize_t data_size = _data_size;
+  int server_names = 0;
+
+  if (session->security_parameters.entity == GNUTLS_SERVER)
+    {
+      DECR_LENGTH_RET (data_size, 2, 0);
+      len = _gnutls_read_uint16 (data);
+
+      if (len != data_size)
+        {
+          /* This is unexpected packet length, but
+           * just ignore it, for now.
+           */
+          gnutls_assert ();
+          return 0;
+        }
+
+      p = data + 2;
+
+      /* Count all server_names in the packet. */
+      while (data_size > 0)
+        {
+          DECR_LENGTH_RET (data_size, 1, 0);
+          p++;
+
+          DECR_LEN (data_size, 2);
+          len = _gnutls_read_uint16 (p);
+          p += 2;
+
+          DECR_LENGTH_RET (data_size, len, 0);
+          server_names++;
+
+          p += len;
+        }
+
+      session->security_parameters.extensions.server_names_size =
+        server_names;
+      if (server_names == 0)
+        return 0;               /* no names found */
+
+      /* we cannot accept more server names.
+       */
+      if (server_names > MAX_SERVER_NAME_EXTENSIONS)
+        server_names = MAX_SERVER_NAME_EXTENSIONS;
+
+      p = data + 2;
+      for (i = 0; i < server_names; i++)
+        {
+          type = *p;
+          p++;
+
+          len = _gnutls_read_uint16 (p);
+          p += 2;
+
+          switch (type)
+            {
+            case 0:            /* NAME_DNS */
+              if (len <= MAX_SERVER_NAME_SIZE)
+                {
+                  memcpy (session->security_parameters.extensions.
+                          server_names[i].name, p, len);
+                  session->security_parameters.extensions.
+                    server_names[i].name_length = len;
+                  session->security_parameters.extensions.
+                    server_names[i].type = GNUTLS_NAME_DNS;
+                  break;
+                }
+            }
+
+          /* move to next record */
+          p += len;
+        }
+    }
+  return 0;
+}
+
+/* returns data_size or a negative number on failure
+ */
+int
+_gnutls_server_name_send_params (gnutls_session_t session,
+                                 opaque * data, size_t _data_size)
+{
+  uint16_t len;
+  opaque *p;
+  unsigned i;
+  ssize_t data_size = _data_size;
+  int total_size = 0;
+
+  /* this function sends the client extension data (dnsname) 
+   */
+  if (session->security_parameters.entity == GNUTLS_CLIENT)
+    {
+
+      if (session->security_parameters.extensions.server_names_size == 0)
+        return 0;
+
+      /* uint16_t 
+       */
+      total_size = 2;
+      for (i = 0;
+           i < session->security_parameters.extensions.server_names_size; i++)
+        {
+          /* count the total size 
+           */
+          len =
+            session->security_parameters.extensions.server_names[i].
+            name_length;
+
+          /* uint8_t + uint16_t + size 
+           */
+          total_size += 1 + 2 + len;
+        }
+
+      p = data;
+
+      /* UINT16: write total size of all names 
+       */
+      DECR_LENGTH_RET (data_size, 2, GNUTLS_E_SHORT_MEMORY_BUFFER);
+      _gnutls_write_uint16 (total_size - 2, p);
+      p += 2;
+
+      for (i = 0;
+           i < session->security_parameters.extensions.server_names_size; i++)
+        {
+
+          switch (session->security_parameters.extensions.
+                  server_names[i].type)
+            {
+            case GNUTLS_NAME_DNS:
+
+              len =
+                session->security_parameters.extensions.
+                server_names[i].name_length;
+              if (len == 0)
+                break;
+
+              /* UINT8: type of this extension
+               * UINT16: size of the first name
+               * LEN: the actual server name.
+               */
+              DECR_LENGTH_RET (data_size, len + 3,
+                               GNUTLS_E_SHORT_MEMORY_BUFFER);
+
+              *p = 0;           /* NAME_DNS type */
+              p++;
+
+              _gnutls_write_uint16 (len, p);
+              p += 2;
+
+              memcpy (p,
+                      session->security_parameters.extensions.
+                      server_names[0].name, len);
+              p += len;
+              break;
+            default:
+              gnutls_assert ();
+              return GNUTLS_E_INTERNAL_ERROR;
+            }
+        }
+    }
+
+  return total_size;
+}
+
+/**
+  * gnutls_server_name_get - Used to get the server name indicator send by a client
+  * @session: is a #gnutls_session_t structure.
+  * @data: will hold the data
+  * @data_length: will hold the data length. Must hold the maximum size of data.
+  * @type: will hold the server name indicator type
+  * @indx: is the index of the server_name
+  *
+  * This function will allow you to get the name indication (if any),
+  * a client has sent. The name indication may be any of the enumeration
+  * gnutls_server_name_type_t.
+  *
+  * If @type is GNUTLS_NAME_DNS, then this function is to be used by servers
+  * that support virtual hosting, and the data will be a null terminated UTF-8 string.
+  *
+  * If @data has not enough size to hold the server name GNUTLS_E_SHORT_MEMORY_BUFFER
+  * is returned, and @data_length will hold the required size.
+  *
+  * @index is used to retrieve more than one server names (if sent by the client).
+  * The first server name has an index of 0, the second 1 and so on. If no name with the given
+  * index exists GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE is returned.
+  *
+  **/
+int
+gnutls_server_name_get (gnutls_session_t session, void *data,
+                        size_t * data_length,
+                        unsigned int *type, unsigned int indx)
+{
+  char *_data = data;
+
+  if (session->security_parameters.entity == GNUTLS_CLIENT)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (indx + 1 > session->security_parameters.extensions.server_names_size)
+    {
+      return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+    }
+
+  *type = session->security_parameters.extensions.server_names[indx].type;
+
+  if (*data_length >            /* greater since we need one extra byte for the null */
+      session->security_parameters.extensions.server_names[indx].name_length)
+    {
+      *data_length =
+        session->security_parameters.extensions.server_names[indx].
+        name_length;
+      memcpy (data,
+              session->security_parameters.extensions.server_names[indx].
+              name, *data_length);
+
+      if (*type == GNUTLS_NAME_DNS)     /* null terminate */
+        _data[(*data_length)] = 0;
+
+    }
+  else
+    {
+      *data_length =
+        session->security_parameters.extensions.server_names[indx].
+        name_length;
+      return GNUTLS_E_SHORT_MEMORY_BUFFER;
+    }
+
+  return 0;
+}
+
+/**
+  * gnutls_server_name_set - Used to set a name indicator to be sent as an extension
+  * @session: is a #gnutls_session_t structure.
+  * @type: specifies the indicator type
+  * @name: is a string that contains the server name.
+  * @name_length: holds the length of name
+  *
+  * This function is to be used by clients that want to inform 
+  * (via a TLS extension mechanism) the server of the name they
+  * connected to. This should be used by clients that connect
+  * to servers that do virtual hosting.
+  *
+  * The value of @name depends on the @ind type. In case of GNUTLS_NAME_DNS,
+  * an ASCII or UTF-8 null terminated string, without the trailing dot, is expected. 
+  * IPv4 or IPv6 addresses are not permitted.
+  *
+  **/
+int
+gnutls_server_name_set (gnutls_session_t session,
+                        gnutls_server_name_type_t type,
+                        const void *name, size_t name_length)
+{
+  int server_names;
+
+  if (session->security_parameters.entity == GNUTLS_SERVER)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (name_length > MAX_SERVER_NAME_SIZE)
+    return GNUTLS_E_SHORT_MEMORY_BUFFER;
+
+  server_names =
+    session->security_parameters.extensions.server_names_size + 1;
+
+  if (server_names > MAX_SERVER_NAME_EXTENSIONS)
+    server_names = MAX_SERVER_NAME_EXTENSIONS;
+
+  session->security_parameters.extensions.server_names[server_names -
+                                                       1].type = type;
+  memcpy (session->security_parameters.extensions.
+          server_names[server_names - 1].name, name, name_length);
+  session->security_parameters.extensions.server_names[server_names -
+                                                       1].name_length =
+    name_length;
+
+  session->security_parameters.extensions.server_names_size++;
+
+  return 0;
+}
diff --git a/src/daemon/https/tls/ext_server_name.h b/src/daemon/https/tls/ext_server_name.h
new file mode 100644
index 00000000..91e727a1
--- /dev/null
+++ b/src/daemon/https/tls/ext_server_name.h
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+int _gnutls_server_name_recv_params (gnutls_session_t session,
+                                     const opaque * data, size_t data_size);
+int _gnutls_server_name_send_params (gnutls_session_t session,
+                                     opaque * data, size_t);
diff --git a/src/daemon/https/tls/gnutls.asn b/src/daemon/https/tls/gnutls.asn
new file mode 100644
index 00000000..0cb98414
--- /dev/null
+++ b/src/daemon/https/tls/gnutls.asn
@@ -0,0 +1,93 @@
+GNUTLS { }
+
+DEFINITIONS EXPLICIT TAGS ::=
+
+BEGIN
+
+-- This file contains parts of PKCS-1 structures and some stuff
+-- required for DSA keys.
+
+RSAPublicKey ::= SEQUENCE {
+        modulus                 INTEGER, -- n
+        publicExponent          INTEGER  -- e 
+}
+
+-- 
+-- Representation of RSA private key with information for the 
+-- CRT algorithm.
+--
+RSAPrivateKey ::= SEQUENCE {
+        version                 Version,
+        modulus                 INTEGER, -- (Usually large) n
+        publicExponent          INTEGER, -- (Usually small) e
+        privateExponent         INTEGER, -- (Usually large) d
+        prime1                  INTEGER, -- (Usually large) p
+        prime2                  INTEGER, -- (Usually large) q
+        exponent1               INTEGER, -- (Usually large) d mod (p-1)
+        exponent2               INTEGER, -- (Usually large) d mod (q-1)
+        coefficient             INTEGER, -- (Usually large) (inverse of q) mod p
+        otherPrimeInfos         OtherPrimeInfos OPTIONAL
+}
+
+Version ::= INTEGER { two-prime(0), multi(1) }
+--      (CONSTRAINED BY { version must be multi if otherPrimeInfos present }) --
+
+OtherPrimeInfos ::= SEQUENCE SIZE(1..MAX) OF OtherPrimeInfo
+
+OtherPrimeInfo ::= SEQUENCE {
+        prime INTEGER,  -- ri
+        exponent INTEGER, -- di
+        coefficient INTEGER -- ti 
+}
+
+-- for signature calculation
+-- added by nmav
+
+AlgorithmIdentifier ::= SEQUENCE  {
+     algorithm               OBJECT IDENTIFIER,
+     parameters              ANY DEFINED BY algorithm OPTIONAL  
+}
+                                -- contains a value of the type
+                                -- registered for use with the
+                                -- algorithm object identifier value
+
+DigestInfo ::= SEQUENCE {
+     digestAlgorithm DigestAlgorithmIdentifier,
+     digest Digest 
+}
+
+DigestAlgorithmIdentifier ::= AlgorithmIdentifier
+
+Digest ::= OCTET STRING
+
+DSAPublicKey ::= INTEGER
+
+DSAParameters ::= SEQUENCE {
+        p                   INTEGER,
+        q                   INTEGER,
+        g                   INTEGER
+}
+
+DSASignatureValue ::= SEQUENCE {
+        r                   INTEGER,
+        s                   INTEGER
+}
+
+DSAPrivateKey ::= SEQUENCE {
+        version                 INTEGER, -- should be zero
+        p                       INTEGER,
+        q                       INTEGER,
+        g                       INTEGER,
+        Y                       INTEGER, -- public
+        priv                    INTEGER
+}
+
+-- from PKCS#3
+DHParameter ::= SEQUENCE {
+        prime INTEGER, -- p
+        base INTEGER, -- g
+        privateValueLength INTEGER OPTIONAL 
+}
+
+
+END
diff --git a/src/daemon/https/tls/gnutls.pc b/src/daemon/https/tls/gnutls.pc
new file mode 100644
index 00000000..544428cb
--- /dev/null
+++ b/src/daemon/https/tls/gnutls.pc
@@ -0,0 +1,23 @@
+# Process this file with autoconf to produce a pkg-config metadata file.
+# Copyright (C) 2002, 2003, 2004, 2005, 2006, 2007 Free Software Foundation
+# Author: Simon Josefsson
+# 
+# This file is free software; as a special exception the author gives
+# unlimited permission to copy and/or distribute it, with or without
+# modifications, as long as this notice is preserved.
+# 
+# This file is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY, to the extent permitted by law; without even the
+# implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+
+prefix=/home/lama/workbench/programming/c/gnunet/gnutls-2.2.3/build
+exec_prefix=${prefix}
+libdir=${exec_prefix}/lib
+includedir=${prefix}/include
+
+Name: GnuTLS
+Description: Transport Security Layer implementation for the GNU system
+Version: 2.2.3
+Libs: -L${libdir} -lgnutls
+Libs.private: -L${exec_prefix}/lib -lgnutls -L/usr/lib -ltasn1 -lgcrypt  
+Cflags: -I${includedir}
diff --git a/src/daemon/https/tls/gnutls_alert.c b/src/daemon/https/tls/gnutls_alert.c
new file mode 100644
index 00000000..75f9dcd2
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_alert.c
@@ -0,0 +1,304 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include <gnutls_int.h>
+#include <gnutls_errors.h>
+#include <gnutls_record.h>
+#include <debug.h>
+
+typedef struct
+{
+  gnutls_alert_description_t alert;
+  const char *desc;
+} gnutls_alert_entry;
+
+static const gnutls_alert_entry sup_alerts[] = {
+  {GNUTLS_A_CLOSE_NOTIFY, "Close notify"},
+  {GNUTLS_A_UNEXPECTED_MESSAGE, "Unexpected message"},
+  {GNUTLS_A_BAD_RECORD_MAC, "Bad record MAC"},
+  {GNUTLS_A_DECRYPTION_FAILED, "Decryption failed"},
+  {GNUTLS_A_RECORD_OVERFLOW, "Record overflow"},
+  {GNUTLS_A_DECOMPRESSION_FAILURE, "Decompression failed"},
+  {GNUTLS_A_HANDSHAKE_FAILURE, "Handshake failed"},
+  {GNUTLS_A_BAD_CERTIFICATE, "Certificate is bad"},
+  {GNUTLS_A_UNSUPPORTED_CERTIFICATE, "Certificate is not supported"},
+  {GNUTLS_A_CERTIFICATE_REVOKED, "Certificate was revoked"},
+  {GNUTLS_A_CERTIFICATE_EXPIRED, "Certificate is expired"},
+  {GNUTLS_A_CERTIFICATE_UNKNOWN, "Unknown certificate"},
+  {GNUTLS_A_ILLEGAL_PARAMETER, "Illegal parameter"},
+  {GNUTLS_A_UNKNOWN_CA, "CA is unknown"},
+  {GNUTLS_A_ACCESS_DENIED, "Access was denied"},
+  {GNUTLS_A_DECODE_ERROR, "Decode error"},
+  {GNUTLS_A_DECRYPT_ERROR, "Decrypt error"},
+  {GNUTLS_A_EXPORT_RESTRICTION, "Export restriction"},
+  {GNUTLS_A_PROTOCOL_VERSION, "Error in protocol version"},
+  {GNUTLS_A_INSUFFICIENT_SECURITY, "Insufficient security"},
+  {GNUTLS_A_USER_CANCELED, "User canceled"},
+  {GNUTLS_A_INTERNAL_ERROR, "Internal error"},
+  {GNUTLS_A_NO_RENEGOTIATION, "No renegotiation is allowed"},
+  {GNUTLS_A_CERTIFICATE_UNOBTAINABLE,
+   "Could not retrieve the specified certificate"},
+  {GNUTLS_A_UNSUPPORTED_EXTENSION, "An unsupported extension was sent"},
+  {GNUTLS_A_UNRECOGNIZED_NAME,
+   "The server name sent was not recognized"},
+  {GNUTLS_A_UNKNOWN_PSK_IDENTITY,
+   "The SRP/PSK username is missing or not known"},
+  {GNUTLS_A_INNER_APPLICATION_FAILURE,
+   "Inner application negotiation failed"},
+  {GNUTLS_A_INNER_APPLICATION_VERIFICATION,
+   "Inner application verification failed"},
+  {0, NULL}
+};
+
+#define GNUTLS_ALERT_LOOP(b) \
+        const gnutls_alert_entry *p; \
+                for(p = sup_alerts; p->desc != NULL; p++) { b ; }
+
+#define GNUTLS_ALERT_ID_LOOP(a) \
+                        GNUTLS_ALERT_LOOP( if(p->alert == alert) { a; break; })
+
+
+/**
+  * gnutls_alert_get_name - Returns a string describing the alert number given
+  * @alert: is an alert number #gnutls_session_t structure.
+  *
+  * This function will return a string that describes the given alert
+  * number or NULL.  See gnutls_alert_get().
+  *
+  **/
+const char *
+gnutls_alert_get_name (gnutls_alert_description_t alert)
+{
+  const char *ret = NULL;
+
+  GNUTLS_ALERT_ID_LOOP (ret = p->desc);
+
+  return ret;
+}
+
+/**
+  * gnutls_alert_send - This function sends an alert message to the peer
+  * @session: is a #gnutls_session_t structure.
+  * @level: is the level of the alert
+  * @desc: is the alert description
+  *
+  * This function will send an alert to the peer in order to inform
+  * him of something important (eg. his Certificate could not be verified).
+  * If the alert level is Fatal then the peer is expected to close the
+  * connection, otherwise he may ignore the alert and continue.
+  *
+  * The error code of the underlying record send function will be returned,
+  * so you may also receive GNUTLS_E_INTERRUPTED or GNUTLS_E_AGAIN as well.
+  *
+  * Returns 0 on success.
+  *
+  **/
+int
+gnutls_alert_send (gnutls_session_t session, gnutls_alert_level_t level,
+                   gnutls_alert_description_t desc)
+{
+  uint8_t data[2];
+  int ret;
+  const char *name;
+
+  data[0] = (uint8_t) level;
+  data[1] = (uint8_t) desc;
+
+  name = gnutls_alert_get_name ((int) data[1]);
+  if (name == NULL)
+    name = "(unknown)";
+  _gnutls_record_log ("REC: Sending Alert[%d|%d] - %s\n", data[0],
+                      data[1], name);
+
+  if ((ret = _gnutls_send_int (session, GNUTLS_ALERT, -1, data, 2)) >= 0)
+    return 0;
+  else
+    return ret;
+}
+
+/**
+  * gnutls_error_to_alert - This function returns an alert code based on the given error code
+  * @err: is a negative integer
+  * @level: the alert level will be stored there
+  *
+  * Returns an alert depending on the error code returned by a gnutls
+  * function. All alerts sent by this function should be considered fatal.
+  * The only exception is when err == GNUTLS_E_REHANDSHAKE, where a warning 
+  * alert should be sent to the peer indicating that no renegotiation will 
+  * be performed.
+  *
+  * If there is no mapping to a valid alert the alert to indicate internal error 
+  * is returned.
+  *
+  **/
+int
+gnutls_error_to_alert (int err, int *level)
+{
+  int ret, _level = -1;
+
+  switch (err)
+    {                           /* send appropriate alert */
+    case GNUTLS_E_DECRYPTION_FAILED:
+      /* GNUTLS_A_DECRYPTION_FAILED is not sent, because
+       * it is not defined in SSL3. Note that we must
+       * not distinguish Decryption failures from mac
+       * check failures, due to the possibility of some 
+       * attacks.
+       */
+      ret = GNUTLS_A_BAD_RECORD_MAC;
+      _level = GNUTLS_AL_FATAL;
+      break;
+    case GNUTLS_E_DECOMPRESSION_FAILED:
+      ret = GNUTLS_A_DECOMPRESSION_FAILURE;
+      _level = GNUTLS_AL_FATAL;
+      break;
+    case GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER:
+    case GNUTLS_E_ILLEGAL_SRP_USERNAME:
+      ret = GNUTLS_A_ILLEGAL_PARAMETER;
+      _level = GNUTLS_AL_FATAL;
+      break;
+    case GNUTLS_E_ASN1_ELEMENT_NOT_FOUND:
+    case GNUTLS_E_ASN1_IDENTIFIER_NOT_FOUND:
+    case GNUTLS_E_ASN1_DER_ERROR:
+    case GNUTLS_E_ASN1_VALUE_NOT_FOUND:
+    case GNUTLS_E_ASN1_GENERIC_ERROR:
+    case GNUTLS_E_ASN1_VALUE_NOT_VALID:
+    case GNUTLS_E_ASN1_TAG_ERROR:
+    case GNUTLS_E_ASN1_TAG_IMPLICIT:
+    case GNUTLS_E_ASN1_TYPE_ANY_ERROR:
+    case GNUTLS_E_ASN1_SYNTAX_ERROR:
+    case GNUTLS_E_ASN1_DER_OVERFLOW:
+      ret = GNUTLS_A_BAD_CERTIFICATE;
+      _level = GNUTLS_AL_FATAL;
+      break;
+    case GNUTLS_E_UNKNOWN_CIPHER_SUITE:
+    case GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM:
+    case GNUTLS_E_INSUFFICIENT_CREDENTIALS:
+    case GNUTLS_E_NO_CIPHER_SUITES:
+    case GNUTLS_E_NO_COMPRESSION_ALGORITHMS:
+      ret = GNUTLS_A_HANDSHAKE_FAILURE;
+      _level = GNUTLS_AL_FATAL;
+      break;
+    case GNUTLS_E_RECEIVED_ILLEGAL_EXTENSION:
+      ret = GNUTLS_A_UNSUPPORTED_EXTENSION;
+      _level = GNUTLS_AL_FATAL;
+      break;
+    case GNUTLS_E_UNEXPECTED_PACKET:
+    case GNUTLS_E_UNEXPECTED_HANDSHAKE_PACKET:
+      ret = GNUTLS_A_UNEXPECTED_MESSAGE;
+      _level = GNUTLS_AL_FATAL;
+      break;
+    case GNUTLS_E_REHANDSHAKE:
+      ret = GNUTLS_A_NO_RENEGOTIATION;
+      _level = GNUTLS_AL_WARNING;
+      break;
+    case GNUTLS_E_UNSUPPORTED_VERSION_PACKET:
+      ret = GNUTLS_A_PROTOCOL_VERSION;
+      _level = GNUTLS_AL_FATAL;
+      break;
+    case GNUTLS_E_UNSUPPORTED_CERTIFICATE_TYPE:
+      ret = GNUTLS_A_UNSUPPORTED_CERTIFICATE;
+      _level = GNUTLS_AL_FATAL;
+      break;
+    case GNUTLS_E_UNEXPECTED_PACKET_LENGTH:
+      ret = GNUTLS_A_RECORD_OVERFLOW;
+      _level = GNUTLS_AL_FATAL;
+      break;
+    case GNUTLS_E_INTERNAL_ERROR:
+    case GNUTLS_E_NO_TEMPORARY_DH_PARAMS:
+    case GNUTLS_E_NO_TEMPORARY_RSA_PARAMS:
+      ret = GNUTLS_A_INTERNAL_ERROR;
+      _level = GNUTLS_AL_FATAL;
+      break;
+    case GNUTLS_E_OPENPGP_GETKEY_FAILED:
+      ret = GNUTLS_A_CERTIFICATE_UNOBTAINABLE;
+      _level = GNUTLS_AL_FATAL;
+      break;
+    case GNUTLS_E_DH_PRIME_UNACCEPTABLE:
+    case GNUTLS_E_NO_CERTIFICATE_FOUND:
+      ret = GNUTLS_A_INSUFFICIENT_SECURITY;
+      _level = GNUTLS_AL_FATAL;
+      break;
+    default:
+      ret = GNUTLS_A_INTERNAL_ERROR;
+      _level = GNUTLS_AL_FATAL;
+      break;
+    }
+
+  if (level != NULL)
+    *level = _level;
+
+  return ret;
+}
+
+
+/**
+ * gnutls_alert_send_appropriate - This function sends an alert to the peer depending on the error code
+ * @session: is a #gnutls_session_t structure.
+ * @err: is an integer
+ *
+ * Sends an alert to the peer depending on the error code returned by a gnutls
+ * function. This function will call gnutls_error_to_alert() to determine
+ * the appropriate alert to send.
+ *
+ * This function may also return GNUTLS_E_AGAIN, or GNUTLS_E_INTERRUPTED.
+ *
+ * If the return value is GNUTLS_E_INVALID_REQUEST, then no alert has
+ * been sent to the peer.
+ *
+ * Returns zero on success.
+ */
+int
+gnutls_alert_send_appropriate (gnutls_session_t session, int err)
+{
+  int alert;
+  int level;
+
+  alert = gnutls_error_to_alert (err, &level);
+  if (alert < 0)
+    {
+      return alert;
+    }
+
+  return gnutls_alert_send (session, level, alert);
+}
+
+/**
+  * gnutls_alert_get - Returns the last alert number received.
+  * @session: is a #gnutls_session_t structure.
+  *
+  * This function will return the last alert number received. This
+  * function should be called if GNUTLS_E_WARNING_ALERT_RECEIVED or
+  * GNUTLS_E_FATAL_ALERT_RECEIVED has been returned by a gnutls
+  * function.  The peer may send alerts if he thinks some things were
+  * not right. Check gnutls.h for the available alert descriptions.
+  *
+  * If no alert has been received the returned value is undefined.
+  *
+  **/
+gnutls_alert_description_t
+gnutls_alert_get (gnutls_session_t session)
+{
+  return session->internals.last_alert;
+}
diff --git a/src/daemon/https/tls/gnutls_algorithms.c b/src/daemon/https/tls/gnutls_algorithms.c
new file mode 100644
index 00000000..82bf9bf6
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_algorithms.c
@@ -0,0 +1,2225 @@
+/*
+ * Copyright (C) 2000, 2002, 2003, 2004, 2005, 2006, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include "gnutls_int.h"
+#include "gnutls_algorithms.h"
+#include "gnutls_errors.h"
+#include "gnutls_cert.h"
+/* x509 */
+#include "common.h"
+
+/* Cred type mappings to KX algorithms 
+ * FIXME: The mappings are not 1-1. Some KX such as SRP_RSA require
+ * more than one credentials type.
+ */
+typedef struct
+{
+  gnutls_kx_algorithm_t algorithm;
+  gnutls_credentials_type_t client_type;
+  gnutls_credentials_type_t server_type;        /* The type of credentials a server
+                                                 * needs to set */
+} gnutls_cred_map;
+
+static const gnutls_cred_map cred_mappings[] = {
+  {GNUTLS_KX_ANON_DH,
+   GNUTLS_CRD_ANON,
+   GNUTLS_CRD_ANON},
+  {GNUTLS_KX_RSA,
+   GNUTLS_CRD_CERTIFICATE,
+   GNUTLS_CRD_CERTIFICATE},
+  {GNUTLS_KX_RSA_EXPORT,
+   GNUTLS_CRD_CERTIFICATE,
+   GNUTLS_CRD_CERTIFICATE},
+  {GNUTLS_KX_DHE_DSS,
+   GNUTLS_CRD_CERTIFICATE,
+   GNUTLS_CRD_CERTIFICATE},
+  {GNUTLS_KX_DHE_RSA,
+   GNUTLS_CRD_CERTIFICATE,
+   GNUTLS_CRD_CERTIFICATE},
+  {GNUTLS_KX_PSK,
+   GNUTLS_CRD_PSK,
+   GNUTLS_CRD_PSK},
+  {GNUTLS_KX_DHE_PSK,
+   GNUTLS_CRD_PSK,
+   GNUTLS_CRD_PSK},
+  {GNUTLS_KX_SRP,
+   GNUTLS_CRD_SRP,
+   GNUTLS_CRD_SRP},
+  {GNUTLS_KX_SRP_RSA,
+   GNUTLS_CRD_SRP,
+   GNUTLS_CRD_CERTIFICATE},
+  {GNUTLS_KX_SRP_DSS,
+   GNUTLS_CRD_SRP,
+   GNUTLS_CRD_CERTIFICATE},
+  {0,
+   0,
+   0}
+};
+
+#define GNUTLS_KX_MAP_LOOP(b) \
+        const gnutls_cred_map *p; \
+                for(p = cred_mappings; p->algorithm != 0; p++) { b ; }
+
+#define GNUTLS_KX_MAP_ALG_LOOP_SERVER(a) \
+                        GNUTLS_KX_MAP_LOOP( if(p->server_type == type) { a; break; })
+
+#define GNUTLS_KX_MAP_ALG_LOOP_CLIENT(a) \
+                        GNUTLS_KX_MAP_LOOP( if(p->client_type == type) { a; break; })
+
+/* KX mappings to PK algorithms */
+typedef struct
+{
+  gnutls_kx_algorithm_t kx_algorithm;
+  gnutls_pk_algorithm_t pk_algorithm;
+  enum encipher_type encipher_type;     /* CIPHER_ENCRYPT if this algorithm is to be used
+                                         * for encryption, CIPHER_SIGN if signature only,
+                                         * CIPHER_IGN if this does not apply at all.
+                                         *
+                                         * This is useful to certificate cipher suites, which check
+                                         * against the certificate key usage bits.
+                                         */
+} gnutls_pk_map;
+
+/* This table maps the Key exchange algorithms to
+ * the certificate algorithms. Eg. if we have
+ * RSA algorithm in the certificate then we can
+ * use GNUTLS_KX_RSA or GNUTLS_KX_DHE_RSA.
+ */
+static const gnutls_pk_map pk_mappings[] = {
+  {GNUTLS_KX_RSA,
+   GNUTLS_PK_RSA,
+   CIPHER_ENCRYPT},
+  {GNUTLS_KX_RSA_EXPORT,
+   GNUTLS_PK_RSA,
+   CIPHER_SIGN},
+  {GNUTLS_KX_DHE_RSA,
+   GNUTLS_PK_RSA,
+   CIPHER_SIGN},
+  {GNUTLS_KX_SRP_RSA,
+   GNUTLS_PK_RSA,
+   CIPHER_SIGN},
+  {0,
+   0,
+   0}
+};
+
+#define GNUTLS_PK_MAP_LOOP(b) \
+        const gnutls_pk_map *p; \
+                for(p = pk_mappings; p->kx_algorithm != 0; p++) { b }
+
+#define GNUTLS_PK_MAP_ALG_LOOP(a) \
+                        GNUTLS_PK_MAP_LOOP( if(p->kx_algorithm == kx_algorithm) { a; break; })
+
+/* TLS Versions */
+
+typedef struct
+{
+  const char *name;
+  gnutls_protocol_t id;         /* gnutls internal version number */
+  int major;                    /* defined by the protocol */
+  int minor;                    /* defined by the protocol */
+  int supported;                /* 0 not supported, > 0 is supported */
+} gnutls_version_entry;
+
+static const gnutls_version_entry sup_versions[] = {
+  {"SSL3.0",
+   GNUTLS_SSL3,
+   3,
+   0,
+   1},
+  {"TLS1.0",
+   GNUTLS_TLS1,
+   3,
+   1,
+   1},
+  {"TLS1.1",
+   GNUTLS_TLS1_1,
+   3,
+   2,
+   1},
+  {"TLS1.2",
+   GNUTLS_TLS1_2,
+   3,
+   3,
+   1},
+  {0,
+   0,
+   0,
+   0,
+   0}
+};
+
+/* Keep the contents of this struct the same as the previous one. */
+static const gnutls_protocol_t supported_protocols[] = { GNUTLS_SSL3,
+  GNUTLS_TLS1,
+  GNUTLS_TLS1_1,
+  GNUTLS_TLS1_2,
+  0
+};
+
+#define GNUTLS_VERSION_LOOP(b) \
+        const gnutls_version_entry *p; \
+                for(p = sup_versions; p->name != NULL; p++) { b ; }
+
+#define GNUTLS_VERSION_ALG_LOOP(a) \
+                        GNUTLS_VERSION_LOOP( if(p->id == version) { a; break; })
+
+struct gnutls_cipher_entry
+{
+  const char *name;
+  gnutls_cipher_algorithm_t id;
+  uint16_t blocksize;
+  uint16_t keysize;
+  cipher_type_t block;
+  uint16_t iv;
+  int export_flag;              /* 0 non export */
+};
+typedef struct gnutls_cipher_entry gnutls_cipher_entry;
+
+/* Note that all algorithms are in CBC or STREAM modes. 
+ * Do not add any algorithms in other modes (avoid modified algorithms).
+ * View first: "The order of encryption and authentication for
+ * protecting communications" by Hugo Krawczyk - CRYPTO 2001
+ */
+static const gnutls_cipher_entry algorithms[] = {
+  {"AES-256-CBC",
+   GNUTLS_CIPHER_AES_256_CBC,
+   16,
+   32,
+   CIPHER_BLOCK,
+   16,
+   0},
+  {"AES-128-CBC",
+   GNUTLS_CIPHER_AES_128_CBC,
+   16,
+   16,
+   CIPHER_BLOCK,
+   16,
+   0},
+  {"3DES-CBC",
+   GNUTLS_CIPHER_3DES_CBC,
+   8,
+   24,
+   CIPHER_BLOCK,
+   8,
+   0},
+  {"DES-CBC",
+   GNUTLS_CIPHER_DES_CBC,
+   8,
+   8,
+   CIPHER_BLOCK,
+   8,
+   0},
+  {"ARCFOUR-128",
+   GNUTLS_CIPHER_ARCFOUR_128,
+   1,
+   16,
+   CIPHER_STREAM,
+   0,
+   0},
+  {"ARCFOUR-40",
+   GNUTLS_CIPHER_ARCFOUR_40,
+   1,
+   5,
+   CIPHER_STREAM,
+   0,
+   1},
+  {"RC2-40",
+   GNUTLS_CIPHER_RC2_40_CBC,
+   8,
+   5,
+   CIPHER_BLOCK,
+   8,
+   1},
+#ifdef  ENABLE_CAMELLIA
+  {"CAMELLIA-256-CBC", GNUTLS_CIPHER_CAMELLIA_256_CBC, 16, 32, CIPHER_BLOCK,
+   16, 0},
+  {"CAMELLIA-128-CBC", GNUTLS_CIPHER_CAMELLIA_128_CBC, 16, 16, CIPHER_BLOCK,
+   16, 0},
+#endif
+  {"NULL",
+   GNUTLS_CIPHER_NULL,
+   1,
+   0,
+   CIPHER_STREAM,
+   0,
+   0},
+  {0,
+   0,
+   0,
+   0,
+   0,
+   0,
+   0}
+};
+
+/* Keep the contents of this struct the same as the previous one. */
+static const gnutls_cipher_algorithm_t supported_ciphers[] =
+  { GNUTLS_CIPHER_AES_256_CBC,
+  GNUTLS_CIPHER_AES_128_CBC,
+  GNUTLS_CIPHER_3DES_CBC,
+  GNUTLS_CIPHER_DES_CBC,
+  GNUTLS_CIPHER_ARCFOUR_128,
+  GNUTLS_CIPHER_ARCFOUR_40,
+  GNUTLS_CIPHER_RC2_40_CBC,
+#ifdef  ENABLE_CAMELLIA
+  GNUTLS_CIPHER_CAMELLIA_256_CBC,
+  GNUTLS_CIPHER_CAMELLIA_128_CBC,
+#endif
+  GNUTLS_CIPHER_NULL,
+  0
+};
+
+#define GNUTLS_LOOP(b) \
+        const gnutls_cipher_entry *p; \
+                for(p = algorithms; p->name != NULL; p++) { b ; }
+
+#define GNUTLS_ALG_LOOP(a) \
+                        GNUTLS_LOOP( if(p->id == algorithm) { a; break; } )
+
+struct gnutls_hash_entry
+{
+  const char *name;
+  const char *oid;
+  gnutls_mac_algorithm_t id;
+  size_t key_size;              /* in case of mac */
+};
+typedef struct gnutls_hash_entry gnutls_hash_entry;
+
+static const gnutls_hash_entry hash_algorithms[] = {
+  {"SHA1",
+   HASH_OID_SHA1,
+   GNUTLS_MAC_SHA1,
+   20},
+  {"MD5",
+   HASH_OID_MD5,
+   GNUTLS_MAC_MD5,
+   16},
+  {"SHA256",
+   HASH_OID_SHA256,
+   GNUTLS_MAC_SHA256,
+   32},
+  {"NULL",
+   NULL,
+   GNUTLS_MAC_NULL,
+   0},
+  {0,
+   0,
+   0,
+   0}
+};
+
+/* Keep the contents of this struct the same as the previous one. */
+static const gnutls_mac_algorithm_t supported_macs[] = { GNUTLS_MAC_SHA1,
+  GNUTLS_MAC_MD5,
+  GNUTLS_MAC_SHA256,
+  GNUTLS_MAC_NULL,
+  0
+};
+
+#define GNUTLS_HASH_LOOP(b) \
+        const gnutls_hash_entry *p; \
+                for(p = hash_algorithms; p->name != NULL; p++) { b ; }
+
+#define GNUTLS_HASH_ALG_LOOP(a) \
+                        GNUTLS_HASH_LOOP( if(p->id == algorithm) { a; break; } )
+
+/* Compression Section */
+#define GNUTLS_COMPRESSION_ENTRY(name, id, wb, ml, cl) \
+        { #name, name, id, wb, ml, cl}
+
+#define MAX_COMP_METHODS 5
+const int _gnutls_comp_algorithms_size = MAX_COMP_METHODS;
+
+/* the compression entry is defined in gnutls_algorithms.h */
+
+gnutls_compression_entry _gnutls_compression_algorithms[MAX_COMP_METHODS] =
+  { GNUTLS_COMPRESSION_ENTRY (GNUTLS_COMP_NULL, 0x00, 0, 0, 0),
+#ifdef HAVE_LIBZ
+  /* draft-ietf-tls-compression-02 */
+  GNUTLS_COMPRESSION_ENTRY (GNUTLS_COMP_DEFLATE, 0x01, 15, 8, 3),
+#endif
+  {0,
+   0,
+   0,
+   0,
+   0,
+   0}
+};
+
+static const gnutls_compression_method_t supported_compressions[] = {
+#ifdef HAVE_LIBZ
+  GNUTLS_COMP_DEFLATE,
+#endif
+  GNUTLS_COMP_NULL,
+  0
+};
+
+#define GNUTLS_COMPRESSION_LOOP(b) \
+        const gnutls_compression_entry *p; \
+                for(p = _gnutls_compression_algorithms; p->name != NULL; p++) { b ; }
+#define GNUTLS_COMPRESSION_ALG_LOOP(a) \
+                        GNUTLS_COMPRESSION_LOOP( if(p->id == algorithm) { a; break; } )
+#define GNUTLS_COMPRESSION_ALG_LOOP_NUM(a) \
+                        GNUTLS_COMPRESSION_LOOP( if(p->num == num) { a; break; } )
+
+/* Key Exchange Section */
+extern mod_auth_st rsa_auth_struct;
+extern mod_auth_st rsa_export_auth_struct;
+extern mod_auth_st dhe_rsa_auth_struct;
+extern mod_auth_st dhe_dss_auth_struct;
+extern mod_auth_st anon_auth_struct;
+extern mod_auth_st srp_auth_struct;
+extern mod_auth_st psk_auth_struct;
+extern mod_auth_st dhe_psk_auth_struct;
+extern mod_auth_st srp_rsa_auth_struct;
+extern mod_auth_st srp_dss_auth_struct;
+
+struct gnutls_kx_algo_entry
+{
+  const char *name;
+  gnutls_kx_algorithm_t algorithm;
+  mod_auth_st *auth_struct;
+  int needs_dh_params;
+  int needs_rsa_params;
+};
+typedef struct gnutls_kx_algo_entry gnutls_kx_algo_entry;
+
+static const gnutls_kx_algo_entry _gnutls_kx_algorithms[] = {
+#ifdef ENABLE_ANON
+  {"ANON-DH", GNUTLS_KX_ANON_DH, &anon_auth_struct, 1, 0},
+#endif
+  {"RSA",
+   GNUTLS_KX_RSA,
+   &rsa_auth_struct,
+   0,
+   0},
+  {"RSA-EXPORT",
+   GNUTLS_KX_RSA_EXPORT,
+   &rsa_export_auth_struct,
+   0,
+   1 /* needs RSA params */ },
+  {"DHE-RSA",
+   GNUTLS_KX_DHE_RSA,
+   &dhe_rsa_auth_struct,
+   1,
+   0},
+  {"DHE-DSS",
+   GNUTLS_KX_DHE_DSS,
+   &dhe_dss_auth_struct,
+   1,
+   0},
+
+#ifdef ENABLE_SRP
+  {"SRP-DSS", GNUTLS_KX_SRP_DSS, &srp_dss_auth_struct, 0, 0},
+  {"SRP-RSA", GNUTLS_KX_SRP_RSA, &srp_rsa_auth_struct, 0, 0},
+  {"SRP", GNUTLS_KX_SRP, &srp_auth_struct, 0, 0},
+#endif
+#ifdef ENABLE_PSK
+  {"PSK", GNUTLS_KX_PSK, &psk_auth_struct, 0, 0},
+  {"DHE-PSK", GNUTLS_KX_DHE_PSK, &dhe_psk_auth_struct,
+   1 /* needs DHE params */ , 0},
+#endif
+  {0,
+   0,
+   0,
+   0,
+   0}
+};
+
+/* Keep the contents of this struct the same as the previous one. */
+static const gnutls_kx_algorithm_t supported_kxs[] = {
+#ifdef ENABLE_ANON
+  GNUTLS_KX_ANON_DH,
+#endif
+  GNUTLS_KX_RSA,
+  GNUTLS_KX_RSA_EXPORT,
+  GNUTLS_KX_DHE_RSA,
+  GNUTLS_KX_DHE_DSS,
+#ifdef ENABLE_SRP
+  GNUTLS_KX_SRP_DSS,
+  GNUTLS_KX_SRP_RSA,
+  GNUTLS_KX_SRP,
+#endif
+#ifdef ENABLE_PSK
+  GNUTLS_KX_PSK,
+  GNUTLS_KX_DHE_PSK,
+#endif
+  0
+};
+
+#define GNUTLS_KX_LOOP(b) \
+        const gnutls_kx_algo_entry *p; \
+                for(p = _gnutls_kx_algorithms; p->name != NULL; p++) { b ; }
+
+#define GNUTLS_KX_ALG_LOOP(a) \
+                        GNUTLS_KX_LOOP( if(p->algorithm == algorithm) { a; break; } )
+
+/* Cipher SUITES */
+#define GNUTLS_CIPHER_SUITE_ENTRY( name, block_algorithm, kx_algorithm, mac_algorithm, version ) \
+        { #name, {name}, block_algorithm, kx_algorithm, mac_algorithm, version }
+
+typedef struct
+{
+  const char *name;
+  cipher_suite_st id;
+  gnutls_cipher_algorithm_t block_algorithm;
+  gnutls_kx_algorithm_t kx_algorithm;
+  gnutls_mac_algorithm_t mac_algorithm;
+  gnutls_protocol_t version;    /* this cipher suite is supported
+                                 * from 'version' and above;
+                                 */
+} gnutls_cipher_suite_entry;
+
+/* RSA with NULL cipher and MD5 MAC
+ * for test purposes.
+ */
+#define GNUTLS_RSA_NULL_MD5 { 0x00, 0x01 }
+
+/* ANONymous cipher suites.
+ */
+
+#define GNUTLS_ANON_DH_3DES_EDE_CBC_SHA1 { 0x00, 0x1B }
+#define GNUTLS_ANON_DH_ARCFOUR_MD5 { 0x00, 0x18 }
+
+/* rfc3268: */
+#define GNUTLS_ANON_DH_AES_128_CBC_SHA1 { 0x00, 0x34 }
+#define GNUTLS_ANON_DH_AES_256_CBC_SHA1 { 0x00, 0x3A }
+
+/* rfc4132 */
+#define GNUTLS_ANON_DH_CAMELLIA_128_CBC_SHA1 { 0x00,0x46 }
+#define GNUTLS_ANON_DH_CAMELLIA_256_CBC_SHA1 { 0x00,0x89 }
+
+/* PSK (not in TLS 1.0)
+ * draft-ietf-tls-psk:
+ */
+#define GNUTLS_PSK_SHA_ARCFOUR_SHA1 { 0x00, 0x8A }
+#define GNUTLS_PSK_SHA_3DES_EDE_CBC_SHA1 { 0x00, 0x8B }
+#define GNUTLS_PSK_SHA_AES_128_CBC_SHA1 { 0x00, 0x8C }
+#define GNUTLS_PSK_SHA_AES_256_CBC_SHA1 { 0x00, 0x8D }
+
+#define GNUTLS_DHE_PSK_SHA_ARCFOUR_SHA1 { 0x00, 0x8E }
+#define GNUTLS_DHE_PSK_SHA_3DES_EDE_CBC_SHA1 { 0x00, 0x8F }
+#define GNUTLS_DHE_PSK_SHA_AES_128_CBC_SHA1 { 0x00, 0x90 }
+#define GNUTLS_DHE_PSK_SHA_AES_256_CBC_SHA1 { 0x00, 0x91 }
+
+/* SRP (rfc5054)
+ */
+#define GNUTLS_SRP_SHA_3DES_EDE_CBC_SHA1 { 0xC0, 0x1A }
+#define GNUTLS_SRP_SHA_RSA_3DES_EDE_CBC_SHA1 { 0xC0, 0x1B }
+#define GNUTLS_SRP_SHA_DSS_3DES_EDE_CBC_SHA1 { 0xC0, 0x1C }
+
+#define GNUTLS_SRP_SHA_AES_128_CBC_SHA1 { 0xC0, 0x1D }
+#define GNUTLS_SRP_SHA_RSA_AES_128_CBC_SHA1 { 0xC0, 0x1E }
+#define GNUTLS_SRP_SHA_DSS_AES_128_CBC_SHA1 { 0xC0, 0x1F }
+
+#define GNUTLS_SRP_SHA_AES_256_CBC_SHA1 { 0xC0, 0x20 }
+#define GNUTLS_SRP_SHA_RSA_AES_256_CBC_SHA1 { 0xC0, 0x21 }
+#define GNUTLS_SRP_SHA_DSS_AES_256_CBC_SHA1 { 0xC0, 0x22 }
+
+/* RSA
+ */
+#define GNUTLS_RSA_ARCFOUR_SHA1 { 0x00, 0x05 }
+#define GNUTLS_RSA_ARCFOUR_MD5 { 0x00, 0x04 }
+#define GNUTLS_RSA_3DES_EDE_CBC_SHA1 { 0x00, 0x0A }
+
+#define GNUTLS_RSA_EXPORT_ARCFOUR_40_MD5 { 0x00, 0x03 }
+
+/* rfc3268:
+ */
+#define GNUTLS_RSA_AES_128_CBC_SHA1 { 0x00, 0x2F }
+#define GNUTLS_RSA_AES_256_CBC_SHA1 { 0x00, 0x35 }
+
+/* rfc4132 */
+#define GNUTLS_RSA_CAMELLIA_128_CBC_SHA1 { 0x00,0x41 }
+#define GNUTLS_RSA_CAMELLIA_256_CBC_SHA1 { 0x00,0x84 }
+
+/* DHE DSS
+ */
+
+#define GNUTLS_DHE_DSS_3DES_EDE_CBC_SHA1 { 0x00, 0x13 }
+
+/* draft-ietf-tls-56-bit-ciphersuites-01:
+ */
+#define GNUTLS_DHE_DSS_ARCFOUR_SHA1 { 0x00, 0x66 }
+
+/* rfc3268:
+ */
+#define GNUTLS_DHE_DSS_AES_256_CBC_SHA1 { 0x00, 0x38 }
+#define GNUTLS_DHE_DSS_AES_128_CBC_SHA1 { 0x00, 0x32 }
+
+/* rfc4132 */
+#define GNUTLS_DHE_DSS_CAMELLIA_128_CBC_SHA1 { 0x00,0x44 }
+#define GNUTLS_DHE_DSS_CAMELLIA_256_CBC_SHA1 { 0x00,0x87 }
+
+/* DHE RSA
+ */
+#define GNUTLS_DHE_RSA_3DES_EDE_CBC_SHA1 { 0x00, 0x16 }
+
+/* rfc3268:
+ */
+#define GNUTLS_DHE_RSA_AES_128_CBC_SHA1 { 0x00, 0x33 }
+#define GNUTLS_DHE_RSA_AES_256_CBC_SHA1 { 0x00, 0x39 }
+
+/* rfc4132 */
+#define GNUTLS_DHE_RSA_CAMELLIA_128_CBC_SHA1 { 0x00,0x45 }
+#define GNUTLS_DHE_RSA_CAMELLIA_256_CBC_SHA1 { 0x00,0x88 }
+
+#define CIPHER_SUITES_COUNT sizeof(cs_algorithms)/sizeof(gnutls_cipher_suite_entry)-1
+
+static const gnutls_cipher_suite_entry cs_algorithms[] = {
+  /* ANON_DH */
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_ANON_DH_ARCFOUR_MD5,
+                             GNUTLS_CIPHER_ARCFOUR_128,
+                             GNUTLS_KX_ANON_DH, GNUTLS_MAC_MD5,
+                             GNUTLS_SSL3),
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_ANON_DH_3DES_EDE_CBC_SHA1,
+                             GNUTLS_CIPHER_3DES_CBC, GNUTLS_KX_ANON_DH,
+                             GNUTLS_MAC_SHA1, GNUTLS_SSL3),
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_ANON_DH_AES_128_CBC_SHA1,
+                             GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_ANON_DH,
+                             GNUTLS_MAC_SHA1, GNUTLS_SSL3),
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_ANON_DH_AES_256_CBC_SHA1,
+                             GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_ANON_DH,
+                             GNUTLS_MAC_SHA1, GNUTLS_SSL3),
+#ifdef  ENABLE_CAMELLIA
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_ANON_DH_CAMELLIA_128_CBC_SHA1,
+                             GNUTLS_CIPHER_CAMELLIA_128_CBC,
+                             GNUTLS_KX_ANON_DH,
+                             GNUTLS_MAC_SHA1, GNUTLS_TLS1),
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_ANON_DH_CAMELLIA_256_CBC_SHA1,
+                             GNUTLS_CIPHER_CAMELLIA_256_CBC,
+                             GNUTLS_KX_ANON_DH,
+                             GNUTLS_MAC_SHA1, GNUTLS_TLS1),
+#endif
+
+  /* PSK */
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_PSK_SHA_ARCFOUR_SHA1,
+                             GNUTLS_CIPHER_ARCFOUR, GNUTLS_KX_PSK,
+                             GNUTLS_MAC_SHA1, GNUTLS_TLS1),
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_PSK_SHA_3DES_EDE_CBC_SHA1,
+                             GNUTLS_CIPHER_3DES_CBC, GNUTLS_KX_PSK,
+                             GNUTLS_MAC_SHA1, GNUTLS_TLS1),
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_PSK_SHA_AES_128_CBC_SHA1,
+                             GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_PSK,
+                             GNUTLS_MAC_SHA1, GNUTLS_TLS1),
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_PSK_SHA_AES_256_CBC_SHA1,
+                             GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_PSK,
+                             GNUTLS_MAC_SHA1, GNUTLS_TLS1),
+
+  /* DHE-PSK */
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_PSK_SHA_ARCFOUR_SHA1,
+                             GNUTLS_CIPHER_ARCFOUR, GNUTLS_KX_DHE_PSK,
+                             GNUTLS_MAC_SHA1, GNUTLS_TLS1),
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_PSK_SHA_3DES_EDE_CBC_SHA1,
+                             GNUTLS_CIPHER_3DES_CBC, GNUTLS_KX_DHE_PSK,
+                             GNUTLS_MAC_SHA1, GNUTLS_TLS1),
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_PSK_SHA_AES_128_CBC_SHA1,
+                             GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_DHE_PSK,
+                             GNUTLS_MAC_SHA1, GNUTLS_TLS1),
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_PSK_SHA_AES_256_CBC_SHA1,
+                             GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_DHE_PSK,
+                             GNUTLS_MAC_SHA1, GNUTLS_TLS1),
+
+  /* SRP */
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_SRP_SHA_3DES_EDE_CBC_SHA1,
+                             GNUTLS_CIPHER_3DES_CBC, GNUTLS_KX_SRP,
+                             GNUTLS_MAC_SHA1, GNUTLS_TLS1),
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_SRP_SHA_AES_128_CBC_SHA1,
+                             GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_SRP,
+                             GNUTLS_MAC_SHA1, GNUTLS_TLS1),
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_SRP_SHA_AES_256_CBC_SHA1,
+                             GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_SRP,
+                             GNUTLS_MAC_SHA1, GNUTLS_TLS1),
+
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_SRP_SHA_DSS_3DES_EDE_CBC_SHA1,
+                             GNUTLS_CIPHER_3DES_CBC, GNUTLS_KX_SRP_DSS,
+                             GNUTLS_MAC_SHA1, GNUTLS_TLS1),
+
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_SRP_SHA_RSA_3DES_EDE_CBC_SHA1,
+                             GNUTLS_CIPHER_3DES_CBC, GNUTLS_KX_SRP_RSA,
+                             GNUTLS_MAC_SHA1, GNUTLS_TLS1),
+
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_SRP_SHA_DSS_AES_128_CBC_SHA1,
+                             GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_SRP_DSS,
+                             GNUTLS_MAC_SHA1, GNUTLS_TLS1),
+
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_SRP_SHA_RSA_AES_128_CBC_SHA1,
+                             GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_SRP_RSA,
+                             GNUTLS_MAC_SHA1, GNUTLS_TLS1),
+
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_SRP_SHA_DSS_AES_256_CBC_SHA1,
+                             GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_SRP_DSS,
+                             GNUTLS_MAC_SHA1, GNUTLS_TLS1),
+
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_SRP_SHA_RSA_AES_256_CBC_SHA1,
+                             GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_SRP_RSA,
+                             GNUTLS_MAC_SHA1, GNUTLS_TLS1),
+
+  /* DHE_DSS */
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_DSS_ARCFOUR_SHA1,
+                             GNUTLS_CIPHER_ARCFOUR_128, GNUTLS_KX_DHE_DSS,
+                             GNUTLS_MAC_SHA1, GNUTLS_TLS1),
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_DSS_3DES_EDE_CBC_SHA1,
+                             GNUTLS_CIPHER_3DES_CBC, GNUTLS_KX_DHE_DSS,
+                             GNUTLS_MAC_SHA1, GNUTLS_SSL3),
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_DSS_AES_128_CBC_SHA1,
+                             GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_DHE_DSS,
+                             GNUTLS_MAC_SHA1, GNUTLS_SSL3),
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_DSS_AES_256_CBC_SHA1,
+                             GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_DHE_DSS,
+                             GNUTLS_MAC_SHA1, GNUTLS_SSL3),
+#ifdef  ENABLE_CAMELLIA
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_DSS_CAMELLIA_128_CBC_SHA1,
+                             GNUTLS_CIPHER_CAMELLIA_128_CBC,
+                             GNUTLS_KX_DHE_DSS,
+                             GNUTLS_MAC_SHA1, GNUTLS_TLS1),
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_DSS_CAMELLIA_256_CBC_SHA1,
+                             GNUTLS_CIPHER_CAMELLIA_256_CBC,
+                             GNUTLS_KX_DHE_DSS,
+                             GNUTLS_MAC_SHA1, GNUTLS_TLS1),
+#endif
+  /* DHE_RSA */
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_RSA_3DES_EDE_CBC_SHA1,
+                             GNUTLS_CIPHER_3DES_CBC, GNUTLS_KX_DHE_RSA,
+                             GNUTLS_MAC_SHA1, GNUTLS_SSL3),
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_RSA_AES_128_CBC_SHA1,
+                             GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_DHE_RSA,
+                             GNUTLS_MAC_SHA1, GNUTLS_SSL3),
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_RSA_AES_256_CBC_SHA1,
+                             GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_DHE_RSA,
+                             GNUTLS_MAC_SHA1, GNUTLS_SSL3),
+#ifdef  ENABLE_CAMELLIA
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_RSA_CAMELLIA_128_CBC_SHA1,
+                             GNUTLS_CIPHER_CAMELLIA_128_CBC,
+                             GNUTLS_KX_DHE_RSA,
+                             GNUTLS_MAC_SHA1, GNUTLS_TLS1),
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_DHE_RSA_CAMELLIA_256_CBC_SHA1,
+                             GNUTLS_CIPHER_CAMELLIA_256_CBC,
+                             GNUTLS_KX_DHE_RSA,
+                             GNUTLS_MAC_SHA1, GNUTLS_TLS1),
+#endif
+  /* RSA */
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_RSA_NULL_MD5,
+                             GNUTLS_CIPHER_NULL,
+                             GNUTLS_KX_RSA, GNUTLS_MAC_MD5, GNUTLS_SSL3),
+
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_RSA_EXPORT_ARCFOUR_40_MD5,
+                             GNUTLS_CIPHER_ARCFOUR_40,
+                             GNUTLS_KX_RSA_EXPORT, GNUTLS_MAC_MD5,
+                             GNUTLS_SSL3),
+
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_RSA_ARCFOUR_SHA1,
+                             GNUTLS_CIPHER_ARCFOUR_128,
+                             GNUTLS_KX_RSA, GNUTLS_MAC_SHA1, GNUTLS_SSL3),
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_RSA_ARCFOUR_MD5,
+                             GNUTLS_CIPHER_ARCFOUR_128,
+                             GNUTLS_KX_RSA, GNUTLS_MAC_MD5, GNUTLS_SSL3),
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_RSA_3DES_EDE_CBC_SHA1,
+                             GNUTLS_CIPHER_3DES_CBC,
+                             GNUTLS_KX_RSA, GNUTLS_MAC_SHA1, GNUTLS_SSL3),
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_RSA_AES_128_CBC_SHA1,
+                             GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_RSA,
+                             GNUTLS_MAC_SHA1, GNUTLS_SSL3),
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_RSA_AES_256_CBC_SHA1,
+                             GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_RSA,
+                             GNUTLS_MAC_SHA1, GNUTLS_SSL3),
+#ifdef  ENABLE_CAMELLIA
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_RSA_CAMELLIA_128_CBC_SHA1,
+                             GNUTLS_CIPHER_CAMELLIA_128_CBC, GNUTLS_KX_RSA,
+                             GNUTLS_MAC_SHA1, GNUTLS_TLS1),
+  GNUTLS_CIPHER_SUITE_ENTRY (GNUTLS_RSA_CAMELLIA_256_CBC_SHA1,
+                             GNUTLS_CIPHER_CAMELLIA_256_CBC, GNUTLS_KX_RSA,
+                             GNUTLS_MAC_SHA1, GNUTLS_TLS1),
+#endif
+  {0,
+   {
+    {0,
+     0}},
+   0,
+   0,
+   0,
+   0}
+};
+
+#define GNUTLS_CIPHER_SUITE_LOOP(b) \
+        const gnutls_cipher_suite_entry *p; \
+                for(p = cs_algorithms; p->name != NULL; p++) { b ; }
+
+#define GNUTLS_CIPHER_SUITE_ALG_LOOP(a) \
+                        GNUTLS_CIPHER_SUITE_LOOP( if( (p->id.suite[0] == suite->suite[0]) && (p->id.suite[1] == suite->suite[1])) { a; break; } )
+
+/* Generic Functions */
+
+int
+_gnutls_mac_priority (gnutls_session_t session,
+                      gnutls_mac_algorithm_t algorithm)
+{                               /* actually returns the priority */
+  unsigned int i;
+  for (i = 0; i < session->internals.priorities.mac.algorithms; i++)
+    {
+      if (session->internals.priorities.mac.priority[i] == algorithm)
+        return i;
+    }
+  return -1;
+}
+
+/**
+ * gnutls_mac_get_name - Returns a string with the name of the specified mac algorithm
+ * @algorithm: is a MAC algorithm
+ *
+ * Returns: a string that contains the name of the specified MAC
+ * algorithm, or %NULL.
+ **/
+const char *
+gnutls_mac_get_name (gnutls_mac_algorithm_t algorithm)
+{
+  const char *ret = NULL;
+
+  /* avoid prefix */
+  GNUTLS_HASH_ALG_LOOP (ret = p->name);
+
+  return ret;
+}
+
+/**
+ * gnutls_mac_get_id - Returns the gnutls id of the specified in string algorithm
+ * @algorithm: is a MAC algorithm name
+ *
+ * Returns: an %gnutls_mac_algorithm_tid of the specified in a string
+ * MAC algorithm, or %GNUTLS_MAC_UNKNOWN on failures.  The names are
+ * compared in a case insensitive way.
+ **/
+gnutls_mac_algorithm_t
+gnutls_mac_get_id (const char *name)
+{
+  gnutls_mac_algorithm_t ret = GNUTLS_MAC_UNKNOWN;
+
+  GNUTLS_HASH_LOOP (if (strcasecmp (p->name, name) == 0) ret = p->id)
+    ;
+
+  return ret;
+}
+
+/**
+ * gnutls_mac_get_key_size - Returns the length of the MAC's key size
+ * @algorithm: is an encryption algorithm
+ *
+ * Returns: length (in bytes) of the given MAC key size, or 0 if the
+ * given MAC algorithm is invalid.
+ *
+ **/
+size_t
+gnutls_mac_get_key_size (gnutls_mac_algorithm_t algorithm)
+{
+  size_t ret = 0;
+
+  /* avoid prefix */
+  GNUTLS_HASH_ALG_LOOP (ret = p->key_size);
+
+  return ret;
+}
+
+/**
+ * gnutls_mac_list:
+ *
+ * Get a list of hash algorithms for use as MACs.  Note that not
+ * necessarily all MACs are supported in TLS cipher suites.  For
+ * example, MD2 is not supported as a cipher suite, but is supported
+ * for other purposes (e.g., X.509 signature verification or similar).
+ *
+ * Returns: Return a zero-terminated list of %gnutls_mac_algorithm_t
+ * integers indicating the available MACs.
+ **/
+const gnutls_mac_algorithm_t *
+gnutls_mac_list (void)
+{
+  return supported_macs;
+}
+
+const char *
+_gnutls_x509_mac_to_oid (gnutls_mac_algorithm_t algorithm)
+{
+  const char *ret = NULL;
+
+  /* avoid prefix */
+  GNUTLS_HASH_ALG_LOOP (ret = p->oid);
+
+  return ret;
+}
+
+gnutls_mac_algorithm_t
+_gnutls_x509_oid2mac_algorithm (const char *oid)
+{
+  gnutls_mac_algorithm_t ret = 0;
+
+  GNUTLS_HASH_LOOP (if (p->oid && strcmp (oid, p->oid) == 0)
+                    {
+                    ret = p->id; break;}
+  )
+    ;
+
+  if (ret == 0)
+    return GNUTLS_MAC_UNKNOWN;
+  return ret;
+}
+
+int
+_gnutls_mac_is_ok (gnutls_mac_algorithm_t algorithm)
+{
+  ssize_t ret = -1;
+  GNUTLS_HASH_ALG_LOOP (ret = p->id);
+  if (ret >= 0)
+    ret = 0;
+  else
+    ret = 1;
+  return ret;
+}
+
+/* Compression Functions */
+int
+_gnutls_compression_priority (gnutls_session_t session,
+                              gnutls_compression_method_t algorithm)
+{                               /* actually returns the priority */
+  unsigned int i;
+  for (i = 0; i < session->internals.priorities.compression.algorithms; i++)
+    {
+      if (session->internals.priorities.compression.priority[i] == algorithm)
+        return i;
+    }
+  return -1;
+}
+
+/**
+ * gnutls_compression_get_name - Returns a string with the name of the specified compression algorithm
+ * @algorithm: is a Compression algorithm
+ *
+ * Returns: a pointer to a string that contains the name of the
+ * specified compression algorithm, or %NULL.
+ **/
+const char *
+gnutls_compression_get_name (gnutls_compression_method_t algorithm)
+{
+  const char *ret = NULL;
+
+  /* avoid prefix */
+  GNUTLS_COMPRESSION_ALG_LOOP (ret = p->name + sizeof ("GNUTLS_COMP_") - 1);
+
+  return ret;
+}
+
+/**
+ * gnutls_compression_get_id - Returns the gnutls id of the specified in string algorithm
+ * @algorithm: is a compression method name
+ *
+ * The names are compared in a case insensitive way.
+ *
+ * Returns: an id of the specified in a string compression method, or
+ * %GNUTLS_COMP_UNKNOWN on error.
+ *
+ **/
+gnutls_compression_method_t
+gnutls_compression_get_id (const char *name)
+{
+  gnutls_compression_method_t ret = GNUTLS_COMP_UNKNOWN;
+
+  GNUTLS_COMPRESSION_LOOP (if
+                           (strcasecmp
+                            (p->name + sizeof ("GNUTLS_COMP_") - 1,
+                             name) == 0) ret = p->id)
+    ;
+
+  return ret;
+}
+
+/**
+ * gnutls_compression_list:
+ *
+ * Get a list of compression methods.  Note that to be able to use LZO
+ * compression, you must link to libgnutls-extra and call
+ * gnutls_global_init_extra().
+ *
+ * Returns: a zero-terminated list of %gnutls_compression_method_t
+ * integers indicating the available compression methods.
+ **/
+const gnutls_compression_method_t *
+gnutls_compression_list (void)
+{
+  return supported_compressions;
+}
+
+/* return the tls number of the specified algorithm */
+int
+_gnutls_compression_get_num (gnutls_compression_method_t algorithm)
+{
+  int ret = -1;
+
+  /* avoid prefix */
+  GNUTLS_COMPRESSION_ALG_LOOP (ret = p->num);
+
+  return ret;
+}
+
+int
+_gnutls_compression_get_wbits (gnutls_compression_method_t algorithm)
+{
+  int ret = -1;
+  /* avoid prefix */
+  GNUTLS_COMPRESSION_ALG_LOOP (ret = p->window_bits);
+  return ret;
+}
+
+int
+_gnutls_compression_get_mem_level (gnutls_compression_method_t algorithm)
+{
+  int ret = -1;
+  /* avoid prefix */
+  GNUTLS_COMPRESSION_ALG_LOOP (ret = p->mem_level);
+  return ret;
+}
+
+int
+_gnutls_compression_get_comp_level (gnutls_compression_method_t algorithm)
+{
+  int ret = -1;
+  /* avoid prefix */
+  GNUTLS_COMPRESSION_ALG_LOOP (ret = p->comp_level);
+  return ret;
+}
+
+/* returns the gnutls internal ID of the TLS compression
+ * method num
+ */
+gnutls_compression_method_t
+_gnutls_compression_get_id (int num)
+{
+  gnutls_compression_method_t ret = -1;
+
+  /* avoid prefix */
+  GNUTLS_COMPRESSION_ALG_LOOP_NUM (ret = p->id);
+
+  return ret;
+}
+
+int
+_gnutls_compression_is_ok (gnutls_compression_method_t algorithm)
+{
+  ssize_t ret = -1;
+  GNUTLS_COMPRESSION_ALG_LOOP (ret = p->id);
+  if (ret >= 0)
+    ret = 0;
+  else
+    ret = 1;
+  return ret;
+}
+
+/* CIPHER functions */
+int
+_gnutls_cipher_get_block_size (gnutls_cipher_algorithm_t algorithm)
+{
+  size_t ret = 0;
+  GNUTLS_ALG_LOOP (ret = p->blocksize);
+  return ret;
+
+}
+
+/* returns the priority */
+int
+_gnutls_cipher_priority (gnutls_session_t session,
+                         gnutls_cipher_algorithm_t algorithm)
+{
+  unsigned int i;
+  for (i = 0; i < session->internals.priorities.cipher.algorithms; i++)
+    {
+      if (session->internals.priorities.cipher.priority[i] == algorithm)
+        return i;
+    }
+  return -1;
+}
+
+int
+_gnutls_cipher_is_block (gnutls_cipher_algorithm_t algorithm)
+{
+  size_t ret = 0;
+
+  GNUTLS_ALG_LOOP (ret = p->block);
+  return ret;
+
+}
+
+/**
+ * gnutls_cipher_get_key_size - Returns the length of the cipher's key size
+ * @algorithm: is an encryption algorithm
+ *
+ * Returns: length (in bytes) of the given cipher's key size, o 0 if
+ *   the given cipher is invalid.
+ **/
+size_t
+gnutls_cipher_get_key_size (gnutls_cipher_algorithm_t algorithm)
+{                               /* In bytes */
+  size_t ret = 0;
+  GNUTLS_ALG_LOOP (ret = p->keysize);
+  return ret;
+
+}
+
+int
+_gnutls_cipher_get_iv_size (gnutls_cipher_algorithm_t algorithm)
+{                               /* In bytes */
+  size_t ret = 0;
+  GNUTLS_ALG_LOOP (ret = p->iv);
+  return ret;
+
+}
+
+int
+_gnutls_cipher_get_export_flag (gnutls_cipher_algorithm_t algorithm)
+{                               /* In bytes */
+  size_t ret = 0;
+  GNUTLS_ALG_LOOP (ret = p->export_flag);
+  return ret;
+
+}
+
+/**
+ * gnutls_cipher_get_name - Returns a string with the name of the specified cipher algorithm
+ * @algorithm: is an encryption algorithm
+ *
+ * Returns: a pointer to a string that contains the name of the
+ *   specified cipher, or %NULL.
+ **/
+const char *
+gnutls_cipher_get_name (gnutls_cipher_algorithm_t algorithm)
+{
+  const char *ret = NULL;
+
+  /* avoid prefix */
+  GNUTLS_ALG_LOOP (ret = p->name);
+
+  return ret;
+}
+
+/**
+ * gnutls_cipher_get_id - Returns the gnutls id of the specified in string algorithm
+ * @algorithm: is a MAC algorithm name
+ *
+ * The names are compared in a case insensitive way.
+ *
+ * Returns: an id of the specified cipher, or %GNUTLS_CIPHER_UNKNOWN
+ * on error.
+ *
+ **/
+gnutls_cipher_algorithm_t
+gnutls_cipher_get_id (const char *name)
+{
+  gnutls_cipher_algorithm_t ret = GNUTLS_CIPHER_UNKNOWN;
+
+  GNUTLS_LOOP (if (strcasecmp (p->name, name) == 0) ret = p->id)
+    ;
+
+  return ret;
+}
+
+/**
+ * gnutls_cipher_list:
+ *
+ * Get a list of supported cipher algorithms.  Note that not
+ * necessarily all ciphers are supported as TLS cipher suites.  For
+ * example, DES is not supported as a cipher suite, but is supported
+ * for other purposes (e.g., PKCS#8 or similar).
+ *
+ * Returns: a zero-terminated list of %gnutls_cipher_algorithm_t
+ * integers indicating the available ciphers.
+ *
+ **/
+const gnutls_cipher_algorithm_t *
+gnutls_cipher_list (void)
+{
+  return supported_ciphers;
+}
+
+int
+_gnutls_cipher_is_ok (gnutls_cipher_algorithm_t algorithm)
+{
+  ssize_t ret = -1;
+  GNUTLS_ALG_LOOP (ret = p->id);
+  if (ret >= 0)
+    ret = 0;
+  else
+    ret = 1;
+  return ret;
+}
+
+/* Key EXCHANGE functions */
+mod_auth_st *
+_gnutls_kx_auth_struct (gnutls_kx_algorithm_t algorithm)
+{
+  mod_auth_st *ret = NULL;
+  GNUTLS_KX_ALG_LOOP (ret = p->auth_struct);
+  return ret;
+
+}
+
+int
+_gnutls_kx_priority (gnutls_session_t session,
+                     gnutls_kx_algorithm_t algorithm)
+{
+  unsigned int i;
+  for (i = 0; i < session->internals.priorities.kx.algorithms; i++)
+    {
+      if (session->internals.priorities.kx.priority[i] == algorithm)
+        return i;
+    }
+  return -1;
+}
+
+/**
+ * gnutls_kx_get_name - Returns a string with the name of the specified key exchange algorithm
+ * @algorithm: is a key exchange algorithm
+ *
+ * Returns: a pointer to a string that contains the name of the
+ * specified key exchange algorithm, or %NULL.
+ **/
+const char *
+gnutls_kx_get_name (gnutls_kx_algorithm_t algorithm)
+{
+  const char *ret = NULL;
+
+  /* avoid prefix */
+  GNUTLS_KX_ALG_LOOP (ret = p->name);
+
+  return ret;
+}
+
+/**
+ * gnutls_kx_get_id - Returns the gnutls id of the specified in string algorithm
+ * @algorithm: is a KX name
+ *
+ * The names are compared in a case insensitive way.
+ *
+ * Returns: an id of the specified KX algorithm, or
+ * %GNUTLS_KX_UNKNOWN on error.
+ **/
+gnutls_kx_algorithm_t
+gnutls_kx_get_id (const char *name)
+{
+  gnutls_cipher_algorithm_t ret = GNUTLS_KX_UNKNOWN;
+
+  GNUTLS_KX_LOOP (if (strcasecmp (p->name, name) == 0) ret = p->algorithm)
+    ;
+
+  return ret;
+}
+
+/**
+ * gnutls_kx_list:
+ *
+ * Get a list of supported key exchange algorithms.
+ *
+ * Returns: a zero-terminated list of %gnutls_kx_algorithm_t integers
+ * indicating the available key exchange algorithms.
+ **/
+const gnutls_kx_algorithm_t *
+gnutls_kx_list (void)
+{
+  return supported_kxs;
+}
+
+int
+_gnutls_kx_is_ok (gnutls_kx_algorithm_t algorithm)
+{
+  ssize_t ret = -1;
+  GNUTLS_KX_ALG_LOOP (ret = p->algorithm);
+  if (ret >= 0)
+    ret = 0;
+  else
+    ret = 1;
+  return ret;
+}
+
+int
+_gnutls_kx_needs_rsa_params (gnutls_kx_algorithm_t algorithm)
+{
+  ssize_t ret = 0;
+  GNUTLS_KX_ALG_LOOP (ret = p->needs_rsa_params);
+  return ret;
+}
+
+int
+_gnutls_kx_needs_dh_params (gnutls_kx_algorithm_t algorithm)
+{
+  ssize_t ret = 0;
+  GNUTLS_KX_ALG_LOOP (ret = p->needs_dh_params);
+  return ret;
+}
+
+/* Version */
+int
+_gnutls_version_priority (gnutls_session_t session, gnutls_protocol_t version)
+{                               /* actually returns the priority */
+  unsigned int i;
+
+  if (session->internals.priorities.protocol.priority == NULL)
+    {
+      gnutls_assert ();
+      return -1;
+    }
+
+  for (i = 0; i < session->internals.priorities.protocol.algorithms; i++)
+    {
+      if (session->internals.priorities.protocol.priority[i] == version)
+        return i;
+    }
+  return -1;
+}
+
+gnutls_protocol_t
+_gnutls_version_lowest (gnutls_session_t session)
+{                               /* returns the lowest version supported */
+  unsigned int i, min = 0xff;
+
+  if (session->internals.priorities.protocol.priority == NULL)
+    {
+      return GNUTLS_VERSION_UNKNOWN;
+    }
+  else
+    for (i = 0; i < session->internals.priorities.protocol.algorithms; i++)
+      {
+        if (session->internals.priorities.protocol.priority[i] < min)
+          min = session->internals.priorities.protocol.priority[i];
+      }
+
+  if (min == 0xff)
+    return GNUTLS_VERSION_UNKNOWN;      /* unknown version */
+
+  return min;
+}
+
+gnutls_protocol_t
+_gnutls_version_max (gnutls_session_t session)
+{                               /* returns the maximum version supported */
+  unsigned int i, max = 0x00;
+
+  if (session->internals.priorities.protocol.priority == NULL)
+    {
+      return GNUTLS_VERSION_UNKNOWN;
+    }
+  else
+    for (i = 0; i < session->internals.priorities.protocol.algorithms; i++)
+      {
+        if (session->internals.priorities.protocol.priority[i] > max)
+          max = session->internals.priorities.protocol.priority[i];
+      }
+
+  if (max == 0x00)
+    return GNUTLS_VERSION_UNKNOWN;      /* unknown version */
+
+  return max;
+}
+
+/**
+ * gnutls_protocol_get_name - Returns a string with the name of the specified SSL/TLS version
+ * @version: is a (gnutls) version number
+ *
+ * Returns: a string that contains the name of the specified TLS
+ * version (e.g., "TLS 1.0"), or %NULL.
+ **/
+const char *
+gnutls_protocol_get_name (gnutls_protocol_t version)
+{
+  const char *ret = NULL;
+
+  /* avoid prefix */
+  GNUTLS_VERSION_ALG_LOOP (ret = p->name);
+  return ret;
+}
+
+/**
+ * gnutls_protocol_get_id - Returns the gnutls id of the specified in string protocol
+ * @algorithm: is a protocol name
+ *
+ * The names are compared in a case insensitive way.
+ *
+ * Returns: an id of the specified protocol, or
+ * %GNUTLS_VERSION_UNKNOWN on error.
+ **/
+gnutls_protocol_t
+gnutls_protocol_get_id (const char *name)
+{
+  gnutls_protocol_t ret = GNUTLS_VERSION_UNKNOWN;
+
+  GNUTLS_VERSION_LOOP (if (strcasecmp (p->name, name) == 0) ret = p->id)
+    ;
+
+  return ret;
+}
+
+/**
+ * gnutls_protocol_list:
+ *
+ * Get a list of supported protocols, e.g. SSL 3.0, TLS 1.0 etc.
+ *
+ * Returns: a zero-terminated list of %gnutls_protocol_t integers
+ * indicating the available protocols.
+ *
+ **/
+const gnutls_protocol_t *
+gnutls_protocol_list (void)
+{
+  return supported_protocols;
+}
+
+int
+_gnutls_version_get_minor (gnutls_protocol_t version)
+{
+  int ret = -1;
+
+  GNUTLS_VERSION_ALG_LOOP (ret = p->minor);
+  return ret;
+}
+
+gnutls_protocol_t
+_gnutls_version_get (int major, int minor)
+{
+  int ret = -1;
+
+  GNUTLS_VERSION_LOOP (if ((p->major == major) && (p->minor == minor))
+                       ret = p->id)
+    ;
+  return ret;
+}
+
+int
+_gnutls_version_get_major (gnutls_protocol_t version)
+{
+  int ret = -1;
+
+  GNUTLS_VERSION_ALG_LOOP (ret = p->major);
+  return ret;
+}
+
+/* Version Functions */
+
+int
+_gnutls_version_is_supported (gnutls_session_t session,
+                              const gnutls_protocol_t version)
+{
+  int ret = 0;
+
+  GNUTLS_VERSION_ALG_LOOP (ret = p->supported);
+  if (ret == 0)
+    return 0;
+
+  if (_gnutls_version_priority (session, version) < 0)
+    return 0;                   /* disabled by the user */
+  else
+    return 1;
+}
+
+/* Type to KX mappings */
+gnutls_kx_algorithm_t
+_gnutls_map_kx_get_kx (gnutls_credentials_type_t type, int server)
+{
+  gnutls_kx_algorithm_t ret = -1;
+
+  if (server)
+    {
+      GNUTLS_KX_MAP_ALG_LOOP_SERVER (ret = p->algorithm);
+    }
+  else
+    {
+      GNUTLS_KX_MAP_ALG_LOOP_SERVER (ret = p->algorithm);
+    }
+  return ret;
+}
+
+gnutls_credentials_type_t
+_gnutls_map_kx_get_cred (gnutls_kx_algorithm_t algorithm, int server)
+{
+  gnutls_credentials_type_t ret = -1;
+  if (server)
+    {
+      GNUTLS_KX_MAP_LOOP (if (p->algorithm == algorithm) ret = p->server_type)
+        ;
+    }
+  else
+    {
+      GNUTLS_KX_MAP_LOOP (if (p->algorithm == algorithm) ret = p->client_type)
+        ;
+    }
+
+  return ret;
+}
+
+/* Cipher Suite's functions */
+gnutls_cipher_algorithm_t
+_gnutls_cipher_suite_get_cipher_algo (const cipher_suite_st * suite)
+{
+  int ret = 0;
+  GNUTLS_CIPHER_SUITE_ALG_LOOP (ret = p->block_algorithm);
+  return ret;
+}
+
+gnutls_protocol_t
+_gnutls_cipher_suite_get_version (const cipher_suite_st * suite)
+{
+  int ret = 0;
+  GNUTLS_CIPHER_SUITE_ALG_LOOP (ret = p->version);
+  return ret;
+}
+
+gnutls_kx_algorithm_t
+_gnutls_cipher_suite_get_kx_algo (const cipher_suite_st * suite)
+{
+  int ret = 0;
+
+  GNUTLS_CIPHER_SUITE_ALG_LOOP (ret = p->kx_algorithm);
+  return ret;
+
+}
+
+gnutls_mac_algorithm_t
+_gnutls_cipher_suite_get_mac_algo (const cipher_suite_st * suite)
+{                               /* In bytes */
+  int ret = 0;
+  GNUTLS_CIPHER_SUITE_ALG_LOOP (ret = p->mac_algorithm);
+  return ret;
+
+}
+
+const char *
+_gnutls_cipher_suite_get_name (cipher_suite_st * suite)
+{
+  const char *ret = NULL;
+
+  /* avoid prefix */
+  GNUTLS_CIPHER_SUITE_ALG_LOOP (ret = p->name + sizeof ("GNUTLS_") - 1);
+
+  return ret;
+}
+
+/**
+ * gnutls_cipher_suite_get_name - Returns a string with the name of the specified cipher suite
+ * @kx_algorithm: is a Key exchange algorithm
+ * @cipher_algorithm: is a cipher algorithm
+ * @mac_algorithm: is a MAC algorithm
+ *
+ * Note that the full cipher suite name must be prepended by TLS or
+ * SSL depending of the protocol in use.
+ *
+ * Returns: a string that contains the name of a TLS cipher suite,
+ * specified by the given algorithms, or %NULL.
+ **/
+const char *
+gnutls_cipher_suite_get_name (gnutls_kx_algorithm_t kx_algorithm,
+                              gnutls_cipher_algorithm_t cipher_algorithm,
+                              gnutls_mac_algorithm_t mac_algorithm)
+{
+  const char *ret = NULL;
+
+  /* avoid prefix */
+  GNUTLS_CIPHER_SUITE_LOOP (if (kx_algorithm == p->kx_algorithm &&
+                                cipher_algorithm == p->block_algorithm &&
+                                mac_algorithm == p->mac_algorithm)
+                            ret = p->name + sizeof ("GNUTLS_") - 1)
+    ;
+
+  return ret;
+}
+
+/**
+ * gnutls_cipher_suite_info:
+ * @idx: index of cipher suite to get information about, starts on 0.
+ * @cs_id: output buffer with room for 2 bytes, indicating cipher suite value
+ * @kx: output variable indicating key exchange algorithm, or %NULL.
+ * @cipher: output variable indicating cipher, or %NULL.
+ * @mac: output variable indicating MAC algorithm, or %NULL.
+ * @version: output variable indicating TLS protocol version, or %NULL.
+ *
+ * Get information about supported cipher suites.  Use the function
+ * iteratively to get information about all supported cipher suites.
+ * Call with idx=0 to get information about first cipher suite, then
+ * idx=1 and so on until the function returns NULL.
+ *
+ * Returns: the name of @idx cipher suite, and set the information
+ * about the cipher suite in the output variables.  If @idx is out of
+ * bounds, %NULL is returned.
+ **/
+const char *
+gnutls_cipher_suite_info (size_t idx,
+                          char *cs_id,
+                          gnutls_kx_algorithm_t * kx,
+                          gnutls_cipher_algorithm_t * cipher,
+                          gnutls_mac_algorithm_t * mac,
+                          gnutls_protocol_t * version)
+{
+  if (idx >= CIPHER_SUITES_COUNT)
+    return NULL;
+
+  if (cs_id)
+    memcpy (cs_id, cs_algorithms[idx].id.suite, 2);
+  if (kx)
+    *kx = cs_algorithms[idx].kx_algorithm;
+  if (cipher)
+    *cipher = cs_algorithms[idx].block_algorithm;
+  if (mac)
+    *mac = cs_algorithms[idx].mac_algorithm;
+  if (version)
+    *version = cs_algorithms[idx].version;
+
+  return cs_algorithms[idx].name + sizeof ("GNU") - 1;
+}
+
+static inline int
+_gnutls_cipher_suite_is_ok (cipher_suite_st * suite)
+{
+  size_t ret;
+  const char *name = NULL;
+
+  GNUTLS_CIPHER_SUITE_ALG_LOOP (name = p->name);
+  if (name != NULL)
+    ret = 0;
+  else
+    ret = 1;
+  return ret;
+
+}
+
+#define SWAP(x, y) memcpy(tmp,x,size); \
+                   memcpy(x,y,size); \
+                   memcpy(y,tmp,size);
+
+#define MAX_ELEM_SIZE 4
+static inline int
+_gnutls_partition (gnutls_session_t session,
+                   void *_base,
+                   size_t nmemb,
+                   size_t size,
+                   int (*compar) (gnutls_session_t,
+                                  const void *, const void *))
+{
+  uint8_t *base = _base;
+  uint8_t tmp[MAX_ELEM_SIZE];
+  uint8_t ptmp[MAX_ELEM_SIZE];
+  unsigned int pivot;
+  unsigned int i, j;
+  unsigned int full;
+
+  i = pivot = 0;
+  j = full = (nmemb - 1) * size;
+
+  memcpy (ptmp, &base[0], size);        /* set pivot item */
+
+  while (i < j)
+    {
+      while ((compar (session, &base[i], ptmp) <= 0) && (i < full))
+        {
+          i += size;
+        }
+      while ((compar (session, &base[j], ptmp) >= 0) && (j > 0))
+        j -= size;
+
+      if (i < j)
+        {
+          SWAP (&base[j], &base[i]);
+        }
+    }
+
+  if (j > pivot)
+    {
+      SWAP (&base[pivot], &base[j]);
+      pivot = j;
+    }
+  else if (i < pivot)
+    {
+      SWAP (&base[pivot], &base[i]);
+      pivot = i;
+    }
+  return pivot / size;
+}
+
+static void
+_gnutls_qsort (gnutls_session_t session,
+               void *_base,
+               size_t nmemb,
+               size_t size,
+               int (*compar) (gnutls_session_t, const void *, const void *))
+{
+  unsigned int pivot;
+  char *base = _base;
+  size_t snmemb = nmemb;
+
+#ifdef DEBUG
+  if (size > MAX_ELEM_SIZE)
+    {
+      gnutls_assert ();
+      _gnutls_debug_log ("QSORT BUG\n");
+      exit (1);
+    }
+#endif
+
+  if (snmemb <= 1)
+    return;
+  pivot = _gnutls_partition (session, _base, nmemb, size, compar);
+
+  _gnutls_qsort (session, base, pivot < nmemb ? pivot + 1
+                 : pivot, size, compar);
+  _gnutls_qsort (session, &base[(pivot + 1) * size], nmemb - pivot - 1, size,
+                 compar);
+}
+
+/* a compare function for KX algorithms (using priorities). 
+ * For use with qsort 
+ */
+static int
+_gnutls_compare_algo (gnutls_session_t session,
+                      const void *i_A1, const void *i_A2)
+{
+  gnutls_kx_algorithm_t kA1 =
+    _gnutls_cipher_suite_get_kx_algo ((const cipher_suite_st *) i_A1);
+  gnutls_kx_algorithm_t kA2 =
+    _gnutls_cipher_suite_get_kx_algo ((const cipher_suite_st *) i_A2);
+  gnutls_cipher_algorithm_t cA1 =
+    _gnutls_cipher_suite_get_cipher_algo ((const cipher_suite_st *) i_A1);
+  gnutls_cipher_algorithm_t cA2 =
+    _gnutls_cipher_suite_get_cipher_algo ((const cipher_suite_st *) i_A2);
+  gnutls_mac_algorithm_t mA1 =
+    _gnutls_cipher_suite_get_mac_algo ((const cipher_suite_st *) i_A1);
+  gnutls_mac_algorithm_t mA2 =
+    _gnutls_cipher_suite_get_mac_algo ((const cipher_suite_st *) i_A2);
+
+  int p1 = (_gnutls_kx_priority (session, kA1) + 1) * 64;
+  int p2 = (_gnutls_kx_priority (session, kA2) + 1) * 64;
+  p1 += (_gnutls_cipher_priority (session, cA1) + 1) * 8;
+  p2 += (_gnutls_cipher_priority (session, cA2) + 1) * 8;
+  p1 += _gnutls_mac_priority (session, mA1);
+  p2 += _gnutls_mac_priority (session, mA2);
+
+  if (p1 > p2)
+    {
+      return 1;
+    }
+  else
+    {
+      if (p1 == p2)
+        {
+          return 0;
+        }
+      return -1;
+    }
+}
+
+#ifdef SORT_DEBUG
+static void
+_gnutls_bsort (gnutls_session_t session, void *_base, size_t nmemb,
+               size_t size, int (*compar) (gnutls_session_t, const void *,
+                                           const void *))
+{
+  unsigned int i, j;
+  int full = nmemb * size;
+  char *base = _base;
+  char tmp[MAX_ELEM_SIZE];
+
+  for (i = 0; i < full; i += size)
+    {
+      for (j = 0; j < full; j += size)
+        {
+          if (compar (session, &base[i], &base[j]) < 0)
+            {
+              SWAP (&base[j], &base[i]);
+            }
+        }
+    }
+
+}
+#endif
+
+int
+_gnutls_supported_ciphersuites_sorted (gnutls_session_t session,
+                                       cipher_suite_st ** ciphers)
+{
+
+#ifdef SORT_DEBUG
+  unsigned int i;
+#endif
+  int count;
+
+  count = _gnutls_supported_ciphersuites (session, ciphers);
+  if (count <= 0)
+    {
+      gnutls_assert ();
+      return count;
+    }
+#ifdef SORT_DEBUG
+  _gnutls_debug_log ("Unsorted: \n");
+  for (i = 0; i < count; i++)
+    _gnutls_debug_log ("\t%d: %s\n", i,
+                       _gnutls_cipher_suite_get_name ((*ciphers)[i]));
+#endif
+
+  _gnutls_qsort (session, *ciphers, count, sizeof (cipher_suite_st),
+                 _gnutls_compare_algo);
+
+#ifdef SORT_DEBUG
+  _gnutls_debug_log ("Sorted: \n");
+  for (i = 0; i < count; i++)
+    _gnutls_debug_log ("\t%d: %s\n", i,
+                       _gnutls_cipher_suite_get_name ((*ciphers)[i]));
+#endif
+
+  return count;
+}
+
+int
+_gnutls_supported_ciphersuites (gnutls_session_t session,
+                                cipher_suite_st ** _ciphers)
+{
+
+  unsigned int i, ret_count, j;
+  unsigned int count = CIPHER_SUITES_COUNT;
+  cipher_suite_st *tmp_ciphers;
+  cipher_suite_st *ciphers;
+  gnutls_protocol_t version;
+
+  if (count == 0)
+    {
+      return 0;
+    }
+
+  tmp_ciphers = gnutls_alloca (count * sizeof (cipher_suite_st));
+  if (tmp_ciphers == NULL)
+    return GNUTLS_E_MEMORY_ERROR;
+
+  ciphers = gnutls_malloc (count * sizeof (cipher_suite_st));
+  if (ciphers == NULL)
+    {
+      gnutls_afree (tmp_ciphers);
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  version = gnutls_protocol_get_version (session);
+
+  for (i = 0; i < count; i++)
+    {
+      memcpy (&tmp_ciphers[i], &cs_algorithms[i].id,
+              sizeof (cipher_suite_st));
+    }
+
+  for (i = j = 0; i < count; i++)
+    {
+      /* remove private cipher suites, if requested.
+       */
+      if (tmp_ciphers[i].suite[0] == 0xFF && session->internals.enable_private
+          == 0)
+        continue;
+
+      /* remove cipher suites which do not support the
+       * protocol version used.
+       */
+      if (_gnutls_cipher_suite_get_version (&tmp_ciphers[i]) > version)
+        continue;
+
+      if (_gnutls_kx_priority (session,
+                               _gnutls_cipher_suite_get_kx_algo (&tmp_ciphers
+                                                                 [i])) < 0)
+        continue;
+      if (_gnutls_mac_priority (session,
+                                _gnutls_cipher_suite_get_mac_algo
+                                (&tmp_ciphers[i])) < 0)
+        continue;
+      if (_gnutls_cipher_priority (session,
+                                   _gnutls_cipher_suite_get_cipher_algo
+                                   (&tmp_ciphers[i])) < 0)
+        continue;
+
+      memcpy (&ciphers[j], &tmp_ciphers[i], sizeof (cipher_suite_st));
+      j++;
+    }
+
+  ret_count = j;
+
+#if 0                           /* expensive */
+  if (ret_count > 0 && ret_count != count)
+    {
+      ciphers =
+        gnutls_realloc_fast (ciphers, ret_count * sizeof (cipher_suite_st));
+    }
+  else
+    {
+      if (ret_count != count)
+        {
+          gnutls_free (ciphers);
+          ciphers = NULL;
+        }
+    }
+#endif
+
+  gnutls_afree (tmp_ciphers);
+
+  /* This function can no longer return 0 cipher suites.
+   * It returns an error code instead.
+   */
+  if (ret_count == 0)
+    {
+      gnutls_assert ();
+      gnutls_free (ciphers);
+      return GNUTLS_E_NO_CIPHER_SUITES;
+    }
+  *_ciphers = ciphers;
+  return ret_count;
+}
+
+/* For compression  */
+
+#define MIN_PRIVATE_COMP_ALGO 0xEF
+
+/* returns the TLS numbers of the compression methods we support 
+ */
+#define SUPPORTED_COMPRESSION_METHODS session->internals.priorities.compression.algorithms
+int
+_gnutls_supported_compression_methods (gnutls_session_t session,
+                                       uint8_t ** comp)
+{
+  unsigned int i, j;
+
+  *comp = gnutls_malloc (sizeof (uint8_t) * SUPPORTED_COMPRESSION_METHODS);
+  if (*comp == NULL)
+    return GNUTLS_E_MEMORY_ERROR;
+
+  for (i = j = 0; i < SUPPORTED_COMPRESSION_METHODS; i++)
+    {
+      int tmp = _gnutls_compression_get_num (session->internals.priorities.
+                                             compression.priority[i]);
+
+      /* remove private compression algorithms, if requested.
+       */
+      if (tmp == -1 || (tmp >= MIN_PRIVATE_COMP_ALGO
+                        && session->internals.enable_private == 0))
+        {
+          gnutls_assert ();
+          continue;
+        }
+
+      (*comp)[j] = (uint8_t) tmp;
+      j++;
+    }
+
+  if (j == 0)
+    {
+      gnutls_assert ();
+      gnutls_free (*comp);
+      *comp = NULL;
+      return GNUTLS_E_NO_COMPRESSION_ALGORITHMS;
+    }
+  return j;
+}
+
+/**
+ * gnutls_certificate_type_get_name - Returns a string with the name of the specified certificate type
+ * @type: is a certificate type
+ *
+ * Returns: a string (or %NULL) that contains the name of the
+ * specified certificate type.
+ **/
+const char *
+gnutls_certificate_type_get_name (gnutls_certificate_type_t type)
+{
+  const char *ret = NULL;
+
+  if (type == GNUTLS_CRT_X509)
+    ret = "X.509";
+  if (type == GNUTLS_CRT_OPENPGP)
+    ret = "OPENPGP";
+
+  return ret;
+}
+
+/**
+ * gnutls_certificate_type_get_id - Returns the gnutls id of the specified in string type
+ * @name: is a certificate type name
+ *
+ * The names are compared in a case insensitive way.
+ *
+ * Returns: an id of the specified in a string certificate type, or
+ * %GNUTLS_CRT_UNKNOWN on error.
+ **/
+gnutls_certificate_type_t
+gnutls_certificate_type_get_id (const char *name)
+{
+  gnutls_certificate_type_t ret = GNUTLS_CRT_UNKNOWN;
+
+  if (strcasecmp (name, "X.509") == 0 || strcasecmp (name, "X509") == 0)
+    return GNUTLS_CRT_X509;
+  if (strcasecmp (name, "OPENPGP") == 0)
+    return GNUTLS_CRT_OPENPGP;
+
+  return ret;
+}
+
+static const gnutls_certificate_type_t supported_certificate_types[] =
+  { GNUTLS_CRT_X509,
+  GNUTLS_CRT_OPENPGP,
+  0
+};
+
+/**
+ * gnutls_certificate_type_list:
+ *
+ * Get a list of certificate types.  Note that to be able to use
+ * OpenPGP certificates, you must link to libgnutls-extra and call
+ * gnutls_global_init_extra().
+ *
+ * Returns: a zero-terminated list of %gnutls_certificate_type_t
+ * integers indicating the available certificate types.
+ *
+ **/
+const gnutls_certificate_type_t *
+gnutls_certificate_type_list (void)
+{
+  return supported_certificate_types;
+}
+
+/* returns the gnutls_pk_algorithm_t which is compatible with
+ * the given gnutls_kx_algorithm_t.
+ */
+gnutls_pk_algorithm_t
+_gnutls_map_pk_get_pk (gnutls_kx_algorithm_t kx_algorithm)
+{
+  gnutls_pk_algorithm_t ret = -1;
+
+  GNUTLS_PK_MAP_ALG_LOOP (ret = p->pk_algorithm) return ret;
+}
+
+/* Returns the encipher type for the given key exchange algorithm.
+ * That one of CIPHER_ENCRYPT, CIPHER_SIGN, CIPHER_IGN.
+ *
+ * ex. GNUTLS_KX_RSA requires a certificate able to encrypt... so returns CIPHER_ENCRYPT.
+ */
+enum encipher_type
+_gnutls_kx_encipher_type (gnutls_kx_algorithm_t kx_algorithm)
+{
+  int ret = CIPHER_IGN;
+  GNUTLS_PK_MAP_ALG_LOOP (ret = p->encipher_type) return ret;
+
+}
+
+/* signature algorithms;
+ */
+struct gnutls_sign_entry
+{
+  const char *name;
+  const char *oid;
+  gnutls_sign_algorithm_t id;
+  gnutls_pk_algorithm_t pk;
+  gnutls_mac_algorithm_t mac;
+};
+typedef struct gnutls_sign_entry gnutls_sign_entry;
+
+static const gnutls_sign_entry sign_algorithms[] = {
+  {"RSA-SHA",
+   SIG_RSA_SHA1_OID,
+   GNUTLS_SIGN_RSA_SHA1,
+   GNUTLS_PK_RSA,
+   GNUTLS_MAC_SHA1},
+  {"RSA-SHA256",
+   SIG_RSA_SHA256_OID,
+   GNUTLS_SIGN_RSA_SHA256,
+   GNUTLS_PK_RSA,
+   GNUTLS_MAC_SHA256},
+  {"RSA-MD5",
+   SIG_RSA_MD5_OID,
+   GNUTLS_SIGN_RSA_MD5,
+   GNUTLS_PK_RSA,
+   GNUTLS_MAC_MD5},
+  {"GOST R 34.10-2001",
+   SIG_GOST_R3410_2001_OID,
+   0,
+   0,
+   0},
+  {"GOST R 34.10-94",
+   SIG_GOST_R3410_94_OID,
+   0,
+   0,
+   0},
+  {0,
+   0,
+   0,
+   0,
+   0}
+};
+
+#define GNUTLS_SIGN_LOOP(b) \
+  do {                                                                 \
+    const gnutls_sign_entry *p;                                        \
+    for(p = sign_algorithms; p->name != NULL; p++) { b ; }             \
+  } while (0)
+
+#define GNUTLS_SIGN_ALG_LOOP(a) \
+  GNUTLS_SIGN_LOOP( if(p->id && p->id == sign) { a; break; } )
+
+/**
+ * gnutls_sign_algorithm_get_name - Returns a string with the name of the specified sign algorithm
+ * @algorithm: is a sign algorithm
+ *
+ * Returns: a string that contains the name of the specified sign
+ * algorithm, or %NULL.
+ **/
+const char *
+gnutls_sign_algorithm_get_name (gnutls_sign_algorithm_t sign)
+{
+  const char *ret = NULL;
+
+  /* avoid prefix */
+  GNUTLS_SIGN_ALG_LOOP (ret = p->name);
+
+  return ret;
+}
+
+gnutls_sign_algorithm_t
+_gnutls_x509_oid2sign_algorithm (const char *oid)
+{
+  gnutls_sign_algorithm_t ret = 0;
+
+  GNUTLS_SIGN_LOOP (if (strcmp (oid, p->oid) == 0)
+                    {
+                    ret = p->id; break;}
+  );
+
+  if (ret == 0)
+    {
+      _gnutls_x509_log ("Unknown SIGN OID: '%s'\n", oid);
+      return GNUTLS_SIGN_UNKNOWN;
+    }
+  return ret;
+}
+
+gnutls_sign_algorithm_t
+_gnutls_x509_pk_to_sign (gnutls_pk_algorithm_t pk, gnutls_mac_algorithm_t mac)
+{
+  gnutls_sign_algorithm_t ret = 0;
+
+  GNUTLS_SIGN_LOOP (if (pk == p->pk && mac == p->mac)
+                    {
+                    ret = p->id; break;}
+  );
+
+  if (ret == 0)
+    return GNUTLS_SIGN_UNKNOWN;
+  return ret;
+}
+
+const char *
+_gnutls_x509_sign_to_oid (gnutls_pk_algorithm_t pk,
+                          gnutls_mac_algorithm_t mac)
+{
+  gnutls_sign_algorithm_t sign;
+  const char *ret = NULL;
+
+  sign = _gnutls_x509_pk_to_sign (pk, mac);
+  if (sign == GNUTLS_SIGN_UNKNOWN)
+    return NULL;
+
+  GNUTLS_SIGN_ALG_LOOP (ret = p->oid);
+  return ret;
+}
+
+/* pk algorithms;
+ */
+struct gnutls_pk_entry
+{
+  const char *name;
+  const char *oid;
+  gnutls_pk_algorithm_t id;
+};
+typedef struct gnutls_pk_entry gnutls_pk_entry;
+
+static const gnutls_pk_entry pk_algorithms[] = {
+  {"RSA",
+   PK_PKIX1_RSA_OID,
+   GNUTLS_PK_RSA},
+  {"GOST R 34.10-2001",
+   PK_GOST_R3410_2001_OID,
+   0},
+  {"GOST R 34.10-94",
+   PK_GOST_R3410_94_OID,
+   0},
+  {0,
+   0,
+   0}
+};
+
+/**
+ * gnutls_pk_algorithm_get_name - Returns a string with the name of the specified public key algorithm
+ * @algorithm: is a pk algorithm
+ *
+ * Returns: a string that contains the name of the specified public
+ * key algorithm, or %NULL.
+ **/
+const char *
+gnutls_pk_algorithm_get_name (gnutls_pk_algorithm_t algorithm)
+{
+  const char *ret = NULL;
+  const gnutls_pk_entry *p;
+
+  for (p = pk_algorithms; p->name != NULL; p++)
+    if (p->id && p->id == algorithm)
+      {
+        ret = p->name;
+        break;
+      }
+
+  return ret;
+}
+
+gnutls_pk_algorithm_t
+_gnutls_x509_oid2pk_algorithm (const char *oid)
+{
+  gnutls_pk_algorithm_t ret = GNUTLS_PK_UNKNOWN;
+  const gnutls_pk_entry *p;
+
+  for (p = pk_algorithms; p->name != NULL; p++)
+    if (strcmp (p->oid, oid) == 0)
+      {
+        ret = p->id;
+        break;
+      }
+
+  return ret;
+}
+
+const char *
+_gnutls_x509_pk_to_oid (gnutls_pk_algorithm_t algorithm)
+{
+  const char *ret = NULL;
+  const gnutls_pk_entry *p;
+
+  for (p = pk_algorithms; p->name != NULL; p++)
+    if (p->id == algorithm)
+      {
+        ret = p->oid;
+        break;
+      }
+
+  return ret;
+}
diff --git a/src/daemon/https/tls/gnutls_algorithms.h b/src/daemon/https/tls/gnutls_algorithms.h
new file mode 100644
index 00000000..fd23ef0a
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_algorithms.h
@@ -0,0 +1,141 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#ifndef ALGORITHMS_H
+# define ALGORITHMS_H
+
+#include "gnutls_auth.h"
+
+/* Functions for version handling. */
+gnutls_protocol_t _gnutls_version_lowest (gnutls_session_t session);
+gnutls_protocol_t _gnutls_version_max (gnutls_session_t session);
+int _gnutls_version_priority (gnutls_session_t session,
+                              gnutls_protocol_t version);
+int _gnutls_version_is_supported (gnutls_session_t session,
+                                  const gnutls_protocol_t version);
+int _gnutls_version_get_major (gnutls_protocol_t ver);
+int _gnutls_version_get_minor (gnutls_protocol_t ver);
+gnutls_protocol_t _gnutls_version_get (int major, int minor);
+
+/* Functions for MACs. */
+int _gnutls_mac_is_ok (gnutls_mac_algorithm_t algorithm);
+gnutls_mac_algorithm_t _gnutls_x509_oid2mac_algorithm (const char *oid);
+const char *_gnutls_x509_mac_to_oid (gnutls_mac_algorithm_t mac);
+
+/* Functions for cipher suites. */
+int _gnutls_supported_ciphersuites (gnutls_session_t session,
+                                    cipher_suite_st ** ciphers);
+int _gnutls_supported_ciphersuites_sorted (gnutls_session_t session,
+                                           cipher_suite_st ** ciphers);
+int _gnutls_supported_compression_methods (gnutls_session_t session,
+                                           uint8_t ** comp);
+const char *_gnutls_cipher_suite_get_name (cipher_suite_st * algorithm);
+gnutls_cipher_algorithm_t _gnutls_cipher_suite_get_cipher_algo (const
+                                                                cipher_suite_st
+                                                                * algorithm);
+gnutls_kx_algorithm_t _gnutls_cipher_suite_get_kx_algo (const cipher_suite_st
+                                                        * algorithm);
+gnutls_mac_algorithm_t _gnutls_cipher_suite_get_mac_algo (const
+                                                          cipher_suite_st *
+                                                          algorithm);
+gnutls_protocol_t _gnutls_cipher_suite_get_version (const cipher_suite_st *
+                                                    algorithm);
+cipher_suite_st _gnutls_cipher_suite_get_suite_name (cipher_suite_st *
+                                                     algorithm);
+
+/* Functions for ciphers. */
+int _gnutls_cipher_get_block_size (gnutls_cipher_algorithm_t algorithm);
+int _gnutls_cipher_is_block (gnutls_cipher_algorithm_t algorithm);
+int _gnutls_cipher_is_ok (gnutls_cipher_algorithm_t algorithm);
+int _gnutls_cipher_get_iv_size (gnutls_cipher_algorithm_t algorithm);
+int _gnutls_cipher_get_export_flag (gnutls_cipher_algorithm_t algorithm);
+
+/* Functions for key exchange. */
+int _gnutls_kx_needs_dh_params (gnutls_kx_algorithm_t algorithm);
+int _gnutls_kx_needs_rsa_params (gnutls_kx_algorithm_t algorithm);
+mod_auth_st *_gnutls_kx_auth_struct (gnutls_kx_algorithm_t algorithm);
+int _gnutls_kx_is_ok (gnutls_kx_algorithm_t algorithm);
+
+/* Functions for compression. */
+int _gnutls_compression_is_ok (gnutls_compression_method_t algorithm);
+int _gnutls_compression_get_num (gnutls_compression_method_t algorithm);
+gnutls_compression_method_t _gnutls_compression_get_id (int num);
+int _gnutls_compression_get_mem_level (gnutls_compression_method_t algorithm);
+int _gnutls_compression_get_comp_level (gnutls_compression_method_t
+                                        algorithm);
+int _gnutls_compression_get_wbits (gnutls_compression_method_t algorithm);
+
+/* Type to KX mappings. */
+gnutls_kx_algorithm_t _gnutls_map_kx_get_kx (gnutls_credentials_type_t type,
+                                             int server);
+gnutls_credentials_type_t _gnutls_map_kx_get_cred (gnutls_kx_algorithm_t
+                                                   algorithm, int server);
+
+/* KX to PK mapping. */
+gnutls_pk_algorithm_t _gnutls_map_pk_get_pk (gnutls_kx_algorithm_t
+                                             kx_algorithm);
+gnutls_pk_algorithm_t _gnutls_x509_oid2pk_algorithm (const char *oid);
+const char *_gnutls_x509_pk_to_oid (gnutls_pk_algorithm_t pk);
+
+enum encipher_type
+{ CIPHER_ENCRYPT = 0, CIPHER_SIGN = 1, CIPHER_IGN };
+
+enum encipher_type _gnutls_kx_encipher_type (gnutls_kx_algorithm_t algorithm);
+
+struct gnutls_compression_entry
+{
+  const char *name;
+  gnutls_compression_method_t id;
+  int num;                      /* the number reserved in TLS for the specific compression method */
+
+  /* used in zlib compressor */
+  int window_bits;
+  int mem_level;
+  int comp_level;
+};
+typedef struct gnutls_compression_entry gnutls_compression_entry;
+
+/* Functions for sign algorithms. */
+gnutls_sign_algorithm_t _gnutls_x509_oid2sign_algorithm (const char *oid);
+gnutls_sign_algorithm_t _gnutls_x509_pk_to_sign (gnutls_pk_algorithm_t pk,
+                                                 gnutls_mac_algorithm_t mac);
+const char *_gnutls_x509_sign_to_oid (gnutls_pk_algorithm_t,
+                                      gnutls_mac_algorithm_t mac);
+
+int _gnutls_mac_priority (gnutls_session_t session,
+                          gnutls_mac_algorithm_t algorithm);
+int _gnutls_cipher_priority (gnutls_session_t session,
+                             gnutls_cipher_algorithm_t algorithm);
+int _gnutls_kx_priority (gnutls_session_t session,
+                         gnutls_kx_algorithm_t algorithm);
+int _gnutls_compression_priority (gnutls_session_t session,
+                                  gnutls_compression_method_t algorithm);
+
+gnutls_mac_algorithm_t gnutls_mac_get_id (const char* name);
+gnutls_cipher_algorithm_t gnutls_cipher_get_id (const char* name);
+gnutls_kx_algorithm_t gnutls_kx_get_id (const char* name);
+gnutls_protocol_t gnutls_protocol_get_id (const char* name);
+gnutls_certificate_type_t gnutls_certificate_type_get_id (const char* name);
+
+#endif
diff --git a/src/daemon/https/tls/gnutls_anon_cred.c b/src/daemon/https/tls/gnutls_anon_cred.c
new file mode 100644
index 00000000..919315ef
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_anon_cred.c
@@ -0,0 +1,137 @@
+/*
+ * Copyright (C) 2001, 2004, 2005, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include "gnutls_int.h"
+
+#ifdef ENABLE_ANON
+
+#include "gnutls_errors.h"
+#include "auth_anon.h"
+#include "gnutls_auth_int.h"
+#include "gnutls_dh.h"
+#include "gnutls_num.h"
+#include "gnutls_mpi.h"
+
+static const int anon_dummy;
+
+/**
+  * gnutls_anon_free_server_credentials - Used to free an allocated gnutls_anon_server_credentials_t structure
+  * @sc: is an #gnutls_anon_server_credentials_t structure.
+  *
+  * This structure is complex enough to manipulate directly thus this
+  * helper function is provided in order to free (deallocate) it.
+  **/
+void
+gnutls_anon_free_server_credentials (gnutls_anon_server_credentials_t sc)
+{
+
+  gnutls_free (sc);
+}
+
+/**
+  * gnutls_anon_allocate_server_credentials - Used to allocate an gnutls_anon_server_credentials_t structure
+  * @sc: is a pointer to an #gnutls_anon_server_credentials_t structure.
+  *
+  * This structure is complex enough to manipulate directly thus this
+  * helper function is provided in order to allocate it.
+  *
+  * Returns: %GNUTLS_E_SUCCESS on success, or an error code.
+  **/
+int
+gnutls_anon_allocate_server_credentials (gnutls_anon_server_credentials_t *
+                                         sc)
+{
+
+  *sc = gnutls_calloc (1, sizeof (anon_server_credentials_st));
+
+  return 0;
+}
+
+
+/**
+  * gnutls_anon_free_client_credentials - Used to free an allocated gnutls_anon_client_credentials_t structure
+  * @sc: is an #gnutls_anon_client_credentials_t structure.
+  *
+  * This structure is complex enough to manipulate directly thus this
+  * helper function is provided in order to free (deallocate) it.
+  **/
+void
+gnutls_anon_free_client_credentials (gnutls_anon_client_credentials_t sc)
+{
+}
+
+/**
+ * gnutls_anon_allocate_client_credentials - Used to allocate a credentials structure
+ * @sc: is a pointer to an #gnutls_anon_client_credentials_t structure.
+ *
+ * This structure is complex enough to manipulate directly thus
+ * this helper function is provided in order to allocate it.
+ *
+ * Returns: %GNUTLS_E_SUCCESS on success, or an error code.
+ **/
+int
+gnutls_anon_allocate_client_credentials (gnutls_anon_client_credentials_t *
+                                         sc)
+{
+  /* anon_dummy is only there for *sc not to be null.
+   * it is not used at all;
+   */
+  *sc = (void *) &anon_dummy;
+
+  return 0;
+}
+
+/**
+  * gnutls_anon_set_server_dh_params - This function will set the DH parameters for a server to use
+  * @res: is a gnutls_anon_server_credentials_t structure
+  * @dh_params: is a structure that holds diffie hellman parameters.
+  *
+  * This function will set the diffie hellman parameters for an
+  * anonymous server to use.  These parameters will be used in
+  * Anonymous Diffie Hellman cipher suites.
+  **/
+void
+gnutls_anon_set_server_dh_params (gnutls_anon_server_credentials_t res,
+                                  gnutls_dh_params_t dh_params)
+{
+  res->dh_params = dh_params;
+}
+
+/**
+  * gnutls_anon_set_server_params_function - This function will set the DH parameters callback
+  * @res: is a gnutls_certificate_credentials_t structure
+  * @func: is the function to be called
+  *
+  * This function will set a callback in order for the server to get
+  * the diffie hellman parameters for anonymous authentication.  The
+  * callback should return zero on success.
+  **/
+void
+gnutls_anon_set_server_params_function (gnutls_anon_server_credentials_t res,
+                                        gnutls_params_function * func)
+{
+  res->params_func = func;
+}
+
+#endif
diff --git a/src/daemon/https/tls/gnutls_asn1_tab.c b/src/daemon/https/tls/gnutls_asn1_tab.c
new file mode 100644
index 00000000..cabea4e1
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_asn1_tab.c
@@ -0,0 +1,63 @@
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <libtasn1.h>
+
+extern const ASN1_ARRAY_TYPE gnutls_asn1_tab[] = {
+  {"GNUTLS", 536872976, 0},
+  {0, 1073741836, 0},
+  {"RSAPublicKey", 1610612741, 0},
+  {"modulus", 1073741827, 0},
+  {"publicExponent", 3, 0},
+  {"RSAPrivateKey", 1610612741, 0},
+  {"version", 1073741826, "Version"},
+  {"modulus", 1073741827, 0},
+  {"publicExponent", 1073741827, 0},
+  {"privateExponent", 1073741827, 0},
+  {"prime1", 1073741827, 0},
+  {"prime2", 1073741827, 0},
+  {"exponent1", 1073741827, 0},
+  {"exponent2", 1073741827, 0},
+  {"coefficient", 1073741827, 0},
+  {"otherPrimeInfos", 16386, "OtherPrimeInfos"},
+  {"Version", 1610874883, 0},
+  {"two-prime", 1073741825, "0"},
+  {"multi", 1, "1"},
+  {"OtherPrimeInfos", 1612709899, 0},
+  {"MAX", 1074266122, "1"},
+  {0, 2, "OtherPrimeInfo"},
+  {"OtherPrimeInfo", 1610612741, 0},
+  {"prime", 1073741827, 0},
+  {"exponent", 1073741827, 0},
+  {"coefficient", 3, 0},
+  {"AlgorithmIdentifier", 1610612741, 0},
+  {"algorithm", 1073741836, 0},
+  {"parameters", 541081613, 0},
+  {"algorithm", 1, 0},
+  {"DigestInfo", 1610612741, 0},
+  {"digestAlgorithm", 1073741826, "DigestAlgorithmIdentifier"},
+  {"digest", 2, "Digest"},
+  {"DigestAlgorithmIdentifier", 1073741826, "AlgorithmIdentifier"},
+  {"Digest", 1073741831, 0},
+  {"DSAPublicKey", 1073741827, 0},
+  {"DSAParameters", 1610612741, 0},
+  {"p", 1073741827, 0},
+  {"q", 1073741827, 0},
+  {"g", 3, 0},
+  {"DSASignatureValue", 1610612741, 0},
+  {"r", 1073741827, 0},
+  {"s", 3, 0},
+  {"DSAPrivateKey", 1610612741, 0},
+  {"version", 1073741827, 0},
+  {"p", 1073741827, 0},
+  {"q", 1073741827, 0},
+  {"g", 1073741827, 0},
+  {"Y", 1073741827, 0},
+  {"priv", 3, 0},
+  {"DHParameter", 536870917, 0},
+  {"prime", 1073741827, 0},
+  {"base", 1073741827, 0},
+  {"privateValueLength", 16387, 0},
+  {0, 0, 0}
+};
diff --git a/src/daemon/https/tls/gnutls_auth.c b/src/daemon/https/tls/gnutls_auth.c
new file mode 100644
index 00000000..89640402
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_auth.c
@@ -0,0 +1,413 @@
+/*
+ * Copyright (C) 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include "gnutls_int.h"
+#include "gnutls_errors.h"
+#include "gnutls_auth.h"
+#include "gnutls_auth_int.h"
+#include "gnutls_algorithms.h"
+#include "auth_cert.h"
+#include <gnutls_datum.h>
+
+#include "auth_anon.h"
+/* The functions here are used in order for authentication algorithms
+ * to be able to retrieve the needed credentials eg public and private
+ * key etc.
+ */
+
+/**
+  * gnutls_credentials_clear - Clears all the credentials previously set
+  * @session: is a #gnutls_session_t structure.
+  *
+  * Clears all the credentials previously set in this session.
+  *
+  **/
+void
+gnutls_credentials_clear (gnutls_session_t session)
+{
+  if (session->key && session->key->cred)
+    {                           /* beginning of the list */
+      auth_cred_st *ccred, *ncred;
+      ccred = session->key->cred;
+      while (ccred != NULL)
+        {
+          ncred = ccred->next;
+          gnutls_free (ccred);
+          ccred = ncred;
+        }
+      session->key->cred = NULL;
+    }
+}
+
+/* 
+ * This creates a linked list of the form:
+ * { algorithm, credentials, pointer to next }
+ */
+/**
+  * gnutls_credentials_set - Sets the needed credentials for the specified authentication algorithm.
+  * @session: is a #gnutls_session_t structure.
+  * @type: is the type of the credentials
+  * @cred: is a pointer to a structure.
+  *
+  * Sets the needed credentials for the specified type.
+  * Eg username, password - or public and private keys etc.  
+  * The (void* cred) parameter is a structure that depends on the
+  * specified type and on the current session (client or server).
+  * [ In order to minimize memory usage, and share credentials between 
+  * several threads gnutls keeps a pointer to cred, and not the whole cred
+  * structure. Thus you will have to keep the structure allocated until   
+  * you call gnutls_deinit(). ]
+  *
+  * For GNUTLS_CRD_ANON cred should be gnutls_anon_client_credentials_t in case of a client.
+  * In case of a server it should be gnutls_anon_server_credentials_t.
+  * 
+  * For GNUTLS_CRD_SRP cred should be gnutls_srp_client_credentials_t
+  * in case of a client, and gnutls_srp_server_credentials_t, in case
+  * of a server.
+  *
+  * For GNUTLS_CRD_CERTIFICATE cred should be gnutls_certificate_credentials_t.
+  *
+  **/
+int
+gnutls_credentials_set (gnutls_session_t session,
+                        gnutls_credentials_type_t type, void *cred)
+{
+  auth_cred_st *ccred = NULL, *pcred = NULL;
+  int exists = 0;
+
+  if (session->key->cred == NULL)
+    {                           /* beginning of the list */
+
+      session->key->cred = gnutls_malloc (sizeof (auth_cred_st));
+      if (session->key->cred == NULL)
+        return GNUTLS_E_MEMORY_ERROR;
+
+      /* copy credentials locally */
+      session->key->cred->credentials = cred;
+
+      session->key->cred->next = NULL;
+      session->key->cred->algorithm = type;
+    }
+  else
+    {
+      ccred = session->key->cred;
+      while (ccred != NULL)
+        {
+          if (ccred->algorithm == type)
+            {
+              exists = 1;
+              break;
+            }
+          pcred = ccred;
+          ccred = ccred->next;
+        }
+      /* After this, pcred is not null.
+       */
+
+      if (exists == 0)
+        {                       /* new entry */
+          pcred->next = gnutls_malloc (sizeof (auth_cred_st));
+          if (pcred->next == NULL)
+            return GNUTLS_E_MEMORY_ERROR;
+
+          ccred = pcred->next;
+
+          /* copy credentials locally */
+          ccred->credentials = cred;
+
+          ccred->next = NULL;
+          ccred->algorithm = type;
+        }
+      else
+        {                       /* modify existing entry */
+          gnutls_free (ccred->credentials);
+          ccred->credentials = cred;
+        }
+    }
+
+  return 0;
+}
+
+/**
+  * gnutls_auth_get_type - Returns the type of credentials for the current authentication schema.
+  * @session: is a #gnutls_session_t structure.
+  *
+  * Returns type of credentials for the current authentication schema.
+  * The returned information is to be used to distinguish the function used
+  * to access authentication data.
+  * 
+  * Eg. for CERTIFICATE ciphersuites (key exchange algorithms: KX_RSA, KX_DHE_RSA),
+  * the same function are to be used to access the authentication data.
+  **/
+gnutls_credentials_type_t
+gnutls_auth_get_type (gnutls_session_t session)
+{
+/* This is not the credentials we must set, but the authentication data
+ * we get by the peer, so it should be reversed.
+ */
+  int server = session->security_parameters.entity == GNUTLS_SERVER ? 0 : 1;
+
+  return
+    _gnutls_map_kx_get_cred (_gnutls_cipher_suite_get_kx_algo
+                             (&session->security_parameters.
+                              current_cipher_suite), server);
+}
+
+/**
+  * gnutls_auth_server_get_type - Returns the type of credentials for the server authentication schema.
+  * @session: is a #gnutls_session_t structure.
+  *
+  * Returns the type of credentials that were used for server authentication.
+  * The returned information is to be used to distinguish the function used
+  * to access authentication data.
+  * 
+  **/
+gnutls_credentials_type_t
+gnutls_auth_server_get_type (gnutls_session_t session)
+{
+  return
+    _gnutls_map_kx_get_cred (_gnutls_cipher_suite_get_kx_algo
+                             (&session->security_parameters.
+                              current_cipher_suite), 1);
+}
+
+/**
+  * gnutls_auth_client_get_type - Returns the type of credentials for the client authentication schema.
+  * @session: is a #gnutls_session_t structure.
+  *
+  * Returns the type of credentials that were used for client authentication.
+  * The returned information is to be used to distinguish the function used
+  * to access authentication data.
+  * 
+  **/
+gnutls_credentials_type_t
+gnutls_auth_client_get_type (gnutls_session_t session)
+{
+  return
+    _gnutls_map_kx_get_cred (_gnutls_cipher_suite_get_kx_algo
+                             (&session->security_parameters.
+                              current_cipher_suite), 0);
+}
+
+
+/* 
+ * This returns a pointer to the linked list. Don't
+ * free that!!!
+ */
+const void *
+_gnutls_get_kx_cred (gnutls_session_t session,
+                     gnutls_kx_algorithm_t algo, int *err)
+{
+  int server = session->security_parameters.entity == GNUTLS_SERVER ? 1 : 0;
+
+  return _gnutls_get_cred (session->key,
+                           _gnutls_map_kx_get_cred (algo, server), err);
+}
+
+const void *
+_gnutls_get_cred (gnutls_key_st key, gnutls_credentials_type_t type, int *err)
+{
+  const void *retval = NULL;
+  int _err = -1;
+  auth_cred_st *ccred;
+
+  if (key == NULL)
+    goto out;
+
+  ccred = key->cred;
+  while (ccred != NULL)
+    {
+      if (ccred->algorithm == type)
+        {
+          break;
+        }
+      ccred = ccred->next;
+    }
+  if (ccred == NULL)
+    goto out;
+
+  _err = 0;
+  retval = ccred->credentials;
+
+out:
+  if (err != NULL)
+    *err = _err;
+  return retval;
+}
+
+/*-
+  * _gnutls_get_auth_info - Returns a pointer to authentication information.
+  * @session: is a #gnutls_session_t structure.
+  *
+  * This function must be called after a succesful gnutls_handshake().
+  * Returns a pointer to authentication information. That information
+  * is data obtained by the handshake protocol, the key exchange algorithm,
+  * and the TLS extensions messages.
+  *
+  * In case of GNUTLS_CRD_ANON returns a type of &anon_(server/client)_auth_info_t;
+  * In case of GNUTLS_CRD_CERTIFICATE returns a type of &cert_auth_info_t;
+  * In case of GNUTLS_CRD_SRP returns a type of &srp_(server/client)_auth_info_t;
+  -*/
+void *
+_gnutls_get_auth_info (gnutls_session_t session)
+{
+  return session->key->auth_info;
+}
+
+/*-
+  * _gnutls_free_auth_info - Frees the auth info structure
+  * @session: is a #gnutls_session_t structure.
+  *
+  * This function frees the auth info structure and sets it to
+  * null. It must be called since some structures contain malloced
+  * elements.
+  -*/
+void
+_gnutls_free_auth_info (gnutls_session_t session)
+{
+  dh_info_st *dh_info;
+  rsa_info_st *rsa_info;
+
+  if (session == NULL || session->key == NULL)
+    {
+      gnutls_assert ();
+      return;
+    }
+
+  switch (session->key->auth_info_type)
+    {
+    case GNUTLS_CRD_SRP:
+      break;
+    case GNUTLS_CRD_ANON:
+      {
+        anon_auth_info_t info = _gnutls_get_auth_info (session);
+
+        if (info == NULL)
+          break;
+
+        dh_info = &info->dh;
+        _gnutls_free_dh_info (dh_info);
+      }
+      break;
+    case GNUTLS_CRD_CERTIFICATE:
+      {
+        unsigned int i;
+        cert_auth_info_t info = _gnutls_get_auth_info (session);
+
+        if (info == NULL)
+          break;
+
+        dh_info = &info->dh;
+        rsa_info = &info->rsa_export;
+        for (i = 0; i < info->ncerts; i++)
+          {
+            _gnutls_free_datum (&info->raw_certificate_list[i]);
+          }
+
+        gnutls_free (info->raw_certificate_list);
+        info->raw_certificate_list = NULL;
+        info->ncerts = 0;
+
+        _gnutls_free_dh_info (dh_info);
+        _gnutls_free_rsa_info (rsa_info);
+      }
+
+
+      break;
+    default:
+      return;
+
+    }
+
+  gnutls_free (session->key->auth_info);
+  session->key->auth_info = NULL;
+  session->key->auth_info_size = 0;
+  session->key->auth_info_type = 0;
+
+}
+
+/* This function will set the auth info structure in the key
+ * structure.
+ * If allow change is !=0 then this will allow changing the auth
+ * info structure to a different type.
+ */
+int
+_gnutls_auth_info_set (gnutls_session_t session,
+                       gnutls_credentials_type_t type, int size,
+                       int allow_change)
+{
+  if (session->key->auth_info == NULL)
+    {
+      session->key->auth_info = gnutls_calloc (1, size);
+      if (session->key->auth_info == NULL)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_MEMORY_ERROR;
+        }
+      session->key->auth_info_type = type;
+      session->key->auth_info_size = size;
+    }
+  else
+    {
+      if (allow_change == 0)
+        {
+          /* If the credentials for the current authentication scheme,
+           * are not the one we want to set, then it's an error.
+           * This may happen if a rehandshake is performed an the
+           * ciphersuite which is negotiated has different authentication
+           * schema.
+           */
+          if (gnutls_auth_get_type (session) != session->key->auth_info_type)
+            {
+              gnutls_assert ();
+              return GNUTLS_E_INVALID_REQUEST;
+            }
+        }
+      else
+        {
+          /* The new behaviour: Here we reallocate the auth info structure
+           * in order to be able to negotiate different authentication
+           * types. Ie. perform an auth_anon and then authenticate again using a
+           * certificate (in order to prevent revealing the certificate's contents,
+           * to passive eavesdropers.
+           */
+          if (gnutls_auth_get_type (session) != session->key->auth_info_type)
+            {
+
+              _gnutls_free_auth_info (session);
+
+              session->key->auth_info = calloc (1, size);
+              if (session->key->auth_info == NULL)
+                {
+                  gnutls_assert ();
+                  return GNUTLS_E_MEMORY_ERROR;
+                }
+
+              session->key->auth_info_type = type;
+              session->key->auth_info_size = size;
+            }
+        }
+    }
+  return 0;
+}
diff --git a/src/daemon/https/tls/gnutls_auth.h b/src/daemon/https/tls/gnutls_auth.h
new file mode 100644
index 00000000..07d81352
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_auth.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#ifndef GNUTLS_AUTH_H
+# define GNUTLS_AUTH_H
+
+typedef struct mod_auth_st_int
+{
+  const char *name;             /* null terminated */
+  int (*gnutls_generate_server_certificate) (gnutls_session_t, opaque **);
+  int (*gnutls_generate_client_certificate) (gnutls_session_t, opaque **);
+  int (*gnutls_generate_server_kx) (gnutls_session_t, opaque **);
+  int (*gnutls_generate_client_kx) (gnutls_session_t, opaque **);       /* used in SRP */
+  int (*gnutls_generate_client_cert_vrfy) (gnutls_session_t, opaque **);
+  int (*gnutls_generate_server_certificate_request) (gnutls_session_t,
+                                                     opaque **);
+
+  int (*gnutls_process_server_certificate) (gnutls_session_t, opaque *,
+                                            size_t);
+  int (*gnutls_process_client_certificate) (gnutls_session_t, opaque *,
+                                            size_t);
+  int (*gnutls_process_server_kx) (gnutls_session_t, opaque *, size_t);
+  int (*gnutls_process_client_kx) (gnutls_session_t, opaque *, size_t);
+  int (*gnutls_process_client_cert_vrfy) (gnutls_session_t, opaque *, size_t);
+  int (*gnutls_process_server_certificate_request) (gnutls_session_t,
+                                                    opaque *, size_t);
+} mod_auth_st;
+
+#endif
diff --git a/src/daemon/https/tls/gnutls_auth_int.h b/src/daemon/https/tls/gnutls_auth_int.h
new file mode 100644
index 00000000..85fe53a1
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_auth_int.h
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+const void *_gnutls_get_cred (gnutls_key_st key,
+                              gnutls_credentials_type_t kx, int *err);
+const void *_gnutls_get_kx_cred (gnutls_session_t session,
+                                 gnutls_kx_algorithm_t algo, int *err);
+void *_gnutls_get_auth_info (gnutls_session_t session);
+int _gnutls_auth_info_set (gnutls_session_t session,
+                           gnutls_credentials_type_t type, int size,
+                           int allow_change);
diff --git a/src/daemon/https/tls/gnutls_buffer.h b/src/daemon/https/tls/gnutls_buffer.h
new file mode 100644
index 00000000..5c552a7a
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_buffer.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include <gnutls_str.h>
+
+typedef gnutls_string gnutls_buffer;
+
+#define _gnutls_buffer_init(buf) _gnutls_string_init(buf, gnutls_malloc, gnutls_realloc, gnutls_free);
+#define _gnutls_buffer_clear _gnutls_string_clear
+#define _gnutls_buffer_append _gnutls_string_append_data
diff --git a/src/daemon/https/tls/gnutls_buffers.c b/src/daemon/https/tls/gnutls_buffers.c
new file mode 100644
index 00000000..5a272dca
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_buffers.c
@@ -0,0 +1,1241 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* This is the only file that uses the berkeley sockets API.
+ * 
+ * Also holds all the buffering code used in gnutls.
+ * The buffering code works as:
+ *
+ * RECORD LAYER: 
+ *  1. uses a buffer to hold data (application/handshake),
+ *    we got but they were not requested, yet.
+ *  (see gnutls_record_buffer_put(), gnutls_record_buffer_get_size() etc.)
+ *
+ *  2. uses a buffer to hold data that were incomplete (ie the read/write
+ *    was interrupted)
+ *  (see _gnutls_io_read_buffered(), _gnutls_io_write_buffered() etc.)
+ * 
+ * HANDSHAKE LAYER:
+ *  1. Uses a buffer to hold data that was not sent or received
+ *  complete. (E.g. sent 10 bytes of a handshake packet that is 20 bytes
+ *  long).
+ * (see _gnutls_handshake_send_int(), _gnutls_handshake_recv_int())
+ *
+ *  2. Uses buffer to hold the last received handshake message.
+ *  (see _gnutls_handshake_buffer_put() etc.)
+ *
+ */
+
+#include <gnutls_int.h>
+#include <gnutls_errors.h>
+#include <gnutls_num.h>
+#include <gnutls_record.h>
+#include <gnutls_buffers.h>
+
+#include <errno.h>
+
+#ifdef _WIN32
+# include <winsock2.h>
+#endif
+
+#ifndef EAGAIN
+# define EAGAIN EWOULDBLOCK
+#endif
+
+#ifdef IO_DEBUG
+# include <io_debug.h>
+#endif
+
+/**
+ * gnutls_transport_set_errno:
+ * @session: is a #gnutls_session_t structure.
+ * @err: error value to store in session-specific errno variable.
+ *
+ * Store @err in the session-specific errno variable.  Useful values
+ * for @err is EAGAIN and EINTR, other values are treated will be
+ * treated as real errors in the push/pull function.
+ *
+ * This function is useful in replacement push/pull functions set by
+ * gnutls_transport_set_push_function and
+ * gnutls_transport_set_pullpush_function under Windows, where the
+ * replacement push/pull may not have access to the same @errno
+ * variable that is used by GnuTLS (e.g., the application is linked to
+ * msvcr71.dll and gnutls is linked to msvcrt.dll).
+ *
+ * If you don't have the @session variable easily accessible from the
+ * push/pull function, and don't worry about thread conflicts, you can
+ * also use gnutls_transport_set_global_errno().
+ **/
+void gnutls_transport_set_errno(gnutls_session_t session,
+                                int err)
+{
+  session->internals.errnum = err;
+}
+
+/**
+ * gnutls_transport_set_global_errno:
+ * @err: error value to store in global errno variable.
+ *
+ * Store @err in the global errno variable.  Useful values for @err is
+ * EAGAIN and EINTR, other values are treated will be treated as real
+ * errors in the push/pull function.
+ *
+ * This function is useful in replacement push/pull functions set by
+ * gnutls_transport_set_push_function and
+ * gnutls_transport_set_pullpush_function under Windows, where the
+ * replacement push/pull may not have access to the same @errno
+ * variable that is used by GnuTLS (e.g., the application is linked to
+ * msvcr71.dll and gnutls is linked to msvcrt.dll).
+ *
+ * Whether this function is thread safe or not depends on whether the
+ * global variable errno is thread safe, some system libraries make it
+ * a thread-local variable.  When feasible, using the guaranteed
+ * thread-safe gnutls_transport_set_errno() may be better.
+ **/
+void gnutls_transport_set_global_errno(int err)
+{
+  errno = err;
+}
+
+/* Buffers received packets of type APPLICATION DATA and
+ * HANDSHAKE DATA.
+ */
+int _gnutls_record_buffer_put(content_type_t type,
+                              gnutls_session_t session,
+                              opaque * data,
+                              size_t length)
+{
+  gnutls_buffer *buf;
+
+  if (length == 0)
+    return 0;
+
+  switch (type)
+    {
+  case GNUTLS_APPLICATION_DATA:
+    buf = &session->internals.application_data_buffer;
+    _gnutls_buffers_log ("BUF[REC]: Inserted %d bytes of Data(%d)\n",
+        length, type);
+    break;
+
+  case GNUTLS_HANDSHAKE:
+    buf = &session->internals.handshake_data_buffer;
+    _gnutls_buffers_log ("BUF[HSK]: Inserted %d bytes of Data(%d)\n",
+        length, type);
+    break;
+
+  case GNUTLS_INNER_APPLICATION:
+    buf = &session->internals.ia_data_buffer;
+    _gnutls_buffers_log ("BUF[IA]: Inserted %d bytes of Data(%d)\n", length,
+        type);
+    break;
+
+  default:
+    gnutls_assert ()
+    ;
+    return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (_gnutls_buffer_append (buf, data, length) < 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  return 0;
+}
+
+int _gnutls_record_buffer_get_size(content_type_t type,
+                                   gnutls_session_t session)
+{
+  switch (type)
+    {
+  case GNUTLS_APPLICATION_DATA:
+    return session->internals.application_data_buffer.length;
+
+  case GNUTLS_HANDSHAKE:
+    return session->internals.handshake_data_buffer.length;
+
+  case GNUTLS_INNER_APPLICATION:
+    return session->internals.ia_data_buffer.length;
+
+  default:
+    return GNUTLS_E_INVALID_REQUEST;
+    }
+}
+
+/**
+ * gnutls_record_check_pending - checks if there are any data to receive in gnutls buffers.
+ * @session: is a #gnutls_session_t structure.
+ *
+ * This function checks if there are any data to receive
+ * in the gnutls buffers. Returns the size of that data or 0.
+ * Notice that you may also use select() to check for data in
+ * a TCP connection, instead of this function.
+ * (gnutls leaves some data in the tcp buffer in order for select
+ * to work).
+ **/
+size_t gnutls_record_check_pending(gnutls_session_t session)
+{
+  return _gnutls_record_buffer_get_size(GNUTLS_APPLICATION_DATA, session);
+}
+
+int _gnutls_record_buffer_get(content_type_t type,
+                              gnutls_session_t session,
+                              opaque * data,
+                              size_t length)
+{
+  if (length == 0 || data == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  switch (type)
+    {
+  case GNUTLS_APPLICATION_DATA:
+
+    if (length > session->internals.application_data_buffer.length)
+      {
+        length = session->internals.application_data_buffer.length;
+      }
+
+    _gnutls_buffers_log ("BUFFER[REC][AD]: Read %d bytes of Data(%d)\n",
+        length, type);
+
+    session->internals.application_data_buffer.length -= length;
+    memcpy(data, session->internals.application_data_buffer.data, length);
+
+    /* overwrite buffer */
+    memmove(session->internals.application_data_buffer.data,
+             &session->internals.application_data_buffer.data[length],
+            session->internals.application_data_buffer.length);
+
+    /* we do no longer realloc the application_data_buffer.data,
+     * since it serves no practical reason. It also decreases
+     * performance.
+     */
+    break;
+
+  case GNUTLS_HANDSHAKE:
+    if (length > session->internals.handshake_data_buffer.length)
+      {
+        length = session->internals.handshake_data_buffer.length;
+      }
+
+    _gnutls_buffers_log ("BUF[REC][HD]: Read %d bytes of Data(%d)\n",
+        length, type);
+
+    session->internals.handshake_data_buffer.length -= length;
+    memcpy(data, session->internals.handshake_data_buffer.data, length);
+
+    /* overwrite buffer */
+    memmove(session->internals.handshake_data_buffer.data,
+             &session->internals.handshake_data_buffer.data[length],
+            session->internals.handshake_data_buffer.length);
+
+    break;
+
+  case GNUTLS_INNER_APPLICATION:
+    if (length > session->internals.ia_data_buffer.length)
+      length = session->internals.ia_data_buffer.length;
+
+    _gnutls_buffers_log ("BUF[REC][IA]: Read %d bytes of Data(%d)\n",
+        length, type);
+
+    session->internals.ia_data_buffer.length -= length;
+    memcpy(data, session->internals.ia_data_buffer.data, length);
+
+    /* overwrite buffer */
+    memmove(session->internals.ia_data_buffer.data,
+             &session->internals.ia_data_buffer.data[length],
+            session->internals.ia_data_buffer.length);
+
+    break;
+
+  default:
+    gnutls_assert ()
+    ;
+    return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return length;
+}
+
+/* This function is like read. But it does not return -1 on error.
+ * It does return gnutls_errno instead.
+ *
+ * Flags are only used if the default recv() function is being used.
+ */
+static ssize_t _gnutls_read(gnutls_session_t session,
+                            void *iptr,
+                            size_t sizeOfPtr,
+                            int flags)
+{
+  size_t left;
+  ssize_t i = 0;
+  char *ptr = iptr;
+  unsigned j, x, sum = 0;
+  gnutls_transport_ptr_t fd = session->internals.transport_recv_ptr;
+
+  session->internals.direction = 0;
+
+  left = sizeOfPtr;
+  while (left > 0)
+    {
+
+      session->internals.errnum = 0;
+
+      if (session->internals._gnutls_pull_func == NULL)
+        {
+          i = recv(GNUTLS_POINTER_TO_INT (fd), &ptr[sizeOfPtr - left], left,
+          flags);
+#if HAVE_WINSOCK
+          if (i < 0)
+            {
+              int tmperr = WSAGetLastError ();
+              switch (tmperr)
+                {
+                  case WSAEWOULDBLOCK:
+                  session->internals.errnum = EAGAIN;
+                  break;
+
+                  case WSAEINTR:
+                  session->internals.errnum = EINTR;
+                  break;
+
+                  default:
+                  session->internals.errnum = EIO;
+                  break;
+                }
+              WSASetLastError (tmperr);
+            }
+#endif
+        }
+      else
+        i = session->internals._gnutls_pull_func(fd, &ptr[sizeOfPtr -
+        left], left);
+
+      if (i < 0)
+        {
+          int err = session->internals.errnum ? session->internals.errnum
+                                              : errno;
+
+          _gnutls_read_log ("READ: %d returned from %d, errno=%d gerrno=%d\n",
+              i, fd, errno, session->internals.errnum);
+
+          if (err == EAGAIN || err == EINTR)
+            {
+              if (sizeOfPtr - left > 0)
+                {
+
+                  _gnutls_read_log ("READ: returning %d bytes from %d\n",
+                      sizeOfPtr - left, fd);
+
+                  goto finish;
+                }
+              gnutls_assert ();
+
+              if (err == EAGAIN)
+                return GNUTLS_E_AGAIN;
+              return GNUTLS_E_INTERRUPTED;
+            }
+          else
+            {
+              gnutls_assert ();
+              return GNUTLS_E_PULL_ERROR;
+            }
+        }
+      else
+        {
+
+          _gnutls_read_log ("READ: Got %d bytes from %d\n", i, fd);
+
+          if (i == 0)
+            break; /* EOF */
+        }
+
+      left -= i;
+
+    }
+
+  finish:
+
+  if (_gnutls_log_level >= 7)
+    {
+      char line[128];
+      char tmp[16];
+
+      _gnutls_read_log ("READ: read %d bytes from %d\n", (sizeOfPtr - left),
+          fd);
+
+      for (x = 0; x < ((sizeOfPtr - left) / 16) + 1; x++)
+        {
+          line[0] = 0;
+
+          sprintf(tmp, "%.4x - ", x);
+          _gnutls_str_cat(line, sizeof (line), tmp);
+
+          for (j = 0; j < 16; j++)
+            {
+              if (sum < (sizeOfPtr - left))
+                {
+                  sprintf(tmp, "%.2x ", ((unsigned char *) ptr)[sum++]);
+                  _gnutls_str_cat(line, sizeof (line), tmp);
+                }
+            }
+          _gnutls_read_log ("%s\n", line);
+        }
+    }
+
+  return (sizeOfPtr - left);
+}
+
+#define RCVLOWAT session->internals.lowat
+
+/* This function is only used with berkeley style sockets.
+ * Clears the peeked data (read with MSG_PEEK).
+ */
+int _gnutls_io_clear_peeked_data(gnutls_session_t session)
+{
+  char *peekdata;
+  int ret, sum;
+
+  if (session->internals.have_peeked_data == 0 || RCVLOWAT == 0)
+    return 0;
+
+  peekdata = gnutls_alloca (RCVLOWAT);
+  if (peekdata == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  /* this was already read by using MSG_PEEK - so it shouldn't fail */
+  sum = 0;
+  do
+    { /* we need this to finish now */
+      ret = _gnutls_read(session, peekdata, RCVLOWAT - sum, 0);
+      if (ret > 0)
+        sum += ret;
+    } while (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN || sum
+      < RCVLOWAT);
+
+  gnutls_afree (peekdata);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  session->internals.have_peeked_data = 0;
+
+  return 0;
+}
+
+void _gnutls_io_clear_read_buffer(gnutls_session_t session)
+{
+  session->internals.record_recv_buffer.length = 0;
+}
+
+/* This function is like recv(with MSG_PEEK). But it does not return -1 on error.
+ * It does return gnutls_errno instead.
+ * This function reads data from the socket and keeps them in a buffer, of up to
+ * MAX_RECV_SIZE. 
+ *
+ * This is not a general purpose function. It returns EXACTLY the data requested,
+ * which are stored in a local (in the session) buffer. A pointer (iptr) to this buffer is returned.
+ *
+ */
+ssize_t _gnutls_io_read_buffered(gnutls_session_t session,
+                                 opaque ** iptr,
+                                 size_t sizeOfPtr,
+                                 content_type_t recv_type)
+{
+  ssize_t ret = 0, ret2 = 0;
+  size_t min;
+  int buf_pos;
+  opaque *buf;
+  int recvlowat;
+  int recvdata, alloc_size;
+
+  *iptr = session->internals.record_recv_buffer.data;
+
+  if (sizeOfPtr > MAX_RECV_SIZE || sizeOfPtr == 0)
+    {
+      gnutls_assert (); /* internal error */
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* If an external pull function is used, then do not leave
+   * any data into the kernel buffer.
+   */
+  if (session->internals._gnutls_pull_func != NULL)
+    {
+      recvlowat = 0;
+    }
+  else
+    {
+      /* leave peeked data to the kernel space only if application data
+       * is received and we don't have any peeked 
+       * data in gnutls session.
+       */
+      if (recv_type != GNUTLS_APPLICATION_DATA
+          && session->internals.have_peeked_data == 0)
+        recvlowat = 0;
+      else
+        recvlowat = RCVLOWAT;
+    }
+
+  /* calculate the actual size, ie. get the minimum of the
+   * buffered data and the requested data.
+   */
+  min = MIN(session->internals.record_recv_buffer.length, sizeOfPtr);
+  if (min > 0)
+    {
+      /* if we have enough buffered data
+       * then just return them.
+       */
+      if (min == sizeOfPtr)
+        {
+          return min;
+        }
+    }
+
+  /* min is over zero. recvdata is the data we must
+   * receive in order to return the requested data.
+   */
+  recvdata = sizeOfPtr - min;
+
+  /* Check if the previously read data plus the new data to
+   * receive are longer than the maximum receive buffer size.
+   */
+  if ((session->internals.record_recv_buffer.length + recvdata) > MAX_RECV_SIZE)
+    {
+      gnutls_assert (); /* internal error */
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* Allocate the data required to store the new packet.
+   */
+  alloc_size = recvdata + session->internals.record_recv_buffer.length;
+  session->internals.record_recv_buffer.data
+      = gnutls_realloc_fast(session->internals.record_recv_buffer.data,
+                            alloc_size);
+  if (session->internals.record_recv_buffer.data == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  buf_pos = session->internals.record_recv_buffer.length;
+  buf = session->internals.record_recv_buffer.data;
+  *iptr = buf;
+
+  /* READ DATA - but leave RCVLOWAT bytes in the kernel buffer. */
+  if (recvdata - recvlowat > 0)
+    {
+      ret = _gnutls_read(session, &buf[buf_pos], recvdata - recvlowat, 0);
+
+      /* return immediately if we got an interrupt or eagain
+       * error.
+       */
+      if (ret < 0 && gnutls_error_is_fatal(ret) == 0)
+        {
+          return ret;
+        }
+    }
+
+  /* copy fresh data to our buffer.
+   */
+  if (ret > 0)
+    {
+      _gnutls_read_log ("RB: Have %d bytes into buffer. Adding %d bytes.\n",
+          session->internals.record_recv_buffer.length, ret);
+      _gnutls_read_log ("RB: Requested %d bytes\n", sizeOfPtr);
+      session->internals.record_recv_buffer.length += ret;
+    }
+
+  buf_pos = session->internals.record_recv_buffer.length;
+
+  /* This is a hack placed in order for select to work. Just leave recvlowat data,
+   * into the kernel buffer (using a read with MSG_PEEK), thus making
+   * select think, that the socket is ready for reading.
+   * MSG_PEEK is only used with berkeley style sockets.
+   */
+  if (ret == (recvdata - recvlowat) && recvlowat > 0)
+    {
+      ret2 = _gnutls_read(session, &buf[buf_pos], recvlowat, MSG_PEEK);
+
+      if (ret2 < 0 && gnutls_error_is_fatal(ret2) == 0)
+        {
+          return ret2;
+        }
+
+      if (ret2 > 0)
+        {
+          _gnutls_read_log ("RB-PEEK: Read %d bytes in PEEK MODE.\n", ret2);
+          _gnutls_read_log
+          ("RB-PEEK: Have %d bytes into buffer. Adding %d bytes.\nRB: Requested %d bytes\n",
+              session->internals.record_recv_buffer.length, ret2, sizeOfPtr);
+          session->internals.have_peeked_data = 1;
+          session->internals.record_recv_buffer.length += ret2;
+
+        }
+    }
+
+  if (ret < 0 || ret2 < 0)
+    {
+      gnutls_assert ();
+      /* that's because they are initialized to 0 */
+      return MIN(ret, ret2);
+    }
+
+  ret += ret2;
+
+  if (ret > 0 && ret < recvlowat)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_AGAIN;
+    }
+
+  if (ret == 0)
+    { /* EOF */
+      gnutls_assert ();
+      return 0;
+    }
+
+  ret = session->internals.record_recv_buffer.length;
+
+  if ((ret > 0) && ((size_t) ret < sizeOfPtr))
+    {
+      /* Short Read */
+      gnutls_assert ();
+      return GNUTLS_E_AGAIN;
+    }
+  else
+    {
+      return ret;
+    }
+}
+
+/* These two functions are used to insert data to the send buffer of the handshake or
+ * record protocol. The send buffer is kept if a send is interrupted and we need to keep
+ * the data left to sent, in order to send them later.
+ */
+
+#define MEMSUB(x,y) ((ssize_t)((ptrdiff_t)x-(ptrdiff_t)y))
+
+inline static int _gnutls_buffer_insert(gnutls_buffer * buffer,
+                                        const opaque * _data,
+                                        size_t data_size)
+{
+
+  if ((MEMSUB (_data, buffer->data) >= 0) && (MEMSUB (_data, buffer->data) < (ssize_t) buffer->length))
+    {
+      /* the given _data is part of the buffer.
+       */
+      if (data_size > buffer->length)
+        {
+          gnutls_assert ();
+          /* this shouldn't have happened */
+          return GNUTLS_E_INTERNAL_ERROR;
+        }
+
+      if (_data == buffer->data)
+        { /* then don't even memmove */
+          buffer->length = data_size;
+          return 0;
+        }
+
+      memmove(buffer->data, _data, data_size);
+      buffer->length = data_size;
+
+      return 0;
+
+    }
+
+  if (_gnutls_buffer_append (buffer, _data, data_size) < 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  return 0;
+}
+
+inline static int _gnutls_buffer_get(gnutls_buffer * buffer,
+                                     const opaque ** ptr,
+                                     size_t * ptr_size)
+{
+  *ptr_size = buffer->length;
+  *ptr = buffer->data;
+
+  return 0;
+}
+
+/* This function is like write. But it does not return -1 on error.
+ * It does return gnutls_errno instead.
+ *
+ * In case of E_AGAIN and E_INTERRUPTED errors, you must call gnutls_write_flush(),
+ * until it returns ok (0).
+ *
+ * We need to push exactly the data in n, since we cannot send less
+ * data. In TLS the peer must receive the whole packet in order
+ * to decrypt and verify the integrity. 
+ *
+ */
+ssize_t _gnutls_io_write_buffered(gnutls_session_t session,
+                                  const void *iptr,
+                                  size_t n)
+{
+  size_t left;
+  unsigned j, x, sum = 0;
+  ssize_t retval, i;
+  const opaque *ptr;
+  int ret;
+  gnutls_transport_ptr_t fd = session->internals.transport_send_ptr;
+
+  /* to know where the procedure was interrupted.
+   */
+  session->internals.direction = 1;
+
+  ptr = iptr;
+
+  /* In case the previous write was interrupted, check if the
+   * iptr != NULL and we have data in the buffer.
+   * If this is true then return an error.
+   */
+  if (session->internals.record_send_buffer.length > 0 && iptr != NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* If data in the buffer exist
+   */
+  if (iptr == NULL)
+    {
+      /* checking is handled above */
+      ret
+          = _gnutls_buffer_get(&session->internals.record_send_buffer, &ptr, &n);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      _gnutls_write_log ("WRITE: Restoring old write. (%d bytes to send)\n",
+          n);
+    }
+
+  _gnutls_write_log ("WRITE: Will write %d bytes to %d.\n", n, fd);
+
+  i = 0;
+  left = n;
+  while (left > 0)
+    {
+
+      session->internals.errnum = 0;
+
+      if (session->internals._gnutls_push_func == NULL)
+        {
+          i = send(GNUTLS_POINTER_TO_INT (fd), &ptr[n - left], left, 0);
+#if HAVE_WINSOCK
+          if (i < 0)
+            {
+              int tmperr = WSAGetLastError ();
+              switch (tmperr)
+                {
+                  case WSAEWOULDBLOCK:
+                  session->internals.errnum = EAGAIN;
+                  break;
+
+                  case WSAEINTR:
+                  session->internals.errnum = EINTR;
+                  break;
+
+                  default:
+                  session->internals.errnum = EIO;
+                  break;
+                }
+              WSASetLastError (tmperr);
+            }
+#endif
+        }
+      else
+        i = session->internals._gnutls_push_func(fd, &ptr[n - left], left);
+
+      if (i == -1)
+        {
+          int err = session->internals.errnum ? session->internals.errnum
+                                              : errno;
+
+          if (err == EAGAIN || err == EINTR)
+            {
+              session->internals.record_send_buffer_prev_size += n - left;
+
+              retval = _gnutls_buffer_insert(&session->internals.
+              record_send_buffer, &ptr[n - left], left);
+              if (retval < 0)
+                {
+                  gnutls_assert ();
+                  return retval;
+                }
+
+              _gnutls_write_log
+              ("WRITE: Interrupted. Stored %d bytes to buffer. Already sent %d bytes.\n",
+                  left, n - left);
+
+              if (err == EAGAIN)
+                return GNUTLS_E_AGAIN;
+              return GNUTLS_E_INTERRUPTED;
+            }
+          else
+            {
+              gnutls_assert ();
+              return GNUTLS_E_PUSH_ERROR;
+            }
+        }
+      left -= i;
+
+      if (_gnutls_log_level >= 7)
+        {
+          char line[128];
+          char tmp[16];
+
+          _gnutls_write_log
+          ("WRITE: wrote %d bytes to %d. Left %d bytes. Total %d bytes.\n",
+              i, fd, left, n);
+          for (x = 0; x < (unsigned) ((i) / 16) + 1; x++)
+            {
+              line[0] = 0;
+
+              if (sum > n - left)
+                break;
+
+              sprintf(tmp, "%.4x - ", x);
+              _gnutls_str_cat(line, sizeof (line), tmp);
+
+              for (j = 0; j < 16; j++)
+                {
+                  if (sum < n - left)
+                    {
+                      sprintf(tmp, "%.2x ", ((unsigned char *) ptr)[sum++]);
+                      _gnutls_str_cat(line, sizeof (line), tmp);
+                    }
+                  else
+                    break;
+                }
+              _gnutls_write_log ("%s\n", line);
+            }
+        }
+    }
+
+  retval = n + session->internals.record_send_buffer_prev_size;
+
+  session->internals.record_send_buffer.length = 0;
+  session->internals.record_send_buffer_prev_size = 0;
+
+  return retval;
+
+}
+
+/* This function writes the data that are left in the
+ * TLS write buffer (ie. because the previous write was
+ * interrupted.
+ */
+ssize_t _gnutls_io_write_flush(gnutls_session_t session)
+{
+  ssize_t ret;
+
+  if (session->internals.record_send_buffer.length == 0)
+    return 0; /* done */
+
+  ret = _gnutls_io_write_buffered(session, NULL, 0);
+  _gnutls_write_log ("WRITE FLUSH: %d [buffer: %d]\n", ret,
+      session->internals.record_send_buffer.length);
+
+  return ret;
+}
+
+/* This function writes the data that are left in the
+ * Handshake write buffer (ie. because the previous write was
+ * interrupted.
+ */
+ssize_t _gnutls_handshake_io_write_flush(gnutls_session_t session)
+{
+  ssize_t ret;
+  ret = _gnutls_handshake_io_send_int(session, 0, 0, NULL, 0);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  _gnutls_write_log ("HANDSHAKE_FLUSH: written[1] %d bytes\n", ret);
+
+  if (session->internals.handshake_send_buffer.length == 0)
+    {
+      ret = session->internals.handshake_send_buffer_prev_size; /* done */
+      session->internals.handshake_send_buffer_prev_size = 0;
+    }
+
+  return ret;
+}
+
+/* This is a send function for the gnutls handshake 
+ * protocol. Just makes sure that all data have been sent.
+ */
+ssize_t _gnutls_handshake_io_send_int(gnutls_session_t session,
+                                      content_type_t type,
+                                      gnutls_handshake_description_t htype,
+                                      const void *iptr,
+                                      size_t n)
+{
+  size_t left;
+  ssize_t ret = 0;
+  const opaque *ptr;
+  ssize_t retval = 0;
+
+  ptr = iptr;
+
+  if (session->internals.handshake_send_buffer.length > 0 && ptr == NULL && n
+      == 0)
+    {
+      /* resuming previously interrupted write
+       */
+      gnutls_assert ();
+      ret = _gnutls_buffer_get(&session->internals.handshake_send_buffer, &ptr,
+                                &n);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return retval;
+        }
+
+      type = session->internals.handshake_send_buffer_type;
+      htype = session->internals.handshake_send_buffer_htype;
+
+    }
+  else if (session->internals.handshake_send_buffer.length > 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+#ifdef WRITE_DEBUG
+  else
+    {
+      size_t sum = 0, x, j;
+
+      _gnutls_write_log ("HWRITE: will write %d bytes to %d.\n", n,
+          gnutls_transport_get_ptr (session));
+      for (x = 0; x < ((n) / 16) + 1; x++)
+        {
+          if (sum> n)
+          break;
+
+          _gnutls_write_log ("%.4x - ", x);
+          for (j = 0; j < 16; j++)
+            {
+              if (sum < n)
+                {
+                  _gnutls_write_log ("%.2x ", ((unsigned char *) ptr)[sum++]);
+                }
+              else
+              break;
+            }
+          _gnutls_write_log ("\n");
+        }
+      _gnutls_write_log ("\n");
+    }
+#endif
+
+  if (n == 0)
+    { /* if we have no data to send */
+      gnutls_assert ();
+      return 0;
+    }
+  else if (ptr == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  left = n;
+  while (left > 0)
+    {
+      ret = _gnutls_send_int(session, type, htype, &ptr[n - left], left);
+
+      if (ret <= 0)
+        {
+          if (ret == 0)
+            {
+              gnutls_assert ();
+              ret = GNUTLS_E_INTERNAL_ERROR;
+            }
+
+          if (left > 0
+              && (ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN))
+            {
+              gnutls_assert ();
+
+              retval = _gnutls_buffer_insert(&session->internals.
+              handshake_send_buffer, &ptr[n - left], left);
+              if (retval < 0)
+                {
+                  gnutls_assert ();
+                  return retval;
+                }
+
+              session->internals.handshake_send_buffer_prev_size += n - left;
+
+              session->internals.handshake_send_buffer_type = type;
+              session->internals.handshake_send_buffer_htype = htype;
+
+            }
+          else
+            {
+              session->internals.handshake_send_buffer_prev_size = 0;
+              session->internals.handshake_send_buffer.length = 0;
+            }
+
+          gnutls_assert ();
+          return ret;
+        }
+      left -= ret;
+    }
+
+  retval = n + session->internals.handshake_send_buffer_prev_size;
+
+  session->internals.handshake_send_buffer.length = 0;
+  session->internals.handshake_send_buffer_prev_size = 0;
+
+  return retval;
+
+}
+
+/* This is a receive function for the gnutls handshake 
+ * protocol. Makes sure that we have received all data.
+ */
+ssize_t _gnutls_handshake_io_recv_int(gnutls_session_t session,
+                                      content_type_t type,
+                                      gnutls_handshake_description_t htype,
+                                      void *iptr,
+                                      size_t sizeOfPtr)
+{
+  size_t left;
+  ssize_t i;
+  opaque *ptr;
+  size_t dsize;
+
+  ptr = iptr;
+  left = sizeOfPtr;
+
+  if (sizeOfPtr == 0 || iptr == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (session->internals.handshake_recv_buffer.length > 0)
+    {
+      /* if we have already received some data */
+      if (sizeOfPtr <= session->internals.handshake_recv_buffer.length)
+        {
+          /* if requested less data then return it.
+           */
+          gnutls_assert ();
+          memcpy(iptr, session->internals.handshake_recv_buffer.data, sizeOfPtr);
+
+          session->internals.handshake_recv_buffer.length -= sizeOfPtr;
+
+          memmove(session->internals.handshake_recv_buffer.data,
+                   &session->internals.handshake_recv_buffer.
+                  data[sizeOfPtr],
+                  session->internals.handshake_recv_buffer.length);
+
+          return sizeOfPtr;
+        }
+      gnutls_assert ();
+      memcpy(iptr, session->internals.handshake_recv_buffer.data,
+             session->internals.handshake_recv_buffer.length);
+
+      htype = session->internals.handshake_recv_buffer_htype;
+      type = session->internals.handshake_recv_buffer_type;
+
+      left -= session->internals.handshake_recv_buffer.length;
+
+      session->internals.handshake_recv_buffer.length = 0;
+    }
+
+  while (left > 0)
+    {
+      dsize = sizeOfPtr - left;
+      i = _gnutls_recv_int(session, type, htype, &ptr[dsize], left);
+      if (i < 0)
+        {
+
+          if (dsize > 0 && (i == GNUTLS_E_INTERRUPTED || i == GNUTLS_E_AGAIN))
+            {
+              gnutls_assert ();
+
+              session->internals.handshake_recv_buffer.data
+                  = gnutls_realloc_fast(session->internals.
+                  handshake_recv_buffer.data, dsize);
+              if (session->internals.handshake_recv_buffer.data == NULL)
+                {
+                  gnutls_assert ();
+                  return GNUTLS_E_MEMORY_ERROR;
+                }
+
+              memcpy(session->internals.handshake_recv_buffer.data, iptr, dsize);
+
+              session->internals.handshake_recv_buffer_htype = htype;
+              session->internals.handshake_recv_buffer_type = type;
+
+              session->internals.handshake_recv_buffer.length = dsize;
+            }
+          else
+            session->internals.handshake_recv_buffer.length = 0;
+
+          gnutls_assert ();
+
+          return i;
+        }
+      else
+        {
+          if (i == 0)
+            break; /* EOF */
+        }
+
+      left -= i;
+
+    }
+
+  session->internals.handshake_recv_buffer.length = 0;
+
+  return sizeOfPtr - left;
+}
+
+/* Buffer for handshake packets. Keeps the packets in order
+ * for finished messages to use them. Used in HMAC calculation
+ * and finished messages.
+ */
+int _gnutls_handshake_buffer_put(gnutls_session_t session,
+                                 opaque * data,
+                                 size_t length)
+{
+
+  if (length == 0)
+    return 0;
+
+  if ((session->internals.max_handshake_data_buffer_size > 0) && ((length
+      + session->
+      internals.
+      handshake_hash_buffer.
+      length) > session->
+  internals.
+  max_handshake_data_buffer_size))
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  _gnutls_buffers_log ("BUF[HSK]: Inserted %d bytes of Data\n", length);
+
+  if (_gnutls_buffer_append (&session->internals.handshake_hash_buffer, data,
+      length) < 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  return 0;
+}
+
+int _gnutls_handshake_buffer_get_size(gnutls_session_t session)
+{
+
+  return session->internals.handshake_hash_buffer.length;
+}
+
+/* this function does not touch the buffer
+ * and returns data from it (peek mode!)
+ */
+int _gnutls_handshake_buffer_peek(gnutls_session_t session,
+                                  opaque * data,
+                                  size_t length)
+{
+  if (length > session->internals.handshake_hash_buffer.length)
+    {
+      length = session->internals.handshake_hash_buffer.length;
+    }
+
+  _gnutls_buffers_log ("BUF[HSK]: Peeked %d bytes of Data\n", length);
+
+  memcpy(data, session->internals.handshake_hash_buffer.data, length);
+  return length;
+}
+
+/* this function does not touch the buffer
+ * and returns data from it (peek mode!)
+ */
+int _gnutls_handshake_buffer_get_ptr(gnutls_session_t session,
+                                     opaque ** data_ptr,
+                                     size_t * length)
+{
+  if (length != NULL)
+    *length = session->internals.handshake_hash_buffer.length;
+
+  _gnutls_buffers_log ("BUF[HSK]: Peeked %d bytes of Data\n", *length);
+
+  if (data_ptr != NULL)
+    *data_ptr = session->internals.handshake_hash_buffer.data;
+
+  return 0;
+}
+
+/* Does not free the buffer
+ */
+int _gnutls_handshake_buffer_empty(gnutls_session_t session)
+{
+
+  _gnutls_buffers_log ("BUF[HSK]: Emptied buffer\n");
+
+  session->internals.handshake_hash_buffer.length = 0;
+
+  return 0;
+}
+
+int _gnutls_handshake_buffer_clear(gnutls_session_t session)
+{
+
+  _gnutls_buffers_log ("BUF[HSK]: Cleared Data from buffer\n");
+
+  _gnutls_buffer_clear (&session->internals.handshake_hash_buffer);
+
+  return 0;
+}
diff --git a/src/daemon/https/tls/gnutls_buffers.h b/src/daemon/https/tls/gnutls_buffers.h
new file mode 100644
index 00000000..aaafde0d
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_buffers.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+int _gnutls_record_buffer_put (content_type_t type,
+                               gnutls_session_t session, opaque * data,
+                               size_t length);
+int _gnutls_record_buffer_get_size (content_type_t type,
+                                    gnutls_session_t session);
+int _gnutls_record_buffer_get (content_type_t type,
+                               gnutls_session_t session, opaque * data,
+                               size_t length);
+ssize_t _gnutls_io_read_buffered (gnutls_session_t, opaque ** iptr,
+                                  size_t n, content_type_t);
+void _gnutls_io_clear_read_buffer (gnutls_session_t);
+int _gnutls_io_clear_peeked_data (gnutls_session_t session);
+
+ssize_t _gnutls_io_write_buffered (gnutls_session_t, const void *iptr,
+                                   size_t n);
+ssize_t _gnutls_io_write_buffered2 (gnutls_session_t, const void *iptr,
+                                    size_t n, const void *iptr2, size_t n2);
+
+int _gnutls_handshake_buffer_get_size (gnutls_session_t session);
+int _gnutls_handshake_buffer_peek (gnutls_session_t session, opaque * data,
+                                   size_t length);
+int _gnutls_handshake_buffer_put (gnutls_session_t session, opaque * data,
+                                  size_t length);
+int _gnutls_handshake_buffer_clear (gnutls_session_t session);
+int _gnutls_handshake_buffer_empty (gnutls_session_t session);
+int _gnutls_handshake_buffer_get_ptr (gnutls_session_t session,
+                                      opaque ** data_ptr, size_t * length);
+
+#define _gnutls_handshake_io_buffer_clear( session) \
+        _gnutls_buffer_clear( &session->internals.handshake_send_buffer); \
+        _gnutls_buffer_clear( &session->internals.handshake_recv_buffer); \
+        session->internals.handshake_send_buffer_prev_size = 0
+
+ssize_t _gnutls_handshake_io_recv_int (gnutls_session_t, content_type_t,
+                                       gnutls_handshake_description_t, void *,
+                                       size_t);
+ssize_t _gnutls_handshake_io_send_int (gnutls_session_t, content_type_t,
+                                       gnutls_handshake_description_t,
+                                       const void *, size_t);
+ssize_t _gnutls_io_write_flush (gnutls_session_t session);
+ssize_t _gnutls_handshake_io_write_flush (gnutls_session_t session);
+
+size_t gnutls_record_check_pending (gnutls_session_t session);
diff --git a/src/daemon/https/tls/gnutls_cert.c b/src/daemon/https/tls/gnutls_cert.c
new file mode 100644
index 00000000..0160d644
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_cert.c
@@ -0,0 +1,918 @@
+/*
+ * Copyright (C) 2001, 2002, 2003, 2004, 2005, 2006, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* Some of the stuff needed for Certificate authentication is contained
+ * in this file.
+ */
+
+#include <gnutls_int.h>
+#include <gnutls_errors.h>
+#include <auth_cert.h>
+#include <gnutls_cert.h>
+#include <libtasn1.h>
+#include <gnutls_datum.h>
+#include <gnutls_mpi.h>
+#include <gnutls_global.h>
+#include <gnutls_algorithms.h>
+#include <gnutls_dh.h>
+#include <gnutls_str.h>
+#include <gnutls_state.h>
+#include <gnutls_auth_int.h>
+#include <gnutls_x509.h>
+#include <gnutls_extra_hooks.h>
+/* x509 */
+#include "x509.h"
+#include "mpi.h"
+
+/**
+  * gnutls_certificate_free_keys - Used to free all the keys from a gnutls_certificate_credentials_t structure
+  * @sc: is an #gnutls_certificate_credentials_t structure.
+  *
+  * This function will delete all the keys and the certificates associated
+  * with the given credentials. This function must not be called when a
+  * TLS negotiation that uses the credentials is in progress.
+  *
+  **/
+void
+gnutls_certificate_free_keys (gnutls_certificate_credentials_t sc)
+{
+  unsigned i, j;
+
+  for (i = 0; i < sc->ncerts; i++)
+    {
+      for (j = 0; j < sc->cert_list_length[i]; j++)
+        {
+          _gnutls_gcert_deinit (&sc->cert_list[i][j]);
+        }
+      gnutls_free (sc->cert_list[i]);
+    }
+
+  gnutls_free (sc->cert_list_length);
+  sc->cert_list_length = NULL;
+
+  gnutls_free (sc->cert_list);
+  sc->cert_list = NULL;
+
+  for (i = 0; i < sc->ncerts; i++)
+    {
+      _gnutls_gkey_deinit (&sc->pkey[i]);
+    }
+
+  gnutls_free (sc->pkey);
+  sc->pkey = NULL;
+
+  sc->ncerts = 0;
+
+}
+
+/**
+  * gnutls_certificate_free_cas - Used to free all the CAs from a gnutls_certificate_credentials_t structure
+  * @sc: is an #gnutls_certificate_credentials_t structure.
+  *
+  * This function will delete all the CAs associated
+  * with the given credentials. Servers that do not use
+  * gnutls_certificate_verify_peers2() may call this to
+  * save some memory.
+  *
+  **/
+void
+gnutls_certificate_free_cas (gnutls_certificate_credentials_t sc)
+{
+  unsigned j;
+
+  for (j = 0; j < sc->x509_ncas; j++)
+    {
+      gnutls_x509_crt_deinit (sc->x509_ca_list[j]);
+    }
+
+  sc->x509_ncas = 0;
+
+  gnutls_free (sc->x509_ca_list);
+  sc->x509_ca_list = NULL;
+
+}
+
+/**
+  * gnutls_certificate_free_ca_names - Used to free all the CA names from a gnutls_certificate_credentials_t structure
+  * @sc: is an #gnutls_certificate_credentials_t structure.
+  *
+  * This function will delete all the CA name in the
+  * given credentials. Clients may call this to save some memory
+  * since in client side the CA names are not used.
+  *
+  * CA names are used by servers to advertize the CAs they
+  * support to clients.
+  *
+  **/
+void
+gnutls_certificate_free_ca_names (gnutls_certificate_credentials_t sc)
+{
+  _gnutls_free_datum (&sc->x509_rdn_sequence);
+}
+
+/*-
+  * _gnutls_certificate_get_rsa_params - Returns the RSA parameters pointer
+  * @rsa_params: holds the RSA parameters or NULL.
+  * @func: function to retrieve the parameters or NULL.
+  * @session: The session.
+  *
+  * This function will return the rsa parameters pointer.
+  *
+  -*/
+gnutls_rsa_params_t
+_gnutls_certificate_get_rsa_params (gnutls_rsa_params_t rsa_params,
+                                    gnutls_params_function * func,
+                                    gnutls_session_t session)
+{
+  gnutls_params_st params;
+  int ret;
+
+  if (session->internals.params.rsa_params)
+    {
+      return session->internals.params.rsa_params;
+    }
+
+  if (rsa_params)
+    {
+      session->internals.params.rsa_params = rsa_params;
+    }
+  else if (func)
+    {
+      ret = func (session, GNUTLS_PARAMS_RSA_EXPORT, &params);
+      if (ret == 0 && params.type == GNUTLS_PARAMS_RSA_EXPORT)
+        {
+          session->internals.params.rsa_params = params.params.rsa_export;
+          session->internals.params.free_rsa_params = params.deinit;
+        }
+    }
+
+  return session->internals.params.rsa_params;
+}
+
+
+/**
+  * gnutls_certificate_free_credentials - Used to free an allocated gnutls_certificate_credentials_t structure
+  * @sc: is an #gnutls_certificate_credentials_t structure.
+  *
+  * This structure is complex enough to manipulate directly thus
+  * this helper function is provided in order to free (deallocate) it.
+  *
+  * This function does not free any temporary parameters associated
+  * with this structure (ie RSA and DH parameters are not freed by
+  * this function).
+  **/
+void
+gnutls_certificate_free_credentials (gnutls_certificate_credentials_t sc)
+{
+  gnutls_certificate_free_keys (sc);
+  gnutls_certificate_free_cas (sc);
+  gnutls_certificate_free_ca_names (sc);
+#ifdef ENABLE_PKI
+  gnutls_certificate_free_crls (sc);
+#endif
+
+#ifndef KEYRING_HACK
+  if (_E_gnutls_openpgp_keyring_deinit)
+    _E_gnutls_openpgp_keyring_deinit (sc->keyring);
+#else
+  _gnutls_free_datum (&sc->keyring);
+#endif
+
+  gnutls_free (sc);
+}
+
+
+/**
+  * gnutls_certificate_allocate_credentials - Used to allocate a gnutls_certificate_credentials_t structure
+  * @res: is a pointer to an #gnutls_certificate_credentials_t structure.
+  *
+  * This structure is complex enough to manipulate directly thus this
+  * helper function is provided in order to allocate it.
+  *
+  * Returns: %GNUTLS_E_SUCCESS on success, or an error code.
+  **/
+int
+gnutls_certificate_allocate_credentials (gnutls_certificate_credentials_t *
+                                         res)
+{
+  *res = gnutls_calloc (1, sizeof (certificate_credentials_st));
+
+  if (*res == NULL)
+    return GNUTLS_E_MEMORY_ERROR;
+
+  (*res)->verify_bits = DEFAULT_VERIFY_BITS;
+  (*res)->verify_depth = DEFAULT_VERIFY_DEPTH;
+
+  return 0;
+}
+
+
+/* returns the KX algorithms that are supported by a
+ * certificate. (Eg a certificate with RSA params, supports
+ * GNUTLS_KX_RSA algorithm).
+ * This function also uses the KeyUsage field of the certificate
+ * extensions in order to disable unneded algorithms.
+ */
+int
+_gnutls_selected_cert_supported_kx (gnutls_session_t session,
+                                    gnutls_kx_algorithm_t ** alg,
+                                    int *alg_size)
+{
+  gnutls_kx_algorithm_t kx;
+  gnutls_pk_algorithm_t pk;
+  gnutls_kx_algorithm_t kxlist[MAX_ALGOS];
+  gnutls_cert *cert;
+  int i;
+
+  if (session->internals.selected_cert_list_length == 0)
+    {
+      *alg_size = 0;
+      *alg = NULL;
+      return 0;
+    }
+
+  cert = &session->internals.selected_cert_list[0];
+  i = 0;
+
+  for (kx = 0; kx < MAX_ALGOS; kx++)
+    {
+      pk = _gnutls_map_pk_get_pk (kx);
+      if (pk == cert->subject_pk_algorithm)
+        {
+          /* then check key usage */
+          if (_gnutls_check_key_usage (cert, kx) == 0)
+            {
+              kxlist[i] = kx;
+              i++;
+            }
+        }
+    }
+
+  if (i == 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  *alg = gnutls_calloc (1, sizeof (gnutls_kx_algorithm_t) * i);
+  if (*alg == NULL)
+    return GNUTLS_E_MEMORY_ERROR;
+
+  *alg_size = i;
+
+  memcpy (*alg, kxlist, i * sizeof (gnutls_kx_algorithm_t));
+
+  return 0;
+}
+
+
+/**
+  * gnutls_certificate_server_set_request - Used to set whether to request a client certificate
+  * @session: is an #gnutls_session_t structure.
+  * @req: is one of GNUTLS_CERT_REQUEST, GNUTLS_CERT_REQUIRE
+  *
+  * This function specifies if we (in case of a server) are going
+  * to send a certificate request message to the client. If @req
+  * is GNUTLS_CERT_REQUIRE then the server will return an error if
+  * the peer does not provide a certificate. If you do not
+  * call this function then the client will not be asked to
+  * send a certificate.
+  **/
+void
+gnutls_certificate_server_set_request (gnutls_session_t session,
+                                       gnutls_certificate_request_t req)
+{
+  session->internals.send_cert_req = req;
+}
+
+/**
+  * gnutls_certificate_client_set_retrieve_function - Used to set a callback to retrieve the certificate
+  * @cred: is a #gnutls_certificate_credentials_t structure.
+  * @func: is the callback function
+  *
+  * This function sets a callback to be called in order to retrieve the certificate
+  * to be used in the handshake.
+  * The callback's function prototype is:
+  * int (*callback)(gnutls_session_t, const gnutls_datum_t* req_ca_dn, int nreqs, 
+  * const gnutls_pk_algorithm_t* pk_algos, int pk_algos_length, gnutls_retr_st* st);
+  *
+  * @req_ca_cert is only used in X.509 certificates. 
+  * Contains a list with the CA names that the server considers trusted. 
+  * Normally we should send a certificate that is signed
+  * by one of these CAs. These names are DER encoded. To get a more
+  * meaningful value use the function gnutls_x509_rdn_get().
+  *
+  * @pk_algos contains a list with server's acceptable signature algorithms.
+  * The certificate returned should support the server's given algorithms.
+  *
+  * @st should contain the certificates and private keys.
+  *
+  * If the callback function is provided then gnutls will call it, in the
+  * handshake, after the certificate request message has been received.
+  *
+  * The callback function should set the certificate list to be sent, and
+  * return 0 on success. If no certificate was selected then the number of certificates
+  * should be set to zero. The value (-1) indicates error and the handshake
+  * will be terminated.
+  **/
+void gnutls_certificate_client_set_retrieve_function
+  (gnutls_certificate_credentials_t cred,
+   gnutls_certificate_client_retrieve_function * func)
+{
+  cred->client_get_cert_callback = func;
+}
+
+/**
+  * gnutls_certificate_server_set_retrieve_function - Used to set a callback to retrieve the certificate
+  * @cred: is a #gnutls_certificate_credentials_t structure.
+  * @func: is the callback function
+  *
+  * This function sets a callback to be called in order to retrieve the certificate
+  * to be used in the handshake.
+  * The callback's function prototype is:
+  * int (*callback)(gnutls_session_t, gnutls_retr_st* st);
+  *
+  * @st should contain the certificates and private keys.
+  *
+  * If the callback function is provided then gnutls will call it, in the
+  * handshake, after the certificate request message has been received.
+  *
+  * The callback function should set the certificate list to be sent, and
+  * return 0 on success.  The value (-1) indicates error and the handshake
+  * will be terminated.
+  **/
+void gnutls_certificate_server_set_retrieve_function
+  (gnutls_certificate_credentials_t cred,
+   gnutls_certificate_server_retrieve_function * func)
+{
+  cred->server_get_cert_callback = func;
+}
+
+/*-
+ * _gnutls_x509_extract_certificate_activation_time - This function returns the peer's certificate activation time
+ * @cert: should contain an X.509 DER encoded certificate
+ *
+ * This function will return the certificate's activation time in UNIX time
+ * (ie seconds since 00:00:00 UTC January 1, 1970).
+ *
+ * Returns a (time_t) -1 in case of an error.
+ *
+ -*/
+static time_t
+_gnutls_x509_get_raw_crt_activation_time (const gnutls_datum_t * cert)
+{
+  gnutls_x509_crt_t xcert;
+  time_t result;
+
+  result = gnutls_x509_crt_init (&xcert);
+  if (result < 0)
+    return (time_t) - 1;
+
+  result = gnutls_x509_crt_import (xcert, cert, GNUTLS_X509_FMT_DER);
+  if (result < 0)
+    {
+      gnutls_x509_crt_deinit (xcert);
+      return (time_t) - 1;
+    }
+
+  result = gnutls_x509_crt_get_activation_time (xcert);
+
+  gnutls_x509_crt_deinit (xcert);
+
+  return result;
+}
+
+/*-
+ * gnutls_x509_extract_certificate_expiration_time - This function returns the certificate's expiration time
+ * @cert: should contain an X.509 DER encoded certificate
+ *
+ * This function will return the certificate's expiration time in UNIX
+ * time (ie seconds since 00:00:00 UTC January 1, 1970).  Returns a
+ *
+ * (time_t) -1 in case of an error.
+ *
+ -*/
+static time_t
+_gnutls_x509_get_raw_crt_expiration_time (const gnutls_datum_t * cert)
+{
+  gnutls_x509_crt_t xcert;
+  time_t result;
+
+  result = gnutls_x509_crt_init (&xcert);
+  if (result < 0)
+    return (time_t) - 1;
+
+  result = gnutls_x509_crt_import (xcert, cert, GNUTLS_X509_FMT_DER);
+  if (result < 0)
+    {
+      gnutls_x509_crt_deinit (xcert);
+      return (time_t) - 1;
+    }
+
+  result = gnutls_x509_crt_get_expiration_time (xcert);
+
+  gnutls_x509_crt_deinit (xcert);
+
+  return result;
+}
+
+/*-
+  * _gnutls_openpgp_crt_verify_peers - This function returns the peer's certificate status
+  * @session: is a gnutls session
+  *
+  * This function will try to verify the peer's certificate and return its status (TRUSTED, INVALID etc.). 
+  * Returns a negative error code in case of an error, or GNUTLS_E_NO_CERTIFICATE_FOUND if no certificate was sent.
+  *
+  -*/
+int
+_gnutls_openpgp_crt_verify_peers (gnutls_session_t session,
+                                  unsigned int *status)
+{
+  cert_auth_info_t info;
+  gnutls_certificate_credentials_t cred;
+  int peer_certificate_list_size, ret;
+
+  CHECK_AUTH (GNUTLS_CRD_CERTIFICATE, GNUTLS_E_INVALID_REQUEST);
+
+  info = _gnutls_get_auth_info (session);
+  if (info == NULL)
+    return GNUTLS_E_INVALID_REQUEST;
+
+  cred = (gnutls_certificate_credentials_t)
+    _gnutls_get_cred (session->key, GNUTLS_CRD_CERTIFICATE, NULL);
+  if (cred == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
+    }
+
+  if (info->raw_certificate_list == NULL || info->ncerts == 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_NO_CERTIFICATE_FOUND;
+    }
+
+  /* generate a list of gnutls_certs based on the auth info
+   * raw certs.
+   */
+  peer_certificate_list_size = info->ncerts;
+
+  if (peer_certificate_list_size != 1)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  /* Verify certificate 
+   */
+  if (_E_gnutls_openpgp_verify_key == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INIT_LIBEXTRA;
+    }
+  ret =
+    _E_gnutls_openpgp_verify_key (cred, &info->raw_certificate_list[0],
+                                  peer_certificate_list_size, status);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return 0;
+}
+
+
+/**
+  * gnutls_certificate_verify_peers2 - This function returns the peer's certificate verification status
+  * @session: is a gnutls session
+  * @status: is the output of the verification
+  *
+  * This function will try to verify the peer's certificate and return
+  * its status (trusted, invalid etc.).  The value of @status should
+  * be one or more of the gnutls_certificate_status_t enumerated
+  * elements bitwise or'd. To avoid denial of service attacks some
+  * default upper limits regarding the certificate key size and chain
+  * size are set. To override them use
+  * gnutls_certificate_set_verify_limits().
+  *
+  * Note that you must also check the peer's name in order to check if
+  * the verified certificate belongs to the actual peer.
+  *
+  * This is the same as gnutls_x509_crt_list_verify() and uses the
+  * loaded CAs in the credentials as trusted CAs.
+  *
+  * Note that some commonly used X.509 Certificate Authorities are
+  * still using Version 1 certificates.  If you want to accept them,
+  * you need to call gnutls_certificate_set_verify_flags() with, e.g.,
+  * %GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT parameter.
+  *
+  * Returns: a negative error code on error and zero on success.
+  **/
+int
+gnutls_certificate_verify_peers2 (gnutls_session_t session,
+                                  unsigned int *status)
+{
+  cert_auth_info_t info;
+
+  CHECK_AUTH (GNUTLS_CRD_CERTIFICATE, GNUTLS_E_INVALID_REQUEST);
+
+  info = _gnutls_get_auth_info (session);
+  if (info == NULL)
+    {
+      return GNUTLS_E_NO_CERTIFICATE_FOUND;
+    }
+
+  if (info->raw_certificate_list == NULL || info->ncerts == 0)
+    return GNUTLS_E_NO_CERTIFICATE_FOUND;
+
+  switch (gnutls_certificate_type_get (session))
+    {
+    case GNUTLS_CRT_X509:
+      return _gnutls_x509_cert_verify_peers (session, status);
+    case GNUTLS_CRT_OPENPGP:
+      return _gnutls_openpgp_crt_verify_peers (session, status);
+    default:
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+}
+
+/**
+  * gnutls_certificate_verify_peers - This function returns the peer's certificate verification status
+  * @session: is a gnutls session
+  *
+  * This function will try to verify the peer's certificate and return
+  * its status (trusted, invalid etc.).  However you must also check
+  * the peer's name in order to check if the verified certificate
+  * belongs to the actual peer.
+  *
+  * The return value should be one or more of the
+  * gnutls_certificate_status_t enumerated elements bitwise or'd, or a
+  * negative value on error.
+  *
+  * This is the same as gnutls_x509_crt_list_verify().
+  *
+  * Deprecated: Use gnutls_certificate_verify_peers2() instead.
+  **/
+int
+gnutls_certificate_verify_peers (gnutls_session_t session)
+{
+  unsigned int status;
+  int ret;
+
+  ret = gnutls_certificate_verify_peers2 (session, &status);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return status;
+}
+
+/**
+  * gnutls_certificate_expiration_time_peers - This function returns the peer's certificate expiration time
+  * @session: is a gnutls session
+  *
+  * This function will return the peer's certificate expiration time.
+  *
+  * Returns: (time_t)-1 on error.
+  **/
+time_t
+gnutls_certificate_expiration_time_peers (gnutls_session_t session)
+{
+  cert_auth_info_t info;
+
+  CHECK_AUTH (GNUTLS_CRD_CERTIFICATE, GNUTLS_E_INVALID_REQUEST);
+
+  info = _gnutls_get_auth_info (session);
+  if (info == NULL)
+    {
+      return (time_t) - 1;
+    }
+
+  if (info->raw_certificate_list == NULL || info->ncerts == 0)
+    {
+      gnutls_assert ();
+      return (time_t) - 1;
+    }
+
+  switch (gnutls_certificate_type_get (session))
+    {
+    case GNUTLS_CRT_X509:
+      return _gnutls_x509_get_raw_crt_expiration_time (&info->
+                                                       raw_certificate_list
+                                                       [0]);
+    case GNUTLS_CRT_OPENPGP:
+      if (_E_gnutls_openpgp_get_raw_key_expiration_time == NULL)
+        return (time_t) - 1;
+      return _E_gnutls_openpgp_get_raw_key_expiration_time (&info->
+                                                            raw_certificate_list
+                                                            [0]);
+    default:
+      return (time_t) - 1;
+    }
+}
+
+/**
+  * gnutls_certificate_activation_time_peers - This function returns the peer's certificate activation time
+  * @session: is a gnutls session
+  *
+  * This function will return the peer's certificate activation time.
+  * This is the creation time for openpgp keys.
+  *
+  * Returns: (time_t)-1 on error.
+  **/
+time_t
+gnutls_certificate_activation_time_peers (gnutls_session_t session)
+{
+  cert_auth_info_t info;
+
+  CHECK_AUTH (GNUTLS_CRD_CERTIFICATE, GNUTLS_E_INVALID_REQUEST);
+
+  info = _gnutls_get_auth_info (session);
+  if (info == NULL)
+    {
+      return (time_t) - 1;
+    }
+
+  if (info->raw_certificate_list == NULL || info->ncerts == 0)
+    {
+      gnutls_assert ();
+      return (time_t) - 1;
+    }
+
+  switch (gnutls_certificate_type_get (session))
+    {
+    case GNUTLS_CRT_X509:
+      return _gnutls_x509_get_raw_crt_activation_time (&info->
+                                                       raw_certificate_list
+                                                       [0]);
+    case GNUTLS_CRT_OPENPGP:
+      if (_E_gnutls_openpgp_get_raw_key_creation_time == NULL)
+        return (time_t) - 1;
+      return _E_gnutls_openpgp_get_raw_key_creation_time (&info->
+                                                          raw_certificate_list
+                                                          [0]);
+    default:
+      return (time_t) - 1;
+    }
+}
+
+int
+_gnutls_raw_cert_to_gcert (gnutls_cert * gcert,
+                           gnutls_certificate_type_t type,
+                           const gnutls_datum_t * raw_cert,
+                           int flags /* OR of ConvFlags */ )
+{
+  switch (type)
+    {
+    case GNUTLS_CRT_X509:
+      return _gnutls_x509_raw_cert_to_gcert (gcert, raw_cert, flags);
+    case GNUTLS_CRT_OPENPGP:
+      if (_E_gnutls_openpgp_raw_key_to_gcert == NULL)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_INIT_LIBEXTRA;
+        }
+      return _E_gnutls_openpgp_raw_key_to_gcert (gcert, raw_cert);
+    default:
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+}
+
+int
+_gnutls_raw_privkey_to_gkey (gnutls_privkey * key,
+                             gnutls_certificate_type_t type,
+                             const gnutls_datum_t * raw_key,
+                             int key_enc /* DER or PEM */ )
+{
+  switch (type)
+    {
+    case GNUTLS_CRT_X509:
+      return _gnutls_x509_raw_privkey_to_gkey (key, raw_key, key_enc);
+    case GNUTLS_CRT_OPENPGP:
+      if (_E_gnutls_openpgp_raw_privkey_to_gkey == NULL)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_INIT_LIBEXTRA;
+        }
+      return _E_gnutls_openpgp_raw_privkey_to_gkey (key, raw_key,
+                                                    (gnutls_openpgp_crt_fmt_t)
+                                                    key_enc);
+    default:
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+}
+
+
+/* This function will convert a der certificate to a format
+ * (structure) that gnutls can understand and use. Actually the
+ * important thing on this function is that it extracts the 
+ * certificate's (public key) parameters.
+ *
+ * The noext flag is used to complete the handshake even if the
+ * extensions found in the certificate are unsupported and critical. 
+ * The critical extensions will be catched by the verification functions.
+ */
+int
+_gnutls_x509_raw_cert_to_gcert (gnutls_cert * gcert,
+                                const gnutls_datum_t * derCert,
+                                int flags /* OR of ConvFlags */ )
+{
+  int ret;
+  gnutls_x509_crt_t cert;
+
+  ret = gnutls_x509_crt_init (&cert);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  ret = gnutls_x509_crt_import (cert, derCert, GNUTLS_X509_FMT_DER);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      gnutls_x509_crt_deinit (cert);
+      return ret;
+    }
+
+  ret = _gnutls_x509_crt_to_gcert (gcert, cert, flags);
+  gnutls_x509_crt_deinit (cert);
+
+  return ret;
+}
+
+/* Like above but it accepts a parsed certificate instead.
+ */
+int
+_gnutls_x509_crt_to_gcert (gnutls_cert * gcert,
+                           gnutls_x509_crt_t cert, unsigned int flags)
+{
+  int ret = 0;
+
+  memset (gcert, 0, sizeof (gnutls_cert));
+  gcert->cert_type = GNUTLS_CRT_X509;
+
+  if (!(flags & CERT_NO_COPY))
+    {
+#define SMALL_DER 512
+      opaque *der;
+      size_t der_size = SMALL_DER;
+
+      /* initially allocate a bogus size, just in case the certificate
+       * fits in it. That way we minimize the DER encodings performed.
+       */
+      der = gnutls_malloc (SMALL_DER);
+      if (der == NULL)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_MEMORY_ERROR;
+        }
+
+      ret =
+        gnutls_x509_crt_export (cert, GNUTLS_X509_FMT_DER, der, &der_size);
+      if (ret < 0 && ret != GNUTLS_E_SHORT_MEMORY_BUFFER)
+        {
+          gnutls_assert ();
+          gnutls_free (der);
+          return ret;
+        }
+
+      if (ret == GNUTLS_E_SHORT_MEMORY_BUFFER)
+        {
+          der = gnutls_realloc (der, der_size);
+          if (der == NULL)
+            {
+              gnutls_assert ();
+              return GNUTLS_E_MEMORY_ERROR;
+            }
+
+          ret =
+            gnutls_x509_crt_export (cert, GNUTLS_X509_FMT_DER, der,
+                                    &der_size);
+          if (ret < 0)
+            {
+              gnutls_assert ();
+              gnutls_free (der);
+              return ret;
+            }
+        }
+
+      gcert->raw.data = der;
+      gcert->raw.size = der_size;
+    }
+  else
+    /* now we have 0 or a bitwise or of things to decode */
+    flags ^= CERT_NO_COPY;
+
+
+  if (flags & CERT_ONLY_EXTENSIONS || flags == 0)
+    {
+      gnutls_x509_crt_get_key_usage (cert, &gcert->key_usage, NULL);
+      gcert->version = gnutls_x509_crt_get_version (cert);
+    }
+  gcert->subject_pk_algorithm = gnutls_x509_crt_get_pk_algorithm (cert, NULL);
+
+  if (flags & CERT_ONLY_PUBKEY || flags == 0)
+    {
+      gcert->params_size = MAX_PUBLIC_PARAMS_SIZE;
+      ret =
+        _gnutls_x509_crt_get_mpis (cert, gcert->params, &gcert->params_size);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+    }
+
+  return 0;
+
+}
+
+void
+_gnutls_gcert_deinit (gnutls_cert * cert)
+{
+  int i;
+
+  if (cert == NULL)
+    return;
+
+  for (i = 0; i < cert->params_size; i++)
+    {
+      _gnutls_mpi_release (&cert->params[i]);
+    }
+
+  _gnutls_free_datum (&cert->raw);
+}
+
+/**
+ * gnutls_sign_callback_set:
+ * @session: is a gnutls session
+ * @sign_func: function pointer to application's sign callback.
+ * @userdata: void pointer that will be passed to sign callback.
+ *
+ * Set the callback function.  The function must have this prototype:
+ *
+ * typedef int (*gnutls_sign_func) (gnutls_session_t session,
+ *                                  void *userdata,
+ *                                  gnutls_certificate_type_t cert_type,
+ *                                  const gnutls_datum_t * cert,
+ *                                  const gnutls_datum_t * hash,
+ *                                  gnutls_datum_t * signature);
+ *
+ * The @userdata parameter is passed to the @sign_func verbatim, and
+ * can be used to store application-specific data needed in the
+ * callback function.  See also gnutls_sign_callback_get().
+ **/
+void
+gnutls_sign_callback_set (gnutls_session_t session,
+                          gnutls_sign_func sign_func, void *userdata)
+{
+  session->internals.sign_func = sign_func;
+  session->internals.sign_func_userdata = userdata;
+}
+
+/**
+ * gnutls_sign_callback_get:
+ * @session: is a gnutls session
+ * @userdata: if non-%NULL, will be set to abstract callback pointer.
+ *
+ * Retrieve the callback function, and its userdata pointer.
+ *
+ * Returns: The function pointer set by gnutls_sign_callback_set(), or
+ *   if not set, %NULL.
+ **/
+gnutls_sign_func
+gnutls_sign_callback_get (gnutls_session_t session, void **userdata)
+{
+  if (userdata)
+    *userdata = session->internals.sign_func_userdata;
+  return session->internals.sign_func;
+}
diff --git a/src/daemon/https/tls/gnutls_cert.h b/src/daemon/https/tls/gnutls_cert.h
new file mode 100644
index 00000000..09df10eb
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_cert.h
@@ -0,0 +1,132 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#ifndef GNUTLS_CERT_H
+# define GNUTLS_CERT_H
+
+#include <gnutls_pk.h>
+#include <libtasn1.h>
+#include "x509.h"
+
+#define MAX_PUBLIC_PARAMS_SIZE 4        /* ok for RSA and DSA */
+
+/* parameters should not be larger than this limit */
+#define DSA_PUBLIC_PARAMS 4
+#define RSA_PUBLIC_PARAMS 2
+
+/* For key Usage, test as:
+ * if (st.key_usage & KEY_DIGITAL_SIGNATURE) ...
+ */
+#define KEY_DIGITAL_SIGNATURE           128
+#define KEY_NON_REPUDIATION             64
+#define KEY_KEY_ENCIPHERMENT            32
+#define KEY_DATA_ENCIPHERMENT           16
+#define KEY_KEY_AGREEMENT               8
+#define KEY_KEY_CERT_SIGN               4
+#define KEY_CRL_SIGN                    2
+#define KEY_ENCIPHER_ONLY               1
+#define KEY_DECIPHER_ONLY               32768
+
+typedef struct gnutls_cert
+{
+  mpi_t params[MAX_PUBLIC_PARAMS_SIZE]; /* the size of params depends on the public 
+                                         * key algorithm 
+                                         * RSA: [0] is modulus
+                                         *      [1] is public exponent
+                                         * DSA: [0] is p
+                                         *      [1] is q
+                                         *      [2] is g
+                                         *      [3] is public key
+                                         */
+  int params_size;              /* holds the size of MPI params */
+
+  gnutls_pk_algorithm_t subject_pk_algorithm;
+
+  unsigned int key_usage;       /* bits from KEY_* 
+                                 */
+
+  unsigned int version;
+  /* holds the type (PGP, X509)
+   */
+  gnutls_certificate_type_t cert_type;
+
+  gnutls_datum_t raw;
+
+} gnutls_cert;
+
+typedef struct gnutls_privkey_int
+{
+  mpi_t params[MAX_PRIV_PARAMS_SIZE];   /* the size of params depends on the public 
+                                         * key algorithm 
+                                         */
+  /*
+   * RSA: [0] is modulus
+   *      [1] is public exponent
+   *      [2] is private exponent
+   *      [3] is prime1 (p)
+   *      [4] is prime2 (q)
+   *      [5] is coefficient (u == inverse of p mod q)
+   * DSA: [0] is p
+   *      [1] is q
+   *      [2] is g
+   *      [3] is y (public key)
+   *      [4] is x (private key)
+   */
+  int params_size;              /* holds the number of params */
+
+  gnutls_pk_algorithm_t pk_algorithm;
+} gnutls_privkey;
+
+struct gnutls_session_int;      /* because gnutls_session_t is not defined when this file is included */
+
+typedef enum ConvFlags
+{
+  CERT_NO_COPY = 2,
+  CERT_ONLY_PUBKEY = 4,
+  CERT_ONLY_EXTENSIONS = 16
+} ConvFlags;
+
+int _gnutls_x509_raw_cert_to_gcert (gnutls_cert * gcert,
+                                    const gnutls_datum_t * derCert,
+                                    int flags);
+int _gnutls_x509_crt_to_gcert (gnutls_cert * gcert, gnutls_x509_crt_t cert,
+                               unsigned int flags);
+
+void _gnutls_gkey_deinit (gnutls_privkey * key);
+void _gnutls_gcert_deinit (gnutls_cert * cert);
+
+int _gnutls_selected_cert_supported_kx (struct gnutls_session_int *session,
+                                        gnutls_kx_algorithm_t ** alg,
+                                        int *alg_size);
+
+int _gnutls_raw_cert_to_gcert (gnutls_cert * gcert,
+                               gnutls_certificate_type_t type,
+                               const gnutls_datum_t * raw_cert,
+                               int flags /* OR of ConvFlags */ );
+int _gnutls_raw_privkey_to_gkey (gnutls_privkey * key,
+                                 gnutls_certificate_type_t type,
+                                 const gnutls_datum_t * raw_key,
+                                 int key_enc /* DER or PEM */ );
+
+#endif
diff --git a/src/daemon/https/tls/gnutls_cipher.c b/src/daemon/https/tls/gnutls_cipher.c
new file mode 100644
index 00000000..8245b1c0
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_cipher.c
@@ -0,0 +1,584 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* Some high level functions to be used in the record encryption are
+ * included here.
+ */
+
+#include "gnutls_int.h"
+#include "gnutls_errors.h"
+#include "gnutls_compress.h"
+#include "gnutls_cipher.h"
+#include "gnutls_algorithms.h"
+#include "gnutls_hash_int.h"
+#include "gnutls_cipher_int.h"
+#include "debug.h"
+#include "gnutls_num.h"
+#include "gnutls_datum.h"
+#include "gnutls_kx.h"
+#include "gnutls_record.h"
+#include "gnutls_constate.h"
+#include <gc.h>
+
+inline static int
+is_write_comp_null (gnutls_session_t session)
+{
+  if (session->security_parameters.write_compression_algorithm ==
+      GNUTLS_COMP_NULL)
+    return 0;
+
+  return 1;
+}
+
+inline static int
+is_read_comp_null (gnutls_session_t session)
+{
+  if (session->security_parameters.read_compression_algorithm ==
+      GNUTLS_COMP_NULL)
+    return 0;
+
+  return 1;
+}
+
+
+/* returns ciphertext which contains the headers too. This also
+ * calculates the size in the header field.
+ * 
+ * If random pad != 0 then the random pad data will be appended.
+ */
+int
+_gnutls_encrypt (gnutls_session_t session, const opaque * headers,
+                 size_t headers_size, const opaque * data,
+                 size_t data_size, opaque * ciphertext,
+                 size_t ciphertext_size, content_type_t type, int random_pad)
+{
+  gnutls_datum_t plain;
+  gnutls_datum_t comp;
+  int ret;
+  int free_comp = 1;
+
+  plain.data = (opaque *) data;
+  plain.size = data_size;
+
+  if (plain.size == 0 || is_write_comp_null (session) == 0)
+    {
+      comp = plain;
+      free_comp = 0;
+    }
+  else
+    {
+      /* Here comp is allocated and must be 
+       * freed.
+       */
+      ret = _gnutls_m_plaintext2compressed (session, &comp, &plain);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+    }
+
+  ret = _gnutls_compressed2ciphertext (session, &ciphertext[headers_size],
+                                       ciphertext_size - headers_size,
+                                       comp, type, random_pad);
+
+  if (free_comp)
+    _gnutls_free_datum (&comp);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+
+  /* copy the headers */
+  memcpy (ciphertext, headers, headers_size);
+  _gnutls_write_uint16 (ret, &ciphertext[3]);
+
+  return ret + headers_size;
+}
+
+/* Decrypts the given data.
+ * Returns the decrypted data length.
+ */
+int
+_gnutls_decrypt (gnutls_session_t session, opaque * ciphertext,
+                 size_t ciphertext_size, uint8_t * data,
+                 size_t max_data_size, content_type_t type)
+{
+  gnutls_datum_t gtxt;
+  gnutls_datum_t gcipher;
+  int ret;
+
+  if (ciphertext_size == 0)
+    return 0;
+
+  gcipher.size = ciphertext_size;
+  gcipher.data = ciphertext;
+
+  ret =
+    _gnutls_ciphertext2compressed (session, data, max_data_size,
+                                   gcipher, type);
+  if (ret < 0)
+    {
+      return ret;
+    }
+
+  if (ret == 0 || is_read_comp_null (session) == 0)
+    {
+      /* ret == ret */
+
+    }
+  else
+    {
+      gnutls_datum_t gcomp;
+
+      /* compression has this malloc overhead.
+       */
+
+      gcomp.data = data;
+      gcomp.size = ret;
+      ret = _gnutls_m_compressed2plaintext (session, &gtxt, &gcomp);
+      if (ret < 0)
+        {
+          return ret;
+        }
+
+      if (gtxt.size > MAX_RECORD_RECV_SIZE)
+        {
+          gnutls_assert ();
+          _gnutls_free_datum (&gtxt);
+          /* This shouldn't have happen and
+           * is a TLS fatal error.
+           */
+          return GNUTLS_E_DECOMPRESSION_FAILED;
+        }
+
+      /* This check is not really needed */
+      if (max_data_size < MAX_RECORD_RECV_SIZE)
+        {
+          gnutls_assert ();
+          _gnutls_free_datum (&gtxt);
+          return GNUTLS_E_INTERNAL_ERROR;
+        }
+
+      memcpy (data, gtxt.data, gtxt.size);
+      ret = gtxt.size;
+
+      _gnutls_free_datum (&gtxt);
+    }
+
+  return ret;
+}
+
+inline static mac_hd_t
+mac_init (gnutls_mac_algorithm_t mac, opaque * secret, int secret_size,
+          int ver)
+{
+  mac_hd_t td;
+
+  if (mac == GNUTLS_MAC_NULL)
+    return GNUTLS_MAC_FAILED;
+
+  if (ver == GNUTLS_SSL3)
+    {                           /* SSL 3.0 */
+      td = _gnutls_mac_init_ssl3 (mac, secret, secret_size);
+    }
+  else
+    {                           /* TLS 1.x */
+      td = _gnutls_hmac_init (mac, secret, secret_size);
+    }
+
+  return td;
+}
+
+inline static void
+mac_deinit (mac_hd_t td, opaque * res, int ver)
+{
+  if (ver == GNUTLS_SSL3)
+    {                           /* SSL 3.0 */
+      _gnutls_mac_deinit_ssl3 (td, res);
+    }
+  else
+    {
+      _gnutls_hmac_deinit (td, res);
+    }
+}
+
+inline static int
+calc_enc_length (gnutls_session_t session, int data_size,
+                 int hash_size, uint8_t * pad, int random_pad,
+                 cipher_type_t block_algo, uint16_t blocksize)
+{
+  uint8_t rnd;
+  int length;
+
+  *pad = 0;
+
+  switch (block_algo)
+    {
+    case CIPHER_STREAM:
+      length = data_size + hash_size;
+
+      break;
+    case CIPHER_BLOCK:
+      if (gc_nonce (&rnd, 1) != GC_OK)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_RANDOM_FAILED;
+        }
+
+      /* make rnd a multiple of blocksize */
+      if (session->security_parameters.version == GNUTLS_SSL3 ||
+          random_pad == 0)
+        {
+          rnd = 0;
+        }
+      else
+        {
+          rnd = (rnd / blocksize) * blocksize;
+          /* added to avoid the case of pad calculated 0
+           * seen below for pad calculation.
+           */
+          if (rnd > blocksize)
+            rnd -= blocksize;
+        }
+
+      length = data_size + hash_size;
+
+      *pad = (uint8_t) (blocksize - (length % blocksize)) + rnd;
+
+      length += *pad;
+      if (session->security_parameters.version >= GNUTLS_TLS1_1)
+        length += blocksize;    /* for the IV */
+
+      break;
+    default:
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  return length;
+}
+
+/* This is the actual encryption 
+ * Encrypts the given compressed datum, and puts the result to cipher_data,
+ * which has cipher_size size.
+ * return the actual encrypted data length.
+ */
+int
+_gnutls_compressed2ciphertext (gnutls_session_t session,
+                               opaque * cipher_data, int cipher_size,
+                               gnutls_datum_t compressed,
+                               content_type_t _type, int random_pad)
+{
+  uint8_t MAC[MAX_HASH_SIZE];
+  uint16_t c_length;
+  uint8_t pad;
+  int length, ret;
+  mac_hd_t td;
+  uint8_t type = _type;
+  uint8_t major, minor;
+  int hash_size =
+    _gnutls_hash_get_algo_len (session->security_parameters.
+                               write_mac_algorithm);
+  gnutls_protocol_t ver;
+  int blocksize =
+    _gnutls_cipher_get_block_size (session->security_parameters.
+                                   write_bulk_cipher_algorithm);
+  cipher_type_t block_algo =
+    _gnutls_cipher_is_block (session->security_parameters.
+                             write_bulk_cipher_algorithm);
+  opaque *data_ptr;
+
+
+  ver = gnutls_protocol_get_version (session);
+  minor = _gnutls_version_get_minor (ver);
+  major = _gnutls_version_get_major (ver);
+
+
+  /* Initialize MAC */
+  td = mac_init (session->security_parameters.write_mac_algorithm,
+                 session->connection_state.write_mac_secret.data,
+                 session->connection_state.write_mac_secret.size, ver);
+
+  if (td == GNUTLS_MAC_FAILED
+      && session->security_parameters.write_mac_algorithm != GNUTLS_MAC_NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  c_length = _gnutls_conv_uint16 (compressed.size);
+
+  if (td != GNUTLS_MAC_FAILED)
+    {                           /* actually when the algorithm in not the NULL one */
+      _gnutls_hmac (td,
+                    UINT64DATA (session->connection_state.
+                                write_sequence_number), 8);
+
+      _gnutls_hmac (td, &type, 1);
+      if (ver >= GNUTLS_TLS1)
+        {                       /* TLS 1.0 or higher */
+          _gnutls_hmac (td, &major, 1);
+          _gnutls_hmac (td, &minor, 1);
+        }
+      _gnutls_hmac (td, &c_length, 2);
+      _gnutls_hmac (td, compressed.data, compressed.size);
+      mac_deinit (td, MAC, ver);
+    }
+
+
+  /* Calculate the encrypted length (padding etc.)
+   */
+  length =
+    calc_enc_length (session, compressed.size, hash_size, &pad,
+                     random_pad, block_algo, blocksize);
+  if (length < 0)
+    {
+      gnutls_assert ();
+      return length;
+    }
+
+  /* copy the encrypted data to cipher_data.
+   */
+  if (cipher_size < length)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  data_ptr = cipher_data;
+  if (block_algo == CIPHER_BLOCK &&
+      session->security_parameters.version >= GNUTLS_TLS1_1)
+    {
+      /* copy the random IV.
+       */
+      if (gc_nonce (data_ptr, blocksize) != GC_OK)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_RANDOM_FAILED;
+        }
+      data_ptr += blocksize;
+    }
+
+  memcpy (data_ptr, compressed.data, compressed.size);
+  data_ptr += compressed.size;
+
+  if (hash_size > 0)
+    {
+      memcpy (data_ptr, MAC, hash_size);
+      data_ptr += hash_size;
+    }
+  if (block_algo == CIPHER_BLOCK && pad > 0)
+    {
+      memset (data_ptr, pad - 1, pad);
+    }
+
+
+  /* Actual encryption (inplace).
+   */
+  ret = _gnutls_cipher_encrypt (session->connection_state.
+                                write_cipher_state, cipher_data, length);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return length;
+}
+
+/* Deciphers the ciphertext packet, and puts the result to compress_data, of compress_size.
+ * Returns the actual compressed packet size.
+ */
+int
+_gnutls_ciphertext2compressed (gnutls_session_t session,
+                               opaque * compress_data,
+                               int compress_size,
+                               gnutls_datum_t ciphertext, uint8_t type)
+{
+  uint8_t MAC[MAX_HASH_SIZE];
+  uint16_t c_length;
+  uint8_t pad;
+  int length;
+  mac_hd_t td;
+  uint16_t blocksize;
+  int ret, i, pad_failed = 0;
+  uint8_t major, minor;
+  gnutls_protocol_t ver;
+  int hash_size =
+    _gnutls_hash_get_algo_len (session->security_parameters.
+                               read_mac_algorithm);
+
+  ver = gnutls_protocol_get_version (session);
+  minor = _gnutls_version_get_minor (ver);
+  major = _gnutls_version_get_major (ver);
+
+  blocksize = _gnutls_cipher_get_block_size (session->security_parameters.
+                                             read_bulk_cipher_algorithm);
+
+  /* initialize MAC 
+   */
+  td = mac_init (session->security_parameters.read_mac_algorithm,
+                 session->connection_state.read_mac_secret.data,
+                 session->connection_state.read_mac_secret.size, ver);
+
+  if (td == GNUTLS_MAC_FAILED
+      && session->security_parameters.read_mac_algorithm != GNUTLS_MAC_NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+
+  /* actual decryption (inplace)
+   */
+  switch (_gnutls_cipher_is_block
+          (session->security_parameters.read_bulk_cipher_algorithm))
+    {
+    case CIPHER_STREAM:
+      if ((ret = _gnutls_cipher_decrypt (session->connection_state.
+                                         read_cipher_state,
+                                         ciphertext.data,
+                                         ciphertext.size)) < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      length = ciphertext.size - hash_size;
+
+      break;
+    case CIPHER_BLOCK:
+      if ((ciphertext.size < blocksize) || (ciphertext.size % blocksize != 0))
+        {
+          gnutls_assert ();
+          return GNUTLS_E_DECRYPTION_FAILED;
+        }
+
+      if ((ret = _gnutls_cipher_decrypt (session->connection_state.
+                                         read_cipher_state,
+                                         ciphertext.data,
+                                         ciphertext.size)) < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      /* ignore the IV in TLS 1.1.
+       */
+      if (session->security_parameters.version >= GNUTLS_TLS1_1)
+        {
+          ciphertext.size -= blocksize;
+          ciphertext.data += blocksize;
+
+          if (ciphertext.size == 0)
+            {
+              gnutls_assert ();
+              return GNUTLS_E_DECRYPTION_FAILED;
+            }
+        }
+
+      pad = ciphertext.data[ciphertext.size - 1] + 1;   /* pad */
+
+      length = ciphertext.size - hash_size - pad;
+
+      if (pad > ciphertext.size - hash_size)
+        {
+          gnutls_assert ();
+          /* We do not fail here. We check below for the
+           * the pad_failed. If zero means success.
+           */
+          pad_failed = GNUTLS_E_DECRYPTION_FAILED;
+        }
+
+      /* Check the pading bytes (TLS 1.x)
+       */
+      if (ver >= GNUTLS_TLS1 && pad_failed == 0)
+        for (i = 2; i < pad; i++)
+          {
+            if (ciphertext.data[ciphertext.size - i] !=
+                ciphertext.data[ciphertext.size - 1])
+              pad_failed = GNUTLS_E_DECRYPTION_FAILED;
+          }
+      break;
+    default:
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  if (length < 0)
+    length = 0;
+  c_length = _gnutls_conv_uint16 ((uint16_t) length);
+
+  /* Pass the type, version, length and compressed through
+   * MAC.
+   */
+  if (td != GNUTLS_MAC_FAILED)
+    {
+      _gnutls_hmac (td,
+                    UINT64DATA (session->connection_state.
+                                read_sequence_number), 8);
+
+      _gnutls_hmac (td, &type, 1);
+      if (ver >= GNUTLS_TLS1)
+        {                       /* TLS 1.x */
+          _gnutls_hmac (td, &major, 1);
+          _gnutls_hmac (td, &minor, 1);
+        }
+      _gnutls_hmac (td, &c_length, 2);
+
+      if (length > 0)
+        _gnutls_hmac (td, ciphertext.data, length);
+
+      mac_deinit (td, MAC, ver);
+    }
+
+  /* This one was introduced to avoid a timing attack against the TLS
+   * 1.0 protocol.
+   */
+  if (pad_failed != 0)
+    return pad_failed;
+
+  /* HMAC was not the same. 
+   */
+  if (memcmp (MAC, &ciphertext.data[length], hash_size) != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_DECRYPTION_FAILED;
+    }
+
+  /* copy the decrypted stuff to compress_data.
+   */
+  if (compress_size < length)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_DECOMPRESSION_FAILED;
+    }
+  memcpy (compress_data, ciphertext.data, length);
+
+  return length;
+}
diff --git a/src/daemon/https/tls/gnutls_cipher.h b/src/daemon/https/tls/gnutls_cipher.h
new file mode 100644
index 00000000..0279e859
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_cipher.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+int _gnutls_encrypt (gnutls_session_t session, const opaque * headers,
+                     size_t headers_size, const opaque * data,
+                     size_t data_size, opaque * ciphertext,
+                     size_t ciphertext_size, content_type_t type,
+                     int random_pad);
+
+int _gnutls_decrypt (gnutls_session_t session, opaque * ciphertext,
+                     size_t ciphertext_size, uint8_t * data, size_t data_size,
+                     content_type_t type);
+int _gnutls_compressed2ciphertext (gnutls_session_t session,
+                                   opaque * cipher_data, int cipher_size,
+                                   gnutls_datum_t compressed,
+                                   content_type_t _type, int random_pad);
+int _gnutls_ciphertext2compressed (gnutls_session_t session,
+                                   opaque * compress_data,
+                                   int compress_size,
+                                   gnutls_datum_t ciphertext, uint8_t type);
diff --git a/src/daemon/https/tls/gnutls_cipher_int.c b/src/daemon/https/tls/gnutls_cipher_int.c
new file mode 100644
index 00000000..c9200e5b
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_cipher_int.c
@@ -0,0 +1,133 @@
+/*
+ * Copyright (C) 2000, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include <gnutls_int.h>
+#include <gnutls_errors.h>
+#include <gnutls_cipher_int.h>
+#include <gnutls_datum.h>
+
+cipher_hd_t
+_gnutls_cipher_init (gnutls_cipher_algorithm_t cipher,
+                     const gnutls_datum_t * key, const gnutls_datum_t * iv)
+{
+  cipher_hd_t ret = NULL;
+  int err = GC_INVALID_CIPHER;  /* doesn't matter */
+
+  switch (cipher)
+    {
+    case GNUTLS_CIPHER_AES_128_CBC:
+      err = gc_cipher_open (GC_AES128, GC_CBC, &ret);
+      break;
+
+    case GNUTLS_CIPHER_AES_256_CBC:
+      err = gc_cipher_open (GC_AES256, GC_CBC, &ret);
+      break;
+
+    case GNUTLS_CIPHER_3DES_CBC:
+      err = gc_cipher_open (GC_3DES, GC_CBC, &ret);
+      break;
+
+    case GNUTLS_CIPHER_DES_CBC:
+      err = gc_cipher_open (GC_DES, GC_CBC, &ret);
+      break;
+
+    case GNUTLS_CIPHER_ARCFOUR_128:
+      err = gc_cipher_open (GC_ARCFOUR128, GC_STREAM, &ret);
+      break;
+
+    case GNUTLS_CIPHER_ARCFOUR_40:
+      err = gc_cipher_open (GC_ARCFOUR40, GC_STREAM, &ret);
+      break;
+
+    case GNUTLS_CIPHER_RC2_40_CBC:
+      err = gc_cipher_open (GC_ARCTWO40, GC_CBC, &ret);
+      break;
+
+#ifdef  ENABLE_CAMELLIA
+    case GNUTLS_CIPHER_CAMELLIA_128_CBC:
+      err = gc_cipher_open (GC_CAMELLIA128, GC_CBC, &ret);
+      break;
+
+    case GNUTLS_CIPHER_CAMELLIA_256_CBC:
+      err = gc_cipher_open (GC_CAMELLIA256, GC_CBC, &ret);
+      break;
+#endif
+
+    default:
+      return NULL;
+    }
+
+  if (err == 0)
+    {
+      gc_cipher_setkey (ret, key->size, key->data);
+      if (iv->data != NULL && iv->size > 0)
+        gc_cipher_setiv (ret, iv->size, iv->data);
+    }
+  else if (cipher != GNUTLS_CIPHER_NULL)
+    {
+      gnutls_assert ();
+      _gnutls_x509_log ("Crypto cipher[%d] error: %d\n", cipher, err);
+      /* FIXME: gc_strerror */
+    }
+
+  return ret;
+}
+
+int
+_gnutls_cipher_encrypt (cipher_hd_t handle, void *text, int textlen)
+{
+  if (handle != GNUTLS_CIPHER_FAILED)
+    {
+      if (gc_cipher_encrypt_inline (handle, textlen, text) != 0)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_INTERNAL_ERROR;
+        }
+    }
+  return 0;
+}
+
+int
+_gnutls_cipher_decrypt (cipher_hd_t handle, void *ciphertext,
+                        int ciphertextlen)
+{
+  if (handle != GNUTLS_CIPHER_FAILED)
+    {
+      if (gc_cipher_decrypt_inline (handle, ciphertextlen, ciphertext) != 0)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_INTERNAL_ERROR;
+        }
+    }
+  return 0;
+}
+
+void
+_gnutls_cipher_deinit (cipher_hd_t handle)
+{
+  if (handle != GNUTLS_CIPHER_FAILED)
+    {
+      gc_cipher_close (handle);
+    }
+}
diff --git a/src/daemon/https/tls/gnutls_cipher_int.h b/src/daemon/https/tls/gnutls_cipher_int.h
new file mode 100644
index 00000000..78ed487f
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_cipher_int.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#ifndef GNUTLS_CIPHER_INT
+# define GNUTLS_CIPHER_INT
+
+#define cipher_hd_t gc_cipher_handle
+#define GNUTLS_CIPHER_FAILED NULL
+
+// TODO gc_cipher_handle -> void * x3
+void * _gnutls_cipher_init(gnutls_cipher_algorithm_t cipher,
+                                     const gnutls_datum_t * key,
+                                     const gnutls_datum_t * iv);
+
+int _gnutls_cipher_encrypt(void * handle,
+                           void *text,
+                           int textlen);
+
+int _gnutls_cipher_decrypt(void * handle,
+                           void *ciphertext,
+                           int ciphertextlen);
+
+void _gnutls_cipher_deinit(void * handle);
+
+#endif /* GNUTLS_CIPHER_INT */
diff --git a/src/daemon/https/tls/gnutls_compress.c b/src/daemon/https/tls/gnutls_compress.c
new file mode 100644
index 00000000..e6561ad6
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_compress.c
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2000, 2004, 2005, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* This file contains the functions which convert the TLS plaintext
+ * packet to TLS compressed packet.
+ */
+
+#include "gnutls_int.h"
+#include "gnutls_compress.h"
+#include "gnutls_errors.h"
+#include "gnutls_compress_int.h"
+
+/* These functions allocate the return value internally
+ */
+int
+_gnutls_m_plaintext2compressed (gnutls_session_t session,
+                                gnutls_datum_t * compressed,
+                                const gnutls_datum_t * plaintext)
+{
+  int size;
+  opaque *data;
+
+  size =
+    _gnutls_compress (session->connection_state.write_compression_state,
+                      plaintext->data, plaintext->size, &data,
+                      MAX_RECORD_SEND_SIZE + EXTRA_COMP_SIZE);
+  if (size < 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_COMPRESSION_FAILED;
+    }
+  compressed->data = data;
+  compressed->size = size;
+
+  return 0;
+}
+
+int
+_gnutls_m_compressed2plaintext (gnutls_session_t session,
+                                gnutls_datum_t * plain,
+                                const gnutls_datum_t * compressed)
+{
+  int size;
+  opaque *data;
+
+  size =
+    _gnutls_decompress (session->connection_state.
+                        read_compression_state, compressed->data,
+                        compressed->size, &data, MAX_RECORD_RECV_SIZE);
+  if (size < 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_DECOMPRESSION_FAILED;
+    }
+  plain->data = data;
+  plain->size = size;
+
+  return 0;
+}
diff --git a/src/daemon/https/tls/gnutls_compress.h b/src/daemon/https/tls/gnutls_compress.h
new file mode 100644
index 00000000..44666321
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_compress.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+int _gnutls_m_plaintext2compressed (gnutls_session_t session,
+                                    gnutls_datum_t * compressed,
+                                    const gnutls_datum_t *plaintext);
+int _gnutls_m_compressed2plaintext (gnutls_session_t session,
+                                    gnutls_datum_t * plain,
+                                    const gnutls_datum_t* compressed);
diff --git a/src/daemon/https/tls/gnutls_compress_int.c b/src/daemon/https/tls/gnutls_compress_int.c
new file mode 100644
index 00000000..eedfd63d
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_compress_int.c
@@ -0,0 +1,300 @@
+/*
+ * Copyright (C) 2000, 2002, 2003, 2004, 2005, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include <gnutls_int.h>
+#include <gnutls_compress.h>
+#include <gnutls_algorithms.h>
+#include "gnutls_errors.h"
+
+/* The flag d is the direction (compress, decompress). Non zero is
+ * decompress.
+ */
+comp_hd_t
+_gnutls_comp_init (gnutls_compression_method_t method, int d)
+{
+  comp_hd_t ret;
+  int err;
+
+  ret = gnutls_malloc (sizeof (struct comp_hd_t_STRUCT));
+  if (ret == NULL)
+    {
+      gnutls_assert ();
+      return NULL;
+    }
+
+  ret->algo = method;
+  ret->handle = NULL;
+
+  switch (method)
+    {
+#ifdef HAVE_LIBZ
+    case GNUTLS_COMP_DEFLATE:
+      {
+        int window_bits, mem_level;
+        int comp_level;
+        z_stream *zhandle;
+
+        window_bits = _gnutls_compression_get_wbits (method);
+        mem_level = _gnutls_compression_get_mem_level (method);
+        comp_level = _gnutls_compression_get_comp_level (method);
+
+        ret->handle = gnutls_malloc (sizeof (z_stream));
+        if (ret->handle == NULL)
+          {
+            gnutls_assert ();
+            goto cleanup_ret;
+          }
+
+        zhandle = ret->handle;
+
+        zhandle->zalloc = (alloc_func) 0;
+        zhandle->zfree = (free_func) 0;
+        zhandle->opaque = (voidpf) 0;
+
+        if (d)
+          err = inflateInit2 (zhandle, window_bits);
+        else
+          {
+            err = deflateInit2 (zhandle,
+                                comp_level, Z_DEFLATED,
+                                window_bits, mem_level, Z_DEFAULT_STRATEGY);
+          }
+        if (err != Z_OK)
+          {
+            gnutls_assert ();
+            gnutls_free (ret->handle);
+            goto cleanup_ret;
+          }
+        break;
+      }
+#endif
+    case GNUTLS_COMP_NULL:
+      break;
+    }
+  return ret;
+
+cleanup_ret:
+  gnutls_free (ret);
+  return NULL;
+}
+
+/* The flag d is the direction (compress, decompress). Non zero is
+ * decompress.
+ */
+void
+_gnutls_comp_deinit (comp_hd_t handle, int d)
+{
+  int err;
+
+  if (handle != NULL)
+    {
+      switch (handle->algo)
+        {
+#ifdef HAVE_LIBZ
+        case GNUTLS_COMP_DEFLATE:
+          if (d)
+            err = inflateEnd (handle->handle);
+          else
+            err = deflateEnd (handle->handle);
+          break;
+#endif
+        default:
+          break;
+        }
+      gnutls_free (handle->handle);
+      gnutls_free (handle);
+
+    }
+}
+
+/* These functions are memory consuming 
+ */
+
+int
+_gnutls_compress (comp_hd_t handle, const opaque * plain,
+                  size_t plain_size, opaque ** compressed,
+                  size_t max_comp_size)
+{
+  int compressed_size = GNUTLS_E_COMPRESSION_FAILED;
+  int err;
+
+  /* NULL compression is not handled here
+   */
+  if (handle == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  switch (handle->algo)
+    {
+
+#ifdef HAVE_LIBZ
+    case GNUTLS_COMP_DEFLATE:
+      {
+        uLongf size;
+        z_stream *zhandle;
+
+        size = (plain_size + plain_size) + 10;
+        *compressed = gnutls_malloc (size);
+        if (*compressed == NULL)
+          {
+            gnutls_assert ();
+            return GNUTLS_E_MEMORY_ERROR;
+          }
+
+        zhandle = handle->handle;
+
+        zhandle->next_in = (Bytef *) plain;
+        zhandle->avail_in = plain_size;
+        zhandle->next_out = (Bytef *) * compressed;
+        zhandle->avail_out = size;
+
+        err = deflate (zhandle, Z_SYNC_FLUSH);
+
+        if (err != Z_OK || zhandle->avail_in != 0)
+          {
+            gnutls_assert ();
+            gnutls_free (*compressed);
+            *compressed = NULL;
+            return GNUTLS_E_COMPRESSION_FAILED;
+          }
+
+        compressed_size = size - zhandle->avail_out;
+        break;
+      }
+#endif
+    default:
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }                           /* switch */
+
+#ifdef COMPRESSION_DEBUG
+  _gnutls_debug_log ("Compression ratio: %f\n",
+                     (float) ((float) compressed_size / (float) plain_size));
+#endif
+
+  if ((size_t) compressed_size > max_comp_size)
+    {
+      gnutls_free (*compressed);
+      *compressed = NULL;
+      return GNUTLS_E_COMPRESSION_FAILED;
+    }
+
+  return compressed_size;
+}
+
+
+
+int
+_gnutls_decompress (comp_hd_t handle, opaque * compressed,
+                    size_t compressed_size, opaque ** plain,
+                    size_t max_record_size)
+{
+  int plain_size = GNUTLS_E_DECOMPRESSION_FAILED, err;
+  int cur_pos;
+
+  if (compressed_size > max_record_size + EXTRA_COMP_SIZE)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_DECOMPRESSION_FAILED;
+    }
+
+  /* NULL compression is not handled here
+   */
+
+  if (handle == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  switch (handle->algo)
+    {
+#ifdef HAVE_LIBZ
+    case GNUTLS_COMP_DEFLATE:
+      {
+        uLongf out_size;
+        z_stream *zhandle;
+
+        *plain = NULL;
+        out_size = compressed_size + compressed_size;
+        plain_size = 0;
+
+        zhandle = handle->handle;
+
+        zhandle->next_in = (Bytef *) compressed;
+        zhandle->avail_in = compressed_size;
+
+        cur_pos = 0;
+
+        do
+          {
+            out_size += 512;
+            *plain = gnutls_realloc_fast (*plain, out_size);
+            if (*plain == NULL)
+              {
+                gnutls_assert ();
+                return GNUTLS_E_MEMORY_ERROR;
+              }
+
+            zhandle->next_out = (Bytef *) (*plain + cur_pos);
+            zhandle->avail_out = out_size - cur_pos;
+
+            err = inflate (zhandle, Z_SYNC_FLUSH);
+
+            cur_pos = out_size - zhandle->avail_out;
+
+          }
+        while ((err == Z_BUF_ERROR && zhandle->avail_out == 0
+                && out_size < max_record_size)
+               || (err == Z_OK && zhandle->avail_in != 0));
+
+        if (err != Z_OK)
+          {
+            gnutls_assert ();
+            gnutls_free (*plain);
+            *plain = NULL;
+            return GNUTLS_E_DECOMPRESSION_FAILED;
+          }
+
+        plain_size = out_size - zhandle->avail_out;
+        break;
+      }
+#endif
+    default:
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }                           /* switch */
+
+  if ((size_t) plain_size > max_record_size)
+    {
+      gnutls_assert ();
+      gnutls_free (*plain);
+      *plain = NULL;
+      return GNUTLS_E_DECOMPRESSION_FAILED;
+    }
+
+  return plain_size;
+}
diff --git a/src/daemon/https/tls/gnutls_compress_int.h b/src/daemon/https/tls/gnutls_compress_int.h
new file mode 100644
index 00000000..4479fb4d
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_compress_int.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#ifndef GNUTLS_COMP_INT
+# define GNUTLS_COMP_INT
+
+#ifdef HAVE_LIBZ
+# include <zlib.h>
+#endif
+
+#define GNUTLS_COMP_FAILED NULL
+
+typedef struct comp_hd_t_STRUCT
+{
+  void *handle;
+  gnutls_compression_method_t algo;
+} *comp_hd_t;
+
+comp_hd_t _gnutls_comp_init (gnutls_compression_method_t, int d);
+void _gnutls_comp_deinit (comp_hd_t handle, int d);
+
+int _gnutls_decompress (comp_hd_t handle, opaque * compressed,
+                        size_t compressed_size, opaque ** plain,
+                        size_t max_record_size);
+int _gnutls_compress (comp_hd_t, const opaque * plain, size_t plain_size,
+                      opaque ** compressed, size_t max_comp_size);
+
+#endif
diff --git a/src/daemon/https/tls/gnutls_constate.c b/src/daemon/https/tls/gnutls_constate.c
new file mode 100644
index 00000000..c2323c46
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_constate.c
@@ -0,0 +1,1039 @@
+/*
+ * Copyright (C) 2001, 2002, 2003, 2004, 2005, 2006  Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* Functions that are supposed to run after the handshake procedure is
+ * finished. These functions activate the established security parameters.
+ */
+
+#include <gnutls_int.h>
+#include <gnutls_constate.h>
+#include <gnutls_errors.h>
+#include <gnutls_kx.h>
+#include <gnutls_algorithms.h>
+#include <gnutls_num.h>
+#include <gnutls_datum.h>
+#include <gnutls_state.h>
+
+static const char keyexp[] = "key expansion";
+static const int keyexp_length = sizeof (keyexp) - 1;
+
+static const char ivblock[] = "IV block";
+static const int ivblock_length = sizeof (ivblock) - 1;
+
+static const char cliwrite[] = "client write key";
+static const int cliwrite_length = sizeof (cliwrite) - 1;
+
+static const char servwrite[] = "server write key";
+static const int servwrite_length = sizeof (servwrite) - 1;
+
+#define EXPORT_FINAL_KEY_SIZE 16
+
+/* This function is to be called after handshake, when master_secret,
+ *  client_random and server_random have been initialized. 
+ * This function creates the keys and stores them into pending session.
+ * (session->cipher_specs)
+ */
+int
+_gnutls_set_keys (gnutls_session_t session, int hash_size, int IV_size,
+                  int key_size, int export_flag)
+{
+
+/* FIXME: This function is too long
+ */
+  opaque *key_block;
+  opaque rnd[2 * TLS_RANDOM_SIZE];
+  opaque rrnd[2 * TLS_RANDOM_SIZE];
+  int pos, ret;
+  int block_size;
+  char buf[65];
+
+  if (session->cipher_specs.generated_keys != 0)
+    {
+      /* keys have already been generated.
+       * reset generated_keys and exit normally.
+       */
+      session->cipher_specs.generated_keys = 0;
+      return 0;
+    }
+
+  block_size = 2 * hash_size + 2 * key_size;
+  if (export_flag == 0)
+    block_size += 2 * IV_size;
+
+  key_block = gnutls_secure_malloc (block_size);
+  if (key_block == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  memcpy (rnd, session->security_parameters.server_random, TLS_RANDOM_SIZE);
+  memcpy (&rnd[TLS_RANDOM_SIZE],
+          session->security_parameters.client_random, TLS_RANDOM_SIZE);
+
+  memcpy (rrnd, session->security_parameters.client_random, TLS_RANDOM_SIZE);
+  memcpy (&rrnd[TLS_RANDOM_SIZE],
+          session->security_parameters.server_random, TLS_RANDOM_SIZE);
+
+  if (session->security_parameters.version == GNUTLS_SSL3)
+    {                           /* SSL 3 */
+      ret =
+        _gnutls_ssl3_generate_random (session->
+                                      security_parameters.
+                                      master_secret,
+                                      TLS_MASTER_SIZE, rnd,
+                                      2 * TLS_RANDOM_SIZE,
+                                      block_size, key_block);
+    }
+  else
+    {                           /* TLS 1.0 */
+      ret =
+        _gnutls_PRF (session, session->security_parameters.master_secret,
+                     TLS_MASTER_SIZE, keyexp, keyexp_length,
+                     rnd, 2 * TLS_RANDOM_SIZE, block_size, key_block);
+    }
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      gnutls_free (key_block);
+      return ret;
+    }
+
+  _gnutls_hard_log ("INT: KEY BLOCK[%d]: %s\n", block_size,
+                    _gnutls_bin2hex (key_block, block_size, buf,
+                                     sizeof (buf)));
+
+  pos = 0;
+  if (hash_size > 0)
+    {
+      if (_gnutls_sset_datum
+          (&session->cipher_specs.client_write_mac_secret,
+           &key_block[pos], hash_size) < 0)
+        {
+          gnutls_free (key_block);
+          return GNUTLS_E_MEMORY_ERROR;
+        }
+      pos += hash_size;
+
+      if (_gnutls_sset_datum
+          (&session->cipher_specs.server_write_mac_secret,
+           &key_block[pos], hash_size) < 0)
+        {
+          gnutls_free (key_block);
+          return GNUTLS_E_MEMORY_ERROR;
+        }
+      pos += hash_size;
+    }
+
+  if (key_size > 0)
+    {
+      opaque *client_write_key, *server_write_key;
+      int client_write_key_size, server_write_key_size;
+      int free_keys = 0;
+
+      if (export_flag == 0)
+        {
+          client_write_key = &key_block[pos];
+          client_write_key_size = key_size;
+
+          pos += key_size;
+
+          server_write_key = &key_block[pos];
+          server_write_key_size = key_size;
+
+          pos += key_size;
+
+        }
+      else
+        {                       /* export */
+          free_keys = 1;
+
+          client_write_key = gnutls_secure_malloc (EXPORT_FINAL_KEY_SIZE);
+          if (client_write_key == NULL)
+            {
+              gnutls_assert ();
+              gnutls_free (key_block);
+              return GNUTLS_E_MEMORY_ERROR;
+            }
+
+          server_write_key = gnutls_secure_malloc (EXPORT_FINAL_KEY_SIZE);
+          if (server_write_key == NULL)
+            {
+              gnutls_assert ();
+              gnutls_free (key_block);
+              gnutls_free (client_write_key);
+              return GNUTLS_E_MEMORY_ERROR;
+            }
+
+          /* generate the final keys */
+
+          if (session->security_parameters.version == GNUTLS_SSL3)
+            {                   /* SSL 3 */
+              ret =
+                _gnutls_ssl3_hash_md5 (&key_block[pos],
+                                       key_size, rrnd,
+                                       2 * TLS_RANDOM_SIZE,
+                                       EXPORT_FINAL_KEY_SIZE,
+                                       client_write_key);
+
+            }
+          else
+            {                   /* TLS 1.0 */
+              ret =
+                _gnutls_PRF (session, &key_block[pos], key_size,
+                             cliwrite, cliwrite_length,
+                             rrnd,
+                             2 * TLS_RANDOM_SIZE,
+                             EXPORT_FINAL_KEY_SIZE, client_write_key);
+            }
+
+          if (ret < 0)
+            {
+              gnutls_assert ();
+              gnutls_free (key_block);
+              gnutls_free (server_write_key);
+              gnutls_free (client_write_key);
+              return ret;
+            }
+
+          client_write_key_size = EXPORT_FINAL_KEY_SIZE;
+          pos += key_size;
+
+          if (session->security_parameters.version == GNUTLS_SSL3)
+            {                   /* SSL 3 */
+              ret =
+                _gnutls_ssl3_hash_md5 (&key_block[pos], key_size,
+                                       rnd, 2 * TLS_RANDOM_SIZE,
+                                       EXPORT_FINAL_KEY_SIZE,
+                                       server_write_key);
+            }
+          else
+            {                   /* TLS 1.0 */
+              ret =
+                _gnutls_PRF (session, &key_block[pos], key_size,
+                             servwrite, servwrite_length,
+                             rrnd, 2 * TLS_RANDOM_SIZE,
+                             EXPORT_FINAL_KEY_SIZE, server_write_key);
+            }
+
+          if (ret < 0)
+            {
+              gnutls_assert ();
+              gnutls_free (key_block);
+              gnutls_free (server_write_key);
+              gnutls_free (client_write_key);
+              return ret;
+            }
+
+          server_write_key_size = EXPORT_FINAL_KEY_SIZE;
+          pos += key_size;
+        }
+
+      if (_gnutls_sset_datum
+          (&session->cipher_specs.client_write_key,
+           client_write_key, client_write_key_size) < 0)
+        {
+          gnutls_free (key_block);
+          gnutls_free (server_write_key);
+          gnutls_free (client_write_key);
+          return GNUTLS_E_MEMORY_ERROR;
+        }
+      _gnutls_hard_log ("INT: CLIENT WRITE KEY [%d]: %s\n",
+                        client_write_key_size,
+                        _gnutls_bin2hex (client_write_key,
+                                         client_write_key_size, buf,
+                                         sizeof (buf)));
+
+      if (_gnutls_sset_datum
+          (&session->cipher_specs.server_write_key,
+           server_write_key, server_write_key_size) < 0)
+        {
+          gnutls_free (key_block);
+          gnutls_free (server_write_key);
+          gnutls_free (client_write_key);
+          return GNUTLS_E_MEMORY_ERROR;
+        }
+
+      _gnutls_hard_log ("INT: SERVER WRITE KEY [%d]: %s\n",
+                        server_write_key_size,
+                        _gnutls_bin2hex (server_write_key,
+                                         server_write_key_size, buf,
+                                         sizeof (buf)));
+
+      if (free_keys != 0)
+        {
+          gnutls_free (server_write_key);
+          gnutls_free (client_write_key);
+        }
+    }
+
+
+  /* IV generation in export and non export ciphers.
+   */
+  if (IV_size > 0 && export_flag == 0)
+    {
+      if (_gnutls_sset_datum
+          (&session->cipher_specs.client_write_IV, &key_block[pos],
+           IV_size) < 0)
+        {
+          gnutls_free (key_block);
+          return GNUTLS_E_MEMORY_ERROR;
+        }
+      pos += IV_size;
+
+      if (_gnutls_sset_datum
+          (&session->cipher_specs.server_write_IV, &key_block[pos],
+           IV_size) < 0)
+        {
+          gnutls_free (key_block);
+          return GNUTLS_E_MEMORY_ERROR;
+        }
+      pos += IV_size;
+
+    }
+  else if (IV_size > 0 && export_flag != 0)
+    {
+      opaque *iv_block = gnutls_alloca (IV_size * 2);
+      if (iv_block == NULL)
+        {
+          gnutls_assert ();
+          gnutls_free (key_block);
+          return GNUTLS_E_MEMORY_ERROR;
+        }
+
+      if (session->security_parameters.version == GNUTLS_SSL3)
+        {                       /* SSL 3 */
+          ret = _gnutls_ssl3_hash_md5 ("", 0,
+                                       rrnd, TLS_RANDOM_SIZE * 2,
+                                       IV_size, iv_block);
+
+          if (ret < 0)
+            {
+              gnutls_assert ();
+              gnutls_free (key_block);
+              gnutls_afree (iv_block);
+              return ret;
+            }
+
+          ret = _gnutls_ssl3_hash_md5 ("", 0, rnd,
+                                       TLS_RANDOM_SIZE * 2,
+                                       IV_size, &iv_block[IV_size]);
+
+        }
+      else
+        {                       /* TLS 1.0 */
+          ret = _gnutls_PRF (session, "", 0,
+                             ivblock, ivblock_length, rrnd,
+                             2 * TLS_RANDOM_SIZE, IV_size * 2, iv_block);
+        }
+
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          gnutls_afree (iv_block);
+          gnutls_free (key_block);
+          return ret;
+        }
+
+      if (_gnutls_sset_datum
+          (&session->cipher_specs.client_write_IV, iv_block, IV_size) < 0)
+        {
+          gnutls_afree (iv_block);
+          gnutls_free (key_block);
+          return GNUTLS_E_MEMORY_ERROR;
+        }
+
+      if (_gnutls_sset_datum
+          (&session->cipher_specs.server_write_IV,
+           &iv_block[IV_size], IV_size) < 0)
+        {
+          gnutls_afree (iv_block);
+          gnutls_free (key_block);
+          return GNUTLS_E_MEMORY_ERROR;
+        }
+
+      gnutls_afree (iv_block);
+    }
+
+  gnutls_free (key_block);
+
+  session->cipher_specs.generated_keys = 1;
+
+  return 0;
+}
+
+int
+_gnutls_set_read_keys (gnutls_session_t session)
+{
+  int hash_size;
+  int IV_size;
+  int key_size, export_flag;
+  gnutls_cipher_algorithm_t algo;
+  gnutls_mac_algorithm_t mac_algo;
+
+  mac_algo = session->security_parameters.read_mac_algorithm;
+  algo = session->security_parameters.read_bulk_cipher_algorithm;
+
+  hash_size = _gnutls_hash_get_algo_len (mac_algo);
+  IV_size = _gnutls_cipher_get_iv_size (algo);
+  key_size = gnutls_cipher_get_key_size (algo);
+  export_flag = _gnutls_cipher_get_export_flag (algo);
+
+  return _gnutls_set_keys (session, hash_size, IV_size, key_size,
+                           export_flag);
+}
+
+int
+_gnutls_set_write_keys (gnutls_session_t session)
+{
+  int hash_size;
+  int IV_size;
+  int key_size, export_flag;
+  gnutls_cipher_algorithm_t algo;
+  gnutls_mac_algorithm_t mac_algo;
+
+  mac_algo = session->security_parameters.write_mac_algorithm;
+  algo = session->security_parameters.write_bulk_cipher_algorithm;
+
+  hash_size = _gnutls_hash_get_algo_len (mac_algo);
+  IV_size = _gnutls_cipher_get_iv_size (algo);
+  key_size = gnutls_cipher_get_key_size (algo);
+  export_flag = _gnutls_cipher_get_export_flag (algo);
+
+  return _gnutls_set_keys (session, hash_size, IV_size, key_size,
+                           export_flag);
+}
+
+#define CPY_COMMON dst->entity = src->entity; \
+        dst->kx_algorithm = src->kx_algorithm; \
+        memcpy( &dst->current_cipher_suite, &src->current_cipher_suite, sizeof(cipher_suite_st)); \
+        memcpy( dst->master_secret, src->master_secret, TLS_MASTER_SIZE); \
+        memcpy( dst->client_random, src->client_random, TLS_RANDOM_SIZE); \
+        memcpy( dst->server_random, src->server_random, TLS_RANDOM_SIZE); \
+        memcpy( dst->session_id, src->session_id, TLS_MAX_SESSION_ID_SIZE); \
+        dst->session_id_size = src->session_id_size; \
+        dst->cert_type = src->cert_type; \
+        dst->timestamp = src->timestamp; \
+        dst->max_record_recv_size = src->max_record_recv_size; \
+        dst->max_record_send_size = src->max_record_send_size; \
+        dst->version = src->version; \
+        memcpy( &dst->extensions, &src->extensions, sizeof(tls_ext_st)); \
+        memcpy( &dst->inner_secret, &src->inner_secret, TLS_MASTER_SIZE);
+
+static void
+_gnutls_cpy_read_security_parameters (security_parameters_st *
+                                      dst, security_parameters_st * src)
+{
+  CPY_COMMON;
+
+  dst->read_bulk_cipher_algorithm = src->read_bulk_cipher_algorithm;
+  dst->read_mac_algorithm = src->read_mac_algorithm;
+  dst->read_compression_algorithm = src->read_compression_algorithm;
+}
+
+static void
+_gnutls_cpy_write_security_parameters (security_parameters_st *
+                                       dst, security_parameters_st * src)
+{
+  CPY_COMMON;
+
+  dst->write_bulk_cipher_algorithm = src->write_bulk_cipher_algorithm;
+  dst->write_mac_algorithm = src->write_mac_algorithm;
+  dst->write_compression_algorithm = src->write_compression_algorithm;
+}
+
+/* Sets the current connection session to conform with the
+ * Security parameters(pending session), and initializes encryption.
+ * Actually it initializes and starts encryption ( so it needs
+ * secrets and random numbers to have been negotiated)
+ * This is to be called after sending the Change Cipher Spec packet.
+ */
+int
+_gnutls_connection_state_init (gnutls_session_t session)
+{
+  int ret;
+
+/* Setup the master secret 
+ */
+  if ((ret = _gnutls_generate_master (session, 0), 0) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+
+  return 0;
+}
+
+
+/* Initializes the read connection session
+ * (read encrypted data)
+ */
+int
+_gnutls_read_connection_state_init (gnutls_session_t session)
+{
+  int mac_size;
+  int rc;
+
+  _gnutls_uint64zero (session->connection_state.read_sequence_number);
+
+/* Update internals from CipherSuite selected.
+ * If we are resuming just copy the connection session
+ */
+  if (session->internals.resumed == RESUME_FALSE)
+    {
+      rc = _gnutls_set_read_cipher (session,
+                                    _gnutls_cipher_suite_get_cipher_algo
+                                    (&session->security_parameters.
+                                     current_cipher_suite));
+      if (rc < 0)
+        return rc;
+      rc = _gnutls_set_read_mac (session,
+                                 _gnutls_cipher_suite_get_mac_algo
+                                 (&session->security_parameters.
+                                  current_cipher_suite));
+      if (rc < 0)
+        return rc;
+
+      rc = _gnutls_set_kx (session,
+                           _gnutls_cipher_suite_get_kx_algo
+                           (&session->security_parameters.
+                            current_cipher_suite));
+      if (rc < 0)
+        return rc;
+
+      rc = _gnutls_set_read_compression (session,
+                                         session->internals.
+                                         compression_method);
+      if (rc < 0)
+        return rc;
+    }
+  else
+    {                           /* RESUME_TRUE */
+      _gnutls_cpy_read_security_parameters (&session->
+                                            security_parameters,
+                                            &session->
+                                            internals.
+                                            resumed_security_parameters);
+    }
+
+
+  rc = _gnutls_set_read_keys (session);
+  if (rc < 0)
+    return rc;
+
+  _gnutls_handshake_log ("HSK[%x]: Cipher Suite: %s\n",
+                         session, _gnutls_cipher_suite_get_name (&session->
+                                                                 security_parameters.
+                                                                 current_cipher_suite));
+
+  if (_gnutls_compression_is_ok
+      (session->security_parameters.read_compression_algorithm) != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM;
+    }
+
+  if (_gnutls_mac_is_ok
+      (session->security_parameters.read_mac_algorithm) != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  /* Free all the previous keys/ sessions etc.
+   */
+  if (session->connection_state.read_mac_secret.data != NULL)
+    _gnutls_free_datum (&session->connection_state.read_mac_secret);
+
+  if (session->connection_state.read_cipher_state != NULL)
+    _gnutls_cipher_deinit (session->connection_state.read_cipher_state);
+
+  if (session->connection_state.read_compression_state != NULL)
+    _gnutls_comp_deinit (session->connection_state.read_compression_state, 1);
+
+
+  mac_size =
+    _gnutls_hash_get_algo_len (session->security_parameters.
+                               read_mac_algorithm);
+
+  _gnutls_handshake_log
+    ("HSK[%x]: Initializing internal [read] cipher sessions\n", session);
+
+  switch (session->security_parameters.entity)
+    {
+    case GNUTLS_SERVER:
+      /* initialize cipher session
+       */
+      session->connection_state.read_cipher_state =
+        _gnutls_cipher_init (session->security_parameters.
+                             read_bulk_cipher_algorithm,
+                             &session->cipher_specs.
+                             client_write_key,
+                             &session->cipher_specs.client_write_IV);
+      if (session->connection_state.read_cipher_state ==
+          GNUTLS_CIPHER_FAILED
+          && session->security_parameters.
+          read_bulk_cipher_algorithm != GNUTLS_CIPHER_NULL)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_INTERNAL_ERROR;
+        }
+
+      /* copy mac secrets from cipherspecs, to connection
+       * session.
+       */
+      if (mac_size > 0)
+        {
+          if (_gnutls_sset_datum (&session->connection_state.
+                                  read_mac_secret,
+                                  session->cipher_specs.
+                                  client_write_mac_secret.data,
+                                  session->cipher_specs.
+                                  client_write_mac_secret.size) < 0)
+            {
+              gnutls_assert ();
+              return GNUTLS_E_MEMORY_ERROR;
+            }
+
+        }
+
+      break;
+
+    case GNUTLS_CLIENT:
+      session->connection_state.read_cipher_state =
+        _gnutls_cipher_init (session->security_parameters.
+                             read_bulk_cipher_algorithm,
+                             &session->cipher_specs.
+                             server_write_key,
+                             &session->cipher_specs.server_write_IV);
+
+      if (session->connection_state.read_cipher_state ==
+          GNUTLS_CIPHER_FAILED
+          && session->security_parameters.
+          read_bulk_cipher_algorithm != GNUTLS_CIPHER_NULL)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_INTERNAL_ERROR;
+        }
+
+
+      /* copy mac secret to connection session
+       */
+      if (mac_size > 0)
+        {
+          if (_gnutls_sset_datum (&session->connection_state.
+                                  read_mac_secret,
+                                  session->cipher_specs.
+                                  server_write_mac_secret.data,
+                                  session->cipher_specs.
+                                  server_write_mac_secret.size) < 0)
+            {
+              gnutls_assert ();
+              return GNUTLS_E_MEMORY_ERROR;
+            }
+        }
+
+      break;
+
+    default:                   /* this check is useless */
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  session->connection_state.read_compression_state =
+    _gnutls_comp_init (session->security_parameters.
+                       read_compression_algorithm, 1);
+
+  if (session->connection_state.read_compression_state == GNUTLS_COMP_FAILED)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM;
+    }
+
+  return 0;
+}
+
+
+
+/* Initializes the write connection session
+ * (write encrypted data)
+ */
+int
+_gnutls_write_connection_state_init (gnutls_session_t session)
+{
+  int mac_size;
+  int rc;
+
+  _gnutls_uint64zero (session->connection_state.write_sequence_number);
+
+/* Update internals from CipherSuite selected.
+ * If we are resuming just copy the connection session
+ */
+  if (session->internals.resumed == RESUME_FALSE)
+    {
+      rc = _gnutls_set_write_cipher (session,
+                                     _gnutls_cipher_suite_get_cipher_algo
+                                     (&session->security_parameters.
+                                      current_cipher_suite));
+      if (rc < 0)
+        return rc;
+      rc = _gnutls_set_write_mac (session,
+                                  _gnutls_cipher_suite_get_mac_algo
+                                  (&session->security_parameters.
+                                   current_cipher_suite));
+      if (rc < 0)
+        return rc;
+
+      rc = _gnutls_set_kx (session,
+                           _gnutls_cipher_suite_get_kx_algo
+                           (&session->security_parameters.
+                            current_cipher_suite));
+      if (rc < 0)
+        return rc;
+
+      rc = _gnutls_set_write_compression (session,
+                                          session->internals.
+                                          compression_method);
+      if (rc < 0)
+        return rc;
+    }
+  else
+    {                           /* RESUME_TRUE */
+      _gnutls_cpy_write_security_parameters (&session->
+                                             security_parameters,
+                                             &session->
+                                             internals.
+                                             resumed_security_parameters);
+    }
+
+  rc = _gnutls_set_write_keys (session);
+  if (rc < 0)
+    return rc;
+
+  _gnutls_handshake_log ("HSK[%x]: Cipher Suite: %s\n", session,
+                         _gnutls_cipher_suite_get_name (&session->
+                                                        security_parameters.
+                                                        current_cipher_suite));
+
+  if (_gnutls_compression_is_ok
+      (session->security_parameters.write_compression_algorithm) != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM;
+    }
+
+  if (_gnutls_mac_is_ok
+      (session->security_parameters.write_mac_algorithm) != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+
+
+  /* Free all the previous keys/ sessions etc.
+   */
+  if (session->connection_state.write_mac_secret.data != NULL)
+    _gnutls_free_datum (&session->connection_state.write_mac_secret);
+
+  if (session->connection_state.write_cipher_state != NULL)
+    _gnutls_cipher_deinit (session->connection_state.write_cipher_state);
+
+  if (session->connection_state.write_compression_state != NULL)
+    _gnutls_comp_deinit (session->connection_state.
+                         write_compression_state, 0);
+
+  mac_size =
+    _gnutls_hash_get_algo_len (session->security_parameters.
+                               write_mac_algorithm);
+
+  _gnutls_handshake_log
+    ("HSK[%x]: Initializing internal [write] cipher sessions\n", session);
+
+  switch (session->security_parameters.entity)
+    {
+    case GNUTLS_SERVER:
+      /* initialize cipher session
+       */
+      session->connection_state.write_cipher_state =
+        _gnutls_cipher_init (session->security_parameters.
+                             write_bulk_cipher_algorithm,
+                             &session->cipher_specs.
+                             server_write_key,
+                             &session->cipher_specs.server_write_IV);
+
+      if (session->connection_state.write_cipher_state ==
+          GNUTLS_CIPHER_FAILED
+          && session->security_parameters.
+          write_bulk_cipher_algorithm != GNUTLS_CIPHER_NULL)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_INTERNAL_ERROR;
+        }
+
+
+      /* copy mac secrets from cipherspecs, to connection
+       * session.
+       */
+      if (mac_size > 0)
+        {
+          if (_gnutls_sset_datum (&session->connection_state.
+                                  write_mac_secret,
+                                  session->cipher_specs.
+                                  server_write_mac_secret.data,
+                                  session->cipher_specs.
+                                  server_write_mac_secret.size) < 0)
+            {
+              gnutls_assert ();
+              return GNUTLS_E_MEMORY_ERROR;
+            }
+
+        }
+
+
+      break;
+
+    case GNUTLS_CLIENT:
+      session->connection_state.write_cipher_state =
+        _gnutls_cipher_init (session->security_parameters.
+                             write_bulk_cipher_algorithm,
+                             &session->cipher_specs.
+                             client_write_key,
+                             &session->cipher_specs.client_write_IV);
+
+      if (session->connection_state.write_cipher_state ==
+          GNUTLS_CIPHER_FAILED
+          && session->security_parameters.
+          write_bulk_cipher_algorithm != GNUTLS_CIPHER_NULL)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_INTERNAL_ERROR;
+        }
+
+      /* copy mac secret to connection session
+       */
+      if (mac_size > 0)
+        {
+          if (_gnutls_sset_datum (&session->connection_state.
+                                  write_mac_secret,
+                                  session->cipher_specs.
+                                  client_write_mac_secret.data,
+                                  session->cipher_specs.
+                                  client_write_mac_secret.size) < 0)
+            {
+              gnutls_assert ();
+              return GNUTLS_E_MEMORY_ERROR;
+            }
+        }
+
+      break;
+
+    default:
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+
+  session->connection_state.write_compression_state =
+    _gnutls_comp_init (session->security_parameters.
+                       write_compression_algorithm, 0);
+
+  if (session->connection_state.write_compression_state == GNUTLS_COMP_FAILED)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM;
+    }
+
+  return 0;
+}
+
+/* Sets the specified cipher into the pending session 
+ */
+int
+_gnutls_set_read_cipher (gnutls_session_t session,
+                         gnutls_cipher_algorithm_t algo)
+{
+
+  if (_gnutls_cipher_is_ok (algo) == 0)
+    {
+      if (_gnutls_cipher_priority (session, algo) < 0)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_UNWANTED_ALGORITHM;
+        }
+
+      session->security_parameters.read_bulk_cipher_algorithm = algo;
+
+    }
+  else
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  return 0;
+
+}
+
+int
+_gnutls_set_write_cipher (gnutls_session_t session,
+                          gnutls_cipher_algorithm_t algo)
+{
+
+  if (_gnutls_cipher_is_ok (algo) == 0)
+    {
+      if (_gnutls_cipher_priority (session, algo) < 0)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_UNWANTED_ALGORITHM;
+        }
+
+      session->security_parameters.write_bulk_cipher_algorithm = algo;
+
+    }
+  else
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  return 0;
+
+}
+
+
+/* Sets the specified algorithm into pending compression session 
+ */
+int
+_gnutls_set_read_compression (gnutls_session_t session,
+                              gnutls_compression_method_t algo)
+{
+
+  if (_gnutls_compression_is_ok (algo) == 0)
+    {
+      session->security_parameters.read_compression_algorithm = algo;
+    }
+  else
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM;
+    }
+  return 0;
+
+}
+
+int
+_gnutls_set_write_compression (gnutls_session_t session,
+                               gnutls_compression_method_t algo)
+{
+
+  if (_gnutls_compression_is_ok (algo) == 0)
+    {
+      session->security_parameters.write_compression_algorithm = algo;
+    }
+  else
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM;
+    }
+  return 0;
+
+}
+
+/* Sets the specified kx algorithm into pending session 
+ */
+int
+_gnutls_set_kx (gnutls_session_t session, gnutls_kx_algorithm_t algo)
+{
+
+  if (_gnutls_kx_is_ok (algo) == 0)
+    {
+      session->security_parameters.kx_algorithm = algo;
+    }
+  else
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+  if (_gnutls_kx_priority (session, algo) < 0)
+    {
+      gnutls_assert ();
+      /* we shouldn't get here */
+      return GNUTLS_E_UNWANTED_ALGORITHM;
+    }
+
+  return 0;
+
+}
+
+/* Sets the specified mac algorithm into pending session */
+int
+_gnutls_set_read_mac (gnutls_session_t session, gnutls_mac_algorithm_t algo)
+{
+
+  if (_gnutls_mac_is_ok (algo) == 0)
+    {
+      session->security_parameters.read_mac_algorithm = algo;
+    }
+  else
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+  if (_gnutls_mac_priority (session, algo) < 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNWANTED_ALGORITHM;
+    }
+
+
+  return 0;
+
+}
+
+int
+_gnutls_set_write_mac (gnutls_session_t session, gnutls_mac_algorithm_t algo)
+{
+
+  if (_gnutls_mac_is_ok (algo) == 0)
+    {
+      session->security_parameters.write_mac_algorithm = algo;
+    }
+  else
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+  if (_gnutls_mac_priority (session, algo) < 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNWANTED_ALGORITHM;
+    }
+
+
+  return 0;
+
+}
diff --git a/src/daemon/https/tls/gnutls_constate.h b/src/daemon/https/tls/gnutls_constate.h
new file mode 100644
index 00000000..f58c8b14
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_constate.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+int _gnutls_connection_state_init (gnutls_session_t session);
+int _gnutls_read_connection_state_init (gnutls_session_t session);
+int _gnutls_write_connection_state_init (gnutls_session_t session);
+int _gnutls_set_write_cipher (gnutls_session_t session,
+                              gnutls_cipher_algorithm_t algo);
+int _gnutls_set_write_mac (gnutls_session_t session,
+                           gnutls_mac_algorithm_t algo);
+int _gnutls_set_read_cipher (gnutls_session_t session,
+                             gnutls_cipher_algorithm_t algo);
+int _gnutls_set_read_mac (gnutls_session_t session,
+                          gnutls_mac_algorithm_t algo);
+int _gnutls_set_read_compression (gnutls_session_t session,
+                                  gnutls_compression_method_t algo);
+int _gnutls_set_write_compression (gnutls_session_t session,
+                                   gnutls_compression_method_t algo);
+int _gnutls_set_kx (gnutls_session_t session, gnutls_kx_algorithm_t algo);
diff --git a/src/daemon/https/tls/gnutls_datum.c b/src/daemon/https/tls/gnutls_datum.c
new file mode 100644
index 00000000..4b2eb1f4
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_datum.c
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2001, 2002, 2003, 2004, 2005, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* contains functions that make it easier to
+ * write vectors of <size|data>. The destination size
+ * should be preallocated (datum.size+(bits/8))
+ */
+
+#include <gnutls_int.h>
+#include <gnutls_num.h>
+#include <gnutls_datum.h>
+#include <gnutls_errors.h>
+
+
+void
+_gnutls_write_datum16 (opaque * dest, gnutls_datum_t dat)
+{
+  _gnutls_write_uint16 (dat.size, dest);
+  if (dat.data != NULL)
+    memcpy (&dest[2], dat.data, dat.size);
+}
+
+void
+_gnutls_write_datum24 (opaque * dest, gnutls_datum_t dat)
+{
+  _gnutls_write_uint24 (dat.size, dest);
+  if (dat.data != NULL)
+    memcpy (&dest[3], dat.data, dat.size);
+}
+
+void
+_gnutls_write_datum32 (opaque * dest, gnutls_datum_t dat)
+{
+  _gnutls_write_uint32 (dat.size, dest);
+  if (dat.data != NULL)
+    memcpy (&dest[4], dat.data, dat.size);
+}
+
+void
+_gnutls_write_datum8 (opaque * dest, gnutls_datum_t dat)
+{
+  dest[0] = (uint8_t) dat.size;
+  if (dat.data != NULL)
+    memcpy (&dest[1], dat.data, dat.size);
+}
+
+
+int
+_gnutls_set_datum_m (gnutls_datum_t * dat, const void *data,
+                     size_t data_size, gnutls_alloc_function galloc_func)
+{
+  if (data_size == 0 || data == NULL)
+    {
+      dat->data = NULL;
+      dat->size = 0;
+      return 0;
+    }
+
+  dat->data = galloc_func (data_size);
+  if (dat->data == NULL)
+    return GNUTLS_E_MEMORY_ERROR;
+
+  dat->size = data_size;
+  memcpy (dat->data, data, data_size);
+
+  return 0;
+}
+
+int
+_gnutls_datum_append_m (gnutls_datum_t * dst, const void *data,
+                        size_t data_size,
+                        gnutls_realloc_function grealloc_func)
+{
+
+  dst->data = grealloc_func (dst->data, data_size + dst->size);
+  if (dst->data == NULL)
+    return GNUTLS_E_MEMORY_ERROR;
+
+  memcpy (&dst->data[dst->size], data, data_size);
+  dst->size += data_size;
+
+  return 0;
+}
+
+void
+_gnutls_free_datum_m (gnutls_datum_t * dat, gnutls_free_function gfree_func)
+{
+  if (dat->data != NULL)
+    gfree_func (dat->data);
+
+  dat->data = NULL;
+  dat->size = 0;
+}
diff --git a/src/daemon/https/tls/gnutls_datum.h b/src/daemon/https/tls/gnutls_datum.h
new file mode 100644
index 00000000..0f609531
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_datum.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+void _gnutls_write_datum16 (opaque * dest, gnutls_datum_t dat);
+void _gnutls_write_datum24 (opaque * dest, gnutls_datum_t dat);
+void _gnutls_write_datum32 (opaque * dest, gnutls_datum_t dat);
+void _gnutls_write_datum8 (opaque * dest, gnutls_datum_t dat);
+
+int _gnutls_set_datum_m (gnutls_datum_t * dat, const void *data,
+                         size_t data_size, gnutls_alloc_function);
+#define _gnutls_set_datum( x, y, z) _gnutls_set_datum_m(x,y,z, gnutls_malloc)
+#define _gnutls_sset_datum( x, y, z) _gnutls_set_datum_m(x,y,z, gnutls_secure_malloc)
+
+int _gnutls_datum_append_m (gnutls_datum_t * dat, const void *data,
+                            size_t data_size, gnutls_realloc_function);
+#define _gnutls_datum_append(x,y,z) _gnutls_datum_append_m(x,y,z, gnutls_realloc)
+
+void _gnutls_free_datum_m (gnutls_datum_t * dat, gnutls_free_function);
+#define _gnutls_free_datum(x) _gnutls_free_datum_m(x, gnutls_free)
diff --git a/src/daemon/https/tls/gnutls_db.c b/src/daemon/https/tls/gnutls_db.c
new file mode 100644
index 00000000..701be2f0
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_db.c
@@ -0,0 +1,386 @@
+/*
+ * Copyright (C) 2000, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* This file contains functions that manipulate a database backend
+ * for resumed sessions. 
+ */
+
+#include "gnutls_int.h"
+#include "gnutls_errors.h"
+#include "gnutls_session.h"
+#include <gnutls_db.h>
+#include "debug.h"
+#include <gnutls_session_pack.h>
+#include <gnutls_datum.h>
+
+/**
+  * gnutls_db_set_retrieve_function - Sets the function that will be used to get data
+  * @session: is a #gnutls_session_t structure.
+  * @retr_func: is the function.
+  *
+  * Sets the function that will be used to retrieve data from the resumed
+  * sessions database. This function must return a gnutls_datum_t containing the
+  * data on success, or a gnutls_datum_t containing null and 0 on failure.
+  *
+  * The datum's data must be allocated using the function
+  * gnutls_malloc().
+  *
+  * The first argument to retr_func() will be null unless gnutls_db_set_ptr() 
+  * has been called.
+  *
+  **/
+void
+gnutls_db_set_retrieve_function (gnutls_session_t session,
+                                 gnutls_db_retr_func retr_func)
+{
+  session->internals.db_retrieve_func = retr_func;
+}
+
+/**
+  * gnutls_db_set_remove_function - Sets the function that will be used to remove data
+  * @session: is a #gnutls_session_t structure.
+  * @rem_func: is the function.
+  *
+  * Sets the function that will be used to remove data from the resumed
+  * sessions database. This function must return 0 on success.
+  *
+  * The first argument to rem_func() will be null unless gnutls_db_set_ptr() 
+  * has been called.
+  *
+  **/
+void
+gnutls_db_set_remove_function (gnutls_session_t session,
+                               gnutls_db_remove_func rem_func)
+{
+  session->internals.db_remove_func = rem_func;
+}
+
+/**
+  * gnutls_db_set_store_function - Sets the function that will be used to put data
+  * @session: is a #gnutls_session_t structure.
+  * @store_func: is the function
+  *
+  * Sets the function that will be used to store data from the resumed
+  * sessions database. This function must remove 0 on success. 
+  *
+  * The first argument to store_func() will be null unless gnutls_db_set_ptr() 
+  * has been called.
+  *
+  **/
+void
+gnutls_db_set_store_function (gnutls_session_t session,
+                              gnutls_db_store_func store_func)
+{
+  session->internals.db_store_func = store_func;
+}
+
+/**
+  * gnutls_db_set_ptr - Sets a pointer to be sent to db functions
+  * @session: is a #gnutls_session_t structure.
+  * @ptr: is the pointer
+  *
+  * Sets the pointer that will be provided to db store, retrieve and delete functions, as
+  * the first argument. 
+  *
+  **/
+void
+gnutls_db_set_ptr (gnutls_session_t session, void *ptr)
+{
+  session->internals.db_ptr = ptr;
+}
+
+/**
+  * gnutls_db_get_ptr - Returns the pointer which is sent to db functions
+  * @session: is a #gnutls_session_t structure.
+  *
+  * Returns the pointer that will be sent to db store, retrieve and delete functions, as
+  * the first argument. 
+  *
+  **/
+void *
+gnutls_db_get_ptr (gnutls_session_t session)
+{
+  return session->internals.db_ptr;
+}
+
+/**
+  * gnutls_db_set_cache_expiration - Sets the expiration time for resumed sessions.
+  * @session: is a #gnutls_session_t structure.
+  * @seconds: is the number of seconds.
+  *
+  * Sets the expiration time for resumed sessions. The default is 3600 (one hour)
+  * at the time writing this.
+  **/
+void
+gnutls_db_set_cache_expiration (gnutls_session_t session, int seconds)
+{
+  session->internals.expire_time = seconds;
+}
+
+/**
+  * gnutls_db_check_entry - checks if the given db entry has expired
+  * @session: is a #gnutls_session_t structure.
+  * @session_entry: is the session data (not key)
+  *
+  * This function returns GNUTLS_E_EXPIRED, if the database entry
+  * has expired or 0 otherwise. This function is to be used when
+  * you want to clear unnesessary session which occupy space in your
+  * backend.
+  *
+  **/
+int
+gnutls_db_check_entry (gnutls_session_t session, gnutls_datum_t session_entry)
+{
+  time_t timestamp;
+
+  timestamp = time (0);
+
+  if (session_entry.data != NULL)
+    if (timestamp -
+        ((security_parameters_st *) (session_entry.data))->timestamp <=
+        session->internals.expire_time
+        || ((security_parameters_st *) (session_entry.data))->
+        timestamp > timestamp
+        || ((security_parameters_st *) (session_entry.data))->timestamp == 0)
+      return GNUTLS_E_EXPIRED;
+
+  return 0;
+}
+
+/* The format of storing data is:
+ * (forget it). Check gnutls_session_pack.c
+ */
+int
+_gnutls_server_register_current_session (gnutls_session_t session)
+{
+  gnutls_datum_t key;
+  gnutls_datum_t content;
+  int ret = 0;
+
+  key.data = session->security_parameters.session_id;
+  key.size = session->security_parameters.session_id_size;
+
+  if (session->internals.resumable == RESUME_FALSE)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_SESSION;
+    }
+
+  if (session->security_parameters.session_id == NULL
+      || session->security_parameters.session_id_size == 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_SESSION;
+    }
+
+/* copy data */
+  ret = _gnutls_session_pack (session, &content);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  ret = _gnutls_store_session (session, key, content);
+  _gnutls_free_datum (&content);
+
+  return ret;
+}
+
+/* Checks if both db_store and db_retrieve functions have
+ * been set up.
+ */
+static int
+_gnutls_db_func_is_ok (gnutls_session_t session)
+{
+  if (session->internals.db_store_func != NULL &&
+      session->internals.db_retrieve_func != NULL &&
+      session->internals.db_remove_func != NULL)
+    return 0;
+  else
+    return GNUTLS_E_DB_ERROR;
+}
+
+
+int
+_gnutls_server_restore_session (gnutls_session_t session,
+                                uint8_t * session_id, int session_id_size)
+{
+  gnutls_datum_t data;
+  gnutls_datum_t key;
+  int ret;
+
+  key.data = session_id;
+  key.size = session_id_size;
+
+  if (_gnutls_db_func_is_ok (session) != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_SESSION;
+    }
+
+  data = _gnutls_retrieve_session (session, key);
+
+  if (data.data == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_SESSION;
+    }
+
+  /* expiration check is performed inside */
+  ret = gnutls_session_set_data (session, data.data, data.size);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  gnutls_free (data.data);
+
+  return 0;
+}
+
+int
+_gnutls_db_remove_session (gnutls_session_t session, uint8_t * session_id,
+                           int session_id_size)
+{
+  gnutls_datum_t key;
+
+  key.data = session_id;
+  key.size = session_id_size;
+
+  return _gnutls_remove_session (session, key);
+}
+
+
+/* Stores session data to the db backend.
+ */
+int
+_gnutls_store_session (gnutls_session_t session,
+                       gnutls_datum_t session_id, gnutls_datum_t session_data)
+{
+  int ret = 0;
+
+  if (session->internals.resumable == RESUME_FALSE)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_SESSION;
+    }
+
+  if (_gnutls_db_func_is_ok (session) != 0)
+    {
+      return GNUTLS_E_DB_ERROR;
+    }
+
+  if (session_id.data == NULL || session_id.size == 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_SESSION;
+    }
+
+  if (session_data.data == NULL || session_data.size == 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_SESSION;
+    }
+  /* if we can't read why bother writing? */
+
+  if (session->internals.db_store_func != NULL)
+    ret =
+      session->internals.db_store_func (session->internals.db_ptr,
+                                        session_id, session_data);
+
+  return (ret == 0 ? ret : GNUTLS_E_DB_ERROR);
+
+}
+
+/* Retrieves session data from the db backend.
+ */
+gnutls_datum_t
+_gnutls_retrieve_session (gnutls_session_t session, gnutls_datum_t session_id)
+{
+  gnutls_datum_t ret = { NULL, 0 };
+
+  if (session_id.data == NULL || session_id.size == 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  if (session->internals.db_retrieve_func != NULL)
+    ret =
+      session->internals.db_retrieve_func (session->internals.db_ptr,
+                                           session_id);
+
+  return ret;
+
+}
+
+/* Removes session data from the db backend.
+ */
+int
+_gnutls_remove_session (gnutls_session_t session, gnutls_datum_t session_id)
+{
+  int ret = 0;
+
+  if (_gnutls_db_func_is_ok (session) != 0)
+    {
+      return GNUTLS_E_DB_ERROR;
+    }
+
+  if (session_id.data == NULL || session_id.size == 0)
+    return GNUTLS_E_INVALID_SESSION;
+
+  /* if we can't read why bother writing? */
+  if (session->internals.db_remove_func != NULL)
+    ret =
+      session->internals.db_remove_func (session->internals.db_ptr,
+                                         session_id);
+
+  return (ret == 0 ? ret : GNUTLS_E_DB_ERROR);
+
+}
+
+/**
+  * gnutls_db_remove_session - This function will remove the current session data from the database
+  * @session: is a #gnutls_session_t structure.
+  *
+  * This function will remove the current session data from the session
+  * database. This will prevent future handshakes reusing these session
+  * data. This function should be called if a session was terminated
+  * abnormally, and before gnutls_deinit() is called.
+  *
+  * Normally gnutls_deinit() will remove abnormally terminated sessions.
+  *
+  **/
+void
+gnutls_db_remove_session (gnutls_session_t session)
+{
+  /* if the session has failed abnormally it has 
+   * to be removed from the db 
+   */
+  _gnutls_db_remove_session (session,
+                             session->security_parameters.session_id,
+                             session->security_parameters.session_id_size);
+}
diff --git a/src/daemon/https/tls/gnutls_db.h b/src/daemon/https/tls/gnutls_db.h
new file mode 100644
index 00000000..9adece4e
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_db.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+int _gnutls_server_register_current_session (gnutls_session_t session);
+int _gnutls_server_restore_session (gnutls_session_t session,
+                                    uint8_t * session_id,
+                                    int session_id_size);
+int _gnutls_db_remove_session (gnutls_session_t session, uint8_t * session_id,
+                               int session_id_size);
+int _gnutls_store_session (gnutls_session_t session,
+                           gnutls_datum_t session_id,
+                           gnutls_datum_t session_data);
+gnutls_datum_t _gnutls_retrieve_session (gnutls_session_t session,
+                                         gnutls_datum_t session_id);
+int _gnutls_remove_session (gnutls_session_t session,
+                            gnutls_datum_t session_id);
diff --git a/src/daemon/https/tls/gnutls_dh.c b/src/daemon/https/tls/gnutls_dh.c
new file mode 100644
index 00000000..19322c73
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_dh.c
@@ -0,0 +1,162 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include <gnutls_int.h>
+#include <gnutls_errors.h>
+
+
+/* 
+        --Example-- 
+        you: X = g ^ x mod p;
+        peer:Y = g ^ y mod p;
+
+        your_key = Y ^ x mod p;
+        his_key  = X ^ y mod p;
+
+//      generate our secret and the public value (X) for it
+        X = gnutls_calc_dh_secret(&x, g, p);
+//      now we can calculate the shared secret
+        key = gnutls_calc_dh_key(Y, x, g, p);
+        _gnutls_mpi_release(x);
+        _gnutls_mpi_release(g);
+*/
+
+#define MAX_BITS 18000
+
+/* returns the public value (X), and the secret (ret_x).
+ */
+mpi_t
+gnutls_calc_dh_secret (mpi_t * ret_x, mpi_t g, mpi_t prime)
+{
+  mpi_t e, x;
+  int x_size = _gnutls_mpi_get_nbits (prime) - 1;
+  /* The size of the secret key is less than
+   * prime/2
+   */
+
+  if (x_size > MAX_BITS || x_size <= 0)
+    {
+      gnutls_assert ();
+      return NULL;
+    }
+
+  x = _gnutls_mpi_new (x_size);
+  if (x == NULL)
+    {
+      gnutls_assert ();
+      if (ret_x)
+        *ret_x = NULL;
+
+      return NULL;
+    }
+
+  /* FIXME: (x_size/8)*8 is there to overcome a bug in libgcrypt
+   * which does not really check the bits given but the bytes.
+   */
+  do
+    {
+      _gnutls_mpi_randomize (x, (x_size / 8) * 8, GCRY_STRONG_RANDOM);
+      /* Check whether x is zero. 
+       */
+    }
+  while (_gnutls_mpi_cmp_ui (x, 0) == 0);
+
+  e = _gnutls_mpi_alloc_like (prime);
+  if (e == NULL)
+    {
+      gnutls_assert ();
+      if (ret_x)
+        *ret_x = NULL;
+
+      _gnutls_mpi_release (&x);
+      return NULL;
+    }
+
+  _gnutls_mpi_powm (e, g, x, prime);
+
+  if (ret_x)
+    *ret_x = x;
+  else
+    _gnutls_mpi_release (&x);
+  return e;
+}
+
+
+mpi_t
+gnutls_calc_dh_key (mpi_t f, mpi_t x, mpi_t prime)
+{
+  mpi_t k;
+  int bits;
+
+  bits = _gnutls_mpi_get_nbits (prime);
+  if (bits <= 0 || bits > MAX_BITS)
+    {
+      gnutls_assert ();
+      return NULL;
+    }
+
+  k = _gnutls_mpi_alloc_like (prime);
+  if (k == NULL)
+    return NULL;
+  _gnutls_mpi_powm (k, f, x, prime);
+  return k;
+}
+
+/*-
+  * _gnutls_get_dh_params - Returns the DH parameters pointer
+  * @dh_params: is an DH parameters structure, or NULL.
+  * @func: is a callback function to receive the parameters or NULL.
+  * @session: a gnutls session.
+  *
+  * This function will return the dh parameters pointer.
+  *
+  -*/
+gnutls_dh_params_t
+_gnutls_get_dh_params (gnutls_dh_params_t dh_params,
+                       gnutls_params_function * func,
+                       gnutls_session_t session)
+{
+  gnutls_params_st params;
+  int ret;
+
+  /* if cached return the cached */
+  if (session->internals.params.dh_params)
+    return session->internals.params.dh_params;
+
+  if (dh_params)
+    {
+      session->internals.params.dh_params = dh_params;
+    }
+  else if (func)
+    {
+      ret = func (session, GNUTLS_PARAMS_DH, &params);
+      if (ret == 0 && params.type == GNUTLS_PARAMS_DH)
+        {
+          session->internals.params.dh_params = params.params.dh;
+          session->internals.params.free_dh_params = params.deinit;
+        }
+    }
+
+  return session->internals.params.dh_params;
+}
diff --git a/src/daemon/https/tls/gnutls_dh.h b/src/daemon/https/tls/gnutls_dh.h
new file mode 100644
index 00000000..dc8a129d
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_dh.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#ifndef GNUTLS_DH_H
+# define GNUTLS_DH_H
+
+const mpi_t *_gnutls_dh_params_to_mpi (gnutls_dh_params_t);
+mpi_t gnutls_calc_dh_secret (mpi_t * ret_x, mpi_t g, mpi_t prime);
+mpi_t gnutls_calc_dh_key (mpi_t f, mpi_t x, mpi_t prime);
+int _gnutls_dh_generate_prime (mpi_t * ret_g, mpi_t * ret_n, unsigned bits);
+
+gnutls_dh_params_t
+_gnutls_get_dh_params (gnutls_dh_params_t dh_params,
+                       gnutls_params_function * func,
+                       gnutls_session_t session);
+
+#endif
diff --git a/src/daemon/https/tls/gnutls_dh_primes.c b/src/daemon/https/tls/gnutls_dh_primes.c
new file mode 100644
index 00000000..0aea5b5f
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_dh_primes.c
@@ -0,0 +1,626 @@
+/*
+ * Copyright (C) 2000, 2001, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include <gnutls_int.h>
+#include <gnutls_errors.h>
+#include <gnutls_datum.h>
+#include <x509_b64.h>           /* for PKCS3 PEM decoding */
+#include <gnutls_global.h>
+#include <gnutls_dh.h>
+#include "debug.h"
+/* x509 */
+#include "mpi.h"
+
+
+/* returns the prime and the generator of DH params.
+ */
+const mpi_t *
+_gnutls_dh_params_to_mpi (gnutls_dh_params_t dh_primes)
+{
+  if (dh_primes == NULL || dh_primes->params[1] == NULL
+      || dh_primes->params[0] == NULL)
+    {
+      return NULL;
+    }
+
+  return dh_primes->params;
+}
+
+int
+_gnutls_dh_generate_prime (mpi_t * ret_g, mpi_t * ret_n, unsigned int bits)
+{
+  mpi_t g = NULL, prime = NULL;
+  gcry_error_t err;
+  int result, times = 0, qbits;
+  mpi_t *factors = NULL;
+
+  /* Calculate the size of a prime factor of (prime-1)/2.
+   * This is an emulation of the values in "Selecting Cryptographic Key Sizes" paper.
+   */
+  if (bits < 256)
+    qbits = bits / 2;
+  else
+    {
+      qbits = (bits / 40) + 105;
+    }
+
+  if (qbits & 1)                /* better have an even number */
+    qbits++;
+
+  /* find a prime number of size bits.
+   */
+  do
+    {
+
+      if (times)
+        {
+          _gnutls_mpi_release (&prime);
+          gcry_prime_release_factors (factors);
+        }
+
+      err = gcry_prime_generate (&prime, bits, qbits, &factors, NULL, NULL,
+                                 GCRY_STRONG_RANDOM,
+                                 GCRY_PRIME_FLAG_SPECIAL_FACTOR);
+
+      if (err != 0)
+        {
+          gnutls_assert ();
+          result = GNUTLS_E_INTERNAL_ERROR;
+          goto cleanup;
+        }
+
+      err = gcry_prime_check (prime, 0);
+
+      times++;
+    }
+  while (err != 0 && times < 10);
+
+  if (err != 0)
+    {
+      gnutls_assert ();
+      result = GNUTLS_E_INTERNAL_ERROR;
+      goto cleanup;
+    }
+
+  /* generate the group generator.
+   */
+  err = gcry_prime_group_generator (&g, prime, factors, NULL);
+  if (err != 0)
+    {
+      gnutls_assert ();
+      result = GNUTLS_E_INTERNAL_ERROR;
+      goto cleanup;
+    }
+
+  gcry_prime_release_factors (factors);
+  factors = NULL;
+
+  if (ret_g)
+    *ret_g = g;
+  else
+    _gnutls_mpi_release (&g);
+  if (ret_n)
+    *ret_n = prime;
+  else
+    _gnutls_mpi_release (&prime);
+
+  return 0;
+
+cleanup:gcry_prime_release_factors (factors);
+  _gnutls_mpi_release (&g);
+  _gnutls_mpi_release (&prime);
+
+  return result;
+
+}
+
+/* Replaces the prime in the static DH parameters, with a randomly
+ * generated one.
+ */
+/**
+ * gnutls_dh_params_import_raw - This function will import DH parameters
+ * @dh_params: Is a structure that will hold the prime numbers
+ * @prime: holds the new prime
+ * @generator: holds the new generator
+ *
+ * This function will replace the pair of prime and generator for use in
+ * the Diffie-Hellman key exchange. The new parameters should be stored in the
+ * appropriate gnutls_datum.
+ *
+ **/
+int
+gnutls_dh_params_import_raw (gnutls_dh_params_t dh_params,
+                             const gnutls_datum_t * prime,
+                             const gnutls_datum_t * generator)
+{
+  mpi_t tmp_prime, tmp_g;
+  size_t siz;
+
+  siz = prime->size;
+  if (_gnutls_mpi_scan_nz (&tmp_prime, prime->data, &siz))
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MPI_SCAN_FAILED;
+    }
+
+  siz = generator->size;
+  if (_gnutls_mpi_scan_nz (&tmp_g, generator->data, &siz))
+    {
+      _gnutls_mpi_release (&tmp_prime);
+      gnutls_assert ();
+      return GNUTLS_E_MPI_SCAN_FAILED;
+    }
+
+  /* store the generated values
+   */
+  dh_params->params[0] = tmp_prime;
+  dh_params->params[1] = tmp_g;
+
+  return 0;
+
+}
+
+/**
+ * gnutls_dh_params_init - This function will initialize the DH parameters
+ * @dh_params: Is a structure that will hold the prime numbers
+ *
+ * This function will initialize the DH parameters structure.
+ *
+ **/
+int
+gnutls_dh_params_init (gnutls_dh_params_t * dh_params)
+{
+
+  (*dh_params) = gnutls_calloc (1, sizeof (dh_params_st));
+  if (*dh_params == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  return 0;
+
+}
+
+/**
+ * gnutls_dh_params_deinit - This function will deinitialize the DH parameters
+ * @dh_params: Is a structure that holds the prime numbers
+ *
+ * This function will deinitialize the DH parameters structure.
+ *
+ **/
+void
+gnutls_dh_params_deinit (gnutls_dh_params_t dh_params)
+{
+  if (dh_params == NULL)
+    return;
+
+  _gnutls_mpi_release (&dh_params->params[0]);
+  _gnutls_mpi_release (&dh_params->params[1]);
+
+  gnutls_free (dh_params);
+
+}
+
+/**
+ * gnutls_dh_params_cpy - This function will copy a DH parameters structure
+ * @dst: Is the destination structure, which should be initialized.
+ * @src: Is the source structure
+ *
+ * This function will copy the DH parameters structure from source
+ * to destination.
+ *
+ **/
+int
+gnutls_dh_params_cpy (gnutls_dh_params_t dst, gnutls_dh_params_t src)
+{
+  if (src == NULL)
+    return GNUTLS_E_INVALID_REQUEST;
+
+  dst->params[0] = _gnutls_mpi_copy (src->params[0]);
+  dst->params[1] = _gnutls_mpi_copy (src->params[1]);
+
+  if (dst->params[0] == NULL || dst->params[1] == NULL)
+    return GNUTLS_E_MEMORY_ERROR;
+
+  return 0;
+}
+
+/**
+ * gnutls_dh_params_generate2 - This function will generate new DH parameters
+ * @params: Is the structure that the DH parameters will be stored
+ * @bits: is the prime's number of bits
+ *
+ * This function will generate a new pair of prime and generator for use in 
+ * the Diffie-Hellman key exchange. The new parameters will be allocated using
+ * gnutls_malloc() and will be stored in the appropriate datum.
+ * This function is normally slow. 
+ * 
+ * Note that the bits value should be one of 768, 1024, 2048, 3072 or 4096.
+ * Also note that the DH parameters are only useful to servers.
+ * Since clients use the parameters sent by the server, it's of
+ * no use to call this in client side.
+ *
+ **/
+int
+gnutls_dh_params_generate2 (gnutls_dh_params_t params, unsigned int bits)
+{
+  int ret;
+
+  ret =
+    _gnutls_dh_generate_prime (&params->params[1], &params->params[0], bits);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return 0;
+}
+
+/**
+ * gnutls_dh_params_import_pkcs3 - This function will import DH params from a pkcs3 structure
+ * @params: A structure where the parameters will be copied to
+ * @pkcs3_params: should contain a PKCS3 DHParams structure PEM or DER encoded
+ * @format: the format of params. PEM or DER.
+ *
+ * This function will extract the DHParams found in a PKCS3 formatted
+ * structure. This is the format generated by "openssl dhparam" tool.
+ *
+ * If the structure is PEM encoded, it should have a header
+ * of "BEGIN DH PARAMETERS".
+ *
+ * In case of failure a negative value will be returned, and
+ * 0 on success.
+ *
+ **/
+int
+gnutls_dh_params_import_pkcs3 (gnutls_dh_params_t params,
+                               const gnutls_datum_t * pkcs3_params,
+                               gnutls_x509_crt_fmt_t format)
+{
+  ASN1_TYPE c2;
+  int result, need_free = 0;
+  gnutls_datum_t _params;
+
+  if (format == GNUTLS_X509_FMT_PEM)
+    {
+      opaque *out;
+
+      result = _gnutls_fbase64_decode ("DH PARAMETERS", pkcs3_params->data,
+                                       pkcs3_params->size, &out);
+
+      if (result <= 0)
+        {
+          if (result == 0)
+            result = GNUTLS_E_INTERNAL_ERROR;
+          gnutls_assert ();
+          return result;
+        }
+
+      _params.data = out;
+      _params.size = result;
+
+      need_free = 1;
+
+    }
+  else
+    {
+      _params.data = pkcs3_params->data;
+      _params.size = pkcs3_params->size;
+    }
+
+  if ((result =
+       asn1_create_element (_gnutls_get_gnutls_asn (), "GNUTLS.DHParameter",
+                            &c2)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      if (need_free != 0)
+        {
+          gnutls_free (_params.data);
+          _params.data = NULL;
+        }
+      return _gnutls_asn2err (result);
+    }
+
+  result = asn1_der_decoding (&c2, _params.data, _params.size, NULL);
+
+  if (need_free != 0)
+    {
+      gnutls_free (_params.data);
+      _params.data = NULL;
+    }
+
+  if (result != ASN1_SUCCESS)
+    {
+      /* couldn't decode DER */
+
+      _gnutls_x509_log ("DHParams: Decoding error %d\n", result);
+      gnutls_assert ();
+      asn1_delete_structure (&c2);
+      return _gnutls_asn2err (result);
+    }
+
+  /* Read PRIME 
+   */
+  result = _gnutls_x509_read_int (c2, "prime", &params->params[0]);
+  if (result < 0)
+    {
+      asn1_delete_structure (&c2);
+      gnutls_assert ();
+      return result;
+    }
+
+  /* read the generator
+   */
+  result = _gnutls_x509_read_int (c2, "base", &params->params[1]);
+  if (result < 0)
+    {
+      asn1_delete_structure (&c2);
+      _gnutls_mpi_release (&params->params[0]);
+      gnutls_assert ();
+      return result;
+    }
+
+  asn1_delete_structure (&c2);
+
+  return 0;
+}
+
+/**
+ * gnutls_dh_params_export_pkcs3 - This function will export DH params to a pkcs3 structure
+ * @params: Holds the DH parameters
+ * @format: the format of output params. One of PEM or DER.
+ * @params_data: will contain a PKCS3 DHParams structure PEM or DER encoded
+ * @params_data_size: holds the size of params_data (and will be replaced by the actual size of parameters)
+ *
+ * This function will export the given dh parameters to a PKCS3
+ * DHParams structure. This is the format generated by "openssl dhparam" tool.
+ * If the buffer provided is not long enough to hold the output, then
+ * GNUTLS_E_SHORT_MEMORY_BUFFER will be returned.
+ *
+ * If the structure is PEM encoded, it will have a header
+ * of "BEGIN DH PARAMETERS".
+ *
+ * In case of failure a negative value will be returned, and
+ * 0 on success.
+ *
+ **/
+int
+gnutls_dh_params_export_pkcs3 (gnutls_dh_params_t params,
+                               gnutls_x509_crt_fmt_t format,
+                               unsigned char *params_data,
+                               size_t * params_data_size)
+{
+  ASN1_TYPE c2;
+  int result, _params_data_size;
+  size_t g_size, p_size;
+  opaque *p_data, *g_data;
+  opaque *all_data;
+
+  _gnutls_mpi_print_lz (NULL, &g_size, params->params[1]);
+  _gnutls_mpi_print_lz (NULL, &p_size, params->params[0]);
+
+  all_data = gnutls_malloc (g_size + p_size);
+  if (all_data == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  p_data = &all_data[0];
+  g_data = &all_data[p_size];
+
+  _gnutls_mpi_print_lz (p_data, &p_size, params->params[0]);
+  _gnutls_mpi_print_lz (g_data, &g_size, params->params[1]);
+
+  /* Ok. Now we have the data. Create the asn1 structures
+   */
+
+  if ((result =
+       asn1_create_element (_gnutls_get_gnutls_asn (), "GNUTLS.DHParameter",
+                            &c2)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      gnutls_free (all_data);
+      return _gnutls_asn2err (result);
+    }
+
+  /* Write PRIME 
+   */
+  if ((result =
+       asn1_write_value (c2, "prime", p_data, p_size)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      gnutls_free (all_data);
+      asn1_delete_structure (&c2);
+      return _gnutls_asn2err (result);
+    }
+
+  /* Write the GENERATOR
+   */
+  if ((result =
+       asn1_write_value (c2, "base", g_data, g_size)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      gnutls_free (all_data);
+      asn1_delete_structure (&c2);
+      return _gnutls_asn2err (result);
+    }
+
+  gnutls_free (all_data);
+
+  if ((result = asn1_write_value (c2, "privateValueLength",
+                                  NULL, 0)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&c2);
+      return _gnutls_asn2err (result);
+    }
+
+  if (format == GNUTLS_X509_FMT_DER)
+    {
+      if (params_data == NULL)
+        *params_data_size = 0;
+
+      _params_data_size = *params_data_size;
+      result =
+        asn1_der_coding (c2, "", params_data, &_params_data_size, NULL);
+      *params_data_size = _params_data_size;
+      asn1_delete_structure (&c2);
+
+      if (result != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          if (result == ASN1_MEM_ERROR)
+            return GNUTLS_E_SHORT_MEMORY_BUFFER;
+
+          return _gnutls_asn2err (result);
+        }
+
+    }
+  else
+    {                           /* PEM */
+      opaque *tmp;
+      opaque *out;
+      int len;
+
+      len = 0;
+      asn1_der_coding (c2, "", NULL, &len, NULL);
+
+      tmp = gnutls_malloc (len);
+      if (tmp == NULL)
+        {
+          gnutls_assert ();
+          asn1_delete_structure (&c2);
+          return GNUTLS_E_MEMORY_ERROR;
+        }
+
+      if ((result =
+           asn1_der_coding (c2, "", tmp, &len, NULL)) != ASN1_SUCCESS)
+        {
+          gnutls_assert ();
+          gnutls_free (tmp);
+          asn1_delete_structure (&c2);
+          return _gnutls_asn2err (result);
+        }
+
+      asn1_delete_structure (&c2);
+
+      result = _gnutls_fbase64_encode ("DH PARAMETERS", tmp, len, &out);
+
+      gnutls_free (tmp);
+
+      if (result < 0)
+        {
+          gnutls_assert ();
+          return result;
+        }
+
+      if (result == 0)
+        {                       /* oooops */
+          gnutls_assert ();
+          gnutls_free (out);
+          return GNUTLS_E_INTERNAL_ERROR;
+        }
+
+      if ((unsigned) result + 1 > *params_data_size)
+        {
+          gnutls_assert ();
+          gnutls_free (out);
+          *params_data_size = result + 1;
+          return GNUTLS_E_SHORT_MEMORY_BUFFER;
+        }
+
+      *params_data_size = result;
+
+      if (params_data)
+        {
+          memcpy (params_data, out, result);
+          params_data[result] = 0;
+        }
+      gnutls_free (out);
+
+    }
+
+  return 0;
+}
+
+/**
+ * gnutls_dh_params_export_raw - This function will export the raw DH parameters
+ * @params: Holds the DH parameters
+ * @prime: will hold the new prime
+ * @generator: will hold the new generator
+ * @bits: if non null will hold is the prime's number of bits
+ *
+ * This function will export the pair of prime and generator for use in 
+ * the Diffie-Hellman key exchange. The new parameters will be allocated using
+ * gnutls_malloc() and will be stored in the appropriate datum.
+ * 
+ **/
+int
+gnutls_dh_params_export_raw (gnutls_dh_params_t params,
+                             gnutls_datum_t * prime,
+                             gnutls_datum_t * generator, unsigned int *bits)
+{
+
+  size_t size;
+
+  if (params->params[1] == NULL || params->params[0] == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  size = 0;
+  _gnutls_mpi_print (NULL, &size, params->params[1]);
+
+  generator->data = gnutls_malloc (size);
+  if (generator->data == NULL)
+    {
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  generator->size = size;
+  _gnutls_mpi_print (generator->data, &size, params->params[1]);
+
+  size = 0;
+  _gnutls_mpi_print (NULL, &size, params->params[0]);
+
+  prime->data = gnutls_malloc (size);
+  if (prime->data == NULL)
+    {
+      gnutls_free (generator->data);
+      generator->data = NULL;
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+  prime->size = size;
+  _gnutls_mpi_print (prime->data, &size, params->params[0]);
+
+  if (bits)
+    *bits = _gnutls_mpi_get_nbits (params->params[0]);
+
+  return 0;
+
+}
diff --git a/src/daemon/https/tls/gnutls_errors.c b/src/daemon/https/tls/gnutls_errors.c
new file mode 100644
index 00000000..9916dc96
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_errors.c
@@ -0,0 +1,422 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include <gnutls_int.h>
+#include "gnutls_errors.h"
+#include <libtasn1.h>
+#ifdef STDC_HEADERS
+# include <stdarg.h>
+#endif
+
+/* I18n of error codes. */
+#include "gettext.h"
+#define _(String) dgettext (PACKAGE, String)
+#define N_(String) gettext_noop (String)
+
+extern LOG_FUNC _gnutls_log_func;
+
+#define ERROR_ENTRY(desc, name, fatal) \
+        { desc, #name, name, fatal}
+
+struct gnutls_error_entry
+{
+  const char *desc;
+  const char *_name;
+  int number;
+  int fatal;
+};
+typedef struct gnutls_error_entry gnutls_error_entry;
+
+static const gnutls_error_entry error_algorithms[] = {
+  /* "Short Description", Error code define, critical (0,1) -- 1 in most cases */
+  ERROR_ENTRY (N_("Success."), GNUTLS_E_SUCCESS, 0),
+  ERROR_ENTRY (N_("Could not negotiate a supported cipher suite."),
+               GNUTLS_E_UNKNOWN_CIPHER_SUITE, 1),
+  ERROR_ENTRY (N_("The cipher type is unsupported."),
+               GNUTLS_E_UNKNOWN_CIPHER_TYPE, 1),
+  ERROR_ENTRY (N_("The certificate and the given key do not match."),
+               GNUTLS_E_CERTIFICATE_KEY_MISMATCH, 1),
+  ERROR_ENTRY (N_("Could not negotiate a supported compression method."),
+               GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM, 1),
+  ERROR_ENTRY (N_("An unknown public key algorithm was encountered."),
+               GNUTLS_E_UNKNOWN_PK_ALGORITHM, 1),
+
+  ERROR_ENTRY (N_("An algorithm that is not enabled was negotiated."),
+               GNUTLS_E_UNWANTED_ALGORITHM, 1),
+  ERROR_ENTRY (N_("A large TLS record packet was received."),
+               GNUTLS_E_LARGE_PACKET, 1),
+  ERROR_ENTRY (N_("A record packet with illegal version was received."),
+               GNUTLS_E_UNSUPPORTED_VERSION_PACKET, 1),
+  ERROR_ENTRY (N_
+               ("The Diffie Hellman prime sent by the server is not acceptable (not long enough)."),
+               GNUTLS_E_DH_PRIME_UNACCEPTABLE, 1),
+  ERROR_ENTRY (N_("A TLS packet with unexpected length was received."),
+               GNUTLS_E_UNEXPECTED_PACKET_LENGTH, 1),
+  ERROR_ENTRY (N_
+               ("The specified session has been invalidated for some reason."),
+               GNUTLS_E_INVALID_SESSION, 1),
+
+  ERROR_ENTRY (N_("GnuTLS internal error."), GNUTLS_E_INTERNAL_ERROR, 1),
+  ERROR_ENTRY (N_("An illegal TLS extension was received."),
+               GNUTLS_E_RECEIVED_ILLEGAL_EXTENSION, 1),
+  ERROR_ENTRY (N_("A TLS fatal alert has been received."),
+               GNUTLS_E_FATAL_ALERT_RECEIVED, 1),
+  ERROR_ENTRY (N_("An unexpected TLS packet was received."),
+               GNUTLS_E_UNEXPECTED_PACKET, 1),
+  ERROR_ENTRY (N_("A TLS warning alert has been received."),
+               GNUTLS_E_WARNING_ALERT_RECEIVED, 0),
+  ERROR_ENTRY (N_
+               ("An error was encountered at the TLS Finished packet calculation."),
+               GNUTLS_E_ERROR_IN_FINISHED_PACKET, 1),
+  ERROR_ENTRY (N_("The peer did not send any certificate."),
+               GNUTLS_E_NO_CERTIFICATE_FOUND, 1),
+
+  ERROR_ENTRY (N_("No temporary RSA parameters were found."),
+               GNUTLS_E_NO_TEMPORARY_RSA_PARAMS, 1),
+  ERROR_ENTRY (N_("No temporary DH parameters were found."),
+               GNUTLS_E_NO_TEMPORARY_DH_PARAMS, 1),
+  ERROR_ENTRY (N_("An unexpected TLS handshake packet was received."),
+               GNUTLS_E_UNEXPECTED_HANDSHAKE_PACKET, 1),
+  ERROR_ENTRY (N_("The scanning of a large integer has failed."),
+               GNUTLS_E_MPI_SCAN_FAILED, 1),
+  ERROR_ENTRY (N_("Could not export a large integer."),
+               GNUTLS_E_MPI_PRINT_FAILED, 1),
+  ERROR_ENTRY (N_("Decryption has failed."), GNUTLS_E_DECRYPTION_FAILED, 1),
+  ERROR_ENTRY (N_("Encryption has failed."), GNUTLS_E_ENCRYPTION_FAILED, 1),
+  ERROR_ENTRY (N_("Public key decryption has failed."),
+               GNUTLS_E_PK_DECRYPTION_FAILED, 1),
+  ERROR_ENTRY (N_("Public key encryption has failed."),
+               GNUTLS_E_PK_ENCRYPTION_FAILED, 1),
+  ERROR_ENTRY (N_("Public key signing has failed."), GNUTLS_E_PK_SIGN_FAILED,
+               1),
+  ERROR_ENTRY (N_("Public key signature verification has failed."),
+               GNUTLS_E_PK_SIG_VERIFY_FAILED, 1),
+  ERROR_ENTRY (N_("Decompression of the TLS record packet has failed."),
+               GNUTLS_E_DECOMPRESSION_FAILED, 1),
+  ERROR_ENTRY (N_("Compression of the TLS record packet has failed."),
+               GNUTLS_E_COMPRESSION_FAILED, 1),
+
+  ERROR_ENTRY (N_("Internal error in memory allocation."),
+               GNUTLS_E_MEMORY_ERROR, 1),
+  ERROR_ENTRY (N_("An unimplemented or disabled feature has been requested."),
+               GNUTLS_E_UNIMPLEMENTED_FEATURE, 1),
+  ERROR_ENTRY (N_("Insufficient credentials for that request."),
+               GNUTLS_E_INSUFFICIENT_CREDENTIALS, 1),
+  ERROR_ENTRY (N_("Error in password file."), GNUTLS_E_SRP_PWD_ERROR, 1),
+  ERROR_ENTRY (N_("Wrong padding in PKCS1 packet."), GNUTLS_E_PKCS1_WRONG_PAD,
+               1),
+  ERROR_ENTRY (N_("The requested session has expired."), GNUTLS_E_EXPIRED, 1),
+  ERROR_ENTRY (N_("Hashing has failed."), GNUTLS_E_HASH_FAILED, 1),
+  ERROR_ENTRY (N_("Base64 decoding error."), GNUTLS_E_BASE64_DECODING_ERROR,
+               1),
+  ERROR_ENTRY (N_("Base64 unexpected header error."),
+               GNUTLS_E_BASE64_UNEXPECTED_HEADER_ERROR,
+               1),
+  ERROR_ENTRY (N_("Base64 encoding error."), GNUTLS_E_BASE64_ENCODING_ERROR,
+               1),
+  ERROR_ENTRY (N_("Parsing error in password file."),
+               GNUTLS_E_SRP_PWD_PARSING_ERROR, 1),
+  ERROR_ENTRY (N_("The requested data were not available."),
+               GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE, 0),
+  ERROR_ENTRY (N_("Error in the pull function."), GNUTLS_E_PULL_ERROR, 1),
+  ERROR_ENTRY (N_("Error in the push function."), GNUTLS_E_PUSH_ERROR, 1),
+  ERROR_ENTRY (N_
+               ("The upper limit of record packet sequence numbers has been reached. Wow!"),
+               GNUTLS_E_RECORD_LIMIT_REACHED, 1),
+  ERROR_ENTRY (N_("Error in the certificate."), GNUTLS_E_CERTIFICATE_ERROR,
+               1),
+  ERROR_ENTRY (N_("Unknown Subject Alternative name in X.509 certificate."),
+               GNUTLS_E_X509_UNKNOWN_SAN, 1),
+
+  ERROR_ENTRY (N_("Unsupported critical extension in X.509 certificate."),
+               GNUTLS_E_X509_UNSUPPORTED_CRITICAL_EXTENSION, 1),
+  ERROR_ENTRY (N_("Key usage violation in certificate has been detected."),
+               GNUTLS_E_KEY_USAGE_VIOLATION, 1),
+  ERROR_ENTRY (N_("Function was interrupted."), GNUTLS_E_AGAIN, 0),
+  ERROR_ENTRY (N_("Function was interrupted."), GNUTLS_E_INTERRUPTED, 0),
+  ERROR_ENTRY (N_("Rehandshake was requested by the peer."),
+               GNUTLS_E_REHANDSHAKE, 0),
+  ERROR_ENTRY (N_
+               ("TLS Application data were received, while expecting handshake data."),
+               GNUTLS_E_GOT_APPLICATION_DATA, 1),
+  ERROR_ENTRY (N_("Error in Database backend."), GNUTLS_E_DB_ERROR, 1),
+  ERROR_ENTRY (N_("The certificate type is not supported."),
+               GNUTLS_E_UNSUPPORTED_CERTIFICATE_TYPE, 1),
+  ERROR_ENTRY (N_("The given memory buffer is too short to hold parameters."),
+               GNUTLS_E_SHORT_MEMORY_BUFFER, 1),
+  ERROR_ENTRY (N_("The request is invalid."), GNUTLS_E_INVALID_REQUEST, 1),
+  ERROR_ENTRY (N_("An illegal parameter has been received."),
+               GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER, 1),
+  ERROR_ENTRY (N_("Error while reading file."), GNUTLS_E_FILE_ERROR, 1),
+
+  ERROR_ENTRY (N_("ASN1 parser: Element was not found."),
+               GNUTLS_E_ASN1_ELEMENT_NOT_FOUND, 1),
+  ERROR_ENTRY (N_("ASN1 parser: Identifier was not found"),
+               GNUTLS_E_ASN1_IDENTIFIER_NOT_FOUND, 1),
+  ERROR_ENTRY (N_("ASN1 parser: Error in DER parsing."),
+               GNUTLS_E_ASN1_DER_ERROR, 1),
+  ERROR_ENTRY (N_("ASN1 parser: Value was not found."),
+               GNUTLS_E_ASN1_VALUE_NOT_FOUND, 1),
+  ERROR_ENTRY (N_("ASN1 parser: Generic parsing error."),
+               GNUTLS_E_ASN1_GENERIC_ERROR, 1),
+  ERROR_ENTRY (N_("ASN1 parser: Value is not valid."),
+               GNUTLS_E_ASN1_VALUE_NOT_VALID, 1),
+  ERROR_ENTRY (N_("ASN1 parser: Error in TAG."), GNUTLS_E_ASN1_TAG_ERROR, 1),
+  ERROR_ENTRY (N_("ASN1 parser: error in implicit tag"),
+               GNUTLS_E_ASN1_TAG_IMPLICIT, 1),
+  ERROR_ENTRY (N_("ASN1 parser: Error in type 'ANY'."),
+               GNUTLS_E_ASN1_TYPE_ANY_ERROR, 1),
+  ERROR_ENTRY (N_("ASN1 parser: Syntax error."), GNUTLS_E_ASN1_SYNTAX_ERROR,
+               1),
+  ERROR_ENTRY (N_("ASN1 parser: Overflow in DER parsing."),
+               GNUTLS_E_ASN1_DER_OVERFLOW, 1),
+
+  ERROR_ENTRY (N_("Too many empty record packets have been received."),
+               GNUTLS_E_TOO_MANY_EMPTY_PACKETS, 1),
+  ERROR_ENTRY (N_("The initialization of GnuTLS-extra has failed."),
+               GNUTLS_E_INIT_LIBEXTRA, 1),
+  ERROR_ENTRY (N_
+               ("The GnuTLS library version does not match the GnuTLS-extra library version."),
+               GNUTLS_E_LIBRARY_VERSION_MISMATCH, 1),
+  ERROR_ENTRY (N_("The gcrypt library version is too old."),
+               GNUTLS_E_INCOMPATIBLE_GCRYPT_LIBRARY, 1),
+
+  ERROR_ENTRY (N_("The tasn1 library version is too old."),
+               GNUTLS_E_INCOMPATIBLE_LIBTASN1_LIBRARY, 1),
+
+  ERROR_ENTRY (N_("Error loading the keyring."),
+               GNUTLS_E_OPENPGP_KEYRING_ERROR, 1),
+  ERROR_ENTRY (N_("The initialization of LZO has failed."),
+               GNUTLS_E_LZO_INIT_FAILED, 1),
+  ERROR_ENTRY (N_("No supported compression algorithms have been found."),
+               GNUTLS_E_NO_COMPRESSION_ALGORITHMS, 1),
+  ERROR_ENTRY (N_("No supported cipher suites have been found."),
+               GNUTLS_E_NO_CIPHER_SUITES, 1),
+  ERROR_ENTRY (N_("Could not get OpenPGP key."),
+               GNUTLS_E_OPENPGP_GETKEY_FAILED, 1),
+
+  ERROR_ENTRY (N_("The SRP username supplied is illegal."),
+               GNUTLS_E_ILLEGAL_SRP_USERNAME, 1),
+
+  ERROR_ENTRY (N_("The OpenPGP fingerprint is not supported."),
+               GNUTLS_E_OPENPGP_FINGERPRINT_UNSUPPORTED, 1),
+  ERROR_ENTRY (N_("The certificate has unsupported attributes."),
+               GNUTLS_E_X509_UNSUPPORTED_ATTRIBUTE, 1),
+  ERROR_ENTRY (N_("The OID is not supported."), GNUTLS_E_X509_UNSUPPORTED_OID,
+               1),
+  ERROR_ENTRY (N_("The hash algorithm is unknown."),
+               GNUTLS_E_UNKNOWN_HASH_ALGORITHM, 1),
+  ERROR_ENTRY (N_("The PKCS structure's content type is unknown."),
+               GNUTLS_E_UNKNOWN_PKCS_CONTENT_TYPE, 1),
+  ERROR_ENTRY (N_("The PKCS structure's bag type is unknown."),
+               GNUTLS_E_UNKNOWN_PKCS_BAG_TYPE, 1),
+  ERROR_ENTRY (N_("The given password contains invalid characters."),
+               GNUTLS_E_INVALID_PASSWORD, 1),
+  ERROR_ENTRY (N_("The Message Authentication Code verification failed."),
+               GNUTLS_E_MAC_VERIFY_FAILED, 1),
+  ERROR_ENTRY (N_("Some constraint limits were reached."),
+               GNUTLS_E_CONSTRAINT_ERROR, 1),
+  ERROR_ENTRY (N_("Failed to acquire random data."), GNUTLS_E_RANDOM_FAILED,
+               1),
+
+  ERROR_ENTRY (N_("Received a TLS/IA Intermediate Phase Finished message"),
+               GNUTLS_E_WARNING_IA_IPHF_RECEIVED, 0),
+  ERROR_ENTRY (N_("Received a TLS/IA Final Phase Finished message"),
+               GNUTLS_E_WARNING_IA_FPHF_RECEIVED, 0),
+  ERROR_ENTRY (N_("Verifying TLS/IA phase checksum failed"),
+               GNUTLS_E_IA_VERIFY_FAILED, 1),
+
+  ERROR_ENTRY (N_("The specified algorithm or protocol is unknown."),
+               GNUTLS_E_UNKNOWN_ALGORITHM, 1),
+
+  {NULL, NULL, 0, 0}
+};
+
+#define GNUTLS_ERROR_LOOP(b) \
+        const gnutls_error_entry *p; \
+                for(p = error_algorithms; p->desc != NULL; p++) { b ; }
+
+#define GNUTLS_ERROR_ALG_LOOP(a) \
+                        GNUTLS_ERROR_LOOP( if(p->number == error) { a; break; } )
+
+
+
+/**
+  * gnutls_error_is_fatal - Returns non-zero in case of a fatal error
+  * @error: is an error returned by a gnutls function. Error should be a negative value.
+  *
+  * If a function returns a negative value you may feed that value
+  * to this function to see if it is fatal. Returns 1 for a fatal 
+  * error 0 otherwise. However you may want to check the
+  * error code manually, since some non-fatal errors to the protocol
+  * may be fatal for you (your program).
+  *
+  * This is only useful if you are dealing with errors from the
+  * record layer or the handshake layer.
+  *
+  * For positive @error values, 0 is returned.
+  *
+  **/
+int
+gnutls_error_is_fatal (int error)
+{
+  int ret = 1;
+
+  /* Input sanitzation.  Positive values are not errors at all, and
+     definitely not fatal. */
+  if (error > 0)
+    return 0;
+
+  GNUTLS_ERROR_ALG_LOOP (ret = p->fatal);
+
+  return ret;
+}
+
+/**
+  * gnutls_perror - prints a string to stderr with a description of an error
+  * @error: is an error returned by a gnutls function. Error is always a negative value.
+  *
+  * This function is like perror(). The only difference is that it accepts an 
+  * error number returned by a gnutls function.
+  **/
+void
+gnutls_perror (int error)
+{
+  const char *ret = NULL;
+
+  /* avoid prefix */
+  GNUTLS_ERROR_ALG_LOOP (ret = p->desc);
+  if (ret == NULL)
+    ret = "(unknown)";
+  fprintf (stderr, "GNUTLS ERROR: %s\n", _(ret));
+}
+
+
+/**
+  * gnutls_strerror - Returns a string with a description of an error
+  * @error: is an error returned by a gnutls function. Error is always a negative value.
+  *
+  * This function is similar to strerror(). Differences: it accepts an error
+  * number returned by a gnutls function; In case of an unknown error
+  * a descriptive string is sent instead of NULL.
+  **/
+const char *
+gnutls_strerror (int error)
+{
+  const char *ret = NULL;
+
+  /* avoid prefix */
+  GNUTLS_ERROR_ALG_LOOP (ret = p->desc);
+  if (ret == NULL)
+    return "(unknown error code)";
+  return _(ret);
+}
+
+/* This will print the actual define of the
+ * given error code.
+ */
+const char *
+_gnutls_strerror (int error)
+{
+  const char *ret = NULL;
+
+  /* avoid prefix */
+  GNUTLS_ERROR_ALG_LOOP (ret = p->_name);
+
+  return _(ret);
+}
+
+int
+_gnutls_asn2err (int asn_err)
+{
+  switch (asn_err)
+    {
+    case ASN1_FILE_NOT_FOUND:
+      return GNUTLS_E_FILE_ERROR;
+    case ASN1_ELEMENT_NOT_FOUND:
+      return GNUTLS_E_ASN1_ELEMENT_NOT_FOUND;
+    case ASN1_IDENTIFIER_NOT_FOUND:
+      return GNUTLS_E_ASN1_IDENTIFIER_NOT_FOUND;
+    case ASN1_DER_ERROR:
+      return GNUTLS_E_ASN1_DER_ERROR;
+    case ASN1_VALUE_NOT_FOUND:
+      return GNUTLS_E_ASN1_VALUE_NOT_FOUND;
+    case ASN1_GENERIC_ERROR:
+      return GNUTLS_E_ASN1_GENERIC_ERROR;
+    case ASN1_VALUE_NOT_VALID:
+      return GNUTLS_E_ASN1_VALUE_NOT_VALID;
+    case ASN1_TAG_ERROR:
+      return GNUTLS_E_ASN1_TAG_ERROR;
+    case ASN1_TAG_IMPLICIT:
+      return GNUTLS_E_ASN1_TAG_IMPLICIT;
+    case ASN1_ERROR_TYPE_ANY:
+      return GNUTLS_E_ASN1_TYPE_ANY_ERROR;
+    case ASN1_SYNTAX_ERROR:
+      return GNUTLS_E_ASN1_SYNTAX_ERROR;
+    case ASN1_MEM_ERROR:
+      return GNUTLS_E_SHORT_MEMORY_BUFFER;
+    case ASN1_MEM_ALLOC_ERROR:
+      return GNUTLS_E_MEMORY_ERROR;
+    case ASN1_DER_OVERFLOW:
+      return GNUTLS_E_ASN1_DER_OVERFLOW;
+    default:
+      return GNUTLS_E_ASN1_GENERIC_ERROR;
+    }
+}
+
+
+/* this function will output a message using the
+ * caller provided function
+ */
+void
+_gnutls_log (int level, const char *fmt, ...)
+{
+  va_list args;
+  char str[MAX_LOG_SIZE];
+  void (*log_func) (int, const char *) = _gnutls_log_func;
+
+  if (_gnutls_log_func == NULL)
+    return;
+
+  va_start (args, fmt);
+  vsnprintf (str, MAX_LOG_SIZE - 1, fmt, args); /* Flawfinder: ignore */
+  va_end (args);
+
+  log_func (level, str);
+}
+
+#ifndef DEBUG
+# ifndef C99_MACROS
+
+/* Without C99 macros these functions have to
+ * be called. This may affect performance.
+ */
+void
+_gnutls_null_log (void *x, ...)
+{
+  return;
+}
+
+# endif /* C99_MACROS */
+#endif /* DEBUG */
diff --git a/src/daemon/https/tls/gnutls_errors.h b/src/daemon/https/tls/gnutls_errors.h
new file mode 100644
index 00000000..667bd62b
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_errors.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include <defines.h>
+
+#define GNUTLS_E_INT_RET_0 -1251
+
+#ifdef __FILE__
+# ifdef __LINE__
+#  define gnutls_assert() _gnutls_debug_log( "ASSERT: %s:%d\n", __FILE__,__LINE__);
+# else
+#  define gnutls_assert()
+# endif
+#else /* __FILE__ not defined */
+# define gnutls_assert()
+#endif
+
+int _gnutls_asn2err (int asn_err);
+void _gnutls_log (int, const char *fmt, ...);
+
+extern int _gnutls_log_level;
+
+#ifdef C99_MACROS
+#define LEVEL(l, ...) if (_gnutls_log_level >= l || _gnutls_log_level > 9) \
+        _gnutls_log( l, __VA_ARGS__)
+
+#define LEVEL_EQ(l, ...) if (_gnutls_log_level == l || _gnutls_log_level > 9) \
+        _gnutls_log( l, __VA_ARGS__)
+
+# define _gnutls_debug_log(...) LEVEL(2, __VA_ARGS__)
+# define _gnutls_handshake_log(...) LEVEL(3, __VA_ARGS__)
+# define _gnutls_io_log(...) LEVEL_EQ(5, __VA_ARGS__)
+# define _gnutls_buffers_log(...) LEVEL_EQ(6, __VA_ARGS__)
+# define _gnutls_hard_log(...) LEVEL(9, __VA_ARGS__)
+# define _gnutls_record_log(...) LEVEL(4, __VA_ARGS__)
+# define _gnutls_read_log(...) LEVEL_EQ(7, __VA_ARGS__)
+# define _gnutls_write_log(...) LEVEL_EQ(7, __VA_ARGS__)
+# define _gnutls_x509_log(...) LEVEL(1, __VA_ARGS__)
+#else
+# define _gnutls_debug_log _gnutls_null_log
+# define _gnutls_handshake_log _gnutls_null_log
+# define _gnutls_io_log _gnutls_null_log
+# define _gnutls_buffers_log _gnutls_null_log
+# define _gnutls_hard_log _gnutls_null_log
+# define _gnutls_record_log _gnutls_null_log
+# define _gnutls_read_log _gnutls_null_log
+# define _gnutls_write_log _gnutls_null_log
+# define _gnutls_x509_log _gnutls_null_log
+
+void _gnutls_null_log (void *, ...);
+
+#endif /* C99_MACROS */
diff --git a/src/daemon/https/tls/gnutls_extensions.c b/src/daemon/https/tls/gnutls_extensions.c
new file mode 100644
index 00000000..603446d7
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_extensions.c
@@ -0,0 +1,318 @@
+/*
+ * Copyright (C) 2001, 2002, 2003, 2004, 2005, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* Functions that relate to the TLS hello extension parsing.
+ * Hello extensions are packets appended in the TLS hello packet, and
+ * allow for extra functionality.
+ */
+
+#include "gnutls_int.h"
+#include "gnutls_extensions.h"
+#include "gnutls_errors.h"
+#include "ext_max_record.h"
+#include <ext_cert_type.h>
+#include <ext_server_name.h>
+#include <ext_oprfi.h>
+#include <ext_inner_application.h>
+#include <gnutls_num.h>
+
+/* Key Exchange Section */
+#define GNUTLS_EXTENSION_ENTRY(type, parse_type, ext_func_recv, ext_func_send) \
+        { #type, type, parse_type, ext_func_recv, ext_func_send }
+
+
+#define MAX_EXT_SIZE 10
+const int _gnutls_extensions_size = MAX_EXT_SIZE;
+
+gnutls_extension_entry _gnutls_extensions[MAX_EXT_SIZE] = {
+  GNUTLS_EXTENSION_ENTRY (GNUTLS_EXTENSION_MAX_RECORD_SIZE,
+                          EXTENSION_TLS,
+                          _gnutls_max_record_recv_params,
+                          _gnutls_max_record_send_params),
+  GNUTLS_EXTENSION_ENTRY (GNUTLS_EXTENSION_CERT_TYPE,
+                          EXTENSION_TLS,
+                          _gnutls_cert_type_recv_params,
+                          _gnutls_cert_type_send_params),
+  GNUTLS_EXTENSION_ENTRY (GNUTLS_EXTENSION_SERVER_NAME,
+                          EXTENSION_APPLICATION,
+                          _gnutls_server_name_recv_params,
+                          _gnutls_server_name_send_params),
+#ifdef ENABLE_OPRFI
+  GNUTLS_EXTENSION_ENTRY (GNUTLS_EXTENSION_OPAQUE_PRF_INPUT,
+                          EXTENSION_TLS,
+                          _gnutls_oprfi_recv_params,
+                          _gnutls_oprfi_send_params),
+#endif
+#ifdef ENABLE_SRP
+  GNUTLS_EXTENSION_ENTRY (GNUTLS_EXTENSION_SRP,
+                          EXTENSION_TLS,
+                          _gnutls_srp_recv_params,
+                          _gnutls_srp_send_params),
+#endif
+  GNUTLS_EXTENSION_ENTRY (GNUTLS_EXTENSION_INNER_APPLICATION,
+                          EXTENSION_TLS,
+                          _gnutls_inner_application_recv_params,
+                          _gnutls_inner_application_send_params),
+  {0, 0, 0, 0}
+};
+
+#define GNUTLS_EXTENSION_LOOP2(b) \
+        gnutls_extension_entry *p; \
+                for(p = _gnutls_extensions; p->name != NULL; p++) { b ; }
+
+#define GNUTLS_EXTENSION_LOOP(a) \
+                        GNUTLS_EXTENSION_LOOP2( if(p->type == type) { a; break; } )
+
+
+/* EXTENSION functions */
+
+ext_recv_func
+_gnutls_ext_func_recv (uint16_t type, tls_ext_parse_type_t parse_type)
+{
+  ext_recv_func ret = NULL;
+  GNUTLS_EXTENSION_LOOP (if
+                         (parse_type == EXTENSION_ANY
+                          || p->parse_type == parse_type) ret =
+                         p->gnutls_ext_func_recv);
+  return ret;
+
+}
+
+ext_send_func
+_gnutls_ext_func_send (uint16_t type)
+{
+  ext_send_func ret = NULL;
+  GNUTLS_EXTENSION_LOOP (ret = p->gnutls_ext_func_send);
+  return ret;
+
+}
+
+const char *
+_gnutls_extension_get_name (uint16_t type)
+{
+  const char *ret = NULL;
+
+  /* avoid prefix */
+  GNUTLS_EXTENSION_LOOP (ret = p->name + sizeof ("GNUTLS_EXTENSION_") - 1);
+
+  return ret;
+}
+
+/* Checks if the extension we just received is one of the 
+ * requested ones. Otherwise it's a fatal error.
+ */
+static int
+_gnutls_extension_list_check (gnutls_session_t session, uint16_t type)
+{
+  if (session->security_parameters.entity == GNUTLS_CLIENT)
+    {
+      int i;
+      for (i = 0; i < session->internals.extensions_sent_size; i++)
+        {
+          if (type == session->internals.extensions_sent[i])
+            return 0;           /* ok found */
+        }
+      return GNUTLS_E_RECEIVED_ILLEGAL_EXTENSION;
+    }
+
+  return 0;
+}
+
+int
+_gnutls_parse_extensions (gnutls_session_t session,
+                          tls_ext_parse_type_t parse_type,
+                          const opaque * data, int data_size)
+{
+  int next, ret;
+  int pos = 0;
+  uint16_t type;
+  const opaque *sdata;
+  ext_recv_func ext_recv;
+  uint16_t size;
+
+#ifdef DEBUG
+  int i;
+
+  if (session->security_parameters.entity == GNUTLS_CLIENT)
+    for (i = 0; i < session->internals.extensions_sent_size; i++)
+      {
+        _gnutls_debug_log ("EXT[%d]: expecting extension '%s'\n",
+                           session,
+                           _gnutls_extension_get_name (session->
+                                                       internals.
+                                                       extensions_sent[i]));
+      }
+#endif
+
+  DECR_LENGTH_RET (data_size, 2, 0);
+  next = _gnutls_read_uint16 (data);
+  pos += 2;
+
+  DECR_LENGTH_RET (data_size, next, 0);
+
+  do
+    {
+      DECR_LENGTH_RET (next, 2, 0);
+      type = _gnutls_read_uint16 (&data[pos]);
+      pos += 2;
+
+      _gnutls_debug_log ("EXT[%x]: Received extension '%s/%d'\n", session,
+                         _gnutls_extension_get_name (type), type);
+
+      if ((ret = _gnutls_extension_list_check (session, type)) < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      DECR_LENGTH_RET (next, 2, 0);
+      size = _gnutls_read_uint16 (&data[pos]);
+      pos += 2;
+
+      DECR_LENGTH_RET (next, size, 0);
+      sdata = &data[pos];
+      pos += size;
+
+      ext_recv = _gnutls_ext_func_recv (type, parse_type);
+      if (ext_recv == NULL)
+        continue;
+      if ((ret = ext_recv (session, sdata, size)) < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+    }
+  while (next > 2);
+
+  return 0;
+
+}
+
+/* Adds the extension we want to send in the extensions list.
+ * This list is used to check whether the (later) received
+ * extensions are the ones we requested.
+ */
+static void
+_gnutls_extension_list_add (gnutls_session_t session, uint16_t type)
+{
+
+  if (session->security_parameters.entity == GNUTLS_CLIENT)
+    {
+      if (session->internals.extensions_sent_size < MAX_EXT_TYPES)
+        {
+          session->internals.extensions_sent[session->internals.
+                                             extensions_sent_size] = type;
+          session->internals.extensions_sent_size++;
+        }
+      else
+        {
+          _gnutls_debug_log ("extensions: Increase MAX_EXT_TYPES\n");
+        }
+    }
+}
+
+int
+_gnutls_gen_extensions (gnutls_session_t session, opaque * data,
+                        size_t data_size)
+{
+  int size;
+  uint16_t pos = 0;
+  opaque *sdata;
+  int sdata_size;
+  ext_send_func ext_send;
+  gnutls_extension_entry *p;
+
+  if (data_size < 2)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  /* allocate enough data for each extension.
+   */
+  sdata_size = data_size;
+  sdata = gnutls_malloc (sdata_size);
+  if (sdata == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  pos += 2;
+  for (p = _gnutls_extensions; p->name != NULL; p++)
+    {
+      ext_send = _gnutls_ext_func_send (p->type);
+      if (ext_send == NULL)
+        continue;
+      size = ext_send (session, sdata, sdata_size);
+      if (size > 0)
+        {
+          if (data_size < pos + (size_t) size + 4)
+            {
+              gnutls_assert ();
+              gnutls_free (sdata);
+              return GNUTLS_E_INTERNAL_ERROR;
+            }
+
+          /* write extension type */
+          _gnutls_write_uint16 (p->type, &data[pos]);
+          pos += 2;
+
+          /* write size */
+          _gnutls_write_uint16 (size, &data[pos]);
+          pos += 2;
+
+          memcpy (&data[pos], sdata, size);
+          pos += size;
+
+          /* add this extension to the extension list
+           */
+          _gnutls_extension_list_add (session, p->type);
+
+          _gnutls_debug_log ("EXT[%x]: Sending extension %s\n", session,
+                             _gnutls_extension_get_name (p->type));
+        }
+      else if (size < 0)
+        {
+          gnutls_assert ();
+          gnutls_free (sdata);
+          return size;
+        }
+    }
+
+  size = pos;
+  pos -= 2;                     /* remove the size of the size header! */
+
+  _gnutls_write_uint16 (pos, data);
+
+  if (size == 2)
+    {                           /* empty */
+      size = 0;
+    }
+
+  gnutls_free (sdata);
+  return size;
+
+}
diff --git a/src/daemon/https/tls/gnutls_extensions.h b/src/daemon/https/tls/gnutls_extensions.h
new file mode 100644
index 00000000..c305846c
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_extensions.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include <gnutls_int.h>
+
+const char *_gnutls_extension_get_name (uint16_t type);
+int _gnutls_parse_extensions (gnutls_session_t, tls_ext_parse_type_t, const opaque *, int);
+int _gnutls_gen_extensions (gnutls_session_t session, opaque * data,
+                            size_t data_size);
+
+typedef int (*ext_recv_func) (gnutls_session_t, const opaque *, size_t);        /* recv data */
+typedef int (*ext_send_func) (gnutls_session_t, opaque *, size_t);      /* send data */
+
+ext_send_func _gnutls_ext_func_send (uint16_t type);
+ext_recv_func _gnutls_ext_func_recv (uint16_t type, tls_ext_parse_type_t);
+
+typedef struct
+{
+  const char *name;
+  uint16_t type;
+  tls_ext_parse_type_t parse_type;
+  ext_recv_func gnutls_ext_func_recv;
+  ext_send_func gnutls_ext_func_send;
+} gnutls_extension_entry;
diff --git a/src/daemon/https/tls/gnutls_extra_hooks.c b/src/daemon/https/tls/gnutls_extra_hooks.c
new file mode 100644
index 00000000..f7852f64
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_extra_hooks.c
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2007 Free Software Foundation
+ *
+ * Author: Simon Josefsson
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include <gnutls_int.h>
+#include <gnutls_extra_hooks.h>
+
+/* Variables used by libgnutls, set by
+   _gnutls_add_openpgp_functions(), typically invoked by
+   libgnutls_extra. */
+_gnutls_openpgp_verify_key_func _E_gnutls_openpgp_verify_key = NULL;
+_gnutls_openpgp_crt_creation_time_func
+  _E_gnutls_openpgp_get_raw_key_creation_time = NULL;
+_gnutls_openpgp_crt_expiration_time_func
+  _E_gnutls_openpgp_get_raw_key_expiration_time = NULL;
+_gnutls_openpgp_fingerprint_func _E_gnutls_openpgp_fingerprint = NULL;
+_gnutls_openpgp_crt_request_func _E_gnutls_openpgp_request_key = NULL;
+_gnutls_openpgp_raw_key_to_gcert_func _E_gnutls_openpgp_raw_key_to_gcert =
+  NULL;
+_gnutls_openpgp_raw_privkey_to_gkey_func _E_gnutls_openpgp_raw_privkey_to_gkey
+  = NULL;
+_gnutls_openpgp_crt_to_gcert_func _E_gnutls_openpgp_crt_to_gcert = NULL;
+_gnutls_openpgp_privkey_to_gkey_func _E_gnutls_openpgp_privkey_to_gkey = NULL;
+_gnutls_openpgp_crt_deinit_func _E_gnutls_openpgp_crt_deinit = NULL;
+_gnutls_openpgp_keyring_deinit_func _E_gnutls_openpgp_keyring_deinit = NULL;
+_gnutls_openpgp_privkey_deinit_func _E_gnutls_openpgp_privkey_deinit = NULL;
+
+/* Called by libgnutls_extra to set the OpenPGP functions that are
+   needed by GnuTLS.  */
+extern void
+  _gnutls_add_openpgp_functions
+  (_gnutls_openpgp_verify_key_func verify_key,
+   _gnutls_openpgp_crt_creation_time_func key_creation_time,
+   _gnutls_openpgp_crt_expiration_time_func key_expiration_time,
+   _gnutls_openpgp_fingerprint_func fingerprint,
+   _gnutls_openpgp_crt_request_func request_key,
+   _gnutls_openpgp_raw_key_to_gcert_func raw_key_to_gcert,
+   _gnutls_openpgp_raw_privkey_to_gkey_func raw_privkey_to_gkey,
+   _gnutls_openpgp_crt_to_gcert_func key_to_gcert,
+   _gnutls_openpgp_privkey_to_gkey_func privkey_to_gkey,
+   _gnutls_openpgp_crt_deinit_func key_deinit,
+   _gnutls_openpgp_keyring_deinit_func keyring_deinit,
+   _gnutls_openpgp_privkey_deinit_func privkey_deinit)
+{
+  _E_gnutls_openpgp_verify_key = verify_key;
+  _E_gnutls_openpgp_get_raw_key_creation_time = key_creation_time;
+  _E_gnutls_openpgp_get_raw_key_expiration_time = key_expiration_time;
+  _E_gnutls_openpgp_fingerprint = fingerprint;
+  _E_gnutls_openpgp_request_key = request_key;
+  _E_gnutls_openpgp_raw_key_to_gcert = raw_key_to_gcert;
+  _E_gnutls_openpgp_raw_privkey_to_gkey = raw_privkey_to_gkey;
+  _E_gnutls_openpgp_crt_to_gcert = key_to_gcert;
+  _E_gnutls_openpgp_privkey_to_gkey = privkey_to_gkey;
+  _E_gnutls_openpgp_crt_deinit = key_deinit;
+  _E_gnutls_openpgp_keyring_deinit = keyring_deinit;
+  _E_gnutls_openpgp_privkey_deinit = privkey_deinit;
+
+}
diff --git a/src/daemon/https/tls/gnutls_extra_hooks.h b/src/daemon/https/tls/gnutls_extra_hooks.h
new file mode 100644
index 00000000..ac55d06a
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_extra_hooks.h
@@ -0,0 +1,106 @@
+/*
+ * Copyright (C) 2007 Free Software Foundation
+ *
+ * Author: Simon Josefsson
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* This file is included by libgnutls-extra, and it will call the
+   _gnutls_add_openpgp_functions() function to register its OpenPGP
+   functions. */
+
+#include <auth_cert.h>
+
+typedef int (*_gnutls_openpgp_verify_key_func)
+(const gnutls_certificate_credentials_t,
+ const gnutls_datum_t *, int,
+ unsigned int *);
+
+typedef time_t (*_gnutls_openpgp_crt_creation_time_func)
+(const gnutls_datum_t *);
+
+typedef time_t (*_gnutls_openpgp_crt_expiration_time_func)
+(const gnutls_datum_t *);
+
+typedef int (*_gnutls_openpgp_crt_request_func)
+(gnutls_session_t, gnutls_datum_t *,
+ const gnutls_certificate_credentials_t,
+ opaque *, int);
+
+typedef int (*_gnutls_openpgp_fingerprint_func)
+(const gnutls_datum_t *,
+ unsigned char *, size_t *);
+
+typedef int (*_gnutls_openpgp_raw_key_to_gcert_func)
+(gnutls_cert *,
+ const gnutls_datum_t *);
+typedef int (*_gnutls_openpgp_raw_privkey_to_gkey_func)
+(gnutls_privkey *,
+ const gnutls_datum_t *,
+ gnutls_openpgp_crt_fmt_t);
+
+typedef int (*_gnutls_openpgp_crt_to_gcert_func)
+(gnutls_cert *, gnutls_openpgp_crt_t);
+
+typedef int (*_gnutls_openpgp_privkey_to_gkey_func)
+(gnutls_privkey *,
+ gnutls_openpgp_privkey_t);
+
+typedef void (*_gnutls_openpgp_crt_deinit_func)
+(gnutls_openpgp_crt_t);
+
+typedef void (*_gnutls_openpgp_keyring_deinit_func)
+(gnutls_openpgp_keyring_t);
+
+typedef void (*_gnutls_openpgp_privkey_deinit_func)
+(gnutls_openpgp_privkey_t);
+
+/* These are defined in libgnutls, but not exported from libgnutls,
+   and not intended to be used by libgnutls-extra or elsewhere.  They
+   are declared here, because this file is included by auth_cert.c and
+   gnutls_cert.c too.  */
+extern _gnutls_openpgp_verify_key_func _E_gnutls_openpgp_verify_key;
+extern _gnutls_openpgp_crt_creation_time_func
+_E_gnutls_openpgp_get_raw_key_creation_time;
+extern _gnutls_openpgp_crt_expiration_time_func
+_E_gnutls_openpgp_get_raw_key_expiration_time;
+extern _gnutls_openpgp_fingerprint_func _E_gnutls_openpgp_fingerprint;
+extern _gnutls_openpgp_crt_request_func _E_gnutls_openpgp_request_key;
+extern _gnutls_openpgp_raw_key_to_gcert_func _E_gnutls_openpgp_raw_key_to_gcert;
+extern _gnutls_openpgp_raw_privkey_to_gkey_func _E_gnutls_openpgp_raw_privkey_to_gkey;
+extern _gnutls_openpgp_crt_to_gcert_func _E_gnutls_openpgp_crt_to_gcert;
+extern _gnutls_openpgp_privkey_to_gkey_func _E_gnutls_openpgp_privkey_to_gkey;
+extern _gnutls_openpgp_crt_deinit_func _E_gnutls_openpgp_crt_deinit;
+extern _gnutls_openpgp_keyring_deinit_func _E_gnutls_openpgp_keyring_deinit;
+extern _gnutls_openpgp_privkey_deinit_func _E_gnutls_openpgp_privkey_deinit;
+
+extern void _gnutls_add_openpgp_functions
+(_gnutls_openpgp_verify_key_func verify_key,
+ _gnutls_openpgp_crt_creation_time_func key_creation_time,
+ _gnutls_openpgp_crt_expiration_time_func key_expiration_time,
+ _gnutls_openpgp_fingerprint_func fingerprint,
+ _gnutls_openpgp_crt_request_func request_key,
+ _gnutls_openpgp_raw_key_to_gcert_func raw_key_to_gcert,
+ _gnutls_openpgp_raw_privkey_to_gkey_func raw_privkey_to_gkey,
+ _gnutls_openpgp_crt_to_gcert_func key_to_gcert,
+ _gnutls_openpgp_privkey_to_gkey_func privkey_to_gkey,
+ _gnutls_openpgp_crt_deinit_func key_deinit,
+ _gnutls_openpgp_keyring_deinit_func keyring_deinit,
+ _gnutls_openpgp_privkey_deinit_func privkey_deinit);
diff --git a/src/daemon/https/tls/gnutls_global.c b/src/daemon/https/tls/gnutls_global.c
new file mode 100644
index 00000000..d019dcda
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_global.c
@@ -0,0 +1,375 @@
+/*
+ * Copyright (C) 2001, 2002, 2003, 2004, 2005, 2006 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include <gnutls_int.h>
+#include <gnutls_errors.h>
+#include <libtasn1.h>
+#include <gnutls_dh.h>
+
+#ifdef HAVE_WINSOCK
+# include <winsock2.h>
+#endif
+
+#include "gettext.h"
+
+#define gnutls_log_func LOG_FUNC
+
+/* created by asn1c */
+extern const ASN1_ARRAY_TYPE gnutls_asn1_tab[];
+extern const ASN1_ARRAY_TYPE pkix_asn1_tab[];
+
+LOG_FUNC _gnutls_log_func;
+int _gnutls_log_level = 0; /* default log level */
+
+ASN1_TYPE _gnutls_pkix1_asn;
+ASN1_TYPE _gnutls_gnutls_asn;
+
+/**
+ * gnutls_global_set_log_function - This function sets the logging function
+ * @log_func: it's a log function
+ *
+ * This is the function where you set the logging function gnutls
+ * is going to use. This function only accepts a character array.
+ * Normally you may not use this function since it is only used 
+ * for debugging purposes.
+ *
+ * gnutls_log_func is of the form, 
+ * void (*gnutls_log_func)( int level, const char*);
+ **/
+void gnutls_global_set_log_function(gnutls_log_func log_func)
+{
+  _gnutls_log_func = log_func;
+}
+
+/**
+ * gnutls_global_set_log_level - This function sets the logging level
+ * @level: it's an integer from 0 to 9. 
+ *
+ * This is the function that allows you to set the log level.
+ * The level is an integer between 0 and 9. Higher values mean
+ * more verbosity. The default value is 0. Larger values should
+ * only be used with care, since they may reveal sensitive information.
+ *
+ * Use a log level over 10 to enable all debugging options.
+ *
+ **/
+void gnutls_global_set_log_level(int level)
+{
+  _gnutls_log_level = level;
+}
+
+#ifdef DEBUG
+/* default logging function */
+static void
+dlog (int level, const char *str)
+  {
+    fputs (str, stderr);
+  }
+#endif
+
+extern gnutls_alloc_function gnutls_secure_malloc;
+extern gnutls_alloc_function gnutls_malloc;
+extern gnutls_free_function gnutls_free;
+extern int (*_gnutls_is_secure_memory)(const void *);
+extern gnutls_realloc_function gnutls_realloc;
+extern char *(*gnutls_strdup)(const char *);
+extern void *(*gnutls_calloc)(size_t,
+                              size_t);
+
+int _gnutls_is_secure_mem_null(const void *);
+
+/**
+ * gnutls_global_set_mem_functions - This function sets the memory allocation functions
+ * @alloc_func: it's the default memory allocation function. Like malloc().
+ * @secure_alloc_func: This is the memory allocation function that will be used for sensitive data.
+ * @is_secure_func: a function that returns 0 if the memory given is not secure. May be NULL.
+ * @realloc_func: A realloc function
+ * @free_func: The function that frees allocated data. Must accept a NULL pointer.
+ *
+ * This is the function were you set the memory allocation functions gnutls
+ * is going to use. By default the libc's allocation functions (malloc(), free()),
+ * are used by gnutls, to allocate both sensitive and not sensitive data.
+ * This function is provided to set the memory allocation functions to
+ * something other than the defaults (ie the gcrypt allocation functions). 
+ *
+ * This function must be called before gnutls_global_init() is called.
+ *
+ **/
+void gnutls_global_set_mem_functions(gnutls_alloc_function alloc_func,
+                                     gnutls_alloc_function
+                                     secure_alloc_func,
+                                     gnutls_is_secure_function
+                                     is_secure_func,
+                                     gnutls_realloc_function realloc_func,
+                                     gnutls_free_function free_func)
+{
+  gnutls_secure_malloc = secure_alloc_func;
+  gnutls_malloc = alloc_func;
+  gnutls_realloc = realloc_func;
+  gnutls_free = free_func;
+
+  if (is_secure_func != NULL)
+    _gnutls_is_secure_memory = is_secure_func;
+  else
+    _gnutls_is_secure_memory = _gnutls_is_secure_mem_null;
+
+  /* if using the libc's default malloc
+   * use libc's calloc as well.
+   */
+  if (gnutls_malloc == malloc)
+    {
+      gnutls_calloc = calloc;
+    }
+  else
+    { /* use the included ones */
+      gnutls_calloc = _gnutls_calloc;
+    }
+  gnutls_strdup = _gnutls_strdup;
+
+}
+
+#ifdef DEBUG
+static void
+_gnutls_gcry_log_handler (void *dummy, int level,
+    const char *fmt, va_list list)
+  {
+    _gnutls_log (fmt, list);
+  }
+#endif
+
+static int _gnutls_init = 0;
+
+/**
+ * gnutls_global_init - This function initializes the global data to defaults.
+ *
+ * This function initializes the global data to defaults.
+ * Every gnutls application has a global data which holds common parameters
+ * shared by gnutls session structures.
+ * You must call gnutls_global_deinit() when gnutls usage is no longer needed
+ * Returns zero on success.
+ *
+ * Note that this function will also initialize libgcrypt, if it has not
+ * been initialized before. Thus if you want to manually initialize libgcrypt
+ * you must do it before calling this function. This is useful in cases you 
+ * want to disable libgcrypt's internal lockings etc.
+ *
+ * This function increment a global counter, so that
+ * gnutls_global_deinit() only releases resources when it has been
+ * called as many times as gnutls_global_init().  This is useful when
+ * GnuTLS is used by more than one library in an application.  This
+ * function can be called many times, but will only do something the
+ * first time.
+ *
+ * Note!  This function is not thread safe.  If two threads call this
+ * function simultaneously, they can cause a race between checking
+ * the global counter and incrementing it, causing both threads to
+ * execute the library initialization code.  That would lead to a
+ * memory leak.  To handle this, your application could invoke this
+ * function after aquiring a thread mutex.  To ignore the potential
+ * memory leak is also an option.
+ *
+ **/
+int gnutls_global_init(void)
+{
+  int result = 0;
+  int res;
+  char c;
+
+  if (_gnutls_init++)
+    return;
+
+#if HAVE_WINSOCK
+    {
+      WORD requested;
+      WSADATA data;
+      int err;
+
+      requested = MAKEWORD (1, 1);
+      err = WSAStartup (requested, &data);
+      if (err != 0)
+        {
+          _gnutls_debug_log ("WSAStartup failed: %d.\n", err);
+          return GNUTLS_E_LIBRARY_VERSION_MISMATCH;
+        }
+
+      if (data.wVersion < requested)
+        {
+          _gnutls_debug_log ("WSAStartup version check failed (%d < %d).\n",
+              data.wVersion, requested);
+          WSACleanup ();
+          return GNUTLS_E_LIBRARY_VERSION_MISMATCH;
+        }
+    }
+#endif
+
+  // TODO rm ? bindtextdomain(PACKAGE, LOCALEDIR);
+
+  if (gcry_control(GCRYCTL_ANY_INITIALIZATION_P) == 0)
+    {
+      /* for gcrypt in order to be able to allocate memory */
+      gcry_set_allocation_handler(gnutls_malloc, gnutls_secure_malloc,
+                                  _gnutls_is_secure_memory, gnutls_realloc,
+                                  gnutls_free);
+
+      /* gcry_control (GCRYCTL_DISABLE_INTERNAL_LOCKING, NULL, 0); */
+
+      gcry_control(GCRYCTL_INITIALIZATION_FINISHED, NULL, 0);
+
+#ifdef DEBUG
+      /* applications may want to override that, so we only use
+       * it in debugging mode.
+       */
+      gcry_set_log_handler (_gnutls_gcry_log_handler, NULL);
+#endif
+    }
+
+  if (gc_init() != GC_OK)
+    {
+      gnutls_assert ();
+      _gnutls_debug_log ("Initializing crypto backend failed\n");
+      return GNUTLS_E_INCOMPATIBLE_CRYPTO_LIBRARY;
+    }
+
+#ifdef DEBUG
+  gnutls_global_set_log_function (dlog);
+#endif
+
+  /* initialize parser 
+   * This should not deal with files in the final
+   * version.
+   */
+
+  res = asn1_array2tree(pkix_asn1_tab, &_gnutls_pkix1_asn, NULL);
+  if (res != ASN1_SUCCESS)
+    {
+      result = _gnutls_asn2err(res);
+      return result;
+    }
+
+  res = asn1_array2tree(gnutls_asn1_tab, &_gnutls_gnutls_asn, NULL);
+  if (res != ASN1_SUCCESS)
+    {
+      asn1_delete_structure(&_gnutls_pkix1_asn);
+      result = _gnutls_asn2err(res);
+      return result;
+    }
+
+  /* Initialize the gcrypt (if used random generator) */
+  gc_pseudo_random(&c, 1);
+
+  return result;
+}
+
+/**
+ * gnutls_global_deinit - This function deinitializes the global data 
+ *
+ * This function deinitializes the global data, that were initialized
+ * using gnutls_global_init().
+ *
+ * Note!  This function is not thread safe.  See the discussion for
+ * gnutls_global_init() for more information.
+ *
+ **/
+void gnutls_global_deinit(void)
+{
+  if (_gnutls_init == 1)
+    {
+#if HAVE_WINSOCK
+      WSACleanup ();
+#endif
+      asn1_delete_structure(&_gnutls_gnutls_asn);
+      asn1_delete_structure(&_gnutls_pkix1_asn);
+      gc_done();
+    }
+  _gnutls_init--;
+}
+
+/* These functions should be elsewere. Kept here for 
+ * historical reasons.
+ */
+
+/**
+ * gnutls_transport_set_pull_function - This function sets a read like function
+ * @pull_func: a callback function similar to read()
+ * @session: gnutls session
+ *
+ * This is the function where you set a function for gnutls 
+ * to receive data. Normally, if you use berkeley style sockets,
+ * do not need to use this function since the default (recv(2)) will 
+ * probably be ok.
+ *
+ * PULL_FUNC is of the form, 
+ * ssize_t (*gnutls_pull_func)(gnutls_transport_ptr_t, void*, size_t);
+ **/
+void gnutls_transport_set_pull_function(gnutls_session_t session,
+                                        gnutls_pull_func pull_func)
+{
+  session->internals._gnutls_pull_func = pull_func;
+}
+
+/**
+ * gnutls_transport_set_push_function - This function sets the function to send data
+ * @push_func: a callback function similar to write()
+ * @session: gnutls session
+ *
+ * This is the function where you set a push function for gnutls
+ * to use in order to send data. If you are going to use berkeley style
+ * sockets, you do not need to use this function since
+ * the default (send(2)) will probably be ok. Otherwise you should
+ * specify this function for gnutls to be able to send data.
+ *  
+ * PUSH_FUNC is of the form, 
+ * ssize_t (*gnutls_push_func)(gnutls_transport_ptr_t, const void*, size_t);
+ **/
+void gnutls_transport_set_push_function(gnutls_session_t session,
+                                        gnutls_push_func push_func)
+{
+  session->internals._gnutls_push_func = push_func;
+}
+
+#include <strverscmp.h>
+
+/**
+ * gnutls_check_version - This function checks the library's version
+ * @req_version: the version to check
+ *
+ * Check that the version of the library is at minimum the requested one
+ * and return the version string; return NULL if the condition is not
+ * satisfied.  If a NULL is passed to this function, no check is done,
+ * but the version string is simply returned.
+ *
+ * See %LIBGNUTLS_VERSION for a suitable @req_version string.
+ *
+ * Return value: Version string of run-time library, or NULL if the
+ *   run-time library does not meet the required version number.  If
+ *   %NULL is passed to this function no check is done and only the
+ *   version string is returned.
+ **/
+const char * gnutls_check_version(const char *req_version)
+{
+  if (!req_version || strverscmp(req_version, VERSION) <= 0)
+    return VERSION;
+
+  return NULL;
+}
diff --git a/src/daemon/https/tls/gnutls_global.h b/src/daemon/https/tls/gnutls_global.h
new file mode 100644
index 00000000..3305ebad
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_global.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#ifndef GNUTLS_GLOBAL_H
+# define GNUTLS_GLOBAL_H
+
+#include <libtasn1.h>
+
+int gnutls_is_secure_memory (const void *mem);
+
+extern ASN1_TYPE _gnutls_pkix1_asn;
+extern ASN1_TYPE _gnutls_gnutls_asn;
+
+/* removed const from node_asn* to 
+ * prevent warnings, since libtasn1 doesn't
+ * use the const keywork in its functions.
+ */
+#define _gnutls_get_gnutls_asn() ((node_asn*) _gnutls_gnutls_asn)
+#define _gnutls_get_pkix() ((node_asn*) _gnutls_pkix1_asn)
+
+#endif
diff --git a/src/daemon/https/tls/gnutls_handshake.c b/src/daemon/https/tls/gnutls_handshake.c
new file mode 100644
index 00000000..1af07a91
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_handshake.c
@@ -0,0 +1,3029 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* Functions that relate to the TLS handshake procedure.
+ */
+
+#include "gnutls_int.h"
+#include "gnutls_errors.h"
+#include "gnutls_dh.h"
+#include "debug.h"
+#include "gnutls_algorithms.h"
+#include "gnutls_compress.h"
+#include "gnutls_cipher.h"
+#include "gnutls_buffers.h"
+#include "gnutls_kx.h"
+#include "gnutls_handshake.h"
+#include "gnutls_num.h"
+#include "gnutls_hash_int.h"
+#include "gnutls_db.h"
+#include "gnutls_extensions.h"
+#include "gnutls_supplemental.h"
+#include "gnutls_auth_int.h"
+#include "gnutls_v2_compat.h"
+#include "auth_cert.h"
+#include "gnutls_cert.h"
+#include "gnutls_constate.h"
+#include <gnutls_record.h>
+#include <gnutls_state.h>
+#include <gnutls_rsa_export.h>  /* for gnutls_get_rsa_params() */
+#include <auth_anon.h>          /* for gnutls_anon_server_credentials_t */
+#include <gc.h>
+
+#ifdef HANDSHAKE_DEBUG
+#define ERR(x, y) _gnutls_handshake_log( "HSK[%x]: %s (%d)\n", session, x,y)
+#else
+#define ERR(x, y)
+#endif
+
+#define TRUE 1
+#define FALSE 0
+
+int _gnutls_server_select_comp_method (gnutls_session_t session,
+                                       opaque * data, int datalen);
+
+
+/* Clears the handshake hash buffers and handles.
+ */
+inline static void
+_gnutls_handshake_hash_buffers_clear (gnutls_session_t session)
+{
+  _gnutls_hash_deinit (session->internals.handshake_mac_handle_md5, NULL);
+  _gnutls_hash_deinit (session->internals.handshake_mac_handle_sha, NULL);
+  session->internals.handshake_mac_handle_md5 = NULL;
+  session->internals.handshake_mac_handle_sha = NULL;
+  _gnutls_handshake_buffer_clear (session);
+}
+
+/* this will copy the required values for resuming to 
+ * internals, and to security_parameters.
+ * this will keep as less data to security_parameters.
+ */
+static void
+resume_copy_required_values (gnutls_session_t session)
+{
+  /* get the new random values */
+  memcpy (session->internals.resumed_security_parameters.
+          server_random,
+          session->security_parameters.server_random, TLS_RANDOM_SIZE);
+  memcpy (session->internals.resumed_security_parameters.
+          client_random,
+          session->security_parameters.client_random, TLS_RANDOM_SIZE);
+
+  /* keep the ciphersuite and compression 
+   * That is because the client must see these in our
+   * hello message.
+   */
+  memcpy (session->security_parameters.current_cipher_suite.
+          suite,
+          session->internals.resumed_security_parameters.
+          current_cipher_suite.suite, 2);
+
+  session->internals.compression_method =
+    session->internals.resumed_security_parameters.read_compression_algorithm;
+  /* or write_compression_algorithm
+   * they are the same
+   */
+
+  session->security_parameters.entity =
+    session->internals.resumed_security_parameters.entity;
+
+  _gnutls_set_current_version (session,
+                               session->internals.
+                               resumed_security_parameters.version);
+
+  session->security_parameters.cert_type =
+    session->internals.resumed_security_parameters.cert_type;
+
+  memcpy (session->security_parameters.session_id,
+          session->internals.resumed_security_parameters.
+          session_id, sizeof (session->security_parameters.session_id));
+  session->security_parameters.session_id_size =
+    session->internals.resumed_security_parameters.session_id_size;
+}
+
+void
+_gnutls_set_server_random (gnutls_session_t session, uint8_t * rnd)
+{
+  memcpy (session->security_parameters.server_random, rnd, TLS_RANDOM_SIZE);
+}
+
+void
+_gnutls_set_client_random (gnutls_session_t session, uint8_t * rnd)
+{
+  memcpy (session->security_parameters.client_random, rnd, TLS_RANDOM_SIZE);
+}
+
+/* Calculate The SSL3 Finished message 
+ */
+#define SSL3_CLIENT_MSG "CLNT"
+#define SSL3_SERVER_MSG "SRVR"
+#define SSL_MSG_LEN 4
+static int
+_gnutls_ssl3_finished (gnutls_session_t session, int type, opaque * ret)
+{
+  const int siz = SSL_MSG_LEN;
+  mac_hd_t td_md5;
+  mac_hd_t td_sha;
+  const char *mesg;
+
+  td_md5 = _gnutls_hash_copy (session->internals.handshake_mac_handle_md5);
+  if (td_md5 == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_HASH_FAILED;
+    }
+
+  td_sha = _gnutls_hash_copy (session->internals.handshake_mac_handle_sha);
+  if (td_sha == NULL)
+    {
+      gnutls_assert ();
+      _gnutls_hash_deinit (td_md5, NULL);
+      return GNUTLS_E_HASH_FAILED;
+    }
+
+  if (type == GNUTLS_SERVER)
+    {
+      mesg = SSL3_SERVER_MSG;
+    }
+  else
+    {
+      mesg = SSL3_CLIENT_MSG;
+    }
+
+  _gnutls_hash (td_md5, mesg, siz);
+  _gnutls_hash (td_sha, mesg, siz);
+
+  _gnutls_mac_deinit_ssl3_handshake (td_md5, ret,
+                                     session->security_parameters.
+                                     master_secret, TLS_MASTER_SIZE);
+  _gnutls_mac_deinit_ssl3_handshake (td_sha, &ret[16],
+                                     session->security_parameters.
+                                     master_secret, TLS_MASTER_SIZE);
+
+  return 0;
+}
+
+/* Hash the handshake messages as required by TLS 1.0 
+ */
+#define SERVER_MSG "server finished"
+#define CLIENT_MSG "client finished"
+#define TLS_MSG_LEN 15
+int
+_gnutls_finished (gnutls_session_t session, int type, void *ret)
+{
+  const int siz = TLS_MSG_LEN;
+  opaque concat[36];
+  size_t len;
+  const char *mesg;
+  mac_hd_t td_md5 = NULL;
+  mac_hd_t td_sha;
+  gnutls_protocol_t ver = gnutls_protocol_get_version (session);
+
+  if (ver < GNUTLS_TLS1_2)
+    {
+      td_md5 =
+        _gnutls_hash_copy (session->internals.handshake_mac_handle_md5);
+      if (td_md5 == NULL)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_HASH_FAILED;
+        }
+    }
+
+  td_sha = _gnutls_hash_copy (session->internals.handshake_mac_handle_sha);
+  if (td_sha == NULL)
+    {
+      gnutls_assert ();
+      _gnutls_hash_deinit (td_md5, NULL);
+      return GNUTLS_E_HASH_FAILED;
+    }
+
+  if (ver < GNUTLS_TLS1_2)
+    {
+      _gnutls_hash_deinit (td_md5, concat);
+      _gnutls_hash_deinit (td_sha, &concat[16]);
+      len = 20 + 16;
+    }
+  else
+    {
+      _gnutls_hash_deinit (td_sha, concat);
+      len = 20;
+    }
+
+  if (type == GNUTLS_SERVER)
+    {
+      mesg = SERVER_MSG;
+    }
+  else
+    {
+      mesg = CLIENT_MSG;
+    }
+
+  return _gnutls_PRF (session, session->security_parameters.master_secret,
+                      TLS_MASTER_SIZE, mesg, siz, concat, len, 12, ret);
+}
+
+/* this function will produce TLS_RANDOM_SIZE==32 bytes of random data
+ * and put it to dst.
+ */
+int
+_gnutls_tls_create_random (opaque * dst)
+{
+  uint32_t tim;
+
+  /* Use weak random numbers for the most of the
+   * buffer except for the first 4 that are the
+   * system's time.
+   */
+
+  tim = time (NULL);
+  /* generate server random value */
+  _gnutls_write_uint32 (tim, dst);
+
+  if (gc_nonce (&dst[4], TLS_RANDOM_SIZE - 4) != GC_OK)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_RANDOM_FAILED;
+    }
+
+  return 0;
+}
+
+/* returns the 0 on success or a negative value.
+ */
+int
+_gnutls_negotiate_version (gnutls_session_t session,
+                           gnutls_protocol_t adv_version)
+{
+  int ret;
+
+  /* if we do not support that version  */
+  if (_gnutls_version_is_supported (session, adv_version) == 0)
+    {
+      /* If he requested something we do not support
+       * then we send him the highest we support.
+       */
+      ret = _gnutls_version_max (session);
+      if (ret == GNUTLS_VERSION_UNKNOWN)
+        {
+          /* this check is not really needed.
+           */
+          gnutls_assert ();
+          return GNUTLS_E_UNKNOWN_CIPHER_SUITE;
+        }
+    }
+  else
+    {
+      ret = adv_version;
+    }
+
+  _gnutls_set_current_version (session, ret);
+
+  return ret;
+}
+
+int
+_gnutls_user_hello_func (gnutls_session session,
+                         gnutls_protocol_t adv_version)
+{
+  int ret;
+
+  if (session->internals.user_hello_func != NULL)
+    {
+      ret = session->internals.user_hello_func (session);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+      /* Here we need to renegotiate the version since the callee might
+       * have disabled some TLS versions.
+       */
+      ret = _gnutls_negotiate_version (session, adv_version);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+    }
+  return 0;
+}
+
+/* Read a client hello packet. 
+ * A client hello must be a known version client hello
+ * or version 2.0 client hello (only for compatibility
+ * since SSL version 2.0 is not supported).
+ */
+int
+_gnutls_read_client_hello (gnutls_session_t session, opaque * data,
+                           int datalen)
+{
+  uint8_t session_id_len;
+  int pos = 0, ret;
+  uint16_t suite_size, comp_size;
+  gnutls_protocol_t adv_version;
+  int neg_version;
+  int len = datalen;
+  opaque rnd[TLS_RANDOM_SIZE], *suite_ptr, *comp_ptr;
+
+  if (session->internals.v2_hello != 0)
+    {                           /* version 2.0 */
+      return _gnutls_read_client_hello_v2 (session, data, datalen);
+    }
+  DECR_LEN (len, 2);
+
+  _gnutls_handshake_log ("HSK[%x]: Client's version: %d.%d\n", session,
+                         data[pos], data[pos + 1]);
+
+  adv_version = _gnutls_version_get (data[pos], data[pos + 1]);
+  set_adv_version (session, data[pos], data[pos + 1]);
+  pos += 2;
+
+  neg_version = _gnutls_negotiate_version (session, adv_version);
+  if (neg_version < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  /* Read client random value.
+   */
+  DECR_LEN (len, TLS_RANDOM_SIZE);
+  _gnutls_set_client_random (session, &data[pos]);
+  pos += TLS_RANDOM_SIZE;
+
+  _gnutls_tls_create_random (rnd);
+  _gnutls_set_server_random (session, rnd);
+
+  session->security_parameters.timestamp = time (NULL);
+
+  DECR_LEN (len, 1);
+  session_id_len = data[pos++];
+
+  /* RESUME SESSION 
+   */
+  if (session_id_len > TLS_MAX_SESSION_ID_SIZE)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+    }
+  DECR_LEN (len, session_id_len);
+
+  ret = _gnutls_server_restore_session (session, &data[pos], session_id_len);
+  pos += session_id_len;
+
+  if (ret == 0)
+    {                           /* resumed! */
+      resume_copy_required_values (session);
+      session->internals.resumed = RESUME_TRUE;
+      return _gnutls_user_hello_func (session, adv_version);
+    }
+  else
+    {
+      _gnutls_generate_session_id (session->security_parameters.
+                                   session_id,
+                                   &session->security_parameters.
+                                   session_id_size);
+
+      session->internals.resumed = RESUME_FALSE;
+    }
+
+  /* Remember ciphersuites for later
+   */
+  DECR_LEN (len, 2);
+  suite_size = _gnutls_read_uint16 (&data[pos]);
+  pos += 2;
+
+  DECR_LEN (len, suite_size);
+  suite_ptr = &data[pos];
+  pos += suite_size;
+
+  /* Point to the compression methods
+   */
+  DECR_LEN (len, 1);
+  comp_size = data[pos++];      /* z is the number of compression methods */
+
+  DECR_LEN (len, comp_size);
+  comp_ptr = &data[pos];
+  pos += comp_size;
+
+  /* Parse the extensions (if any)
+   */
+  if (neg_version >= GNUTLS_TLS1)
+    {
+      ret = _gnutls_parse_extensions (session, EXTENSION_APPLICATION, &data[pos], len); /* len is the rest of the parsed length */
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+    }
+
+  ret = _gnutls_user_hello_func (session, adv_version);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  if (neg_version >= GNUTLS_TLS1)
+    {
+      ret = _gnutls_parse_extensions (session, EXTENSION_TLS, &data[pos], len); /* len is the rest of the parsed length */
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+    }
+
+  /* select an appropriate cipher suite
+   */
+  ret = _gnutls_server_select_suite (session, suite_ptr, suite_size);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  /* select appropriate compression method */
+  ret = _gnutls_server_select_comp_method (session, comp_ptr, comp_size);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return 0;
+}
+
+/* here we hash all pending data. 
+ */
+inline static int
+_gnutls_handshake_hash_pending (gnutls_session_t session)
+{
+  size_t siz;
+  int ret;
+  opaque *data;
+
+  if (session->internals.handshake_mac_handle_sha == NULL ||
+      session->internals.handshake_mac_handle_md5 == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  /* We check if there are pending data to hash.
+   */
+  if ((ret = _gnutls_handshake_buffer_get_ptr (session, &data, &siz)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  if (siz > 0)
+    {
+      _gnutls_hash (session->internals.handshake_mac_handle_sha, data, siz);
+      _gnutls_hash (session->internals.handshake_mac_handle_md5, data, siz);
+    }
+
+  _gnutls_handshake_buffer_empty (session);
+
+  return 0;
+}
+
+
+/* This is to be called after sending CHANGE CIPHER SPEC packet
+ * and initializing encryption. This is the first encrypted message
+ * we send.
+ */
+int
+_gnutls_send_finished (gnutls_session_t session, int again)
+{
+  uint8_t data[36];
+  int ret;
+  int data_size = 0;
+
+
+  if (again == 0)
+    {
+
+      /* This is needed in order to hash all the required
+       * messages.
+       */
+      if ((ret = _gnutls_handshake_hash_pending (session)) < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      if (gnutls_protocol_get_version (session) == GNUTLS_SSL3)
+        {
+          ret =
+            _gnutls_ssl3_finished (session,
+                                   session->security_parameters.entity, data);
+          data_size = 36;
+        }
+      else
+        {                       /* TLS 1.0 */
+          ret =
+            _gnutls_finished (session,
+                              session->security_parameters.entity, data);
+          data_size = 12;
+        }
+
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+    }
+
+  ret =
+    _gnutls_send_handshake (session, data, data_size,
+                            GNUTLS_HANDSHAKE_FINISHED);
+
+  return ret;
+}
+
+/* This is to be called after sending our finished message. If everything
+ * went fine we have negotiated a secure connection 
+ */
+int
+_gnutls_recv_finished (gnutls_session_t session)
+{
+  uint8_t data[36], *vrfy;
+  int data_size;
+  int ret;
+  int vrfysize;
+
+  ret =
+    _gnutls_recv_handshake (session, &vrfy, &vrfysize,
+                            GNUTLS_HANDSHAKE_FINISHED, MANDATORY_PACKET);
+  if (ret < 0)
+    {
+      ERR ("recv finished int", ret);
+      gnutls_assert ();
+      return ret;
+    }
+
+
+  if (gnutls_protocol_get_version (session) == GNUTLS_SSL3)
+    {
+      data_size = 36;
+    }
+  else
+    {
+      data_size = 12;
+    }
+
+  if (vrfysize != data_size)
+    {
+      gnutls_assert ();
+      gnutls_free (vrfy);
+      return GNUTLS_E_ERROR_IN_FINISHED_PACKET;
+    }
+
+  if (gnutls_protocol_get_version (session) == GNUTLS_SSL3)
+    {
+      ret =
+        _gnutls_ssl3_finished (session,
+                               (session->security_parameters.
+                                entity + 1) % 2, data);
+    }
+  else
+    {                           /* TLS 1.0 */
+      ret =
+        _gnutls_finished (session,
+                          (session->security_parameters.entity +
+                           1) % 2, data);
+    }
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      gnutls_free (vrfy);
+      return ret;
+    }
+
+  if (memcmp (vrfy, data, data_size) != 0)
+    {
+      gnutls_assert ();
+      ret = GNUTLS_E_ERROR_IN_FINISHED_PACKET;
+    }
+  gnutls_free (vrfy);
+
+  return ret;
+}
+
+/* returns PK_RSA if the given cipher suite list only supports,
+ * RSA algorithms, PK_DSA if DSS, and PK_ANY for both or PK_NONE for none.
+ */
+static int
+_gnutls_server_find_pk_algos_in_ciphersuites (const opaque *
+                                              data, int datalen)
+{
+  int j;
+  gnutls_pk_algorithm_t algo = GNUTLS_PK_NONE, prev_algo = 0;
+  gnutls_kx_algorithm_t kx;
+  cipher_suite_st cs;
+
+  if (datalen % 2 != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+    }
+
+  for (j = 0; j < datalen; j += 2)
+    {
+      memcpy (&cs.suite, &data[j], 2);
+      kx = _gnutls_cipher_suite_get_kx_algo (&cs);
+
+      if (_gnutls_map_kx_get_cred (kx, 1) == GNUTLS_CRD_CERTIFICATE)
+        {
+          algo = _gnutls_map_pk_get_pk (kx);
+
+          if (algo != prev_algo && prev_algo != 0)
+            return GNUTLS_PK_ANY;
+          prev_algo = algo;
+        }
+    }
+
+  return algo;
+}
+
+
+/* This selects the best supported ciphersuite from the given ones. Then
+ * it adds the suite to the session and performs some checks.
+ */
+int
+_gnutls_server_select_suite (gnutls_session_t session, opaque * data,
+                             int datalen)
+{
+  int x, i, j;
+  cipher_suite_st *ciphers, cs;
+  int retval, err;
+  gnutls_pk_algorithm_t pk_algo;        /* will hold the pk algorithms
+                                         * supported by the peer.
+                                         */
+
+  pk_algo = _gnutls_server_find_pk_algos_in_ciphersuites (data, datalen);
+
+  x = _gnutls_supported_ciphersuites (session, &ciphers);
+  if (x < 0)
+    {                           /* the case x==0 is handled within the function. */
+      gnutls_assert ();
+      return x;
+    }
+
+  /* Here we remove any ciphersuite that does not conform
+   * the certificate requested, or to the
+   * authentication requested (e.g. SRP).
+   */
+  x = _gnutls_remove_unwanted_ciphersuites (session, &ciphers, x, pk_algo);
+  if (x <= 0)
+    {
+      gnutls_assert ();
+      gnutls_free (ciphers);
+      if (x < 0)
+        return x;
+      else
+        return GNUTLS_E_UNKNOWN_CIPHER_SUITE;
+    }
+
+  /* Data length should be zero mod 2 since
+   * every ciphersuite is 2 bytes. (this check is needed
+   * see below).
+   */
+  if (datalen % 2 != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+    }
+#ifdef HANDSHAKE_DEBUG
+
+  _gnutls_handshake_log ("HSK[%x]: Requested cipher suites: \n", session);
+  for (j = 0; j < datalen; j += 2)
+    {
+      memcpy (&cs.suite, &data[j], 2);
+      _gnutls_handshake_log ("\t%s\n", _gnutls_cipher_suite_get_name (&cs));
+    }
+  _gnutls_handshake_log ("HSK[%x]: Supported cipher suites: \n", session);
+  for (j = 0; j < x; j++)
+    _gnutls_handshake_log ("\t%s\n",
+                           _gnutls_cipher_suite_get_name (&ciphers[j]));
+#endif
+  memset (session->security_parameters.current_cipher_suite.suite, '\0', 2);
+
+  retval = GNUTLS_E_UNKNOWN_CIPHER_SUITE;
+
+  for (j = 0; j < datalen; j += 2)
+    {
+      for (i = 0; i < x; i++)
+        {
+          if (memcmp (ciphers[i].suite, &data[j], 2) == 0)
+            {
+              memcpy (&cs.suite, &data[j], 2);
+
+              _gnutls_handshake_log
+                ("HSK[%x]: Selected cipher suite: %s\n", session,
+                 _gnutls_cipher_suite_get_name (&cs));
+              memcpy (session->security_parameters.current_cipher_suite.
+                      suite, ciphers[i].suite, 2);
+              retval = 0;
+              goto finish;
+            }
+        }
+    }
+
+finish:
+  gnutls_free (ciphers);
+
+  if (retval != 0)
+    {
+      gnutls_assert ();
+      return retval;
+    }
+
+  /* check if the credentials (username, public key etc.) are ok
+   */
+  if (_gnutls_get_kx_cred
+      (session,
+       _gnutls_cipher_suite_get_kx_algo (&session->security_parameters.
+                                         current_cipher_suite),
+       &err) == NULL && err != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
+    }
+
+
+  /* set the mod_auth_st to the appropriate struct
+   * according to the KX algorithm. This is needed since all the
+   * handshake functions are read from there;
+   */
+  session->internals.auth_struct =
+    _gnutls_kx_auth_struct (_gnutls_cipher_suite_get_kx_algo
+                            (&session->security_parameters.
+                             current_cipher_suite));
+  if (session->internals.auth_struct == NULL)
+    {
+
+      _gnutls_handshake_log
+        ("HSK[%x]: Cannot find the appropriate handler for the KX algorithm\n",
+         session);
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  return 0;
+
+}
+
+
+/* This selects the best supported compression method from the ones provided 
+ */
+int
+_gnutls_server_select_comp_method (gnutls_session_t session,
+                                   opaque * data, int datalen)
+{
+  int x, i, j;
+  uint8_t *comps;
+
+  x = _gnutls_supported_compression_methods (session, &comps);
+  if (x < 0)
+    {
+      gnutls_assert ();
+      return x;
+    }
+
+  memset (&session->internals.compression_method, 0,
+          sizeof (gnutls_compression_method_t));
+
+  for (j = 0; j < datalen; j++)
+    {
+      for (i = 0; i < x; i++)
+        {
+          if (comps[i] == data[j])
+            {
+              gnutls_compression_method_t method =
+                _gnutls_compression_get_id (comps[i]);
+
+              session->internals.compression_method = method;
+              gnutls_free (comps);
+
+              _gnutls_handshake_log
+                ("HSK[%x]: Selected Compression Method: %s\n", session,
+                 gnutls_compression_get_name (session->internals.
+                                              compression_method));
+
+
+              return 0;
+            }
+        }
+    }
+
+  /* we were not able to find a compatible compression
+   * algorithm
+   */
+  gnutls_free (comps);
+  gnutls_assert ();
+  return GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM;
+
+}
+
+/* This function sends an empty handshake packet. (like hello request).
+ * If the previous _gnutls_send_empty_handshake() returned
+ * GNUTLS_E_AGAIN or GNUTLS_E_INTERRUPTED, then it must be called again 
+ * (until it returns ok), with NULL parameters.
+ */
+int
+_gnutls_send_empty_handshake (gnutls_session_t session,
+                              gnutls_handshake_description_t type, int again)
+{
+  opaque data = 0;
+  opaque *ptr;
+
+  if (again == 0)
+    ptr = &data;
+  else
+    ptr = NULL;
+
+  return _gnutls_send_handshake (session, ptr, 0, type);
+}
+
+
+/* This function will hash the handshake message we sent.
+ */
+static int
+_gnutls_handshake_hash_add_sent (gnutls_session_t session,
+                                 gnutls_handshake_description_t type,
+                                 opaque * dataptr, uint32_t datalen)
+{
+  int ret;
+
+  if ((ret = _gnutls_handshake_hash_pending (session)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  if (type != GNUTLS_HANDSHAKE_HELLO_REQUEST)
+    {
+      _gnutls_hash (session->internals.handshake_mac_handle_sha, dataptr,
+                    datalen);
+      _gnutls_hash (session->internals.handshake_mac_handle_md5, dataptr,
+                    datalen);
+    }
+
+  return 0;
+}
+
+
+/* This function sends a handshake message of type 'type' containing the
+ * data specified here. If the previous _gnutls_send_handshake() returned
+ * GNUTLS_E_AGAIN or GNUTLS_E_INTERRUPTED, then it must be called again 
+ * (until it returns ok), with NULL parameters.
+ */
+int
+_gnutls_send_handshake (gnutls_session_t session, void *i_data,
+                        uint32_t i_datasize,
+                        gnutls_handshake_description_t type)
+{
+  int ret;
+  uint8_t *data;
+  uint32_t datasize;
+  int pos = 0;
+
+  if (i_data == NULL && i_datasize == 0)
+    {
+      /* we are resuming a previously interrupted
+       * send.
+       */
+      ret = _gnutls_handshake_io_write_flush (session);
+      return ret;
+
+    }
+
+  if (i_data == NULL && i_datasize > 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* first run */
+  datasize = i_datasize + HANDSHAKE_HEADER_SIZE;
+  data = gnutls_alloca (datasize);
+  if (data == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  data[pos++] = (uint8_t) type;
+  _gnutls_write_uint24 (i_datasize, &data[pos]);
+  pos += 3;
+
+  if (i_datasize > 0)
+    memcpy (&data[pos], i_data, i_datasize);
+
+  _gnutls_handshake_log ("HSK[%x]: %s was send [%ld bytes]\n",
+                         session, _gnutls_handshake2str (type), datasize);
+
+
+  /* Here we keep the handshake messages in order to hash them...
+   */
+  if (type != GNUTLS_HANDSHAKE_HELLO_REQUEST)
+    if ((ret =
+         _gnutls_handshake_hash_add_sent (session, type, data, datasize)) < 0)
+      {
+        gnutls_assert ();
+        gnutls_afree (data);
+        return ret;
+      }
+
+  session->internals.last_handshake_out = type;
+
+  ret =
+    _gnutls_handshake_io_send_int (session, GNUTLS_HANDSHAKE, type,
+                                   data, datasize);
+
+  gnutls_afree (data);
+
+  return ret;
+}
+
+/* This function will read the handshake header and return it to the caller. If the
+ * received handshake packet is not the one expected then it buffers the header, and
+ * returns UNEXPECTED_HANDSHAKE_PACKET.
+ *
+ * FIXME: This function is complex.
+ */
+#define SSL2_HEADERS 1
+static int
+_gnutls_recv_handshake_header (gnutls_session_t session,
+                               gnutls_handshake_description_t type,
+                               gnutls_handshake_description_t * recv_type)
+{
+  int ret;
+  uint32_t length32 = 0;
+  uint8_t *dataptr = NULL;      /* for realloc */
+  size_t handshake_header_size = HANDSHAKE_HEADER_SIZE;
+
+  /* if we have data into the buffer then return them, do not read the next packet.
+   * In order to return we need a full TLS handshake header, or in case of a version 2
+   * packet, then we return the first byte.
+   */
+  if (session->internals.handshake_header_buffer.header_size ==
+      handshake_header_size || (session->internals.v2_hello != 0
+                                && type == GNUTLS_HANDSHAKE_CLIENT_HELLO
+                                && session->internals.
+                                handshake_header_buffer.packet_length > 0))
+    {
+
+      *recv_type = session->internals.handshake_header_buffer.recv_type;
+
+      return session->internals.handshake_header_buffer.packet_length;
+    }
+
+  /* Note: SSL2_HEADERS == 1 */
+
+  dataptr = session->internals.handshake_header_buffer.header;
+
+  /* If we haven't already read the handshake headers.
+   */
+  if (session->internals.handshake_header_buffer.header_size < SSL2_HEADERS)
+    {
+      ret =
+        _gnutls_handshake_io_recv_int (session, GNUTLS_HANDSHAKE,
+                                       type, dataptr, SSL2_HEADERS);
+
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      /* The case ret==0 is caught here.
+       */
+      if (ret != SSL2_HEADERS)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+        }
+      session->internals.handshake_header_buffer.header_size = SSL2_HEADERS;
+    }
+
+  if (session->internals.v2_hello == 0
+      || type != GNUTLS_HANDSHAKE_CLIENT_HELLO)
+    {
+      ret =
+        _gnutls_handshake_io_recv_int (session, GNUTLS_HANDSHAKE,
+                                       type,
+                                       &dataptr[session->
+                                                internals.
+                                                handshake_header_buffer.
+                                                header_size],
+                                       HANDSHAKE_HEADER_SIZE -
+                                       session->internals.
+                                       handshake_header_buffer.header_size);
+      if (ret <= 0)
+        {
+          gnutls_assert ();
+          return (ret < 0) ? ret : GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+        }
+      if ((size_t) ret !=
+          HANDSHAKE_HEADER_SIZE -
+          session->internals.handshake_header_buffer.header_size)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+        }
+      *recv_type = dataptr[0];
+
+      /* we do not use DECR_LEN because we know
+       * that the packet has enough data.
+       */
+      length32 = _gnutls_read_uint24 (&dataptr[1]);
+      handshake_header_size = HANDSHAKE_HEADER_SIZE;
+
+      _gnutls_handshake_log ("HSK[%x]: %s was received [%ld bytes]\n",
+                             session, _gnutls_handshake2str (dataptr[0]),
+                             length32 + HANDSHAKE_HEADER_SIZE);
+
+    }
+  else
+    {                           /* v2 hello */
+      length32 = session->internals.v2_hello - SSL2_HEADERS;    /* we've read the first byte */
+
+      handshake_header_size = SSL2_HEADERS;     /* we've already read one byte */
+
+      *recv_type = dataptr[0];
+
+      _gnutls_handshake_log ("HSK[%x]: %s(v2) was received [%ld bytes]\n",
+                             session, _gnutls_handshake2str (*recv_type),
+                             length32 + handshake_header_size);
+
+      if (*recv_type != GNUTLS_HANDSHAKE_CLIENT_HELLO)
+        {                       /* it should be one or nothing */
+          gnutls_assert ();
+          return GNUTLS_E_UNEXPECTED_HANDSHAKE_PACKET;
+        }
+    }
+
+  /* put the packet into the buffer */
+  session->internals.handshake_header_buffer.header_size =
+    handshake_header_size;
+  session->internals.handshake_header_buffer.packet_length = length32;
+  session->internals.handshake_header_buffer.recv_type = *recv_type;
+
+  if (*recv_type != type)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNEXPECTED_HANDSHAKE_PACKET;
+    }
+
+  return length32;
+}
+
+#define _gnutls_handshake_header_buffer_clear( session) session->internals.handshake_header_buffer.header_size = 0
+
+
+
+/* This function will hash the handshake headers and the
+ * handshake data.
+ */
+static int
+_gnutls_handshake_hash_add_recvd (gnutls_session_t session,
+                                  gnutls_handshake_description_t recv_type,
+                                  opaque * header, uint16_t header_size,
+                                  opaque * dataptr, uint32_t datalen)
+{
+  int ret;
+
+  /* The idea here is to hash the previous message we received,
+   * and add the one we just received into the handshake_hash_buffer.
+   */
+
+  if ((ret = _gnutls_handshake_hash_pending (session)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  /* here we buffer the handshake messages - needed at Finished message */
+  if (recv_type != GNUTLS_HANDSHAKE_HELLO_REQUEST)
+    {
+
+      if ((ret =
+           _gnutls_handshake_buffer_put (session, header, header_size)) < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      if (datalen > 0)
+        {
+          if ((ret =
+               _gnutls_handshake_buffer_put (session, dataptr, datalen)) < 0)
+            {
+              gnutls_assert ();
+              return ret;
+            }
+        }
+    }
+
+  return 0;
+}
+
+
+/* This function will receive handshake messages of the given types,
+ * and will pass the message to the right place in order to be processed.
+ * E.g. for the SERVER_HELLO message (if it is expected), it will be
+ * passed to _gnutls_recv_hello().
+ */
+int
+_gnutls_recv_handshake (gnutls_session_t session, uint8_t ** data,
+                        int *datalen, gnutls_handshake_description_t type,
+                        Optional optional)
+{
+  int ret;
+  uint32_t length32 = 0;
+  opaque *dataptr = NULL;
+  gnutls_handshake_description_t recv_type;
+
+  ret = _gnutls_recv_handshake_header (session, type, &recv_type);
+  if (ret < 0)
+    {
+
+      if (ret == GNUTLS_E_UNEXPECTED_HANDSHAKE_PACKET
+          && optional == OPTIONAL_PACKET)
+        {
+          if (datalen != NULL)
+            *datalen = 0;
+          if (data != NULL)
+            *data = NULL;
+          return 0;             /* ok just ignore the packet */
+        }
+
+      return ret;
+    }
+
+  session->internals.last_handshake_in = recv_type;
+
+  length32 = ret;
+
+  if (length32 > 0)
+    dataptr = gnutls_malloc (length32);
+  else if (recv_type != GNUTLS_HANDSHAKE_SERVER_HELLO_DONE)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+    }
+
+  if (dataptr == NULL && length32 > 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  if (datalen != NULL)
+    *datalen = length32;
+
+  if (length32 > 0)
+    {
+      ret =
+        _gnutls_handshake_io_recv_int (session, GNUTLS_HANDSHAKE,
+                                       type, dataptr, length32);
+      if (ret <= 0)
+        {
+          gnutls_assert ();
+          gnutls_free (dataptr);
+          return (ret == 0) ? GNUTLS_E_UNEXPECTED_PACKET_LENGTH : ret;
+        }
+    }
+
+  if (data != NULL && length32 > 0)
+    *data = dataptr;
+
+
+  ret = _gnutls_handshake_hash_add_recvd (session, recv_type,
+                                          session->internals.
+                                          handshake_header_buffer.header,
+                                          session->internals.
+                                          handshake_header_buffer.
+                                          header_size, dataptr, length32);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      _gnutls_handshake_header_buffer_clear (session);
+      return ret;
+    }
+
+  /* If we fail before this then we will reuse the handshake header
+   * have have received above. if we get here the we clear the handshake
+   * header we received.
+   */
+  _gnutls_handshake_header_buffer_clear (session);
+
+  switch (recv_type)
+    {
+    case GNUTLS_HANDSHAKE_CLIENT_HELLO:
+    case GNUTLS_HANDSHAKE_SERVER_HELLO:
+      ret = _gnutls_recv_hello (session, dataptr, length32);
+      /* dataptr is freed because the caller does not
+       * need it */
+      gnutls_free (dataptr);
+      if (data != NULL)
+        *data = NULL;
+      break;
+    case GNUTLS_HANDSHAKE_SERVER_HELLO_DONE:
+      if (length32 == 0)
+        ret = 0;
+      else
+        ret = GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+      break;
+    case GNUTLS_HANDSHAKE_CERTIFICATE_PKT:
+    case GNUTLS_HANDSHAKE_FINISHED:
+    case GNUTLS_HANDSHAKE_SERVER_KEY_EXCHANGE:
+    case GNUTLS_HANDSHAKE_CLIENT_KEY_EXCHANGE:
+    case GNUTLS_HANDSHAKE_CERTIFICATE_REQUEST:
+    case GNUTLS_HANDSHAKE_CERTIFICATE_VERIFY:
+    case GNUTLS_HANDSHAKE_SUPPLEMENTAL:
+      ret = length32;
+      break;
+    default:
+      gnutls_assert ();
+      gnutls_free (dataptr);
+      if (data != NULL)
+        *data = NULL;
+      ret = GNUTLS_E_UNEXPECTED_HANDSHAKE_PACKET;
+    }
+
+  return ret;
+}
+
+/* This function checks if the given cipher suite is supported, and sets it
+ * to the session;
+ */
+static int
+_gnutls_client_set_ciphersuite (gnutls_session_t session, opaque suite[2])
+{
+  uint8_t z;
+  cipher_suite_st *cipher_suites;
+  int cipher_suite_num;
+  int i, err;
+
+  z = 1;
+  cipher_suite_num = _gnutls_supported_ciphersuites (session, &cipher_suites);
+  if (cipher_suite_num < 0)
+    {
+      gnutls_assert ();
+      return cipher_suite_num;
+    }
+
+  for (i = 0; i < cipher_suite_num; i++)
+    {
+      if (memcmp (&cipher_suites[i], suite, 2) == 0)
+        {
+          z = 0;
+          break;
+        }
+    }
+
+  gnutls_free (cipher_suites);
+
+  if (z != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNKNOWN_CIPHER_SUITE;
+    }
+
+  memcpy (session->security_parameters.current_cipher_suite.suite, suite, 2);
+
+  _gnutls_handshake_log ("HSK[%x]: Selected cipher suite: %s\n", session,
+                         _gnutls_cipher_suite_get_name (&session->
+                                                        security_parameters.
+                                                        current_cipher_suite));
+
+
+  /* check if the credentials (username, public key etc.) are ok.
+   * Actually checks if they exist.
+   */
+  if (_gnutls_get_kx_cred
+      (session, _gnutls_cipher_suite_get_kx_algo (&session->
+                                                  security_parameters.
+                                                  current_cipher_suite),
+       &err) == NULL && err != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
+    }
+
+
+  /* set the mod_auth_st to the appropriate struct
+   * according to the KX algorithm. This is needed since all the
+   * handshake functions are read from there;
+   */
+  session->internals.auth_struct =
+    _gnutls_kx_auth_struct (_gnutls_cipher_suite_get_kx_algo
+                            (&session->security_parameters.
+                             current_cipher_suite));
+
+  if (session->internals.auth_struct == NULL)
+    {
+
+      _gnutls_handshake_log
+        ("HSK[%x]: Cannot find the appropriate handler for the KX algorithm\n",
+         session);
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+
+  return 0;
+}
+
+/* This function sets the given comp method to the session.
+ */
+static int
+_gnutls_client_set_comp_method (gnutls_session_t session, opaque comp_method)
+{
+  int comp_methods_num;
+  uint8_t *compression_methods;
+  int i;
+
+  comp_methods_num = _gnutls_supported_compression_methods (session,
+                                                            &compression_methods);
+  if (comp_methods_num < 0)
+    {
+      gnutls_assert ();
+      return comp_methods_num;
+    }
+
+  for (i = 0; i < comp_methods_num; i++)
+    {
+      if (compression_methods[i] == comp_method)
+        {
+          comp_methods_num = 0;
+          break;
+        }
+    }
+
+  gnutls_free (compression_methods);
+
+  if (comp_methods_num != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM;
+    }
+
+  session->internals.compression_method =
+    _gnutls_compression_get_id (comp_method);
+
+
+  return 0;
+}
+
+/* This function returns 0 if we are resuming a session or -1 otherwise.
+ * This also sets the variables in the session. Used only while reading a server
+ * hello.
+ */
+static int
+_gnutls_client_check_if_resuming (gnutls_session_t session,
+                                  opaque * session_id, int session_id_len)
+{
+  opaque buf[2 * TLS_MAX_SESSION_ID_SIZE + 1];
+
+  _gnutls_handshake_log ("HSK[%x]: SessionID length: %d\n", session,
+                         session_id_len);
+  _gnutls_handshake_log ("HSK[%x]: SessionID: %s\n", session,
+                         _gnutls_bin2hex (session_id, session_id_len, buf,
+                                          sizeof (buf)));
+
+  if (session_id_len > 0 &&
+      session->internals.resumed_security_parameters.session_id_size ==
+      session_id_len
+      && memcmp (session_id,
+                 session->internals.resumed_security_parameters.
+                 session_id, session_id_len) == 0)
+    {
+      /* resume session */
+      memcpy (session->internals.
+              resumed_security_parameters.server_random,
+              session->security_parameters.server_random, TLS_RANDOM_SIZE);
+      memcpy (session->internals.
+              resumed_security_parameters.client_random,
+              session->security_parameters.client_random, TLS_RANDOM_SIZE);
+      session->internals.resumed = RESUME_TRUE; /* we are resuming */
+
+      return 0;
+    }
+  else
+    {
+      /* keep the new session id */
+      session->internals.resumed = RESUME_FALSE;        /* we are not resuming */
+      session->security_parameters.session_id_size = session_id_len;
+      memcpy (session->security_parameters.session_id,
+              session_id, session_id_len);
+
+      return -1;
+    }
+}
+
+
+/* This function reads and parses the server hello handshake message.
+ * This function also restores resumed parameters if we are resuming a
+ * session.
+ */
+static int
+_gnutls_read_server_hello (gnutls_session_t session,
+                           opaque * data, int datalen)
+{
+  uint8_t session_id_len = 0;
+  int pos = 0;
+  int ret = 0;
+  gnutls_protocol_t version;
+  int len = datalen;
+
+  if (datalen < 38)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+    }
+
+  _gnutls_handshake_log ("HSK[%x]: Server's version: %d.%d\n",
+                         session, data[pos], data[pos + 1]);
+
+  DECR_LEN (len, 2);
+  version = _gnutls_version_get (data[pos], data[pos + 1]);
+  if (_gnutls_version_is_supported (session, version) == 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNSUPPORTED_VERSION_PACKET;
+    }
+  else
+    {
+      _gnutls_set_current_version (session, version);
+    }
+
+  pos += 2;
+
+  DECR_LEN (len, TLS_RANDOM_SIZE);
+  _gnutls_set_server_random (session, &data[pos]);
+  pos += TLS_RANDOM_SIZE;
+
+
+  /* Read session ID
+   */
+  DECR_LEN (len, 1);
+  session_id_len = data[pos++];
+
+  if (len < session_id_len)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNSUPPORTED_VERSION_PACKET;
+    }
+  DECR_LEN (len, session_id_len);
+
+
+  /* check if we are resuming and set the appropriate
+   * values;
+   */
+  if (_gnutls_client_check_if_resuming
+      (session, &data[pos], session_id_len) == 0)
+    return 0;
+  pos += session_id_len;
+
+
+  /* Check if the given cipher suite is supported and copy
+   * it to the session.
+   */
+
+  DECR_LEN (len, 2);
+  ret = _gnutls_client_set_ciphersuite (session, &data[pos]);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+  pos += 2;
+
+
+
+  /* move to compression 
+   */
+  DECR_LEN (len, 1);
+
+  ret = _gnutls_client_set_comp_method (session, data[pos++]);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM;
+    }
+
+  /* Parse extensions.
+   */
+  if (version >= GNUTLS_TLS1)
+    {
+      ret = _gnutls_parse_extensions (session, EXTENSION_ANY, &data[pos], len); /* len is the rest of the parsed length */
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+    }
+  return ret;
+}
+
+
+/* This function copies the appropriate ciphersuites to a locally allocated buffer
+ * Needed in client hello messages. Returns the new data length.
+ */
+static int
+_gnutls_copy_ciphersuites (gnutls_session_t session,
+                           opaque * ret_data, size_t ret_data_size)
+{
+  int ret, i;
+  cipher_suite_st *cipher_suites;
+  uint16_t cipher_num;
+  int datalen, pos;
+
+  ret = _gnutls_supported_ciphersuites_sorted (session, &cipher_suites);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  /* Here we remove any ciphersuite that does not conform
+   * the certificate requested, or to the
+   * authentication requested (eg SRP).
+   */
+  ret =
+    _gnutls_remove_unwanted_ciphersuites (session, &cipher_suites, ret, -1);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      gnutls_free (cipher_suites);
+      return ret;
+    }
+
+  /* If no cipher suites were enabled.
+   */
+  if (ret == 0)
+    {
+      gnutls_assert ();
+      gnutls_free (cipher_suites);
+      return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
+    }
+
+  cipher_num = ret;
+
+  cipher_num *= sizeof (uint16_t);      /* in order to get bytes */
+
+  datalen = pos = 0;
+
+  datalen += sizeof (uint16_t) + cipher_num;
+
+  if ((size_t) datalen > ret_data_size)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  _gnutls_write_uint16 (cipher_num, ret_data);
+  pos += 2;
+
+  for (i = 0; i < (cipher_num / 2); i++)
+    {
+      memcpy (&ret_data[pos], cipher_suites[i].suite, 2);
+      pos += 2;
+    }
+  gnutls_free (cipher_suites);
+
+  return datalen;
+}
+
+
+/* This function copies the appropriate compression methods, to a locally allocated buffer 
+ * Needed in hello messages. Returns the new data length.
+ */
+static int
+_gnutls_copy_comp_methods (gnutls_session_t session,
+                           opaque * ret_data, size_t ret_data_size)
+{
+  int ret, i;
+  uint8_t *compression_methods, comp_num;
+  int datalen, pos;
+
+  ret = _gnutls_supported_compression_methods (session, &compression_methods);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  comp_num = ret;
+
+  datalen = pos = 0;
+  datalen += comp_num + 1;
+
+  if ((size_t) datalen > ret_data_size)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  ret_data[pos++] = comp_num;   /* put the number of compression methods */
+
+  for (i = 0; i < comp_num; i++)
+    {
+      ret_data[pos++] = compression_methods[i];
+    }
+
+  gnutls_free (compression_methods);
+
+  return datalen;
+}
+
+/* This should be sufficient by now. It should hold all the extensions
+ * plus the headers in a hello message.
+ */
+#define MAX_EXT_DATA_LENGTH 1024
+
+/* This function sends the client hello handshake message.
+ */
+static int
+_gnutls_send_client_hello (gnutls_session_t session, int again)
+{
+  opaque *data = NULL;
+  int extdatalen;
+  int pos = 0;
+  int datalen = 0, ret = 0;
+  opaque rnd[TLS_RANDOM_SIZE];
+  gnutls_protocol_t hver;
+  opaque extdata[MAX_EXT_DATA_LENGTH];
+
+  opaque *SessionID =
+    session->internals.resumed_security_parameters.session_id;
+  uint8_t session_id_len =
+    session->internals.resumed_security_parameters.session_id_size;
+
+  if (SessionID == NULL)
+    session_id_len = 0;
+  else if (session_id_len == 0)
+    SessionID = NULL;
+
+  if (again == 0)
+    {
+
+      datalen = 2 + (session_id_len + 1) + TLS_RANDOM_SIZE;
+      /* 2 for version, (4 for unix time + 28 for random bytes==TLS_RANDOM_SIZE) 
+       */
+
+      data = gnutls_malloc (datalen);
+      if (data == NULL)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_MEMORY_ERROR;
+        }
+
+      /* if we are resuming a session then we set the
+       * version number to the previously established.
+       */
+      if (SessionID == NULL)
+        hver = _gnutls_version_max (session);
+      else
+        {                       /* we are resuming a session */
+          hver = session->internals.resumed_security_parameters.version;
+        }
+
+      if (hver == GNUTLS_VERSION_UNKNOWN || hver == 0)
+        {
+          gnutls_assert ();
+          gnutls_free (data);
+          return GNUTLS_E_INTERNAL_ERROR;
+        }
+
+      data[pos++] = _gnutls_version_get_major (hver);
+      data[pos++] = _gnutls_version_get_minor (hver);
+
+      /* Set the version we advertized as maximum 
+       * (RSA uses it).
+       */
+      _gnutls_set_adv_version (session, hver);
+
+      /* Some old implementations do not interoperate if we send a
+       * different version in the record layer.
+       * It seems they prefer to read the record's version
+       * as the one we actually requested.
+       * The proper behaviour is to use the one in the client hello 
+       * handshake packet and ignore the one in the packet's record 
+       * header.
+       */
+      _gnutls_set_current_version (session, hver);
+
+      /* In order to know when this session was initiated.
+       */
+      session->security_parameters.timestamp = time (NULL);
+
+      /* Generate random data 
+       */
+      _gnutls_tls_create_random (rnd);
+      _gnutls_set_client_random (session, rnd);
+
+      memcpy (&data[pos], rnd, TLS_RANDOM_SIZE);
+      pos += TLS_RANDOM_SIZE;
+
+      /* Copy the Session ID 
+       */
+      data[pos++] = session_id_len;
+
+      if (session_id_len > 0)
+        {
+          memcpy (&data[pos], SessionID, session_id_len);
+          pos += session_id_len;
+        }
+
+
+      /* Copy the ciphersuites.
+       */
+      extdatalen =
+        _gnutls_copy_ciphersuites (session, extdata, sizeof (extdata));
+      if (extdatalen > 0)
+        {
+          datalen += extdatalen;
+          data = gnutls_realloc_fast (data, datalen);
+          if (data == NULL)
+            {
+              gnutls_assert ();
+              return GNUTLS_E_MEMORY_ERROR;
+            }
+
+          memcpy (&data[pos], extdata, extdatalen);
+          pos += extdatalen;
+
+        }
+      else
+        {
+          if (extdatalen == 0)
+            extdatalen = GNUTLS_E_INTERNAL_ERROR;
+          gnutls_free (data);
+          gnutls_assert ();
+          return extdatalen;
+        }
+
+
+      /* Copy the compression methods.
+       */
+      extdatalen =
+        _gnutls_copy_comp_methods (session, extdata, sizeof (extdata));
+      if (extdatalen > 0)
+        {
+          datalen += extdatalen;
+          data = gnutls_realloc_fast (data, datalen);
+          if (data == NULL)
+            {
+              gnutls_assert ();
+              return GNUTLS_E_MEMORY_ERROR;
+            }
+
+          memcpy (&data[pos], extdata, extdatalen);
+          pos += extdatalen;
+
+        }
+      else
+        {
+          if (extdatalen == 0)
+            extdatalen = GNUTLS_E_INTERNAL_ERROR;
+          gnutls_free (data);
+          gnutls_assert ();
+          return extdatalen;
+        }
+
+      /* Generate and copy TLS extensions.
+       */
+      if (hver >= GNUTLS_TLS1)
+        {
+          extdatalen =
+            _gnutls_gen_extensions (session, extdata, sizeof (extdata));
+
+          if (extdatalen > 0)
+            {
+              datalen += extdatalen;
+              data = gnutls_realloc_fast (data, datalen);
+              if (data == NULL)
+                {
+                  gnutls_assert ();
+                  return GNUTLS_E_MEMORY_ERROR;
+                }
+
+              memcpy (&data[pos], extdata, extdatalen);
+            }
+          else if (extdatalen < 0)
+            {
+              gnutls_assert ();
+              gnutls_free (data);
+              return extdatalen;
+            }
+        }
+    }
+
+  ret =
+    _gnutls_send_handshake (session, data, datalen,
+                            GNUTLS_HANDSHAKE_CLIENT_HELLO);
+  gnutls_free (data);
+
+  return ret;
+}
+
+static int
+_gnutls_send_server_hello (gnutls_session_t session, int again)
+{
+  opaque *data = NULL;
+  opaque extdata[MAX_EXT_DATA_LENGTH];
+  int extdatalen;
+  int pos = 0;
+  int datalen, ret = 0;
+  uint8_t comp;
+  opaque *SessionID = session->security_parameters.session_id;
+  uint8_t session_id_len = session->security_parameters.session_id_size;
+  opaque buf[2 * TLS_MAX_SESSION_ID_SIZE + 1];
+
+  if (SessionID == NULL)
+    session_id_len = 0;
+
+  datalen = 0;
+
+#ifdef ENABLE_SRP
+  if (IS_SRP_KX
+      (_gnutls_cipher_suite_get_kx_algo
+       (&session->security_parameters.current_cipher_suite)))
+    {
+      /* While resuming we cannot check the username extension since it is
+       * not available at this point. It will be copied on connection
+       * state activation.
+       */
+      if (session->internals.resumed == RESUME_FALSE &&
+          session->security_parameters.extensions.srp_username[0] == 0)
+        {
+          /* The peer didn't send a valid SRP extension with the
+           * SRP username. The draft requires that we send a fatal
+           * alert and abort.
+           */
+          gnutls_assert ();
+          ret = gnutls_alert_send (session, GNUTLS_AL_FATAL,
+                                   GNUTLS_A_UNKNOWN_PSK_IDENTITY);
+          if (ret < 0)
+            {
+              gnutls_assert ();
+              return ret;
+            }
+
+          return GNUTLS_E_ILLEGAL_SRP_USERNAME;
+        }
+    }
+#endif
+
+  if (again == 0)
+    {
+      datalen = 2 + session_id_len + 1 + TLS_RANDOM_SIZE + 3;
+      extdatalen =
+        _gnutls_gen_extensions (session, extdata, sizeof (extdata));
+
+      if (extdatalen < 0)
+        {
+          gnutls_assert ();
+          return extdatalen;
+        }
+
+      data = gnutls_alloca (datalen + extdatalen);
+      if (data == NULL)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_MEMORY_ERROR;
+        }
+
+      data[pos++] =
+        _gnutls_version_get_major (session->security_parameters.version);
+      data[pos++] =
+        _gnutls_version_get_minor (session->security_parameters.version);
+
+      memcpy (&data[pos],
+              session->security_parameters.server_random, TLS_RANDOM_SIZE);
+      pos += TLS_RANDOM_SIZE;
+
+      data[pos++] = session_id_len;
+      if (session_id_len > 0)
+        {
+          memcpy (&data[pos], SessionID, session_id_len);
+        }
+      pos += session_id_len;
+
+      _gnutls_handshake_log ("HSK[%x]: SessionID: %s\n", session,
+                             _gnutls_bin2hex (SessionID, session_id_len,
+                                              buf, sizeof (buf)));
+
+      memcpy (&data[pos],
+              session->security_parameters.current_cipher_suite.suite, 2);
+      pos += 2;
+
+      comp =
+        (uint8_t) _gnutls_compression_get_num (session->
+                                               internals.compression_method);
+      data[pos++] = comp;
+
+
+      if (extdatalen > 0)
+        {
+          datalen += extdatalen;
+
+          memcpy (&data[pos], extdata, extdatalen);
+        }
+    }
+
+  ret =
+    _gnutls_send_handshake (session, data, datalen,
+                            GNUTLS_HANDSHAKE_SERVER_HELLO);
+  gnutls_afree (data);
+
+  return ret;
+}
+
+int
+_gnutls_send_hello (gnutls_session_t session, int again)
+{
+  int ret;
+
+  if (session->security_parameters.entity == GNUTLS_CLIENT)
+    {
+      ret = _gnutls_send_client_hello (session, again);
+
+    }
+  else
+    {                           /* SERVER */
+      ret = _gnutls_send_server_hello (session, again);
+    }
+
+  return ret;
+}
+
+/* RECEIVE A HELLO MESSAGE. This should be called from gnutls_recv_handshake_int only if a
+ * hello message is expected. It uses the security_parameters.current_cipher_suite
+ * and internals.compression_method.
+ */
+int
+_gnutls_recv_hello (gnutls_session_t session, opaque * data, int datalen)
+{
+  int ret;
+
+  if (session->security_parameters.entity == GNUTLS_CLIENT)
+    {
+      ret = _gnutls_read_server_hello (session, data, datalen);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+    }
+  else
+    {                           /* Server side reading a client hello */
+
+      ret = _gnutls_read_client_hello (session, data, datalen);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+    }
+
+  return ret;
+}
+
+/* The packets in gnutls_handshake (it's more broad than original TLS handshake)
+ *
+ *     Client                                               Server
+ *
+ *     ClientHello                  -------->
+ *                                  <--------         ServerHello
+ *
+ *                                                    Certificate*
+ *                                              ServerKeyExchange*
+ *                                  <--------   CertificateRequest*
+ *
+ *                                  <--------      ServerHelloDone
+ *     Certificate*
+ *     ClientKeyExchange
+ *     CertificateVerify*
+ *     [ChangeCipherSpec]
+ *     Finished                     -------->
+ *                                              [ChangeCipherSpec]
+ *                                  <--------             Finished
+ *
+ * (*): means optional packet.
+ */
+
+/**
+  * gnutls_rehandshake - This function will renegotiate security parameters
+  * @session: is a #gnutls_session_t structure.
+  *
+  * This function will renegotiate security parameters with the
+  * client.  This should only be called in case of a server.
+  *
+  * This message informs the peer that we want to renegotiate
+  * parameters (perform a handshake).
+  *
+  * If this function succeeds (returns 0), you must call the
+  * gnutls_handshake() function in order to negotiate the new
+  * parameters.
+  *
+  * If the client does not wish to renegotiate parameters he will
+  * should with an alert message, thus the return code will be
+  * %GNUTLS_E_WARNING_ALERT_RECEIVED and the alert will be
+  * %GNUTLS_A_NO_RENEGOTIATION.  A client may also choose to ignore
+  * this message.
+  *
+  * Returns: %GNUTLS_E_SUCCESS on success, otherwise an error.
+  *
+  **/
+int
+gnutls_rehandshake (gnutls_session_t session)
+{
+  int ret;
+
+  /* only server sends that handshake packet */
+  if (session->security_parameters.entity == GNUTLS_CLIENT)
+    return GNUTLS_E_INVALID_REQUEST;
+
+  ret =
+    _gnutls_send_empty_handshake (session, GNUTLS_HANDSHAKE_HELLO_REQUEST,
+                                  AGAIN (STATE50));
+  STATE = STATE50;
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+  STATE = STATE0;
+
+  return 0;
+}
+
+inline static int
+_gnutls_abort_handshake (gnutls_session_t session, int ret)
+{
+  if (((ret == GNUTLS_E_WARNING_ALERT_RECEIVED) &&
+       (gnutls_alert_get (session) == GNUTLS_A_NO_RENEGOTIATION))
+      || ret == GNUTLS_E_GOT_APPLICATION_DATA)
+    return 0;
+
+  /* this doesn't matter */
+  return GNUTLS_E_INTERNAL_ERROR;
+}
+
+
+/* This function initialized the handshake hash session.
+ * required for finished messages.
+ */
+inline static int
+_gnutls_handshake_hash_init (gnutls_session_t session)
+{
+
+  if (session->internals.handshake_mac_handle_md5 == NULL)
+    {
+      session->internals.handshake_mac_handle_md5 =
+        _gnutls_hash_init (GNUTLS_MAC_MD5);
+
+      if (session->internals.handshake_mac_handle_md5 == GNUTLS_HASH_FAILED)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_MEMORY_ERROR;
+        }
+    }
+
+  if (session->internals.handshake_mac_handle_sha == NULL)
+    {
+      session->internals.handshake_mac_handle_sha =
+        _gnutls_hash_init (GNUTLS_MAC_SHA1);
+      if (session->internals.handshake_mac_handle_sha == GNUTLS_HASH_FAILED)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_MEMORY_ERROR;
+        }
+    }
+
+  return 0;
+}
+
+int
+_gnutls_send_supplemental (gnutls_session_t session, int again)
+{
+  int ret = 0;
+
+  _gnutls_debug_log ("EXT[%x]: Sending supplemental data\n", session);
+
+  if (again)
+    ret = _gnutls_send_handshake (session, NULL, 0,
+                                  GNUTLS_HANDSHAKE_SUPPLEMENTAL);
+  else
+    {
+      gnutls_buffer buf;
+      _gnutls_buffer_init (&buf);
+
+      ret = _gnutls_gen_supplemental (session, &buf);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      ret = _gnutls_send_handshake (session, buf.data, buf.length,
+                                    GNUTLS_HANDSHAKE_SUPPLEMENTAL);
+      _gnutls_buffer_clear (&buf);
+    }
+
+  return ret;
+}
+
+int
+_gnutls_recv_supplemental (gnutls_session_t session)
+{
+  uint8_t *data = NULL;
+  int datalen = 0;
+  int ret;
+
+  _gnutls_debug_log ("EXT[%x]: Expecting supplemental data\n", session);
+
+  ret = _gnutls_recv_handshake (session, &data, &datalen,
+                                GNUTLS_HANDSHAKE_SUPPLEMENTAL,
+                                OPTIONAL_PACKET);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  ret = _gnutls_parse_supplemental (session, data, datalen);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  gnutls_free (data);
+
+  return ret;
+}
+
+/**
+  * gnutls_handshake - This is the main function in the handshake protocol.
+  * @session: is a #gnutls_session_t structure.
+  *
+  * This function does the handshake of the TLS/SSL protocol, and
+  * initializes the TLS connection.
+  *
+  * This function will fail if any problem is encountered, and will
+  * return a negative error code. In case of a client, if the client
+  * has asked to resume a session, but the server couldn't, then a
+  * full handshake will be performed.
+  *
+  * The non-fatal errors such as %GNUTLS_E_AGAIN and
+  * %GNUTLS_E_INTERRUPTED interrupt the handshake procedure, which
+  * should be later be resumed.  Call this function again, until it
+  * returns 0; cf.  gnutls_record_get_direction() and
+  * gnutls_error_is_fatal().
+  *
+  * If this function is called by a server after a rehandshake request
+  * then %GNUTLS_E_GOT_APPLICATION_DATA or
+  * %GNUTLS_E_WARNING_ALERT_RECEIVED may be returned.  Note that these
+  * are non fatal errors, only in the specific case of a rehandshake.
+  * Their meaning is that the client rejected the rehandshake request.
+  *
+  * Returns: %GNUTLS_E_SUCCESS on success, otherwise an error.
+  *
+  **/
+int
+gnutls_handshake (gnutls_session_t session)
+{
+  int ret;
+
+  if ((ret = _gnutls_handshake_hash_init (session)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  if (session->security_parameters.entity == GNUTLS_CLIENT)
+    {
+      ret = _gnutls_handshake_client (session);
+    }
+  else
+    {
+      ret = _gnutls_handshake_server (session);
+    }
+  if (ret < 0)
+    {
+      /* In the case of a rehandshake abort
+       * we should reset the handshake's internal state.
+       */
+      if (_gnutls_abort_handshake (session, ret) == 0)
+        STATE = STATE0;
+
+      return ret;
+    }
+
+  ret = _gnutls_handshake_common (session);
+
+  if (ret < 0)
+    {
+      if (_gnutls_abort_handshake (session, ret) == 0)
+        STATE = STATE0;
+
+      return ret;
+    }
+
+  STATE = STATE0;
+
+  _gnutls_handshake_io_buffer_clear (session);
+  _gnutls_handshake_internal_state_clear (session);
+
+  return 0;
+}
+
+#define IMED_RET( str, ret) do { \
+        if (ret < 0) { \
+                if (gnutls_error_is_fatal(ret)==0) return ret; \
+                gnutls_assert(); \
+                ERR( str, ret); \
+                _gnutls_handshake_hash_buffers_clear(session); \
+                return ret; \
+        } } while (0)
+
+
+
+/*
+ * _gnutls_handshake_client 
+ * This function performs the client side of the handshake of the TLS/SSL protocol.
+ */
+int
+_gnutls_handshake_client (gnutls_session_t session)
+{
+  int ret = 0;
+
+#ifdef HANDSHAKE_DEBUG
+  char buf[64];
+
+  if (session->internals.resumed_security_parameters.session_id_size > 0)
+    _gnutls_handshake_log ("HSK[%x]: Ask to resume: %s\n", session,
+                           _gnutls_bin2hex (session->internals.
+                                            resumed_security_parameters.
+                                            session_id,
+                                            session->internals.
+                                            resumed_security_parameters.
+                                            session_id_size, buf,
+                                            sizeof (buf)));
+#endif
+
+  switch (STATE)
+    {
+    case STATE0:
+    case STATE1:
+      ret = _gnutls_send_hello (session, AGAIN (STATE1));
+      STATE = STATE1;
+      IMED_RET ("send hello", ret);
+
+    case STATE2:
+      /* receive the server hello */
+      ret =
+        _gnutls_recv_handshake (session, NULL, NULL,
+                                GNUTLS_HANDSHAKE_SERVER_HELLO,
+                                MANDATORY_PACKET);
+      STATE = STATE2;
+      IMED_RET ("recv hello", ret);
+
+    case STATE70:
+      if (session->security_parameters.extensions.do_recv_supplemental)
+        {
+          ret = _gnutls_recv_supplemental (session);
+          STATE = STATE70;
+          IMED_RET ("recv supplemental", ret);
+        }
+
+    case STATE3:
+      /* RECV CERTIFICATE */
+      if (session->internals.resumed == RESUME_FALSE)   /* if we are not resuming */
+        ret = _gnutls_recv_server_certificate (session);
+      STATE = STATE3;
+      IMED_RET ("recv server certificate", ret);
+
+    case STATE4:
+      /* receive the server key exchange */
+      if (session->internals.resumed == RESUME_FALSE)   /* if we are not resuming */
+        ret = _gnutls_recv_server_kx_message (session);
+      STATE = STATE4;
+      IMED_RET ("recv server kx message", ret);
+
+    case STATE5:
+      /* receive the server certificate request - if any 
+       */
+
+      if (session->internals.resumed == RESUME_FALSE)   /* if we are not resuming */
+        ret = _gnutls_recv_server_certificate_request (session);
+      STATE = STATE5;
+      IMED_RET ("recv server certificate request message", ret);
+
+    case STATE6:
+      /* receive the server hello done */
+      if (session->internals.resumed == RESUME_FALSE)   /* if we are not resuming */
+        ret =
+          _gnutls_recv_handshake (session, NULL, NULL,
+                                  GNUTLS_HANDSHAKE_SERVER_HELLO_DONE,
+                                  MANDATORY_PACKET);
+      STATE = STATE6;
+      IMED_RET ("recv server hello done", ret);
+
+    case STATE71:
+      if (session->security_parameters.extensions.do_send_supplemental)
+        {
+          ret = _gnutls_send_supplemental (session, AGAIN (STATE71));
+          STATE = STATE71;
+          IMED_RET ("send supplemental", ret);
+        }
+
+    case STATE7:
+      /* send our certificate - if any and if requested
+       */
+      if (session->internals.resumed == RESUME_FALSE)   /* if we are not resuming */
+        ret = _gnutls_send_client_certificate (session, AGAIN (STATE7));
+      STATE = STATE7;
+      IMED_RET ("send client certificate", ret);
+
+    case STATE8:
+      if (session->internals.resumed == RESUME_FALSE)   /* if we are not resuming */
+        ret = _gnutls_send_client_kx_message (session, AGAIN (STATE8));
+      STATE = STATE8;
+      IMED_RET ("send client kx", ret);
+
+    case STATE9:
+      /* send client certificate verify */
+      if (session->internals.resumed == RESUME_FALSE)   /* if we are not resuming */
+        ret =
+          _gnutls_send_client_certificate_verify (session, AGAIN (STATE9));
+      STATE = STATE9;
+      IMED_RET ("send client certificate verify", ret);
+
+      STATE = STATE0;
+    default:
+      break;
+    }
+
+
+  return 0;
+}
+
+/* This function sends the final handshake packets and initializes connection 
+ */
+static int
+_gnutls_send_handshake_final (gnutls_session_t session, int init)
+{
+  int ret = 0;
+
+  /* Send the CHANGE CIPHER SPEC PACKET */
+
+  switch (STATE)
+    {
+    case STATE0:
+    case STATE20:
+      ret = _gnutls_send_change_cipher_spec (session, AGAIN (STATE20));
+      STATE = STATE20;
+      if (ret < 0)
+        {
+          ERR ("send ChangeCipherSpec", ret);
+          gnutls_assert ();
+          return ret;
+        }
+
+      /* Initialize the connection session (start encryption) - in case of client 
+       */
+      if (init == TRUE)
+        {
+          ret = _gnutls_connection_state_init (session);
+          if (ret < 0)
+            {
+              gnutls_assert ();
+              return ret;
+            }
+        }
+
+      ret = _gnutls_write_connection_state_init (session);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+    case STATE21:
+      /* send the finished message */
+      ret = _gnutls_send_finished (session, AGAIN (STATE21));
+      STATE = STATE21;
+      if (ret < 0)
+        {
+          ERR ("send Finished", ret);
+          gnutls_assert ();
+          return ret;
+        }
+
+      STATE = STATE0;
+    default:
+      break;
+    }
+
+  return 0;
+}
+
+/* This function receives the final handshake packets 
+ * And executes the appropriate function to initialize the
+ * read session.
+ */
+static int
+_gnutls_recv_handshake_final (gnutls_session_t session, int init)
+{
+  int ret = 0;
+  uint8_t ch;
+
+  switch (STATE)
+    {
+    case STATE0:
+    case STATE30:
+      ret = _gnutls_recv_int (session, GNUTLS_CHANGE_CIPHER_SPEC, -1, &ch, 1);
+      STATE = STATE30;
+      if (ret <= 0)
+        {
+          ERR ("recv ChangeCipherSpec", ret);
+          gnutls_assert ();
+          return (ret < 0) ? ret : GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+        }
+
+      /* Initialize the connection session (start encryption) - in case of server */
+      if (init == TRUE)
+        {
+          ret = _gnutls_connection_state_init (session);
+          if (ret < 0)
+            {
+              gnutls_assert ();
+              return ret;
+            }
+        }
+
+      ret = _gnutls_read_connection_state_init (session);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+    case STATE31:
+      ret = _gnutls_recv_finished (session);
+      STATE = STATE31;
+      if (ret < 0)
+        {
+          ERR ("recv finished", ret);
+          gnutls_assert ();
+          return ret;
+        }
+      STATE = STATE0;
+    default:
+      break;
+    }
+
+
+  return 0;
+}
+
+ /*
+  * _gnutls_handshake_server 
+  * This function does the server stuff of the handshake protocol.
+  */
+
+int
+_gnutls_handshake_server (gnutls_session_t session)
+{
+  int ret = 0;
+
+  switch (STATE)
+    {
+    case STATE0:
+    case STATE1:
+      ret =
+        _gnutls_recv_handshake (session, NULL, NULL,
+                                GNUTLS_HANDSHAKE_CLIENT_HELLO,
+                                MANDATORY_PACKET);
+      STATE = STATE1;
+      IMED_RET ("recv hello", ret);
+
+    case STATE2:
+      ret = _gnutls_send_hello (session, AGAIN (STATE2));
+      STATE = STATE2;
+      IMED_RET ("send hello", ret);
+
+    case STATE70:
+      if (session->security_parameters.extensions.do_send_supplemental)
+        {
+          ret = _gnutls_send_supplemental (session, AGAIN (STATE70));
+          STATE = STATE70;
+          IMED_RET ("send supplemental data", ret);
+        }
+
+      /* SEND CERTIFICATE + KEYEXCHANGE + CERTIFICATE_REQUEST */
+    case STATE3:
+      /* NOTE: these should not be send if we are resuming */
+
+      if (session->internals.resumed == RESUME_FALSE)
+        ret = _gnutls_send_server_certificate (session, AGAIN (STATE3));
+      STATE = STATE3;
+      IMED_RET ("send server certificate", ret);
+
+    case STATE4:
+      /* send server key exchange (A) */
+      if (session->internals.resumed == RESUME_FALSE)
+        ret = _gnutls_send_server_kx_message (session, AGAIN (STATE4));
+      STATE = STATE4;
+      IMED_RET ("send server kx", ret);
+
+    case STATE5:
+      /* Send certificate request - if requested to */
+      if (session->internals.resumed == RESUME_FALSE)
+        ret =
+          _gnutls_send_server_certificate_request (session, AGAIN (STATE5));
+      STATE = STATE5;
+      IMED_RET ("send server cert request", ret);
+
+    case STATE6:
+      /* send the server hello done */
+      if (session->internals.resumed == RESUME_FALSE)   /* if we are not resuming */
+        ret =
+          _gnutls_send_empty_handshake (session,
+                                        GNUTLS_HANDSHAKE_SERVER_HELLO_DONE,
+                                        AGAIN (STATE6));
+      STATE = STATE6;
+      IMED_RET ("send server hello done", ret);
+
+    case STATE71:
+      if (session->security_parameters.extensions.do_recv_supplemental)
+        {
+          ret = _gnutls_recv_supplemental (session);
+          STATE = STATE71;
+          IMED_RET ("recv client supplemental", ret);
+        }
+
+      /* RECV CERTIFICATE + KEYEXCHANGE + CERTIFICATE_VERIFY */
+    case STATE7:
+      /* receive the client certificate message */
+      if (session->internals.resumed == RESUME_FALSE)   /* if we are not resuming */
+        ret = _gnutls_recv_client_certificate (session);
+      STATE = STATE7;
+      IMED_RET ("recv client certificate", ret);
+
+    case STATE8:
+      /* receive the client key exchange message */
+      if (session->internals.resumed == RESUME_FALSE)   /* if we are not resuming */
+        ret = _gnutls_recv_client_kx_message (session);
+      STATE = STATE8;
+      IMED_RET ("recv client kx", ret);
+
+    case STATE9:
+      /* receive the client certificate verify message */
+      if (session->internals.resumed == RESUME_FALSE)   /* if we are not resuming */
+        ret = _gnutls_recv_client_certificate_verify_message (session);
+      STATE = STATE9;
+      IMED_RET ("recv client certificate verify", ret);
+
+      STATE = STATE0;           /* finished thus clear session */
+    default:
+      break;
+    }
+
+  return 0;
+}
+
+int
+_gnutls_handshake_common (gnutls_session_t session)
+{
+  int ret = 0;
+
+  /* send and recv the change cipher spec and finished messages */
+  if ((session->internals.resumed == RESUME_TRUE
+       && session->security_parameters.entity == GNUTLS_CLIENT)
+      || (session->internals.resumed == RESUME_FALSE
+          && session->security_parameters.entity == GNUTLS_SERVER))
+    {
+      /* if we are a client resuming - or we are a server not resuming */
+
+      ret = _gnutls_recv_handshake_final (session, TRUE);
+      IMED_RET ("recv handshake final", ret);
+
+      ret = _gnutls_send_handshake_final (session, FALSE);
+      IMED_RET ("send handshake final", ret);
+    }
+  else
+    {                           /* if we are a client not resuming - or we are a server resuming */
+
+      ret = _gnutls_send_handshake_final (session, TRUE);
+      IMED_RET ("send handshake final 2", ret);
+
+      ret = _gnutls_recv_handshake_final (session, FALSE);
+      IMED_RET ("recv handshake final 2", ret);
+    }
+
+  if (session->security_parameters.entity == GNUTLS_SERVER)
+    {
+      /* in order to support session resuming */
+      _gnutls_server_register_current_session (session);
+    }
+
+  /* clear handshake buffer */
+  _gnutls_handshake_hash_buffers_clear (session);
+  return ret;
+
+}
+
+int
+_gnutls_generate_session_id (opaque * session_id, uint8_t * len)
+{
+  *len = TLS_MAX_SESSION_ID_SIZE;
+
+  if (gc_nonce (session_id, *len) != GC_OK)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_RANDOM_FAILED;
+    }
+
+  return 0;
+}
+
+int
+_gnutls_recv_hello_request (gnutls_session_t session, void *data,
+                            uint32_t data_size)
+{
+  uint8_t type;
+
+  if (session->security_parameters.entity == GNUTLS_SERVER)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNEXPECTED_PACKET;
+    }
+  if (data_size < 1)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+    }
+  type = ((uint8_t *) data)[0];
+  if (type == GNUTLS_HANDSHAKE_HELLO_REQUEST)
+    return GNUTLS_E_REHANDSHAKE;
+  else
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNEXPECTED_PACKET;
+    }
+}
+
+/* Returns 1 if the given KX has not the corresponding parameters
+ * (DH or RSA) set up. Otherwise returns 0.
+ */
+inline static int
+check_server_params (gnutls_session_t session,
+                     gnutls_kx_algorithm_t kx,
+                     gnutls_kx_algorithm_t * alg, int alg_size)
+{
+  int cred_type;
+  gnutls_dh_params_t dh_params = NULL;
+  gnutls_rsa_params_t rsa_params = NULL;
+  int j;
+
+  cred_type = _gnutls_map_kx_get_cred (kx, 1);
+
+  /* Read the Diffie Hellman parameters, if any.
+   */
+  if (cred_type == GNUTLS_CRD_CERTIFICATE)
+    {
+      int delete;
+      gnutls_certificate_credentials_t x509_cred =
+        (gnutls_certificate_credentials_t) _gnutls_get_cred (session->key,
+                                                             cred_type, NULL);
+
+      if (x509_cred != NULL)
+        {
+          dh_params =
+            _gnutls_get_dh_params (x509_cred->dh_params,
+                                   x509_cred->params_func, session);
+          rsa_params =
+            _gnutls_certificate_get_rsa_params (x509_cred->rsa_params,
+                                                x509_cred->params_func,
+                                                session);
+        }
+
+      /* Check also if the certificate supports the
+       * KX method.
+       */
+      delete = 1;
+      for (j = 0; j < alg_size; j++)
+        {
+          if (alg[j] == kx)
+            {
+              delete = 0;
+              break;
+            }
+        }
+
+      if (delete == 1)
+        return 1;
+
+#ifdef ENABLE_ANON
+    }
+  else if (cred_type == GNUTLS_CRD_ANON)
+    {
+      gnutls_anon_server_credentials_t anon_cred =
+        (gnutls_anon_server_credentials_t) _gnutls_get_cred (session->key,
+                                                             cred_type, NULL);
+
+      if (anon_cred != NULL)
+        {
+          dh_params =
+            _gnutls_get_dh_params (anon_cred->dh_params,
+                                   anon_cred->params_func, session);
+        }
+#endif
+#ifdef ENABLE_PSK
+    }
+  else if (cred_type == GNUTLS_CRD_PSK)
+    {
+      gnutls_psk_server_credentials_t psk_cred =
+        (gnutls_psk_server_credentials_t) _gnutls_get_cred (session->key,
+                                                            cred_type, NULL);
+
+      if (psk_cred != NULL)
+        {
+          dh_params =
+            _gnutls_get_dh_params (psk_cred->dh_params, psk_cred->params_func,
+                                   session);
+        }
+#endif
+    }
+  else
+    return 0;                   /* no need for params */
+
+
+  /* If the key exchange method needs RSA or DH params,
+   * but they are not set then remove it.
+   */
+  if (_gnutls_kx_needs_rsa_params (kx) != 0)
+    {
+      /* needs rsa params. */
+      if (_gnutls_rsa_params_to_mpi (rsa_params) == NULL)
+        {
+          gnutls_assert ();
+          return 1;
+        }
+    }
+
+  if (_gnutls_kx_needs_dh_params (kx) != 0)
+    {
+      /* needs DH params. */
+      if (_gnutls_dh_params_to_mpi (dh_params) == NULL)
+        {
+          gnutls_assert ();
+          return 1;
+        }
+    }
+
+  return 0;
+}
+
+/* This function will remove algorithms that are not supported by
+ * the requested authentication method. We remove an algorithm if
+ * we have a certificate with keyUsage bits set.
+ *
+ * This does a more high level check than  gnutls_supported_ciphersuites(),
+ * by checking certificates etc.
+ */
+int
+_gnutls_remove_unwanted_ciphersuites (gnutls_session_t session,
+                                      cipher_suite_st ** cipherSuites,
+                                      int numCipherSuites,
+                                      gnutls_pk_algorithm_t requested_pk_algo)
+{
+
+  int ret = 0;
+  cipher_suite_st *newSuite, cs;
+  int newSuiteSize = 0, i;
+  gnutls_certificate_credentials_t cert_cred;
+  gnutls_kx_algorithm_t kx;
+  int server = session->security_parameters.entity == GNUTLS_SERVER ? 1 : 0;
+  gnutls_kx_algorithm_t *alg = NULL;
+  int alg_size = 0;
+
+  /* if we should use a specific certificate, 
+   * we should remove all algorithms that are not supported
+   * by that certificate and are on the same authentication
+   * method (CERTIFICATE).
+   */
+
+  cert_cred =
+    (gnutls_certificate_credentials_t) _gnutls_get_cred (session->key,
+                                                         GNUTLS_CRD_CERTIFICATE,
+                                                         NULL);
+
+  /* If there are certificate credentials, find an appropriate certificate
+   * or disable them;
+   */
+  if (session->security_parameters.entity == GNUTLS_SERVER
+      && cert_cred != NULL)
+    {
+      ret = _gnutls_server_select_cert (session, requested_pk_algo);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          _gnutls_x509_log ("Could not find an appropriate certificate: %s\n",
+                            gnutls_strerror (ret));
+          cert_cred = NULL;
+        }
+    }
+
+  /* get all the key exchange algorithms that are 
+   * supported by the X509 certificate parameters.
+   */
+  if ((ret =
+       _gnutls_selected_cert_supported_kx (session, &alg, &alg_size)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  newSuite = gnutls_malloc (numCipherSuites * sizeof (cipher_suite_st));
+  if (newSuite == NULL)
+    {
+      gnutls_assert ();
+      gnutls_free (alg);
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  /* now removes ciphersuites based on the KX algorithm
+   */
+  for (i = 0; i < numCipherSuites; i++)
+    {
+      int delete = 0;
+
+      /* finds the key exchange algorithm in
+       * the ciphersuite
+       */
+      kx = _gnutls_cipher_suite_get_kx_algo (&(*cipherSuites)[i]);
+
+      /* if it is defined but had no credentials 
+       */
+      if (_gnutls_get_kx_cred (session, kx, NULL) == NULL)
+        {
+          delete = 1;
+        }
+      else
+        {
+          delete = 0;
+
+          if (server)
+            delete = check_server_params (session, kx, alg, alg_size);
+        }
+
+      /* These two SRP kx's are marked to require a CRD_CERTIFICATE,
+         (see cred_mappings in gnutls_algorithms.c), but it also
+         requires a SRP credential.  Don't use SRP kx unless we have a
+         SRP credential too.  */
+      if (kx == GNUTLS_KX_SRP_RSA || kx == GNUTLS_KX_SRP_DSS)
+        {
+          if (!_gnutls_get_cred (session->key, GNUTLS_CRD_SRP, NULL))
+            delete = 1;
+        }
+
+      memcpy (&cs.suite, &(*cipherSuites)[i].suite, 2);
+
+      if (delete == 0)
+        {
+
+          _gnutls_handshake_log ("HSK[%x]: Keeping ciphersuite: %s\n",
+                                 session,
+                                 _gnutls_cipher_suite_get_name (&cs));
+
+          memcpy (newSuite[newSuiteSize].suite, (*cipherSuites)[i].suite, 2);
+          newSuiteSize++;
+        }
+      else
+        {
+          _gnutls_handshake_log ("HSK[%x]: Removing ciphersuite: %s\n",
+                                 session,
+                                 _gnutls_cipher_suite_get_name (&cs));
+
+        }
+    }
+
+  gnutls_free (alg);
+  gnutls_free (*cipherSuites);
+  *cipherSuites = newSuite;
+
+  ret = newSuiteSize;
+
+  return ret;
+
+}
+
+/**
+  * gnutls_handshake_set_max_packet_length - This function will set the maximum length of a handshake message
+  * @session: is a #gnutls_session_t structure.
+  * @max: is the maximum number.
+  *
+  * This function will set the maximum size of a handshake message.
+  * Handshake messages over this size are rejected.  The default value
+  * is 16kb which is large enough. Set this to 0 if you do not want to
+  * set an upper limit.
+  *
+  **/
+void
+gnutls_handshake_set_max_packet_length (gnutls_session_t session, size_t max)
+{
+  session->internals.max_handshake_data_buffer_size = max;
+}
+
+void
+_gnutls_set_adv_version (gnutls_session_t session, gnutls_protocol_t ver)
+{
+  set_adv_version (session, _gnutls_version_get_major (ver),
+                   _gnutls_version_get_minor (ver));
+}
+
+gnutls_protocol_t
+_gnutls_get_adv_version (gnutls_session_t session)
+{
+  return _gnutls_version_get (_gnutls_get_adv_version_major (session),
+                              _gnutls_get_adv_version_minor (session));
+}
+
+/**
+  * gnutls_handshake_get_last_in - Returns the last handshake message received.
+  * @session: is a #gnutls_session_t structure.
+  *
+  * This function is only useful to check where the last performed
+  * handshake failed.  If the previous handshake succeed or was not
+  * performed at all then no meaningful value will be returned.
+  *
+  * Check %gnutls_handshake_description_t in gnutls.h for the
+  * available handshake descriptions.
+  *
+  * Returns: the last handshake message type received, a
+  * %gnutls_handshake_description_t.
+  **/
+gnutls_handshake_description_t
+gnutls_handshake_get_last_in (gnutls_session_t session)
+{
+  return session->internals.last_handshake_in;
+}
+
+/**
+  * gnutls_handshake_get_last_out - Returns the last handshake message sent.
+  * @session: is a #gnutls_session_t structure.
+  *
+  * This function is only useful to check where the last performed
+  * handshake failed.  If the previous handshake succeed or was not
+  * performed at all then no meaningful value will be returned.
+  *
+  * Check %gnutls_handshake_description_t in gnutls.h for the
+  * available handshake descriptions.
+  *
+  * Returns: the last handshake message type sent, a
+  * %gnutls_handshake_description_t.
+  **/
+gnutls_handshake_description_t
+gnutls_handshake_get_last_out (gnutls_session_t session)
+{
+  return session->internals.last_handshake_out;
+}
diff --git a/src/daemon/https/tls/gnutls_handshake.h b/src/daemon/https/tls/gnutls_handshake.h
new file mode 100644
index 00000000..5cff279a
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_handshake.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+typedef enum Optional
+{ OPTIONAL_PACKET, MANDATORY_PACKET } Optional;
+
+int _gnutls_send_handshake (gnutls_session_t session, void *i_data,
+                            uint32_t i_datasize,
+                            gnutls_handshake_description_t type);
+int _gnutls_recv_hello_request (gnutls_session_t session, void *data,
+                                uint32_t data_size);
+int _gnutls_send_hello (gnutls_session_t session, int again);
+int _gnutls_recv_hello (gnutls_session_t session, opaque * data, int datalen);
+int _gnutls_recv_handshake (gnutls_session_t session, uint8_t **, int *,
+                            gnutls_handshake_description_t,
+                            Optional optional);
+int _gnutls_generate_session_id (opaque * session_id, uint8_t * len);
+int _gnutls_handshake_common (gnutls_session_t session);
+int _gnutls_handshake_client (gnutls_session_t session);
+int _gnutls_handshake_server (gnutls_session_t session);
+void _gnutls_set_server_random (gnutls_session_t session, uint8_t * rnd);
+void _gnutls_set_client_random (gnutls_session_t session, uint8_t * rnd);
+int _gnutls_tls_create_random (opaque * dst);
+int _gnutls_remove_unwanted_ciphersuites (gnutls_session_t session,
+                                          cipher_suite_st ** cipherSuites,
+                                          int numCipherSuites,
+                                          gnutls_pk_algorithm_t);
+int _gnutls_find_pk_algos_in_ciphersuites (opaque * data, int datalen);
+int _gnutls_server_select_suite (gnutls_session_t session, opaque * data,
+                                 int datalen);
+
+int _gnutls_negotiate_version( gnutls_session_t session, gnutls_protocol_t adv_version);
+int _gnutls_user_hello_func( gnutls_session, gnutls_protocol_t adv_version);
+
+#define STATE session->internals.handshake_state
+/* This returns true if we have got there
+ * before (and not finished due to an interrupt).
+ */
+#define AGAIN(target) STATE==target?1:0
diff --git a/src/daemon/https/tls/gnutls_hash_int.c b/src/daemon/https/tls/gnutls_hash_int.c
new file mode 100644
index 00000000..2574f213
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_hash_int.c
@@ -0,0 +1,446 @@
+/*
+ * Copyright (C) 2000, 2001, 2004, 2005, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* This file handles all the internal functions that cope with hashes
+ * and HMACs.
+ */
+
+#include <gnutls_int.h>
+#include <gnutls_hash_int.h>
+#include <gnutls_errors.h>
+
+static inline Gc_hash
+_gnutls_mac2gc (gnutls_mac_algorithm_t mac)
+{
+  switch (mac)
+    {
+    case GNUTLS_MAC_NULL:
+      return -1;
+      break;
+    case GNUTLS_MAC_SHA1:
+      return GC_SHA1;
+      break;
+    case GNUTLS_MAC_SHA256:
+      return GC_SHA256;
+      break;
+    case GNUTLS_MAC_MD5:
+      return GC_MD5;
+      break;
+    default:
+      gnutls_assert ();
+      return -1;
+    }
+  return -1;
+}
+
+GNUTLS_HASH_HANDLE
+_gnutls_hash_init (gnutls_mac_algorithm_t algorithm)
+{
+  mac_hd_t ret;
+  int result;
+
+  ret = gnutls_malloc (sizeof (mac_hd_st));
+  if (ret == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_HASH_FAILED;
+    }
+
+  ret->algorithm = algorithm;
+
+  result = gc_hash_open (_gnutls_mac2gc (algorithm), 0, &ret->handle);
+  if (result)
+    {
+      gnutls_assert ();
+      gnutls_free (ret);
+      ret = GNUTLS_HASH_FAILED;
+    }
+
+  return ret;
+}
+
+int
+_gnutls_hash_get_algo_len (gnutls_mac_algorithm_t algorithm)
+{
+  int ret;
+
+  ret = gc_hash_digest_length (_gnutls_mac2gc (algorithm));
+
+  return ret;
+
+}
+
+int
+_gnutls_hash (GNUTLS_HASH_HANDLE handle, const void *text, size_t textlen)
+{
+  if (textlen > 0)
+    gc_hash_write (handle->handle, textlen, text);
+  return 0;
+}
+
+GNUTLS_HASH_HANDLE
+_gnutls_hash_copy (GNUTLS_HASH_HANDLE handle)
+{
+  GNUTLS_HASH_HANDLE ret;
+  int result;
+
+  ret = gnutls_malloc (sizeof (mac_hd_st));
+
+  if (ret == NULL)
+    return GNUTLS_HASH_FAILED;
+
+  ret->algorithm = handle->algorithm;
+  ret->key = NULL;              /* it's a hash anyway */
+  ret->keysize = 0;
+
+  result = gc_hash_clone (handle->handle, &ret->handle);
+
+  if (result)
+    {
+      gnutls_free (ret);
+      return GNUTLS_HASH_FAILED;
+    }
+
+  return ret;
+}
+
+void
+_gnutls_hash_deinit (GNUTLS_HASH_HANDLE handle, void *digest)
+{
+  const opaque *mac;
+  int maclen;
+
+  maclen = _gnutls_hash_get_algo_len (handle->algorithm);
+
+  mac = gc_hash_read (handle->handle);
+  if (digest != NULL)
+    memcpy (digest, mac, maclen);
+
+  gc_hash_close (handle->handle);
+
+  gnutls_free (handle);
+}
+
+
+mac_hd_t
+_gnutls_hmac_init (gnutls_mac_algorithm_t algorithm,
+                   const void *key, int keylen)
+{
+  mac_hd_t ret;
+  int result;
+
+  ret = gnutls_malloc (sizeof (mac_hd_st));
+  if (ret == NULL)
+    return GNUTLS_MAC_FAILED;
+
+  result = gc_hash_open (_gnutls_mac2gc (algorithm), GC_HMAC, &ret->handle);
+  if (result)
+    {
+      gnutls_free (ret);
+      return GNUTLS_MAC_FAILED;
+    }
+
+  gc_hash_hmac_setkey (ret->handle, keylen, key);
+
+  ret->algorithm = algorithm;
+  ret->key = key;
+  ret->keysize = keylen;
+
+  return ret;
+}
+
+void
+_gnutls_hmac_deinit (mac_hd_t handle, void *digest)
+{
+  const opaque *mac;
+  int maclen;
+
+  maclen = _gnutls_hash_get_algo_len (handle->algorithm);
+
+  mac = gc_hash_read (handle->handle);
+
+  if (digest != NULL)
+    memcpy (digest, mac, maclen);
+
+  gc_hash_close (handle->handle);
+
+  gnutls_free (handle);
+}
+
+inline static int
+get_padsize (gnutls_mac_algorithm_t algorithm)
+{
+  switch (algorithm)
+    {
+    case GNUTLS_MAC_MD5:
+      return 48;
+    case GNUTLS_MAC_SHA1:
+      return 40;
+    default:
+      return 0;
+    }
+}
+
+mac_hd_t
+_gnutls_mac_init_ssl3 (gnutls_mac_algorithm_t algorithm, void *key,
+                       int keylen)
+{
+  mac_hd_t ret;
+  opaque ipad[48];
+  int padsize;
+
+  padsize = get_padsize (algorithm);
+  if (padsize == 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_MAC_FAILED;
+    }
+
+  memset (ipad, 0x36, padsize);
+
+  ret = _gnutls_hash_init (algorithm);
+  if (ret != GNUTLS_HASH_FAILED)
+    {
+      ret->key = key;
+      ret->keysize = keylen;
+
+      if (keylen > 0)
+        _gnutls_hash (ret, key, keylen);
+      _gnutls_hash (ret, ipad, padsize);
+    }
+
+  return ret;
+}
+
+void
+_gnutls_mac_deinit_ssl3 (mac_hd_t handle, void *digest)
+{
+  opaque ret[MAX_HASH_SIZE];
+  mac_hd_t td;
+  opaque opad[48];
+  int padsize;
+  int block;
+
+  padsize = get_padsize (handle->algorithm);
+  if (padsize == 0)
+    {
+      gnutls_assert ();
+      return;
+    }
+
+  memset (opad, 0x5C, padsize);
+
+  td = _gnutls_hash_init (handle->algorithm);
+  if (td != GNUTLS_MAC_FAILED)
+    {
+      if (handle->keysize > 0)
+        _gnutls_hash (td, handle->key, handle->keysize);
+
+      _gnutls_hash (td, opad, padsize);
+      block = _gnutls_hmac_get_algo_len (handle->algorithm);
+      _gnutls_hash_deinit (handle, ret);        /* get the previous hash */
+      _gnutls_hash (td, ret, block);
+
+      _gnutls_hash_deinit (td, digest);
+    }
+}
+
+void
+_gnutls_mac_deinit_ssl3_handshake (mac_hd_t handle,
+                                   void *digest, opaque * key,
+                                   uint32_t key_size)
+{
+  opaque ret[MAX_HASH_SIZE];
+  mac_hd_t td;
+  opaque opad[48];
+  opaque ipad[48];
+  int padsize;
+  int block;
+
+  padsize = get_padsize (handle->algorithm);
+  if (padsize == 0)
+    {
+      gnutls_assert ();
+      return;
+    }
+
+  memset (opad, 0x5C, padsize);
+  memset (ipad, 0x36, padsize);
+
+  td = _gnutls_hash_init (handle->algorithm);
+  if (td != GNUTLS_HASH_FAILED)
+    {
+      if (key_size > 0)
+        _gnutls_hash (td, key, key_size);
+
+      _gnutls_hash (td, opad, padsize);
+      block = _gnutls_hmac_get_algo_len (handle->algorithm);
+
+      if (key_size > 0)
+        _gnutls_hash (handle, key, key_size);
+      _gnutls_hash (handle, ipad, padsize);
+      _gnutls_hash_deinit (handle, ret);        /* get the previous hash */
+
+      _gnutls_hash (td, ret, block);
+
+      _gnutls_hash_deinit (td, digest);
+    }
+}
+
+static int
+ssl3_sha (int i, opaque * secret, int secret_len,
+          opaque * rnd, int rnd_len, void *digest)
+{
+  int j;
+  opaque text1[26];
+
+  GNUTLS_HASH_HANDLE td;
+
+  for (j = 0; j < i + 1; j++)
+    {
+      text1[j] = 65 + i;        /* A==65 */
+    }
+
+  td = _gnutls_hash_init (GNUTLS_MAC_SHA1);
+  if (td == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_HASH_FAILED;
+    }
+
+  _gnutls_hash (td, text1, i + 1);
+  _gnutls_hash (td, secret, secret_len);
+  _gnutls_hash (td, rnd, rnd_len);
+
+  _gnutls_hash_deinit (td, digest);
+  return 0;
+}
+
+static int
+ssl3_md5 (int i, opaque * secret, int secret_len,
+          opaque * rnd, int rnd_len, void *digest)
+{
+  opaque tmp[MAX_HASH_SIZE];
+  mac_hd_t td;
+  int ret;
+
+  td = _gnutls_hash_init (GNUTLS_MAC_MD5);
+  if (td == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_HASH_FAILED;
+    }
+
+  _gnutls_hash (td, secret, secret_len);
+
+  ret = ssl3_sha (i, secret, secret_len, rnd, rnd_len, tmp);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      _gnutls_hash_deinit (td, digest);
+      return ret;
+    }
+
+  _gnutls_hash (td, tmp, _gnutls_hash_get_algo_len (GNUTLS_MAC_SHA1));
+
+  _gnutls_hash_deinit (td, digest);
+  return 0;
+}
+
+int
+_gnutls_ssl3_hash_md5 (void *first, int first_len,
+                       void *second, int second_len, int ret_len,
+                       opaque * ret)
+{
+  opaque digest[MAX_HASH_SIZE];
+  mac_hd_t td;
+  int block = _gnutls_hash_get_algo_len (GNUTLS_MAC_MD5);
+
+  td = _gnutls_hash_init (GNUTLS_MAC_MD5);
+  if (td == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_HASH_FAILED;
+    }
+
+  _gnutls_hash (td, first, first_len);
+  _gnutls_hash (td, second, second_len);
+
+  _gnutls_hash_deinit (td, digest);
+
+  if (ret_len > block)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  memcpy (ret, digest, ret_len);
+
+  return 0;
+
+}
+
+int
+_gnutls_ssl3_generate_random (void *secret, int secret_len,
+                              void *rnd, int rnd_len,
+                              int ret_bytes, opaque * ret)
+{
+  int i = 0, copy, output_bytes;
+  opaque digest[MAX_HASH_SIZE];
+  int block = _gnutls_hash_get_algo_len (GNUTLS_MAC_MD5);
+  int result, times;
+
+  output_bytes = 0;
+  do
+    {
+      output_bytes += block;
+    }
+  while (output_bytes < ret_bytes);
+
+  times = output_bytes / block;
+
+  for (i = 0; i < times; i++)
+    {
+
+      result = ssl3_md5 (i, secret, secret_len, rnd, rnd_len, digest);
+      if (result < 0)
+        {
+          gnutls_assert ();
+          return result;
+        }
+
+      if ((1 + i) * block < ret_bytes)
+        {
+          copy = block;
+        }
+      else
+        {
+          copy = ret_bytes - (i) * block;
+        }
+
+      memcpy (&ret[i * block], digest, copy);
+    }
+
+  return 0;
+}
diff --git a/src/daemon/https/tls/gnutls_hash_int.h b/src/daemon/https/tls/gnutls_hash_int.h
new file mode 100644
index 00000000..3e1b75e6
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_hash_int.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#ifndef GNUTLS_HASH_INT_H
+# define GNUTLS_HASH_INT_H
+
+#include <gnutls_int.h>
+
+/* for message digests */
+
+typedef struct
+{
+  gc_hash_handle handle;
+  gnutls_mac_algorithm_t algorithm;
+  const void *key;
+  int keysize;
+} mac_hd_st;
+typedef mac_hd_st *mac_hd_t;
+typedef mac_hd_t GNUTLS_HASH_HANDLE;
+
+#define GNUTLS_HASH_FAILED NULL
+#define GNUTLS_MAC_FAILED NULL
+
+mac_hd_t _gnutls_hmac_init (gnutls_mac_algorithm_t algorithm,
+                            const void *key, int keylen);
+#define _gnutls_hmac_get_algo_len _gnutls_hash_get_algo_len
+#define _gnutls_hmac _gnutls_hash
+void _gnutls_hmac_deinit (mac_hd_t handle, void *digest);
+
+mac_hd_t _gnutls_mac_init_ssl3 (gnutls_mac_algorithm_t algorithm, void *key,
+                                int keylen);
+void _gnutls_mac_deinit_ssl3 (mac_hd_t handle, void *digest);
+
+GNUTLS_HASH_HANDLE _gnutls_hash_init (gnutls_mac_algorithm_t algorithm);
+int _gnutls_hash_get_algo_len (gnutls_mac_algorithm_t algorithm);
+int _gnutls_hash (GNUTLS_HASH_HANDLE handle, const void *text,
+                  size_t textlen);
+void _gnutls_hash_deinit (GNUTLS_HASH_HANDLE handle, void *digest);
+
+int _gnutls_ssl3_generate_random (void *secret, int secret_len,
+                                  void *rnd, int random_len, int bytes,
+                                  opaque * ret);
+int _gnutls_ssl3_hash_md5 (void *first, int first_len, void *second,
+                           int second_len, int ret_len, opaque * ret);
+
+void _gnutls_mac_deinit_ssl3_handshake (mac_hd_t handle, void *digest,
+                                        opaque * key, uint32_t key_size);
+
+GNUTLS_HASH_HANDLE _gnutls_hash_copy (GNUTLS_HASH_HANDLE handle);
+
+#endif /* GNUTLS_HASH_INT_H */
diff --git a/src/daemon/https/tls/gnutls_int.h b/src/daemon/https/tls/gnutls_int.h
new file mode 100644
index 00000000..9c54262e
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_int.h
@@ -0,0 +1,679 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#ifndef GNUTLS_INT_H
+
+#define GNUTLS_INT_H
+
+#include <defines.h>
+
+#include <gnutls.h>
+#include <extra.h>
+#include <gnutls_mem.h>
+
+/* FIXME: delete this once opencdk has reentrant keyring functions
+ */
+#define KEYRING_HACK
+
+#define MAX32 4294967295
+#define MAX24 16777215
+#define MAX16 65535
+
+/* The size of a handshake message should not
+ * be larger than this value.
+ */
+#define MAX_HANDSHAKE_PACKET_SIZE 48*1024
+
+#define TLS_RANDOM_SIZE 32
+#define TLS_MAX_SESSION_ID_SIZE 32
+#define TLS_MASTER_SIZE 48
+
+/* The maximum digest size of hash algorithms. 
+ */
+#define MAX_HASH_SIZE 64
+
+#define MAX_LOG_SIZE 1024       /* maximum size of log message */
+#define MAX_SRP_USERNAME 128
+#define MAX_SERVER_NAME_SIZE 128
+
+/* we can receive up to MAX_EXT_TYPES extensions.
+ */
+#define MAX_EXT_TYPES 64
+
+/* The initial size of the receive
+ * buffer size. This will grow if larger
+ * packets are received.
+ */
+#define INITIAL_RECV_BUFFER_SIZE 256
+
+/* the default for TCP */
+#define DEFAULT_LOWAT 1
+
+/* expire time for resuming sessions */
+#define DEFAULT_EXPIRE_TIME 3600
+
+/* the maximum size of encrypted packets */
+#define DEFAULT_MAX_RECORD_SIZE 16384
+#define RECORD_HEADER_SIZE 5
+#define MAX_RECORD_SEND_SIZE (size_t)session->security_parameters.max_record_send_size
+#define MAX_RECORD_RECV_SIZE (size_t)session->security_parameters.max_record_recv_size
+#define MAX_PAD_SIZE 255
+#define EXTRA_COMP_SIZE 2048
+#define MAX_RECORD_OVERHEAD MAX_PAD_SIZE+EXTRA_COMP_SIZE
+#define MAX_RECV_SIZE MAX_RECORD_OVERHEAD+MAX_RECORD_RECV_SIZE+RECORD_HEADER_SIZE
+
+#define HANDSHAKE_HEADER_SIZE 4
+
+/* defaults for verification functions
+ */
+#define DEFAULT_VERIFY_DEPTH 32
+#define DEFAULT_VERIFY_BITS 16*1024
+
+#define DECR_LEN(len, x) do { len-=x; if (len<0) {gnutls_assert(); return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;} } while (0)
+#define DECR_LENGTH_RET(len, x, RET) do { len-=x; if (len<0) {gnutls_assert(); return RET;} } while (0)
+#define DECR_LENGTH_COM(len, x, COM) do { len-=x; if (len<0) {gnutls_assert(); COM;} } while (0)
+
+#define HASH2MAC(x) ((gnutls_mac_algorithm_t)x)
+
+// TODO rm
+/* Additional cast to bring void* to a type castable to int. */
+#define GNUTLS_POINTER_TO_INT_CAST (long)
+
+#define GNUTLS_POINTER_TO_INT(_) ((int) GNUTLS_POINTER_TO_INT_CAST (_))
+#define GNUTLS_INT_TO_POINTER(_) ((void*) GNUTLS_POINTER_TO_INT_CAST (_))
+
+typedef unsigned char opaque;
+typedef struct
+  {
+    opaque pint[3];
+  } uint24;
+
+#include <gnutls_mpi.h>
+
+typedef enum change_cipher_spec_t
+  { 
+    GNUTLS_TYPE_CHANGE_CIPHER_SPEC = 1
+  } change_cipher_spec_t;
+
+typedef enum handshake_state_t
+  {
+    STATE0 = 0, STATE1, STATE2,
+    STATE3, STATE4, STATE5,
+    STATE6, STATE7, STATE8, STATE9, STATE20 = 20, STATE21,
+    STATE30 = 30, STATE31, STATE50 = 50, STATE60 = 60, STATE61, STATE62,
+    STATE70, STATE71
+  } handshake_state_t;
+
+#include <gnutls_buffer.h>
+
+/* This is the maximum number of algorithms (ciphers or macs etc).
+ * keep it synced with GNUTLS_MAX_ALGORITHM_NUM in gnutls.h
+ */
+#define MAX_ALGOS 16
+
+#define MAX_CIPHERSUITES 256
+
+typedef enum extensions_t
+  { GNUTLS_EXTENSION_SERVER_NAME = 0,
+    GNUTLS_EXTENSION_MAX_RECORD_SIZE = 1,
+    GNUTLS_EXTENSION_CERT_TYPE = 9,
+#ifdef ENABLE_OPRFI
+    GNUTLS_EXTENSION_OPAQUE_PRF_INPUT = ENABLE_OPRFI,
+#endif
+    GNUTLS_EXTENSION_SRP = 12,
+    GNUTLS_EXTENSION_INNER_APPLICATION = 37703
+  } extensions_t;
+
+typedef enum
+  { CIPHER_STREAM, CIPHER_BLOCK} cipher_type_t;
+
+typedef enum valid_session_t
+  { VALID_TRUE, VALID_FALSE} valid_session_t;
+typedef enum resumable_session_t
+  { RESUME_TRUE,
+    RESUME_FALSE
+  } resumable_session_t;
+
+/* Record Protocol */
+typedef enum content_type_t
+  {
+    GNUTLS_CHANGE_CIPHER_SPEC = 20, GNUTLS_ALERT,
+    GNUTLS_HANDSHAKE, GNUTLS_APPLICATION_DATA,
+    GNUTLS_INNER_APPLICATION = 24
+  } content_type_t;
+
+#define GNUTLS_PK_ANY (gnutls_pk_algorithm_t)-1
+#define GNUTLS_PK_NONE (gnutls_pk_algorithm_t)-2
+
+/* STATE (stop) */
+
+typedef void (*LOG_FUNC)(int,
+                         const char *);
+
+/* Store & Retrieve functions defines:  */
+typedef struct auth_cred_st
+  {
+    gnutls_credentials_type_t algorithm;
+
+    /* the type of credentials depends on algorithm 
+     */
+    void *credentials;
+    struct auth_cred_st *next;
+  } auth_cred_st;
+
+struct gnutls_key_st
+  {
+    /* For DH KX */
+    gnutls_datum_t key;
+    mpi_t KEY;
+    mpi_t client_Y;
+    mpi_t client_g;
+    mpi_t client_p;
+    mpi_t dh_secret;
+    /* for SRP */
+    mpi_t A;
+    mpi_t B;
+    mpi_t u;
+    mpi_t b;
+    mpi_t a;
+    mpi_t x;
+    /* RSA: e, m
+     */
+    mpi_t rsa[2];
+
+    /* this is used to hold the peers authentication data 
+     */
+    /* auth_info_t structures SHOULD NOT contain malloced 
+     * elements. Check gnutls_session_pack.c, and gnutls_auth.c.
+     * Rememember that this should be calloced!
+     */
+    void *auth_info;
+    gnutls_credentials_type_t auth_info_type;
+    int auth_info_size; /* needed in order to store to db for restoring 
+     */
+    uint8_t crypt_algo;
+
+    auth_cred_st *cred; /* used to specify keys/certificates etc */
+
+    int certificate_requested;
+  /* some ciphersuites use this
+   * to provide client authentication.
+   * 1 if client auth was requested
+   * by the peer, 0 otherwise
+   *** In case of a server this
+   * holds 1 if we should wait
+   * for a client certificate verify
+   */
+  };
+typedef struct gnutls_key_st *gnutls_key_st;
+
+/* STATE (cont) */
+#include <gnutls_hash_int.h>
+#include <gnutls_cipher_int.h>
+#include <gnutls_compress_int.h>
+#include <gnutls_cert.h>
+
+typedef struct
+  {
+    uint8_t suite[2];
+  } cipher_suite_st;
+
+/* This structure holds parameters got from TLS extension
+ * mechanism. (some extensions may hold parameters in auth_info_t
+ * structures also - see SRP).
+ */
+typedef struct
+  {
+    opaque name[MAX_SERVER_NAME_SIZE];
+    unsigned name_length;
+    gnutls_server_name_type_t type;
+  } server_name_st;
+
+#define MAX_SERVER_NAME_EXTENSIONS 3
+typedef struct
+  {
+    server_name_st server_names[MAX_SERVER_NAME_EXTENSIONS];
+    /* limit server_name extensions */
+    unsigned server_names_size;
+
+    opaque srp_username[MAX_SRP_USERNAME + 1];
+
+    /* TLS/IA data. */
+    int gnutls_ia_enable, gnutls_ia_peer_enable;
+    int gnutls_ia_allowskip, gnutls_ia_peer_allowskip;
+
+    /* Used by extensions that enable supplemental data. */
+    int do_recv_supplemental, do_send_supplemental;
+
+    /* Opaque PRF input. */
+    gnutls_oprfi_callback_func oprfi_cb;
+    void *oprfi_userdata;
+    opaque *oprfi_client;
+    uint16_t oprfi_client_len;
+    opaque *oprfi_server;
+    uint16_t oprfi_server_len;
+  } tls_ext_st;
+
+/* This flag indicates for an extension whether
+ * it is useful to application level or TLS level only.
+ * This is used to parse the application level extensions
+ * before the user_hello callback is called.
+ */
+typedef enum tls_ext_parse_type_t
+  {
+    EXTENSION_ANY,
+    EXTENSION_APPLICATION,
+    EXTENSION_TLS
+  } tls_ext_parse_type_t;
+
+/* auth_info_t structures now MAY contain malloced 
+ * elements.
+ */
+
+/* This structure and auth_info_t, are stored in the resume database,
+ * and are restored, in case of resume.
+ * Holds all the required parameters to resume the current 
+ * session.
+ */
+
+/* if you add anything in Security_Parameters struct, then
+ * also modify CPY_COMMON in gnutls_constate.c
+ */
+
+/* Note that the security parameters structure is set up after the
+ * handshake has finished. The only value you may depend on while
+ * the handshake is in progress is the cipher suite value.
+ */
+typedef struct
+  {
+    gnutls_connection_end_t entity;
+    gnutls_kx_algorithm_t kx_algorithm;
+    /* we've got separate write/read bulk/macs because
+     * there is a time in handshake where the peer has
+     * null cipher and we don't
+     */
+    gnutls_cipher_algorithm_t read_bulk_cipher_algorithm;
+    gnutls_mac_algorithm_t read_mac_algorithm;
+    gnutls_compression_method_t read_compression_algorithm;
+
+    gnutls_cipher_algorithm_t write_bulk_cipher_algorithm;
+    gnutls_mac_algorithm_t write_mac_algorithm;
+    gnutls_compression_method_t write_compression_algorithm;
+
+    /* this is the ciphersuite we are going to use 
+     * moved here from internals in order to be restored
+     * on resume;
+     */
+    cipher_suite_st current_cipher_suite;
+    opaque master_secret[TLS_MASTER_SIZE];
+    opaque client_random[TLS_RANDOM_SIZE];
+    opaque server_random[TLS_RANDOM_SIZE];
+    opaque session_id[TLS_MAX_SESSION_ID_SIZE];
+    uint8_t session_id_size;
+    time_t timestamp;
+    tls_ext_st extensions;
+
+    /* The send size is the one requested by the programmer.
+     * The recv size is the one negotiated with the peer.
+     */
+    uint16_t max_record_send_size;
+    uint16_t max_record_recv_size;
+    /* holds the negotiated certificate type */
+    gnutls_certificate_type_t cert_type;
+    gnutls_protocol_t version; /* moved here */
+    /* For TLS/IA.  XXX: Move to IA credential? */
+    opaque inner_secret[TLS_MASTER_SIZE];
+  } security_parameters_st;
+
+/* This structure holds the generated keys
+ */
+typedef struct
+  {
+    gnutls_datum_t server_write_mac_secret;
+    gnutls_datum_t client_write_mac_secret;
+    gnutls_datum_t server_write_IV;
+    gnutls_datum_t client_write_IV;
+    gnutls_datum_t server_write_key;
+    gnutls_datum_t client_write_key;
+    int generated_keys; /* zero if keys have not
+     * been generated. Non zero
+     * otherwise.
+     */
+  } cipher_specs_st;
+
+typedef struct
+  {
+    cipher_hd_t write_cipher_state;
+    cipher_hd_t read_cipher_state;
+    comp_hd_t read_compression_state;
+    comp_hd_t write_compression_state;
+    gnutls_datum_t read_mac_secret;
+    gnutls_datum_t write_mac_secret;
+    uint64 read_sequence_number;
+    uint64 write_sequence_number;
+  } conn_stat_st;
+
+typedef struct
+  {
+    unsigned int priority[MAX_ALGOS];
+    unsigned int algorithms;
+  } priority_st;
+
+/* For the external api */
+struct gnutls_priority_st
+  {
+    priority_st cipher;
+    priority_st mac;
+    priority_st kx;
+    priority_st compression;
+    priority_st protocol;
+    priority_st cert_type;
+
+    /* to disable record padding */
+    int no_padding;
+  };
+
+/* DH and RSA parameters types.
+ */
+typedef struct gnutls_dh_params_int
+  {
+    /* [0] is the prime, [1] is the generator.
+     */
+    mpi_t params[2];
+  } dh_params_st;
+
+typedef struct
+  {
+    gnutls_dh_params_t dh_params;
+    int free_dh_params;
+    gnutls_rsa_params_t rsa_params;
+    int free_rsa_params;
+  } internal_params_st;
+
+typedef struct
+  {
+    opaque header[HANDSHAKE_HEADER_SIZE];
+    /* this holds the number of bytes in the handshake_header[] */
+    size_t header_size;
+    /* this holds the length of the handshake packet */
+    size_t packet_length;
+    gnutls_handshake_description_t recv_type;
+  } handshake_header_buffer_st;
+
+typedef struct
+  {
+    gnutls_buffer application_data_buffer; /* holds data to be delivered to application layer */
+    gnutls_buffer handshake_hash_buffer; /* used to keep the last received handshake 
+     * message */
+    mac_hd_t handshake_mac_handle_sha; /* hash of the handshake messages */
+    mac_hd_t handshake_mac_handle_md5; /* hash of the handshake messages */
+
+    gnutls_buffer handshake_data_buffer; /* this is a buffer that holds the current handshake message */
+    gnutls_buffer ia_data_buffer; /* holds inner application data (TLS/IA) */
+    resumable_session_t resumable; /* TRUE or FALSE - if we can resume that session */
+    handshake_state_t handshake_state; /* holds
+     * a number which indicates where
+     * the handshake procedure has been
+     * interrupted. If it is 0 then
+     * no interruption has happened.
+     */
+
+    valid_session_t valid_connection; /* true or FALSE - if this session is valid */
+
+    int may_not_read; /* if it's 0 then we can read/write, otherwise it's forbiden to read/write
+     */
+    int may_not_write;
+    int read_eof; /* non-zero if we have received a closure alert. */
+
+    int last_alert; /* last alert received */
+
+    /* The last handshake messages sent or received.
+     */
+    int last_handshake_in;
+    int last_handshake_out;
+
+    /* this is the compression method we are going to use */
+    gnutls_compression_method_t compression_method;
+
+    /* priorities */
+    struct gnutls_priority_st priorities;
+
+    /* resumed session */
+    resumable_session_t resumed; /* RESUME_TRUE or FALSE - if we are resuming a session */
+    security_parameters_st resumed_security_parameters;
+
+    /* sockets internals */
+    int lowat;
+
+    /* These buffers are used in the handshake
+     * protocol only. freed using _gnutls_handshake_io_buffer_clear();
+     */
+    gnutls_buffer handshake_send_buffer;
+    size_t handshake_send_buffer_prev_size;
+    content_type_t handshake_send_buffer_type;
+    gnutls_handshake_description_t handshake_send_buffer_htype;
+    content_type_t handshake_recv_buffer_type;
+    gnutls_handshake_description_t handshake_recv_buffer_htype;
+    gnutls_buffer handshake_recv_buffer;
+
+    /* this buffer holds a record packet -mostly used for
+     * non blocking IO.
+     */
+    gnutls_buffer record_recv_buffer;
+    gnutls_buffer record_send_buffer; /* holds cached data
+     * for the gnutls_io_write_buffered()
+     * function.
+     */
+    size_t record_send_buffer_prev_size; /* holds the
+     * data written in the previous runs.
+     */
+    size_t record_send_buffer_user_size; /* holds the
+     * size of the user specified data to
+     * send.
+     */
+
+    /* 0 if no peeked data was kept, 1 otherwise.
+     */
+    int have_peeked_data;
+
+    int expire_time; /* after expire_time seconds this session will expire */
+    struct mod_auth_st_int *auth_struct; /* used in handshake packets and KX algorithms */
+    int v2_hello; /* 0 if the client hello is v3+.
+     * non-zero if we got a v2 hello.
+     */
+    /* keeps the headers of the handshake packet 
+     */
+    handshake_header_buffer_st handshake_header_buffer;
+
+    /* this is the highest version available
+     * to the peer. (advertized version).
+     * This is obtained by the Handshake Client Hello 
+     * message. (some implementations read the Record version)
+     */
+    uint8_t adv_version_major;
+    uint8_t adv_version_minor;
+
+    /* if this is non zero a certificate request message
+     * will be sent to the client. - only if the ciphersuite
+     * supports it.
+     */
+    int send_cert_req;
+
+    /* bits to use for DHE and DHA 
+     * use _gnutls_dh_get_prime_bits() and gnutls_dh_set_prime_bits() 
+     * to access it.
+     */
+    uint16_t dh_prime_bits;
+
+    size_t max_handshake_data_buffer_size;
+
+    /* PUSH & PULL functions.
+     */
+    gnutls_pull_func _gnutls_pull_func;
+    gnutls_push_func _gnutls_push_func;
+    /* Holds the first argument of PUSH and PULL
+     * functions;
+     */
+    gnutls_transport_ptr_t transport_recv_ptr;
+    gnutls_transport_ptr_t transport_send_ptr;
+
+    /* STORE & RETRIEVE functions. Only used if other
+     * backend than gdbm is used.
+     */
+    gnutls_db_store_func db_store_func;
+    gnutls_db_retr_func db_retrieve_func;
+    gnutls_db_remove_func db_remove_func;
+    void *db_ptr;
+
+    /* post client hello callback (server side only)
+     */
+    gnutls_handshake_post_client_hello_func user_hello_func;
+
+    /* Holds the record size requested by the
+     * user.
+     */
+    uint16_t proposed_record_size;
+
+    /* holds the selected certificate and key.
+     * use _gnutls_selected_certs_deinit() and _gnutls_selected_certs_set()
+     * to change them.
+     */
+    gnutls_cert *selected_cert_list;
+    int selected_cert_list_length;
+    gnutls_privkey *selected_key;
+    int selected_need_free;
+
+    /* holds the extensions we sent to the peer
+     * (in case of a client)
+     */
+    uint16_t extensions_sent[MAX_EXT_TYPES];
+    uint16_t extensions_sent_size;
+
+    /* is 0 if we are to send the whole PGP key, or non zero
+     * if the fingerprint is to be sent.
+     */
+    int pgp_fingerprint;
+
+    /* This holds the default version that our first
+     * record packet will have. */
+    opaque default_record_version[2];
+
+    int cbc_protection_hack;
+
+    void *user_ptr;
+
+    int enable_private; /* non zero to
+     * enable cipher suites
+     * which have 0xFF status.
+     */
+
+    /* Holds 0 if the last called function was interrupted while
+     * receiving, and non zero otherwise.
+     */
+    int direction;
+
+    /* This callback will be used (if set) to receive an
+     * openpgp key. (if the peer sends a fingerprint)
+     */
+    gnutls_openpgp_recv_key_func openpgp_recv_key_func;
+
+    /* If non zero the server will not advertize the CA's he
+     * trusts (do not send an RDN sequence).
+     */
+    int ignore_rdn_sequence;
+
+    /* This is used to set an arbitary version in the RSA
+     * PMS secret. Can be used by clients to test whether the
+     * server checks that version. (** only used in gnutls-cli-debug)
+     */
+    opaque rsa_pms_version[2];
+
+    char *srp_username;
+    char *srp_password;
+
+    /* Here we cache the DH or RSA parameters got from the
+     * credentials structure, or from a callback. That is to
+     * minimize external calls.
+     */
+    internal_params_st params;
+
+    /* This buffer is used by the record recv functions,
+     * as a temporary store buffer.
+     */
+    gnutls_datum_t recv_buffer;
+
+    /* To avoid using global variables, and especially on Windows where
+     * the application may use a different errno variable than GnuTLS,
+     * it is possible to use gnutls_transport_set_errno to set a
+     * session-specific errno variable in the user-replaceable push/pull
+     * functions.  This value is used by the send/recv functions.  (The
+     * strange name of this variable is because 'errno' is typically
+     * #define'd.)
+     */
+    int errnum;
+
+    /* Function used to perform public-key signing operation during
+     handshake.  Used by gnutls_sig.c:_gnutls_tls_sign(), see also
+     gnutls_sign_callback_set(). */
+    gnutls_sign_func sign_func;
+    void *sign_func_userdata;
+
+  /* If you add anything here, check _gnutls_handshake_internal_state_clear().
+   */
+  } internals_st;
+
+struct gnutls_session_int
+  {
+    security_parameters_st security_parameters;
+    cipher_specs_st cipher_specs;
+    conn_stat_st connection_state;
+    internals_st internals;
+    gnutls_key_st key;
+  };
+
+/* functions 
+ */
+void _gnutls_set_current_version(gnutls_session_t session,
+                                 gnutls_protocol_t version);
+
+void _gnutls_free_auth_info(gnutls_session_t session);
+
+/* These two macros return the advertized TLS version of
+ * the peer.
+ */
+#define _gnutls_get_adv_version_major( session) \
+        session->internals.adv_version_major
+
+#define _gnutls_get_adv_version_minor( session) \
+        session->internals.adv_version_minor
+
+#define set_adv_version( session, major, minor) \
+        session->internals.adv_version_major = major; \
+        session->internals.adv_version_minor = minor
+
+void _gnutls_set_adv_version(gnutls_session_t,
+                             gnutls_protocol_t);
+gnutls_protocol_t _gnutls_get_adv_version(gnutls_session_t);
+
+#endif /* GNUTLS_INT_H */
diff --git a/src/daemon/https/tls/gnutls_kx.c b/src/daemon/https/tls/gnutls_kx.c
new file mode 100644
index 00000000..5e7f0d4d
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_kx.c
@@ -0,0 +1,773 @@
+/*
+ * Copyright (C) 2000, 2001, 2004, 2005, 2006  Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* This file contains functions which are wrappers for the key exchange
+ * part of TLS. They are called by the handshake functions (gnutls_handshake)
+ */
+
+#include "gnutls_int.h"
+#include "gnutls_handshake.h"
+#include "gnutls_kx.h"
+#include "gnutls_dh.h"
+#include "gnutls_errors.h"
+#include "gnutls_algorithms.h"
+#include "debug.h"
+#include "gnutls_mpi.h"
+#include <gnutls_state.h>
+#include <gnutls_datum.h>
+#include <gnutls_rsa_export.h>
+
+/* This file contains important thing for the TLS handshake procedure.
+ */
+
+#define MASTER_SECRET "master secret"
+static int generate_normal_master (gnutls_session_t session, int);
+
+int
+_gnutls_generate_master (gnutls_session_t session, int keep_premaster)
+{
+  if (session->internals.resumed == RESUME_FALSE)
+    return generate_normal_master (session, keep_premaster);
+  return 0;
+}
+
+/* here we generate the TLS Master secret.
+ */
+#define PREMASTER session->key->key
+static int
+generate_normal_master (gnutls_session_t session, int keep_premaster)
+{
+  int ret = 0;
+  char buf[512];
+
+  _gnutls_hard_log ("INT: PREMASTER SECRET[%d]: %s\n", PREMASTER.size,
+                    _gnutls_bin2hex (PREMASTER.data, PREMASTER.size, buf,
+                                     sizeof (buf)));
+  _gnutls_hard_log ("INT: CLIENT RANDOM[%d]: %s\n", 32,
+                    _gnutls_bin2hex (session->security_parameters.
+                                     client_random, 32, buf, sizeof (buf)));
+  _gnutls_hard_log ("INT: SERVER RANDOM[%d]: %s\n", 32,
+                    _gnutls_bin2hex (session->security_parameters.
+                                     server_random, 32, buf, sizeof (buf)));
+
+  if (gnutls_protocol_get_version (session) == GNUTLS_SSL3)
+    {
+      opaque rnd[2 * TLS_RANDOM_SIZE + 1];
+
+      memcpy (rnd, session->security_parameters.client_random,
+              TLS_RANDOM_SIZE);
+      memcpy (&rnd[TLS_RANDOM_SIZE],
+              session->security_parameters.server_random, TLS_RANDOM_SIZE);
+
+      ret =
+        _gnutls_ssl3_generate_random (PREMASTER.data, PREMASTER.size,
+                                      rnd, 2 * TLS_RANDOM_SIZE,
+                                      TLS_MASTER_SIZE,
+                                      session->security_parameters.
+                                      master_secret);
+
+    }
+  else if (session->security_parameters.extensions.oprfi_client_len > 0 &&
+           session->security_parameters.extensions.oprfi_server_len > 0)
+    {
+      opaque *rnd;
+      size_t rndlen = 2 * TLS_RANDOM_SIZE;
+
+      rndlen += session->security_parameters.extensions.oprfi_client_len;
+      rndlen += session->security_parameters.extensions.oprfi_server_len;
+
+      rnd = gnutls_malloc (rndlen + 1);
+      if (!rnd)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_MEMORY_ERROR;
+        }
+
+      _gnutls_hard_log ("INT: CLIENT OPRFI[%d]: %s\n",
+                        session->security_parameters.
+                        extensions.oprfi_server_len,
+                        _gnutls_bin2hex (session->security_parameters.
+                                         extensions.oprfi_client,
+                                         session->security_parameters.
+                                         extensions.oprfi_client_len,
+                                         buf, sizeof (buf)));
+      _gnutls_hard_log ("INT: SERVER OPRFI[%d]: %s\n",
+                        session->security_parameters.
+                        extensions.oprfi_server_len,
+                        _gnutls_bin2hex (session->security_parameters.
+                                         extensions.oprfi_server,
+                                         session->security_parameters.
+                                         extensions.oprfi_server_len,
+                                         buf, sizeof (buf)));
+
+      memcpy (rnd, session->security_parameters.client_random,
+              TLS_RANDOM_SIZE);
+      memcpy (rnd + TLS_RANDOM_SIZE,
+              session->security_parameters.extensions.oprfi_client,
+              session->security_parameters.extensions.oprfi_client_len);
+      memcpy (rnd + TLS_RANDOM_SIZE +
+              session->security_parameters.extensions.oprfi_client_len,
+              session->security_parameters.server_random, TLS_RANDOM_SIZE);
+      memcpy (rnd + TLS_RANDOM_SIZE +
+              session->security_parameters.extensions.oprfi_client_len +
+              TLS_RANDOM_SIZE,
+              session->security_parameters.extensions.oprfi_server,
+              session->security_parameters.extensions.oprfi_server_len);
+
+      ret = _gnutls_PRF (session, PREMASTER.data, PREMASTER.size,
+                         MASTER_SECRET, strlen (MASTER_SECRET),
+                         rnd, rndlen, TLS_MASTER_SIZE,
+                         session->security_parameters.master_secret);
+
+      gnutls_free (rnd);
+    }
+  else
+    {
+      opaque rnd[2 * TLS_RANDOM_SIZE + 1];
+
+      memcpy (rnd, session->security_parameters.client_random,
+              TLS_RANDOM_SIZE);
+      memcpy (&rnd[TLS_RANDOM_SIZE],
+              session->security_parameters.server_random, TLS_RANDOM_SIZE);
+
+      ret =
+        _gnutls_PRF (session, PREMASTER.data, PREMASTER.size,
+                     MASTER_SECRET, strlen (MASTER_SECRET),
+                     rnd, 2 * TLS_RANDOM_SIZE, TLS_MASTER_SIZE,
+                     session->security_parameters.master_secret);
+    }
+
+  /* TLS/IA inner secret is derived from the master secret. */
+  memcpy (session->security_parameters.inner_secret,
+          session->security_parameters.master_secret, TLS_MASTER_SIZE);
+
+  if (!keep_premaster)
+    _gnutls_free_datum (&PREMASTER);
+
+  if (ret < 0)
+    return ret;
+
+  _gnutls_hard_log ("INT: MASTER SECRET: %s\n",
+                    _gnutls_bin2hex (session->security_parameters.
+                                     master_secret, TLS_MASTER_SIZE, buf,
+                                     sizeof (buf)));
+
+  return ret;
+}
+
+
+/* This is called when we want to receive the key exchange message of the
+ * server. It does nothing if this type of message is not required
+ * by the selected ciphersuite. 
+ */
+int
+_gnutls_send_server_kx_message (gnutls_session_t session, int again)
+{
+  uint8_t *data = NULL;
+  int data_size = 0;
+  int ret = 0;
+
+  if (session->internals.auth_struct->gnutls_generate_server_kx == NULL)
+    return 0;
+
+  data = NULL;
+  data_size = 0;
+
+  if (again == 0)
+    {
+      data_size =
+        session->internals.auth_struct->
+        gnutls_generate_server_kx (session, &data);
+
+      if (data_size == GNUTLS_E_INT_RET_0)
+        {
+          gnutls_assert ();
+          return 0;
+        }
+
+      if (data_size < 0)
+        {
+          gnutls_assert ();
+          return data_size;
+        }
+    }
+
+  ret =
+    _gnutls_send_handshake (session, data, data_size,
+                            GNUTLS_HANDSHAKE_SERVER_KEY_EXCHANGE);
+  gnutls_free (data);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+  return data_size;
+}
+
+/* This function sends a certificate request message to the
+ * client.
+ */
+int
+_gnutls_send_server_certificate_request (gnutls_session_t session, int again)
+{
+  uint8_t *data = NULL;
+  int data_size = 0;
+  int ret = 0;
+
+  if (session->internals.auth_struct->
+      gnutls_generate_server_certificate_request == NULL)
+    return 0;
+
+  if (session->internals.send_cert_req <= 0)
+    return 0;
+
+  data = NULL;
+  data_size = 0;
+
+  if (again == 0)
+    {
+      data_size =
+        session->internals.auth_struct->
+        gnutls_generate_server_certificate_request (session, &data);
+
+      if (data_size < 0)
+        {
+          gnutls_assert ();
+          return data_size;
+        }
+    }
+  ret =
+    _gnutls_send_handshake (session, data, data_size,
+                            GNUTLS_HANDSHAKE_CERTIFICATE_REQUEST);
+  gnutls_free (data);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+  return data_size;
+}
+
+
+/* This is the function for the client to send the key
+ * exchange message 
+ */
+int
+_gnutls_send_client_kx_message (gnutls_session_t session, int again)
+{
+  uint8_t *data;
+  int data_size;
+  int ret = 0;
+
+  if (session->internals.auth_struct->gnutls_generate_client_kx == NULL)
+    return 0;
+
+
+  data = NULL;
+  data_size = 0;
+
+  if (again == 0)
+    {
+      data_size =
+        session->internals.auth_struct->
+        gnutls_generate_client_kx (session, &data);
+      if (data_size < 0)
+        {
+          gnutls_assert ();
+          return data_size;
+        }
+    }
+  ret =
+    _gnutls_send_handshake (session, data, data_size,
+                            GNUTLS_HANDSHAKE_CLIENT_KEY_EXCHANGE);
+  gnutls_free (data);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return ret;
+}
+
+
+/* This is the function for the client to send the certificate
+ * verify message
+ */
+int
+_gnutls_send_client_certificate_verify (gnutls_session_t session, int again)
+{
+  uint8_t *data;
+  int ret = 0;
+  int data_size;
+
+  /* This is a packet that is only sent by the client
+   */
+  if (session->security_parameters.entity == GNUTLS_SERVER)
+    return 0;
+
+  /* if certificate verify is not needed just exit 
+   */
+  if (session->key->certificate_requested == 0)
+    return 0;
+
+  if (session->internals.auth_struct->gnutls_generate_client_cert_vrfy ==
+      NULL)
+    {
+      gnutls_assert ();
+      return 0;                 /* this algorithm does not support cli_cert_vrfy 
+                                 */
+    }
+
+  data = NULL;
+  data_size = 0;
+
+  if (again == 0)
+    {
+      data_size =
+        session->internals.auth_struct->
+        gnutls_generate_client_cert_vrfy (session, &data);
+      if (data_size < 0)
+        {
+          gnutls_assert ();
+          return data_size;
+        }
+      if (data_size == 0)
+        return 0;
+
+    }
+  ret =
+    _gnutls_send_handshake (session, data,
+                            data_size, GNUTLS_HANDSHAKE_CERTIFICATE_VERIFY);
+  gnutls_free (data);
+
+  return ret;
+}
+
+
+int
+_gnutls_recv_server_kx_message (gnutls_session_t session)
+{
+  uint8_t *data = NULL;
+  int datasize;
+  int ret = 0;
+
+  if (session->internals.auth_struct->gnutls_process_server_kx != NULL)
+    {
+
+      /* EXCEPTION FOR RSA_EXPORT cipher suite 
+       */
+      if (_gnutls_session_is_export (session) != 0 &&
+          _gnutls_peers_cert_less_512 (session) != 0)
+        {
+          gnutls_assert ();
+          return 0;
+        }
+
+      ret =
+        _gnutls_recv_handshake (session, &data,
+                                &datasize,
+                                GNUTLS_HANDSHAKE_SERVER_KEY_EXCHANGE,
+                                MANDATORY_PACKET);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      ret =
+        session->internals.auth_struct->
+        gnutls_process_server_kx (session, data, datasize);
+      gnutls_free (data);
+
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+    }
+  return ret;
+}
+
+int
+_gnutls_recv_server_certificate_request (gnutls_session_t session)
+{
+  uint8_t *data;
+  int datasize;
+  int ret = 0;
+
+  if (session->internals.auth_struct->
+      gnutls_process_server_certificate_request != NULL)
+    {
+
+      ret =
+        _gnutls_recv_handshake (session, &data,
+                                &datasize,
+                                GNUTLS_HANDSHAKE_CERTIFICATE_REQUEST,
+                                OPTIONAL_PACKET);
+      if (ret < 0)
+        return ret;
+
+      if (ret == 0 && datasize == 0)
+        return 0;               /* ignored */
+
+      ret =
+        session->internals.auth_struct->
+        gnutls_process_server_certificate_request (session, data, datasize);
+      gnutls_free (data);
+      if (ret < 0)
+        return ret;
+
+    }
+  return ret;
+}
+
+int
+_gnutls_recv_client_kx_message (gnutls_session_t session)
+{
+  uint8_t *data;
+  int datasize;
+  int ret = 0;
+
+
+  /* Do key exchange only if the algorithm permits it */
+  if (session->internals.auth_struct->gnutls_process_client_kx != NULL)
+    {
+
+      ret =
+        _gnutls_recv_handshake (session, &data,
+                                &datasize,
+                                GNUTLS_HANDSHAKE_CLIENT_KEY_EXCHANGE,
+                                MANDATORY_PACKET);
+      if (ret < 0)
+        return ret;
+
+      ret =
+        session->internals.auth_struct->
+        gnutls_process_client_kx (session, data, datasize);
+      gnutls_free (data);
+      if (ret < 0)
+        return ret;
+
+    }
+
+  return ret;
+}
+
+
+/* This is called when we want send our certificate
+ */
+int
+_gnutls_send_client_certificate (gnutls_session_t session, int again)
+{
+  uint8_t *data = NULL;
+  int data_size = 0;
+  int ret = 0;
+
+
+  if (session->key->certificate_requested == 0)
+    return 0;
+
+  if (session->internals.auth_struct->
+      gnutls_generate_client_certificate == NULL)
+    return 0;
+
+  data = NULL;
+  data_size = 0;
+
+  if (again == 0)
+    {
+      if (gnutls_protocol_get_version (session) != GNUTLS_SSL3 ||
+          session->internals.selected_cert_list_length > 0)
+        {
+          /* TLS 1.0 or SSL 3.0 with a valid certificate 
+           */
+          data_size =
+            session->internals.auth_struct->
+            gnutls_generate_client_certificate (session, &data);
+
+          if (data_size < 0)
+            {
+              gnutls_assert ();
+              return data_size;
+            }
+        }
+    }
+
+  /* In the SSL 3.0 protocol we need to send a
+   * no certificate alert instead of an
+   * empty certificate.
+   */
+  if (gnutls_protocol_get_version (session) == GNUTLS_SSL3 &&
+      session->internals.selected_cert_list_length == 0)
+    {
+      ret =
+        gnutls_alert_send (session, GNUTLS_AL_WARNING,
+                           GNUTLS_A_SSL3_NO_CERTIFICATE);
+
+    }
+  else
+    {                           /* TLS 1.0 or SSL 3.0 with a valid certificate 
+                                 */
+      ret =
+        _gnutls_send_handshake (session, data, data_size,
+                                GNUTLS_HANDSHAKE_CERTIFICATE_PKT);
+      gnutls_free (data);
+    }
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return data_size;
+}
+
+
+/* This is called when we want send our certificate
+ */
+int
+_gnutls_send_server_certificate (gnutls_session_t session, int again)
+{
+  uint8_t *data = NULL;
+  int data_size = 0;
+  int ret = 0;
+
+
+  if (session->internals.auth_struct->
+      gnutls_generate_server_certificate == NULL)
+    return 0;
+
+  data = NULL;
+  data_size = 0;
+
+  if (again == 0)
+    {
+      data_size =
+        session->internals.auth_struct->
+        gnutls_generate_server_certificate (session, &data);
+
+      if (data_size < 0)
+        {
+          gnutls_assert ();
+          return data_size;
+        }
+    }
+  ret =
+    _gnutls_send_handshake (session, data, data_size,
+                            GNUTLS_HANDSHAKE_CERTIFICATE_PKT);
+  gnutls_free (data);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return data_size;
+}
+
+
+int
+_gnutls_recv_client_certificate (gnutls_session_t session)
+{
+  int datasize;
+  opaque *data;
+  int ret = 0;
+  int optional;
+
+  if (session->internals.auth_struct->
+      gnutls_process_client_certificate != NULL)
+    {
+
+      /* if we have not requested a certificate then just return
+       */
+      if (session->internals.send_cert_req == 0)
+        {
+          return 0;
+        }
+
+      if (session->internals.send_cert_req == GNUTLS_CERT_REQUIRE)
+        optional = MANDATORY_PACKET;
+      else
+        optional = OPTIONAL_PACKET;
+
+      ret =
+        _gnutls_recv_handshake (session, &data,
+                                &datasize,
+                                GNUTLS_HANDSHAKE_CERTIFICATE_PKT, optional);
+
+      if (ret < 0)
+        {
+          /* Handle the case of old SSL3 clients who send
+           * a warning alert instead of an empty certificate to indicate
+           * no certificate.
+           */
+          if (optional == OPTIONAL_PACKET &&
+              ret == GNUTLS_E_WARNING_ALERT_RECEIVED &&
+              gnutls_protocol_get_version (session) == GNUTLS_SSL3 &&
+              gnutls_alert_get (session) == GNUTLS_A_SSL3_NO_CERTIFICATE)
+            {
+
+              /* SSL3 does not send an empty certificate,
+               * but this alert. So we just ignore it.
+               */
+              gnutls_assert ();
+              return 0;
+            }
+
+          /* certificate was required 
+           */
+          if ((ret == GNUTLS_E_WARNING_ALERT_RECEIVED
+               || ret == GNUTLS_E_FATAL_ALERT_RECEIVED)
+              && optional == MANDATORY_PACKET)
+            {
+              gnutls_assert ();
+              return GNUTLS_E_NO_CERTIFICATE_FOUND;
+            }
+
+          return ret;
+        }
+
+      if (ret == 0 && datasize == 0 && optional == OPTIONAL_PACKET)
+        {
+          /* Client has not sent the certificate message.
+           * well I'm not sure we should accept this
+           * behaviour.
+           */
+          gnutls_assert ();
+          return 0;
+        }
+      ret =
+        session->internals.auth_struct->
+        gnutls_process_client_certificate (session, data, datasize);
+
+      gnutls_free (data);
+      if (ret < 0 && ret != GNUTLS_E_NO_CERTIFICATE_FOUND)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      /* ok we should expect a certificate verify message now 
+       */
+      if (ret == GNUTLS_E_NO_CERTIFICATE_FOUND && optional == OPTIONAL_PACKET)
+        ret = 0;
+      else
+        session->key->certificate_requested = 1;
+
+    }
+
+  return ret;
+}
+
+int
+_gnutls_recv_server_certificate (gnutls_session_t session)
+{
+  int datasize;
+  opaque *data;
+  int ret = 0;
+
+  if (session->internals.auth_struct->
+      gnutls_process_server_certificate != NULL)
+    {
+
+      ret =
+        _gnutls_recv_handshake (session, &data,
+                                &datasize,
+                                GNUTLS_HANDSHAKE_CERTIFICATE_PKT,
+                                MANDATORY_PACKET);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      ret =
+        session->internals.auth_struct->
+        gnutls_process_server_certificate (session, data, datasize);
+      gnutls_free (data);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+    }
+
+  return ret;
+}
+
+
+/* Recv the client certificate verify. This packet may not
+ * arrive if the peer did not send us a certificate.
+ */
+int
+_gnutls_recv_client_certificate_verify_message (gnutls_session_t session)
+{
+  uint8_t *data;
+  int datasize;
+  int ret = 0;
+
+
+  if (session->internals.auth_struct->gnutls_process_client_cert_vrfy != NULL)
+    {
+
+      if (session->internals.send_cert_req == 0 ||
+          session->key->certificate_requested == 0)
+        {
+          return 0;
+        }
+
+      ret =
+        _gnutls_recv_handshake (session, &data,
+                                &datasize,
+                                GNUTLS_HANDSHAKE_CERTIFICATE_VERIFY,
+                                OPTIONAL_PACKET);
+      if (ret < 0)
+        return ret;
+
+      if (ret == 0 && datasize == 0
+          && session->internals.send_cert_req == GNUTLS_CERT_REQUIRE)
+        {
+          /* certificate was required */
+          gnutls_assert ();
+          return GNUTLS_E_NO_CERTIFICATE_FOUND;
+        }
+
+      ret =
+        session->internals.auth_struct->
+        gnutls_process_client_cert_vrfy (session, data, datasize);
+      gnutls_free (data);
+      if (ret < 0)
+        return ret;
+
+    }
+
+  return ret;
+}
diff --git a/src/daemon/https/tls/gnutls_kx.h b/src/daemon/https/tls/gnutls_kx.h
new file mode 100644
index 00000000..45ba68bd
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_kx.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+int _gnutls_send_server_kx_message (gnutls_session_t session, int again);
+int _gnutls_send_client_kx_message (gnutls_session_t session, int again);
+int _gnutls_recv_server_kx_message (gnutls_session_t session);
+int _gnutls_recv_client_kx_message (gnutls_session_t session);
+int _gnutls_send_client_certificate_verify (gnutls_session_t session,
+                                            int again);
+int _gnutls_send_server_certificate (gnutls_session_t session, int again);
+int _gnutls_generate_master (gnutls_session_t session, int keep_premaster);
+int _gnutls_recv_client_certificate (gnutls_session_t session);
+int _gnutls_recv_server_certificate (gnutls_session_t session);
+int _gnutls_send_client_certificate (gnutls_session_t session, int again);
+int _gnutls_recv_server_certificate_request (gnutls_session_t session);
+int _gnutls_send_server_certificate_request (gnutls_session_t session,
+                                             int again);
+int _gnutls_recv_client_certificate_verify_message (gnutls_session_t session);
diff --git a/src/daemon/https/tls/gnutls_mem.c b/src/daemon/https/tls/gnutls_mem.c
new file mode 100644
index 00000000..91a6fa3c
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_mem.c
@@ -0,0 +1,134 @@
+/*
+ * Copyright (C) 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include <gnutls_int.h>
+#include <gnutls_errors.h>
+#include <gnutls_num.h>
+
+gnutls_alloc_function gnutls_secure_malloc = malloc;
+gnutls_alloc_function gnutls_malloc = malloc;
+gnutls_free_function gnutls_free = free;
+gnutls_realloc_function gnutls_realloc = realloc;
+
+void *(*gnutls_calloc) (size_t, size_t) = calloc;
+char *(*gnutls_strdup) (const char *) = _gnutls_strdup;
+
+int
+_gnutls_is_secure_mem_null (const void *ign)
+{
+  return 0;
+}
+
+int (*_gnutls_is_secure_memory) (const void *) = _gnutls_is_secure_mem_null;
+
+
+void *
+_gnutls_calloc (size_t nmemb, size_t size)
+{
+  void *ret;
+  size *= nmemb;
+  ret = gnutls_malloc (size);
+  if (ret != NULL)
+    memset (ret, 0, size);
+  return ret;
+}
+
+svoid *
+gnutls_secure_calloc (size_t nmemb, size_t size)
+{
+  svoid *ret;
+  size *= nmemb;
+  ret = gnutls_secure_malloc (size);
+  if (ret != NULL)
+    memset (ret, 0, size);
+  return ret;
+}
+
+/* This realloc will free ptr in case realloc
+ * fails.
+ */
+void *
+gnutls_realloc_fast (void *ptr, size_t size)
+{
+  void *ret;
+
+  if (size == 0)
+    return ptr;
+
+  ret = gnutls_realloc (ptr, size);
+  if (ret == NULL)
+    {
+      gnutls_free (ptr);
+    }
+
+  return ret;
+}
+
+char *
+_gnutls_strdup (const char *str)
+{
+  size_t siz = strlen (str) + 1;
+  char *ret;
+
+  ret = gnutls_malloc (siz);
+  if (ret != NULL)
+    memcpy (ret, str, siz);
+  return ret;
+}
+
+
+#if 0
+/* don't use them. They are included for documentation.
+ */
+
+/**
+  * gnutls_malloc - Allocates and returns data
+  *
+  * This function will allocate 's' bytes data, and
+  * return a pointer to memory. This function is supposed
+  * to be used by callbacks.
+  *
+  * The allocation function used is the one set by gnutls_global_set_mem_functions().
+  *
+  **/
+void *
+gnutls_malloc (size_t s)
+{
+}
+
+/**
+  * gnutls_free - Returns a free() like function
+  * @d: pointer to memory
+  *
+  * This function will free data pointed by ptr.
+  *
+  * The deallocation function used is the one set by gnutls_global_set_mem_functions().
+  *
+  **/
+void
+gnutls_free (void *ptr)
+{
+}
+
+#endif
diff --git a/src/daemon/https/tls/gnutls_mem.h b/src/daemon/https/tls/gnutls_mem.h
new file mode 100644
index 00000000..f76081e5
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_mem.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#ifndef GNUTLS_MEM_H
+# define GNUTLS_MEM_H
+
+#ifdef USE_DMALLOC
+# include <dmalloc.h>
+#endif
+
+typedef void svoid;             /* for functions that allocate using gnutls_secure_malloc */
+
+/* Use gnutls_afree() when calling alloca, or
+ * memory leaks may occur in systems which do not
+ * support alloca.
+ */
+#ifdef USE_EFENCE
+# define gnutls_alloca gnutls_malloc
+# define gnutls_afree gnutls_free
+#endif
+
+#ifdef HAVE_ALLOCA
+# ifdef HAVE_ALLOCA_H
+#  include <alloca.h>
+# endif
+# ifndef gnutls_alloca
+#  define gnutls_alloca alloca
+#  define gnutls_afree(x)
+# endif
+#else
+# ifndef gnutls_alloca
+#  define gnutls_alloca gnutls_malloc
+#  define gnutls_afree gnutls_free
+# endif
+#endif /* HAVE_ALLOCA */
+
+extern int (*_gnutls_is_secure_memory) (const void *);
+
+/* this realloc function will return ptr if size==0, and
+ * will free the ptr if the new allocation failed.
+ */
+void *gnutls_realloc_fast (void *ptr, size_t size);
+
+svoid *gnutls_secure_calloc (size_t nmemb, size_t size);
+
+void *_gnutls_calloc (size_t nmemb, size_t size);
+char *_gnutls_strdup (const char *);
+
+#endif /* GNUTLS_MEM_H */
diff --git a/src/daemon/https/tls/gnutls_mpi.c b/src/daemon/https/tls/gnutls_mpi.c
new file mode 100644
index 00000000..0d807a18
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_mpi.c
@@ -0,0 +1,285 @@
+/*
+ * Copyright (C) 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* Here lie everything that has to do with large numbers, libgcrypt and
+ * other stuff that didn't fit anywhere else.
+ */
+
+#include <gnutls_int.h>
+#include <libtasn1.h>
+#include <gnutls_errors.h>
+#include <gnutls_num.h>
+
+/* Functions that refer to the libgcrypt library.
+ */
+
+void
+_gnutls_mpi_release (mpi_t * x)
+{
+  if (*x == NULL)
+    return;
+  gcry_mpi_release (*x);
+  *x = NULL;
+}
+
+/* returns zero on success
+ */
+int
+_gnutls_mpi_scan (mpi_t * ret_mpi, const opaque * buffer, size_t * nbytes)
+{
+  int ret;
+
+  ret = gcry_mpi_scan (ret_mpi, GCRYMPI_FMT_USG, buffer, *nbytes, nbytes);
+  if (ret)
+    return GNUTLS_E_MPI_SCAN_FAILED;
+
+  return 0;
+}
+
+/* returns zero on success. Fails if the number is zero.
+ */
+int
+_gnutls_mpi_scan_nz (mpi_t * ret_mpi, const opaque * buffer, size_t * nbytes)
+{
+  int ret;
+
+  ret = gcry_mpi_scan (ret_mpi, GCRYMPI_FMT_USG, buffer, *nbytes, nbytes);
+  if (ret)
+    return GNUTLS_E_MPI_SCAN_FAILED;
+
+  /* MPIs with 0 bits are illegal
+   */
+  if (_gnutls_mpi_get_nbits (*ret_mpi) == 0)
+    {
+      _gnutls_mpi_release (ret_mpi);
+      return GNUTLS_E_MPI_SCAN_FAILED;
+    }
+
+  return 0;
+}
+
+int
+_gnutls_mpi_scan_pgp (mpi_t * ret_mpi, const opaque * buffer, size_t * nbytes)
+{
+  int ret;
+  ret = gcry_mpi_scan (ret_mpi, GCRYMPI_FMT_PGP, buffer, *nbytes, nbytes);
+  if (ret)
+    return GNUTLS_E_MPI_SCAN_FAILED;
+
+  /* MPIs with 0 bits are illegal
+   */
+  if (_gnutls_mpi_get_nbits (*ret_mpi) == 0)
+    {
+      _gnutls_mpi_release (ret_mpi);
+      return GNUTLS_E_MPI_SCAN_FAILED;
+    }
+
+  return 0;
+}
+
+int
+_gnutls_mpi_print (void *buffer, size_t * nbytes, const mpi_t a)
+{
+  int ret;
+
+  if (nbytes == NULL || a == NULL)
+    return GNUTLS_E_INVALID_REQUEST;
+
+  ret = gcry_mpi_print (GCRYMPI_FMT_USG, buffer, *nbytes, nbytes, a);
+  if (!ret)
+    return 0;
+
+  return GNUTLS_E_MPI_PRINT_FAILED;
+}
+
+/* Always has the first bit zero */
+int
+_gnutls_mpi_print_lz (void *buffer, size_t * nbytes, const mpi_t a)
+{
+  int ret;
+
+  if (nbytes == NULL || a == NULL)
+    return GNUTLS_E_INVALID_REQUEST;
+
+  ret = gcry_mpi_print (GCRYMPI_FMT_STD, buffer, *nbytes, nbytes, a);
+  if (!ret)
+    return 0;
+
+  return GNUTLS_E_MPI_PRINT_FAILED;
+}
+
+/* Always has the first bit zero */
+int
+_gnutls_mpi_dprint_lz (gnutls_datum_t * dest, const mpi_t a)
+{
+  int ret;
+  opaque *buf = NULL;
+  size_t bytes = 0;
+
+  if (dest == NULL || a == NULL)
+    return GNUTLS_E_INVALID_REQUEST;
+
+  gcry_mpi_print (GCRYMPI_FMT_STD, NULL, 0, &bytes, a);
+
+  if (bytes != 0)
+    buf = gnutls_malloc (bytes);
+  if (buf == NULL)
+    return GNUTLS_E_MEMORY_ERROR;
+
+  ret = gcry_mpi_print (GCRYMPI_FMT_STD, buf, bytes, &bytes, a);
+  if (!ret)
+    {
+      dest->data = buf;
+      dest->size = bytes;
+      return 0;
+    }
+
+  gnutls_free (buf);
+  return GNUTLS_E_MPI_PRINT_FAILED;
+}
+
+int
+_gnutls_mpi_dprint (gnutls_datum_t * dest, const mpi_t a)
+{
+  int ret;
+  opaque *buf = NULL;
+  size_t bytes = 0;
+
+  if (dest == NULL || a == NULL)
+    return GNUTLS_E_INVALID_REQUEST;
+
+  gcry_mpi_print (GCRYMPI_FMT_USG, NULL, 0, &bytes, a);
+
+  if (bytes != 0)
+    buf = gnutls_malloc (bytes);
+  if (buf == NULL)
+    return GNUTLS_E_MEMORY_ERROR;
+
+  ret = gcry_mpi_print (GCRYMPI_FMT_USG, buf, bytes, &bytes, a);
+  if (!ret)
+    {
+      dest->data = buf;
+      dest->size = bytes;
+      return 0;
+    }
+
+  gnutls_free (buf);
+  return GNUTLS_E_MPI_PRINT_FAILED;
+}
+
+
+/* this function reads an integer
+ * from asn1 structs. Combines the read and mpi_scan
+ * steps.
+ */
+int
+_gnutls_x509_read_int (ASN1_TYPE node, const char *value, mpi_t * ret_mpi)
+{
+  int result;
+  size_t s_len;
+  opaque *tmpstr = NULL;
+  int tmpstr_size;
+
+  tmpstr_size = 0;
+  result = asn1_read_value (node, value, NULL, &tmpstr_size);
+  if (result != ASN1_MEM_ERROR)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  tmpstr = gnutls_alloca (tmpstr_size);
+  if (tmpstr == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  result = asn1_read_value (node, value, tmpstr, &tmpstr_size);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      gnutls_afree (tmpstr);
+      return _gnutls_asn2err (result);
+    }
+
+  s_len = tmpstr_size;
+  if (_gnutls_mpi_scan (ret_mpi, tmpstr, &s_len) != 0)
+    {
+      gnutls_assert ();
+      gnutls_afree (tmpstr);
+      return GNUTLS_E_MPI_SCAN_FAILED;
+    }
+
+  gnutls_afree (tmpstr);
+
+  return 0;
+}
+
+/* Writes the specified integer into the specified node.
+ */
+int
+_gnutls_x509_write_int (ASN1_TYPE node, const char *value, mpi_t mpi, int lz)
+{
+  opaque *tmpstr;
+  size_t s_len;
+  int result;
+
+  s_len = 0;
+  if (lz)
+    result = _gnutls_mpi_print_lz (NULL, &s_len, mpi);
+  else
+    result = _gnutls_mpi_print (NULL, &s_len, mpi);
+
+  tmpstr = gnutls_alloca (s_len);
+  if (tmpstr == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  if (lz)
+    result = _gnutls_mpi_print_lz (tmpstr, &s_len, mpi);
+  else
+    result = _gnutls_mpi_print (tmpstr, &s_len, mpi);
+
+  if (result != 0)
+    {
+      gnutls_assert ();
+      gnutls_afree (tmpstr);
+      return GNUTLS_E_MPI_PRINT_FAILED;
+    }
+
+  result = asn1_write_value (node, value, tmpstr, s_len);
+
+  gnutls_afree (tmpstr);
+
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  return 0;
+}
diff --git a/src/daemon/https/tls/gnutls_mpi.h b/src/daemon/https/tls/gnutls_mpi.h
new file mode 100644
index 00000000..de2a6f20
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_mpi.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#ifndef GNUTLS_MPI_H
+# define GNUTLS_MPI_H
+
+# include <gnutls_int.h>
+# include <gcrypt.h>
+# include <libtasn1.h>
+/* lgl */
+# include "gc.h"
+
+typedef gcry_mpi_t mpi_t;
+
+#define _gnutls_mpi_cmp gcry_mpi_cmp
+#define _gnutls_mpi_cmp_ui gcry_mpi_cmp_ui
+#define _gnutls_mpi_mod gcry_mpi_mod
+#define _gnutls_mpi_new gcry_mpi_new
+#define _gnutls_mpi_snew gcry_mpi_snew
+#define _gnutls_mpi_copy gcry_mpi_copy
+#define _gnutls_mpi_set_ui gcry_mpi_set_ui
+#define _gnutls_mpi_set gcry_mpi_set
+#define _gnutls_mpi_randomize gcry_mpi_randomize
+#define _gnutls_mpi_get_nbits gcry_mpi_get_nbits
+#define _gnutls_mpi_powm gcry_mpi_powm
+#define _gnutls_mpi_invm gcry_mpi_invm
+#define _gnutls_mpi_addm gcry_mpi_addm
+#define _gnutls_mpi_subm gcry_mpi_subm
+#define _gnutls_mpi_sub_ui gcry_mpi_sub_ui
+#define _gnutls_mpi_mulm gcry_mpi_mulm
+#define _gnutls_mpi_mul gcry_mpi_mul
+#define _gnutls_mpi_add gcry_mpi_add
+#define _gnutls_mpi_add_ui gcry_mpi_add_ui
+#define _gnutls_mpi_sub_ui gcry_mpi_sub_ui
+#define _gnutls_mpi_mul_ui gcry_mpi_mul_ui
+#define _gnutls_prime_check gcry_prime_check
+#define _gnutls_mpi_div gcry_mpi_div
+
+#define _gnutls_mpi_alloc_like(x) _gnutls_mpi_new(_gnutls_mpi_get_nbits(x))
+#define _gnutls_mpi_salloc_like(x) _gnutls_mpi_snew(_gnutls_mpi_get_nbits(x))
+
+void _gnutls_mpi_release (mpi_t * x);
+
+int _gnutls_mpi_scan_nz (mpi_t * ret_mpi, const opaque * buffer,
+                         size_t * nbytes);
+int _gnutls_mpi_scan (mpi_t * ret_mpi, const opaque * buffer,
+                      size_t * nbytes);
+int _gnutls_mpi_scan_pgp (mpi_t * ret_mpi, const opaque * buffer,
+                          size_t * nbytes);
+
+int _gnutls_mpi_print (void *buffer, size_t * nbytes, const mpi_t a);
+int _gnutls_mpi_print_lz (void *buffer, size_t * nbytes, const mpi_t a);
+
+int _gnutls_mpi_dprint_lz (gnutls_datum_t * dest, const mpi_t a);
+int _gnutls_mpi_dprint (gnutls_datum_t * dest, const mpi_t a);
+
+#endif
diff --git a/src/daemon/https/tls/gnutls_num.c b/src/daemon/https/tls/gnutls_num.c
new file mode 100644
index 00000000..474cb73b
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_num.c
@@ -0,0 +1,192 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* This file contains the functions needed for 64 bit integer support in
+ * TLS, and functions which ease the access to TLS vectors (data of given size).
+ */
+
+#include <gnutls_int.h>
+#include <gnutls_num.h>
+#include <gnutls_errors.h>
+
+/* This function will add one to uint64 x.
+ * Returns 0 on success, or -1 if the uint64 max limit
+ * has been reached.
+ */
+int
+_gnutls_uint64pp (uint64 * x)
+{
+  register int i, y = 0;
+
+  for (i = 7; i >= 0; i--)
+    {
+      y = 0;
+      if (x->i[i] == 0xff)
+        {
+          x->i[i] = 0;
+          y = 1;
+        }
+      else
+        x->i[i]++;
+
+      if (y == 0)
+        break;
+    }
+  if (y != 0)
+    return -1;                  /* over 64 bits! WOW */
+
+  return 0;
+}
+
+uint32_t
+_gnutls_uint24touint32 (uint24 num)
+{
+  uint32_t ret = 0;
+
+  ((uint8_t *) & ret)[1] = num.pint[0];
+  ((uint8_t *) & ret)[2] = num.pint[1];
+  ((uint8_t *) & ret)[3] = num.pint[2];
+  return ret;
+}
+
+uint24
+_gnutls_uint32touint24 (uint32_t num)
+{
+  uint24 ret;
+
+  ret.pint[0] = ((uint8_t *) & num)[1];
+  ret.pint[1] = ((uint8_t *) & num)[2];
+  ret.pint[2] = ((uint8_t *) & num)[3];
+  return ret;
+
+}
+
+/* data should be at least 3 bytes */
+uint32_t
+_gnutls_read_uint24 (const opaque * data)
+{
+  uint32_t res;
+  uint24 num;
+
+  num.pint[0] = data[0];
+  num.pint[1] = data[1];
+  num.pint[2] = data[2];
+
+  res = _gnutls_uint24touint32 (num);
+#ifndef WORDS_BIGENDIAN
+  res = byteswap32 (res);
+#endif
+  return res;
+}
+
+void
+_gnutls_write_uint24 (uint32_t num, opaque * data)
+{
+  uint24 tmp;
+
+#ifndef WORDS_BIGENDIAN
+  num = byteswap32 (num);
+#endif
+  tmp = _gnutls_uint32touint24 (num);
+
+  data[0] = tmp.pint[0];
+  data[1] = tmp.pint[1];
+  data[2] = tmp.pint[2];
+}
+
+uint32_t
+_gnutls_read_uint32 (const opaque * data)
+{
+  uint32_t res;
+
+  memcpy (&res, data, sizeof (uint32_t));
+#ifndef WORDS_BIGENDIAN
+  res = byteswap32 (res);
+#endif
+  return res;
+}
+
+void
+_gnutls_write_uint32 (uint32_t num, opaque * data)
+{
+
+#ifndef WORDS_BIGENDIAN
+  num = byteswap32 (num);
+#endif
+  memcpy (data, &num, sizeof (uint32_t));
+}
+
+uint16_t
+_gnutls_read_uint16 (const opaque * data)
+{
+  uint16_t res;
+  memcpy (&res, data, sizeof (uint16_t));
+#ifndef WORDS_BIGENDIAN
+  res = byteswap16 (res);
+#endif
+  return res;
+}
+
+void
+_gnutls_write_uint16 (uint16_t num, opaque * data)
+{
+
+#ifndef WORDS_BIGENDIAN
+  num = byteswap16 (num);
+#endif
+  memcpy (data, &num, sizeof (uint16_t));
+}
+
+uint32_t
+_gnutls_conv_uint32 (uint32_t data)
+{
+#ifndef WORDS_BIGENDIAN
+  return byteswap32 (data);
+#else
+  return data;
+#endif
+}
+
+uint16_t
+_gnutls_conv_uint16 (uint16_t data)
+{
+#ifndef WORDS_BIGENDIAN
+  return byteswap16 (data);
+#else
+  return data;
+#endif
+}
+
+uint32_t
+_gnutls_uint64touint32 (const uint64 * num)
+{
+  uint32_t ret;
+
+  memcpy (&ret, &num->i[4], 4);
+#ifndef WORDS_BIGENDIAN
+  ret = byteswap32 (ret);
+#endif
+
+  return ret;
+}
diff --git a/src/daemon/https/tls/gnutls_num.h b/src/daemon/https/tls/gnutls_num.h
new file mode 100644
index 00000000..3ab226ae
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_num.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include <gnutls_int.h>
+
+#define rotl32(x,n)   (((x) << ((uint16_t)(n))) | ((x) >> (32 - (uint16_t)(n))))
+#define rotr32(x,n)   (((x) >> ((uint16_t)(n))) | ((x) << (32 - (uint16_t)(n))))
+#define rotl16(x,n)   (((x) << ((uint16_t)(n))) | ((x) >> (16 - (uint16_t)(n))))
+#define rotr16(x,n)   (((x) >> ((uint16_t)(n))) | ((x) << (16 - (uint16_t)(n))))
+
+#define byteswap16(x)  ((rotl16(x, 8) & 0x00ff) | (rotr16(x, 8) & 0xff00))
+#define byteswap32(x)  ((rotl32(x, 8) & 0x00ff00ffUL) | (rotr32(x, 8) & 0xff00ff00UL))
+
+uint32_t _gnutls_uint24touint32 (uint24 num);
+uint24 _gnutls_uint32touint24 (uint32_t num);
+uint32_t _gnutls_read_uint32 (const opaque * data);
+uint16_t _gnutls_read_uint16 (const opaque * data);
+uint32_t _gnutls_conv_uint32 (uint32_t data);
+uint16_t _gnutls_conv_uint16 (uint16_t data);
+uint32_t _gnutls_read_uint24 (const opaque * data);
+void _gnutls_write_uint24 (uint32_t num, opaque * data);
+void _gnutls_write_uint32 (uint32_t num, opaque * data);
+void _gnutls_write_uint16 (uint16_t num, opaque * data);
+uint32_t _gnutls_uint64touint32 (const uint64 *);
+
+int _gnutls_uint64pp (uint64 *);
+# define _gnutls_uint64zero(x) x.i[0] = x.i[1] = x.i[2] = x.i[3] = x.i[4] = x.i[5] = x.i[6] = x.i[7] = 0
+# define UINT64DATA(x) x.i
diff --git a/src/daemon/https/tls/gnutls_pk.c b/src/daemon/https/tls/gnutls_pk.c
new file mode 100644
index 00000000..cfec9463
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_pk.c
@@ -0,0 +1,915 @@
+/*
+ * Copyright (C) 2001, 2002, 2003, 2004, 2005, 2006 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* This file contains the functions needed for RSA/DSA public key
+ * encryption and signatures. 
+ */
+
+#include <gnutls_int.h>
+#include <gnutls_mpi.h>
+#include <gnutls_pk.h>
+#include <gnutls_errors.h>
+#include <gnutls_datum.h>
+#include <gnutls_global.h>
+#include <gnutls_num.h>
+#include "debug.h"
+#include <gc.h>
+
+/* x509 */
+#include "common.h"
+#include "mpi.h"
+
+static int _gnutls_pk_encrypt (int algo, mpi_t * resarr, mpi_t data,
+                               mpi_t * pkey, int pkey_len);
+static int _gnutls_pk_sign (int algo, mpi_t * data, mpi_t hash,
+                            mpi_t * pkey, int);
+static int _gnutls_pk_verify (int algo, mpi_t hash, mpi_t * data,
+                              mpi_t * pkey, int);
+static int _gnutls_pk_decrypt (int algo, mpi_t * resarr, mpi_t data,
+                               mpi_t * pkey, int);
+
+
+/* Do PKCS-1 RSA encryption. 
+ * params is modulus, public exp.
+ */
+int
+_gnutls_pkcs1_rsa_encrypt (gnutls_datum_t * ciphertext,
+                           const gnutls_datum_t * plaintext,
+                           mpi_t * params, unsigned params_len,
+                           unsigned btype)
+{
+  unsigned int i, pad;
+  int ret;
+  mpi_t m, res;
+  opaque *edata, *ps;
+  size_t k, psize;
+  size_t mod_bits;
+
+  mod_bits = _gnutls_mpi_get_nbits (params[0]);
+  k = mod_bits / 8;
+  if (mod_bits % 8 != 0)
+    k++;
+
+  if (plaintext->size > k - 11)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_PK_ENCRYPTION_FAILED;
+    }
+
+  edata = gnutls_alloca (k);
+  if (edata == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  /* EB = 00||BT||PS||00||D 
+   * (use block type 'btype')
+   */
+
+  edata[0] = 0;
+  edata[1] = btype;
+  psize = k - 3 - plaintext->size;
+
+  ps = &edata[2];
+  switch (btype)
+    {
+    case 2:
+      /* using public key */
+      if (params_len < RSA_PUBLIC_PARAMS)
+        {
+          gnutls_assert ();
+          gnutls_afree (edata);
+          return GNUTLS_E_INTERNAL_ERROR;
+        }
+
+      if (gc_pseudo_random (ps, psize) != GC_OK)
+        {
+          gnutls_assert ();
+          gnutls_afree (edata);
+          return GNUTLS_E_RANDOM_FAILED;
+        }
+      for (i = 0; i < psize; i++)
+        while (ps[i] == 0)
+          {
+            if (gc_pseudo_random (&ps[i], 1) != GC_OK)
+              {
+                gnutls_assert ();
+                gnutls_afree (edata);
+                return GNUTLS_E_RANDOM_FAILED;
+              }
+          }
+      break;
+    case 1:
+      /* using private key */
+
+      if (params_len < RSA_PRIVATE_PARAMS)
+        {
+          gnutls_assert ();
+          gnutls_afree (edata);
+          return GNUTLS_E_INTERNAL_ERROR;
+        }
+
+      for (i = 0; i < psize; i++)
+        ps[i] = 0xff;
+      break;
+    default:
+      gnutls_assert ();
+      gnutls_afree (edata);
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  ps[psize] = 0;
+  memcpy (&ps[psize + 1], plaintext->data, plaintext->size);
+
+  if (_gnutls_mpi_scan_nz (&m, edata, &k) != 0)
+    {
+      gnutls_assert ();
+      gnutls_afree (edata);
+      return GNUTLS_E_MPI_SCAN_FAILED;
+    }
+  gnutls_afree (edata);
+
+  if (btype == 2)               /* encrypt */
+    ret = _gnutls_pk_encrypt (GCRY_PK_RSA, &res, m, params, params_len);
+  else                          /* sign */
+    ret = _gnutls_pk_sign (GCRY_PK_RSA, &res, m, params, params_len);
+
+  _gnutls_mpi_release (&m);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  _gnutls_mpi_print (NULL, &psize, res);
+
+  if (psize < k)
+    {
+      /* padding psize */
+      pad = k - psize;
+      psize = k;
+    }
+  else if (psize == k)
+    {
+      pad = 0;
+    }
+  else
+    {                           /* psize > k !!! */
+      /* This is an impossible situation */
+      gnutls_assert ();
+      _gnutls_mpi_release (&res);
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  ciphertext->data = gnutls_malloc (psize);
+  if (ciphertext->data == NULL)
+    {
+      gnutls_assert ();
+      _gnutls_mpi_release (&res);
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+  _gnutls_mpi_print (&ciphertext->data[pad], &psize, res);
+  for (i = 0; i < pad; i++)
+    ciphertext->data[i] = 0;
+
+  ciphertext->size = k;
+
+  _gnutls_mpi_release (&res);
+
+  return 0;
+}
+
+
+/* Do PKCS-1 RSA decryption. 
+ * params is modulus, public exp., private key
+ * Can decrypt block type 1 and type 2 packets.
+ */
+int
+_gnutls_pkcs1_rsa_decrypt (gnutls_datum_t * plaintext,
+                           const gnutls_datum_t * ciphertext,
+                           mpi_t * params, unsigned params_len,
+                           unsigned btype)
+{
+  unsigned k, i;
+  int ret;
+  mpi_t c, res;
+  opaque *edata;
+  size_t esize, mod_bits;
+
+  mod_bits = _gnutls_mpi_get_nbits (params[0]);
+  k = mod_bits / 8;
+  if (mod_bits % 8 != 0)
+    k++;
+
+  esize = ciphertext->size;
+
+  if (esize != k)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_PK_DECRYPTION_FAILED;
+    }
+
+  if (_gnutls_mpi_scan_nz (&c, ciphertext->data, &esize) != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MPI_SCAN_FAILED;
+    }
+
+  /* we can use btype to see if the private key is
+   * available.
+   */
+  if (btype == 2)
+    ret = _gnutls_pk_decrypt (GCRY_PK_RSA, &res, c, params, params_len);
+  else
+    {
+      ret = _gnutls_pk_encrypt (GCRY_PK_RSA, &res, c, params, params_len);
+    }
+  _gnutls_mpi_release (&c);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  _gnutls_mpi_print (NULL, &esize, res);
+  edata = gnutls_alloca (esize + 1);
+  if (edata == NULL)
+    {
+      gnutls_assert ();
+      _gnutls_mpi_release (&res);
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+  _gnutls_mpi_print (&edata[1], &esize, res);
+
+  _gnutls_mpi_release (&res);
+
+  /* EB = 00||BT||PS||00||D
+   * (use block type 'btype')
+   *
+   * From now on, return GNUTLS_E_DECRYPTION_FAILED on errors, to
+   * avoid attacks similar to the one described by Bleichenbacher in:
+   * "Chosen Ciphertext Attacks against Protocols Based on RSA
+   * Encryption Standard PKCS #1".
+   */
+
+
+  edata[0] = 0;
+  esize++;
+
+  if (edata[0] != 0 || edata[1] != btype)
+    {
+      gnutls_assert ();
+      gnutls_afree (edata);
+      return GNUTLS_E_DECRYPTION_FAILED;
+    }
+
+  ret = GNUTLS_E_DECRYPTION_FAILED;
+  switch (btype)
+    {
+    case 2:
+      for (i = 2; i < esize; i++)
+        {
+          if (edata[i] == 0)
+            {
+              ret = 0;
+              break;
+            }
+        }
+      break;
+    case 1:
+      for (i = 2; i < esize; i++)
+        {
+          if (edata[i] == 0 && i > 2)
+            {
+              ret = 0;
+              break;
+            }
+          if (edata[i] != 0xff)
+            {
+              _gnutls_handshake_log ("PKCS #1 padding error");
+              /* PKCS #1 padding error.  Don't use
+                 GNUTLS_E_PKCS1_WRONG_PAD here.  */
+              break;
+            }
+        }
+      break;
+    default:
+      gnutls_assert ();
+      gnutls_afree (edata);
+      break;
+    }
+  i++;
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      gnutls_afree (edata);
+      return GNUTLS_E_DECRYPTION_FAILED;
+    }
+
+  if (_gnutls_sset_datum (plaintext, &edata[i], esize - i) < 0)
+    {
+      gnutls_assert ();
+      gnutls_afree (edata);
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  gnutls_afree (edata);
+
+  return 0;
+}
+
+
+int
+_gnutls_rsa_verify (const gnutls_datum_t * vdata,
+                    const gnutls_datum_t * ciphertext, mpi_t * params,
+                    int params_len, int btype)
+{
+
+  gnutls_datum_t plain;
+  int ret;
+
+  /* decrypt signature */
+  if ((ret =
+       _gnutls_pkcs1_rsa_decrypt (&plain, ciphertext, params, params_len,
+                                  btype)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  if (plain.size != vdata->size)
+    {
+      gnutls_assert ();
+      _gnutls_free_datum (&plain);
+      return GNUTLS_E_PK_SIG_VERIFY_FAILED;
+    }
+
+  if (memcmp (plain.data, vdata->data, plain.size) != 0)
+    {
+      gnutls_assert ();
+      _gnutls_free_datum (&plain);
+      return GNUTLS_E_PK_SIG_VERIFY_FAILED;
+    }
+
+  _gnutls_free_datum (&plain);
+
+  return 0;                     /* ok */
+}
+
+/* encodes the Dss-Sig-Value structure
+ */
+static int
+encode_ber_rs (gnutls_datum_t * sig_value, mpi_t r, mpi_t s)
+{
+  ASN1_TYPE sig;
+  int result, tot_len;
+
+  if ((result =
+       asn1_create_element (_gnutls_get_gnutls_asn (),
+                            "GNUTLS.DSASignatureValue",
+                            &sig)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  result = _gnutls_x509_write_int (sig, "r", r, 1);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&sig);
+      return result;
+    }
+
+  result = _gnutls_x509_write_int (sig, "s", s, 1);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&sig);
+      return result;
+    }
+
+  tot_len = 0;
+
+  result = _gnutls_x509_der_encode (sig, "", sig_value, 0);
+
+  asn1_delete_structure (&sig);
+
+  if (result < 0)
+    {
+      gnutls_assert ();
+      return result;
+    }
+
+  return 0;
+}
+
+
+/* Do DSA signature calculation. params is p, q, g, y, x in that order.
+ */
+int
+_gnutls_dsa_sign (gnutls_datum_t * signature,
+                  const gnutls_datum_t * hash, mpi_t * params,
+                  unsigned params_len)
+{
+  mpi_t rs[2], mdata;
+  int ret;
+  size_t k;
+
+  k = hash->size;
+  if (k < 20)
+    {                           /* SHA1 or better only */
+      gnutls_assert ();
+      return GNUTLS_E_PK_SIGN_FAILED;
+    }
+
+  if (_gnutls_mpi_scan_nz (&mdata, hash->data, &k) != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MPI_SCAN_FAILED;
+    }
+
+  ret = _gnutls_pk_sign (GCRY_PK_DSA, rs, mdata, params, params_len);
+  /* rs[0], rs[1] now hold r,s */
+  _gnutls_mpi_release (&mdata);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  ret = encode_ber_rs (signature, rs[0], rs[1]);
+
+  /* free r,s */
+  _gnutls_mpi_release (&rs[0]);
+  _gnutls_mpi_release (&rs[1]);
+
+  if (ret != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  return 0;
+}
+
+/* decodes the Dss-Sig-Value structure
+ */
+static int
+decode_ber_rs (const gnutls_datum_t * sig_value, mpi_t * r, mpi_t * s)
+{
+  ASN1_TYPE sig;
+  int result;
+
+  if ((result =
+       asn1_create_element (_gnutls_get_gnutls_asn (),
+                            "GNUTLS.DSASignatureValue",
+                            &sig)) != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      return _gnutls_asn2err (result);
+    }
+
+  result = asn1_der_decoding (&sig, sig_value->data, sig_value->size, NULL);
+  if (result != ASN1_SUCCESS)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&sig);
+      return _gnutls_asn2err (result);
+    }
+
+  result = _gnutls_x509_read_int (sig, "r", r);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      asn1_delete_structure (&sig);
+      return result;
+    }
+
+  result = _gnutls_x509_read_int (sig, "s", s);
+  if (result < 0)
+    {
+      gnutls_assert ();
+      _gnutls_mpi_release (s);
+      asn1_delete_structure (&sig);
+      return result;
+    }
+
+  asn1_delete_structure (&sig);
+
+  return 0;
+}
+
+/* params is p, q, g, y in that order
+ */
+int
+_gnutls_dsa_verify (const gnutls_datum_t * vdata,
+                    const gnutls_datum_t * sig_value, mpi_t * params,
+                    int params_len)
+{
+
+  mpi_t mdata;
+  int ret;
+  size_t k;
+  mpi_t rs[2];
+
+  if (vdata->size != 20)
+    {                           /* sha-1 only */
+      gnutls_assert ();
+      return GNUTLS_E_PK_SIG_VERIFY_FAILED;
+    }
+
+  if (decode_ber_rs (sig_value, &rs[0], &rs[1]) != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MPI_SCAN_FAILED;
+    }
+
+  k = vdata->size;
+  if (_gnutls_mpi_scan_nz (&mdata, vdata->data, &k) != 0)
+    {
+      gnutls_assert ();
+      _gnutls_mpi_release (&rs[0]);
+      _gnutls_mpi_release (&rs[1]);
+      return GNUTLS_E_MPI_SCAN_FAILED;
+    }
+
+  /* decrypt signature */
+  ret = _gnutls_pk_verify (GCRY_PK_DSA, mdata, rs, params, params_len);
+  _gnutls_mpi_release (&mdata);
+  _gnutls_mpi_release (&rs[0]);
+  _gnutls_mpi_release (&rs[1]);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return 0;                     /* ok */
+}
+
+
+/* this is taken from gnupg 
+ */
+
+/****************
+ * Emulate our old PK interface here - sometime in the future we might
+ * change the internal design to directly fit to libgcrypt.
+ */
+static int
+_gnutls_pk_encrypt (int algo, mpi_t * resarr, mpi_t data,
+                    mpi_t * pkey, int pkey_len)
+{
+  gcry_sexp_t s_ciph, s_data, s_pkey;
+  int rc = -1;
+
+  /* make a sexp from pkey */
+  switch (algo)
+    {
+    case GCRY_PK_RSA:
+      if (pkey_len >= 2)
+        rc = gcry_sexp_build (&s_pkey, NULL,
+                              "(public-key(rsa(n%m)(e%m)))",
+                              pkey[0], pkey[1]);
+      break;
+
+    default:
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  if (rc != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  /* put the data into a simple list */
+  if (gcry_sexp_build (&s_data, NULL, "%m", data))
+    {
+      gnutls_assert ();
+      gcry_sexp_release (s_pkey);
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  /* pass it to libgcrypt */
+  rc = gcry_pk_encrypt (&s_ciph, s_data, s_pkey);
+  gcry_sexp_release (s_data);
+  gcry_sexp_release (s_pkey);
+
+  if (rc != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_PK_ENCRYPTION_FAILED;
+
+    }
+  else
+    {                           /* add better error handling or make gnupg use S-Exp directly */
+      gcry_sexp_t list = gcry_sexp_find_token (s_ciph, "a", 0);
+      if (list == NULL)
+        {
+          gnutls_assert ();
+          gcry_sexp_release (s_ciph);
+          return GNUTLS_E_INTERNAL_ERROR;
+        }
+
+      resarr[0] = gcry_sexp_nth_mpi (list, 1, 0);
+      gcry_sexp_release (list);
+
+      if (resarr[0] == NULL)
+        {
+          gnutls_assert ();
+          gcry_sexp_release (s_ciph);
+          return GNUTLS_E_INTERNAL_ERROR;
+        }
+    }
+
+  gcry_sexp_release (s_ciph);
+  return rc;
+}
+
+static int
+_gnutls_pk_decrypt (int algo, mpi_t * resarr, mpi_t data, mpi_t * pkey,
+                    int pkey_len)
+{
+  gcry_sexp_t s_plain, s_data, s_pkey;
+  int rc = -1;
+
+  /* make a sexp from pkey */
+  switch (algo)
+    {
+    case GCRY_PK_RSA:
+      if (pkey_len >= 6)
+        rc = gcry_sexp_build (&s_pkey, NULL,
+                              "(private-key(rsa((n%m)(e%m)(d%m)(p%m)(q%m)(u%m))))",
+                              pkey[0], pkey[1], pkey[2], pkey[3],
+                              pkey[4], pkey[5]);
+      break;
+
+    default:
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  if (rc != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  /* put the data into a simple list */
+  if (gcry_sexp_build (&s_data, NULL, "(enc-val(rsa(a%m)))", data))
+    {
+      gnutls_assert ();
+      gcry_sexp_release (s_pkey);
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  /* pass it to libgcrypt */
+  rc = gcry_pk_decrypt (&s_plain, s_data, s_pkey);
+  gcry_sexp_release (s_data);
+  gcry_sexp_release (s_pkey);
+
+  if (rc != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_PK_DECRYPTION_FAILED;
+
+    }
+  else
+    {                           /* add better error handling or make gnupg use S-Exp directly */
+      resarr[0] = gcry_sexp_nth_mpi (s_plain, 0, 0);
+
+      if (resarr[0] == NULL)
+        {
+          gnutls_assert ();
+          gcry_sexp_release (s_plain);
+          return GNUTLS_E_INTERNAL_ERROR;
+        }
+    }
+
+  gcry_sexp_release (s_plain);
+  return rc;
+}
+
+
+/* in case of DSA puts into data, r,s
+ */
+static int
+_gnutls_pk_sign (int algo, mpi_t * data, mpi_t hash, mpi_t * pkey,
+                 int pkey_len)
+{
+  gcry_sexp_t s_hash, s_key, s_sig;
+  int rc = -1;
+
+  /* make a sexp from pkey */
+  switch (algo)
+    {
+    case GCRY_PK_DSA:
+      if (pkey_len >= 5)
+        rc = gcry_sexp_build (&s_key, NULL,
+                              "(private-key(dsa(p%m)(q%m)(g%m)(y%m)(x%m)))",
+                              pkey[0], pkey[1], pkey[2], pkey[3], pkey[4]);
+      else
+        {
+          gnutls_assert ();
+        }
+
+      break;
+    case GCRY_PK_RSA:
+      if (pkey_len >= 6)
+        rc = gcry_sexp_build (&s_key, NULL,
+                              "(private-key(rsa((n%m)(e%m)(d%m)(p%m)(q%m)(u%m))))",
+                              pkey[0], pkey[1], pkey[2], pkey[3],
+                              pkey[4], pkey[5]);
+      else
+        {
+          gnutls_assert ();
+        }
+      break;
+
+    default:
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  if (rc != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  /* put the data into a simple list */
+  if (gcry_sexp_build (&s_hash, NULL, "%m", hash))
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  /* pass it to libgcrypt */
+  rc = gcry_pk_sign (&s_sig, s_hash, s_key);
+  gcry_sexp_release (s_hash);
+  gcry_sexp_release (s_key);
+
+  if (rc != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_PK_SIGN_FAILED;
+
+    }
+  else
+    {
+      gcry_sexp_t list;
+
+      if (algo == GCRY_PK_DSA)
+        {
+          list = gcry_sexp_find_token (s_sig, "r", 0);
+          if (list == NULL)
+            {
+              gnutls_assert ();
+              gcry_sexp_release (s_sig);
+              return GNUTLS_E_INTERNAL_ERROR;
+            }
+
+          data[0] = gcry_sexp_nth_mpi (list, 1, 0);
+          gcry_sexp_release (list);
+
+          list = gcry_sexp_find_token (s_sig, "s", 0);
+          if (list == NULL)
+            {
+              gnutls_assert ();
+              gcry_sexp_release (s_sig);
+              return GNUTLS_E_INTERNAL_ERROR;
+            }
+
+          data[1] = gcry_sexp_nth_mpi (list, 1, 0);
+          gcry_sexp_release (list);
+        }
+      else
+        {                       /* GCRY_PK_RSA */
+          list = gcry_sexp_find_token (s_sig, "s", 0);
+          if (list == NULL)
+            {
+              gnutls_assert ();
+              gcry_sexp_release (s_sig);
+              return GNUTLS_E_INTERNAL_ERROR;
+            }
+
+          data[0] = gcry_sexp_nth_mpi (list, 1, 0);
+          gcry_sexp_release (list);
+        }
+    }
+
+  gcry_sexp_release (s_sig);
+  return 0;
+}
+
+
+static int
+_gnutls_pk_verify (int algo, mpi_t hash, mpi_t * data,
+                   mpi_t * pkey, int pkey_len)
+{
+  gcry_sexp_t s_sig, s_hash, s_pkey;
+  int rc = -1;
+
+  /* make a sexp from pkey */
+  switch (algo)
+    {
+    case GCRY_PK_DSA:
+      if (pkey_len >= 4)
+        rc = gcry_sexp_build (&s_pkey, NULL,
+                              "(public-key(dsa(p%m)(q%m)(g%m)(y%m)))",
+                              pkey[0], pkey[1], pkey[2], pkey[3]);
+      break;
+    case GCRY_PK_RSA:
+      if (pkey_len >= 2)
+        rc = gcry_sexp_build (&s_pkey, NULL,
+                              "(public-key(rsa(n%m)(e%m)))",
+                              pkey[0], pkey[1]);
+      break;
+
+    default:
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  if (rc != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  /* put the data into a simple list */
+  if (gcry_sexp_build (&s_hash, NULL, "%m", hash))
+    {
+      gnutls_assert ();
+      gcry_sexp_release (s_pkey);
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  switch (algo)
+    {
+    case GCRY_PK_DSA:
+      rc = gcry_sexp_build (&s_sig, NULL,
+                            "(sig-val(dsa(r%m)(s%m)))", data[0], data[1]);
+      break;
+    case GCRY_PK_RSA:
+      rc = gcry_sexp_build (&s_sig, NULL, "(sig-val(rsa(s%m)))", data[0]);
+      break;
+
+    default:
+      gnutls_assert ();
+      gcry_sexp_release (s_pkey);
+      gcry_sexp_release (s_hash);
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  if (rc != 0)
+    {
+      gnutls_assert ();
+      gcry_sexp_release (s_pkey);
+      gcry_sexp_release (s_hash);
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  rc = gcry_pk_verify (s_sig, s_hash, s_pkey);
+
+  gcry_sexp_release (s_sig);
+  gcry_sexp_release (s_hash);
+  gcry_sexp_release (s_pkey);
+
+  if (rc != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_PK_SIG_VERIFY_FAILED;
+    }
+
+  return 0;
+}
diff --git a/src/daemon/https/tls/gnutls_pk.h b/src/daemon/https/tls/gnutls_pk.h
new file mode 100644
index 00000000..e6f37b0e
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_pk.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#ifndef GNUTLS_PK_H
+# define GNUTLS_PK_H
+
+int _gnutls_pkcs1_rsa_encrypt (gnutls_datum_t * ciphertext,
+                               const gnutls_datum_t * plaintext,
+                               mpi_t * params, unsigned params_len,
+                               unsigned btype);
+int _gnutls_dsa_sign (gnutls_datum_t * signature,
+                      const gnutls_datum_t * plaintext, mpi_t * params,
+                      unsigned params_len);
+int _gnutls_pkcs1_rsa_decrypt (gnutls_datum_t * plaintext,
+                               const gnutls_datum_t * ciphertext,
+                               mpi_t * params, unsigned params_len,
+                               unsigned btype);
+int _gnutls_rsa_verify (const gnutls_datum_t * vdata,
+                        const gnutls_datum_t * ciphertext, mpi_t * params,
+                        int params_len, int btype);
+int _gnutls_dsa_verify (const gnutls_datum_t * vdata,
+                        const gnutls_datum_t * sig_value, mpi_t * params,
+                        int params_len);
+
+#endif /* GNUTLS_PK_H */
diff --git a/src/daemon/https/tls/gnutls_priority.c b/src/daemon/https/tls/gnutls_priority.c
new file mode 100644
index 00000000..69019191
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_priority.c
@@ -0,0 +1,497 @@
+/*
+ * Copyright (C) 2004, 2005, 2006, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* Here lies the code of the gnutls_*_set_priority() functions.
+ */
+
+#include "gnutls_int.h"
+#include "gnutls_algorithms.h"
+#include "gnutls_errors.h"
+#include <gnutls_num.h>
+
+#define MAX_ELEMENTS 48
+
+static void break_comma_list (char *etag,
+                              char **broken_etag,
+                              int *elements, int max_elements, char sep);
+
+/**
+ * gnutls_cipher_set_priority - Sets the priority on the ciphers supported by gnutls.
+ * @session: is a #gnutls_session_t structure.
+ * @list: is a 0 terminated list of gnutls_cipher_algorithm_t elements.
+ *
+ * Sets the priority on the ciphers supported by gnutls.
+ * Priority is higher for elements specified before others.
+ * After specifying the ciphers you want, you must append a 0.
+ * Note that the priority is set on the client. The server does
+ * not use the algorithm's priority except for disabling
+ * algorithms that were not specified.
+ *
+ * Returns 0 on success.
+ *
+ **/
+int
+gnutls_cipher_set_priority (gnutls_session_t session, const int *list)
+{
+  int num = 0, i;
+
+  while (list[num] != 0)
+    num++;
+  if (num > MAX_ALGOS)
+    num = MAX_ALGOS;
+  session->internals.priorities.cipher.algorithms = num;
+
+  for (i = 0; i < num; i++)
+    {
+      session->internals.priorities.cipher.priority[i] = list[i];
+    }
+
+  return 0;
+}
+
+inline static int
+_set_priority (priority_st * st, const int *list)
+{
+  int num = 0, i;
+
+  while (list[num] != 0)
+    num++;
+  if (num > MAX_ALGOS)
+    num = MAX_ALGOS;
+  st->algorithms = num;
+
+  for (i = 0; i < num; i++)
+    {
+      st->priority[i] = list[i];
+    }
+
+  return 0;
+
+}
+
+/**
+ * gnutls_kx_set_priority - Sets the priority on the key exchange algorithms supported by gnutls.
+ * @session: is a #gnutls_session_t structure.
+ * @list: is a 0 terminated list of gnutls_kx_algorithm_t elements.
+ *
+ * Sets the priority on the key exchange algorithms supported by gnutls.
+ * Priority is higher for elements specified before others.
+ * After specifying the algorithms you want, you must append a 0.
+ * Note that the priority is set on the client. The server does
+ * not use the algorithm's priority except for disabling
+ * algorithms that were not specified.
+ *
+ * Returns 0 on success.
+ *
+ **/
+int
+gnutls_kx_set_priority (gnutls_session_t session, const int *list)
+{
+  return _set_priority (&session->internals.priorities.kx, list);
+}
+
+/**
+ * gnutls_mac_set_priority - Sets the priority on the mac algorithms supported by gnutls.
+ * @session: is a #gnutls_session_t structure.
+ * @list: is a 0 terminated list of gnutls_mac_algorithm_t elements.
+ *
+ * Sets the priority on the mac algorithms supported by gnutls.
+ * Priority is higher for elements specified before others.
+ * After specifying the algorithms you want, you must append a 0.
+ * Note that the priority is set on the client. The server does
+ * not use the algorithm's priority except for disabling
+ * algorithms that were not specified.
+ *
+ * Returns 0 on success.
+ *
+ **/
+int
+gnutls_mac_set_priority (gnutls_session_t session, const int *list)
+{
+  return _set_priority (&session->internals.priorities.mac, list);
+}
+
+/**
+ * gnutls_compression_set_priority - Sets the priority on the compression algorithms supported by gnutls.
+ * @session: is a #gnutls_session_t structure.
+ * @list: is a 0 terminated list of gnutls_compression_method_t elements.
+ *
+ * Sets the priority on the compression algorithms supported by gnutls.
+ * Priority is higher for elements specified before others.
+ * After specifying the algorithms you want, you must append a 0.
+ * Note that the priority is set on the client. The server does
+ * not use the algorithm's priority except for disabling
+ * algorithms that were not specified.
+ *
+ * TLS 1.0 does not define any compression algorithms except
+ * NULL. Other compression algorithms are to be considered
+ * as gnutls extensions.
+ *
+ * Returns 0 on success.
+ *
+ **/
+int
+gnutls_compression_set_priority (gnutls_session_t session, const int *list)
+{
+  return _set_priority (&session->internals.priorities.compression, list);
+}
+
+/**
+ * gnutls_protocol_set_priority - Sets the priority on the protocol versions supported by gnutls.
+ * @session: is a #gnutls_session_t structure.
+ * @list: is a 0 terminated list of gnutls_protocol_t elements.
+ *
+ * Sets the priority on the protocol versions supported by gnutls.
+ * This function actually enables or disables protocols. Newer protocol
+ * versions always have highest priority.
+ *
+ * Returns 0 on success.
+ *
+ **/
+int
+gnutls_protocol_set_priority (gnutls_session_t session, const int *list)
+{
+  int ret;
+
+  ret = _set_priority (&session->internals.priorities.protocol, list);
+
+  /* set the current version to the first in the chain.
+   * This will be overridden later.
+   */
+  if (list)
+    _gnutls_set_current_version (session, list[0]);
+
+  return ret;
+}
+
+/**
+ * gnutls_certificate_type_set_priority - Sets the priority on the certificate types supported by gnutls.
+ * @session: is a #gnutls_session_t structure.
+ * @list: is a 0 terminated list of gnutls_certificate_type_t elements.
+ *
+ * Sets the priority on the certificate types supported by gnutls.
+ * Priority is higher for elements specified before others.
+ * After specifying the types you want, you must append a 0.
+ * Note that the certificate type priority is set on the client. 
+ * The server does not use the cert type priority except for disabling
+ * types that were not specified.
+ *
+ * Returns 0 on success.
+ *
+ **/
+int
+gnutls_certificate_type_set_priority (gnutls_session_t session,
+                                      const int *list)
+{
+#ifdef ENABLE_OPENPGP
+  return _set_priority (&session->internals.priorities.cert_type, list);
+
+#else
+
+  return GNUTLS_E_UNIMPLEMENTED_FEATURE;
+
+#endif
+}
+
+static const int protocol_priority[] = { GNUTLS_TLS1_1,
+  GNUTLS_TLS1_0,
+  0
+};
+
+static const int cipher_priority_secure256[] = { GNUTLS_CIPHER_AES_256_CBC,
+  0
+};
+
+static const int kx_priority_secure[] = { GNUTLS_KX_RSA,
+  0
+};
+
+static const int mac_priority_secure[] = { GNUTLS_MAC_SHA1,
+  0
+};
+
+static int cert_type_priority[] = { GNUTLS_CRT_X509,
+  0
+};
+
+static const int comp_priority[] = { GNUTLS_COMP_NULL,
+  0
+};
+
+typedef void (rmadd_func) (priority_st * priority_list, int alg);
+
+/**
+ * gnutls_priority_set - Sets priorities for the cipher suites supported by gnutls.
+ * @session: is a #gnutls_session_t structure.
+ * @priority: is a #gnutls_priority_t structure.
+ *
+ * Sets the priorities to use on the ciphers, key exchange methods,
+ * macs and compression methods. 
+ *
+ * On success 0 is returned.
+ *
+ **/
+int
+gnutls_priority_set (gnutls_session_t session, gnutls_priority_t priority)
+{
+  if (priority == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_NO_CIPHER_SUITES;
+    }
+
+  memcpy (&session->internals.priorities, priority,
+          sizeof (struct gnutls_priority_st));
+
+  return 0;
+}
+
+/**
+ * gnutls_priority_init - Sets priorities for the cipher suites supported by gnutls.
+ * @priority_cache: is a #gnutls_prioritity_t structure.
+ * @priorities: is a string describing priorities
+ * @err_pos: In case of an error this will have the position in the string the error occured
+ *
+ * Sets priorities for the ciphers, key exchange methods, macs and
+ * compression methods. This is to avoid using the
+ * gnutls_*_priority() functions.
+ *
+ * The #priorities option allows you to specify a semi-colon
+ * separated list of the cipher priorities to enable.
+ *
+ * Unless the first keyword is "NONE" the defaults are:
+ * Protocols: TLS1.1, TLS1.0, and SSL3.0.
+ * Compression: NULL.
+ * Certificate types: X.509, OpenPGP.
+ *
+ * You can also use predefined sets of ciphersuites: "PERFORMANCE"
+ * all the "secure" ciphersuites are enabled, limited to 128 bit
+ * ciphers and sorted by terms of speed performance.
+ *
+ * "NORMAL" option enables all "secure" ciphersuites. The 256-bit ciphers
+ * are included as a fallback only. The ciphers are sorted by security margin.
+ *
+ * "SECURE128" flag enables all "secure" ciphersuites with ciphers up to 
+ * 128 bits, sorted by security margin.
+ *
+ * "SECURE256" flag enables all "secure" ciphersuites including the 256 bit
+ * ciphers, sorted by security margin.
+ *
+ * "EXPORT" all the ciphersuites are enabled, including the
+ * low-security 40 bit ciphers.
+ *
+ * "NONE" nothing is enabled. This disables even protocols and
+ * compression methods.
+ *
+ * Special keywords:
+ * '!' or '-' appended with an algorithm will remove this algorithm.
+ * '+' appended with an algorithm will add this algorithm.
+ * '%COMPAT' will enable compatibility features for a server.
+ *
+ * To avoid collisions in order to specify a compression algorithm in
+ * this string you have to prefix it with "COMP-", protocol versions
+ * with "VERS-" and certificate types with "CTYPE-". All other
+ * algorithms don't need a prefix.
+ *
+ * For key exchange algorithms when in NORMAL or SECURE levels the
+ * perfect forward secrecy algorithms take precendence of the other
+ * protocols.  In all cases all the supported key exchange algorithms
+ * are enabled (except for the RSA-EXPORT which is only enabled in
+ * EXPORT level).
+ *
+ * Note that although one can select very long key sizes (such as 256 bits) 
+ * for symmetric algorithms, to actually increase security the public key
+ * algorithms have to use longer key sizes as well.
+ *
+ * Examples: "NORMAL:!AES-128-CBC",
+ * "EXPORT:!VERS-TLS1.0:+COMP-DEFLATE:+CTYPE-OPENPGP",
+ * "NONE:+VERS-TLS1.0:+AES-128-CBC:+RSA:+SHA1:+COMP-NULL", "NORMAL",
+ * "NORMAL:%COMPAT".
+ *
+ * Returns: On syntax error GNUTLS_E_INVALID_REQUEST is returned and
+ * 0 on success.
+ **/
+int
+gnutls_priority_init (gnutls_priority_t * priority_cache,
+                      const char *priorities, const char **err_pos)
+{
+  int broken_list_size, i, j;
+  char *darg;
+  int algo;
+
+  *priority_cache = gnutls_calloc (1, sizeof (struct gnutls_priority_st));
+  if (*priority_cache == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  /* set mode to "SECURE256" */
+  _set_priority (&(*priority_cache)->protocol, protocol_priority);
+  _set_priority (&(*priority_cache)->cipher, cipher_priority_secure256);
+  _set_priority (&(*priority_cache)->kx, kx_priority_secure);
+  _set_priority (&(*priority_cache)->mac, mac_priority_secure);
+  _set_priority (&(*priority_cache)->cert_type, cert_type_priority);
+  _set_priority (&(*priority_cache)->compression, comp_priority);
+  (*priority_cache)->no_padding = 0;
+
+  return 0;
+}
+
+/**
+ * gnutls_priority_deinit - Deinitialize the priorities cache for the cipher suites supported by gnutls.
+ * @priority_cache: is a #gnutls_prioritity_t structure.
+ *
+ * Deinitializes the priority cache.
+ *
+ **/
+void
+gnutls_priority_deinit (gnutls_priority_t priority_cache)
+{
+  gnutls_free (priority_cache);
+}
+
+/**
+ * gnutls_priority_set_direct - Sets priorities for the cipher suites supported by gnutls.
+ * @session: is a #gnutls_session_t structure.
+ * @priorities: is a string describing priorities
+ * @err_pos: In case of an error this will have the position in the string the error occured
+ *
+ * Sets the priorities to use on the ciphers, key exchange methods,
+ * macs and compression methods. This function avoids keeping a
+ * priority cache and is used to directly set string priorities to a
+ * TLS session.  For documentation check the gnutls_priority_init().
+ *
+ * On syntax error GNUTLS_E_INVALID_REQUEST is returned and 0 on success.
+ *
+ **/
+int
+gnutls_priority_set_direct (gnutls_session_t session,
+                            const char *priorities, const char **err_pos)
+{
+  gnutls_priority_t prio;
+  int ret;
+
+  ret = gnutls_priority_init (&prio, priorities, err_pos);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  ret = gnutls_priority_set (session, prio);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  gnutls_priority_deinit (prio);
+
+  return 0;
+}
+
+/* Breaks a list of "xxx", "yyy", to a character array, of
+ * MAX_COMMA_SEP_ELEMENTS size; Note that the given string is modified.
+ */
+static void
+break_comma_list (char *etag,
+                  char **broken_etag,
+                  int *elements, int max_elements, char sep)
+{
+  char *p = etag;
+  if (sep == 0)
+    sep = ',';
+
+  *elements = 0;
+
+  do
+    {
+      broken_etag[*elements] = p;
+
+      (*elements)++;
+
+      p = strchr (p, sep);
+      if (p)
+        {
+          *p = 0;
+          p++;                  /* move to next entry and skip white
+                                 * space.
+                                 */
+          while (*p == ' ')
+            p++;
+        }
+    }
+  while (p != NULL && *elements < max_elements);
+}
+
+/**
+ * gnutls_set_default_priority - Sets some default priority on the cipher suites supported by gnutls.
+ * @session: is a #gnutls_session_t structure.
+ *
+ * Sets some default priority on the ciphers, key exchange methods,
+ * macs and compression methods.
+ *
+ * This is the same as calling:
+ *
+ * gnutls_priority_set_direct (session, "NORMAL", NULL);
+ *
+ * This function is kept around for backwards compatibility, but
+ * because of its wide use it is still fully supported.  If you wish
+ * to allow users to provide a string that specify which ciphers to
+ * use (which is recommended), you should use
+ * gnutls_priority_set_direct() or gnutls_priority_set() instead.
+ *
+ * Returns 0 on success.
+ **/
+int
+gnutls_set_default_priority (gnutls_session_t session)
+{
+  return gnutls_priority_set_direct (session, "NORMAL", NULL);
+}
+
+/**
+ * gnutls_set_default_export_priority - Sets some default priority on the cipher suites supported by gnutls.
+ * @session: is a #gnutls_session_t structure.
+ *
+ * Sets some default priority on the ciphers, key exchange methods, macs
+ * and compression methods.  This function also includes weak algorithms.
+ *
+ * This is the same as calling:
+ *
+ * gnutls_priority_set_direct (session, "EXPORT", NULL);
+ *
+ * This function is kept around for backwards compatibility, but
+ * because of its wide use it is still fully supported.  If you wish
+ * to allow users to provide a string that specify which ciphers to
+ * use (which is recommended), you should use
+ * gnutls_priority_set_direct() or gnutls_priority_set() instead.
+ *
+ * Returns 0 on success.
+ **/
+int
+gnutls_set_default_export_priority (gnutls_session_t session)
+{
+  return gnutls_priority_set_direct (session, "EXPORT", NULL);
+}
diff --git a/src/daemon/https/tls/gnutls_record.c b/src/daemon/https/tls/gnutls_record.c
new file mode 100644
index 00000000..cacbdecc
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_record.c
@@ -0,0 +1,1204 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* Functions that are record layer specific, are included in this file.
+ */
+
+#include "gnutls_int.h"
+#include "gnutls_errors.h"
+#include "debug.h"
+#include "gnutls_compress.h"
+#include "gnutls_cipher.h"
+#include "gnutls_buffers.h"
+#include "gnutls_handshake.h"
+#include "gnutls_hash_int.h"
+#include "gnutls_cipher_int.h"
+#include "gnutls_algorithms.h"
+#include "gnutls_db.h"
+#include "gnutls_auth_int.h"
+#include "gnutls_num.h"
+#include "gnutls_record.h"
+#include "gnutls_datum.h"
+#include "ext_max_record.h"
+#include <gnutls_state.h>
+#include <gnutls_dh.h>
+
+/**
+ * gnutls_protocol_get_version - Returns the version of the currently used protocol
+ * @session: is a #gnutls_session_t structure.
+ *
+ * Returns: the version of the currently used protocol.
+ **/
+gnutls_protocol_t gnutls_protocol_get_version(gnutls_session_t session)
+{
+  return session->security_parameters.version;
+}
+
+void _gnutls_set_current_version(gnutls_session_t session,
+                                 gnutls_protocol_t version)
+{
+  session->security_parameters.version = version;
+}
+
+/**
+ * gnutls_transport_set_lowat - Used to set the lowat value in order for select to check for pending data.
+ * @session: is a #gnutls_session_t structure.
+ * @num: is the low water value.
+ *
+ * Used to set the lowat value in order for select to check if there
+ * are pending data to socket buffer. Used only if you have changed
+ * the default low water value (default is 1).  Normally you will not
+ * need that function.  This function is only useful if using
+ * berkeley style sockets.  Otherwise it must be called and set lowat
+ * to zero.
+ **/
+void gnutls_transport_set_lowat(gnutls_session_t session,
+                                int num)
+{
+  session->internals.lowat = num;
+}
+
+/**
+ * gnutls_record_disable_padding - Used to disabled padding in TLS 1.0 and above
+ * @session: is a #gnutls_session_t structure.
+ *
+ * Used to disabled padding in TLS 1.0 and above.  Normally you do
+ * not need to use this function, but there are buggy clients that
+ * complain if a server pads the encrypted data.  This of course will
+ * disable protection against statistical attacks on the data.
+ *
+ * Normally only servers that require maximum compatibility with everything
+ * out there, need to call this function.
+ **/
+void gnutls_record_disable_padding(gnutls_session_t session)
+{
+  session->internals.priorities.no_padding = 1;
+}
+
+/**
+ * gnutls_transport_set_ptr - Used to set first argument of the transport functions
+ * @session: is a #gnutls_session_t structure.
+ * @ptr: is the value.
+ *
+ * Used to set the first argument of the transport function (like
+ * PUSH and PULL).  In berkeley style sockets this function will set
+ * the connection handle.
+ **/
+void gnutls_transport_set_ptr(gnutls_session_t session,
+                              gnutls_transport_ptr_t ptr)
+{
+  session->internals.transport_recv_ptr = ptr;
+  session->internals.transport_send_ptr = ptr;
+}
+
+/**
+ * gnutls_transport_set_ptr2 - Used to set first argument of the transport functions
+ * @session: is a #gnutls_session_t structure.
+ * @recv_ptr: is the value for the pull function
+ * @send_ptr: is the value for the push function
+ *
+ * Used to set the first argument of the transport function (like
+ * PUSH and PULL). In berkeley style sockets this function will set
+ * the connection handle.  With this function you can use two
+ * different pointers for receiving and sending.
+ **/
+void gnutls_transport_set_ptr2(gnutls_session_t session,
+                               gnutls_transport_ptr_t recv_ptr,
+                               gnutls_transport_ptr_t send_ptr)
+{
+  session->internals.transport_send_ptr = send_ptr;
+  session->internals.transport_recv_ptr = recv_ptr;
+}
+
+/**
+ * gnutls_transport_get_ptr - Used to return the first argument of the transport functions
+ * @session: is a #gnutls_session_t structure.
+ *
+ * Used to get the first argument of the transport function (like
+ * PUSH and PULL).  This must have been set using
+ * gnutls_transport_set_ptr().
+ *
+ * Returns: first argument of the transport function.
+ **/
+gnutls_transport_ptr_t gnutls_transport_get_ptr(gnutls_session_t session)
+{
+  return session->internals.transport_recv_ptr;
+}
+
+/**
+ * gnutls_transport_get_ptr2 - Used to return the first argument of the transport functions
+ * @session: is a #gnutls_session_t structure.
+ * @recv_ptr: will hold the value for the pull function
+ * @send_ptr: will hold the value for the push function
+ *
+ * Used to get the arguments of the transport functions (like PUSH
+ * and PULL).  These should have been set using
+ * gnutls_transport_set_ptr2().
+ **/
+void gnutls_transport_get_ptr2(gnutls_session_t session,
+                               gnutls_transport_ptr_t * recv_ptr,
+                               gnutls_transport_ptr_t * send_ptr)
+{
+
+  *recv_ptr = session->internals.transport_recv_ptr;
+  *send_ptr = session->internals.transport_send_ptr;
+}
+
+/**
+ * gnutls_bye - This function terminates the current TLS/SSL connection.
+ * @session: is a #gnutls_session_t structure.
+ * @how: is an integer
+ *
+ * Terminates the current TLS/SSL connection. The connection should
+ * have been initiated using gnutls_handshake().  @how should be one
+ * of %GNUTLS_SHUT_RDWR, %GNUTLS_SHUT_WR.
+ *
+ * In case of %GNUTLS_SHUT_RDWR then the TLS connection gets
+ * terminated and further receives and sends will be disallowed.  If
+ * the return value is zero you may continue using the connection.
+ * %GNUTLS_SHUT_RDWR actually sends an alert containing a close
+ * request and waits for the peer to reply with the same message.
+ *
+ * In case of %GNUTLS_SHUT_WR then the TLS connection gets terminated
+ * and further sends will be disallowed. In order to reuse the
+ * connection you should wait for an EOF from the peer.
+ * %GNUTLS_SHUT_WR sends an alert containing a close request.
+ *
+ * Note that not all implementations will properly terminate a TLS
+ * connection.  Some of them, usually for performance reasons, will
+ * terminate only the underlying transport layer, thus causing a
+ * transmission error to the peer.  This error cannot be
+ * distinguished from a malicious party prematurely terminating the
+ * session, thus this behavior is not recommended.
+ *
+ * This function may also return %GNUTLS_E_AGAIN or
+ * %GNUTLS_E_INTERRUPTED; cf.  gnutls_record_get_direction().
+ *
+ * Returns: %GNUTLS_E_SUCCESS on success, or an error code, see
+ *   function documentation for entire semantics.
+ **/
+int gnutls_bye(gnutls_session_t session,
+               gnutls_close_request_t how)
+{
+  int ret = 0;
+
+  switch (STATE)
+    {
+  case STATE0:
+  case STATE60:
+    ret = _gnutls_io_write_flush(session);
+    STATE = STATE60;
+    if (ret < 0)
+      {
+        gnutls_assert ();
+        return ret;
+      }
+
+  case STATE61:
+    ret = gnutls_alert_send(session, GNUTLS_AL_WARNING, GNUTLS_A_CLOSE_NOTIFY);
+    STATE = STATE61;
+    if (ret < 0)
+      {
+        gnutls_assert ();
+        return ret;
+      }
+
+  case STATE62:
+    STATE = STATE62;
+    if (how == GNUTLS_SHUT_RDWR)
+      {
+        do
+          {
+            _gnutls_io_clear_peeked_data(session);
+            ret = _gnutls_recv_int(session, GNUTLS_ALERT, -1, NULL, 0);
+          } while (ret == GNUTLS_E_GOT_APPLICATION_DATA);
+
+        if (ret >= 0)
+          session->internals.may_not_read = 1;
+
+        if (ret < 0)
+          {
+            gnutls_assert ();
+            return ret;
+          }
+      }
+    STATE = STATE62;
+
+    break;
+  default:
+    gnutls_assert ()
+    ;
+    return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  STATE = STATE0;
+
+  session->internals.may_not_write = 1;
+  return 0;
+}
+
+inline static void session_invalidate(gnutls_session_t session)
+{
+  session->internals.valid_connection = VALID_FALSE;
+}
+
+inline static void session_unresumable(gnutls_session_t session)
+{
+  session->internals.resumable = RESUME_FALSE;
+}
+
+/* returns 0 if session is valid
+ */
+inline static int session_is_valid(gnutls_session_t session)
+{
+  if (session->internals.valid_connection == VALID_FALSE)
+    return GNUTLS_E_INVALID_SESSION;
+
+  return 0;
+}
+
+/* Copies the record version into the headers. The 
+ * version must have 2 bytes at least.
+ */
+inline static void copy_record_version(gnutls_session_t session,
+                                       gnutls_handshake_description_t htype,
+                                       opaque version[2])
+{
+  gnutls_protocol_t lver;
+
+  if (htype != GNUTLS_HANDSHAKE_CLIENT_HELLO
+      || session->internals.default_record_version[0] == 0)
+    {
+      lver = gnutls_protocol_get_version(session);
+
+      version[0] = _gnutls_version_get_major(lver);
+      version[1] = _gnutls_version_get_minor(lver);
+    }
+  else
+    {
+      version[0] = session->internals.default_record_version[0];
+      version[1] = session->internals.default_record_version[1];
+    }
+}
+
+/* This function behaves exactly like write(). The only difference is
+ * that it accepts, the gnutls_session_t and the content_type_t of data to
+ * send (if called by the user the Content is specific)
+ * It is intended to transfer data, under the current session.    
+ *
+ * Oct 30 2001: Removed capability to send data more than MAX_RECORD_SIZE.
+ * This makes the function much easier to read, and more error resistant
+ * (there were cases were the old function could mess everything up).
+ * --nmav
+ *
+ * This function may accept a NULL pointer for data, and 0 for size, if
+ * and only if the previous send was interrupted for some reason.
+ *
+ */
+ssize_t _gnutls_send_int(gnutls_session_t session,
+                         content_type_t type,
+                         gnutls_handshake_description_t htype,
+                         const void *_data,
+                         size_t sizeofdata)
+{
+  uint8_t *cipher;
+  int cipher_size;
+  int retval, ret;
+  int data2send_size;
+  uint8_t headers[5];
+  const uint8_t *data = _data;
+
+  /* Do not allow null pointer if the send buffer is empty.
+   * If the previous send was interrupted then a null pointer is
+   * ok, and means to resume.
+   */
+  if (session->internals.record_send_buffer.length == 0 && (sizeofdata == 0
+      && _data == NULL))
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (type != GNUTLS_ALERT) /* alert messages are sent anyway */
+    if (session_is_valid(session) || session->internals.may_not_write != 0)
+      {
+        gnutls_assert ();
+        return GNUTLS_E_INVALID_SESSION;
+      }
+
+  headers[0] = type;
+
+  /* Use the default record version, if it is
+   * set.
+   */
+  copy_record_version(session, htype, &headers[1]);
+
+  _gnutls_record_log
+  ("REC[%x]: Sending Packet[%d] %s(%d) with length: %d\n", session,
+      (int) _gnutls_uint64touint32 (&session->connection_state.
+          write_sequence_number),
+      _gnutls_packet2str (type), type, sizeofdata);
+
+  if (sizeofdata > MAX_RECORD_SEND_SIZE)
+    data2send_size = MAX_RECORD_SEND_SIZE;
+  else
+    data2send_size = sizeofdata;
+
+  /* Only encrypt if we don't have data to send 
+   * from the previous run. - probably interrupted.
+   */
+  if (session->internals.record_send_buffer.length > 0)
+    {
+      ret = _gnutls_io_write_flush(session);
+      if (ret > 0)
+        cipher_size = ret;
+      else
+        cipher_size = 0;
+
+      cipher = NULL;
+
+      retval = session->internals.record_send_buffer_user_size;
+    }
+  else
+    {
+      /* now proceed to packet encryption
+       */
+      cipher_size = data2send_size + MAX_RECORD_OVERHEAD;cipher = gnutls_malloc (cipher_size);
+      if (cipher == NULL)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_MEMORY_ERROR;
+        }
+
+      cipher_size =
+      _gnutls_encrypt (session, headers, RECORD_HEADER_SIZE, data,
+          data2send_size, cipher, cipher_size, type,
+          (session->internals.priorities.no_padding ==
+              0) ? 1 : 0);
+      if (cipher_size <= 0)
+        {
+          gnutls_assert ();
+          if (cipher_size == 0)
+          cipher_size = GNUTLS_E_ENCRYPTION_FAILED;
+          gnutls_free (cipher);
+          return cipher_size; /* error */
+        }
+
+      retval = data2send_size;
+      session->internals.record_send_buffer_user_size = data2send_size;
+
+      /* increase sequence number
+       */
+      if (_gnutls_uint64pp
+          (&session->connection_state.write_sequence_number) != 0)
+        {
+          session_invalidate (session);
+          gnutls_assert ();
+          gnutls_free (cipher);
+          return GNUTLS_E_RECORD_LIMIT_REACHED;
+        }
+
+      ret = _gnutls_io_write_buffered (session, cipher, cipher_size);
+      gnutls_free (cipher);
+    }
+
+  if (ret != cipher_size)
+    {
+      if (ret < 0 && gnutls_error_is_fatal (ret) == 0)
+        {
+          /* If we have sent any data then just return
+           * the error value. Do not invalidate the session.
+           */
+          gnutls_assert ();
+          return ret;
+        }
+
+      if (ret> 0)
+        {
+          gnutls_assert ();
+          ret = GNUTLS_E_INTERNAL_ERROR;
+        }
+      session_unresumable (session);
+      session->internals.may_not_write = 1;
+      gnutls_assert ();
+      return ret;
+    }
+
+  session->internals.record_send_buffer_user_size = 0;
+
+  _gnutls_record_log ("REC[%x]: Sent Packet[%d] %s(%d) with length: %d\n",
+      session,
+      (int) _gnutls_uint64touint32 (&session->
+          connection_state.
+          write_sequence_number),
+      _gnutls_packet2str (type), type, cipher_size);
+
+  return retval;
+}
+
+/* This function is to be called if the handshake was successfully 
+ * completed. This sends a Change Cipher Spec packet to the peer.
+ */
+ssize_t _gnutls_send_change_cipher_spec(gnutls_session_t session,
+                                        int again)
+{
+  static const opaque data[1] =
+    {
+      GNUTLS_TYPE_CHANGE_CIPHER_SPEC };
+
+  _gnutls_handshake_log ("REC[%x]: Sent ChangeCipherSpec\n", session);
+
+  if (again == 0)
+    return _gnutls_send_int(session, GNUTLS_CHANGE_CIPHER_SPEC, -1, data, 1);
+  else
+    {
+      return _gnutls_io_write_flush(session);
+    }
+}
+
+inline static int check_recv_type(content_type_t recv_type)
+{
+  switch (recv_type)
+    {
+  case GNUTLS_CHANGE_CIPHER_SPEC:
+  case GNUTLS_ALERT:
+  case GNUTLS_HANDSHAKE:
+  case GNUTLS_APPLICATION_DATA:
+  case GNUTLS_INNER_APPLICATION:
+    return 0;
+  default:
+    gnutls_assert ()
+    ;
+    return GNUTLS_A_UNEXPECTED_MESSAGE;
+    }
+
+}
+
+/* Checks if there are pending data in the record buffers. If there are
+ * then it copies the data.
+ */
+static int check_buffers(gnutls_session_t session,
+                         content_type_t type,
+                         opaque * data,
+                         int sizeofdata)
+{
+  if ((type == GNUTLS_APPLICATION_DATA || type == GNUTLS_HANDSHAKE || type
+      == GNUTLS_INNER_APPLICATION) && _gnutls_record_buffer_get_size(type,
+                                                                     session)
+      > 0)
+    {
+      int ret, ret2;
+      ret = _gnutls_record_buffer_get(type, session, data, sizeofdata);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      /* if the buffer just got empty */
+      if (_gnutls_record_buffer_get_size(type, session) == 0)
+        {
+          if ((ret2 = _gnutls_io_clear_peeked_data(session)) < 0)
+            {
+              gnutls_assert ();
+              return ret2;
+            }
+        }
+
+      return ret;
+    }
+
+  return 0;
+}
+
+/* Checks the record headers and returns the length, version and
+ * content type.
+ */
+static int record_check_headers(gnutls_session_t session,
+                                uint8_t headers[RECORD_HEADER_SIZE],
+                                content_type_t type,
+                                gnutls_handshake_description_t htype,
+                                /*output */content_type_t * recv_type,
+                                opaque version[2],
+                                uint16_t * length,
+                                uint16_t * header_size)
+{
+
+  /* Read the first two bytes to determine if this is a 
+   * version 2 message 
+   */
+
+  if (htype == GNUTLS_HANDSHAKE_CLIENT_HELLO && type == GNUTLS_HANDSHAKE
+      && headers[0] > 127)
+    {
+
+      /* if msb set and expecting handshake message
+       * it should be SSL 2 hello 
+       */
+      version[0] = 3; /* assume SSL 3.0 */
+      version[1] = 0;
+
+      *length = (((headers[0] & 0x7f) << 8)) | headers[1];
+
+      /* SSL 2.0 headers */
+      *header_size = 2;
+      *recv_type = GNUTLS_HANDSHAKE; /* we accept only v2 client hello
+       */
+
+      /* in order to assist the handshake protocol.
+       * V2 compatibility is a mess.
+       */
+      session->internals.v2_hello = *length;
+
+      _gnutls_record_log ("REC[%x]: V2 packet received. Length: %d\n",
+          session, *length);
+
+    }
+  else
+    {
+      /* version 3.x */
+      *recv_type = headers[0];
+      version[0] = headers[1];
+      version[1] = headers[2];
+
+      /* No DECR_LEN, since headers has enough size. 
+       */
+      *length = _gnutls_read_uint16(&headers[3]);
+    }
+
+  return 0;
+}
+
+/* Here we check if the advertized version is the one we
+ * negotiated in the handshake.
+ */
+inline static int record_check_version(gnutls_session_t session,
+                                       gnutls_handshake_description_t htype,
+                                       opaque version[2])
+{
+  if (htype == GNUTLS_HANDSHAKE_CLIENT_HELLO)
+    {
+      /* Reject hello packets with major version higher than 3.
+       */
+      if (version[0] > 3)
+        {
+          gnutls_assert ();
+          _gnutls_record_log
+          ("REC[%x]: INVALID VERSION PACKET: (%d) %d.%d\n", session,
+              htype, version[0], version[1]);
+          return GNUTLS_E_UNSUPPORTED_VERSION_PACKET;
+        }
+    }
+  else if (htype != GNUTLS_HANDSHAKE_SERVER_HELLO
+      && gnutls_protocol_get_version(session)
+          != _gnutls_version_get(version[0], version[1]))
+    {
+      /* Reject record packets that have a different version than the
+       * one negotiated. Note that this version is not protected by any
+       * mac. I don't really think that this check serves any purpose.
+       */
+      gnutls_assert ();
+      _gnutls_record_log ("REC[%x]: INVALID VERSION PACKET: (%d) %d.%d\n",
+          session, htype, version[0], version[1]);
+
+      return GNUTLS_E_UNSUPPORTED_VERSION_PACKET;
+    }
+
+  return 0;
+}
+
+/* This function will check if the received record type is
+ * the one we actually expect.
+ */
+static int record_check_type(gnutls_session_t session,
+                             content_type_t recv_type,
+                             content_type_t type,
+                             gnutls_handshake_description_t htype,
+                             opaque * data,
+                             int data_size)
+{
+
+  int ret;
+
+  if ((recv_type == type) && (type == GNUTLS_APPLICATION_DATA || type
+      == GNUTLS_HANDSHAKE || type == GNUTLS_INNER_APPLICATION))
+    {
+      _gnutls_record_buffer_put(type, session, (void *) data, data_size);
+    }
+  else
+    {
+      switch (recv_type)
+        {
+      case GNUTLS_ALERT:
+
+        _gnutls_record_log
+        ("REC[%x]: Alert[%d|%d] - %s - was received\n", session,
+            data[0], data[1], gnutls_alert_get_name ((int) data[1]));
+
+        session->internals.last_alert = data[1];
+
+        /* if close notify is received and
+         * the alert is not fatal
+         */
+        if (data[1] == GNUTLS_A_CLOSE_NOTIFY && data[0] != GNUTLS_AL_FATAL)
+          {
+            /* If we have been expecting for an alert do 
+             */
+            session->internals.read_eof = 1;
+            return GNUTLS_E_INT_RET_0; /* EOF */
+          }
+        else
+          {
+
+            /* if the alert is FATAL or WARNING
+             * return the apropriate message
+             */
+
+            gnutls_assert ();
+            ret = GNUTLS_E_WARNING_ALERT_RECEIVED;
+            if (data[0] == GNUTLS_AL_FATAL)
+              {
+                session_unresumable(session);
+                session_invalidate(session);
+                ret = GNUTLS_E_FATAL_ALERT_RECEIVED;
+              }
+
+            return ret;
+          }
+        break;
+
+      case GNUTLS_CHANGE_CIPHER_SPEC:
+        /* this packet is now handled in the recv_int()
+         * function
+         */
+        gnutls_assert ()
+        ;
+
+        return GNUTLS_E_UNEXPECTED_PACKET;
+
+      case GNUTLS_APPLICATION_DATA:
+        /* even if data is unexpected put it into the buffer */
+        if ((ret = _gnutls_record_buffer_put(recv_type, session, (void *) data,
+                                             data_size)) < 0)
+          {
+            gnutls_assert ();
+            return ret;
+          }
+
+        /* the got_application data is only returned
+         * if expecting client hello (for rehandshake
+         * reasons). Otherwise it is an unexpected packet
+         */
+        if (type == GNUTLS_ALERT || (htype == GNUTLS_HANDSHAKE_CLIENT_HELLO
+            && type == GNUTLS_HANDSHAKE))
+          return GNUTLS_E_GOT_APPLICATION_DATA;
+        else
+          {
+            gnutls_assert ();
+            return GNUTLS_E_UNEXPECTED_PACKET;
+          }
+
+        break;
+      case GNUTLS_HANDSHAKE:
+        /* This is legal if HELLO_REQUEST is received - and we are a client.
+         * If we are a server, a client may initiate a renegotiation at any time.
+         */
+        if (session->security_parameters.entity == GNUTLS_SERVER)
+          {
+            gnutls_assert ();
+            return GNUTLS_E_REHANDSHAKE;
+          }
+
+        /* If we are already in a handshake then a Hello
+         * Request is illegal. But here we don't really care
+         * since this message will never make it up here.
+         */
+
+        /* So we accept it */
+        return _gnutls_recv_hello_request(session, data, data_size);
+
+        break;
+      case GNUTLS_INNER_APPLICATION:
+        /* even if data is unexpected put it into the buffer */
+        if ((ret = _gnutls_record_buffer_put(recv_type, session, (void *) data,
+                                             data_size)) < 0)
+          {
+            gnutls_assert ();
+            return ret;
+          }
+        gnutls_assert ()
+        ;
+        return GNUTLS_E_UNEXPECTED_PACKET;
+        break;
+      default:
+
+        _gnutls_record_log
+        ("REC[%x]: Received Unknown packet %d expecting %d\n",
+            session, recv_type, type);
+
+        gnutls_assert ()
+        ;
+        return GNUTLS_E_INTERNAL_ERROR;
+        }
+    }
+
+  return 0;
+
+}
+
+/* This function will return the internal (per session) temporary
+ * recv buffer. If the buffer was not initialized before it will
+ * also initialize it.
+ */
+inline static int get_temp_recv_buffer(gnutls_session_t session,
+                                       gnutls_datum_t * tmp)
+{
+  size_t max_record_size;
+
+  if (gnutls_compression_get(session) != GNUTLS_COMP_NULL)
+    max_record_size = MAX_RECORD_RECV_SIZE + EXTRA_COMP_SIZE;
+  else
+    max_record_size = MAX_RECORD_RECV_SIZE;
+
+  /* We allocate MAX_RECORD_RECV_SIZE length
+   * because we cannot predict the output data by the record
+   * packet length (due to compression).
+   */
+
+  if (max_record_size > session->internals.recv_buffer.size
+      || session->internals.recv_buffer.data == NULL)
+    {
+
+      /* Initialize the internal buffer.
+       */
+      session->internals.recv_buffer.data
+          = gnutls_realloc(session->internals.recv_buffer.data, max_record_size);
+
+      if (session->internals.recv_buffer.data == NULL)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_MEMORY_ERROR;
+        }
+
+      session->internals.recv_buffer.size = max_record_size;
+    }
+ 
+  tmp->data = session->internals.recv_buffer.data;
+  tmp->size = session->internals.recv_buffer.size;
+
+  return 0;
+}
+
+#define MAX_EMPTY_PACKETS_SEQUENCE 4
+
+/* This function behaves exactly like read(). The only difference is
+ * that it accepts the gnutls_session_t and the content_type_t of data to
+ * receive (if called by the user the Content is Userdata only)
+ * It is intended to receive data, under the current session.
+ *
+ * The gnutls_handshake_description_t was introduced to support SSL V2.0 client hellos.
+ */
+ssize_t _gnutls_recv_int(gnutls_session_t session,
+                         content_type_t type,
+                         gnutls_handshake_description_t htype,
+                         opaque * data,
+                         size_t sizeofdata)
+{
+  gnutls_datum_t tmp;
+  int decrypted_length;
+  opaque version[2];
+  uint8_t *headers;
+  content_type_t recv_type;
+  uint16_t length;
+  uint8_t *ciphertext;
+  uint8_t *recv_data;
+  int ret, ret2;
+  uint16_t header_size;
+  int empty_packet = 0;
+
+  if (type != GNUTLS_ALERT && (sizeofdata == 0 || data == NULL))
+    {
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  begin:
+
+  if (empty_packet > MAX_EMPTY_PACKETS_SEQUENCE)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_TOO_MANY_EMPTY_PACKETS;
+    }
+
+  if (session->internals.read_eof != 0)
+    {
+      /* if we have already read an EOF
+       */
+      return 0;
+    }
+  else if (session_is_valid(session) != 0 || session->internals.may_not_read
+      != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_SESSION;
+    }
+
+  /* If we have enough data in the cache do not bother receiving
+   * a new packet. (in order to flush the cache)
+   */
+  ret = check_buffers(session, type, data, sizeofdata);
+  if (ret != 0)
+    return ret;
+
+  /* default headers for TLS 1.0
+   */
+  header_size = RECORD_HEADER_SIZE;
+
+  if ((ret = _gnutls_io_read_buffered(session, &headers, header_size, -1))
+      != header_size)
+    {
+      if (ret < 0 && gnutls_error_is_fatal(ret) == 0)
+        return ret;
+
+      session_invalidate(session);
+      if (type == GNUTLS_ALERT)
+        {
+          gnutls_assert ();
+          return 0; /* we were expecting close notify */
+        }
+      session_unresumable(session);
+      gnutls_assert ();
+      return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+    }
+
+  if ((ret = record_check_headers(session, headers, type, htype, &recv_type,
+                                  version, &length, &header_size)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  /* Here we check if the Type of the received packet is
+   * ok. 
+   */
+  if ((ret = check_recv_type(recv_type)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  /* Here we check if the advertized version is the one we
+   * negotiated in the handshake.
+   */
+  if ((ret = record_check_version(session, htype, version)) < 0)
+    {
+      gnutls_assert ();
+      session_invalidate(session);
+      return ret;
+    }
+
+  _gnutls_record_log
+  ("REC[%x]: Expected Packet[%d] %s(%d) with length: %d\n", session,
+      (int) _gnutls_uint64touint32 (&session->connection_state.
+          read_sequence_number),
+      _gnutls_packet2str (type), type, sizeofdata);
+  _gnutls_record_log
+  ("REC[%x]: Received Packet[%d] %s(%d) with length: %d\n", session,
+      (int) _gnutls_uint64touint32 (&session->connection_state.
+          read_sequence_number),
+      _gnutls_packet2str (recv_type), recv_type, length);
+
+  if (length > MAX_RECV_SIZE)
+    {
+      _gnutls_record_log
+      ("REC[%x]: FATAL ERROR: Received packet with length: %d\n",
+          session, length);
+
+      session_unresumable(session);
+      session_invalidate(session);
+      gnutls_assert ();
+      return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+    }
+
+  /* check if we have that data into buffer. 
+   */
+  if ((ret = _gnutls_io_read_buffered(session, &recv_data,
+                                      header_size + length, recv_type))
+      != header_size + length)
+    {
+      if (ret < 0 && gnutls_error_is_fatal(ret) == 0)
+        return ret;
+
+      session_unresumable(session);
+      session_invalidate(session);
+      gnutls_assert ();
+      return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+    }
+
+  /* ok now we are sure that we can read all the data - so
+   * move on !
+   */
+  _gnutls_io_clear_read_buffer(session);
+  ciphertext = &recv_data[header_size];
+
+  ret = get_temp_recv_buffer(session, &tmp);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  /* decrypt the data we got. 
+   */
+  ret = _gnutls_decrypt(session, ciphertext, length, tmp.data, tmp.size,
+                        recv_type);
+  if (ret < 0)
+    {
+      session_unresumable(session);
+      session_invalidate(session);
+      gnutls_assert ();
+      return ret;
+    }
+  decrypted_length = ret;
+
+  /* Check if this is a CHANGE_CIPHER_SPEC
+   */
+  if (type == GNUTLS_CHANGE_CIPHER_SPEC && recv_type
+      == GNUTLS_CHANGE_CIPHER_SPEC)
+    {
+
+      _gnutls_record_log
+      ("REC[%x]: ChangeCipherSpec Packet was received\n", session);
+
+      if ((size_t) ret != sizeofdata)
+        { /* sizeofdata should be 1 */
+          gnutls_assert ();
+          return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+        }
+      memcpy(data, tmp.data, sizeofdata);
+
+      return ret;
+    }
+
+  _gnutls_record_log
+  ("REC[%x]: Decrypted Packet[%d] %s(%d) with length: %d\n", session,
+      (int) _gnutls_uint64touint32 (&session->connection_state.
+          read_sequence_number),
+      _gnutls_packet2str (recv_type), recv_type, decrypted_length);
+
+  /* increase sequence number 
+   */
+  if (_gnutls_uint64pp(&session->connection_state.read_sequence_number) != 0)
+    {
+      session_invalidate(session);
+      gnutls_assert ();
+      return GNUTLS_E_RECORD_LIMIT_REACHED;
+    }
+
+  ret = record_check_type(session, recv_type, type, htype, tmp.data,
+                          decrypted_length);
+  if (ret < 0)
+    {
+      if (ret == GNUTLS_E_INT_RET_0)
+        return 0;
+      gnutls_assert ();
+      return ret;
+    }
+
+  /* Get Application data from buffer 
+   */
+  if ((recv_type == type) && (type == GNUTLS_APPLICATION_DATA || type
+      == GNUTLS_HANDSHAKE || type == GNUTLS_INNER_APPLICATION))
+    {
+
+      ret = _gnutls_record_buffer_get(type, session, data, sizeofdata);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      /* if the buffer just got empty 
+       */
+      if (_gnutls_record_buffer_get_size(type, session) == 0)
+        {
+          if ((ret2 = _gnutls_io_clear_peeked_data(session)) < 0)
+            {
+              gnutls_assert ();
+              return ret2;
+            }
+        }
+    }
+  else
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNEXPECTED_PACKET;
+      /* we didn't get what we wanted to 
+       */
+    }
+
+  /* (originally for) TLS 1.0 CBC protection. 
+   * Actually this code is called if we just received
+   * an empty packet. An empty TLS packet is usually
+   * sent to protect some vulnerabilities in the CBC mode.
+   * In that case we go to the beginning and start reading
+   * the next packet.
+   */
+  if (ret == 0)
+    {
+      empty_packet++;
+      goto begin;
+    }
+
+  return ret;
+}
+
+/**
+ * gnutls_record_send - sends to the peer the specified data
+ * @session: is a #gnutls_session_t structure.
+ * @data: contains the data to send
+ * @sizeofdata: is the length of the data
+ *
+ * This function has the similar semantics with send(). The only
+ * difference is that is accepts a GNUTLS session, and uses different
+ * error codes.
+ *
+ * Note that if the send buffer is full, send() will block this
+ * function.  See the send() documentation for full information.  You
+ * can replace the default push function by using
+ * gnutls_transport_set_ptr2() with a call to send() with a
+ * MSG_DONTWAIT flag if blocking is a problem.
+ *
+ * If the EINTR is returned by the internal push function (the
+ * default is send()} then %GNUTLS_E_INTERRUPTED will be returned. If
+ * %GNUTLS_E_INTERRUPTED or %GNUTLS_E_AGAIN is returned, you must
+ * call this function again, with the same parameters; alternatively
+ * you could provide a %NULL pointer for data, and 0 for
+ * size. cf. gnutls_record_get_direction().
+ *
+ * Returns: the number of bytes sent, or a negative error code.  The
+ * number of bytes sent might be less than @sizeofdata.  The maximum
+ * number of bytes this function can send in a single call depends on
+ * the negotiated maximum record size.
+ **/
+ssize_t gnutls_record_send(gnutls_session_t session,
+                           const void *data,
+                           size_t sizeofdata)
+{
+  return _gnutls_send_int(session, GNUTLS_APPLICATION_DATA, -1, data,
+                          sizeofdata);
+}
+
+/**
+ * gnutls_record_recv - reads data from the TLS record protocol
+ * @session: is a #gnutls_session_t structure.
+ * @data: the buffer that the data will be read into
+ * @sizeofdata: the number of requested bytes
+ *
+ * This function has the similar semantics with recv(). The only
+ * difference is that is accepts a GNUTLS session, and uses different
+ * error codes.
+ *
+ * In the special case that a server requests a renegotiation, the
+ * client may receive an error code of %GNUTLS_E_REHANDSHAKE.  This
+ * message may be simply ignored, replied with an alert containing
+ * NO_RENEGOTIATION, or replied with a new handshake, depending on
+ * the client's will.
+ *
+ * If %EINTR is returned by the internal push function (the default
+ * is recv()) then %GNUTLS_E_INTERRUPTED will be returned.  If
+ * %GNUTLS_E_INTERRUPTED or %GNUTLS_E_AGAIN is returned, you must
+ * call this function again to get the data.  See also
+ * gnutls_record_get_direction().
+ *
+ * A server may also receive %GNUTLS_E_REHANDSHAKE when a client has
+ * initiated a handshake. In that case the server can only initiate a
+ * handshake or terminate the connection.
+ *
+ * Returns: the number of bytes received and zero on EOF.  A negative
+ * error code is returned in case of an error.  The number of bytes
+ * received might be less than @sizeofdata.
+ **/
+ssize_t gnutls_record_recv(gnutls_session_t session,
+                           void *data,
+                           size_t sizeofdata)
+{
+  return _gnutls_recv_int(session, GNUTLS_APPLICATION_DATA, -1, data,
+                          sizeofdata);
+}
+
+/**
+ * gnutls_record_get_max_size - returns the maximum record size
+ * @session: is a #gnutls_session_t structure.
+ *
+ * This function returns the maximum record packet size in this
+ * connection.  The maximum record size is negotiated by the client
+ * after the first handshake message.
+ **/
+size_t gnutls_record_get_max_size(gnutls_session_t session)
+{
+  /* Recv will hold the negotiated max record size
+   * always.
+   */
+  return session->security_parameters.max_record_recv_size;
+}
+
+/**
+ * gnutls_record_set_max_size - sets the maximum record size
+ * @session: is a #gnutls_session_t structure.
+ * @size: is the new size
+ *
+ * This function sets the maximum record packet size in this
+ * connection.  This property can only be set to clients.  The server
+ * may choose not to accept the requested size.
+ *
+ * Acceptable values are 512(=2^9), 1024(=2^10), 2048(=2^11) and
+ * 4096(=2^12).  Returns 0 on success. The requested record size does
+ * get in effect immediately only while sending data. The receive
+ * part will take effect after a successful handshake.
+ *
+ * This function uses a TLS extension called 'max record size'.  Not
+ * all TLS implementations use or even understand this extension.
+ **/
+ssize_t gnutls_record_set_max_size(gnutls_session_t session,
+                                   size_t size)
+{
+  ssize_t new_size;
+
+  if (session->security_parameters.entity == GNUTLS_SERVER)
+    return GNUTLS_E_INVALID_REQUEST;
+
+  new_size = _gnutls_mre_record2num(size);
+
+  if (new_size < 0)
+    {
+      gnutls_assert ();
+      return new_size;
+    }
+
+  session->security_parameters.max_record_send_size = size;
+
+  session->internals.proposed_record_size = size;
+
+  return 0;
+}
diff --git a/src/daemon/https/tls/gnutls_record.h b/src/daemon/https/tls/gnutls_record.h
new file mode 100644
index 00000000..5595f32a
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_record.h
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+ssize_t _gnutls_send_int (gnutls_session_t session, content_type_t type,
+                          gnutls_handshake_description_t htype,
+                          const void *data, size_t sizeofdata);
+ssize_t _gnutls_recv_int (gnutls_session_t session, content_type_t type,
+                          gnutls_handshake_description_t, opaque * data,
+                          size_t sizeofdata);
+ssize_t _gnutls_send_change_cipher_spec (gnutls_session_t session, int again);
+void gnutls_transport_set_lowat (gnutls_session_t session, int num);
diff --git a/src/daemon/https/tls/gnutls_rsa_export.c b/src/daemon/https/tls/gnutls_rsa_export.c
new file mode 100644
index 00000000..66fad085
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_rsa_export.c
@@ -0,0 +1,361 @@
+/*
+ * Copyright (C) 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* This file contains code for RSA temporary keys. These keys are
+ * only used in export cipher suites.
+ */
+
+#include <gnutls_int.h>
+#include <gnutls_errors.h>
+#include <gnutls_datum.h>
+#include <gnutls_rsa_export.h>
+#include "debug.h"
+/* x509 */
+#include "x509.h"
+#include "privkey.h"
+
+/* This function takes a number of bits and returns a supported
+ * number of bits. Ie a number of bits that we have a prime in the
+ * dh_primes structure.
+ */
+
+#define MAX_SUPPORTED_BITS 512
+
+/* returns e and m, depends on the requested bits.
+ * We only support limited key sizes.
+ */
+const mpi_t *
+_gnutls_rsa_params_to_mpi (gnutls_rsa_params_t rsa_params)
+{
+  if (rsa_params == NULL)
+    {
+      return NULL;
+    }
+
+  return rsa_params->params;
+
+}
+
+/* resarr will contain: modulus(0), public exponent(1), private exponent(2),
+ * prime1 - p (3), prime2 - q(4), u (5).
+ */
+int
+_gnutls_rsa_generate_params (mpi_t * resarr, int *resarr_len, int bits)
+{
+
+  int ret;
+  gcry_sexp_t parms, key, list;
+
+  ret = gcry_sexp_build (&parms, NULL, "(genkey(rsa(nbits %d)))", bits);
+  if (ret != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  /* generate the RSA key */
+  ret = gcry_pk_genkey (&key, parms);
+  gcry_sexp_release (parms);
+
+  if (ret != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  list = gcry_sexp_find_token (key, "n", 0);
+  if (list == NULL)
+    {
+      gnutls_assert ();
+      gcry_sexp_release (key);
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  resarr[0] = gcry_sexp_nth_mpi (list, 1, 0);
+  gcry_sexp_release (list);
+
+  list = gcry_sexp_find_token (key, "e", 0);
+  if (list == NULL)
+    {
+      gnutls_assert ();
+      gcry_sexp_release (key);
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  resarr[1] = gcry_sexp_nth_mpi (list, 1, 0);
+  gcry_sexp_release (list);
+
+  list = gcry_sexp_find_token (key, "d", 0);
+  if (list == NULL)
+    {
+      gnutls_assert ();
+      gcry_sexp_release (key);
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  resarr[2] = gcry_sexp_nth_mpi (list, 1, 0);
+  gcry_sexp_release (list);
+
+  list = gcry_sexp_find_token (key, "p", 0);
+  if (list == NULL)
+    {
+      gnutls_assert ();
+      gcry_sexp_release (key);
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  resarr[3] = gcry_sexp_nth_mpi (list, 1, 0);
+  gcry_sexp_release (list);
+
+
+  list = gcry_sexp_find_token (key, "q", 0);
+  if (list == NULL)
+    {
+      gnutls_assert ();
+      gcry_sexp_release (key);
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  resarr[4] = gcry_sexp_nth_mpi (list, 1, 0);
+  gcry_sexp_release (list);
+
+
+  list = gcry_sexp_find_token (key, "u", 0);
+  if (list == NULL)
+    {
+      gnutls_assert ();
+      gcry_sexp_release (key);
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  resarr[5] = gcry_sexp_nth_mpi (list, 1, 0);
+  gcry_sexp_release (list);
+
+  gcry_sexp_release (key);
+
+  _gnutls_dump_mpi ("n: ", resarr[0]);
+  _gnutls_dump_mpi ("e: ", resarr[1]);
+  _gnutls_dump_mpi ("d: ", resarr[2]);
+  _gnutls_dump_mpi ("p: ", resarr[3]);
+  _gnutls_dump_mpi ("q: ", resarr[4]);
+  _gnutls_dump_mpi ("u: ", resarr[5]);
+
+  *resarr_len = 6;
+
+  return 0;
+
+}
+
+
+/**
+  * gnutls_rsa_params_import_raw - This function will replace the old RSA parameters
+  * @rsa_params: Is a structure will hold the parameters
+  * @m: holds the modulus
+  * @e: holds the public exponent
+  * @d: holds the private exponent
+  * @p: holds the first prime (p)
+  * @q: holds the second prime (q)
+  * @u: holds the coefficient
+  *
+  * This function will replace the parameters in the given structure.
+  * The new parameters should be stored in the appropriate gnutls_datum. 
+  * 
+  **/
+int
+gnutls_rsa_params_import_raw (gnutls_rsa_params_t rsa_params,
+                              const gnutls_datum_t * m,
+                              const gnutls_datum_t * e,
+                              const gnutls_datum_t * d,
+                              const gnutls_datum_t * p,
+                              const gnutls_datum_t * q,
+                              const gnutls_datum_t * u)
+{
+  return gnutls_x509_privkey_import_rsa_raw (rsa_params, m, e, d, p, q, u);
+}
+
+/**
+  * gnutls_rsa_params_init - This function will initialize the temporary RSA parameters
+  * @rsa_params: Is a structure that will hold the parameters
+  *
+  * This function will initialize the temporary RSA parameters structure.
+  *
+  **/
+int
+gnutls_rsa_params_init (gnutls_rsa_params_t * rsa_params)
+{
+  int ret;
+
+  ret = gnutls_x509_privkey_init (rsa_params);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  (*rsa_params)->crippled = 1;
+
+  return 0;
+}
+
+/**
+  * gnutls_rsa_params_deinit - This function will deinitialize the RSA parameters
+  * @rsa_params: Is a structure that holds the parameters
+  *
+  * This function will deinitialize the RSA parameters structure.
+  *
+  **/
+void
+gnutls_rsa_params_deinit (gnutls_rsa_params_t rsa_params)
+{
+  gnutls_x509_privkey_deinit (rsa_params);
+}
+
+/**
+  * gnutls_rsa_params_cpy - This function will copy an RSA parameters structure
+  * @dst: Is the destination structure, which should be initialized.
+  * @src: Is the source structure
+  *
+  * This function will copy the RSA parameters structure from source
+  * to destination.
+  *
+  **/
+int
+gnutls_rsa_params_cpy (gnutls_rsa_params_t dst, gnutls_rsa_params_t src)
+{
+  return gnutls_x509_privkey_cpy (dst, src);
+}
+
+/**
+  * gnutls_rsa_params_generate2 - This function will generate temporary RSA parameters
+  * @params: The structure where the parameters will be stored
+  * @bits: is the prime's number of bits
+  *
+  * This function will generate new temporary RSA parameters for use in 
+  * RSA-EXPORT ciphersuites.  This function is normally slow. 
+  * 
+  * Note that if the parameters are to be used in export cipher suites the 
+  * bits value should be 512 or less.
+  * Also note that the generation of new RSA parameters is only useful
+  * to servers. Clients use the parameters sent by the server, thus it's
+  * no use calling this in client side.
+  *
+  **/
+int
+gnutls_rsa_params_generate2 (gnutls_rsa_params_t params, unsigned int bits)
+{
+  return gnutls_x509_privkey_generate (params, GNUTLS_PK_RSA, bits, 0);
+}
+
+/**
+  * gnutls_rsa_params_import_pkcs1 - This function will import RSA params from a pkcs1 structure
+  * @params: A structure where the parameters will be copied to
+  * @pkcs1_params: should contain a PKCS1 RSAPublicKey structure PEM or DER encoded
+  * @format: the format of params. PEM or DER.
+  *
+  * This function will extract the RSAPublicKey found in a PKCS1 formatted
+  * structure. 
+  *
+  * If the structure is PEM encoded, it should have a header
+  * of "BEGIN RSA PRIVATE KEY".
+  *
+  * In case of failure a negative value will be returned, and
+  * 0 on success.
+  *
+  **/
+int
+gnutls_rsa_params_import_pkcs1 (gnutls_rsa_params_t params,
+                                const gnutls_datum_t * pkcs1_params,
+                                gnutls_x509_crt_fmt_t format)
+{
+  return gnutls_x509_privkey_import (params, pkcs1_params, format);
+}
+
+
+/**
+  * gnutls_rsa_params_export_pkcs1 - This function will export RSA params to a pkcs1 structure
+  * @params: Holds the RSA parameters
+  * @format: the format of output params. One of PEM or DER.
+  * @params_data: will contain a PKCS1 RSAPublicKey structure PEM or DER encoded
+  * @params_data_size: holds the size of params_data (and will be replaced by the actual size of parameters)
+  *
+  * This function will export the given RSA parameters to a PKCS1
+  * RSAPublicKey structure. If the buffer provided is not long enough to 
+  * hold the output, then GNUTLS_E_SHORT_MEMORY_BUFFER will be returned.
+  *
+  * If the structure is PEM encoded, it will have a header
+  * of "BEGIN RSA PRIVATE KEY".
+  *
+  * In case of failure a negative value will be returned, and
+  * 0 on success.
+  *
+  **/
+int
+gnutls_rsa_params_export_pkcs1 (gnutls_rsa_params_t params,
+                                gnutls_x509_crt_fmt_t format,
+                                unsigned char *params_data,
+                                size_t * params_data_size)
+{
+  return gnutls_x509_privkey_export (params, format,
+                                     params_data, params_data_size);
+}
+
+
+/**
+  * gnutls_rsa_params_export_raw - This function will export the RSA parameters
+  * @params: a structure that holds the rsa parameters
+  * @m: will hold the modulus
+  * @e: will hold the public exponent
+  * @d: will hold the private exponent
+  * @p: will hold the first prime (p)
+  * @q: will hold the second prime (q)
+  * @u: will hold the coefficient
+  * @bits: if non null will hold the prime's number of bits
+  *
+  * This function will export the RSA parameters found in the given
+  * structure. The new parameters will be allocated using
+  * gnutls_malloc() and will be stored in the appropriate datum.
+  * 
+  **/
+int
+gnutls_rsa_params_export_raw (gnutls_rsa_params_t params,
+                              gnutls_datum_t * m, gnutls_datum_t * e,
+                              gnutls_datum_t * d, gnutls_datum_t * p,
+                              gnutls_datum_t * q, gnutls_datum_t * u,
+                              unsigned int *bits)
+{
+  int ret;
+
+  ret = gnutls_x509_privkey_export_rsa_raw (params, m, e, d, p, q, u);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  if (bits)
+    *bits = _gnutls_mpi_get_nbits (params->params[3]);
+
+  return 0;
+
+}
diff --git a/src/daemon/https/tls/gnutls_rsa_export.h b/src/daemon/https/tls/gnutls_rsa_export.h
new file mode 100644
index 00000000..b39e5e93
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_rsa_export.h
@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+const mpi_t *_gnutls_rsa_params_to_mpi (gnutls_rsa_params_t);
+int _gnutls_peers_cert_less_512 (gnutls_session_t session);
+int _gnutls_rsa_generate_params (mpi_t * resarr, int *resarr_len, int bits);
diff --git a/src/daemon/https/tls/gnutls_session.c b/src/daemon/https/tls/gnutls_session.c
new file mode 100644
index 00000000..541cc699
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_session.c
@@ -0,0 +1,199 @@
+/*
+ * Copyright (C) 2000, 2003, 2004, 2005, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+#include "gnutls_int.h"
+#include "gnutls_errors.h"
+#include "debug.h"
+#include <gnutls_session_pack.h>
+#include <gnutls_datum.h>
+
+/**
+  * gnutls_session_get_data - Returns all session parameters.
+  * @session: is a #gnutls_session_t structure.
+  * @session_data: is a pointer to space to hold the session.
+  * @session_data_size: is the session_data's size, or it will be set by the function.
+  *
+  * Returns all session parameters, in order to support resuming.
+  * The client should call this, and keep the returned session, if he wants to
+  * resume that current version later by calling gnutls_session_set_data()
+  * This function must be called after a successful handshake.
+  *
+  * Resuming sessions is really useful and speedups connections after a succesful one.
+  **/
+int
+gnutls_session_get_data (gnutls_session_t session,
+                         void *session_data, size_t * session_data_size)
+{
+
+  gnutls_datum_t psession;
+  int ret;
+
+  if (session->internals.resumable == RESUME_FALSE)
+    return GNUTLS_E_INVALID_SESSION;
+
+  psession.data = session_data;
+
+  ret = _gnutls_session_pack (session, &psession);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+  *session_data_size = psession.size;
+
+  if (psession.size > *session_data_size)
+    {
+      ret = GNUTLS_E_SHORT_MEMORY_BUFFER;
+      goto error;
+    }
+
+  if (session_data != NULL)
+    memcpy (session_data, psession.data, psession.size);
+
+  ret = 0;
+
+error:
+  _gnutls_free_datum (&psession);
+  return ret;
+}
+
+/**
+  * gnutls_session_get_data2 - Returns all session parameters.
+  * @session: is a #gnutls_session_t structure.
+  * @session_data: is a pointer to a datum that will hold the session.
+  *
+  * Returns all session parameters, in order to support resuming.
+  * The client should call this, and keep the returned session, if he wants to
+  * resume that current version later by calling gnutls_session_set_data()
+  * This function must be called after a successful handshake. The returned
+  * datum must be freed with gnutls_free().
+  *
+  * Resuming sessions is really useful and speedups connections after a succesful one.
+  **/
+int
+gnutls_session_get_data2 (gnutls_session_t session, gnutls_datum_t * data)
+{
+
+  int ret;
+
+  if (data == NULL)
+    {
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  if (session->internals.resumable == RESUME_FALSE)
+    return GNUTLS_E_INVALID_SESSION;
+
+  ret = _gnutls_session_pack (session, data);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return 0;
+}
+
+
+/**
+  * gnutls_session_get_id - Returns session id.
+  * @session: is a #gnutls_session_t structure.
+  * @session_id: is a pointer to space to hold the session id.
+  * @session_id_size: is the session id's size, or it will be set by the function.
+  *
+  * Returns the current session id. This can be used if you want to check if
+  * the next session you tried to resume was actually resumed.
+  * This is because resumed sessions have the same sessionID with the 
+  * original session.
+  *
+  * Session id is some data set by the server, that identify the current session. 
+  * In TLS 1.0 and SSL 3.0 session id is always less than 32 bytes.
+  *
+  * Returns zero on success.
+  **/
+int
+gnutls_session_get_id (gnutls_session_t session,
+                       void *session_id, size_t * session_id_size)
+{
+  size_t given_session_id_size = *session_id_size;
+
+  *session_id_size = session->security_parameters.session_id_size;
+
+  /* just return the session size */
+  if (session_id == NULL)
+    {
+      return 0;
+    }
+
+  if (given_session_id_size < session->security_parameters.session_id_size)
+    {
+      return GNUTLS_E_SHORT_MEMORY_BUFFER;
+    }
+
+  memcpy (session_id, &session->security_parameters.session_id,
+          *session_id_size);
+
+  return 0;
+}
+
+/**
+  * gnutls_session_set_data - Sets all session parameters
+  * @session: is a #gnutls_session_t structure.
+  * @session_data: is a pointer to space to hold the session.
+  * @session_data_size: is the session's size
+  *
+  * Sets all session parameters, in order to resume a previously established
+  * session. The session data given must be the one returned by gnutls_session_get_data().
+  * This function should be called before gnutls_handshake().
+  *
+  * Keep in mind that session resuming is advisory. The server may
+  * choose not to resume the session, thus a full handshake will be
+  * performed.
+  *
+  * Returns a negative value on error.
+  *
+  **/
+int
+gnutls_session_set_data (gnutls_session_t session,
+                         const void *session_data, size_t session_data_size)
+{
+  int ret;
+  gnutls_datum_t psession;
+
+  psession.data = (opaque *) session_data;
+  psession.size = session_data_size;
+
+  if (session_data == NULL || session_data_size == 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+  ret = _gnutls_session_unpack (session, &psession);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return 0;
+}
diff --git a/src/daemon/https/tls/gnutls_session.h b/src/daemon/https/tls/gnutls_session.h
new file mode 100644
index 00000000..dae99edc
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_session.h
@@ -0,0 +1,23 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
diff --git a/src/daemon/https/tls/gnutls_session_pack.c b/src/daemon/https/tls/gnutls_session_pack.c
new file mode 100644
index 00000000..f18fe97a
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_session_pack.c
@@ -0,0 +1,1204 @@
+/*
+ * Copyright (C) 2000, 2004, 2005, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* Contains functions that are supposed to pack and unpack session data,
+ * before and after they are sent to the database backend.
+ */
+
+#include <gnutls_int.h>
+#ifdef ENABLE_SRP
+# include <auth_srp.h>
+#endif
+#ifdef ENABLE_PSK
+# include <auth_psk.h>
+#endif
+#include <auth_anon.h>
+#include <auth_cert.h>
+#include <gnutls_errors.h>
+#include <gnutls_auth_int.h>
+#include <gnutls_session_pack.h>
+#include <gnutls_datum.h>
+#include <gnutls_num.h>
+
+#define PACK_HEADER_SIZE 1
+#define MAX_SEC_PARAMS 7+MAX_SRP_USERNAME+MAX_SERVER_NAME_EXTENSIONS*(3+MAX_SERVER_NAME_SIZE)+165
+static int pack_certificate_auth_info (gnutls_session_t,
+                                       gnutls_datum_t * packed_session);
+static int unpack_certificate_auth_info (gnutls_session_t,
+                                         const gnutls_datum_t *
+                                         packed_session);
+
+static int unpack_srp_auth_info (gnutls_session_t session,
+                                 const gnutls_datum_t * packed_session);
+static int pack_srp_auth_info (gnutls_session_t session,
+                               gnutls_datum_t * packed_session);
+
+static int unpack_psk_auth_info (gnutls_session_t session,
+                                 const gnutls_datum_t * packed_session);
+static int pack_psk_auth_info (gnutls_session_t session,
+                               gnutls_datum_t * packed_session);
+
+static int unpack_anon_auth_info (gnutls_session_t session,
+                                  const gnutls_datum_t * packed_session);
+static int pack_anon_auth_info (gnutls_session_t session,
+                                gnutls_datum_t * packed_session);
+
+static int unpack_security_parameters (gnutls_session_t session,
+                                       const gnutls_datum_t * packed_session);
+static int pack_security_parameters (gnutls_session_t session,
+                                     gnutls_datum_t * packed_session);
+
+
+/* Since auth_info structures contain malloced data, this function
+ * is required in order to pack these structures in a vector in
+ * order to store them to the DB.
+ *
+ * packed_session will contain the session data.
+ *
+ * The data will be in a platform independent format.
+ */
+int
+_gnutls_session_pack (gnutls_session_t session,
+                      gnutls_datum_t * packed_session)
+{
+  int ret;
+
+  if (packed_session == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+
+  switch (gnutls_auth_get_type (session))
+    {
+#ifdef ENABLE_SRP
+    case GNUTLS_CRD_SRP:
+      ret = pack_srp_auth_info (session, packed_session);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+      break;
+#endif
+#ifdef ENABLE_PSK
+    case GNUTLS_CRD_PSK:
+      ret = pack_psk_auth_info (session, packed_session);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+      break;
+#endif
+#ifdef ENABLE_ANON
+    case GNUTLS_CRD_ANON:
+      ret = pack_anon_auth_info (session, packed_session);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+      break;
+#endif
+    case GNUTLS_CRD_CERTIFICATE:
+      ret = pack_certificate_auth_info (session, packed_session);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+      break;
+    default:
+      return GNUTLS_E_INTERNAL_ERROR;
+
+    }
+
+  /* Auth_info structures copied. Now copy security_parameters_st. 
+   * packed_session must have allocated space for the security parameters.
+   */
+  ret = pack_security_parameters (session, packed_session);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      _gnutls_free_datum (packed_session);
+      return ret;
+    }
+
+  return 0;
+}
+
+
+/* Load session data from a buffer.
+ */
+int
+_gnutls_session_unpack (gnutls_session_t session,
+                        const gnutls_datum_t * packed_session)
+{
+  int ret;
+
+  if (packed_session == NULL || packed_session->size == 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  if (_gnutls_get_auth_info (session) != NULL)
+    {
+      _gnutls_free_auth_info (session);
+    }
+
+  switch (packed_session->data[0])
+    {
+#ifdef ENABLE_SRP
+    case GNUTLS_CRD_SRP:
+      ret = unpack_srp_auth_info (session, packed_session);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+      break;
+#endif
+#ifdef ENABLE_PSK
+    case GNUTLS_CRD_PSK:
+      ret = unpack_psk_auth_info (session, packed_session);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+      break;
+#endif
+#ifdef ENABLE_ANON
+    case GNUTLS_CRD_ANON:
+      ret = unpack_anon_auth_info (session, packed_session);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+      break;
+#endif
+    case GNUTLS_CRD_CERTIFICATE:
+      ret = unpack_certificate_auth_info (session, packed_session);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+      break;
+    default:
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+
+    }
+
+  /* Auth_info structures copied. Now copy security_parameters_st. 
+   * packed_session must have allocated space for the security parameters.
+   */
+  ret = unpack_security_parameters (session, packed_session);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return 0;
+}
+
+
+/* Format: 
+ *      1 byte the credentials type
+ *      4 bytes the size of the whole structure
+ *        DH stuff
+ *      2 bytes the size of secret key in bits
+ *      4 bytes the size of the prime
+ *      x bytes the prime
+ *      4 bytes the size of the generator
+ *      x bytes the generator
+ *      4 bytes the size of the public key
+ *      x bytes the public key
+ *        RSA stuff
+ *      4 bytes the size of the modulus
+ *      x bytes the modulus
+ *      4 bytes the size of the exponent
+ *      x bytes the exponent
+ *        CERTIFICATES
+ *      4 bytes the length of the certificate list
+ *      4 bytes the size of first certificate
+ *      x bytes the certificate
+ *       and so on...
+ */
+static int
+pack_certificate_auth_info (gnutls_session_t session,
+                            gnutls_datum_t * packed_session)
+{
+  unsigned int pos = 0, i;
+  int cert_size, pack_size;
+  cert_auth_info_t info = _gnutls_get_auth_info (session);
+
+  if (info)
+    {
+      cert_size = 4;
+
+      for (i = 0; i < info->ncerts; i++)
+        cert_size += 4 + info->raw_certificate_list[i].size;
+
+      pack_size = 2 + 4 + info->dh.prime.size +
+        4 + info->dh.generator.size + 4 + info->dh.public_key.size +
+        4 + info->rsa_export.modulus.size +
+        4 + info->rsa_export.exponent.size + cert_size;
+    }
+  else
+    pack_size = 0;
+
+  packed_session->size = PACK_HEADER_SIZE + pack_size + sizeof (uint32_t);
+
+  /* calculate the size and allocate the data.
+   */
+  packed_session->data =
+    gnutls_malloc (packed_session->size + MAX_SEC_PARAMS);
+
+  if (packed_session->data == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  packed_session->data[0] = GNUTLS_CRD_CERTIFICATE;
+  _gnutls_write_uint32 (pack_size, &packed_session->data[PACK_HEADER_SIZE]);
+  pos += 4 + PACK_HEADER_SIZE;
+
+
+  if (pack_size > 0)
+    {
+
+      _gnutls_write_uint16 (info->dh.secret_bits, &packed_session->data[pos]);
+      pos += 2;
+
+      _gnutls_write_datum32 (&packed_session->data[pos], info->dh.prime);
+      pos += 4 + info->dh.prime.size;
+      _gnutls_write_datum32 (&packed_session->data[pos], info->dh.generator);
+      pos += 4 + info->dh.generator.size;
+      _gnutls_write_datum32 (&packed_session->data[pos], info->dh.public_key);
+      pos += 4 + info->dh.public_key.size;
+
+      _gnutls_write_datum32 (&packed_session->data[pos],
+                             info->rsa_export.modulus);
+      pos += 4 + info->rsa_export.modulus.size;
+      _gnutls_write_datum32 (&packed_session->data[pos],
+                             info->rsa_export.exponent);
+      pos += 4 + info->rsa_export.exponent.size;
+
+      _gnutls_write_uint32 (info->ncerts, &packed_session->data[pos]);
+      pos += 4;
+
+      for (i = 0; i < info->ncerts; i++)
+        {
+          _gnutls_write_datum32 (&packed_session->data[pos],
+                                 info->raw_certificate_list[i]);
+          pos += sizeof (uint32_t) + info->raw_certificate_list[i].size;
+        }
+    }
+
+  return 0;
+}
+
+
+/* Upack certificate info.
+ */
+static int
+unpack_certificate_auth_info (gnutls_session_t session,
+                              const gnutls_datum_t * packed_session)
+{
+  int pos = 0, size, ret;
+  unsigned int i = 0, j;
+  size_t pack_size;
+  cert_auth_info_t info;
+
+  if (packed_session->data[0] != GNUTLS_CRD_CERTIFICATE)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  pack_size = _gnutls_read_uint32 (&packed_session->data[PACK_HEADER_SIZE]);
+  pos += PACK_HEADER_SIZE + 4;
+
+  if (pack_size == 0)
+    return 0;                   /* nothing to be done */
+
+  /* a simple check for integrity */
+  if (pack_size + PACK_HEADER_SIZE + 4 > packed_session->size)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* client and server have the same auth_info here
+   */
+  ret =
+    _gnutls_auth_info_set (session, GNUTLS_CRD_CERTIFICATE,
+                           sizeof (cert_auth_info_st), 1);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  info = _gnutls_get_auth_info (session);
+  if (info == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  info->dh.secret_bits = _gnutls_read_uint16 (&packed_session->data[pos]);
+  pos += 2;
+
+  size = _gnutls_read_uint32 (&packed_session->data[pos]);
+  pos += 4;
+  ret = _gnutls_set_datum (&info->dh.prime, &packed_session->data[pos], size);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+  pos += size;
+
+  size = _gnutls_read_uint32 (&packed_session->data[pos]);
+  pos += 4;
+  ret =
+    _gnutls_set_datum (&info->dh.generator, &packed_session->data[pos], size);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+  pos += size;
+
+  size = _gnutls_read_uint32 (&packed_session->data[pos]);
+  pos += 4;
+  ret =
+    _gnutls_set_datum (&info->dh.public_key, &packed_session->data[pos],
+                       size);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+  pos += size;
+
+  size = _gnutls_read_uint32 (&packed_session->data[pos]);
+  pos += 4;
+  ret =
+    _gnutls_set_datum (&info->rsa_export.modulus,
+                       &packed_session->data[pos], size);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+  pos += size;
+
+  size = _gnutls_read_uint32 (&packed_session->data[pos]);
+  pos += 4;
+  ret =
+    _gnutls_set_datum (&info->rsa_export.exponent,
+                       &packed_session->data[pos], size);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+  pos += size;
+
+  info->ncerts = _gnutls_read_uint32 (&packed_session->data[pos]);
+  pos += 4;
+
+  if (info->ncerts > 0)
+    {
+      info->raw_certificate_list =
+        gnutls_calloc (1, sizeof (gnutls_datum_t) * info->ncerts);
+      if (info->raw_certificate_list == NULL)
+        {
+          gnutls_assert ();
+          ret = GNUTLS_E_MEMORY_ERROR;
+          goto error;
+        }
+    }
+
+  for (i = 0; i < info->ncerts; i++)
+    {
+      size = _gnutls_read_uint32 (&packed_session->data[pos]);
+      pos += sizeof (uint32_t);
+
+      ret =
+        _gnutls_set_datum (&info->raw_certificate_list[i],
+                           &packed_session->data[pos], size);
+      pos += size;
+
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          goto error;
+        }
+    }
+
+
+  return 0;
+
+error:
+  _gnutls_free_datum (&info->dh.prime);
+  _gnutls_free_datum (&info->dh.generator);
+  _gnutls_free_datum (&info->dh.public_key);
+
+  _gnutls_free_datum (&info->rsa_export.modulus);
+  _gnutls_free_datum (&info->rsa_export.exponent);
+
+  for (j = 0; j < i; j++)
+    _gnutls_free_datum (&info->raw_certificate_list[j]);
+
+  gnutls_free (info->raw_certificate_list);
+
+  return ret;
+
+}
+
+#ifdef ENABLE_SRP
+/* Packs the SRP session authentication data.
+ */
+
+/* Format: 
+ *      1 byte the credentials type
+ *      4 bytes the size of the SRP username (x)
+ *      x bytes the SRP username
+ */
+static int
+pack_srp_auth_info (gnutls_session_t session, gnutls_datum_t * packed_session)
+{
+  srp_server_auth_info_t info = _gnutls_get_auth_info (session);
+  int pack_size;
+
+  if (info && info->username)
+    pack_size = strlen (info->username) + 1;    /* include the terminating null */
+  else
+    pack_size = 0;
+
+  packed_session->size = PACK_HEADER_SIZE + pack_size + sizeof (uint32_t);
+
+  /* calculate the size and allocate the data.
+   */
+  packed_session->data =
+    gnutls_malloc (packed_session->size + MAX_SEC_PARAMS);
+
+  if (packed_session->data == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  packed_session->data[0] = GNUTLS_CRD_SRP;
+  _gnutls_write_uint32 (pack_size, &packed_session->data[PACK_HEADER_SIZE]);
+
+  if (pack_size > 0)
+    memcpy (&packed_session->data[PACK_HEADER_SIZE + sizeof (uint32_t)],
+            info->username, pack_size + 1);
+
+  return 0;
+}
+
+
+static int
+unpack_srp_auth_info (gnutls_session_t session,
+                      const gnutls_datum_t * packed_session)
+{
+  size_t username_size;
+  int ret;
+  srp_server_auth_info_t info;
+
+  if (packed_session->data[0] != GNUTLS_CRD_SRP)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  username_size =
+    _gnutls_read_uint32 (&packed_session->data[PACK_HEADER_SIZE]);
+
+  if (username_size == 0)
+    return 0;                   /* nothing to be done */
+
+  /* a simple check for integrity */
+  if (username_size + 4 + PACK_HEADER_SIZE > packed_session->size)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  ret =
+    _gnutls_auth_info_set (session, GNUTLS_CRD_SRP,
+                           sizeof (srp_server_auth_info_st), 1);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  info = _gnutls_get_auth_info (session);
+  if (info == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  memcpy (info->username,
+          &packed_session->data[PACK_HEADER_SIZE + sizeof (uint32_t)],
+          username_size);
+
+  return 0;
+}
+#endif
+
+
+#ifdef ENABLE_ANON
+/* Packs the ANON session authentication data.
+ */
+
+/* Format: 
+ *      1 byte the credentials type
+ *      4 bytes the size of the whole structure
+ *      2 bytes the size of secret key in bits
+ *      4 bytes the size of the prime
+ *      x bytes the prime
+ *      4 bytes the size of the generator
+ *      x bytes the generator
+ *      4 bytes the size of the public key
+ *      x bytes the public key
+ */
+static int
+pack_anon_auth_info (gnutls_session_t session,
+                     gnutls_datum_t * packed_session)
+{
+  anon_auth_info_t info = _gnutls_get_auth_info (session);
+  int pos = 0;
+  size_t pack_size;
+
+  if (info)
+    pack_size = 2 + 4 * 3 + info->dh.prime.size +
+      info->dh.generator.size + info->dh.public_key.size;
+  else
+    pack_size = 0;
+
+  packed_session->size = PACK_HEADER_SIZE + pack_size + sizeof (uint32_t);
+
+  /* calculate the size and allocate the data.
+   */
+  packed_session->data =
+    gnutls_malloc (packed_session->size + MAX_SEC_PARAMS);
+
+  if (packed_session->data == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  packed_session->data[0] = GNUTLS_CRD_ANON;
+  _gnutls_write_uint32 (pack_size, &packed_session->data[PACK_HEADER_SIZE]);
+  pos += 4 + PACK_HEADER_SIZE;
+
+  if (pack_size > 0)
+    {
+      _gnutls_write_uint16 (info->dh.secret_bits, &packed_session->data[pos]);
+      pos += 2;
+
+      _gnutls_write_datum32 (&packed_session->data[pos], info->dh.prime);
+      pos += 4 + info->dh.prime.size;
+      _gnutls_write_datum32 (&packed_session->data[pos], info->dh.generator);
+      pos += 4 + info->dh.generator.size;
+      _gnutls_write_datum32 (&packed_session->data[pos], info->dh.public_key);
+      pos += 4 + info->dh.public_key.size;
+
+    }
+
+  return 0;
+}
+
+
+static int
+unpack_anon_auth_info (gnutls_session_t session,
+                       const gnutls_datum_t * packed_session)
+{
+  size_t pack_size;
+  int pos = 0, size, ret;
+  anon_auth_info_t info;
+
+  if (packed_session->data[0] != GNUTLS_CRD_ANON)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  pack_size = _gnutls_read_uint32 (&packed_session->data[PACK_HEADER_SIZE]);
+  pos += PACK_HEADER_SIZE + 4;
+
+
+  if (pack_size == 0)
+    return 0;                   /* nothing to be done */
+
+  /* a simple check for integrity */
+  if (pack_size + PACK_HEADER_SIZE + 4 > packed_session->size)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* client and serer have the same auth_info here
+   */
+  ret =
+    _gnutls_auth_info_set (session, GNUTLS_CRD_ANON,
+                           sizeof (anon_auth_info_st), 1);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  info = _gnutls_get_auth_info (session);
+  if (info == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  info->dh.secret_bits = _gnutls_read_uint16 (&packed_session->data[pos]);
+  pos += 2;
+
+  size = _gnutls_read_uint32 (&packed_session->data[pos]);
+  pos += 4;
+  ret = _gnutls_set_datum (&info->dh.prime, &packed_session->data[pos], size);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+  pos += size;
+
+  size = _gnutls_read_uint32 (&packed_session->data[pos]);
+  pos += 4;
+  ret =
+    _gnutls_set_datum (&info->dh.generator, &packed_session->data[pos], size);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+  pos += size;
+
+  size = _gnutls_read_uint32 (&packed_session->data[pos]);
+  pos += 4;
+  ret =
+    _gnutls_set_datum (&info->dh.public_key, &packed_session->data[pos],
+                       size);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+  pos += size;
+
+  return 0;
+
+error:
+  _gnutls_free_datum (&info->dh.prime);
+  _gnutls_free_datum (&info->dh.generator);
+  _gnutls_free_datum (&info->dh.public_key);
+  return ret;
+}
+#endif /* ANON */
+
+#ifdef ENABLE_PSK
+/* Packs the PSK session authentication data.
+ */
+
+/* Format: 
+ *      1 byte the credentials type
+ *      4 bytes the size of the whole structure
+ *      4 bytes the size of the PSK username (x)
+ *      x bytes the PSK username
+ *      2 bytes the size of secret key in bits
+ *      4 bytes the size of the prime
+ *      x bytes the prime
+ *      4 bytes the size of the generator
+ *      x bytes the generator
+ *      4 bytes the size of the public key
+ *      x bytes the public key
+ */
+static int
+pack_psk_auth_info (gnutls_session_t session, gnutls_datum_t * packed_session)
+{
+  psk_auth_info_t info;
+  int pack_size, username_size = 0, pos;
+
+  info = _gnutls_get_auth_info (session);
+
+  if (info)
+    {
+      username_size = strlen (info->username) + 1;      /* include the terminating null */
+      pack_size = username_size +
+        2 + 4 * 3 + info->dh.prime.size + info->dh.generator.size +
+        info->dh.public_key.size;
+    }
+  else
+    pack_size = 0;
+
+  packed_session->size = PACK_HEADER_SIZE + pack_size + sizeof (uint32_t);
+
+  /* calculate the size and allocate the data.
+   */
+  packed_session->data =
+    gnutls_malloc (packed_session->size + MAX_SEC_PARAMS);
+
+  if (packed_session->data == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  pos = 0;
+
+  packed_session->data[pos] = GNUTLS_CRD_PSK;
+  pos++;
+
+  _gnutls_write_uint32 (pack_size, &packed_session->data[pos]);
+  pos += 4;
+
+
+  if (pack_size > 0)
+    {
+      _gnutls_write_uint32 (username_size, &packed_session->data[pos]);
+      pos += 4;
+
+      memcpy (&packed_session->data[pos], info->username, username_size);
+      pos += username_size;
+
+      _gnutls_write_uint16 (info->dh.secret_bits, &packed_session->data[pos]);
+      pos += 2;
+
+      _gnutls_write_datum32 (&packed_session->data[pos], info->dh.prime);
+      pos += 4 + info->dh.prime.size;
+      _gnutls_write_datum32 (&packed_session->data[pos], info->dh.generator);
+      pos += 4 + info->dh.generator.size;
+      _gnutls_write_datum32 (&packed_session->data[pos], info->dh.public_key);
+      pos += 4 + info->dh.public_key.size;
+
+    }
+
+
+  return 0;
+}
+
+static int
+unpack_psk_auth_info (gnutls_session_t session,
+                      const gnutls_datum_t * packed_session)
+{
+  size_t username_size;
+  size_t pack_size;
+  int pos = 0, size, ret;
+  psk_auth_info_t info;
+
+  if (packed_session->data[0] != GNUTLS_CRD_PSK)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  pack_size = _gnutls_read_uint32 (&packed_session->data[PACK_HEADER_SIZE]);
+  pos += PACK_HEADER_SIZE + 4;
+
+
+  if (pack_size == 0)
+    return 0;                   /* nothing to be done */
+
+  /* a simple check for integrity */
+  if (pack_size + PACK_HEADER_SIZE + 4 > packed_session->size)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* client and serer have the same auth_info here
+   */
+  ret =
+    _gnutls_auth_info_set (session, GNUTLS_CRD_PSK,
+                           sizeof (psk_auth_info_st), 1);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  info = _gnutls_get_auth_info (session);
+  if (info == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  username_size = _gnutls_read_uint32 (&packed_session->data[pos]);
+  pos += 4;
+
+  memcpy (info->username, &packed_session->data[pos], username_size);
+  pos += username_size;
+
+  info->dh.secret_bits = _gnutls_read_uint16 (&packed_session->data[pos]);
+  pos += 2;
+
+  size = _gnutls_read_uint32 (&packed_session->data[pos]);
+  pos += 4;
+  ret = _gnutls_set_datum (&info->dh.prime, &packed_session->data[pos], size);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+  pos += size;
+
+  size = _gnutls_read_uint32 (&packed_session->data[pos]);
+  pos += 4;
+  ret =
+    _gnutls_set_datum (&info->dh.generator, &packed_session->data[pos], size);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+  pos += size;
+
+  size = _gnutls_read_uint32 (&packed_session->data[pos]);
+  pos += 4;
+  ret =
+    _gnutls_set_datum (&info->dh.public_key, &packed_session->data[pos],
+                       size);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+  pos += size;
+
+  return 0;
+
+error:
+  _gnutls_free_datum (&info->dh.prime);
+  _gnutls_free_datum (&info->dh.generator);
+  _gnutls_free_datum (&info->dh.public_key);
+  return ret;
+}
+#endif
+
+
+/* Packs the security parameters.
+ */
+
+/* Format: 
+ *      4 bytes the total security data size
+ *      1 byte the entity type (client/server)
+ *      1 byte the key exchange algorithm used
+ *      1 byte the read cipher algorithm
+ *      1 byte the read mac algorithm
+ *      1 byte the read compression algorithm
+ *
+ *      1 byte the write cipher algorithm
+ *      1 byte the write mac algorithm
+ *      1 byte the write compression algorithm
+ *
+ *      1 byte the certificate type
+ *      1 byte the protocol version
+ *
+ *      2 bytes the cipher suite
+ *
+ *      48 bytes the master secret
+ *
+ *      32 bytes the client random
+ *      32 bytes the server random
+ *
+ *      1 byte the session ID size
+ *      x bytes the session ID (32 bytes max)
+ *
+ *      4 bytes a timestamp
+ *            -------------------
+ *                MAX: 165 bytes
+ *
+ *      EXTENSIONS:
+ *      2 bytes the record send size
+ *      2 bytes the record recv size
+ *
+ *      1 byte the SRP username size
+ *      x bytes the SRP username (MAX_SRP_USERNAME)
+ *
+ *      2 bytes the number of server name extensions (up to MAX_SERVER_NAME_EXTENSIONS)
+ *      1 byte the first name type
+ *      2 bytes the size of the first name 
+ *      x bytes the first name (MAX_SERVER_NAME_SIZE)
+ *       and so on...
+ *
+ *           --------------------
+ *                MAX: 7+MAX_SRP_USERNAME+MAX_SERVER_NAME_EXTENSIONS*(3+MAX_SERVER_NAME_SIZE)
+ */
+static int
+pack_security_parameters (gnutls_session_t session,
+                          gnutls_datum_t * packed_session)
+{
+  int pos = 0;
+  size_t len, init, i;
+
+  /* move after the auth info stuff.
+   */
+  init =
+    _gnutls_read_uint32 (&packed_session->data[PACK_HEADER_SIZE]) + 4 +
+    PACK_HEADER_SIZE;
+
+  pos = init + 4;               /* make some space to write later the size */
+
+  packed_session->data[pos++] = session->security_parameters.entity;
+  packed_session->data[pos++] = session->security_parameters.kx_algorithm;
+  packed_session->data[pos++] =
+    session->security_parameters.read_bulk_cipher_algorithm;
+  packed_session->data[pos++] =
+    session->security_parameters.read_mac_algorithm;
+  packed_session->data[pos++] =
+    session->security_parameters.read_compression_algorithm;
+  packed_session->data[pos++] =
+    session->security_parameters.write_bulk_cipher_algorithm;
+  packed_session->data[pos++] =
+    session->security_parameters.write_mac_algorithm;
+  packed_session->data[pos++] =
+    session->security_parameters.write_compression_algorithm;
+  packed_session->data[pos++] =
+    session->security_parameters.current_cipher_suite.suite[0];
+  packed_session->data[pos++] =
+    session->security_parameters.current_cipher_suite.suite[1];
+
+  packed_session->data[pos++] = session->security_parameters.cert_type;
+  packed_session->data[pos++] = session->security_parameters.version;
+
+  memcpy (&packed_session->data[pos],
+          session->security_parameters.master_secret, TLS_MASTER_SIZE);
+  pos += TLS_MASTER_SIZE;
+
+  memcpy (&packed_session->data[pos],
+          session->security_parameters.client_random, TLS_RANDOM_SIZE);
+  pos += TLS_RANDOM_SIZE;
+  memcpy (&packed_session->data[pos],
+          session->security_parameters.server_random, TLS_RANDOM_SIZE);
+  pos += TLS_RANDOM_SIZE;
+
+  packed_session->data[pos++] = session->security_parameters.session_id_size;
+  memcpy (&packed_session->data[pos], session->security_parameters.session_id,
+          session->security_parameters.session_id_size);
+  pos += session->security_parameters.session_id_size;
+
+  _gnutls_write_uint32 (session->security_parameters.timestamp,
+                        &packed_session->data[pos]);
+  pos += 4;
+
+  /* Extensions */
+  _gnutls_write_uint16 (session->security_parameters.max_record_send_size,
+                        &packed_session->data[pos]);
+  pos += 2;
+
+  _gnutls_write_uint16 (session->security_parameters.max_record_recv_size,
+                        &packed_session->data[pos]);
+  pos += 2;
+
+  /* SRP */
+  len =
+    strlen ((char *) session->security_parameters.extensions.srp_username);
+  packed_session->data[pos++] = len;
+  memcpy (&packed_session->data[pos],
+          session->security_parameters.extensions.srp_username, len);
+  pos += len;
+
+  _gnutls_write_uint16 (session->security_parameters.extensions.
+                        server_names_size, &packed_session->data[pos]);
+  pos += 2;
+
+  for (i = 0; i < session->security_parameters.extensions.server_names_size;
+       i++)
+    {
+      packed_session->data[pos++] =
+        session->security_parameters.extensions.server_names[i].type;
+      _gnutls_write_uint16 (session->security_parameters.extensions.
+                            server_names[i].name_length,
+                            &packed_session->data[pos]);
+      pos += 2;
+
+      memcpy (&packed_session->data[pos],
+              session->security_parameters.extensions.server_names[i].name,
+              session->security_parameters.extensions.server_names[i].
+              name_length);
+      pos +=
+        session->security_parameters.extensions.server_names[i].name_length;
+    }
+
+  /* write the total size */
+  _gnutls_write_uint32 (pos - init - 4, &packed_session->data[init]);
+  packed_session->size += pos - init;
+
+  return 0;
+}
+
+
+static int
+unpack_security_parameters (gnutls_session_t session,
+                            const gnutls_datum_t * packed_session)
+{
+  size_t pack_size, init, i;
+  int pos = 0, len;
+  time_t timestamp = time (0);
+
+
+  /* skip the auth info stuff */
+  init =
+    _gnutls_read_uint32 (&packed_session->data[PACK_HEADER_SIZE]) + 4 +
+    PACK_HEADER_SIZE;
+
+  pos = init;
+
+  pack_size = _gnutls_read_uint32 (&packed_session->data[pos]);
+  pos += 4;
+
+
+  if (pack_size == 0)
+    return GNUTLS_E_INVALID_REQUEST;
+
+  /* a simple check for integrity */
+  if (pack_size > MAX_SEC_PARAMS)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  session->internals.resumed_security_parameters.entity =
+    packed_session->data[pos++];
+  session->internals.resumed_security_parameters.kx_algorithm =
+    packed_session->data[pos++];
+  session->internals.resumed_security_parameters.read_bulk_cipher_algorithm =
+    packed_session->data[pos++];
+  session->internals.resumed_security_parameters.read_mac_algorithm =
+    packed_session->data[pos++];
+  session->internals.resumed_security_parameters.read_compression_algorithm =
+    packed_session->data[pos++];
+  session->internals.resumed_security_parameters.write_bulk_cipher_algorithm =
+    packed_session->data[pos++];
+  session->internals.resumed_security_parameters.write_mac_algorithm =
+    packed_session->data[pos++];
+  session->internals.resumed_security_parameters.write_compression_algorithm =
+    packed_session->data[pos++];
+  session->internals.resumed_security_parameters.current_cipher_suite.
+    suite[0] = packed_session->data[pos++];
+  session->internals.resumed_security_parameters.current_cipher_suite.
+    suite[1] = packed_session->data[pos++];
+
+  session->internals.resumed_security_parameters.cert_type =
+    packed_session->data[pos++];
+  session->internals.resumed_security_parameters.version =
+    packed_session->data[pos++];
+
+  memcpy (session->internals.resumed_security_parameters.master_secret,
+          &packed_session->data[pos], TLS_MASTER_SIZE);
+  pos += TLS_MASTER_SIZE;
+
+  memcpy (session->internals.resumed_security_parameters.client_random,
+          &packed_session->data[pos], TLS_RANDOM_SIZE);
+  pos += TLS_RANDOM_SIZE;
+  memcpy (session->internals.resumed_security_parameters.server_random,
+          &packed_session->data[pos], TLS_RANDOM_SIZE);
+  pos += TLS_RANDOM_SIZE;
+
+  session->internals.resumed_security_parameters.session_id_size =
+    packed_session->data[pos++];
+  memcpy (session->internals.resumed_security_parameters.session_id,
+          &packed_session->data[pos],
+          session->internals.resumed_security_parameters.session_id_size);
+  pos += session->internals.resumed_security_parameters.session_id_size;
+
+  session->internals.resumed_security_parameters.timestamp =
+    _gnutls_read_uint32 (&packed_session->data[pos]);
+  pos += 4;
+
+  if (timestamp - session->internals.resumed_security_parameters.timestamp >
+      session->internals.expire_time
+      || session->internals.resumed_security_parameters.timestamp > timestamp)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_EXPIRED;
+    }
+
+  /* Extensions */
+  session->internals.resumed_security_parameters.max_record_send_size =
+    _gnutls_read_uint16 (&packed_session->data[pos]);
+  pos += 2;
+
+  session->internals.resumed_security_parameters.max_record_recv_size =
+    _gnutls_read_uint16 (&packed_session->data[pos]);
+  pos += 2;
+
+
+  /* SRP */
+  len = packed_session->data[pos++];    /* srp username length */
+  memcpy (session->internals.resumed_security_parameters.extensions.
+          srp_username, &packed_session->data[pos], len);
+  session->internals.resumed_security_parameters.extensions.
+    srp_username[len] = 0;
+  pos += len;
+
+  session->internals.resumed_security_parameters.extensions.
+    server_names_size = _gnutls_read_uint16 (&packed_session->data[pos]);
+  pos += 2;
+  for (i = 0;
+       i <
+       session->internals.resumed_security_parameters.extensions.
+       server_names_size; i++)
+    {
+      session->internals.resumed_security_parameters.extensions.
+        server_names[i].type = packed_session->data[pos++];
+      session->internals.resumed_security_parameters.extensions.
+        server_names[i].name_length =
+        _gnutls_read_uint16 (&packed_session->data[pos]);
+      pos += 2;
+
+      memcpy (session->internals.resumed_security_parameters.extensions.
+              server_names[i].name, &packed_session->data[pos],
+              session->internals.resumed_security_parameters.extensions.
+              server_names[i].name_length);
+      pos +=
+        session->internals.resumed_security_parameters.extensions.
+        server_names[i].name_length;
+    }
+  return 0;
+}
diff --git a/src/daemon/https/tls/gnutls_session_pack.h b/src/daemon/https/tls/gnutls_session_pack.h
new file mode 100644
index 00000000..93dd32de
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_session_pack.h
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+int _gnutls_session_pack (gnutls_session_t session,
+                          gnutls_datum_t * packed_session);
+int _gnutls_session_unpack (gnutls_session_t session,
+                            const gnutls_datum_t * packed_session);
diff --git a/src/daemon/https/tls/gnutls_sig.c b/src/daemon/https/tls/gnutls_sig.c
new file mode 100644
index 00000000..0456438f
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_sig.c
@@ -0,0 +1,473 @@
+/*
+ * Copyright (C) 2001, 2004, 2005, 2006, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include <gnutls_int.h>
+#include <gnutls_errors.h>
+#include <x509_b64.h>
+#include <auth_cert.h>
+#include <gnutls_cert.h>
+#include <libtasn1.h>
+#include <gnutls_datum.h>
+#include <gnutls_mpi.h>
+#include <gnutls_global.h>
+#include <gnutls_pk.h>
+#include <debug.h>
+#include <gnutls_buffers.h>
+#include <gnutls_sig.h>
+#include <gnutls_kx.h>
+
+static int _gnutls_tls_sign (gnutls_session_t session,
+                             gnutls_cert * cert,
+                             gnutls_privkey * pkey,
+                             const gnutls_datum_t * hash_concat,
+                             gnutls_datum_t * signature);
+
+/* Generates a signature of all the previous sent packets in the 
+ * handshake procedure. (20040227: now it works for SSL 3.0 as well)
+ */
+int
+_gnutls_tls_sign_hdata (gnutls_session_t session,
+                        gnutls_cert * cert,
+                        gnutls_privkey * pkey, gnutls_datum_t * signature)
+{
+  gnutls_datum_t dconcat;
+  int ret;
+  opaque concat[36];
+  mac_hd_t td_md5;
+  mac_hd_t td_sha;
+  gnutls_protocol_t ver = gnutls_protocol_get_version (session);
+
+  td_sha = _gnutls_hash_copy (session->internals.handshake_mac_handle_sha);
+  if (td_sha == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_HASH_FAILED;
+    }
+
+  if (ver == GNUTLS_SSL3)
+    {
+      ret = _gnutls_generate_master (session, 1);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      _gnutls_mac_deinit_ssl3_handshake (td_sha, &concat[16],
+                                         session->security_parameters.
+                                         master_secret, TLS_MASTER_SIZE);
+    }
+  else
+    _gnutls_hash_deinit (td_sha, &concat[16]);
+
+  switch (cert->subject_pk_algorithm)
+    {
+    case GNUTLS_PK_RSA:
+      td_md5 =
+        _gnutls_hash_copy (session->internals.handshake_mac_handle_md5);
+      if (td_md5 == NULL)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_HASH_FAILED;
+        }
+
+      if (ver == GNUTLS_SSL3)
+        _gnutls_mac_deinit_ssl3_handshake (td_md5, concat,
+                                           session->security_parameters.
+                                           master_secret, TLS_MASTER_SIZE);
+      else
+        _gnutls_hash_deinit (td_md5, concat);
+
+      dconcat.data = concat;
+      dconcat.size = 36;
+      break;
+    default:
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+  ret = _gnutls_tls_sign (session, cert, pkey, &dconcat, signature);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+    }
+
+  return ret;
+}
+
+/* Generates a signature of all the random data and the parameters.
+ * Used in DHE_* ciphersuites.
+ */
+int
+_gnutls_tls_sign_params (gnutls_session_t session,
+                         gnutls_cert * cert,
+                         gnutls_privkey * pkey,
+                         gnutls_datum_t * params, gnutls_datum_t * signature)
+{
+  gnutls_datum_t dconcat;
+  int ret;
+  mac_hd_t td_sha;
+  opaque concat[36];
+  gnutls_protocol_t ver = gnutls_protocol_get_version (session);
+
+  td_sha = _gnutls_hash_init (GNUTLS_MAC_SHA1);
+  if (td_sha == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_HASH_FAILED;
+    }
+
+  _gnutls_hash (td_sha, session->security_parameters.client_random,
+                TLS_RANDOM_SIZE);
+  _gnutls_hash (td_sha, session->security_parameters.server_random,
+                TLS_RANDOM_SIZE);
+  _gnutls_hash (td_sha, params->data, params->size);
+
+  switch (cert->subject_pk_algorithm)
+    {
+    case GNUTLS_PK_RSA:
+      if (ver < GNUTLS_TLS1_2)
+        {
+          mac_hd_t td_md5 = _gnutls_hash_init (GNUTLS_MAC_MD5);
+          if (td_md5 == NULL)
+            {
+              gnutls_assert ();
+              return GNUTLS_E_HASH_FAILED;
+            }
+
+          _gnutls_hash (td_md5, session->security_parameters.client_random,
+                        TLS_RANDOM_SIZE);
+          _gnutls_hash (td_md5, session->security_parameters.server_random,
+                        TLS_RANDOM_SIZE);
+          _gnutls_hash (td_md5, params->data, params->size);
+
+          _gnutls_hash_deinit (td_md5, concat);
+          _gnutls_hash_deinit (td_sha, &concat[16]);
+
+          dconcat.size = 36;
+        }
+      else
+        {
+#if 1
+          /* Use NULL parameters. */
+          memcpy (concat,
+                  "\x30\x21\x30\x09\x06\x05\x2b\x0e\x03\x02\x1a\x05\x00\x04\x14",
+                  15);
+          _gnutls_hash_deinit (td_sha, &concat[15]);
+          dconcat.size = 35;
+#else
+          /* No parameters field. */
+          memcpy (concat,
+                  "\x30\x1f\x30\x07\x06\x05\x2b\x0e\x03\x02\x1a\x04\x14", 13);
+          _gnutls_hash_deinit (td_sha, &concat[13]);
+          dconcat.size = 33;
+#endif
+        }
+      dconcat.data = concat;
+      break;
+    default:
+      gnutls_assert ();
+      _gnutls_hash_deinit (td_sha, NULL);
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+  ret = _gnutls_tls_sign (session, cert, pkey, &dconcat, signature);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+    }
+
+  return ret;
+
+}
+
+/* This will create a PKCS1 or DSA signature, using the given parameters, and the
+ * given data. The output will be allocated and be put in signature.
+ */
+int
+_gnutls_sign (gnutls_pk_algorithm_t algo,
+              mpi_t * params,
+              int params_size,
+              const gnutls_datum_t * data, gnutls_datum_t * signature)
+{
+  int ret;
+
+  switch (algo)
+    {
+    case GNUTLS_PK_RSA:
+      /* encrypt */
+      if ((ret =
+           _gnutls_pkcs1_rsa_encrypt (signature, data, params, params_size,
+                                      1)) < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      break;
+    default:
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+      break;
+    }
+
+  return 0;
+}
+
+/* This will create a PKCS1 or DSA signature, as defined in the TLS protocol.
+ * Cert is the certificate of the corresponding private key. It is only checked if
+ * it supports signing.
+ */
+static int
+_gnutls_tls_sign (gnutls_session_t session,
+                  gnutls_cert * cert,
+                  gnutls_privkey * pkey,
+                  const gnutls_datum_t * hash_concat,
+                  gnutls_datum_t * signature)
+{
+
+  /* If our certificate supports signing
+   */
+
+  if (cert != NULL)
+    if (cert->key_usage != 0)
+      if (!(cert->key_usage & KEY_DIGITAL_SIGNATURE))
+        {
+          gnutls_assert ();
+          return GNUTLS_E_KEY_USAGE_VIOLATION;
+        }
+
+  /* External signing. */
+  if (!pkey || pkey->params_size == 0)
+    {
+      if (!session->internals.sign_func)
+        return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
+
+      return (*session->internals.sign_func) (session,
+                                              session->internals.
+                                              sign_func_userdata,
+                                              cert->cert_type, &cert->raw,
+                                              hash_concat, signature);
+    }
+
+  return _gnutls_sign (pkey->pk_algorithm, pkey->params, pkey->params_size,
+                       hash_concat, signature);
+}
+
+static int
+_gnutls_verify_sig (gnutls_cert * cert,
+                    const gnutls_datum_t * hash_concat,
+                    gnutls_datum_t * signature, size_t sha1pos)
+{
+  int ret;
+  gnutls_datum_t vdata;
+
+  if (cert->version == 0 || cert == NULL)
+    {                           /* this is the only way to check
+                                 * if it is initialized
+                                 */
+      gnutls_assert ();
+      return GNUTLS_E_CERTIFICATE_ERROR;
+    }
+
+  /* If the certificate supports signing continue.
+   */
+  if (cert != NULL)
+    if (cert->key_usage != 0)
+      if (!(cert->key_usage & KEY_DIGITAL_SIGNATURE))
+        {
+          gnutls_assert ();
+          return GNUTLS_E_KEY_USAGE_VIOLATION;
+        }
+
+  switch (cert->subject_pk_algorithm)
+    {
+    case GNUTLS_PK_RSA:
+
+      vdata.data = hash_concat->data;
+      vdata.size = hash_concat->size;
+
+      /* verify signature */
+      if ((ret = _gnutls_rsa_verify (&vdata, signature, cert->params,
+                                     cert->params_size, 1)) < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      break;
+    default:
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  return 0;
+}
+
+/* Verifies a TLS signature (like the one in the client certificate
+ * verify message). 
+ */
+int
+_gnutls_verify_sig_hdata (gnutls_session_t session,
+                          gnutls_cert * cert, gnutls_datum_t * signature)
+{
+  int ret;
+  opaque concat[36];
+  mac_hd_t td_md5;
+  mac_hd_t td_sha;
+  gnutls_datum_t dconcat;
+  gnutls_protocol_t ver = gnutls_protocol_get_version (session);
+
+  td_md5 = _gnutls_hash_copy (session->internals.handshake_mac_handle_md5);
+  if (td_md5 == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_HASH_FAILED;
+    }
+
+  td_sha = _gnutls_hash_copy (session->internals.handshake_mac_handle_sha);
+  if (td_sha == NULL)
+    {
+      gnutls_assert ();
+      _gnutls_hash_deinit (td_md5, NULL);
+      return GNUTLS_E_HASH_FAILED;
+    }
+
+  if (ver == GNUTLS_SSL3)
+    {
+      ret = _gnutls_generate_master (session, 1);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      _gnutls_mac_deinit_ssl3_handshake (td_md5, concat,
+                                         session->security_parameters.
+                                         master_secret, TLS_MASTER_SIZE);
+      _gnutls_mac_deinit_ssl3_handshake (td_sha, &concat[16],
+                                         session->security_parameters.
+                                         master_secret, TLS_MASTER_SIZE);
+    }
+  else
+    {
+      _gnutls_hash_deinit (td_md5, concat);
+      _gnutls_hash_deinit (td_sha, &concat[16]);
+    }
+
+  dconcat.data = concat;
+  dconcat.size = 20 + 16;       /* md5+ sha */
+
+  ret = _gnutls_verify_sig (cert, &dconcat, signature, 16);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return ret;
+
+}
+
+/* Generates a signature of all the random data and the parameters.
+ * Used in DHE_* ciphersuites.
+ */
+int
+_gnutls_verify_sig_params (gnutls_session_t session,
+                           gnutls_cert * cert,
+                           const gnutls_datum_t * params,
+                           gnutls_datum_t * signature)
+{
+  gnutls_datum_t dconcat;
+  int ret;
+  mac_hd_t td_md5 = NULL;
+  mac_hd_t td_sha;
+  opaque concat[36];
+  gnutls_protocol_t ver = gnutls_protocol_get_version (session);
+
+  if (ver < GNUTLS_TLS1_2)
+    {
+      td_md5 = _gnutls_hash_init (GNUTLS_MAC_MD5);
+      if (td_md5 == NULL)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_HASH_FAILED;
+        }
+
+      _gnutls_hash (td_md5, session->security_parameters.client_random,
+                    TLS_RANDOM_SIZE);
+      _gnutls_hash (td_md5, session->security_parameters.server_random,
+                    TLS_RANDOM_SIZE);
+      _gnutls_hash (td_md5, params->data, params->size);
+    }
+
+  td_sha = _gnutls_hash_init (GNUTLS_MAC_SHA1);
+  if (td_sha == NULL)
+    {
+      gnutls_assert ();
+      if (td_md5)
+        _gnutls_hash_deinit (td_md5, NULL);
+      return GNUTLS_E_HASH_FAILED;
+    }
+
+  _gnutls_hash (td_sha, session->security_parameters.client_random,
+                TLS_RANDOM_SIZE);
+  _gnutls_hash (td_sha, session->security_parameters.server_random,
+                TLS_RANDOM_SIZE);
+  _gnutls_hash (td_sha, params->data, params->size);
+
+  if (ver < GNUTLS_TLS1_2)
+    {
+      _gnutls_hash_deinit (td_md5, concat);
+      _gnutls_hash_deinit (td_sha, &concat[16]);
+      dconcat.size = 36;
+    }
+  else
+    {
+#if 1
+      /* Use NULL parameters. */
+      memcpy (concat,
+              "\x30\x21\x30\x09\x06\x05\x2b\x0e\x03\x02\x1a\x05\x00\x04\x14",
+              15);
+      _gnutls_hash_deinit (td_sha, &concat[15]);
+      dconcat.size = 35;
+#else
+      /* No parameters field. */
+      memcpy (concat,
+              "\x30\x1f\x30\x07\x06\x05\x2b\x0e\x03\x02\x1a\x04\x14", 13);
+      _gnutls_hash_deinit (td_sha, &concat[13]);
+      dconcat.size = 33;
+#endif
+    }
+
+  dconcat.data = concat;
+
+  ret = _gnutls_verify_sig (cert, &dconcat, signature, dconcat.size - 20);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return ret;
+
+}
diff --git a/src/daemon/https/tls/gnutls_sig.h b/src/daemon/https/tls/gnutls_sig.h
new file mode 100644
index 00000000..4d770716
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_sig.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#ifndef GNUTLS_SIG_H
+# define GNUTLS_SIG_H
+
+int _gnutls_tls_sign_hdata (gnutls_session_t session,
+                            gnutls_cert * cert,
+                            gnutls_privkey * pkey,
+                            gnutls_datum_t * signature);
+
+int _gnutls_tls_sign_params (gnutls_session_t session,
+                             gnutls_cert * cert,
+                             gnutls_privkey * pkey,
+                             gnutls_datum_t * params,
+                             gnutls_datum_t * signature);
+
+int _gnutls_verify_sig_hdata (gnutls_session_t session,
+                              gnutls_cert * cert, gnutls_datum_t * signature);
+
+int _gnutls_verify_sig_params (gnutls_session_t session,
+                               gnutls_cert * cert,
+                               const gnutls_datum_t * params,
+                               gnutls_datum_t * signature);
+
+int _gnutls_sign (gnutls_pk_algorithm_t algo,
+                  mpi_t * params, int params_size,
+                  const gnutls_datum_t * data, gnutls_datum_t * signature);
+
+#endif
diff --git a/src/daemon/https/tls/gnutls_state.c b/src/daemon/https/tls/gnutls_state.c
new file mode 100644
index 00000000..ccc865a1
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_state.c
@@ -0,0 +1,1219 @@
+/*
+ * Copyright (C) 2002, 2003, 2004, 2005, 2006, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* Functions to manipulate the session (gnutls_int.h), and some other stuff
+ * are included here. The file's name is traditionally gnutls_state even if the
+ * state has been renamed to session.
+ */
+
+#include <gnutls_int.h>
+#include <gnutls_errors.h>
+#include <gnutls_auth_int.h>
+#include <gnutls_num.h>
+#include <gnutls_datum.h>
+#include <gnutls_db.h>
+#include <gnutls_record.h>
+#include <gnutls_handshake.h>
+#include <gnutls_dh.h>
+#include <gnutls_buffers.h>
+#include <gnutls_state.h>
+#include <auth_cert.h>
+#include <auth_anon.h>
+#include <gnutls_algorithms.h>
+#include <gnutls_rsa_export.h>
+
+void
+_gnutls_session_cert_type_set (gnutls_session_t session,
+                               gnutls_certificate_type_t ct)
+{
+  session->security_parameters.cert_type = ct;
+}
+
+/**
+ * gnutls_cipher_get - Returns the currently used cipher.
+ * @session: is a #gnutls_session_t structure.
+ *
+ * Returns: the currently used cipher.
+ **/
+gnutls_cipher_algorithm_t
+gnutls_cipher_get (gnutls_session_t session)
+{
+  return session->security_parameters.read_bulk_cipher_algorithm;
+}
+
+/**
+ * gnutls_certificate_type_get - Returns the currently used certificate type.
+ * @session: is a #gnutls_session_t structure.
+ *
+ * The certificate type is by default X.509, unless it is negotiated
+ * as a TLS extension.
+ *
+ * Returns: the currently used %gnutls_certificate_type_t certificate
+ *   type.
+ **/
+gnutls_certificate_type_t
+gnutls_certificate_type_get (gnutls_session_t session)
+{
+  return session->security_parameters.cert_type;
+}
+
+/**
+ * gnutls_kx_get - Returns the key exchange algorithm.
+ * @session: is a #gnutls_session_t structure.
+ *
+ * Returns: the key exchange algorithm used in the last handshake.
+ **/
+gnutls_kx_algorithm_t
+gnutls_kx_get (gnutls_session_t session)
+{
+  return session->security_parameters.kx_algorithm;
+}
+
+/**
+ * gnutls_mac_get - Returns the currently used mac algorithm.
+ * @session: is a #gnutls_session_t structure.
+ *
+ * Returns: the currently used mac algorithm.
+ **/
+gnutls_mac_algorithm_t
+gnutls_mac_get (gnutls_session_t session)
+{
+  return session->security_parameters.read_mac_algorithm;
+}
+
+/**
+ * gnutls_compression_get - Returns the currently used compression algorithm.
+ * @session: is a #gnutls_session_t structure.
+ *
+ * Returns: the currently used compression method.
+ **/
+gnutls_compression_method_t
+gnutls_compression_get (gnutls_session_t session)
+{
+  return session->security_parameters.read_compression_algorithm;
+}
+
+/* Check if the given certificate type is supported.
+ * This means that it is enabled by the priority functions,
+ * and a matching certificate exists.
+ */
+int
+_gnutls_session_cert_type_supported (gnutls_session_t session,
+                                     gnutls_certificate_type_t cert_type)
+{
+  unsigned i;
+  unsigned cert_found = 0;
+  gnutls_certificate_credentials_t cred;
+
+  if (session->security_parameters.entity == GNUTLS_SERVER)
+    {
+      cred
+        = (gnutls_certificate_credentials_t) _gnutls_get_cred (session->key,
+                                                               GNUTLS_CRD_CERTIFICATE,
+                                                               NULL);
+
+      if (cred == NULL)
+        return GNUTLS_E_UNSUPPORTED_CERTIFICATE_TYPE;
+
+      if (cred->server_get_cert_callback == NULL)
+        {
+          for (i = 0; i < cred->ncerts; i++)
+            {
+              if (cred->cert_list[i][0].cert_type == cert_type)
+                {
+                  cert_found = 1;
+                  break;
+                }
+            }
+
+          if (cert_found == 0)
+            /* no certificate is of that type.
+             */
+            return GNUTLS_E_UNSUPPORTED_CERTIFICATE_TYPE;
+        }
+    }
+
+  if (session->internals.priorities.cert_type.algorithms == 0 && cert_type
+      == DEFAULT_CERT_TYPE)
+    return 0;
+
+  for (i = 0; i < session->internals.priorities.cert_type.algorithms; i++)
+    {
+      if (session->internals.priorities.cert_type.priority[i] == cert_type)
+        {
+          return 0;             /* ok */
+        }
+    }
+
+  return GNUTLS_E_UNSUPPORTED_CERTIFICATE_TYPE;
+}
+
+/* this function deinitializes all the internal parameters stored
+ * in a session struct.
+ */
+inline static void
+deinit_internal_params (gnutls_session_t session)
+{
+  if (session->internals.params.free_dh_params)
+    gnutls_dh_params_deinit (session->internals.params.dh_params);
+
+  if (session->internals.params.free_rsa_params)
+    gnutls_rsa_params_deinit (session->internals.params.rsa_params);
+
+  memset (&session->internals.params, 0, sizeof (session->internals.params));
+}
+
+/* This function will clear all the variables in internals
+ * structure within the session, which depend on the current handshake.
+ * This is used to allow further handshakes.
+ */
+void
+_gnutls_handshake_internal_state_clear (gnutls_session_t session)
+{
+  session->internals.extensions_sent_size = 0;
+
+  /* by default no selected certificate */
+  session->internals.proposed_record_size = DEFAULT_MAX_RECORD_SIZE;
+  session->internals.adv_version_major = 0;
+  session->internals.adv_version_minor = 0;
+  session->internals.v2_hello = 0;
+  memset (&session->internals.handshake_header_buffer, 0,
+          sizeof (handshake_header_buffer_st));
+  session->internals.adv_version_minor = 0;
+  session->internals.adv_version_minor = 0;
+  session->internals.direction = 0;
+
+  /* use out of band data for the last
+   * handshake messages received.
+   */
+  session->internals.last_handshake_in = -1;
+  session->internals.last_handshake_out = -1;
+
+  session->internals.resumable = RESUME_TRUE;
+  _gnutls_free_datum (&session->internals.recv_buffer);
+
+  deinit_internal_params (session);
+
+}
+
+#define MIN_DH_BITS 727
+/**
+ * gnutls_init - This function initializes the session to null (null encryption etc...).
+ * @con_end: indicate if this session is to be used for server or client.
+ * @session: is a pointer to a #gnutls_session_t structure.
+ *
+ * This function initializes the current session to null. Every
+ * session must be initialized before use, so internal structures can
+ * be allocated.  This function allocates structures which can only
+ * be free'd by calling gnutls_deinit().  Returns zero on success.
+ *
+ * @con_end can be one of %GNUTLS_CLIENT and %GNUTLS_SERVER.
+ *
+ * Returns: %GNUTLS_E_SUCCESS on success, or an error code.
+ **/
+
+// TODO rm redundent pointer ref  
+int
+gnutls_init (gnutls_session_t * session, gnutls_connection_end_t con_end)
+{
+  *session = gnutls_calloc (1, sizeof (struct gnutls_session_int));
+  if (*session == NULL)
+    return GNUTLS_E_MEMORY_ERROR;
+
+  (*session)->security_parameters.entity = con_end;
+
+  /* the default certificate type for TLS */
+  (*session)->security_parameters.cert_type = DEFAULT_CERT_TYPE;
+
+  /* Set the defaults for initial handshake */
+  (*session)->security_parameters.read_bulk_cipher_algorithm =
+    (*session)->security_parameters.write_bulk_cipher_algorithm =
+    GNUTLS_CIPHER_NULL;
+
+  (*session)->security_parameters.read_mac_algorithm =
+    (*session)->security_parameters.write_mac_algorithm = GNUTLS_MAC_NULL;
+
+  (*session)->security_parameters.read_compression_algorithm
+    = GNUTLS_COMP_NULL;
+  (*session)->security_parameters.write_compression_algorithm
+    = GNUTLS_COMP_NULL;
+
+  (*session)->internals.enable_private = 0;
+
+  /* Initialize buffers */
+  _gnutls_buffer_init (&(*session)->internals.application_data_buffer);
+  _gnutls_buffer_init (&(*session)->internals.handshake_data_buffer);
+  _gnutls_buffer_init (&(*session)->internals.handshake_hash_buffer);
+  _gnutls_buffer_init (&(*session)->internals.ia_data_buffer);
+
+  _gnutls_buffer_init (&(*session)->internals.record_send_buffer);
+  _gnutls_buffer_init (&(*session)->internals.record_recv_buffer);
+
+  _gnutls_buffer_init (&(*session)->internals.handshake_send_buffer);
+  _gnutls_buffer_init (&(*session)->internals.handshake_recv_buffer);
+
+  (*session)->key = gnutls_calloc (1, sizeof (struct gnutls_key_st));
+  if ((*session)->key == NULL)
+    {
+    cleanup_session:gnutls_free (*session);
+      *session = NULL;
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  (*session)->internals.expire_time = DEFAULT_EXPIRE_TIME;      /* one hour default */
+
+  gnutls_dh_set_prime_bits ((*session), MIN_DH_BITS);
+
+  gnutls_transport_set_lowat ((*session), DEFAULT_LOWAT);       /* the default for tcp */
+
+  gnutls_handshake_set_max_packet_length ((*session),
+                                          MAX_HANDSHAKE_PACKET_SIZE);
+
+  /* Allocate a minimum size for recv_data 
+   * This is allocated in order to avoid small messages, making
+   * the receive procedure slow.
+   */
+  (*session)->internals.record_recv_buffer.data
+    = gnutls_malloc (INITIAL_RECV_BUFFER_SIZE);
+  if ((*session)->internals.record_recv_buffer.data == NULL)
+    {
+      gnutls_free ((*session)->key);
+      goto cleanup_session;
+    }
+
+  /* set the socket pointers to -1; */
+  (*session)->internals.transport_recv_ptr = (gnutls_transport_ptr_t) - 1;
+  (*session)->internals.transport_send_ptr = (gnutls_transport_ptr_t) - 1;
+
+  /* set the default maximum record size for TLS
+   */
+  (*session)->security_parameters.max_record_recv_size
+    = DEFAULT_MAX_RECORD_SIZE;
+  (*session)->security_parameters.max_record_send_size
+    = DEFAULT_MAX_RECORD_SIZE;
+
+  /* everything else not initialized here is initialized
+   * as NULL or 0. This is why calloc is used.
+   */
+
+  _gnutls_handshake_internal_state_clear (*session);
+
+  return 0;
+}
+
+/* returns RESUME_FALSE or RESUME_TRUE.
+ */
+int
+_gnutls_session_is_resumable (gnutls_session_t session)
+{
+  return session->internals.resumable;
+}
+
+/**
+ * gnutls_deinit - This function clears all buffers associated with a session
+ * @session: is a #gnutls_session_t structure.
+ *
+ * This function clears all buffers associated with the @session.
+ * This function will also remove session data from the session
+ * database if the session was terminated abnormally.
+ **/
+void
+gnutls_deinit (gnutls_session_t session)
+{
+
+  if (session == NULL)
+    return;
+
+  /* remove auth info firstly */
+  _gnutls_free_auth_info (session);
+
+  _gnutls_handshake_internal_state_clear (session);
+  _gnutls_handshake_io_buffer_clear (session);
+
+  _gnutls_free_datum (&session->connection_state.read_mac_secret);
+  _gnutls_free_datum (&session->connection_state.write_mac_secret);
+
+  _gnutls_buffer_clear (&session->internals.ia_data_buffer);
+  _gnutls_buffer_clear (&session->internals.handshake_hash_buffer);
+  _gnutls_buffer_clear (&session->internals.handshake_data_buffer);
+  _gnutls_buffer_clear (&session->internals.application_data_buffer);
+  _gnutls_buffer_clear (&session->internals.record_recv_buffer);
+  _gnutls_buffer_clear (&session->internals.record_send_buffer);
+
+  gnutls_credentials_clear (session);
+  _gnutls_selected_certs_deinit (session);
+
+  if (session->connection_state.read_cipher_state != NULL)
+    _gnutls_cipher_deinit (session->connection_state.read_cipher_state);
+  if (session->connection_state.write_cipher_state != NULL)
+    _gnutls_cipher_deinit (session->connection_state.write_cipher_state);
+
+  if (session->connection_state.read_compression_state != NULL)
+    _gnutls_comp_deinit (session->connection_state.read_compression_state, 1);
+  if (session->connection_state.write_compression_state != NULL)
+    _gnutls_comp_deinit (session->connection_state.
+                         write_compression_state, 0);
+
+  _gnutls_free_datum (&session->cipher_specs.server_write_mac_secret);
+  _gnutls_free_datum (&session->cipher_specs.client_write_mac_secret);
+  _gnutls_free_datum (&session->cipher_specs.server_write_IV);
+  _gnutls_free_datum (&session->cipher_specs.client_write_IV);
+  _gnutls_free_datum (&session->cipher_specs.server_write_key);
+  _gnutls_free_datum (&session->cipher_specs.client_write_key);
+
+  if (session->key != NULL)
+    {
+      _gnutls_mpi_release (&session->key->KEY);
+      _gnutls_mpi_release (&session->key->client_Y);
+      _gnutls_mpi_release (&session->key->client_p);
+      _gnutls_mpi_release (&session->key->client_g);
+
+      _gnutls_mpi_release (&session->key->u);
+      _gnutls_mpi_release (&session->key->a);
+      _gnutls_mpi_release (&session->key->x);
+      _gnutls_mpi_release (&session->key->A);
+      _gnutls_mpi_release (&session->key->B);
+      _gnutls_mpi_release (&session->key->b);
+
+      /* RSA */
+      _gnutls_mpi_release (&session->key->rsa[0]);
+      _gnutls_mpi_release (&session->key->rsa[1]);
+
+      _gnutls_mpi_release (&session->key->dh_secret);
+      gnutls_free (session->key);
+
+      session->key = NULL;
+    }
+
+  gnutls_free (session->internals.srp_username);
+
+  if (session->internals.srp_password)
+    {
+      memset (session->internals.srp_password, 0,
+              strlen (session->internals.srp_password));
+      gnutls_free (session->internals.srp_password);
+    }
+
+  memset (session, 0, sizeof (struct gnutls_session_int));
+  gnutls_free (session);
+}
+
+/* Returns the minimum prime bits that are acceptable.
+ */
+int
+_gnutls_dh_get_allowed_prime_bits (gnutls_session_t session)
+{
+  return session->internals.dh_prime_bits;
+}
+
+int
+_gnutls_dh_set_peer_public (gnutls_session_t session, mpi_t public)
+{
+  dh_info_st *dh;
+  int ret;
+
+  switch (gnutls_auth_get_type (session))
+    {
+    case GNUTLS_CRD_ANON:
+      {
+        anon_auth_info_t info;
+        info = _gnutls_get_auth_info (session);
+        if (info == NULL)
+          return GNUTLS_E_INTERNAL_ERROR;
+
+        dh = &info->dh;
+        break;
+      }
+    case GNUTLS_CRD_CERTIFICATE:
+      {
+        cert_auth_info_t info;
+
+        info = _gnutls_get_auth_info (session);
+        if (info == NULL)
+          return GNUTLS_E_INTERNAL_ERROR;
+
+        dh = &info->dh;
+        break;
+      }
+    default:
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  ret = _gnutls_mpi_dprint_lz (&dh->public_key, public);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return 0;
+}
+
+int
+_gnutls_dh_set_secret_bits (gnutls_session_t session, unsigned bits)
+{
+  switch (gnutls_auth_get_type (session))
+    {
+    case GNUTLS_CRD_ANON:
+      {
+        anon_auth_info_t info;
+        info = _gnutls_get_auth_info (session);
+        if (info == NULL)
+          return GNUTLS_E_INTERNAL_ERROR;
+        info->dh.secret_bits = bits;
+        break;
+      }
+    case GNUTLS_CRD_CERTIFICATE:
+      {
+        cert_auth_info_t info;
+
+        info = _gnutls_get_auth_info (session);
+        if (info == NULL)
+          return GNUTLS_E_INTERNAL_ERROR;
+
+        info->dh.secret_bits = bits;
+        break;
+    default:
+        gnutls_assert ();
+        return GNUTLS_E_INTERNAL_ERROR;
+      }
+    }
+
+  return 0;
+}
+
+/* This function will set in the auth info structure the
+ * RSA exponent and the modulus.
+ */
+int
+_gnutls_rsa_export_set_pubkey (gnutls_session_t session,
+                               mpi_t exponent, mpi_t modulus)
+{
+  cert_auth_info_t info;
+  int ret;
+
+  info = _gnutls_get_auth_info (session);
+  if (info == NULL)
+    return GNUTLS_E_INTERNAL_ERROR;
+
+  ret = _gnutls_mpi_dprint_lz (&info->rsa_export.modulus, modulus);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  ret = _gnutls_mpi_dprint_lz (&info->rsa_export.exponent, exponent);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      _gnutls_free_datum (&info->rsa_export.modulus);
+      return ret;
+    }
+
+  return 0;
+}
+
+/* Sets the prime and the generator in the auth info structure.
+ */
+int
+_gnutls_dh_set_group (gnutls_session_t session, mpi_t gen, mpi_t prime)
+{
+  dh_info_st *dh;
+  int ret;
+
+  switch (gnutls_auth_get_type (session))
+    {
+    case GNUTLS_CRD_ANON:
+      {
+        anon_auth_info_t info;
+        info = _gnutls_get_auth_info (session);
+        if (info == NULL)
+          return GNUTLS_E_INTERNAL_ERROR;
+
+        dh = &info->dh;
+        break;
+      }
+    case GNUTLS_CRD_CERTIFICATE:
+      {
+        cert_auth_info_t info;
+
+        info = _gnutls_get_auth_info (session);
+        if (info == NULL)
+          return GNUTLS_E_INTERNAL_ERROR;
+
+        dh = &info->dh;
+        break;
+      }
+    default:
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  /* prime
+   */
+  ret = _gnutls_mpi_dprint_lz (&dh->prime, prime);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  /* generator
+   */
+  ret = _gnutls_mpi_dprint_lz (&dh->generator, gen);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      _gnutls_free_datum (&dh->prime);
+      return ret;
+    }
+
+  return 0;
+}
+
+/**
+ * gnutls_openpgp_send_cert - This function will order gnutls to send the openpgp fingerprint instead of the key
+ * @session: is a pointer to a #gnutls_session_t structure.
+ * @status: is one of GNUTLS_OPENPGP_CERT, or GNUTLS_OPENPGP_CERT_FINGERPRINT
+ *
+ * This function will order gnutls to send the key fingerprint
+ * instead of the key in the initial handshake procedure. This should
+ * be used with care and only when there is indication or knowledge
+ * that the server can obtain the client's key.
+ **/
+void
+gnutls_openpgp_send_cert (gnutls_session_t session,
+                          gnutls_openpgp_crt_status_t status)
+{
+  session->internals.pgp_fingerprint = status;
+}
+
+/**
+ * gnutls_certificate_send_x509_rdn_sequence - This function will order gnutls to send or not the x.509 rdn sequence
+ * @session: is a pointer to a #gnutls_session_t structure.
+ * @status: is 0 or 1
+ *
+ * If status is non zero, this function will order gnutls not to send
+ * the rdnSequence in the certificate request message. That is the
+ * server will not advertize it's trusted CAs to the peer. If status
+ * is zero then the default behaviour will take effect, which is to
+ * advertize the server's trusted CAs.
+ *
+ * This function has no effect in clients, and in authentication
+ * methods other than certificate with X.509 certificates.
+ **/
+void
+gnutls_certificate_send_x509_rdn_sequence (gnutls_session_t session,
+                                           int status)
+{
+  session->internals.ignore_rdn_sequence = status;
+}
+
+int
+_gnutls_openpgp_send_fingerprint (gnutls_session_t session)
+{
+  return session->internals.pgp_fingerprint;
+}
+
+/*-
+ * _gnutls_record_set_default_version - Used to set the default version for the first record packet
+ * @session: is a #gnutls_session_t structure.
+ * @major: is a tls major version
+ * @minor: is a tls minor version
+ *
+ * This function sets the default version that we will use in the first
+ * record packet (client hello). This function is only useful to people
+ * that know TLS internals and want to debug other implementations.
+ *
+ -*/
+void
+_gnutls_record_set_default_version (gnutls_session_t session,
+                                    unsigned char major, unsigned char minor)
+{
+  session->internals.default_record_version[0] = major;
+  session->internals.default_record_version[1] = minor;
+}
+
+/**
+ * gnutls_handshake_set_private_extensions - Used to enable the private cipher suites
+ * @session: is a #gnutls_session_t structure.
+ * @allow: is an integer (0 or 1)
+ *
+ * This function will enable or disable the use of private cipher
+ * suites (the ones that start with 0xFF).  By default or if @allow
+ * is 0 then these cipher suites will not be advertized nor used.
+ *
+ * Unless this function is called with the option to allow (1), then
+ * no compression algorithms, like LZO.  That is because these
+ * algorithms are not yet defined in any RFC or even internet draft.
+ *
+ * Enabling the private ciphersuites when talking to other than
+ * gnutls servers and clients may cause interoperability problems.
+ **/
+void
+gnutls_handshake_set_private_extensions (gnutls_session_t session, int allow)
+{
+  session->internals.enable_private = allow;
+}
+
+inline static int
+_gnutls_cal_PRF_A (gnutls_mac_algorithm_t algorithm,
+                   const void *secret,
+                   int secret_size,
+                   const void *seed, int seed_size, void *result)
+{
+  mac_hd_t td1;
+
+  td1 = _gnutls_hmac_init (algorithm, secret, secret_size);
+  if (td1 == GNUTLS_MAC_FAILED)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  _gnutls_hmac (td1, seed, seed_size);
+  _gnutls_hmac_deinit (td1, result);
+
+  return 0;
+}
+
+#define MAX_SEED_SIZE 200
+
+/* Produces "total_bytes" bytes using the hash algorithm specified.
+ * (used in the PRF function)
+ */
+static int
+_gnutls_P_hash (gnutls_mac_algorithm_t algorithm,
+                const opaque * secret,
+                int secret_size,
+                const opaque * seed,
+                int seed_size, int total_bytes, opaque * ret)
+{
+
+  mac_hd_t td2;
+  int i, times, how, blocksize, A_size;
+  opaque final[20], Atmp[MAX_SEED_SIZE];
+  int output_bytes, result;
+
+  if (seed_size > MAX_SEED_SIZE || total_bytes <= 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  blocksize = _gnutls_hmac_get_algo_len (algorithm);
+
+  output_bytes = 0;
+  do
+    {
+      output_bytes += blocksize;
+    }
+  while (output_bytes < total_bytes);
+
+  /* calculate A(0) */
+
+  memcpy (Atmp, seed, seed_size);
+  A_size = seed_size;
+
+  times = output_bytes / blocksize;
+
+  for (i = 0; i < times; i++)
+    {
+      td2 = _gnutls_hmac_init (algorithm, secret, secret_size);
+      if (td2 == GNUTLS_MAC_FAILED)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_INTERNAL_ERROR;
+        }
+
+      /* here we calculate A(i+1) */
+      if ((result = _gnutls_cal_PRF_A (algorithm, secret, secret_size, Atmp,
+                                       A_size, Atmp)) < 0)
+        {
+          gnutls_assert ();
+          _gnutls_hmac_deinit (td2, final);
+          return result;
+        }
+
+      A_size = blocksize;
+
+      _gnutls_hmac (td2, Atmp, A_size);
+      _gnutls_hmac (td2, seed, seed_size);
+      _gnutls_hmac_deinit (td2, final);
+
+      if ((1 + i) * blocksize < total_bytes)
+        {
+          how = blocksize;
+        }
+      else
+        {
+          how = total_bytes - (i) * blocksize;
+        }
+
+      if (how > 0)
+        {
+          memcpy (&ret[i * blocksize], final, how);
+        }
+    }
+
+  return 0;
+}
+
+/* Xor's two buffers and puts the output in the first one.
+ */
+inline static void
+_gnutls_xor (opaque * o1, opaque * o2, int length)
+{
+  int i;
+  for (i = 0; i < length; i++)
+    {
+      o1[i] ^= o2[i];
+    }
+}
+
+#define MAX_PRF_BYTES 200
+
+/* The PRF function expands a given secret 
+ * needed by the TLS specification. ret must have a least total_bytes
+ * available.
+ */
+int
+_gnutls_PRF (gnutls_session_t session,
+             const opaque * secret,
+             int secret_size,
+             const char *label,
+             int label_size,
+             const opaque * seed, int seed_size, int total_bytes, void *ret)
+{
+  int l_s, s_seed_size;
+  const opaque *s1, *s2;
+  opaque s_seed[MAX_SEED_SIZE];
+  opaque o1[MAX_PRF_BYTES], o2[MAX_PRF_BYTES];
+  int result;
+  gnutls_protocol_t ver = gnutls_protocol_get_version (session);
+
+  if (total_bytes > MAX_PRF_BYTES)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+  /* label+seed = s_seed */
+  s_seed_size = seed_size + label_size;
+
+  if (s_seed_size > MAX_SEED_SIZE)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  memcpy (s_seed, label, label_size);
+  memcpy (&s_seed[label_size], seed, seed_size);
+
+  if (ver >= GNUTLS_TLS1_2)
+    {
+      result = _gnutls_P_hash (GNUTLS_MAC_SHA1, secret, secret_size, s_seed,
+                               s_seed_size, total_bytes, ret);
+      if (result < 0)
+        {
+          gnutls_assert ();
+          return result;
+        }
+    }
+  else
+    {
+      l_s = secret_size / 2;
+
+      s1 = &secret[0];
+      s2 = &secret[l_s];
+
+      if (secret_size % 2 != 0)
+        {
+          l_s++;
+        }
+
+      result = _gnutls_P_hash (GNUTLS_MAC_MD5, s1, l_s, s_seed, s_seed_size,
+                               total_bytes, o1);
+      if (result < 0)
+        {
+          gnutls_assert ();
+          return result;
+        }
+
+      result = _gnutls_P_hash (GNUTLS_MAC_SHA1, s2, l_s, s_seed, s_seed_size,
+                               total_bytes, o2);
+      if (result < 0)
+        {
+          gnutls_assert ();
+          return result;
+        }
+
+      _gnutls_xor (o1, o2, total_bytes);
+
+      memcpy (ret, o1, total_bytes);
+    }
+
+  return 0;                     /* ok */
+
+}
+
+/**
+ * gnutls_prf_raw - access the TLS PRF directly
+ * @session: is a #gnutls_session_t structure.
+ * @label_size: length of the @label variable.
+ * @label: label used in PRF computation, typically a short string.
+ * @seed_size: length of the @seed variable.
+ * @seed: optional extra data to seed the PRF with.
+ * @outsize: size of pre-allocated output buffer to hold the output.
+ * @out: pre-allocate buffer to hold the generated data.
+ *
+ * Apply the TLS Pseudo-Random-Function (PRF) using the master secret
+ * on some data.
+ *
+ * The @label variable usually contain a string denoting the purpose
+ * for the generated data.  The @seed usually contain data such as the
+ * client and server random, perhaps together with some additional
+ * data that is added to guarantee uniqueness of the output for a
+ * particular purpose.
+ *
+ * Because the output is not guaranteed to be unique for a particular
+ * session unless @seed include the client random and server random
+ * fields (the PRF would output the same data on another connection
+ * resumed from the first one), it is not recommended to use this
+ * function directly.  The gnutls_prf() function seed the PRF with the
+ * client and server random fields directly, and is recommended if you
+ * want to generate pseudo random data unique for each session.
+ *
+ * Returns: %GNUTLS_E_SUCCESS on success, or an error code.
+ **/
+int
+gnutls_prf_raw (gnutls_session_t session,
+                size_t label_size,
+                const char *label,
+                size_t seed_size, const char *seed, size_t outsize, char *out)
+{
+  int ret;
+
+  ret = _gnutls_PRF (session, session->security_parameters.master_secret,
+                     TLS_MASTER_SIZE, label, label_size, (opaque *) seed,
+                     seed_size, outsize, out);
+
+  return ret;
+}
+
+/**
+ * gnutls_prf - derive pseudo-random data using the TLS PRF
+ * @session: is a #gnutls_session_t structure.
+ * @label_size: length of the @label variable.
+ * @label: label used in PRF computation, typically a short string.
+ * @server_random_first: non-0 if server random field should be first in seed
+ * @extra_size: length of the @extra variable.
+ * @extra: optional extra data to seed the PRF with.
+ * @outsize: size of pre-allocated output buffer to hold the output.
+ * @out: pre-allocate buffer to hold the generated data.
+ *
+ * Apply the TLS Pseudo-Random-Function (PRF) using the master secret
+ * on some data, seeded with the client and server random fields.
+ *
+ * The @label variable usually contain a string denoting the purpose
+ * for the generated data.  The @server_random_first indicate whether
+ * the client random field or the server random field should be first
+ * in the seed.  Non-0 indicate that the server random field is first,
+ * 0 that the client random field is first.
+ *
+ * The @extra variable can be used to add more data to the seed, after
+ * the random variables.  It can be used to tie make sure the
+ * generated output is strongly connected to some additional data
+ * (e.g., a string used in user authentication).
+ *
+ * The output is placed in *@OUT, which must be pre-allocated.
+ *
+ * Returns: %GNUTLS_E_SUCCESS on success, or an error code.
+ **/
+int
+gnutls_prf (gnutls_session_t session,
+            size_t label_size,
+            const char *label,
+            int server_random_first,
+            size_t extra_size, const char *extra, size_t outsize, char *out)
+{
+  int ret;
+  opaque *seed;
+  size_t seedsize = 2 * TLS_RANDOM_SIZE + extra_size;
+
+  seed = gnutls_malloc (seedsize);
+  if (!seed)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  memcpy (seed,
+          server_random_first ? session->security_parameters.server_random
+          : session->security_parameters.client_random, TLS_RANDOM_SIZE);
+  memcpy (seed + TLS_RANDOM_SIZE,
+          server_random_first ? session->security_parameters.client_random
+          : session->security_parameters.server_random, TLS_RANDOM_SIZE);
+
+  memcpy (seed + 2 * TLS_RANDOM_SIZE, extra, extra_size);
+
+  ret = _gnutls_PRF (session, session->security_parameters.master_secret,
+                     TLS_MASTER_SIZE, label, label_size, seed, seedsize,
+                     outsize, out);
+
+  gnutls_free (seed);
+
+  return ret;
+}
+
+/**
+ * gnutls_session_get_client_random - get the session's client random value
+ * @session: is a #gnutls_session_t structure.
+ *
+ * Return a pointer to the 32-byte client random field used in the
+ * session.  The pointer must not be modified or deallocated.
+ *
+ * If a client random value has not yet been established, the output
+ * will be garbage; in particular, a %NULL return value should not be
+ * expected.
+ *
+ * Returns: pointer to client random data.
+ **/
+const void *
+gnutls_session_get_client_random (gnutls_session_t session)
+{
+  return (char *) session->security_parameters.client_random;
+}
+
+/**
+ * gnutls_session_get_server_random - get the session's server random value
+ * @session: is a #gnutls_session_t structure.
+ *
+ * Return a pointer to the 32-byte server random field used in the
+ * session.  The pointer must not be modified or deallocated.
+ *
+ * If a server random value has not yet been established, the output
+ * will be garbage; in particular, a %NULL return value should not be
+ * expected.
+ *
+ * Returns: pointer to server random data.
+ **/
+const void *
+gnutls_session_get_server_random (gnutls_session_t session)
+{
+  return (char *) session->security_parameters.server_random;
+}
+
+/**
+ * gnutls_session_get_master_secret - get the session's master secret value
+ * @session: is a #gnutls_session_t structure.
+ *
+ * Return a pointer to the 48-byte master secret in the session.  The
+ * pointer must not be modified or deallocated.
+ *
+ * If a master secret value has not yet been established, the output
+ * will be garbage; in particular, a %NULL return value should not be
+ * expected.
+ *
+ * Consider using gnutls_prf() rather than extracting the master
+ * secret and use it to derive further data.
+ *
+ * Returns: pointer to master secret data.
+ **/
+const void *
+gnutls_session_get_master_secret (gnutls_session_t session)
+{
+  return (char *) session->security_parameters.master_secret;
+}
+
+/**
+ * gnutls_session_is_resumed - Used to check whether this session is a resumed one
+ * @session: is a #gnutls_session_t structure.
+ *
+ * Returns: non zero if this session is resumed, or a zero if this is
+ * a new session.
+ **/
+int
+gnutls_session_is_resumed (gnutls_session_t session)
+{
+  if (session->security_parameters.entity == GNUTLS_CLIENT)
+    {
+      if (session->security_parameters.session_id_size > 0
+          && session->security_parameters.session_id_size
+          == session->internals.resumed_security_parameters.session_id_size
+          && memcmp (session->security_parameters.session_id,
+                     session->internals.resumed_security_parameters.
+                     session_id, session->security_parameters.session_id_size)
+          == 0)
+        return 1;
+    }
+  else
+    {
+      if (session->internals.resumed == RESUME_TRUE)
+        return 1;
+    }
+
+  return 0;
+}
+
+/*-
+ * _gnutls_session_is_export - Used to check whether this session is of export grade
+ * @session: is a #gnutls_session_t structure.
+ *
+ * This function will return non zero if this session is of export grade.
+ *
+ -*/
+int
+_gnutls_session_is_export (gnutls_session_t session)
+{
+  gnutls_cipher_algorithm_t cipher;
+
+  cipher =
+    _gnutls_cipher_suite_get_cipher_algo (&session->security_parameters.
+                                          current_cipher_suite);
+
+  if (_gnutls_cipher_get_export_flag (cipher) != 0)
+    return 1;
+
+  return 0;
+}
+
+/**
+ * gnutls_session_get_ptr - Used to get the user pointer from the session structure
+ * @session: is a #gnutls_session_t structure.
+ *
+ * Returns: the user given pointer from the session structure.  This
+ * is the pointer set with gnutls_session_set_ptr().
+ **/
+void *
+gnutls_session_get_ptr (gnutls_session_t session)
+{
+  return session->internals.user_ptr;
+}
+
+/**
+ * gnutls_session_set_ptr - Used to set the user pointer to the session structure
+ * @session: is a #gnutls_session_t structure.
+ * @ptr: is the user pointer
+ *
+ * This function will set (associate) the user given pointer to the
+ * session structure.  This is pointer can be accessed with
+ * gnutls_session_get_ptr().
+ **/
+void
+gnutls_session_set_ptr (gnutls_session_t session, void *ptr)
+{
+  session->internals.user_ptr = ptr;
+}
+
+/**
+ * gnutls_record_get_direction - This function will return the direction of the last interrupted function call
+ * @session: is a #gnutls_session_t structure.
+ *
+ * This function provides information about the internals of the
+ * record protocol and is only useful if a prior gnutls function call
+ * (e.g.  gnutls_handshake()) was interrupted for some reason, that
+ * is, if a function returned %GNUTLS_E_INTERRUPTED or
+ * %GNUTLS_E_AGAIN.  In such a case, you might want to call select()
+ * or poll() before calling the interrupted gnutls function again.
+ * To tell you whether a file descriptor should be selected for
+ * either reading or writing, gnutls_record_get_direction() returns 0
+ * if the interrupted function was trying to read data, and 1 if it
+ * was trying to write data.
+ *
+ * Returns: 0 if trying to read data, 1 if trying to write data.
+ **/
+int
+gnutls_record_get_direction (gnutls_session_t session)
+{
+  return session->internals.direction;
+}
+
+/*-
+ * _gnutls_rsa_pms_set_version - Sets a version to be used at the RSA PMS
+ * @session: is a #gnutls_session_t structure.
+ * @major: is the major version to use
+ * @minor: is the minor version to use
+ *
+ * This function will set the given version number to be used at the
+ * RSA PMS secret. This is only useful to clients, which want to
+ * test server's capabilities.
+ *
+ -*/
+void
+_gnutls_rsa_pms_set_version (gnutls_session_t session,
+                             unsigned char major, unsigned char minor)
+{
+  session->internals.rsa_pms_version[0] = major;
+  session->internals.rsa_pms_version[1] = minor;
+}
+
+/**
+ * gnutls_handshake_set_post_client_hello_function - This function will a callback to be called after the client hello is received
+ * @res: is a gnutls_anon_server_credentials_t structure
+ * @func: is the function to be called
+ *
+ * This function will set a callback to be called after the client
+ * hello has been received (callback valid in server side only). This
+ * allows the server to adjust settings based on received extensions.
+ *
+ * Those settings could be ciphersuites, requesting certificate, or
+ * anything else except for version negotiation (this is done before
+ * the hello message is parsed).
+ *
+ * This callback must return 0 on success or a gnutls error code to
+ * terminate the handshake.
+ *
+ * NOTE: You should not use this function to terminate the handshake
+ * based on client input unless you know what you are doing. Before
+ * the handshake is finished there is no way to know if there is a
+ * man-in-the-middle attack being performed.
+ *
+ **/
+void
+gnutls_handshake_set_post_client_hello_function (gnutls_session_t session,
+                                                 gnutls_handshake_post_client_hello_func
+                                                 func)
+{
+  session->internals.user_hello_func = func;
+}
+
+/**
+ * gnutls_session_enable_compatibility_mode - Used to disable certain features in TLS in order to honour compatibility
+ * @session: is a #gnutls_session_t structure.
+ *
+ * This function can be used to disable certain (security) features
+ * in TLS in order to maintain maximum compatibility with buggy
+ * clients. It is equivalent to calling:
+ * gnutls_record_disable_padding()
+ *
+ * Normally only servers that require maximum compatibility with
+ * everything out there, need to call this function.
+ **/
+void
+gnutls_session_enable_compatibility_mode (gnutls_session_t session)
+{
+  gnutls_record_disable_padding (session);
+}
diff --git a/src/daemon/https/tls/gnutls_state.h b/src/daemon/https/tls/gnutls_state.h
new file mode 100644
index 00000000..7a920ee4
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_state.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005, 2006 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#ifndef GNUTLS_STATE_H
+# define GNUTLS_STATE_H
+
+#include <gnutls_int.h>
+
+void _gnutls_session_cert_type_set (gnutls_session_t session,
+                                    gnutls_certificate_type_t);
+gnutls_kx_algorithm_t gnutls_kx_get (gnutls_session_t session);
+gnutls_cipher_algorithm_t gnutls_cipher_get (gnutls_session_t session);
+gnutls_certificate_type_t gnutls_certificate_type_get (gnutls_session_t);
+
+#include <gnutls_auth_int.h>
+
+#define CHECK_AUTH(auth, ret) if (gnutls_auth_get_type(session) != auth) { \
+        gnutls_assert(); \
+        return ret; \
+        }
+
+#endif
+
+int _gnutls_session_cert_type_supported (gnutls_session_t,
+                                         gnutls_certificate_type_t);
+
+int _gnutls_dh_set_secret_bits (gnutls_session_t session, unsigned bits);
+
+int _gnutls_dh_set_peer_public (gnutls_session_t session, mpi_t public);
+int _gnutls_dh_set_group (gnutls_session_t session, mpi_t gen, mpi_t prime);
+
+int _gnutls_dh_get_allowed_prime_bits (gnutls_session_t session);
+void _gnutls_handshake_internal_state_clear (gnutls_session_t);
+
+int _gnutls_rsa_export_set_pubkey (gnutls_session_t session,
+                                   mpi_t exponent, mpi_t modulus);
+
+int _gnutls_session_is_resumable (gnutls_session_t session);
+int _gnutls_session_is_export (gnutls_session_t session);
+
+int _gnutls_openpgp_send_fingerprint (gnutls_session_t session);
+
+int _gnutls_PRF (gnutls_session_t session,
+                 const opaque * secret, int secret_size,
+                 const char *label, int label_size,
+                 const opaque * seed, int seed_size,
+                 int total_bytes, void *ret);
+
+int gnutls_init (gnutls_session_t * session, gnutls_connection_end_t con_end);
+
+#define DEFAULT_CERT_TYPE GNUTLS_CRT_X509
diff --git a/src/daemon/https/tls/gnutls_str.c b/src/daemon/https/tls/gnutls_str.c
new file mode 100644
index 00000000..0ccf8445
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_str.c
@@ -0,0 +1,312 @@
+/*
+ * Copyright (C) 2002, 2004, 2005, 2007  Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include <gnutls_int.h>
+#include <gnutls_errors.h>
+#include <gnutls_num.h>
+#include <gnutls_str.h>
+
+/* These function are like strcat, strcpy. They only
+ * do bound checking (they shouldn't cause buffer overruns),
+ * and they always produce null terminated strings.
+ *
+ * They should be used only with null terminated strings.
+ */
+void _gnutls_str_cat(char *dest,
+                     size_t dest_tot_size,
+                     const char *src)
+{
+  size_t str_size = strlen(src);
+  size_t dest_size = strlen(dest);
+
+  if (dest_tot_size - dest_size > str_size)
+    {
+      strcat(dest, src);
+    }
+  else
+    {
+      if (dest_tot_size - dest_size > 0)
+        {
+          strncat(dest, src, (dest_tot_size - dest_size) - 1);
+          dest[dest_tot_size - 1] = 0;
+        }
+    }
+}
+
+void _gnutls_str_cpy(char *dest,
+                     size_t dest_tot_size,
+                     const char *src)
+{
+  size_t str_size = strlen(src);
+
+  if (dest_tot_size > str_size)
+    {
+      strcpy(dest, src);
+    }
+  else
+    {
+      if (dest_tot_size > 0)
+        {
+          strncpy(dest, src, (dest_tot_size) - 1);
+          dest[dest_tot_size - 1] = 0;
+        }
+    }
+}
+
+void _gnutls_mem_cpy(char *dest,
+                     size_t dest_tot_size,
+                     const char *src,
+                     size_t src_size)
+{
+
+  if (dest_tot_size >= src_size)
+    {
+      memcpy(dest, src, src_size);
+    }
+  else
+    {
+      if (dest_tot_size > 0)
+        {
+          memcpy(dest, src, dest_tot_size);
+        }
+    }
+}
+
+void _gnutls_string_init(gnutls_string * str,
+                         gnutls_alloc_function alloc_func,
+                         gnutls_realloc_function realloc_func,
+                         gnutls_free_function free_func)
+{
+  str->data = NULL;
+  str->max_length = 0;
+  str->length = 0;
+
+  str->alloc_func = alloc_func;
+  str->free_func = free_func;
+  str->realloc_func = realloc_func;
+}
+
+void _gnutls_string_clear(gnutls_string * str)
+{
+  if (str == NULL || str->data == NULL)
+    return;
+  str->free_func(str->data);
+
+  str->data = NULL;
+  str->max_length = 0;
+  str->length = 0;
+}
+
+/* This one does not copy the string.
+ */
+gnutls_datum_t _gnutls_string2datum(gnutls_string * str)
+{
+  gnutls_datum_t ret;
+
+  ret.data = str->data;
+  ret.size = str->length;
+
+  return ret;
+}
+
+#define MIN_CHUNK 256
+
+int _gnutls_string_copy_str(gnutls_string * dest,
+                            const char *src)
+{
+  size_t src_len = strlen(src);
+  size_t max;
+  if (dest->max_length >= src_len)
+    {
+      memcpy(dest->data, src, src_len);
+      dest->length = src_len;
+
+      return src_len;
+    }
+  else
+    {
+      max = (src_len > MIN_CHUNK) ? src_len : MIN_CHUNK;
+      dest->data = dest->realloc_func(dest->data, max);
+      if (dest->data == NULL)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_MEMORY_ERROR;
+        }
+      dest->max_length = MAX (MIN_CHUNK, src_len);
+
+      memcpy(dest->data, src, src_len);
+      dest->length = src_len;
+
+      return src_len;
+    }
+}
+
+int _gnutls_string_append_str(gnutls_string * dest,
+                              const char *src)
+{
+  size_t src_len = strlen(src);
+  size_t tot_len = src_len + dest->length;
+
+  if (dest->max_length >= tot_len)
+    {
+      memcpy(&dest->data[dest->length], src, src_len);
+      dest->length = tot_len;
+
+      return tot_len;
+    }
+  else
+    {
+      size_t new_len=
+        MAX (src_len, MIN_CHUNK) + MAX (dest->max_length, MIN_CHUNK);
+
+      dest->data = dest->realloc_func(dest->data, new_len);
+      if (dest->data == NULL)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_MEMORY_ERROR;
+        }
+      dest->max_length = new_len;
+
+      memcpy(&dest->data[dest->length], src, src_len);
+      dest->length = tot_len;
+
+      return tot_len;
+    }
+}
+
+int _gnutls_string_append_data(gnutls_string * dest,
+                               const void *data,
+                               size_t data_size)
+{
+  size_t tot_len = data_size + dest->length;
+
+  if (dest->max_length >= tot_len)
+    {
+      memcpy(&dest->data[dest->length], data, data_size);
+      dest->length = tot_len;
+
+      return tot_len;
+    }
+  else
+    {
+      size_t new_len=
+        MAX (data_size, MIN_CHUNK) + MAX (dest->max_length, MIN_CHUNK);
+
+      dest->data = dest->realloc_func(dest->data, new_len);
+      if (dest->data == NULL)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_MEMORY_ERROR;
+        }
+      dest->max_length = new_len;
+
+      memcpy(&dest->data[dest->length], data, data_size);
+      dest->length = tot_len;
+
+      return tot_len;
+    }
+}
+
+int _gnutls_string_append_printf(gnutls_string * dest,
+                                 const char *fmt,
+                                 ...)
+{
+  va_list args;
+  int len;
+  char *str;
+
+  va_start(args, fmt);
+  len = vasprintf(&str, fmt, args);
+  va_end(args);
+
+  if (len < 0 || !str)
+    return -1;
+
+  len = _gnutls_string_append_str(dest, str);
+
+  free(str);
+
+  return len;
+}
+
+/* Converts the given string (old) to hex. A buffer must be provided
+ * to hold the new hex string. The new string will be null terminated.
+ * If the buffer does not have enough space to hold the string, a
+ * truncated hex string is returned (always null terminated).
+ */
+char * _gnutls_bin2hex(const void *_old,
+                       size_t oldlen,
+                       char *buffer,
+                       size_t buffer_size)
+{
+  unsigned int i, j;
+  const opaque *old = _old;
+
+  for (i = j = 0; i < oldlen && j + 2 < buffer_size; j += 2)
+    {
+      sprintf(&buffer[j], "%.2x", old[i]);
+      i++;
+    }
+  buffer[j] = '\0';
+
+  return buffer;
+}
+
+/* just a hex2bin function.
+ */
+int _gnutls_hex2bin(const opaque * hex_data,
+                    int hex_size,
+                    opaque * bin_data,
+                    size_t * bin_size)
+{
+  int i, j;
+  opaque hex2_data[3];
+  unsigned long val;
+
+  /* FIXME: we don't handle whitespace.
+   */
+  hex_size /= 2;
+
+  if (*bin_size < (size_t) hex_size)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_SHORT_MEMORY_BUFFER;
+    }
+
+  for (i = j = 0; j < hex_size; i += 2, j++)
+    {
+      hex2_data[0] = hex_data[i];
+      hex2_data[1] = hex_data[i + 1];
+      hex2_data[2] = 0;
+      val = strtoul((char *) hex2_data, NULL, 16);
+      if (val == ULONG_MAX)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_SRP_PWD_PARSING_ERROR;
+        }
+      bin_data[j] = val;
+    }
+
+  return 0;
+}
diff --git a/src/daemon/https/tls/gnutls_str.h b/src/daemon/https/tls/gnutls_str.h
new file mode 100644
index 00000000..c805d70f
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_str.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#ifndef GNUTLS_STR_H
+# define GNUTLS_STR_H
+
+#include <gnutls_int.h>
+
+#define MAX(X,Y) ((X) > (Y) ? (X) : (Y));
+
+void _gnutls_str_cpy (char *dest, size_t dest_tot_size, const char *src);
+void _gnutls_mem_cpy (char *dest, size_t dest_tot_size, const char *src,
+                      size_t src_size);
+void _gnutls_str_cat (char *dest, size_t dest_tot_size, const char *src);
+
+typedef struct
+{
+  opaque * data;
+  size_t max_length;
+  size_t length;
+  gnutls_realloc_function realloc_func;
+  gnutls_alloc_function alloc_func;
+  gnutls_free_function free_func;
+} gnutls_string;
+
+void _gnutls_string_init (gnutls_string *, gnutls_alloc_function,
+                          gnutls_realloc_function, gnutls_free_function);
+void _gnutls_string_clear (gnutls_string *);
+
+/* Beware, do not clear the string, after calling this
+ * function
+ */
+gnutls_datum_t _gnutls_string2datum (gnutls_string * str);
+
+int _gnutls_string_copy_str (gnutls_string * dest, const char *src);
+int _gnutls_string_append_str (gnutls_string *, const char *str);
+int _gnutls_string_append_data (gnutls_string *, const void *data,
+                                size_t data_size);
+int _gnutls_string_append_printf (gnutls_string * dest, const char *fmt, ...);
+
+char *_gnutls_bin2hex (const void *old, size_t oldlen, char *buffer,
+                       size_t buffer_size);
+int _gnutls_hex2bin (const opaque * hex_data, int hex_size, opaque * bin_data,
+                     size_t * bin_size);
+
+#endif
diff --git a/src/daemon/https/tls/gnutls_supplemental.c b/src/daemon/https/tls/gnutls_supplemental.c
new file mode 100644
index 00000000..a47b9aaa
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_supplemental.c
@@ -0,0 +1,207 @@
+/*
+ * Copyright (C) 2007 Free Software Foundation
+ *
+ * Author: Simon Josefsson
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* This file contains support functions for 'TLS Handshake Message for
+ * Supplemental Data' (RFC 4680).
+ *
+ * The idea here is simple.  gnutls_handshake() in gnuts_handshake.c
+ * will call _gnutls_gen_supplemental and _gnutls_parse_supplemental
+ * when some extension requested that supplemental data be sent or
+ * received.  Extension request this by setting the flags
+ * do_recv_supplemental or do_send_supplemental in the session.
+ *
+ * The functions in this file iterate through the _gnutls_supplemental
+ * array, and calls the send/recv functions for each respective data
+ * type.
+ *
+ * The receive function of each data type is responsible for decoding
+ * its own data.  If the extension did not expect to receive
+ * supplemental data, it should return GNUTLS_E_UNEXPECTED_PACKET.
+ * Otherwise, it just parse the data as normal.
+ *
+ * The send function needs to append the 2-byte data format type, and
+ * append the 2-byte length of its data, and the data.  If it doesn't
+ * want to send any data, it is fine to return without doing anything.
+ */
+
+#include "gnutls_int.h"
+#include "gnutls_supplemental.h"
+#include "gnutls_errors.h"
+#include "gnutls_num.h"
+
+typedef int (*supp_recv_func) (gnutls_session_t session,
+                               const opaque * data, size_t data_size);
+typedef int (*supp_send_func) (gnutls_session_t session, gnutls_buffer * buf);
+
+typedef struct
+{
+  const char *name;
+  gnutls_supplemental_data_format_type_t type;
+  supp_recv_func supp_recv_func;
+  supp_send_func supp_send_func;
+} gnutls_supplemental_entry;
+
+gnutls_supplemental_entry _gnutls_supplemental[] = {
+  {0, 0, 0, 0}
+};
+
+const char *
+gnutls_supplemental_get_name (gnutls_supplemental_data_format_type_t type)
+{
+  gnutls_supplemental_entry *p;
+
+  for (p = _gnutls_supplemental; p->name != NULL; p++)
+    if (p->type == type)
+      return p->name;
+
+  return NULL;
+}
+
+static supp_recv_func
+get_supp_func_recv (gnutls_supplemental_data_format_type_t type)
+{
+  gnutls_supplemental_entry *p;
+
+  for (p = _gnutls_supplemental; p->name != NULL; p++)
+    if (p->type == type)
+      return p->supp_recv_func;
+
+  return NULL;
+}
+
+int
+_gnutls_gen_supplemental (gnutls_session_t session, gnutls_buffer * buf)
+{
+  gnutls_supplemental_entry *p;
+  int ret;
+
+  /* Make room for 3 byte length field. */
+  ret = _gnutls_buffer_append (buf, "\0\0\0", 3);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  for (p = _gnutls_supplemental; p->name; p++)
+    {
+      supp_send_func supp_send = p->supp_send_func;
+      size_t sizepos = buf->length;
+      int ret;
+
+      /* Make room for supplement type and length byte length field. */
+      ret = _gnutls_buffer_append (buf, "\0\0\0\0", 4);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      ret = supp_send (session, buf);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      /* If data were added, store type+length, otherwise reset. */
+      if (buf->length > sizepos + 4)
+        {
+          buf->data[sizepos] = 0;
+          buf->data[sizepos + 1] = p->type;
+          buf->data[sizepos + 2] = ((buf->length - sizepos - 4) >> 8) & 0xFF;
+          buf->data[sizepos + 3] = (buf->length - sizepos - 4) & 0xFF;
+        }
+      else
+        buf->length -= 4;
+    }
+
+  buf->data[0] = ((buf->length - 3) >> 16) & 0xFF;
+  buf->data[1] = ((buf->length - 3) >> 8) & 0xFF;
+  buf->data[2] = (buf->length - 3) & 0xFF;
+
+  _gnutls_debug_log ("EXT[%x]: Sending %d bytes of supplemental data\n",
+                     session, buf->length);
+
+  return buf->length;
+}
+
+int
+_gnutls_parse_supplemental (gnutls_session_t session,
+                            const uint8_t * data, int datalen)
+{
+  const opaque *p = data;
+  ssize_t dsize = datalen;
+  size_t total_size;
+
+  DECR_LEN (dsize, 3);
+  total_size = _gnutls_read_uint24 (p);
+  p += 3;
+
+  if (dsize != total_size)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER;
+    }
+
+  do
+    {
+      uint16_t supp_data_type;
+      uint16_t supp_data_length;
+      supp_recv_func recv_func;
+
+      DECR_LEN (dsize, 2);
+      supp_data_type = _gnutls_read_uint16 (p);
+      p += 2;
+
+      DECR_LEN (dsize, 2);
+      supp_data_length = _gnutls_read_uint16 (p);
+      p += 2;
+
+      _gnutls_debug_log ("EXT[%x]: Got supplemental type=%02x length=%d\n",
+                         session, supp_data_type, supp_data_length);
+
+      recv_func = get_supp_func_recv (supp_data_type);
+      if (recv_func)
+        {
+          int ret = recv_func (session, p, supp_data_length);
+          if (ret < 0)
+            {
+              gnutls_assert ();
+              return ret;
+            }
+        }
+      else
+        {
+          gnutls_assert ();
+          return GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER;
+        }
+
+      DECR_LEN (dsize, supp_data_length);
+      p += supp_data_length;
+    }
+  while (dsize > 0);
+
+  return 0;
+}
diff --git a/src/daemon/https/tls/gnutls_supplemental.h b/src/daemon/https/tls/gnutls_supplemental.h
new file mode 100644
index 00000000..0b9c1207
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_supplemental.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2007 Free Software Foundation
+ *
+ * Author: Simon Josefsson
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include <gnutls_int.h>
+
+int _gnutls_parse_supplemental (gnutls_session_t session,
+                                const uint8_t *data,
+                                int data_size);
+int _gnutls_gen_supplemental (gnutls_session_t session,
+                              gnutls_buffer *buf);
diff --git a/src/daemon/https/tls/gnutls_ui.c b/src/daemon/https/tls/gnutls_ui.c
new file mode 100644
index 00000000..49ed2e96
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_ui.c
@@ -0,0 +1,627 @@
+/*
+ * Copyright (C) 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* This file contains certificate authentication functions to be exported in the
+ * API and did not fit elsewhere.
+ */
+
+#include <gnutls_int.h>
+#include <auth_anon.h>
+#include <auth_cert.h>
+#include <gnutls_errors.h>
+#include <gnutls_auth_int.h>
+#include <gnutls_state.h>
+#include <gnutls_datum.h>
+
+/* ANON & DHE */
+
+/**
+ * gnutls_dh_set_prime_bits - Used to set the bits for a DH ciphersuite
+ * @session: is a #gnutls_session_t structure.
+ * @bits: is the number of bits
+ *
+ * This function sets the number of bits, for use in an 
+ * Diffie Hellman key exchange. This is used both in DH ephemeral and
+ * DH anonymous cipher suites. This will set the
+ * minimum size of the prime that will be used for the handshake.
+ *
+ * In the client side it sets the minimum accepted number of bits.
+ * If a server sends a prime with less bits than that 
+ * GNUTLS_E_DH_PRIME_UNACCEPTABLE will be returned by the
+ * handshake.
+ *
+ **/
+void
+gnutls_dh_set_prime_bits (gnutls_session_t session, unsigned int bits)
+{
+  session->internals.dh_prime_bits = bits;
+}
+
+/**
+ * gnutls_dh_get_group - This function returns the group of the DH authentication
+ * @session: is a gnutls session
+ * @raw_gen: will hold the generator.
+ * @raw_prime: will hold the prime.
+ *
+ * This function will return the group parameters used in the last Diffie Hellman 
+ * authentication with the peer. These are the prime and the generator used.
+ * This function should be used for both anonymous and ephemeral diffie Hellman.
+ * The output parameters must be freed with gnutls_free().
+ *
+ * Returns a negative value in case of an error.
+ *
+ **/
+int
+gnutls_dh_get_group (gnutls_session_t session,
+                     gnutls_datum_t * raw_gen, gnutls_datum_t * raw_prime)
+{
+  dh_info_st *dh;
+  int ret;
+  anon_auth_info_t anon_info;
+  cert_auth_info_t cert_info;
+
+  switch (gnutls_auth_get_type (session))
+    {
+    case GNUTLS_CRD_ANON:
+      anon_info = _gnutls_get_auth_info (session);
+      if (anon_info == NULL)
+        return GNUTLS_E_INTERNAL_ERROR;
+      dh = &anon_info->dh;
+      break;
+    case GNUTLS_CRD_CERTIFICATE:
+      cert_info = _gnutls_get_auth_info (session);
+      if (cert_info == NULL)
+        return GNUTLS_E_INTERNAL_ERROR;
+      dh = &cert_info->dh;
+      break;
+    default:
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  ret = _gnutls_set_datum (raw_prime, dh->prime.data, dh->prime.size);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  ret = _gnutls_set_datum (raw_gen, dh->generator.data, dh->generator.size);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      _gnutls_free_datum (raw_prime);
+      return ret;
+    }
+
+  return 0;
+}
+
+/**
+ * gnutls_dh_get_pubkey - This function returns the peer's public key used in DH authentication
+ * @session: is a gnutls session
+ * @raw_key: will hold the public key.
+ *
+ * This function will return the peer's public key used in the last Diffie Hellman authentication.
+ * This function should be used for both anonymous and ephemeral diffie Hellman.
+ * The output parameters must be freed with gnutls_free().
+ *
+ * Returns a negative value in case of an error.
+ *
+ **/
+int
+gnutls_dh_get_pubkey (gnutls_session_t session, gnutls_datum_t * raw_key)
+{
+  dh_info_st *dh;
+  anon_auth_info_t anon_info;
+  cert_auth_info_t cert_info;
+  cert_auth_info_t psk_info;
+
+  switch (gnutls_auth_get_type (session))
+    {
+    case GNUTLS_CRD_ANON:
+      {
+        anon_info = _gnutls_get_auth_info (session);
+        if (anon_info == NULL)
+          return GNUTLS_E_INTERNAL_ERROR;
+        dh = &anon_info->dh;
+        break;
+      }
+    case GNUTLS_CRD_PSK:
+      {
+        psk_info = _gnutls_get_auth_info (session);
+        if (psk_info == NULL)
+          return GNUTLS_E_INTERNAL_ERROR;
+        dh = &psk_info->dh;
+        break;
+      }
+    case GNUTLS_CRD_CERTIFICATE:
+      {
+
+        cert_info = _gnutls_get_auth_info (session);
+        if (cert_info == NULL)
+          return GNUTLS_E_INTERNAL_ERROR;
+        dh = &cert_info->dh;
+        break;
+      }
+    default:
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return _gnutls_set_datum (raw_key, dh->public_key.data,
+                            dh->public_key.size);
+}
+
+/**
+ * gnutls_rsa_export_get_pubkey - This function returns the peer's public key used in RSA-EXPORT authentication
+ * @session: is a gnutls session
+ * @exponent: will hold the exponent.
+ * @modulus: will hold the modulus.
+ *
+ * This function will return the peer's public key exponent and
+ * modulus used in the last RSA-EXPORT authentication.  The output
+ * parameters must be freed with gnutls_free().
+ *
+ * Returns a negative value in case of an error.
+ *
+ **/
+int
+gnutls_rsa_export_get_pubkey (gnutls_session_t session,
+                              gnutls_datum_t * exponent,
+                              gnutls_datum_t * modulus)
+{
+  cert_auth_info_t info;
+  int ret;
+
+  if (gnutls_auth_get_type (session) == GNUTLS_CRD_CERTIFICATE)
+    {
+      info = _gnutls_get_auth_info (session);
+      if (info == NULL)
+        return GNUTLS_E_INTERNAL_ERROR;
+
+      ret = _gnutls_set_datum (modulus, info->rsa_export.modulus.data,
+                               info->rsa_export.modulus.size);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      ret = _gnutls_set_datum (exponent, info->rsa_export.exponent.data,
+                               info->rsa_export.exponent.size);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          _gnutls_free_datum (modulus);
+          return ret;
+        }
+
+      return 0;
+    }
+
+  return GNUTLS_E_INVALID_REQUEST;
+}
+
+/**
+ * gnutls_dh_get_secret_bits - This function returns the bits used in DH authentication
+ * @session: is a gnutls session
+ *
+ * This function will return the bits used in the last Diffie Hellman authentication
+ * with the peer. Should be used for both anonymous and ephemeral diffie Hellman.
+ * Returns a negative value in case of an error.
+ *
+ **/
+int
+gnutls_dh_get_secret_bits (gnutls_session_t session)
+{
+  switch (gnutls_auth_get_type (session))
+    {
+    case GNUTLS_CRD_ANON:
+      {
+        anon_auth_info_t info;
+
+        info = _gnutls_get_auth_info (session);
+        if (info == NULL)
+          return GNUTLS_E_INTERNAL_ERROR;
+        return info->dh.secret_bits;
+      }
+    case GNUTLS_CRD_CERTIFICATE:
+      {
+        cert_auth_info_t info;
+
+        info = _gnutls_get_auth_info (session);
+        if (info == NULL)
+          return GNUTLS_E_INTERNAL_ERROR;
+
+        return info->dh.secret_bits;
+      }
+    default:
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+}
+
+/**
+ * gnutls_dh_get_prime_bits - This function returns the bits used in DH authentication
+ * @session: is a gnutls session
+ *
+ * This function will return the bits of the prime used in the last Diffie Hellman authentication
+ * with the peer. Should be used for both anonymous and ephemeral diffie Hellman.
+ * Returns a negative value in case of an error.
+ *
+ **/
+int
+gnutls_dh_get_prime_bits (gnutls_session_t session)
+{
+  dh_info_st *dh;
+
+  switch (gnutls_auth_get_type (session))
+    {
+    case GNUTLS_CRD_ANON:
+      {
+        anon_auth_info_t info;
+
+        info = _gnutls_get_auth_info (session);
+        if (info == NULL)
+          return GNUTLS_E_INTERNAL_ERROR;
+        dh = &info->dh;
+        break;
+      }
+    case GNUTLS_CRD_CERTIFICATE:
+      {
+        cert_auth_info_t info;
+
+        info = _gnutls_get_auth_info (session);
+        if (info == NULL)
+          return GNUTLS_E_INTERNAL_ERROR;
+
+        dh = &info->dh;
+        break;
+      }
+    default:
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return (dh->prime.size) * 8;
+
+}
+
+/**
+ * gnutls_rsa_export_get_modulus_bits - This function returns the bits used in RSA-export key exchange
+ * @session: is a gnutls session
+ *
+ * This function will return the bits used in the last RSA-EXPORT key exchange
+ * with the peer. 
+ * Returns a negative value in case of an error.
+ *
+ **/
+int
+gnutls_rsa_export_get_modulus_bits (gnutls_session_t session)
+{
+  cert_auth_info_t info;
+
+  info = _gnutls_get_auth_info (session);
+  if (info == NULL)
+    return GNUTLS_E_INTERNAL_ERROR;
+
+  return info->rsa_export.modulus.size * 8;
+}
+
+/**
+ * gnutls_dh_get_peers_public_bits - This function returns the bits used in DH authentication
+ * @session: is a gnutls session
+ *
+ * This function will return the bits used in the last Diffie Hellman authentication
+ * with the peer. Should be used for both anonymous and ephemeral diffie Hellman.
+ * Returns a negative value in case of an error.
+ *
+ **/
+int
+gnutls_dh_get_peers_public_bits (gnutls_session_t session)
+{
+  dh_info_st *dh;
+
+  switch (gnutls_auth_get_type (session))
+    {
+    case GNUTLS_CRD_ANON:
+      {
+        anon_auth_info_t info;
+
+        info = _gnutls_get_auth_info (session);
+        if (info == NULL)
+          return GNUTLS_E_INTERNAL_ERROR;
+
+        dh = &info->dh;
+        break;
+      }
+    case GNUTLS_CRD_CERTIFICATE:
+      {
+        cert_auth_info_t info;
+
+        info = _gnutls_get_auth_info (session);
+        if (info == NULL)
+          return GNUTLS_E_INTERNAL_ERROR;
+
+        dh = &info->dh;
+        break;
+      }
+    default:
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  return dh->public_key.size * 8;
+
+}
+
+/* CERTIFICATE STUFF */
+
+/**
+ * gnutls_certificate_get_ours - This function returns the raw certificate sent in the last handshake
+ * @session: is a gnutls session
+ *
+ * This function will return the certificate as sent to the peer,
+ * in the last handshake. These certificates are in raw format. 
+ * In X.509 this is a certificate list. In OpenPGP this is a single
+ * certificate.
+ * Returns NULL in case of an error, or if no certificate was used.
+ *
+ **/
+const gnutls_datum_t *
+gnutls_certificate_get_ours (gnutls_session_t session)
+{
+  gnutls_certificate_credentials_t cred;
+
+  CHECK_AUTH (GNUTLS_CRD_CERTIFICATE, NULL);
+
+  cred
+    = (gnutls_certificate_credentials_t) _gnutls_get_cred (session->key,
+                                                           GNUTLS_CRD_CERTIFICATE,
+                                                           NULL);
+  if (cred == NULL || cred->cert_list == NULL)
+    {
+      gnutls_assert ();
+      return NULL;
+    }
+
+  if (session->internals.selected_cert_list == NULL)
+    return NULL;
+
+  return &session->internals.selected_cert_list[0].raw;
+}
+
+/**
+ * gnutls_certificate_get_peers - This function returns the peer's raw certificate
+ * @session: is a gnutls session
+ * @list_size: is the length of the certificate list
+ *
+ * This function will return the peer's raw certificate (chain) as 
+ * sent by the peer. These certificates are in raw format (DER encoded 
+ * for X.509). In case of a X.509 then a certificate list may be present. 
+ * The first certificate in the list is the peer's certificate,
+ * following the issuer's certificate, then the issuer's issuer etc.
+ *
+ * In case of OpenPGP keys a single key will be returned
+ * in raw format.
+ *
+ * Returns NULL in case of an error, or if no certificate was sent.
+ *
+ **/
+const gnutls_datum_t *
+gnutls_certificate_get_peers (gnutls_session_t
+                              session, unsigned int *list_size)
+{
+  cert_auth_info_t info;
+
+  CHECK_AUTH (GNUTLS_CRD_CERTIFICATE, NULL);
+
+  info = _gnutls_get_auth_info (session);
+  if (info == NULL)
+    return NULL;
+
+  *list_size = info->ncerts;
+  return info->raw_certificate_list;
+}
+
+/**
+ * gnutls_certificate_client_get_request_status - This function returns the certificate request status
+ * @session: is a gnutls session
+ *
+ * This function will return 0 if the peer (server) did not request client
+ * authentication or 1 otherwise.
+ * Returns a negative value in case of an error.
+ *
+ **/
+int
+gnutls_certificate_client_get_request_status (gnutls_session_t session)
+{
+  cert_auth_info_t info;
+
+  CHECK_AUTH (GNUTLS_CRD_CERTIFICATE, 0);
+
+  info = _gnutls_get_auth_info (session);
+  if (info == NULL)
+    return GNUTLS_E_INTERNAL_ERROR;
+  return info->certificate_requested;
+}
+
+/**
+ * gnutls_fingerprint - This function calculates the fingerprint of the given data
+ * @algo: is a digest algorithm
+ * @data: is the data
+ * @result: is the place where the result will be copied (may be null). 
+ * @result_size: should hold the size of the result. The actual size
+ * of the returned result will also be copied there.
+ *
+ * This function will calculate a fingerprint (actually a hash), of the
+ * given data. The result is not printable data. You should convert it
+ * to hex, or to something else printable.
+ *
+ * This is the usual way to calculate a fingerprint of an X.509 
+ * DER encoded certificate. Note however that the fingerprint 
+ * of an OpenPGP is not just a hash and cannot be calculated with
+ * this function.
+ *
+ * Returns a negative value in case of an error.
+ *
+ **/
+int
+gnutls_fingerprint (gnutls_digest_algorithm_t algo,
+                    const gnutls_datum_t * data,
+                    void *result, size_t * result_size)
+{
+  GNUTLS_HASH_HANDLE td;
+  int hash_len = _gnutls_hash_get_algo_len (HASH2MAC (algo));
+
+  if (hash_len < 0 || (unsigned) hash_len > *result_size || result == NULL)
+    {
+      *result_size = hash_len;
+      return GNUTLS_E_SHORT_MEMORY_BUFFER;
+    }
+  *result_size = hash_len;
+
+  if (result)
+    {
+      td = _gnutls_hash_init (HASH2MAC (algo));
+      if (td == NULL)
+        return GNUTLS_E_HASH_FAILED;
+
+      _gnutls_hash (td, data->data, data->size);
+
+      _gnutls_hash_deinit (td, result);
+    }
+
+  return 0;
+}
+
+/**
+ * gnutls_certificate_set_dh_params - This function will set the DH parameters for a server to use
+ * @res: is a gnutls_certificate_credentials_t structure
+ * @dh_params: is a structure that holds diffie hellman parameters.
+ *
+ * This function will set the diffie hellman parameters for a
+ * certificate server to use. These parameters will be used in
+ * Ephemeral Diffie Hellman cipher suites.  Note that only a pointer
+ * to the parameters are stored in the certificate handle, so if you
+ * deallocate the parameters before the certificate is deallocated,
+ * you must change the parameters stored in the certificate first.
+ *
+ **/
+void
+gnutls_certificate_set_dh_params (gnutls_certificate_credentials_t res,
+                                  gnutls_dh_params_t dh_params)
+{
+  res->dh_params = dh_params;
+}
+
+/**
+ * gnutls_certificate_set_params_function - This function will set the DH or RSA parameters callback
+ * @res: is a gnutls_certificate_credentials_t structure
+ * @func: is the function to be called
+ *
+ * This function will set a callback in order for the server to get the 
+ * diffie hellman or RSA parameters for certificate authentication. The callback
+ * should return zero on success.
+ *
+ **/
+void
+gnutls_certificate_set_params_function (gnutls_certificate_credentials_t res,
+                                        gnutls_params_function * func)
+{
+  res->params_func = func;
+}
+
+/**
+ * gnutls_certificate_set_verify_flags - This function will set the flags to be used at certificate verification
+ * @res: is a gnutls_certificate_credentials_t structure
+ * @flags: are the flags
+ *
+ * This function will set the flags to be used at verification of the
+ * certificates.  Flags must be OR of the
+ * #gnutls_certificate_verify_flags enumerations.
+ *
+ **/
+void
+gnutls_certificate_set_verify_flags (gnutls_certificate_credentials_t
+                                     res, unsigned int flags)
+{
+  res->verify_flags = flags;
+}
+
+/**
+ * gnutls_certificate_set_verify_limits - This function will set the upper limits to be used at certificate verification
+ * @res: is a gnutls_certificate_credentials structure
+ * @max_bits: is the number of bits of an acceptable certificate (default 8200)
+ * @max_depth: is maximum depth of the verification of a certificate chain (default 5)
+ *
+ * This function will set some upper limits for the default verification function,
+ * gnutls_certificate_verify_peers2(), to avoid denial of service attacks.
+ * You can set them to zero to disable limits.
+ *
+ **/
+void
+gnutls_certificate_set_verify_limits (gnutls_certificate_credentials_t
+                                      res,
+                                      unsigned int max_bits,
+                                      unsigned int max_depth)
+{
+  res->verify_depth = max_depth;
+  res->verify_bits = max_bits;
+}
+
+/**
+ * gnutls_certificate_set_rsa_export_params - This function will set the RSA parameters for a server to use
+ * @res: is a gnutls_certificate_credentials_t structure
+ * @rsa_params: is a structure that holds temporary RSA parameters.
+ *
+ * This function will set the temporary RSA parameters for a certificate
+ * server to use. These parameters will be used in RSA-EXPORT
+ * cipher suites.
+ *
+ **/
+void
+gnutls_certificate_set_rsa_export_params (gnutls_certificate_credentials_t
+                                          res, gnutls_rsa_params_t rsa_params)
+{
+  res->rsa_params = rsa_params;
+}
+
+/**
+ * gnutls_anon_set_params_function - This function will set the DH or RSA parameters callback
+ * @res: is a gnutls_anon_server_credentials_t structure
+ * @func: is the function to be called
+ *
+ * This function will set a callback in order for the server to get the 
+ * diffie hellman or RSA parameters for anonymous authentication. The callback
+ * should return zero on success.
+ *
+ **/
+void
+gnutls_anon_set_params_function (gnutls_anon_server_credentials_t res,
+                                 gnutls_params_function * func)
+{
+  res->params_func = func;
+}
diff --git a/src/daemon/https/tls/gnutls_v2_compat.c b/src/daemon/https/tls/gnutls_v2_compat.c
new file mode 100644
index 00000000..ecf8c936
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_v2_compat.c
@@ -0,0 +1,259 @@
+/*
+ * Copyright (C) 2001, 2004, 2005, 2006 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* Functions to parse the SSLv2.0 hello message.
+ */
+
+#include "gnutls_int.h"
+#include "gnutls_errors.h"
+#include "gnutls_dh.h"
+#include "debug.h"
+#include "gnutls_algorithms.h"
+#include "gnutls_compress.h"
+#include "gnutls_cipher.h"
+#include "gnutls_buffers.h"
+#include "gnutls_kx.h"
+#include "gnutls_handshake.h"
+#include "gnutls_num.h"
+#include "gnutls_hash_int.h"
+#include "gnutls_db.h"
+#include "gnutls_extensions.h"
+#include "gnutls_auth_int.h"
+
+/* This selects the best supported ciphersuite from the ones provided */
+static int
+_gnutls_handshake_select_v2_suite (gnutls_session_t session,
+                                   opaque * data, int datalen)
+{
+  int i, j, ret;
+  opaque *_data;
+  int _datalen;
+
+  _gnutls_handshake_log ("HSK[%x]: Parsing a version 2.0 client hello.\n",
+                         session);
+
+  _data = gnutls_malloc (datalen);
+  if (_data == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  if (datalen % 3 != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+    }
+
+  i = _datalen = 0;
+  for (j = 0; j < datalen; j += 3)
+    {
+      if (data[j] == 0)
+        {
+          memcpy (&_data[i], &data[j + 1], 2);
+          i += 2;
+          _datalen += 2;
+        }
+    }
+
+  ret = _gnutls_server_select_suite (session, _data, _datalen);
+  gnutls_free (_data);
+
+  return ret;
+
+}
+
+
+/* Read a v2 client hello. Some browsers still use that beast!
+ * However they set their version to 3.0 or 3.1.
+ */
+int
+_gnutls_read_client_hello_v2 (gnutls_session_t session, opaque * data,
+                              int datalen)
+{
+  uint16_t session_id_len = 0;
+  int pos = 0;
+  int ret = 0;
+  uint16_t sizeOfSuites;
+  gnutls_protocol_t adv_version;
+  opaque rnd[TLS_RANDOM_SIZE];
+  int len = datalen;
+  int err;
+  uint16_t challenge;
+  opaque session_id[TLS_MAX_SESSION_ID_SIZE];
+
+  /* we only want to get here once - only in client hello */
+  session->internals.v2_hello = 0;
+
+  DECR_LEN (len, 2);
+
+  _gnutls_handshake_log
+    ("HSK[%x]: SSL 2.0 Hello: Client's version: %d.%d\n", session,
+     data[pos], data[pos + 1]);
+
+  set_adv_version (session, data[pos], data[pos + 1]);
+
+  adv_version = _gnutls_version_get (data[pos], data[pos + 1]);
+
+  ret = _gnutls_negotiate_version (session, adv_version);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  pos += 2;
+
+  /* Read uint16_t cipher_spec_length */
+  DECR_LEN (len, 2);
+  sizeOfSuites = _gnutls_read_uint16 (&data[pos]);
+  pos += 2;
+
+  /* read session id length */
+  DECR_LEN (len, 2);
+  session_id_len = _gnutls_read_uint16 (&data[pos]);
+  pos += 2;
+
+  if (session_id_len > TLS_MAX_SESSION_ID_SIZE)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
+    }
+
+  /* read challenge length */
+  DECR_LEN (len, 2);
+  challenge = _gnutls_read_uint16 (&data[pos]);
+  pos += 2;
+
+  if (challenge < 16 || challenge > TLS_RANDOM_SIZE)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_UNSUPPORTED_VERSION_PACKET;
+    }
+
+  /* call the user hello callback
+   */
+  ret = _gnutls_user_hello_func (session, adv_version);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  /* find an appropriate cipher suite */
+
+  DECR_LEN (len, sizeOfSuites);
+  ret = _gnutls_handshake_select_v2_suite (session, &data[pos], sizeOfSuites);
+
+  pos += sizeOfSuites;
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  /* check if the credentials (username, public key etc.) are ok
+   */
+  if (_gnutls_get_kx_cred
+      (session,
+       _gnutls_cipher_suite_get_kx_algo (&session->security_parameters.
+                                         current_cipher_suite),
+       &err) == NULL && err != 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
+    }
+
+  /* set the mod_auth_st to the appropriate struct
+   * according to the KX algorithm. This is needed since all the
+   * handshake functions are read from there;
+   */
+  session->internals.auth_struct =
+    _gnutls_kx_auth_struct (_gnutls_cipher_suite_get_kx_algo
+                            (&session->security_parameters.
+                             current_cipher_suite));
+  if (session->internals.auth_struct == NULL)
+    {
+
+      _gnutls_handshake_log
+        ("HSK[%x]: SSL 2.0 Hello: Cannot find the appropriate handler for the KX algorithm\n",
+         session);
+
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+
+
+  /* read random new values -skip session id for now */
+  DECR_LEN (len, session_id_len);       /* skip session id for now */
+  memcpy (session_id, &data[pos], session_id_len);
+  pos += session_id_len;
+
+  DECR_LEN (len, challenge);
+  memset (rnd, 0, TLS_RANDOM_SIZE);
+
+  memcpy (&rnd[TLS_RANDOM_SIZE - challenge], &data[pos], challenge);
+
+  _gnutls_set_client_random (session, rnd);
+
+  /* generate server random value */
+
+  _gnutls_tls_create_random (rnd);
+  _gnutls_set_server_random (session, rnd);
+
+  session->security_parameters.timestamp = time (NULL);
+
+
+  /* RESUME SESSION */
+
+  DECR_LEN (len, session_id_len);
+  ret = _gnutls_server_restore_session (session, session_id, session_id_len);
+
+  if (ret == 0)
+    {                           /* resumed! */
+      /* get the new random values */
+      memcpy (session->internals.resumed_security_parameters.
+              server_random, session->security_parameters.server_random,
+              TLS_RANDOM_SIZE);
+      memcpy (session->internals.resumed_security_parameters.
+              client_random, session->security_parameters.client_random,
+              TLS_RANDOM_SIZE);
+
+      session->internals.resumed = RESUME_TRUE;
+      return 0;
+    }
+  else
+    {
+      _gnutls_generate_session_id (session->security_parameters.
+                                   session_id,
+                                   &session->security_parameters.
+                                   session_id_size);
+      session->internals.resumed = RESUME_FALSE;
+    }
+
+  session->internals.compression_method = GNUTLS_COMP_NULL;
+
+  return 0;
+}
diff --git a/src/daemon/https/tls/gnutls_v2_compat.h b/src/daemon/https/tls/gnutls_v2_compat.h
new file mode 100644
index 00000000..59ee6130
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_v2_compat.h
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+int _gnutls_read_client_hello_v2 (gnutls_session_t session, opaque * data,
+                                  int datalen);
diff --git a/src/daemon/https/tls/gnutls_x509.c b/src/daemon/https/tls/gnutls_x509.c
new file mode 100644
index 00000000..29d20957
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_x509.c
@@ -0,0 +1,1991 @@
+/*
+ * Copyright (C) 2002, 2003, 2004, 2005, 2006, 2007 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include <gnutls_int.h>
+#include "gnutls_auth_int.h"
+#include "gnutls_errors.h"
+#include <gnutls_cert.h>
+#include <auth_cert.h>
+#include "gnutls_dh.h"
+#include "gnutls_num.h"
+#include "libtasn1.h"
+#include "gnutls_datum.h"
+#include <gnutls_pk.h>
+#include <gnutls_algorithms.h>
+#include <gnutls_global.h>
+#include <gnutls_record.h>
+#include <gnutls_sig.h>
+#include <gnutls_state.h>
+#include <gnutls_pk.h>
+#include <gnutls_str.h>
+#include <debug.h>
+#include <x509_b64.h>
+#include <gnutls_x509.h>
+#include <read-file.h>
+
+/* x509 */
+#include "common.h"
+#include "x509.h"
+#include "verify.h"
+#include "mpi.h"
+#include "pkcs7.h"
+#include "privkey.h"
+
+
+/*
+ * some x509 certificate parsing functions.
+ */
+
+/* Check if the number of bits of the key in the certificate
+ * is unacceptable.
+  */
+inline static int
+check_bits (gnutls_x509_crt_t crt, unsigned int max_bits)
+{
+  int ret;
+  unsigned int bits;
+
+  ret = gnutls_x509_crt_get_pk_algorithm (crt, &bits);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  if (bits > max_bits && max_bits > 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_CONSTRAINT_ERROR;
+    }
+
+  return 0;
+}
+
+
+#define CLEAR_CERTS for(x=0;x<peer_certificate_list_size;x++) { \
+        if (peer_certificate_list[x]) \
+                gnutls_x509_crt_deinit(peer_certificate_list[x]); \
+        } \
+        gnutls_free( peer_certificate_list)
+
+/*-
+  * _gnutls_x509_cert_verify_peers - This function returns the peer's certificate status
+  * @session: is a gnutls session
+  *
+  * This function will try to verify the peer's certificate and return its status (TRUSTED, REVOKED etc.). 
+  * The return value (status) should be one of the gnutls_certificate_status_t enumerated elements.
+  * However you must also check the peer's name in order to check if the verified certificate belongs to the 
+  * actual peer. Returns a negative error code in case of an error, or GNUTLS_E_NO_CERTIFICATE_FOUND if no certificate was sent.
+  *
+  -*/
+int
+_gnutls_x509_cert_verify_peers (gnutls_session_t session,
+                                unsigned int *status)
+{
+  cert_auth_info_t info;
+  gnutls_certificate_credentials_t cred;
+  gnutls_x509_crt_t *peer_certificate_list;
+  int peer_certificate_list_size, i, x, ret;
+
+  CHECK_AUTH (GNUTLS_CRD_CERTIFICATE, GNUTLS_E_INVALID_REQUEST);
+
+  info = _gnutls_get_auth_info (session);
+  if (info == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  cred = (gnutls_certificate_credentials_t)
+    _gnutls_get_cred (session->key, GNUTLS_CRD_CERTIFICATE, NULL);
+  if (cred == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
+    }
+
+  if (info->raw_certificate_list == NULL || info->ncerts == 0)
+    return GNUTLS_E_NO_CERTIFICATE_FOUND;
+
+  if (info->ncerts > cred->verify_depth && cred->verify_depth > 0)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_CONSTRAINT_ERROR;
+    }
+
+  /* generate a list of gnutls_certs based on the auth info
+   * raw certs.
+   */
+  peer_certificate_list_size = info->ncerts;
+  peer_certificate_list =
+    gnutls_calloc (1,
+                   peer_certificate_list_size * sizeof (gnutls_x509_crt_t));
+  if (peer_certificate_list == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  for (i = 0; i < peer_certificate_list_size; i++)
+    {
+      ret = gnutls_x509_crt_init (&peer_certificate_list[i]);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          CLEAR_CERTS;
+          return ret;
+        }
+
+      ret =
+        gnutls_x509_crt_import (peer_certificate_list[i],
+                                &info->raw_certificate_list[i],
+                                GNUTLS_X509_FMT_DER);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          CLEAR_CERTS;
+          return ret;
+        }
+
+      ret = check_bits (peer_certificate_list[i], cred->verify_bits);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          CLEAR_CERTS;
+          return ret;
+        }
+
+    }
+
+  /* Verify certificate 
+   */
+  ret =
+    gnutls_x509_crt_list_verify (peer_certificate_list,
+                                 peer_certificate_list_size,
+                                 cred->x509_ca_list, cred->x509_ncas,
+                                 cred->x509_crl_list, cred->x509_ncrls,
+                                 cred->verify_flags, status);
+
+  CLEAR_CERTS;
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return 0;
+}
+
+/*
+ * Read certificates and private keys, from files, memory etc.
+ */
+
+/* returns error if the certificate has different algorithm than
+ * the given key parameters.
+ */
+static int
+_gnutls_check_key_cert_match (gnutls_certificate_credentials_t res)
+{
+  gnutls_datum_t cid;
+  gnutls_datum_t kid;
+  unsigned pk = res->cert_list[res->ncerts - 1][0].subject_pk_algorithm;
+
+  if (res->pkey[res->ncerts - 1].pk_algorithm != pk)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_CERTIFICATE_KEY_MISMATCH;
+    }
+
+  _gnutls_x509_write_rsa_params (res->pkey[res->ncerts - 1].params,
+                                 res->pkey[res->ncerts -
+                                           1].params_size, &kid);
+
+
+  _gnutls_x509_write_rsa_params (res->cert_list[res->ncerts - 1][0].
+                                 params,
+                                 res->cert_list[res->ncerts -
+                                                1][0].params_size, &cid);
+
+  if (cid.size != kid.size)
+    {
+      gnutls_assert ();
+      _gnutls_free_datum (&kid);
+      _gnutls_free_datum (&cid);
+      return GNUTLS_E_CERTIFICATE_KEY_MISMATCH;
+    }
+
+  if (memcmp (kid.data, cid.data, kid.size) != 0)
+    {
+      gnutls_assert ();
+      _gnutls_free_datum (&kid);
+      _gnutls_free_datum (&cid);
+      return GNUTLS_E_CERTIFICATE_KEY_MISMATCH;
+    }
+
+  _gnutls_free_datum (&kid);
+  _gnutls_free_datum (&cid);
+  return 0;
+}
+
+/* Reads a DER encoded certificate list from memory and stores it to
+ * a gnutls_cert structure. This is only called if PKCS7 read fails.
+ * returns the number of certificates parsed (1)
+ */
+static int
+parse_crt_mem (gnutls_cert ** cert_list, unsigned *ncerts,
+               gnutls_x509_crt_t cert)
+{
+  int i;
+  int ret;
+
+  i = *ncerts + 1;
+
+  *cert_list =
+    (gnutls_cert *) gnutls_realloc_fast (*cert_list,
+                                         i * sizeof (gnutls_cert));
+
+  if (*cert_list == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  ret = _gnutls_x509_crt_to_gcert (&cert_list[0][i - 1], cert, 0);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  *ncerts = i;
+
+  return 1;                     /* one certificate parsed */
+}
+
+/* Reads a DER encoded certificate list from memory and stores it to
+ * a gnutls_cert structure. This is only called if PKCS7 read fails.
+ * returns the number of certificates parsed (1)
+ */
+static int
+parse_der_cert_mem (gnutls_cert ** cert_list, unsigned *ncerts,
+                    const void *input_cert, int input_cert_size)
+{
+  gnutls_datum_t tmp;
+  gnutls_x509_crt_t cert;
+  int ret;
+
+  ret = gnutls_x509_crt_init (&cert);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  tmp.data = (opaque *) input_cert;
+  tmp.size = input_cert_size;
+
+  ret = gnutls_x509_crt_import (cert, &tmp, GNUTLS_X509_FMT_DER);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      gnutls_x509_crt_deinit (cert);
+      return ret;
+    }
+
+  ret = parse_crt_mem (cert_list, ncerts, cert);
+  gnutls_x509_crt_deinit (cert);
+
+  return ret;
+}
+
+#define CERT_PEM 1
+
+
+/* Reads a PKCS7 base64 encoded certificate list from memory and stores it to
+ * a gnutls_cert structure.
+ * returns the number of certificate parsed
+ */
+static int
+parse_pkcs7_cert_mem (gnutls_cert ** cert_list, unsigned *ncerts, const
+                      void *input_cert, int input_cert_size, int flags)
+{
+#ifdef ENABLE_PKI
+  int i, j, count;
+  gnutls_datum_t tmp, tmp2;
+  int ret;
+  opaque *pcert = NULL;
+  size_t pcert_size;
+  gnutls_pkcs7_t pkcs7;
+
+  ret = gnutls_pkcs7_init (&pkcs7);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  if (flags & CERT_PEM)
+    ret = gnutls_pkcs7_import (pkcs7, &tmp, GNUTLS_X509_FMT_PEM);
+  else
+    ret = gnutls_pkcs7_import (pkcs7, &tmp, GNUTLS_X509_FMT_DER);
+  if (ret < 0)
+    {
+      /* if we failed to read the structure,
+       * then just try to decode a plain DER
+       * certificate.
+       */
+      gnutls_assert ();
+      gnutls_pkcs7_deinit (pkcs7);
+#endif
+      return parse_der_cert_mem (cert_list, ncerts,
+                                 input_cert, input_cert_size);
+#ifdef ENABLE_PKI
+    }
+
+  i = *ncerts + 1;
+
+  /* tmp now contains the decoded certificate list */
+  tmp.data = (opaque *) input_cert;
+  tmp.size = input_cert_size;
+
+  ret = gnutls_pkcs7_get_crt_count (pkcs7);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      gnutls_pkcs7_deinit (pkcs7);
+      return ret;
+    }
+  count = ret;
+
+  j = count - 1;
+  do
+    {
+      pcert_size = 0;
+      ret = gnutls_pkcs7_get_crt_raw (pkcs7, j, NULL, &pcert_size);
+      if (ret != GNUTLS_E_MEMORY_ERROR)
+        {
+          count--;
+          continue;
+        }
+
+      pcert = gnutls_malloc (pcert_size);
+      if (ret == GNUTLS_E_MEMORY_ERROR)
+        {
+          gnutls_assert ();
+          count--;
+          continue;
+        }
+
+      /* read the certificate
+       */
+      ret = gnutls_pkcs7_get_crt_raw (pkcs7, j, pcert, &pcert_size);
+
+      j--;
+
+      if (ret >= 0)
+        {
+          *cert_list =
+            (gnutls_cert *) gnutls_realloc_fast (*cert_list,
+                                                 i * sizeof (gnutls_cert));
+
+          if (*cert_list == NULL)
+            {
+              gnutls_assert ();
+              gnutls_free (pcert);
+              return GNUTLS_E_MEMORY_ERROR;
+            }
+
+          tmp2.data = pcert;
+          tmp2.size = pcert_size;
+
+          ret =
+            _gnutls_x509_raw_cert_to_gcert (&cert_list[0][i - 1], &tmp2, 0);
+
+          if (ret < 0)
+            {
+              gnutls_assert ();
+              gnutls_pkcs7_deinit (pkcs7);
+              gnutls_free (pcert);
+              return ret;
+            }
+
+          i++;
+        }
+
+      gnutls_free (pcert);
+
+    }
+  while (ret >= 0 && j >= 0);
+
+  *ncerts = i - 1;
+
+  gnutls_pkcs7_deinit (pkcs7);
+  return count;
+#endif
+}
+
+/* Reads a base64 encoded certificate list from memory and stores it to
+ * a gnutls_cert structure. Returns the number of certificate parsed.
+ */
+static int
+parse_pem_cert_mem (gnutls_cert ** cert_list, unsigned *ncerts,
+                    const char *input_cert, int input_cert_size)
+{
+  int size, siz2, i;
+  const char *ptr;
+  opaque *ptr2;
+  gnutls_datum_t tmp;
+  int ret, count;
+
+#ifdef ENABLE_PKI
+  if ((ptr = memmem (input_cert, input_cert_size,
+                     PEM_PKCS7_SEP, sizeof (PEM_PKCS7_SEP) - 1)) != NULL)
+    {
+      size = strlen (ptr);
+
+      ret = parse_pkcs7_cert_mem (cert_list, ncerts, ptr, size, CERT_PEM);
+
+      return ret;
+    }
+#endif
+
+  /* move to the certificate
+   */
+  ptr = memmem (input_cert, input_cert_size,
+                PEM_CERT_SEP, sizeof (PEM_CERT_SEP) - 1);
+  if (ptr == NULL)
+    ptr = memmem (input_cert, input_cert_size,
+                  PEM_CERT_SEP2, sizeof (PEM_CERT_SEP2) - 1);
+
+  if (ptr == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_BASE64_DECODING_ERROR;
+    }
+  size = input_cert_size - (ptr - input_cert);
+
+  i = *ncerts + 1;
+  count = 0;
+
+  do
+    {
+
+      siz2 = _gnutls_fbase64_decode (NULL, ptr, size, &ptr2);
+
+      if (siz2 < 0)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_BASE64_DECODING_ERROR;
+        }
+
+      *cert_list =
+        (gnutls_cert *) gnutls_realloc_fast (*cert_list,
+                                             i * sizeof (gnutls_cert));
+
+      if (*cert_list == NULL)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_MEMORY_ERROR;
+        }
+
+      tmp.data = ptr2;
+      tmp.size = siz2;
+
+      ret = _gnutls_x509_raw_cert_to_gcert (&cert_list[0][i - 1], &tmp, 0);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+      _gnutls_free_datum (&tmp);        /* free ptr2 */
+
+      /* now we move ptr after the pem header 
+       */
+      ptr++;
+      /* find the next certificate (if any)
+       */
+      size = input_cert_size - (ptr - input_cert);
+
+      if (size > 0)
+        {
+          char *ptr3;
+
+          ptr3 = memmem (ptr, size, PEM_CERT_SEP, sizeof (PEM_CERT_SEP) - 1);
+          if (ptr3 == NULL)
+            ptr3 = memmem (ptr, size, PEM_CERT_SEP2,
+                           sizeof (PEM_CERT_SEP2) - 1);
+
+          ptr = ptr3;
+        }
+      else
+        ptr = NULL;
+
+      i++;
+      count++;
+
+    }
+  while (ptr != NULL);
+
+  *ncerts = i - 1;
+
+  return count;
+}
+
+
+
+/* Reads a DER or PEM certificate from memory
+ */
+static int
+read_cert_mem (gnutls_certificate_credentials_t res, const void *cert,
+               int cert_size, gnutls_x509_crt_fmt_t type)
+{
+  int ret;
+
+  /* allocate space for the certificate to add
+   */
+  res->cert_list = gnutls_realloc_fast (res->cert_list,
+                                        (1 +
+                                         res->ncerts) *
+                                        sizeof (gnutls_cert *));
+  if (res->cert_list == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  res->cert_list_length = gnutls_realloc_fast (res->cert_list_length,
+                                               (1 +
+                                                res->ncerts) * sizeof (int));
+  if (res->cert_list_length == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  res->cert_list[res->ncerts] = NULL;   /* for realloc */
+  res->cert_list_length[res->ncerts] = 0;
+
+  if (type == GNUTLS_X509_FMT_DER)
+    ret = parse_pkcs7_cert_mem (&res->cert_list[res->ncerts],
+                                &res->cert_list_length[res->ncerts],
+                                cert, cert_size, 0);
+  else
+    ret =
+      parse_pem_cert_mem (&res->cert_list[res->ncerts],
+                          &res->cert_list_length[res->ncerts], cert,
+                          cert_size);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return ret;
+}
+
+
+int
+_gnutls_x509_privkey_to_gkey (gnutls_privkey * dest,
+                              gnutls_x509_privkey_t src)
+{
+  int i, ret;
+
+  memset (dest, 0, sizeof (gnutls_privkey));
+
+  for (i = 0; i < src->params_size; i++)
+    {
+      dest->params[i] = _gnutls_mpi_copy (src->params[i]);
+      if (dest->params[i] == NULL)
+        {
+          gnutls_assert ();
+          ret = GNUTLS_E_MEMORY_ERROR;
+          goto cleanup;
+        }
+    }
+
+  dest->pk_algorithm = src->pk_algorithm;
+  dest->params_size = src->params_size;
+
+  return 0;
+
+cleanup:
+
+  for (i = 0; i < src->params_size; i++)
+    {
+      _gnutls_mpi_release (&dest->params[i]);
+    }
+  return ret;
+}
+
+void
+_gnutls_gkey_deinit (gnutls_privkey * key)
+{
+  int i;
+  if (key == NULL)
+    return;
+
+  for (i = 0; i < key->params_size; i++)
+    {
+      _gnutls_mpi_release (&key->params[i]);
+    }
+}
+
+int
+_gnutls_x509_raw_privkey_to_gkey (gnutls_privkey * privkey,
+                                  const gnutls_datum_t * raw_key,
+                                  gnutls_x509_crt_fmt_t type)
+{
+  gnutls_x509_privkey_t tmpkey;
+  int ret;
+
+  ret = gnutls_x509_privkey_init (&tmpkey);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  ret = gnutls_x509_privkey_import (tmpkey, raw_key, type);
+
+  /* If normal key decoding doesn't work try decoding a plain PKCS #8 key */
+  if (ret < 0)
+    ret =
+      gnutls_x509_privkey_import_pkcs8 (tmpkey, raw_key, type, NULL,
+                                        GNUTLS_PKCS_PLAIN);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      gnutls_x509_privkey_deinit (tmpkey);
+      return ret;
+    }
+
+  ret = _gnutls_x509_privkey_to_gkey (privkey, tmpkey);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      gnutls_x509_privkey_deinit (tmpkey);
+      return ret;
+    }
+
+  gnutls_x509_privkey_deinit (tmpkey);
+
+  return 0;
+}
+
+/* Reads a PEM encoded PKCS-1 RSA/DSA private key from memory.  Type
+ * indicates the certificate format.  KEY can be NULL, to indicate
+ * that GnuTLS doesn't know the private key.
+ */
+static int
+read_key_mem (gnutls_certificate_credentials_t res,
+              const void *key, int key_size, gnutls_x509_crt_fmt_t type)
+{
+  int ret;
+  gnutls_datum_t tmp;
+
+  /* allocate space for the pkey list
+   */
+  res->pkey =
+    gnutls_realloc_fast (res->pkey,
+                         (res->ncerts + 1) * sizeof (gnutls_privkey));
+  if (res->pkey == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  if (key)
+    {
+      tmp.data = (opaque *) key;
+      tmp.size = key_size;
+
+      ret =
+        _gnutls_x509_raw_privkey_to_gkey (&res->pkey[res->ncerts], &tmp,
+                                          type);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+    }
+  else
+    memset (&res->pkey[res->ncerts], 0, sizeof (gnutls_privkey));
+
+  return 0;
+}
+
+/* Reads a certificate file
+ */
+static int
+read_cert_file (gnutls_certificate_credentials_t res,
+                const char *certfile, gnutls_x509_crt_fmt_t type)
+{
+  int ret;
+  size_t size;
+  char *data = read_binary_file (certfile, &size);
+
+  if (data == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_FILE_ERROR;
+    }
+
+  ret = read_cert_mem (res, data, size, type);
+  free (data);
+
+  return ret;
+
+}
+
+
+
+/* Reads PKCS-1 RSA private key file or a DSA file (in the format openssl
+ * stores it).
+ */
+static int
+read_key_file (gnutls_certificate_credentials_t res,
+               const char *keyfile, gnutls_x509_crt_fmt_t type)
+{
+  int ret;
+  size_t size;
+  char *data = read_binary_file (keyfile, &size);
+
+  if (data == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_FILE_ERROR;
+    }
+
+  ret = read_key_mem (res, data, size, type);
+  free (data);
+
+  return ret;
+}
+
+/**
+  * gnutls_certificate_set_x509_key_mem - Used to set keys in a gnutls_certificate_credentials_t structure
+  * @res: is an #gnutls_certificate_credentials_t structure.
+  * @cert: contains a certificate list (path) for the specified private key
+  * @key: is the private key, or %NULL
+  * @type: is PEM or DER
+  *
+  * This function sets a certificate/private key pair in the 
+  * gnutls_certificate_credentials_t structure. This function may be called
+  * more than once (in case multiple keys/certificates exist for the
+  * server).
+  *
+  * Currently are supported: RSA PKCS-1 encoded private keys, 
+  * DSA private keys.
+  *
+  * DSA private keys are encoded the OpenSSL way, which is an ASN.1
+  * DER sequence of 6 INTEGERs - version, p, q, g, pub, priv.
+  *
+  * Note that the keyUsage (2.5.29.15) PKIX extension in X.509 certificates 
+  * is supported. This means that certificates intended for signing cannot
+  * be used for ciphersuites that require encryption.
+  *
+  * If the certificate and the private key are given in PEM encoding
+  * then the strings that hold their values must be null terminated.
+  *
+  * The @key may be %NULL if you are using a sign callback, see
+  * gnutls_sign_callback_set().
+  *
+  * Returns: %GNUTLS_E_SUCCESS on success, or an error code.
+  **/
+int
+gnutls_certificate_set_x509_key_mem (gnutls_certificate_credentials_t
+                                     res, const gnutls_datum_t * cert,
+                                     const gnutls_datum_t * key,
+                                     gnutls_x509_crt_fmt_t type)
+{
+  int ret;
+
+  /* this should be first 
+   */
+  if ((ret = read_key_mem (res, key ? key->data : NULL,
+                           key ? key->size : 0, type)) < 0)
+    return ret;
+
+  if ((ret = read_cert_mem (res, cert->data, cert->size, type)) < 0)
+    return ret;
+
+  res->ncerts++;
+
+  if (key && (ret = _gnutls_check_key_cert_match (res)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return 0;
+}
+
+/**
+  * gnutls_certificate_set_x509_key - Used to set keys in a gnutls_certificate_credentials_t structure
+  * @res: is an #gnutls_certificate_credentials_t structure.
+  * @cert_list: contains a certificate list (path) for the specified private key
+  * @cert_list_size: holds the size of the certificate list
+  * @key: is a gnutls_x509_privkey_t key
+  *
+  * This function sets a certificate/private key pair in the
+  * gnutls_certificate_credentials_t structure.  This function may be
+  * called more than once (in case multiple keys/certificates exist
+  * for the server).
+  *
+  * Returns: %GNUTLS_E_SUCCESS on success, or an error code.
+  **/
+int
+gnutls_certificate_set_x509_key (gnutls_certificate_credentials_t res,
+                                 gnutls_x509_crt_t * cert_list,
+                                 int cert_list_size,
+                                 gnutls_x509_privkey_t key)
+{
+  int ret, i;
+
+  /* this should be first 
+   */
+
+  res->pkey =
+    gnutls_realloc_fast (res->pkey,
+                         (res->ncerts + 1) * sizeof (gnutls_privkey));
+  if (res->pkey == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  ret = _gnutls_x509_privkey_to_gkey (&res->pkey[res->ncerts], key);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  res->cert_list = gnutls_realloc_fast (res->cert_list,
+                                        (1 +
+                                         res->ncerts) *
+                                        sizeof (gnutls_cert *));
+  if (res->cert_list == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  res->cert_list_length = gnutls_realloc_fast (res->cert_list_length,
+                                               (1 +
+                                                res->ncerts) * sizeof (int));
+  if (res->cert_list_length == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  res->cert_list[res->ncerts] = NULL;   /* for realloc */
+  res->cert_list_length[res->ncerts] = 0;
+
+
+  for (i = 0; i < cert_list_size; i++)
+    {
+      ret = parse_crt_mem (&res->cert_list[res->ncerts],
+                           &res->cert_list_length[res->ncerts], cert_list[i]);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+    }
+  res->ncerts++;
+
+  if ((ret = _gnutls_check_key_cert_match (res)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return 0;
+}
+
+/**
+  * gnutls_certificate_set_x509_key_file - Used to set keys in a gnutls_certificate_credentials_t structure
+  * @res: is an #gnutls_certificate_credentials_t structure.
+  * @CERTFILE: is a file that containing the certificate list (path) for
+  * the specified private key, in PKCS7 format, or a list of certificates
+  * @KEYFILE: is a file that contains the private key
+  * @type: is PEM or DER
+  *
+  * This function sets a certificate/private key pair in the
+  * gnutls_certificate_credentials_t structure.  This function may be
+  * called more than once (in case multiple keys/certificates exist
+  * for the server).
+  *
+  * Currently only PKCS-1 encoded RSA and DSA private keys are accepted by
+  * this function.
+  *
+  * Returns: %GNUTLS_E_SUCCESS on success, or an error code.
+  **/
+int
+gnutls_certificate_set_x509_key_file (gnutls_certificate_credentials_t
+                                      res, const char *CERTFILE,
+                                      const char *KEYFILE,
+                                      gnutls_x509_crt_fmt_t type)
+{
+  int ret;
+
+  /* this should be first 
+   */
+  if ((ret = read_key_file (res, KEYFILE, type)) < 0)
+    return ret;
+
+  if ((ret = read_cert_file (res, CERTFILE, type)) < 0)
+    return ret;
+
+  res->ncerts++;
+
+  if ((ret = _gnutls_check_key_cert_match (res)) < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return 0;
+}
+
+static int
+generate_rdn_seq (gnutls_certificate_credentials_t res)
+{
+  gnutls_datum_t tmp;
+  int ret;
+  unsigned size, i;
+  opaque *pdata;
+
+  /* Generate the RDN sequence 
+   * This will be sent to clients when a certificate
+   * request message is sent.
+   */
+
+  /* FIXME: in case of a client it is not needed
+   * to do that. This would save time and memory.
+   * However we don't have that information available
+   * here.
+   */
+
+  size = 0;
+  for (i = 0; i < res->x509_ncas; i++)
+    {
+      if ((ret = gnutls_x509_crt_get_raw_dn (res->x509_ca_list[i], &tmp)) < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+      size += (2 + tmp.size);
+      _gnutls_free_datum (&tmp);
+    }
+
+  if (res->x509_rdn_sequence.data != NULL)
+    gnutls_free (res->x509_rdn_sequence.data);
+
+  res->x509_rdn_sequence.data = gnutls_malloc (size);
+  if (res->x509_rdn_sequence.data == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+  res->x509_rdn_sequence.size = size;
+
+  pdata = res->x509_rdn_sequence.data;
+
+  for (i = 0; i < res->x509_ncas; i++)
+    {
+      if ((ret = gnutls_x509_crt_get_raw_dn (res->x509_ca_list[i], &tmp)) < 0)
+        {
+          _gnutls_free_datum (&res->x509_rdn_sequence);
+          gnutls_assert ();
+          return ret;
+        }
+
+      _gnutls_write_datum16 (pdata, tmp);
+      pdata += (2 + tmp.size);
+      _gnutls_free_datum (&tmp);
+    }
+
+  return 0;
+}
+
+
+
+
+/* Returns 0 if it's ok to use the gnutls_kx_algorithm_t with this 
+ * certificate (uses the KeyUsage field). 
+ */
+int
+_gnutls_check_key_usage (const gnutls_cert * cert, gnutls_kx_algorithm_t alg)
+{
+  unsigned int key_usage = 0;
+  int encipher_type;
+
+  if (cert == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  if (_gnutls_map_kx_get_cred (alg, 1) == GNUTLS_CRD_CERTIFICATE ||
+      _gnutls_map_kx_get_cred (alg, 0) == GNUTLS_CRD_CERTIFICATE)
+    {
+
+      key_usage = cert->key_usage;
+
+      encipher_type = _gnutls_kx_encipher_type (alg);
+
+      if (key_usage != 0 && encipher_type != CIPHER_IGN)
+        {
+          /* If key_usage has been set in the certificate
+           */
+
+          if (encipher_type == CIPHER_ENCRYPT)
+            {
+              /* If the key exchange method requires an encipher
+               * type algorithm, and key's usage does not permit
+               * encipherment, then fail.
+               */
+              if (!(key_usage & KEY_KEY_ENCIPHERMENT))
+                {
+                  gnutls_assert ();
+                  return GNUTLS_E_KEY_USAGE_VIOLATION;
+                }
+            }
+
+          if (encipher_type == CIPHER_SIGN)
+            {
+              /* The same as above, but for sign only keys
+               */
+              if (!(key_usage & KEY_DIGITAL_SIGNATURE))
+                {
+                  gnutls_assert ();
+                  return GNUTLS_E_KEY_USAGE_VIOLATION;
+                }
+            }
+        }
+    }
+  return 0;
+}
+
+
+
+static int
+parse_pem_ca_mem (gnutls_x509_crt_t ** cert_list, unsigned *ncerts,
+                  const opaque * input_cert, int input_cert_size)
+{
+  int i, size;
+  const opaque *ptr;
+  gnutls_datum_t tmp;
+  int ret, count;
+
+  /* move to the certificate
+   */
+  ptr = memmem (input_cert, input_cert_size,
+                PEM_CERT_SEP, sizeof (PEM_CERT_SEP) - 1);
+  if (ptr == NULL)
+    ptr = memmem (input_cert, input_cert_size,
+                  PEM_CERT_SEP2, sizeof (PEM_CERT_SEP2) - 1);
+
+  if (ptr == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_BASE64_DECODING_ERROR;
+    }
+  size = input_cert_size - (ptr - input_cert);
+
+  i = *ncerts + 1;
+  count = 0;
+
+  do
+    {
+
+      *cert_list =
+        (gnutls_x509_crt_t *) gnutls_realloc_fast (*cert_list,
+                                                   i *
+                                                   sizeof
+                                                   (gnutls_x509_crt_t));
+
+      if (*cert_list == NULL)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_MEMORY_ERROR;
+        }
+
+      ret = gnutls_x509_crt_init (&cert_list[0][i - 1]);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      tmp.data = (opaque *) ptr;
+      tmp.size = size;
+
+      ret =
+        gnutls_x509_crt_import (cert_list[0][i - 1],
+                                &tmp, GNUTLS_X509_FMT_PEM);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      /* now we move ptr after the pem header 
+       */
+      ptr++;
+      size--;
+      /* find the next certificate (if any)
+       */
+
+      if (size > 0)
+        {
+          char *ptr3;
+
+          ptr3 = memmem (ptr, size, PEM_CERT_SEP, sizeof (PEM_CERT_SEP) - 1);
+          if (ptr3 == NULL)
+            ptr3 = memmem (ptr, size,
+                           PEM_CERT_SEP2, sizeof (PEM_CERT_SEP2) - 1);
+
+          ptr = ptr3;
+          size = input_cert_size - (ptr - input_cert);
+        }
+      else
+        ptr = NULL;
+
+      i++;
+      count++;
+
+    }
+  while (ptr != NULL);
+
+  *ncerts = i - 1;
+
+  return count;
+}
+
+/* Reads a DER encoded certificate list from memory and stores it to
+ * a gnutls_cert structure. This is only called if PKCS7 read fails.
+ * returns the number of certificates parsed (1)
+ */
+static int
+parse_der_ca_mem (gnutls_x509_crt_t ** cert_list, unsigned *ncerts,
+                  const void *input_cert, int input_cert_size)
+{
+  int i;
+  gnutls_datum_t tmp;
+  int ret;
+
+  i = *ncerts + 1;
+
+  *cert_list =
+    (gnutls_x509_crt_t *) gnutls_realloc_fast (*cert_list,
+                                               i *
+                                               sizeof (gnutls_x509_crt_t));
+
+  if (*cert_list == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  tmp.data = (opaque *) input_cert;
+  tmp.size = input_cert_size;
+
+  ret = gnutls_x509_crt_init (&cert_list[0][i - 1]);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  ret =
+    gnutls_x509_crt_import (cert_list[0][i - 1], &tmp, GNUTLS_X509_FMT_DER);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  *ncerts = i;
+
+  return 1;                     /* one certificate parsed */
+}
+
+/**
+  * gnutls_certificate_set_x509_trust_mem - Used to add trusted CAs in a gnutls_certificate_credentials_t structure
+  * @res: is an #gnutls_certificate_credentials_t structure.
+  * @ca: is a list of trusted CAs or a DER certificate
+  * @type: is DER or PEM
+  *
+  * This function adds the trusted CAs in order to verify client or
+  * server certificates. In case of a client this is not required to
+  * be called if the certificates are not verified using
+  * gnutls_certificate_verify_peers2().  This function may be called
+  * multiple times.
+  *
+  * In case of a server the CAs set here will be sent to the client if
+  * a certificate request is sent. This can be disabled using
+  * gnutls_certificate_send_x509_rdn_sequence().
+  *
+  * Returns: the number of certificates processed or a negative value
+  * on error.
+  **/
+int
+gnutls_certificate_set_x509_trust_mem (gnutls_certificate_credentials_t
+                                       res, const gnutls_datum_t * ca,
+                                       gnutls_x509_crt_fmt_t type)
+{
+  int ret, ret2;
+
+  if (type == GNUTLS_X509_FMT_DER)
+    ret = parse_der_ca_mem (&res->x509_ca_list, &res->x509_ncas,
+                            ca->data, ca->size);
+  else
+    ret = parse_pem_ca_mem (&res->x509_ca_list, &res->x509_ncas,
+                            ca->data, ca->size);
+
+  if ((ret2 = generate_rdn_seq (res)) < 0)
+    return ret2;
+
+  return ret;
+}
+
+/**
+  * gnutls_certificate_set_x509_trust - Used to add trusted CAs in a gnutls_certificate_credentials_t structure
+  * @res: is an #gnutls_certificate_credentials_t structure.
+  * @ca_list: is a list of trusted CAs
+  * @ca_list_size: holds the size of the CA list
+  *
+  * This function adds the trusted CAs in order to verify client
+  * or server certificates. In case of a client this is not required
+  * to be called if the certificates are not verified using
+  * gnutls_certificate_verify_peers2().
+  * This function may be called multiple times.
+  *
+  * In case of a server the CAs set here will be sent to the client if
+  * a certificate request is sent. This can be disabled using
+  * gnutls_certificate_send_x509_rdn_sequence().
+  *
+  * Returns: %GNUTLS_E_SUCCESS on success, or an error code.
+  **/
+int
+gnutls_certificate_set_x509_trust (gnutls_certificate_credentials_t res,
+                                   gnutls_x509_crt_t * ca_list,
+                                   int ca_list_size)
+{
+  int ret, i, ret2;
+
+  res->x509_ca_list = gnutls_realloc_fast (res->x509_ca_list,
+                                           (ca_list_size +
+                                            res->x509_ncas) *
+                                           sizeof (gnutls_x509_crt_t));
+  if (res->x509_ca_list == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  for (i = 0; i < ca_list_size; i++)
+    {
+      ret = gnutls_x509_crt_init (&res->x509_ca_list[res->x509_ncas]);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      ret = _gnutls_x509_crt_cpy (res->x509_ca_list[res->x509_ncas],
+                                  ca_list[i]);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          gnutls_x509_crt_deinit (res->x509_ca_list[res->x509_ncas]);
+          return ret;
+        }
+      res->x509_ncas++;
+    }
+
+  if ((ret2 = generate_rdn_seq (res)) < 0)
+    return ret2;
+
+  return 0;
+}
+
+/**
+  * gnutls_certificate_set_x509_trust_file - Used to add trusted CAs in a gnutls_certificate_credentials_t structure
+  * @res: is an #gnutls_certificate_credentials_t structure.
+  * @cafile: is a file containing the list of trusted CAs (DER or PEM list)
+  * @type: is PEM or DER
+  *
+  * This function adds the trusted CAs in order to verify client or
+  * server certificates. In case of a client this is not required to
+  * be called if the certificates are not verified using
+  * gnutls_certificate_verify_peers2().  This function may be called
+  * multiple times.
+  *
+  * In case of a server the names of the CAs set here will be sent to
+  * the client if a certificate request is sent. This can be disabled
+  * using gnutls_certificate_send_x509_rdn_sequence().
+  *
+  * Returns: number of certificates processed, or a negative value on
+  * error.
+  **/
+int
+gnutls_certificate_set_x509_trust_file (gnutls_certificate_credentials_t
+                                        res, const char *cafile,
+                                        gnutls_x509_crt_fmt_t type)
+{
+  int ret, ret2;
+  size_t size;
+  char *data = read_binary_file (cafile, &size);
+
+  if (data == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_FILE_ERROR;
+    }
+
+  if (type == GNUTLS_X509_FMT_DER)
+    ret = parse_der_ca_mem (&res->x509_ca_list, &res->x509_ncas, data, size);
+  else
+    ret = parse_pem_ca_mem (&res->x509_ca_list, &res->x509_ncas, data, size);
+
+  free (data);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  if ((ret2 = generate_rdn_seq (res)) < 0)
+    return ret2;
+
+  return ret;
+}
+
+#ifdef ENABLE_PKI
+
+static int
+parse_pem_crl_mem (gnutls_x509_crl_t ** crl_list, unsigned *ncrls,
+                   const opaque * input_crl, int input_crl_size)
+{
+  int size, i;
+  const opaque *ptr;
+  gnutls_datum_t tmp;
+  int ret, count;
+
+  /* move to the certificate
+   */
+  ptr = memmem (input_crl, input_crl_size,
+                PEM_CRL_SEP, sizeof (PEM_CRL_SEP) - 1);
+  if (ptr == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_BASE64_DECODING_ERROR;
+    }
+
+  size = input_crl_size - (ptr - input_crl);
+
+  i = *ncrls + 1;
+  count = 0;
+
+  do
+    {
+
+      *crl_list =
+        (gnutls_x509_crl_t *) gnutls_realloc_fast (*crl_list,
+                                                   i *
+                                                   sizeof
+                                                   (gnutls_x509_crl_t));
+
+      if (*crl_list == NULL)
+        {
+          gnutls_assert ();
+          return GNUTLS_E_MEMORY_ERROR;
+        }
+
+      ret = gnutls_x509_crl_init (&crl_list[0][i - 1]);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      tmp.data = (char *) ptr;
+      tmp.size = size;
+
+      ret =
+        gnutls_x509_crl_import (crl_list[0][i - 1],
+                                &tmp, GNUTLS_X509_FMT_PEM);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      /* now we move ptr after the pem header 
+       */
+      ptr++;
+      /* find the next certificate (if any)
+       */
+
+      size = input_crl_size - (ptr - input_crl);
+
+      if (size > 0)
+        ptr = memmem (ptr, size, PEM_CRL_SEP, sizeof (PEM_CRL_SEP) - 1);
+      else
+        ptr = NULL;
+      i++;
+      count++;
+
+    }
+  while (ptr != NULL);
+
+  *ncrls = i - 1;
+
+  return count;
+}
+
+/* Reads a DER encoded certificate list from memory and stores it to
+ * a gnutls_cert structure. This is only called if PKCS7 read fails.
+ * returns the number of certificates parsed (1)
+ */
+static int
+parse_der_crl_mem (gnutls_x509_crl_t ** crl_list, unsigned *ncrls,
+                   const void *input_crl, int input_crl_size)
+{
+  int i;
+  gnutls_datum_t tmp;
+  int ret;
+
+  i = *ncrls + 1;
+
+  *crl_list =
+    (gnutls_x509_crl_t *) gnutls_realloc_fast (*crl_list,
+                                               i *
+                                               sizeof (gnutls_x509_crl_t));
+
+  if (*crl_list == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  tmp.data = (opaque *) input_crl;
+  tmp.size = input_crl_size;
+
+  ret = gnutls_x509_crl_init (&crl_list[0][i - 1]);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  ret =
+    gnutls_x509_crl_import (crl_list[0][i - 1], &tmp, GNUTLS_X509_FMT_DER);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  *ncrls = i;
+
+  return 1;                     /* one certificate parsed */
+}
+
+
+/* Reads a DER or PEM CRL from memory
+ */
+static int
+read_crl_mem (gnutls_certificate_credentials_t res, const void *crl,
+              int crl_size, gnutls_x509_crt_fmt_t type)
+{
+  int ret;
+
+  /* allocate space for the certificate to add
+   */
+  res->x509_crl_list = gnutls_realloc_fast (res->x509_crl_list,
+                                            (1 +
+                                             res->x509_ncrls) *
+                                            sizeof (gnutls_x509_crl_t));
+  if (res->x509_crl_list == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  if (type == GNUTLS_X509_FMT_DER)
+    ret = parse_der_crl_mem (&res->x509_crl_list,
+                             &res->x509_ncrls, crl, crl_size);
+  else
+    ret = parse_pem_crl_mem (&res->x509_crl_list,
+                             &res->x509_ncrls, crl, crl_size);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return ret;
+}
+
+/**
+  * gnutls_certificate_set_x509_crl_mem - Used to add CRLs in a gnutls_certificate_credentials_t structure
+  * @res: is an #gnutls_certificate_credentials_t structure.
+  * @CRL: is a list of trusted CRLs. They should have been verified before.
+  * @type: is DER or PEM
+  *
+  * This function adds the trusted CRLs in order to verify client or
+  * server certificates.  In case of a client this is not required to
+  * be called if the certificates are not verified using
+  * gnutls_certificate_verify_peers2().  This function may be called
+  * multiple times.
+  *
+  * Returns: number of CRLs processed, or a negative value on error.
+  **/
+int
+gnutls_certificate_set_x509_crl_mem (gnutls_certificate_credentials_t
+                                     res, const gnutls_datum_t * CRL,
+                                     gnutls_x509_crt_fmt_t type)
+{
+  int ret;
+
+  if ((ret = read_crl_mem (res, CRL->data, CRL->size, type)) < 0)
+    return ret;
+
+  return ret;
+}
+
+/**
+  * gnutls_certificate_set_x509_crl - Used to add CRLs in a gnutls_certificate_credentials_t structure
+  * @res: is an #gnutls_certificate_credentials_t structure.
+  * @crl_list: is a list of trusted CRLs. They should have been verified before.
+  * @crl_list_size: holds the size of the crl_list
+  *
+  * This function adds the trusted CRLs in order to verify client or
+  * server certificates.  In case of a client this is not required to
+  * be called if the certificates are not verified using
+  * gnutls_certificate_verify_peers2().  This function may be called
+  * multiple times.
+  *
+  * Returns: %GNUTLS_E_SUCCESS on success, or an error code.
+  **/
+int
+gnutls_certificate_set_x509_crl (gnutls_certificate_credentials_t res,
+                                 gnutls_x509_crl_t * crl_list,
+                                 int crl_list_size)
+{
+  int ret, i;
+
+  res->x509_crl_list = gnutls_realloc_fast (res->x509_crl_list,
+                                            (crl_list_size +
+                                             res->x509_ncrls) *
+                                            sizeof (gnutls_x509_crl_t));
+  if (res->x509_crl_list == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  for (i = 0; i < crl_list_size; i++)
+    {
+      ret = gnutls_x509_crl_init (&res->x509_crl_list[res->x509_ncrls]);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+
+      ret = _gnutls_x509_crl_cpy (res->x509_crl_list[res->x509_ncrls],
+                                  crl_list[i]);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          return ret;
+        }
+      res->x509_ncrls++;
+    }
+
+  return 0;
+}
+
+/**
+  * gnutls_certificate_set_x509_crl_file - Used to add CRLs in a gnutls_certificate_credentials_t structure
+  * @res: is an #gnutls_certificate_credentials_t structure.
+  * @crlfile: is a file containing the list of verified CRLs (DER or PEM list)
+  * @type: is PEM or DER
+  *
+  * This function adds the trusted CRLs in order to verify client or server
+  * certificates.  In case of a client this is not required
+  * to be called if the certificates are not verified using
+  * gnutls_certificate_verify_peers2().
+  * This function may be called multiple times.
+  *
+  * Returns: number of CRLs processed or a negative value on error.
+  **/
+int
+gnutls_certificate_set_x509_crl_file (gnutls_certificate_credentials_t
+                                      res, const char *crlfile,
+                                      gnutls_x509_crt_fmt_t type)
+{
+  int ret;
+  size_t size;
+  char *data = read_binary_file (crlfile, &size);
+
+  if (data == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_FILE_ERROR;
+    }
+
+  if (type == GNUTLS_X509_FMT_DER)
+    ret = parse_der_crl_mem (&res->x509_crl_list, &res->x509_ncrls,
+                             data, size);
+  else
+    ret = parse_pem_crl_mem (&res->x509_crl_list, &res->x509_ncrls,
+                             data, size);
+
+  free (data);
+
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  return ret;
+}
+
+#include <pkcs12.h>
+
+static int
+parse_pkcs12 (gnutls_certificate_credentials_t res,
+              gnutls_pkcs12_t p12,
+              const char *password,
+              gnutls_x509_privkey_t * key,
+              gnutls_x509_crt_t * cert, gnutls_x509_crl_t * crl)
+{
+  gnutls_pkcs12_bag_t bag = NULL;
+  int index = 0;
+  int ret;
+
+  for (;;)
+    {
+      int elements_in_bag;
+      int i;
+
+      ret = gnutls_pkcs12_bag_init (&bag);
+      if (ret < 0)
+        {
+          bag = NULL;
+          gnutls_assert ();
+          goto done;
+        }
+
+      ret = gnutls_pkcs12_get_bag (p12, index, bag);
+      if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
+        break;
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          goto done;
+        }
+
+      ret = gnutls_pkcs12_bag_get_type (bag, 0);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          goto done;
+        }
+
+      if (ret == GNUTLS_BAG_ENCRYPTED)
+        {
+          ret = gnutls_pkcs12_bag_decrypt (bag, password);
+          if (ret < 0)
+            {
+              gnutls_assert ();
+              goto done;
+            }
+        }
+
+      elements_in_bag = gnutls_pkcs12_bag_get_count (bag);
+      if (elements_in_bag < 0)
+        {
+          gnutls_assert ();
+          goto done;
+        }
+
+      for (i = 0; i < elements_in_bag; i++)
+        {
+          int type;
+          gnutls_datum_t data;
+
+          type = gnutls_pkcs12_bag_get_type (bag, i);
+          if (type < 0)
+            {
+              gnutls_assert ();
+              goto done;
+            }
+
+          ret = gnutls_pkcs12_bag_get_data (bag, i, &data);
+          if (ret < 0)
+            {
+              gnutls_assert ();
+              goto done;
+            }
+
+          switch (type)
+            {
+            case GNUTLS_BAG_PKCS8_ENCRYPTED_KEY:
+            case GNUTLS_BAG_PKCS8_KEY:
+              ret = gnutls_x509_privkey_init (key);
+              if (ret < 0)
+                {
+                  gnutls_assert ();
+                  goto done;
+                }
+
+              ret = gnutls_x509_privkey_import_pkcs8
+                (*key, &data, GNUTLS_X509_FMT_DER, password,
+                 type == GNUTLS_BAG_PKCS8_KEY ? GNUTLS_PKCS_PLAIN : 0);
+              if (ret < 0)
+                {
+                  gnutls_assert ();
+                  goto done;
+                }
+              break;
+
+            case GNUTLS_BAG_CERTIFICATE:
+              ret = gnutls_x509_crt_init (cert);
+              if (ret < 0)
+                {
+                  gnutls_assert ();
+                  goto done;
+                }
+
+              ret =
+                gnutls_x509_crt_import (*cert, &data, GNUTLS_X509_FMT_DER);
+              if (ret < 0)
+                {
+                  gnutls_assert ();
+                  goto done;
+                }
+              break;
+
+            case GNUTLS_BAG_CRL:
+              ret = gnutls_x509_crl_init (crl);
+              if (ret < 0)
+                {
+                  gnutls_assert ();
+                  goto done;
+                }
+
+              ret = gnutls_x509_crl_import (*crl, &data, GNUTLS_X509_FMT_DER);
+              if (ret < 0)
+                {
+                  gnutls_assert ();
+                  goto done;
+                }
+              break;
+
+            case GNUTLS_BAG_ENCRYPTED:
+              /* XXX Bother to recurse one level down?  Unlikely to
+                 use the same password anyway. */
+            case GNUTLS_BAG_EMPTY:
+            default:
+              break;
+            }
+        }
+
+      index++;
+      gnutls_pkcs12_bag_deinit (bag);
+    }
+
+  ret = 0;
+
+done:
+  if (bag)
+    gnutls_pkcs12_bag_deinit (bag);
+
+  return ret;
+}
+
+/**
+ * gnutls_certificate_set_x509_simple_pkcs12_file:
+ * @res: is an #gnutls_certificate_credentials_t structure.
+ * @pkcs12file: filename of file containing PKCS#12 blob.
+ * @type: is PEM or DER of the @pkcs12file.
+ * @password: optional password used to decrypt PKCS#12 file, bags and keys.
+ *
+ * This function sets a certificate/private key pair and/or a CRL in
+ * the gnutls_certificate_credentials_t structure.  This function may
+ * be called more than once (in case multiple keys/certificates exist
+ * for the server).
+ *
+ * MAC:ed PKCS#12 files are supported.  Encrypted PKCS#12 bags are
+ * supported.  Encrypted PKCS#8 private keys are supported.  However,
+ * only password based security, and the same password for all
+ * operations, are supported.
+ *
+ * The private keys may be RSA PKCS#1 or DSA private keys encoded in
+ * the OpenSSL way.
+ *
+ * PKCS#12 file may contain many keys and/or certificates, and there
+ * is no way to identify which key/certificate pair you want.  You
+ * should make sure the PKCS#12 file only contain one key/certificate
+ * pair and/or one CRL.
+ *
+ * It is believed that the limitations of this function is acceptable
+ * for most usage, and that any more flexibility would introduce
+ * complexity that would make it harder to use this functionality at
+ * all.
+ *
+ * Returns: %GNUTLS_E_SUCCESS on success, or an error code.
+ **/
+int
+  gnutls_certificate_set_x509_simple_pkcs12_file
+  (gnutls_certificate_credentials_t res, const char *pkcs12file,
+   gnutls_x509_crt_fmt_t type, const char *password)
+{
+  gnutls_pkcs12_t p12;
+  gnutls_datum_t p12blob;
+  gnutls_x509_privkey_t key = NULL;
+  gnutls_x509_crt_t cert = NULL;
+  gnutls_x509_crl_t crl = NULL;
+  int ret;
+  size_t size;
+
+  ret = gnutls_pkcs12_init (&p12);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  p12blob.data = read_binary_file (pkcs12file, &size);
+  p12blob.size = (unsigned int) size;
+  if (p12blob.data == NULL)
+    {
+      gnutls_assert ();
+      gnutls_pkcs12_deinit (p12);
+      return GNUTLS_E_FILE_ERROR;
+    }
+
+  ret = gnutls_pkcs12_import (p12, &p12blob, type, 0);
+  free (p12blob.data);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      gnutls_pkcs12_deinit (p12);
+      return ret;
+    }
+
+  if (password)
+    {
+      ret = gnutls_pkcs12_verify_mac (p12, password);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          gnutls_pkcs12_deinit (p12);
+          return ret;
+        }
+    }
+
+  ret = parse_pkcs12 (res, p12, password, &key, &cert, &crl);
+  gnutls_pkcs12_deinit (p12);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  if (key && cert)
+    {
+      ret = gnutls_certificate_set_x509_key (res, &cert, 1, key);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          goto done;
+        }
+    }
+
+  if (crl)
+    {
+      ret = gnutls_certificate_set_x509_crl (res, &crl, 1);
+      if (ret < 0)
+        {
+          gnutls_assert ();
+          goto done;
+        }
+    }
+
+  ret = 0;
+
+done:
+  if (cert)
+    gnutls_x509_crt_deinit (cert);
+  if (key)
+    gnutls_x509_privkey_deinit (key);
+  if (crl)
+    gnutls_x509_crl_deinit (crl);
+
+  return ret;
+}
+
+
+/**
+  * gnutls_certificate_free_crls - Used to free all the CRLs from a gnutls_certificate_credentials_t structure
+  * @sc: is an #gnutls_certificate_credentials_t structure.
+  *
+  * This function will delete all the CRLs associated
+  * with the given credentials.
+  *
+  **/
+void
+gnutls_certificate_free_crls (gnutls_certificate_credentials_t sc)
+{
+  unsigned j;
+
+  for (j = 0; j < sc->x509_ncrls; j++)
+    {
+      gnutls_x509_crl_deinit (sc->x509_crl_list[j]);
+    }
+
+  sc->x509_ncrls = 0;
+
+  gnutls_free (sc->x509_crl_list);
+  sc->x509_crl_list = NULL;
+}
+
+#endif
diff --git a/src/daemon/https/tls/gnutls_x509.h b/src/daemon/https/tls/gnutls_x509.h
new file mode 100644
index 00000000..3aa0d915
--- /dev/null
+++ b/src/daemon/https/tls/gnutls_x509.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+#include <libtasn1.h>
+
+int _gnutls_x509_cert_verify_peers (gnutls_session_t session,
+                                    unsigned int *status);
+
+#define PEM_CERT_SEP2 "-----BEGIN X509 CERTIFICATE"
+#define PEM_CERT_SEP "-----BEGIN CERTIFICATE"
+#define PEM_PKCS7_SEP "-----BEGIN PKCS7"
+
+#define PEM_CRL_SEP "-----BEGIN X509 CRL"
+
+#define PEM_KEY_RSA_SEP "-----BEGIN RSA"
+#define PEM_KEY_DSA_SEP "-----BEGIN DSA"
+
+int _gnutls_check_key_usage (const gnutls_cert * cert,
+                             gnutls_kx_algorithm_t alg);
+
+int _gnutls_x509_read_rsa_params (opaque * der, int dersize, mpi_t * params);
+int _gnutls_x509_read_dsa_pubkey (opaque * der, int dersize, mpi_t * params);
+
+int _gnutls_x509_raw_privkey_to_gkey (gnutls_privkey * privkey,
+                                      const gnutls_datum_t * raw_key,
+                                      gnutls_x509_crt_fmt_t type);
+int _gnutls_x509_privkey_to_gkey (gnutls_privkey * privkey,
+                                  gnutls_x509_privkey_t);
diff --git a/src/daemon/https/tls/gnutlsxx.cpp b/src/daemon/https/tls/gnutlsxx.cpp
new file mode 100644
index 00000000..70621a43
--- /dev/null
+++ b/src/daemon/https/tls/gnutlsxx.cpp
@@ -0,0 +1,907 @@
+#include <gnutlsxx.h>
+
+using namespace gnutls;
+
+inline int RETWRAP_NET(int ret) 
+{
+    if (gnutls_error_is_fatal(ret)) throw(exception(ret));
+    else return ret;
+}
+
+inline int RETWRAP(int ret) 
+{
+    if (ret < 0) throw(exception(ret));
+    return ret;
+}
+
+session::session( gnutls_connection_end_t end)
+{
+    RETWRAP(gnutls_init( &this->s, end));
+}
+
+session::session( session& s)
+{
+    this->s = s.s;
+}
+
+session::~session()
+{
+    gnutls_deinit( this->s);
+}
+
+int session::bye( gnutls_close_request_t how)
+{
+    return RETWRAP_NET( gnutls_bye( this->s, how));
+}
+
+int session::handshake ()
+{
+    return RETWRAP_NET( gnutls_handshake( this->s));
+}
+
+
+server_session::server_session() : session( GNUTLS_SERVER)
+{
+}
+
+int server_session::rehandshake()
+{
+    return RETWRAP_NET( gnutls_rehandshake( this->s));
+}
+
+gnutls_alert_description_t session::get_alert() const
+{
+    return gnutls_alert_get( this->s);
+}
+
+int session::send_alert ( gnutls_alert_level_t level,
+                          gnutls_alert_description_t desc)
+{
+    return RETWRAP_NET(gnutls_alert_send( this->s, level, desc));
+}
+
+int session::send_appropriate_alert (int err)
+{
+    return RETWRAP_NET(gnutls_alert_send_appropriate( this->s, err));
+}
+
+gnutls_cipher_algorithm_t session::get_cipher() const
+{
+    return gnutls_cipher_get( this->s);
+}
+
+gnutls_kx_algorithm_t session::get_kx () const
+{
+    return gnutls_kx_get( this->s);
+}
+
+gnutls_mac_algorithm_t session::get_mac () const
+{
+    return gnutls_mac_get( this->s);
+}
+
+gnutls_compression_method_t session::get_compression() const
+{
+    return gnutls_compression_get( this->s);
+}
+
+gnutls_certificate_type_t session::get_certificate_type() const
+{
+    return gnutls_certificate_type_get( this->s);
+}
+
+void session::set_private_extensions ( bool allow)
+{
+    gnutls_handshake_set_private_extensions( this->s, (int)allow);
+}
+
+gnutls_handshake_description_t session::get_handshake_last_out() const
+{
+    return gnutls_handshake_get_last_out( this->s);
+}
+
+gnutls_handshake_description_t session::get_handshake_last_in() const
+{
+    return gnutls_handshake_get_last_in( this->s);
+}
+
+ssize_t session::send (const void *data, size_t sizeofdata)
+{
+    return RETWRAP_NET(gnutls_record_send( this->s, data, sizeofdata));
+}
+
+ssize_t session::recv (void *data, size_t sizeofdata)
+{
+    return RETWRAP_NET(gnutls_record_recv( this->s, data, sizeofdata));
+}
+
+bool session::get_record_direction() const
+{
+    return gnutls_record_get_direction(this->s);
+}
+
+        // maximum packet size
+size_t session::get_max_size () const
+{
+    return gnutls_record_get_max_size( this->s);
+}
+
+void session::set_max_size(size_t size)
+{
+    RETWRAP( gnutls_record_set_max_size( this->s, size));
+}
+
+size_t session::check_pending () const
+{
+    return gnutls_record_check_pending( this->s);
+}
+
+
+void session::prf (size_t label_size, const char *label,
+                 int server_random_first,
+                 size_t extra_size, const char *extra,
+                 size_t outsize, char *out)
+{
+    RETWRAP(gnutls_prf( this->s, label_size, label, server_random_first,
+            extra_size, extra, outsize, out));
+}
+
+void session::prf_raw ( size_t label_size, const char *label,
+                      size_t seed_size, const char *seed,
+                      size_t outsize, char *out)
+{
+    RETWRAP( gnutls_prf_raw( this->s, label_size, label, seed_size, seed, outsize, out));
+}
+
+
+void session::set_cipher_priority (const int *list)
+{
+    RETWRAP( gnutls_cipher_set_priority( this->s, list));
+}
+
+void session::set_mac_priority (const int *list)
+{
+    RETWRAP( gnutls_mac_set_priority( this->s, list));
+}
+
+void session::set_compression_priority (const int *list)
+{
+    RETWRAP( gnutls_compression_set_priority( this->s, list));
+}
+
+void session::set_kx_priority (const int *list)
+{
+    RETWRAP( gnutls_kx_set_priority( this->s, list));
+}
+
+void session::set_protocol_priority (const int *list)
+{
+    RETWRAP( gnutls_protocol_set_priority( this->s, list));
+}
+
+void session::set_certificate_type_priority (const int *list)
+{
+    RETWRAP( gnutls_certificate_type_set_priority( this->s, list));
+}
+
+
+/* if you just want some defaults, use the following.
+ */
+void session::set_priority(const char* prio, const char** err_pos)
+{
+    RETWRAP(gnutls_priority_set_direct( this->s, prio, err_pos));
+}
+
+void session::set_priority(gnutls_priority_t p)
+{
+    RETWRAP(gnutls_priority_set( this->s, p));
+}
+
+gnutls_protocol_t session::get_protocol_version() const
+{
+    return gnutls_protocol_get_version( this->s);
+}
+
+void session::set_data ( const void *session_data,
+                        size_t session_data_size)
+{
+    RETWRAP(gnutls_session_set_data( this->s, session_data, session_data_size));
+}
+
+void session::get_data (void *session_data,
+                        size_t * session_data_size) const
+{
+    RETWRAP(gnutls_session_get_data( this->s, session_data, session_data_size));
+}
+
+void session::get_data(gnutls_session_t session,
+                       gnutls_datum_t & data) const
+{
+    RETWRAP(gnutls_session_get_data2( this->s, &data));
+
+}
+
+void session::get_id ( void *session_id,
+                       size_t * session_id_size) const
+{
+    RETWRAP( gnutls_session_get_id( this->s, session_id, session_id_size));
+}
+
+bool session::is_resumed() const
+{
+    int ret = gnutls_session_is_resumed( this->s);
+    
+    if (ret != 0) return true;
+    return false;
+}
+
+
+bool session::get_peers_certificate(std::vector<gnutls_datum_t> &out_certs) const
+{
+    const gnutls_datum_t *certs;
+    unsigned int certs_size;
+    
+    certs = gnutls_certificate_get_peers (this->s, &certs_size);
+    
+    if (certs==NULL) return false;
+    
+    for(unsigned int i=0;i<certs_size;i++)
+        out_certs.push_back( certs[i]);
+    
+    return true;
+}
+
+bool session::get_peers_certificate(const gnutls_datum_t** certs, unsigned int *certs_size) const
+{
+    *certs = gnutls_certificate_get_peers (this->s, certs_size);
+    
+    if (*certs==NULL) return false;
+    return true;
+}
+
+void session::get_our_certificate(gnutls_datum_t& cert) const
+{
+const gnutls_datum_t *d;
+    
+    d = gnutls_certificate_get_ours(this->s);
+    if (d==NULL)
+        throw(exception( GNUTLS_E_INVALID_REQUEST));
+    cert = *d;
+}
+          
+time_t session::get_peers_certificate_activation_time() const
+{
+    return gnutls_certificate_activation_time_peers( this->s);
+}
+
+time_t session::get_peers_certificate_expiration_time() const
+{
+    return gnutls_certificate_expiration_time_peers( this->s);
+}
+void session::verify_peers_certificate( unsigned int& status) const
+{
+    RETWRAP( gnutls_certificate_verify_peers2( this->s, &status));
+}
+
+
+client_session::client_session() : session( GNUTLS_CLIENT)
+{
+}
+
+// client session
+void client_session::set_server_name (gnutls_server_name_type_t type,
+                                      const void *name, size_t name_length)
+{
+    RETWRAP( gnutls_server_name_set( this->s, type, name, name_length));
+}
+
+bool client_session::get_request_status()
+{
+    return RETWRAP(gnutls_certificate_client_get_request_status (this->s));
+}
+
+// server_session
+void server_session::get_server_name (void *data, size_t * data_length,
+                                      unsigned int *type, unsigned int indx) const
+{
+    RETWRAP( gnutls_server_name_get( this->s, data, data_length, type, indx));
+}
+
+// internal DB stuff
+static int store_function(void *_db, gnutls_datum_t key, gnutls_datum_t data)
+{
+    try {
+        DB* db = static_cast<DB*>(_db);
+    
+        if (db->store( key, data)==false) return -1;
+    } catch(...) {
+        return -1;
+    }
+
+    return 0;
+}
+
+const static gnutls_datum_t null_datum = { NULL, 0 };
+
+static gnutls_datum_t retrieve_function(void *_db, gnutls_datum_t key)
+{
+    gnutls_datum_t data;
+    
+    try {
+        DB* db = static_cast<DB*>(_db);
+    
+        if (db->retrieve( key, data)==false) return null_datum;
+    
+    } catch(...) {
+        return null_datum;
+    }
+
+    return data;
+}
+
+static int remove_function(void *_db, gnutls_datum_t key)
+{
+    try {
+        DB* db = static_cast<DB*>(_db);
+    
+        if (db->remove( key)==false) return -1;
+    } catch(...) {
+        return -1;
+    }
+
+    return 0;
+}
+
+void server_session::set_db( const DB& db)
+{
+    gnutls_db_set_ptr( this->s, const_cast<DB*>(&db));
+    gnutls_db_set_store_function( this->s, store_function);
+    gnutls_db_set_retrieve_function( this->s, retrieve_function);
+    gnutls_db_set_remove_function( this->s, remove_function);
+}
+
+void server_session::set_db_cache_expiration (unsigned int seconds)
+{
+    gnutls_db_set_cache_expiration( this->s, seconds);
+}
+
+void server_session::db_remove () const
+{
+    gnutls_db_remove_session( this->s);
+}
+
+bool server_session::db_check_entry ( gnutls_datum_t &session_data) const
+{
+    int ret = gnutls_db_check_entry( this->s, session_data);
+
+    if (ret != 0) return true;
+    return false;
+}
+
+void session::set_max_handshake_packet_length ( size_t max)
+{
+    gnutls_handshake_set_max_packet_length( this->s, max);
+}
+
+void session::clear_credentials()
+{
+    gnutls_credentials_clear( this->s);
+}
+
+void session::set_credentials( credentials &cred)
+{
+    RETWRAP(gnutls_credentials_set( this->s, cred.get_type(), cred.ptr()));
+}
+
+const char* server_session::get_srp_username() const
+{
+    return gnutls_srp_server_get_username( this->s);
+}
+
+const char* server_session::get_psk_username() const
+{
+    return gnutls_psk_server_get_username( this->s);
+}
+
+
+void session::set_transport_ptr( gnutls_transport_ptr_t ptr)
+{
+    gnutls_transport_set_ptr( this->s, ptr);
+}
+  
+void session::set_transport_ptr( gnutls_transport_ptr_t recv_ptr, gnutls_transport_ptr_t send_ptr)
+{
+    gnutls_transport_set_ptr2( this->s, recv_ptr, send_ptr);
+}
+
+
+gnutls_transport_ptr_t session::get_transport_ptr () const
+{
+    return gnutls_transport_get_ptr (this->s);
+}
+  
+void session::get_transport_ptr( gnutls_transport_ptr_t & recv_ptr,
+                                 gnutls_transport_ptr_t & send_ptr) const
+{
+    gnutls_transport_get_ptr2 (this->s, &recv_ptr, &send_ptr);
+}
+
+void session::set_transport_lowat( size_t num)
+{
+    gnutls_transport_set_lowat (this->s, num);
+}
+
+void session::set_transport_push_function( gnutls_push_func push_func)
+{
+    gnutls_transport_set_push_function ( this->s,  push_func);
+}
+  
+void session::set_transport_pull_function( gnutls_pull_func pull_func)
+{
+    gnutls_transport_set_pull_function ( this->s,  pull_func);
+}
+
+void session::set_user_ptr( void* ptr)
+{
+    gnutls_session_set_ptr( this->s, ptr);
+}
+
+void* session::get_user_ptr( ) const
+{
+    return gnutls_session_get_ptr(this->s);
+}
+  
+void session::send_openpgp_cert( gnutls_openpgp_crt_status_t status)
+{
+    gnutls_openpgp_send_cert(this->s, status);
+}
+
+
+void session::set_dh_prime_bits( unsigned int bits)
+{
+    gnutls_dh_set_prime_bits( this->s, bits);
+}
+
+unsigned int session::get_dh_secret_bits() const
+{
+    return RETWRAP( gnutls_dh_get_secret_bits( this->s));
+}
+
+unsigned int session::get_dh_peers_public_bits() const
+{
+    return RETWRAP(gnutls_dh_get_peers_public_bits( this->s));
+}
+
+unsigned int session::get_dh_prime_bits() const
+{
+    return RETWRAP( gnutls_dh_get_prime_bits( this->s));
+}
+
+void session::get_dh_group( gnutls_datum_t & gen, gnutls_datum_t & prime) const
+{
+    RETWRAP( gnutls_dh_get_group( this->s, &gen, &prime));
+}
+
+void session::get_dh_pubkey( gnutls_datum_t & raw_key) const
+{
+    RETWRAP(gnutls_dh_get_pubkey( this->s, &raw_key));
+}
+
+void session::get_rsa_export_pubkey( gnutls_datum_t& exponent, gnutls_datum_t& modulus) const
+{
+    RETWRAP( gnutls_rsa_export_get_pubkey( this->s, &exponent, &modulus));
+}
+
+unsigned int session::get_rsa_export_modulus_bits() const
+{
+    return RETWRAP(gnutls_rsa_export_get_modulus_bits( this->s));
+}
+
+void server_session::set_certificate_request( gnutls_certificate_request_t req)
+{
+    gnutls_certificate_server_set_request (this->s, req);
+}
+
+
+
+
+gnutls_credentials_type_t session::get_auth_type() const
+{
+    return gnutls_auth_get_type( this->s);
+}
+
+gnutls_credentials_type_t session::get_server_auth_type() const
+{
+    return gnutls_auth_server_get_type( this->s);
+}
+
+gnutls_credentials_type_t session::get_client_auth_type() const
+{
+    return gnutls_auth_client_get_type( this->s);
+}
+
+
+void* certificate_credentials::ptr() const
+{
+    return this->cred;
+}
+
+void certificate_credentials::set_ptr(void* p)
+{
+    this->cred = static_cast<gnutls_certificate_credentials_t> (p);
+}
+
+certificate_credentials::~certificate_credentials()
+{
+    gnutls_certificate_free_credentials (this->cred); 
+}
+
+certificate_credentials::certificate_credentials() : credentials(GNUTLS_CRD_CERTIFICATE)
+{
+    RETWRAP(gnutls_certificate_allocate_credentials ( &this->cred));
+}
+
+void certificate_server_credentials::set_params_function( gnutls_params_function* func)
+{
+    gnutls_certificate_set_params_function( this->cred, func);
+}
+
+anon_server_credentials::anon_server_credentials() : credentials(GNUTLS_CRD_ANON)
+{ 
+    RETWRAP(gnutls_anon_allocate_server_credentials( &this->cred));
+}
+        
+anon_server_credentials::~anon_server_credentials() 
+{ 
+    gnutls_anon_free_server_credentials( this->cred); 
+}
+
+void anon_server_credentials::set_dh_params( const dh_params& params) 
+{
+    gnutls_anon_set_server_dh_params (this->cred, params.get_params_t());
+}
+
+void anon_server_credentials::set_params_function ( gnutls_params_function * func)
+{
+    gnutls_anon_set_server_params_function ( this->cred, func); 
+}
+
+anon_client_credentials::anon_client_credentials() : credentials(GNUTLS_CRD_ANON)
+{ 
+    RETWRAP(gnutls_anon_allocate_client_credentials( &this->cred));
+}
+        
+anon_client_credentials::~anon_client_credentials() 
+{ 
+    gnutls_anon_free_client_credentials( this->cred); 
+}
+
+void certificate_credentials::free_keys ()
+{
+    gnutls_certificate_free_keys( this->cred);
+}
+
+void certificate_credentials::free_cas ()
+{
+    gnutls_certificate_free_cas( this->cred);
+}
+
+void certificate_credentials::free_ca_names ()
+{
+    gnutls_certificate_free_ca_names( this->cred);
+}
+
+void certificate_credentials::free_crls ()
+{
+    gnutls_certificate_free_crls( this->cred);
+}
+
+
+void certificate_credentials::set_dh_params ( const dh_params& params)
+{
+    gnutls_certificate_set_dh_params( this->cred, params.get_params_t());
+}
+
+void certificate_credentials::set_rsa_export_params ( const rsa_params & params)
+{
+    gnutls_certificate_set_rsa_export_params( this->cred, params.get_params_t());
+}
+
+void certificate_credentials::set_verify_flags ( unsigned int flags)
+{
+    gnutls_certificate_set_verify_flags( this->cred, flags);
+}
+
+void certificate_credentials::set_verify_limits ( unsigned int max_bits, unsigned int max_depth)
+{
+    gnutls_certificate_set_verify_limits( this->cred, max_bits, max_depth);
+}
+
+void certificate_credentials::set_x509_trust_file(const char *cafile, gnutls_x509_crt_fmt_t type)
+{
+    RETWRAP( gnutls_certificate_set_x509_trust_file( this->cred, cafile, type));
+}
+
+void certificate_credentials::set_x509_trust(const gnutls_datum_t & CA, gnutls_x509_crt_fmt_t type)
+{
+    RETWRAP( gnutls_certificate_set_x509_trust_mem( this->cred, &CA, type));
+}
+
+
+void certificate_credentials::set_x509_crl_file( const char *crlfile, gnutls_x509_crt_fmt_t type)
+{
+    RETWRAP( gnutls_certificate_set_x509_crl_file( this->cred, crlfile, type));
+}
+
+void certificate_credentials::set_x509_crl(const gnutls_datum_t & CRL, gnutls_x509_crt_fmt_t type)
+{
+    RETWRAP( gnutls_certificate_set_x509_crl_mem( this->cred, &CRL, type));
+}
+
+void certificate_credentials::set_x509_key_file(const char *certfile, const char *keyfile, gnutls_x509_crt_fmt_t type)
+{
+    RETWRAP( gnutls_certificate_set_x509_key_file( this->cred, certfile, keyfile, type));
+}
+
+void certificate_credentials::set_x509_key(const gnutls_datum_t & CERT, const gnutls_datum_t & KEY, gnutls_x509_crt_fmt_t type)
+{
+    RETWRAP( gnutls_certificate_set_x509_key_mem( this->cred, &CERT, &KEY, type));
+}
+
+void certificate_credentials::set_simple_pkcs12_file( const char *pkcs12file,
+                                     gnutls_x509_crt_fmt_t type, const char *password)
+{
+    RETWRAP( gnutls_certificate_set_x509_simple_pkcs12_file( this->cred, pkcs12file, type, password));
+}
+
+void certificate_credentials::set_x509_key ( gnutls_x509_crt_t * cert_list, int cert_list_size,
+                            gnutls_x509_privkey_t key)
+{
+    RETWRAP( gnutls_certificate_set_x509_key( this->cred, cert_list, cert_list_size, key));
+}
+
+void certificate_credentials::set_x509_trust ( gnutls_x509_crt_t * ca_list, int ca_list_size)
+{
+    RETWRAP( gnutls_certificate_set_x509_trust( this->cred, ca_list, ca_list_size));
+}
+
+void certificate_credentials::set_x509_crl ( gnutls_x509_crl_t * crl_list, int crl_list_size)
+{
+    RETWRAP( gnutls_certificate_set_x509_crl( this->cred, crl_list, crl_list_size));
+}
+
+void certificate_server_credentials::set_retrieve_function( gnutls_certificate_server_retrieve_function* func)
+{
+    gnutls_certificate_server_set_retrieve_function( this->cred, func);
+}
+
+void certificate_client_credentials::set_retrieve_function( gnutls_certificate_client_retrieve_function* func)
+{
+    gnutls_certificate_client_set_retrieve_function( this->cred, func);
+}
+
+// SRP
+
+srp_server_credentials::srp_server_credentials() : credentials(GNUTLS_CRD_SRP)
+{ 
+    RETWRAP(gnutls_srp_allocate_server_credentials( &this->cred));
+}
+        
+srp_server_credentials::~srp_server_credentials() 
+{ 
+    gnutls_srp_free_server_credentials( this->cred); 
+}
+
+void* srp_server_credentials::ptr() const
+{
+    return this->cred;
+}
+
+void srp_server_credentials::set_ptr(void* p)
+{
+    this->cred = static_cast<gnutls_srp_server_credentials_t> (p);
+}
+
+srp_client_credentials::srp_client_credentials() : credentials(GNUTLS_CRD_SRP)
+{ 
+    RETWRAP(gnutls_srp_allocate_client_credentials( &this->cred));
+}
+        
+srp_client_credentials::~srp_client_credentials() 
+{ 
+    gnutls_srp_free_client_credentials( this->cred); 
+}
+
+void* srp_client_credentials::ptr() const
+{
+    return this->cred;
+}
+
+void srp_client_credentials::set_ptr(void* p)
+{
+    this->cred = static_cast<gnutls_srp_client_credentials_t> (p);
+}
+
+void srp_client_credentials::set_credentials( const char* username, const char* password)
+{
+    RETWRAP(gnutls_srp_set_client_credentials (this->cred, username, password));
+}
+
+void srp_server_credentials::set_credentials_file (
+    const char *password_file, const char *password_conf_file)
+{
+    RETWRAP( gnutls_srp_set_server_credentials_file( this->cred, password_file, password_conf_file));
+}
+
+
+void srp_server_credentials::set_credentials_function(gnutls_srp_server_credentials_function * func)
+{
+    gnutls_srp_set_server_credentials_function( this->cred, func);
+}
+
+void srp_client_credentials::set_credentials_function(gnutls_srp_client_credentials_function * func)
+{
+    gnutls_srp_set_client_credentials_function( this->cred, func);
+}
+
+credentials::credentials(gnutls_credentials_type_t t) : type(t) 
+{ 
+}
+
+#if !(defined(__APPLE__) || defined(__MACOS__))
+/* FIXME: This #if is due to a compile bug in Mac OS X.  Give it some
+   time and then remove this cruft.  See also
+   includes/gnutls/gnutlsxx.h. */
+credentials::credentials( credentials& c)
+{
+    this->type = c.type;
+    this->set_ptr( c.ptr());
+}
+#endif
+
+gnutls_credentials_type_t credentials::get_type() const
+{ 
+    return type; 
+}
+        
+exception::exception( int x) 
+{ 
+    retcode = x; 
+}
+
+int exception::get_code()
+{
+    return retcode;
+}
+
+const char* exception::what() const throw()
+{ 
+    return gnutls_strerror(retcode); 
+}
+
+
+
+
+dh_params::dh_params()
+{
+    RETWRAP(gnutls_dh_params_init( &params));
+}
+
+dh_params::~dh_params()
+{
+    gnutls_dh_params_deinit(params);
+}
+
+void dh_params::import_raw( const gnutls_datum_t & prime,
+                     const gnutls_datum_t & generator)
+{
+    RETWRAP( gnutls_dh_params_import_raw( params, &prime, &generator));
+}
+
+void dh_params::import_pkcs3( const gnutls_datum_t & pkcs3_params,
+                              gnutls_x509_crt_fmt_t format)
+{
+    RETWRAP(gnutls_dh_params_import_pkcs3( params, &pkcs3_params, format));
+}
+
+void dh_params::generate( unsigned int bits)
+{
+    RETWRAP(gnutls_dh_params_generate2( params, bits));
+}
+        
+void dh_params::export_pkcs3( gnutls_x509_crt_fmt_t format, unsigned char *params_data, size_t * params_data_size)
+{
+    RETWRAP( gnutls_dh_params_export_pkcs3( params, format, params_data, params_data_size));
+}
+
+void dh_params::export_raw( gnutls_datum_t& prime, gnutls_datum_t &generator)
+{
+    RETWRAP( gnutls_dh_params_export_raw( params, &prime, &generator, NULL));
+}
+
+gnutls_dh_params_t dh_params::get_params_t() const
+{
+    return params;
+}
+
+dh_params & dh_params::operator=(const dh_params& src)
+{
+    dh_params* dst = new dh_params;
+    int ret;
+    
+    ret = gnutls_dh_params_cpy( dst->params, src.params);
+    
+    if (ret < 0) {
+        delete dst;
+        throw(ret);
+    }
+    
+    return *dst;
+}
+
+
+// RSA
+
+rsa_params::rsa_params()
+{
+    RETWRAP(gnutls_rsa_params_init( &params));
+}
+
+rsa_params::~rsa_params()
+{
+    gnutls_rsa_params_deinit(params);
+}
+
+void rsa_params::import_pkcs1( const gnutls_datum_t & pkcs1_params,
+                              gnutls_x509_crt_fmt_t format)
+{
+    RETWRAP(gnutls_rsa_params_import_pkcs1( params, &pkcs1_params, format));
+}
+
+void rsa_params::generate( unsigned int bits)
+{
+    RETWRAP(gnutls_rsa_params_generate2( params, bits));
+}
+        
+void rsa_params::export_pkcs1( gnutls_x509_crt_fmt_t format, unsigned char *params_data, size_t * params_data_size)
+{
+    RETWRAP( gnutls_rsa_params_export_pkcs1( params, format, params_data, params_data_size));
+}
+
+gnutls_rsa_params_t rsa_params::get_params_t() const
+{
+    return params;
+}
+
+rsa_params & rsa_params::operator=(const rsa_params& src)
+{
+    rsa_params* dst = new rsa_params;
+    int ret;
+    
+    ret = gnutls_rsa_params_cpy( dst->params, src.params);
+    
+    if (ret < 0)
+        delete dst;
+    throw(ret);
+    
+    return *dst;
+}
+  
+void rsa_params::import_raw( const gnutls_datum_t & m,
+                         const gnutls_datum_t & e,
+                         const gnutls_datum_t & d,
+                         const gnutls_datum_t & p,
+                         const gnutls_datum_t & q,
+                         const gnutls_datum_t & u)
+{
+    
+    RETWRAP(gnutls_rsa_params_import_raw ( params, &m, &e, &d, &p, &q, &u));
+}
+  
+
+void rsa_params::export_raw( gnutls_datum_t & m, gnutls_datum_t & e,
+                      gnutls_datum_t & d, gnutls_datum_t & p,
+                      gnutls_datum_t & q, gnutls_datum_t & u)
+{
+    RETWRAP( gnutls_rsa_params_export_raw ( params, &m, &e, &d, &p, &q, &u, NULL));
+}
diff --git a/src/daemon/https/tls/io_debug.h b/src/daemon/https/tls/io_debug.h
new file mode 100644
index 00000000..9800565e
--- /dev/null
+++ b/src/daemon/https/tls/io_debug.h
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* This debug file was contributed by 
+ * Paul Sheer <psheer@icon.co.za>. Some changes were made by nmav.
+ * Its purpose is to debug non blocking behaviour of gnutls. The included
+ * send() and recv() functions return EAGAIN errors in random.
+ *
+ */
+
+#ifdef IO_DEBUG
+
+#include <gnutls_int.h>
+
+#define EDUNNO EAGAIN           /* EAGAIN */
+
+extern int errno;
+static int initialized_rand = 0;
+
+#define INITIALIZE_RAND if (initialized_rand==0) {\
+                srand(time(0)); \
+                initialized_rand = 1; \
+                }
+static int
+recv_debug (int fd, char *buf, int len, int flags)
+{
+  INITIALIZE_RAND;
+
+  if (!(rand () % IO_DEBUG))
+    {
+      errno = EDUNNO;
+      return -1;
+    }
+  if (len > 1)
+    len = 1;
+  return recv (fd, buf, len, flags);
+}
+
+#define recv recv_debug
+
+static int
+send_debug (int fd, const char *buf, int len, int flags)
+{
+  INITIALIZE_RAND;
+
+  if (!(rand () % IO_DEBUG))
+    {
+      errno = EDUNNO;
+      return -1;
+    }
+  if (len > 10)
+    len = 10;
+  return send (fd, buf, len, flags);
+}
+
+#define send send_debug
+
+#endif
diff --git a/src/daemon/https/tls/libgnutls-config b/src/daemon/https/tls/libgnutls-config
new file mode 100644
index 00000000..80580a89
--- /dev/null
+++ b/src/daemon/https/tls/libgnutls-config
@@ -0,0 +1,104 @@
+#!/bin/sh
+
+prefix=/home/lama/workbench/programming/c/gnunet/gnutls-2.2.3/build
+exec_prefix=${prefix}
+exec_prefix_set=no
+
+gnutls_libs="-L${exec_prefix}/lib -lgnutls -L/usr/lib -ltasn1 -lgcrypt "
+gnutls_cflags=" -I/usr/include -I${prefix}/include"
+gnutls_la_file="${exec_prefix}/lib/libgnutls.la"
+
+usage()
+{
+        cat <<EOF
+Usage: libgnutls-config [OPTIONS]
+Options:
+        [--prefix[=DIR]]
+        [--exec-prefix[=DIR]]
+        [--version]
+        [--libs]
+        [--cflags]
+EOF
+        exit $1
+}
+
+if test $# -eq 0; then
+        usage 1 1>&2
+fi
+
+while test $# -gt 0; do
+  case "$1" in
+  -*=*) optarg=`echo "$1" | sed 's/[-_a-zA-Z0-9]*=//'` ;;
+  *) optarg= ;;
+  esac
+
+  case $1 in
+    --prefix=*)
+      prefix=$optarg
+      if test $exec_prefix_set = no ; then
+        exec_prefix=$optarg
+      fi
+      ;;
+    --prefix)
+      echo_prefix=yes
+      ;;
+    --exec-prefix=*)
+      exec_prefix=$optarg
+      exec_prefix_set=yes
+      ;;
+    --exec-prefix)
+      echo_exec_prefix=yes
+      ;;
+    --version)
+      echo "2.2.3"
+      exit 0
+      ;;
+    --cflags)
+      echo_cflags=yes
+      ;;
+    --libs)
+      echo_libs=yes
+      ;;
+    --la-file)
+      echo_la_file=yes
+      ;;
+    --help)
+      usage 0
+      ;;
+    *)
+      usage 1 1>&2
+      ;;
+  esac
+  shift
+done
+
+if test "$echo_prefix" = "yes"; then
+    echo $prefix
+fi
+
+if test "$echo_exec_prefix" = "yes"; then
+    echo $exec_prefix
+fi
+
+if test "$echo_cflags" = "yes"; then
+    if test "${prefix}/include" != "/usr/include" ; then
+      includes="-I${prefix}/include"
+      for i in $gnutls_cflags ; do
+        if test "$i" = "-I${prefix}/include" ; then
+          includes=""
+        fi
+      done
+    fi
+    echo $includes $gnutls_cflags
+fi
+
+if test "$echo_la_file" = "yes"; then
+    echo ${gnutls_la_file}
+fi
+
+if test "$echo_libs" = "yes"; then
+    echo ${gnutls_libs}
+fi
+
+
+
diff --git a/src/daemon/https/tls/libgnutls.m4 b/src/daemon/https/tls/libgnutls.m4
new file mode 100644
index 00000000..1851ca23
--- /dev/null
+++ b/src/daemon/https/tls/libgnutls.m4
@@ -0,0 +1,160 @@
+dnl Autoconf macros for libgnutls
+dnl $id$
+
+# Modified for LIBGNUTLS -- nmav
+# Configure paths for LIBGCRYPT
+# Shamelessly stolen from the one of XDELTA by Owen Taylor
+# Werner Koch   99-12-09
+
+dnl AM_PATH_LIBGNUTLS([MINIMUM-VERSION, [ACTION-IF-FOUND [, ACTION-IF-NOT-FOUND ]]])
+dnl Test for libgnutls, and define LIBGNUTLS_CFLAGS and LIBGNUTLS_LIBS
+dnl
+AC_DEFUN([AM_PATH_LIBGNUTLS],
+[dnl
+dnl Get the cflags and libraries from the libgnutls-config script
+dnl
+AC_ARG_WITH(libgnutls-prefix,
+          [  --with-libgnutls-prefix=PFX   Prefix where libgnutls is installed (optional)],
+          libgnutls_config_prefix="$withval", libgnutls_config_prefix="")
+
+  if test x$libgnutls_config_prefix != x ; then
+     if test x${LIBGNUTLS_CONFIG+set} != xset ; then
+        LIBGNUTLS_CONFIG=$libgnutls_config_prefix/bin/libgnutls-config
+     fi
+  fi
+
+  AC_PATH_PROG(LIBGNUTLS_CONFIG, libgnutls-config, no)
+  min_libgnutls_version=ifelse([$1], ,0.1.0,$1)
+  AC_MSG_CHECKING(for libgnutls - version >= $min_libgnutls_version)
+  no_libgnutls=""
+  if test "$LIBGNUTLS_CONFIG" = "no" ; then
+    no_libgnutls=yes
+  else
+    LIBGNUTLS_CFLAGS=`$LIBGNUTLS_CONFIG $libgnutls_config_args --cflags`
+    LIBGNUTLS_LIBS=`$LIBGNUTLS_CONFIG $libgnutls_config_args --libs`
+    libgnutls_config_version=`$LIBGNUTLS_CONFIG $libgnutls_config_args --version`
+
+
+      ac_save_CFLAGS="$CFLAGS"
+      ac_save_LIBS="$LIBS"
+      CFLAGS="$CFLAGS $LIBGNUTLS_CFLAGS"
+      LIBS="$LIBS $LIBGNUTLS_LIBS"
+dnl
+dnl Now check if the installed libgnutls is sufficiently new. Also sanity
+dnl checks the results of libgnutls-config to some extent
+dnl
+      rm -f conf.libgnutlstest
+      AC_TRY_RUN([
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <gnutls.h>
+
+int
+main ()
+{
+    system ("touch conf.libgnutlstest");
+
+    if( strcmp( gnutls_check_version(NULL), "$libgnutls_config_version" ) )
+    {
+      printf("\n*** 'libgnutls-config --version' returned %s, but LIBGNUTLS (%s)\n",
+             "$libgnutls_config_version", gnutls_check_version(NULL) );
+      printf("*** was found! If libgnutls-config was correct, then it is best\n");
+      printf("*** to remove the old version of LIBGNUTLS. You may also be able to fix the error\n");
+      printf("*** by modifying your LD_LIBRARY_PATH enviroment variable, or by editing\n");
+      printf("*** /etc/ld.so.conf. Make sure you have run ldconfig if that is\n");
+      printf("*** required on your system.\n");
+      printf("*** If libgnutls-config was wrong, set the environment variable LIBGNUTLS_CONFIG\n");
+      printf("*** to point to the correct copy of libgnutls-config, and remove the file config.cache\n");
+      printf("*** before re-running configure\n");
+    }
+    else if ( strcmp(gnutls_check_version(NULL), LIBGNUTLS_VERSION ) )
+    {
+      printf("\n*** LIBGNUTLS header file (version %s) does not match\n", LIBGNUTLS_VERSION);
+      printf("*** library (version %s)\n", gnutls_check_version(NULL) );
+    }
+    else
+    {
+      if ( gnutls_check_version( "$min_libgnutls_version" ) )
+      {
+        return 0;
+      }
+     else
+      {
+        printf("no\n*** An old version of LIBGNUTLS (%s) was found.\n",
+                gnutls_check_version(NULL) );
+        printf("*** You need a version of LIBGNUTLS newer than %s. The latest version of\n",
+               "$min_libgnutls_version" );
+        printf("*** LIBGNUTLS is always available from ftp://gnutls.hellug.gr/pub/gnutls.\n");
+        printf("*** \n");
+        printf("*** If you have already installed a sufficiently new version, this error\n");
+        printf("*** probably means that the wrong copy of the libgnutls-config shell script is\n");
+        printf("*** being found. The easiest way to fix this is to remove the old version\n");
+        printf("*** of LIBGNUTLS, but you can also set the LIBGNUTLS_CONFIG environment to point to the\n");
+        printf("*** correct copy of libgnutls-config. (In this case, you will have to\n");
+        printf("*** modify your LD_LIBRARY_PATH enviroment variable, or edit /etc/ld.so.conf\n");
+        printf("*** so that the correct libraries are found at run-time))\n");
+      }
+    }
+  return 1;
+}
+],, no_libgnutls=yes,[echo $ac_n "cross compiling; assumed OK... $ac_c"])
+       CFLAGS="$ac_save_CFLAGS"
+       LIBS="$ac_save_LIBS"
+  fi
+
+  if test "x$no_libgnutls" = x ; then
+     AC_MSG_RESULT(yes)
+     ifelse([$2], , :, [$2])
+  else
+     if test -f conf.libgnutlstest ; then
+        :
+     else
+        AC_MSG_RESULT(no)
+     fi
+     if test "$LIBGNUTLS_CONFIG" = "no" ; then
+       echo "*** The libgnutls-config script installed by LIBGNUTLS could not be found"
+       echo "*** If LIBGNUTLS was installed in PREFIX, make sure PREFIX/bin is in"
+       echo "*** your path, or set the LIBGNUTLS_CONFIG environment variable to the"
+       echo "*** full path to libgnutls-config."
+     else
+       if test -f conf.libgnutlstest ; then
+        :
+       else
+          echo "*** Could not run libgnutls test program, checking why..."
+          CFLAGS="$CFLAGS $LIBGNUTLS_CFLAGS"
+          LIBS="$LIBS $LIBGNUTLS_LIBS"
+          AC_TRY_LINK([
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <gnutls.h>
+],      [ return !!gnutls_check_version(NULL); ],
+        [ echo "*** The test program compiled, but did not run. This usually means"
+          echo "*** that the run-time linker is not finding LIBGNUTLS or finding the wrong"
+          echo "*** version of LIBGNUTLS. If it is not finding LIBGNUTLS, you'll need to set your"
+          echo "*** LD_LIBRARY_PATH environment variable, or edit /etc/ld.so.conf to point"
+          echo "*** to the installed location  Also, make sure you have run ldconfig if that"
+          echo "*** is required on your system"
+          echo "***"
+          echo "*** If you have an old version installed, it is best to remove it, although"
+          echo "*** you may also be able to get things to work by modifying LD_LIBRARY_PATH"
+          echo "***" ],
+        [ echo "*** The test program failed to compile or link. See the file config.log for the"
+          echo "*** exact error that occured. This usually means LIBGNUTLS was incorrectly installed"
+          echo "*** or that you have moved LIBGNUTLS since it was installed. In the latter case, you"
+          echo "*** may want to edit the libgnutls-config script: $LIBGNUTLS_CONFIG" ])
+          CFLAGS="$ac_save_CFLAGS"
+          LIBS="$ac_save_LIBS"
+       fi
+     fi
+     LIBGNUTLS_CFLAGS=""
+     LIBGNUTLS_LIBS=""
+     ifelse([$3], , :, [$3])
+  fi
+  rm -f conf.libgnutlstest
+  AC_SUBST(LIBGNUTLS_CFLAGS)
+  AC_SUBST(LIBGNUTLS_LIBS)
+])
+
+dnl *-*wedit:notab*-*  Please keep this as the last line.
diff --git a/src/daemon/https/tls/libgnutls.vers b/src/daemon/https/tls/libgnutls.vers
new file mode 100644
index 00000000..f793617b
--- /dev/null
+++ b/src/daemon/https/tls/libgnutls.vers
@@ -0,0 +1,27 @@
+# libgnutls.vers -- Versioning script to control what symbols to export.
+# Copyright (C) 2005, 2006, 2007 Free Software Foundation
+#
+# Author: Simon Josefsson
+#
+# This file is part of GNUTLS.
+#
+# The GNUTLS library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public License
+# as published by the Free Software Foundation; either version 2.1 of
+# the License, or (at your option) any later version.
+#
+# The GNUTLS library is distributed in the hope that it will be
+#useful, but WITHOUT ANY WARRANTY; without even the implied warranty
+#of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+#Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with the GNUTLS library; if not, write to the Free
+# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+# MA 02110-1301, USA
+
+GNUTLS_1_4
+{
+  global: _gnutls*; gnutls*;
+  local: *;
+};
diff --git a/src/daemon/https/tls/libgnutlsxx.vers b/src/daemon/https/tls/libgnutlsxx.vers
new file mode 100644
index 00000000..8b8af51d
--- /dev/null
+++ b/src/daemon/https/tls/libgnutlsxx.vers
@@ -0,0 +1,30 @@
+# libgnutlsxx.vers -- Versioning script to control what symbols to export.
+# Copyright (C) 2005, 2006 Free Software Foundation
+#
+# Author: Simon Josefsson
+#
+# This file is part of GNUTLS.
+#
+# The GNUTLS library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public License
+# as published by the Free Software Foundation; either version 2.1 of
+# the License, or (at your option) any later version.
+#
+# The GNUTLS library is distributed in the hope that it will be
+#useful, but WITHOUT ANY WARRANTY; without even the implied warranty
+#of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+#Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with the GNUTLS library; if not, write to the Free
+# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
+# MA 02110-1301, USA
+
+GNUTLS_1_6
+{
+  global:
+    extern "C++" {
+      gnutls*;
+  };
+  local: *;
+};
diff --git a/src/daemon/https/tls/pkix.asn b/src/daemon/https/tls/pkix.asn
new file mode 100644
index 00000000..d46dfa07
--- /dev/null
+++ b/src/daemon/https/tls/pkix.asn
@@ -0,0 +1,1241 @@
+
+PKIX1 { }
+
+DEFINITIONS IMPLICIT TAGS ::=
+
+BEGIN
+
+-- This contains both PKIX1Implicit88 and RFC2630 ASN.1 modules.
+
+-- ISO arc for standard certificate and CRL extensions
+
+id-ce OBJECT IDENTIFIER  ::=  {joint-iso-ccitt(2) ds(5) 29}
+
+
+-- authority key identifier OID and syntax
+
+id-ce-authorityKeyIdentifier OBJECT IDENTIFIER ::=  { id-ce 35 }
+
+AuthorityKeyIdentifier ::= SEQUENCE {
+      keyIdentifier             [0] KeyIdentifier            OPTIONAL,
+      authorityCertIssuer       [1] GeneralNames             OPTIONAL,
+      authorityCertSerialNumber [2] CertificateSerialNumber  OPTIONAL }
+    -- authorityCertIssuer and authorityCertSerialNumber shall both
+    -- be present or both be absgent
+
+KeyIdentifier ::= OCTET STRING
+
+-- subject key identifier OID and syntax
+
+id-ce-subjectKeyIdentifier OBJECT IDENTIFIER ::=  { id-ce 14 }
+
+SubjectKeyIdentifier ::= KeyIdentifier
+
+-- key usage extension OID and syntax
+
+id-ce-keyUsage OBJECT IDENTIFIER ::=  { id-ce 15 }
+
+KeyUsage ::= BIT STRING {
+     digitalSignature        (0),
+     nonRepudiation          (1),
+     keyEncipherment         (2),
+     dataEncipherment        (3),
+     keyAgreement            (4),
+     keyCertSign             (5),
+     cRLSign                 (6),
+     encipherOnly            (7),
+     decipherOnly            (8) }
+
+-- private key usage period extension OID and syntax
+
+id-ce-privateKeyUsagePeriod OBJECT IDENTIFIER ::=  { id-ce 16 }
+
+PrivateKeyUsagePeriod ::= SEQUENCE {
+     notBefore       [0]     GeneralizedTime OPTIONAL,
+     notAfter        [1]     GeneralizedTime OPTIONAL }
+     -- either notBefore or notAfter shall be present
+
+-- certificate policies extension OID and syntax
+
+id-ce-certificatePolicies OBJECT IDENTIFIER ::=  { id-ce 32 }
+
+CertificatePolicies ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation
+
+PolicyInformation ::= SEQUENCE {
+     policyIdentifier   CertPolicyId,
+     policyQualifiers   SEQUENCE SIZE (1..MAX) OF
+             PolicyQualifierInfo OPTIONAL }
+
+CertPolicyId ::= OBJECT IDENTIFIER
+
+PolicyQualifierInfo ::= SEQUENCE {
+       policyQualifierId  PolicyQualifierId,
+       qualifier        ANY DEFINED BY policyQualifierId }
+
+-- Implementations that recognize additional policy qualifiers shall
+-- augment the following definition for PolicyQualifierId
+
+PolicyQualifierId ::=
+    OBJECT IDENTIFIER  -- ( id-qt-cps | id-qt-unotice )
+
+-- CPS pointer qualifier
+
+CPSuri ::= IA5String
+
+-- user notice qualifier
+
+UserNotice ::= SEQUENCE {
+     noticeRef        NoticeReference OPTIONAL,
+     explicitText     DisplayText OPTIONAL}
+
+NoticeReference ::= SEQUENCE {
+     organization     DisplayText,
+     noticeNumbers    SEQUENCE OF INTEGER }
+
+DisplayText ::= CHOICE {
+     visibleString    VisibleString  (SIZE (1..200)),
+     bmpString        BMPString      (SIZE (1..200)),
+     utf8String       UTF8String     (SIZE (1..200)) }
+
+-- policy mapping extension OID and syntax
+
+id-ce-policyMappings OBJECT IDENTIFIER ::=  { id-ce 33 }
+
+PolicyMappings ::= SEQUENCE SIZE (1..MAX) OF SEQUENCE {
+     issuerDomainPolicy      CertPolicyId,
+     subjectDomainPolicy     CertPolicyId }
+
+-- subject alternative name extension OID and syntax
+
+-- Directory string type --
+
+DirectoryString ::= CHOICE {
+      teletexString             TeletexString (SIZE (1..MAX)),
+      printableString           PrintableString (SIZE (1..MAX)),
+      universalString           UniversalString (SIZE (1..MAX)),
+      utf8String              UTF8String (SIZE (1..MAX)),
+      bmpString               BMPString (SIZE(1..MAX)),
+      -- IA5String is added here to handle old UID encoded as ia5String --
+      -- See tests/userid/ for more information.  It shouldn't be here, --
+      -- so if it causes problems, considering dropping it. --
+      ia5String               IA5String (SIZE(1..MAX)) }
+
+id-ce-subjectAltName OBJECT IDENTIFIER ::=  { id-ce 17 }
+
+SubjectAltName ::= GeneralNames
+
+GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
+
+GeneralName ::= CHOICE {
+     otherName                       [0]     AnotherName,
+     rfc822Name                      [1]     IA5String,
+     dNSName                         [2]     IA5String,
+     x400Address                     [3]     ORAddress,
+-- Changed to work with the libtasn1 parser.
+     directoryName                   [4]     EXPLICIT RDNSequence, --Name,
+     ediPartyName                    [5]     EDIPartyName,
+     uniformResourceIdentifier       [6]     IA5String,
+     iPAddress                       [7]     OCTET STRING,
+     registeredID                    [8]     OBJECT IDENTIFIER }
+
+-- AnotherName replaces OTHER-NAME ::= TYPE-IDENTIFIER, as
+-- TYPE-IDENTIFIER is not supported in the '88 ASN.1 syntax
+
+AnotherName ::= SEQUENCE {
+     type-id    OBJECT IDENTIFIER,
+     value      [0] EXPLICIT ANY DEFINED BY type-id }
+
+EDIPartyName ::= SEQUENCE {
+     nameAssigner            [0]     DirectoryString OPTIONAL,
+     partyName               [1]     DirectoryString }
+
+-- issuer alternative name extension OID and syntax
+
+id-ce-issuerAltName OBJECT IDENTIFIER ::=  { id-ce 18 }
+
+IssuerAltName ::= GeneralNames
+
+id-ce-subjectDirectoryAttributes OBJECT IDENTIFIER ::=  { id-ce 9 }
+
+SubjectDirectoryAttributes ::= SEQUENCE SIZE (1..MAX) OF Attribute
+
+-- basic constraints extension OID and syntax
+
+id-ce-basicConstraints OBJECT IDENTIFIER ::=  { id-ce 19 }
+
+BasicConstraints ::= SEQUENCE {
+     cA                      BOOLEAN DEFAULT FALSE,
+     pathLenConstraint       INTEGER (0..MAX) OPTIONAL }
+
+-- name constraints extension OID and syntax
+
+id-ce-nameConstraints OBJECT IDENTIFIER ::=  { id-ce 30 }
+
+NameConstraints ::= SEQUENCE {
+     permittedSubtrees       [0]     GeneralSubtrees OPTIONAL,
+     excludedSubtrees        [1]     GeneralSubtrees OPTIONAL }
+
+GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
+
+GeneralSubtree ::= SEQUENCE {
+     base                    GeneralName,
+     minimum         [0]     BaseDistance DEFAULT 0,
+     maximum         [1]     BaseDistance OPTIONAL }
+
+BaseDistance ::= INTEGER (0..MAX)
+
+-- policy constraints extension OID and syntax
+
+id-ce-policyConstraints OBJECT IDENTIFIER ::=  { id-ce 36 }
+
+PolicyConstraints ::= SEQUENCE {
+     requireExplicitPolicy           [0] SkipCerts OPTIONAL,
+     inhibitPolicyMapping            [1] SkipCerts OPTIONAL }
+
+SkipCerts ::= INTEGER (0..MAX)
+
+-- CRL distribution points extension OID and syntax
+
+id-ce-cRLDistributionPoints     OBJECT IDENTIFIER  ::=  {id-ce 31}
+
+CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint
+
+DistributionPoint ::= SEQUENCE {
+     distributionPoint       [0]     EXPLICIT DistributionPointName OPTIONAL,
+     reasons                 [1]     ReasonFlags OPTIONAL,
+     cRLIssuer               [2]     GeneralNames OPTIONAL
+}
+
+DistributionPointName ::= CHOICE {
+    fullName                [0]     GeneralNames,
+    nameRelativeToCRLIssuer [1]     RelativeDistinguishedName 
+}
+
+ReasonFlags ::= BIT STRING {
+     unused                  (0),
+     keyCompromise           (1),
+     cACompromise            (2),
+     affiliationChanged      (3),
+     superseded              (4),
+     cessationOfOperation    (5),
+     certificateHold         (6),
+     privilegeWithdrawn      (7),
+     aACompromise            (8) }
+
+-- extended key usage extension OID and syntax
+
+id-ce-extKeyUsage OBJECT IDENTIFIER ::= {id-ce 37}
+
+ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId
+
+KeyPurposeId ::= OBJECT IDENTIFIER
+
+-- extended key purpose OIDs
+id-kp-serverAuth      OBJECT IDENTIFIER ::= { id-kp 1 }
+id-kp-clientAuth      OBJECT IDENTIFIER ::= { id-kp 2 }
+id-kp-codeSigning     OBJECT IDENTIFIER ::= { id-kp 3 }
+id-kp-emailProtection OBJECT IDENTIFIER ::= { id-kp 4 }
+id-kp-ipsecEndSystem  OBJECT IDENTIFIER ::= { id-kp 5 }
+id-kp-ipsecTunnel     OBJECT IDENTIFIER ::= { id-kp 6 }
+id-kp-ipsecUser       OBJECT IDENTIFIER ::= { id-kp 7 }
+id-kp-timeStamping    OBJECT IDENTIFIER ::= { id-kp 8 }
+
+-- authority info access
+
+id-pe-authorityInfoAccess OBJECT IDENTIFIER ::= { id-pe 1 }
+
+AuthorityInfoAccessSyntax  ::=
+        SEQUENCE SIZE (1..MAX) OF AccessDescription
+
+AccessDescription  ::=  SEQUENCE {
+        accessMethod          OBJECT IDENTIFIER,
+        accessLocation        GeneralName  }
+
+-- CRL number extension OID and syntax
+
+id-ce-cRLNumber OBJECT IDENTIFIER ::= { id-ce 20 }
+
+CRLNumber ::= INTEGER (0..MAX)
+
+-- issuing distribution point extension OID and syntax
+
+id-ce-issuingDistributionPoint OBJECT IDENTIFIER ::= { id-ce 28 }
+
+IssuingDistributionPoint ::= SEQUENCE {
+     distributionPoint       [0] DistributionPointName OPTIONAL,
+     onlyContainsUserCerts   [1] BOOLEAN DEFAULT FALSE,
+     onlyContainsCACerts     [2] BOOLEAN DEFAULT FALSE,
+     onlySomeReasons         [3] ReasonFlags OPTIONAL,
+     indirectCRL             [4] BOOLEAN DEFAULT FALSE }
+
+
+id-ce-deltaCRLIndicator OBJECT IDENTIFIER ::= { id-ce 27 }
+
+-- deltaCRLIndicator ::= BaseCRLNumber
+
+BaseCRLNumber ::= CRLNumber
+
+-- CRL reasons extension OID and syntax
+
+id-ce-cRLReasons OBJECT IDENTIFIER ::= { id-ce 21 }
+
+CRLReason ::= ENUMERATED {
+     unspecified             (0),
+     keyCompromise           (1),
+     cACompromise            (2),
+     affiliationChanged      (3),
+     superseded              (4),
+     cessationOfOperation    (5),
+     certificateHold         (6),
+     removeFromCRL           (8) }
+
+-- certificate issuer CRL entry extension OID and syntax
+
+id-ce-certificateIssuer OBJECT IDENTIFIER ::= { id-ce 29 }
+
+CertificateIssuer ::= GeneralNames
+
+-- hold instruction extension OID and syntax
+
+id-ce-holdInstructionCode OBJECT IDENTIFIER ::= { id-ce 23 }
+
+HoldInstructionCode ::= OBJECT IDENTIFIER
+
+-- ANSI x9 holdinstructions
+
+-- ANSI x9 arc holdinstruction arc
+holdInstruction OBJECT IDENTIFIER ::=
+          {joint-iso-itu-t(2) member-body(2) us(840) x9cm(10040) 2}
+
+-- ANSI X9 holdinstructions referenced by this standard
+id-holdinstruction-none OBJECT IDENTIFIER  ::=
+                {holdInstruction 1} -- deprecated
+id-holdinstruction-callissuer OBJECT IDENTIFIER ::=
+                {holdInstruction 2}
+id-holdinstruction-reject OBJECT IDENTIFIER ::=
+                {holdInstruction 3}
+
+-- invalidity date CRL entry extension OID and syntax
+
+id-ce-invalidityDate OBJECT IDENTIFIER ::= { id-ce 24 }
+
+InvalidityDate ::=  GeneralizedTime
+
+
+-- --------------------------------------
+--  EXPLICIT
+-- --------------------------------------
+
+-- UNIVERSAL Types defined in '93 and '98 ASN.1
+-- but required by this specification
+
+VisibleString ::= [UNIVERSAL 26] IMPLICIT OCTET STRING
+
+NumericString ::= [UNIVERSAL 18] IMPLICIT OCTET STRING
+
+IA5String ::= [UNIVERSAL 22] IMPLICIT OCTET STRING
+
+TeletexString ::= [UNIVERSAL 20] IMPLICIT OCTET STRING
+
+PrintableString ::= [UNIVERSAL 19] IMPLICIT OCTET STRING
+
+UniversalString ::= [UNIVERSAL 28] IMPLICIT OCTET STRING
+        -- UniversalString is defined in ASN.1:1993
+
+BMPString ::= [UNIVERSAL 30] IMPLICIT OCTET STRING
+      -- BMPString is the subtype of UniversalString and models
+       -- the Basic Multilingual Plane of ISO/IEC/ITU 10646-1
+
+UTF8String ::= [UNIVERSAL 12] IMPLICIT OCTET STRING
+        -- The content of this type conforms to RFC 2279.
+
+
+-- PKIX specific OIDs
+
+id-pkix  OBJECT IDENTIFIER  ::=
+         { iso(1) identified-organization(3) dod(6) internet(1)
+                    security(5) mechanisms(5) pkix(7) }
+
+-- PKIX arcs
+
+id-pe OBJECT IDENTIFIER  ::=  { id-pkix 1 }
+        -- arc for private certificate extensions
+id-qt OBJECT IDENTIFIER ::= { id-pkix 2 }
+        -- arc for policy qualifier types
+id-kp OBJECT IDENTIFIER ::= { id-pkix 3 }
+        -- arc for extended key purpose OIDS
+id-ad OBJECT IDENTIFIER ::= { id-pkix 48 }
+        -- arc for access descriptors
+
+-- policyQualifierIds for Internet policy qualifiers
+
+id-qt-cps      OBJECT IDENTIFIER ::=  { id-qt 1 }
+        -- OID for CPS qualifier
+id-qt-unotice  OBJECT IDENTIFIER ::=  { id-qt 2 }
+        -- OID for user notice qualifier
+
+-- access descriptor definitions
+
+id-ad-ocsp      OBJECT IDENTIFIER ::= { id-ad 1 }
+id-ad-caIssuers OBJECT IDENTIFIER ::= { id-ad 2 }
+
+-- attribute data types --
+
+Attribute       ::=     SEQUENCE {
+        type            AttributeType,
+        values  SET OF AttributeValue
+                -- at least one value is required -- 
+}
+
+AttributeType           ::=   OBJECT IDENTIFIER
+
+AttributeValue          ::=   ANY DEFINED BY type
+
+AttributeTypeAndValue           ::=     SEQUENCE {
+        type    AttributeType,
+        value   AttributeValue }
+
+-- suggested naming attributes: Definition of the following
+--  information object set may be augmented to meet local
+--  requirements.  Note that deleting members of the set may
+--  prevent interoperability with conforming implementations.
+--  presented in pairs: the AttributeType followed by the
+--  type definition for the corresponding AttributeValue
+
+-- Arc for standard naming attributes
+id-at           OBJECT IDENTIFIER ::= {joint-iso-ccitt(2) ds(5) 4}
+
+-- Attributes of type NameDirectoryString
+id-at-initials          AttributeType ::= { id-at 43 }
+X520initials ::= DirectoryString
+
+id-at-generationQualifier AttributeType ::= { id-at 44 }
+X520generationQualifier ::= DirectoryString
+
+id-at-surname           AttributeType ::= { id-at 4 }
+X520surName ::= DirectoryString
+
+id-at-givenName         AttributeType ::= { id-at 42 }
+X520givenName ::= DirectoryString
+
+id-at-name              AttributeType ::= { id-at 41 }
+X520name        ::= DirectoryString
+
+id-at-commonName        AttributeType   ::=     {id-at 3}
+X520CommonName  ::=      DirectoryString
+
+id-at-localityName      AttributeType   ::=     {id-at 7}
+X520LocalityName ::= DirectoryString
+
+id-at-stateOrProvinceName       AttributeType   ::=     {id-at 8}
+X520StateOrProvinceName         ::= DirectoryString
+
+id-at-organizationName          AttributeType   ::=     {id-at 10}
+X520OrganizationName ::= DirectoryString
+
+id-at-organizationalUnitName    AttributeType   ::=     {id-at 11}
+X520OrganizationalUnitName ::= DirectoryString
+
+id-at-title     AttributeType   ::=     {id-at 12}
+X520Title ::=   DirectoryString
+
+id-at-description     AttributeType   ::=     {id-at 13}
+X520Description ::=   DirectoryString
+
+id-at-dnQualifier       AttributeType   ::=     {id-at 46}
+X520dnQualifier ::=     PrintableString
+
+id-at-countryName       AttributeType   ::=     {id-at 6}
+X520countryName ::=     PrintableString (SIZE (2)) -- IS 3166 codes
+
+id-at-serialNumber       AttributeType   ::=     {id-at 5}
+X520serialNumber ::=     PrintableString
+
+id-at-telephoneNumber       AttributeType   ::=     {id-at 20}
+X520telephoneNumber ::=     PrintableString
+
+id-at-facsimileTelephoneNumber       AttributeType   ::=     {id-at 23}
+X520facsimileTelephoneNumber ::=     PrintableString
+
+id-at-pseudonym         AttributeType   ::=     {id-at 65}
+X520pseudonym ::=       DirectoryString
+
+id-at-name      AttributeType   ::=     {id-at 41}
+X520name ::=    DirectoryString
+
+id-at-streetAddress     AttributeType   ::=     {id-at 9}
+X520streetAddress ::=   DirectoryString
+
+id-at-postalAddress     AttributeType   ::=     {id-at 16}
+X520postalAddress ::= PostalAddress
+
+PostalAddress ::= SEQUENCE OF DirectoryString
+
+
+ -- Legacy attributes
+
+pkcs OBJECT IDENTIFIER ::=
+       { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) }
+
+pkcs-9 OBJECT IDENTIFIER ::=
+       { pkcs 9 }
+
+
+emailAddress AttributeType      ::= { pkcs-9 1 }
+
+Pkcs9email ::= IA5String (SIZE (1..ub-emailaddress-length))
+
+-- naming data types --
+
+Name            ::=   CHOICE { -- only one possibility for now --
+                                 rdnSequence  RDNSequence }
+
+RDNSequence     ::=   SEQUENCE OF RelativeDistinguishedName
+
+DistinguishedName       ::=   RDNSequence
+
+RelativeDistinguishedName  ::=
+                    SET SIZE (1 .. MAX) OF AttributeTypeAndValue
+
+
+
+-- --------------------------------------------------------
+-- certificate and CRL specific structures begin here
+-- --------------------------------------------------------
+
+Certificate  ::=  SEQUENCE  {
+     tbsCertificate       TBSCertificate,
+     signatureAlgorithm   AlgorithmIdentifier,
+     signature            BIT STRING  }
+
+TBSCertificate  ::=  SEQUENCE  {
+     version         [0]  EXPLICIT Version DEFAULT v1,
+     serialNumber         CertificateSerialNumber,
+     signature            AlgorithmIdentifier,
+     issuer               Name,
+     validity             Validity,
+     subject              Name,
+     subjectPublicKeyInfo SubjectPublicKeyInfo,
+     issuerUniqueID  [1]  IMPLICIT UniqueIdentifier OPTIONAL,
+                          -- If present, version shall be v2 or v3
+     subjectUniqueID [2]  IMPLICIT UniqueIdentifier OPTIONAL,
+                          -- If present, version shall be v2 or v3
+     extensions      [3]  EXPLICIT Extensions OPTIONAL
+                          -- If present, version shall be v3 --  
+}
+
+Version  ::=  INTEGER  {  v1(0), v2(1), v3(2)  }
+
+CertificateSerialNumber  ::=  INTEGER
+
+Validity ::= SEQUENCE {
+     notBefore      Time,
+     notAfter       Time }
+
+Time ::= CHOICE {
+     utcTime        UTCTime,
+     generalTime    GeneralizedTime }
+
+UniqueIdentifier  ::=  BIT STRING
+
+SubjectPublicKeyInfo  ::=  SEQUENCE  {
+     algorithm            AlgorithmIdentifier,
+     subjectPublicKey     BIT STRING  }
+
+Extensions  ::=  SEQUENCE SIZE (1..MAX) OF Extension
+
+Extension  ::=  SEQUENCE  {
+     extnID      OBJECT IDENTIFIER,
+     critical    BOOLEAN DEFAULT FALSE,
+     extnValue   OCTET STRING  }
+
+
+-- ------------------------------------------
+-- CRL structures
+-- ------------------------------------------
+
+CertificateList  ::=  SEQUENCE  {
+     tbsCertList          TBSCertList,
+     signatureAlgorithm   AlgorithmIdentifier,
+     signature            BIT STRING  }
+
+TBSCertList  ::=  SEQUENCE  {
+     version                 Version OPTIONAL,
+                                  -- if present, shall be v2
+     signature               AlgorithmIdentifier,
+     issuer                  Name,
+     thisUpdate              Time,
+     nextUpdate              Time OPTIONAL,
+     revokedCertificates     SEQUENCE OF SEQUENCE  {
+          userCertificate         CertificateSerialNumber,
+          revocationDate          Time,
+          crlEntryExtensions      Extensions OPTIONAL
+                                         -- if present, shall be v2
+                               }  OPTIONAL,
+     crlExtensions           [0] EXPLICIT Extensions OPTIONAL
+                                         -- if present, shall be v2 -- 
+}
+
+-- Version, Time, CertificateSerialNumber, and Extensions were
+-- defined earlier for use in the certificate structure
+
+AlgorithmIdentifier  ::=  SEQUENCE  {
+     algorithm               OBJECT IDENTIFIER,
+     parameters              ANY DEFINED BY algorithm OPTIONAL  }
+                                -- contains a value of the type
+                                -- registered for use with the
+                                -- algorithm object identifier value
+
+-- Algorithm OIDs and parameter structures
+
+pkcs-1 OBJECT IDENTIFIER ::= {
+     pkcs 1 }
+
+rsaEncryption OBJECT IDENTIFIER ::=  { pkcs-1 1 }
+
+md2WithRSAEncryption OBJECT IDENTIFIER  ::=  { pkcs-1 2 }
+
+md5WithRSAEncryption OBJECT IDENTIFIER  ::=  { pkcs-1 4 }
+
+sha1WithRSAEncryption OBJECT IDENTIFIER  ::=  { pkcs-1 5 }
+
+id-dsa-with-sha1 OBJECT IDENTIFIER ::=  {
+     iso(1) member-body(2) us(840) x9-57 (10040) x9algorithm(4) 3 }
+
+Dss-Sig-Value ::= SEQUENCE {
+     r       INTEGER,
+     s       INTEGER  
+}
+
+dhpublicnumber OBJECT IDENTIFIER ::= {
+     iso(1) member-body(2) us(840) ansi-x942(10046) number-type(2) 1 }
+
+DomainParameters ::= SEQUENCE {
+     p       INTEGER, -- odd prime, p=jq +1
+     g       INTEGER, -- generator, g
+     q       INTEGER, -- factor of p-1
+     j       INTEGER OPTIONAL, -- subgroup factor, j>= 2
+     validationParms  ValidationParms OPTIONAL }
+
+ValidationParms ::= SEQUENCE {
+     seed             BIT STRING,
+     pgenCounter      INTEGER }
+
+id-dsa OBJECT IDENTIFIER ::= {
+     iso(1) member-body(2) us(840) x9-57(10040) x9algorithm(4) 1 }
+
+Dss-Parms  ::=  SEQUENCE  {
+     p             INTEGER,
+     q             INTEGER,
+     g             INTEGER  }
+
+-- x400 address syntax starts here
+--      OR Names
+
+ORAddress ::= SEQUENCE {
+   built-in-standard-attributes BuiltInStandardAttributes,
+   built-in-domain-defined-attributes
+                        BuiltInDomainDefinedAttributes OPTIONAL,
+   -- see also teletex-domain-defined-attributes
+   extension-attributes ExtensionAttributes OPTIONAL }
+--      The OR-address is semantically absent from the OR-name if the
+--      built-in-standard-attribute sequence is empty and the
+--      built-in-domain-defined-attributes and extension-attributes are
+--      both omitted.
+
+--      Built-in Standard Attributes
+
+BuiltInStandardAttributes ::= SEQUENCE {
+   country-name CountryName OPTIONAL,
+   administration-domain-name AdministrationDomainName OPTIONAL,
+   network-address      [0] EXPLICIT NetworkAddress OPTIONAL,
+   -- see also extended-network-address
+   terminal-identifier  [1] EXPLICIT TerminalIdentifier OPTIONAL,
+   private-domain-name  [2] EXPLICIT PrivateDomainName OPTIONAL,
+   organization-name    [3] EXPLICIT OrganizationName OPTIONAL,
+   -- see also teletex-organization-name
+   numeric-user-identifier      [4] EXPLICIT NumericUserIdentifier OPTIONAL,
+   personal-name        [5] EXPLICIT PersonalName OPTIONAL,
+   -- see also teletex-personal-name
+   organizational-unit-names    [6] EXPLICIT OrganizationalUnitNames OPTIONAL
+   -- see also teletex-organizational-unit-names -- 
+}
+
+CountryName ::= [APPLICATION 1] CHOICE {
+   x121-dcc-code NumericString
+                (SIZE (ub-country-name-numeric-length)),
+   iso-3166-alpha2-code PrintableString
+                (SIZE (ub-country-name-alpha-length)) }
+
+AdministrationDomainName ::= [APPLICATION 2] EXPLICIT CHOICE {
+   numeric NumericString (SIZE (0..ub-domain-name-length)),
+   printable PrintableString (SIZE (0..ub-domain-name-length)) }
+
+NetworkAddress ::= X121Address  -- see also extended-network-address
+
+X121Address ::= NumericString (SIZE (1..ub-x121-address-length))
+
+TerminalIdentifier ::= PrintableString (SIZE (1..ub-terminal-id-length))
+
+PrivateDomainName ::= CHOICE {
+   numeric NumericString (SIZE (1..ub-domain-name-length)),
+   printable PrintableString (SIZE (1..ub-domain-name-length)) }
+
+OrganizationName ::= PrintableString
+                            (SIZE (1..ub-organization-name-length))
+-- see also teletex-organization-name
+
+NumericUserIdentifier ::= NumericString
+                            (SIZE (1..ub-numeric-user-id-length))
+
+PersonalName ::= SET {
+   surname [0] PrintableString (SIZE (1..ub-surname-length)),
+   given-name [1] PrintableString
+                        (SIZE (1..ub-given-name-length)) OPTIONAL,
+   initials [2] PrintableString (SIZE (1..ub-initials-length)) OPTIONAL,
+   generation-qualifier [3] PrintableString
+                (SIZE (1..ub-generation-qualifier-length)) OPTIONAL }
+-- see also teletex-personal-name
+
+OrganizationalUnitNames ::= SEQUENCE SIZE (1..ub-organizational-units)
+                                        OF OrganizationalUnitName
+-- see also teletex-organizational-unit-names
+
+OrganizationalUnitName ::= PrintableString (SIZE
+                        (1..ub-organizational-unit-name-length))
+
+--      Built-in Domain-defined Attributes
+
+BuiltInDomainDefinedAttributes ::= SEQUENCE SIZE
+                                (1..ub-domain-defined-attributes) OF
+                                BuiltInDomainDefinedAttribute
+
+BuiltInDomainDefinedAttribute ::= SEQUENCE {
+   type PrintableString (SIZE
+                        (1..ub-domain-defined-attribute-type-length)),
+   value PrintableString (SIZE
+                        (1..ub-domain-defined-attribute-value-length))}
+
+--      Extension Attributes
+
+ExtensionAttributes ::= SET SIZE (1..ub-extension-attributes) OF
+                        ExtensionAttribute
+
+ExtensionAttribute ::=  SEQUENCE {
+   extension-attribute-type [0] EXPLICIT INTEGER (0..ub-extension-attributes),
+   extension-attribute-value [1] EXPLICIT
+                        ANY DEFINED BY extension-attribute-type }
+
+-- Extension types and attribute values
+--
+
+common-name INTEGER ::= 1
+
+CommonName ::= PrintableString (SIZE (1..ub-common-name-length))
+
+teletex-common-name INTEGER ::= 2
+
+TeletexCommonName ::= TeletexString (SIZE (1..ub-common-name-length))
+
+teletex-organization-name INTEGER ::= 3
+
+TeletexOrganizationName ::=
+                TeletexString (SIZE (1..ub-organization-name-length))
+
+teletex-personal-name INTEGER ::= 4
+
+TeletexPersonalName ::= SET {
+   surname [0] EXPLICIT TeletexString (SIZE (1..ub-surname-length)),
+   given-name [1] EXPLICIT TeletexString
+                (SIZE (1..ub-given-name-length)) OPTIONAL,
+   initials [2] EXPLICIT TeletexString (SIZE (1..ub-initials-length)) OPTIONAL,
+   generation-qualifier [3] EXPLICIT TeletexString (SIZE
+                (1..ub-generation-qualifier-length)) OPTIONAL }
+
+teletex-organizational-unit-names INTEGER ::= 5
+
+TeletexOrganizationalUnitNames ::= SEQUENCE SIZE
+        (1..ub-organizational-units) OF TeletexOrganizationalUnitName
+
+TeletexOrganizationalUnitName ::= TeletexString
+                        (SIZE (1..ub-organizational-unit-name-length))
+
+pds-name INTEGER ::= 7
+
+PDSName ::= PrintableString (SIZE (1..ub-pds-name-length))
+
+physical-delivery-country-name INTEGER ::= 8
+
+PhysicalDeliveryCountryName ::= CHOICE {
+   x121-dcc-code NumericString (SIZE (ub-country-name-numeric-length)),
+   iso-3166-alpha2-code PrintableString
+                        (SIZE (ub-country-name-alpha-length)) }
+
+postal-code INTEGER ::= 9
+
+PostalCode ::= CHOICE {
+   numeric-code NumericString (SIZE (1..ub-postal-code-length)),
+   printable-code PrintableString (SIZE (1..ub-postal-code-length)) }
+
+physical-delivery-office-name INTEGER ::= 10
+
+PhysicalDeliveryOfficeName ::= PDSParameter
+
+physical-delivery-office-number INTEGER ::= 11
+
+PhysicalDeliveryOfficeNumber ::= PDSParameter
+
+extension-OR-address-components INTEGER ::= 12
+
+ExtensionORAddressComponents ::= PDSParameter
+
+physical-delivery-personal-name INTEGER ::= 13
+
+PhysicalDeliveryPersonalName ::= PDSParameter
+
+physical-delivery-organization-name INTEGER ::= 14
+
+PhysicalDeliveryOrganizationName ::= PDSParameter
+
+extension-physical-delivery-address-components INTEGER ::= 15
+
+ExtensionPhysicalDeliveryAddressComponents ::= PDSParameter
+
+unformatted-postal-address INTEGER ::= 16
+
+UnformattedPostalAddress ::= SET {
+   printable-address SEQUENCE SIZE (1..ub-pds-physical-address-lines) OF
+           PrintableString (SIZE (1..ub-pds-parameter-length)) OPTIONAL,
+   teletex-string TeletexString
+         (SIZE (1..ub-unformatted-address-length)) OPTIONAL }
+
+street-address INTEGER ::= 17
+
+StreetAddress ::= PDSParameter
+
+post-office-box-address INTEGER ::= 18
+
+PostOfficeBoxAddress ::= PDSParameter
+
+poste-restante-address INTEGER ::= 19
+
+PosteRestanteAddress ::= PDSParameter
+
+unique-postal-name INTEGER ::= 20
+
+UniquePostalName ::= PDSParameter
+
+local-postal-attributes INTEGER ::= 21
+
+LocalPostalAttributes ::= PDSParameter
+
+PDSParameter ::= SET {
+   printable-string PrintableString
+                (SIZE(1..ub-pds-parameter-length)) OPTIONAL,
+   teletex-string TeletexString
+                (SIZE(1..ub-pds-parameter-length)) OPTIONAL }
+
+extended-network-address INTEGER ::= 22
+
+ExtendedNetworkAddress ::= CHOICE {
+   e163-4-address SEQUENCE {
+        number [0] EXPLICIT NumericString (SIZE (1..ub-e163-4-number-length)),
+        sub-address [1] EXPLICIT NumericString
+                (SIZE (1..ub-e163-4-sub-address-length)) OPTIONAL },
+   psap-address [0] EXPLICIT PresentationAddress }
+
+PresentationAddress ::= SEQUENCE {
+        pSelector       [0] EXPLICIT OCTET STRING OPTIONAL,
+        sSelector       [1] EXPLICIT OCTET STRING OPTIONAL,
+        tSelector       [2] EXPLICIT OCTET STRING OPTIONAL,
+        nAddresses      [3] EXPLICIT SET SIZE (1..MAX) OF OCTET STRING }
+
+terminal-type  INTEGER ::= 23
+
+TerminalType ::= INTEGER {
+   telex (3),
+   teletex (4),
+   g3-facsimile (5),
+   g4-facsimile (6),
+   ia5-terminal (7),
+   videotex (8) } -- (0..ub-integer-options)
+
+--      Extension Domain-defined Attributes
+
+teletex-domain-defined-attributes INTEGER ::= 6
+
+TeletexDomainDefinedAttributes ::= SEQUENCE SIZE
+   (1..ub-domain-defined-attributes) OF TeletexDomainDefinedAttribute
+
+TeletexDomainDefinedAttribute ::= SEQUENCE {
+        type TeletexString
+               (SIZE (1..ub-domain-defined-attribute-type-length)),
+        value TeletexString
+               (SIZE (1..ub-domain-defined-attribute-value-length)) }
+
+--  specifications of Upper Bounds shall be regarded as mandatory
+--  from Annex B of ITU-T X.411 Reference Definition of MTS Parameter
+--  Upper Bounds
+
+--      Upper Bounds
+ub-name INTEGER ::=     32768
+ub-common-name  INTEGER ::=     64
+ub-locality-name        INTEGER ::=     128
+ub-state-name   INTEGER ::=     128
+ub-organization-name    INTEGER ::=     64
+ub-organizational-unit-name     INTEGER ::=     64
+ub-title        INTEGER ::=     64
+ub-match        INTEGER ::=     128
+
+ub-emailaddress-length INTEGER ::= 128
+
+ub-common-name-length INTEGER ::= 64
+ub-country-name-alpha-length INTEGER ::= 2
+ub-country-name-numeric-length INTEGER ::= 3
+ub-domain-defined-attributes INTEGER ::= 4
+ub-domain-defined-attribute-type-length INTEGER ::= 8
+ub-domain-defined-attribute-value-length INTEGER ::= 128
+ub-domain-name-length INTEGER ::= 16
+ub-extension-attributes INTEGER ::= 256
+ub-e163-4-number-length INTEGER ::= 15
+ub-e163-4-sub-address-length INTEGER ::= 40
+ub-generation-qualifier-length INTEGER ::= 3
+ub-given-name-length INTEGER ::= 16
+ub-initials-length INTEGER ::= 5
+ub-integer-options INTEGER ::= 256
+ub-numeric-user-id-length INTEGER ::= 32
+ub-organization-name-length INTEGER ::= 64
+ub-organizational-unit-name-length INTEGER ::= 32
+ub-organizational-units INTEGER ::= 4
+ub-pds-name-length INTEGER ::= 16
+ub-pds-parameter-length INTEGER ::= 30
+ub-pds-physical-address-lines INTEGER ::= 6
+ub-postal-code-length INTEGER ::= 16
+ub-surname-length INTEGER ::= 40
+ub-terminal-id-length INTEGER ::= 24
+ub-unformatted-address-length INTEGER ::= 180
+ub-x121-address-length INTEGER ::= 16
+
+-- Note - upper bounds on string types, such as TeletexString, are
+-- measured in characters.  Excepting PrintableString or IA5String, a
+-- significantly greater number of octets will be required to hold
+-- such a value.  As a minimum, 16 octets, or twice the specified upper
+-- bound, whichever is the larger, should be allowed for TeletexString.
+-- For UTF8String or UniversalString at least four times the upper
+-- bound should be allowed.
+
+
+
+-- END of PKIX1Implicit88
+
+
+-- BEGIN of RFC2630
+
+-- Cryptographic Message Syntax
+
+pkcs-7-ContentInfo ::= SEQUENCE {
+  contentType pkcs-7-ContentType,
+  content [0] EXPLICIT ANY DEFINED BY contentType }
+
+pkcs-7-DigestInfo ::= SEQUENCE {
+  digestAlgorithm pkcs-7-DigestAlgorithmIdentifier,
+  digest pkcs-7-Digest 
+}
+
+pkcs-7-Digest ::= OCTET STRING
+
+pkcs-7-ContentType ::= OBJECT IDENTIFIER
+
+pkcs-7-SignedData ::= SEQUENCE {
+  version pkcs-7-CMSVersion,
+  digestAlgorithms pkcs-7-DigestAlgorithmIdentifiers,
+  encapContentInfo pkcs-7-EncapsulatedContentInfo,
+  certificates [0] IMPLICIT pkcs-7-CertificateSet OPTIONAL,
+  crls [1] IMPLICIT pkcs-7-CertificateRevocationLists OPTIONAL,
+  signerInfos pkcs-7-SignerInfos 
+}
+
+pkcs-7-CMSVersion ::= INTEGER  { v0(0), v1(1), v2(2), v3(3), v4(4) }
+
+pkcs-7-DigestAlgorithmIdentifiers ::= SET OF pkcs-7-DigestAlgorithmIdentifier
+
+pkcs-7-DigestAlgorithmIdentifier ::= AlgorithmIdentifier
+
+pkcs-7-EncapsulatedContentInfo ::= SEQUENCE {
+  eContentType pkcs-7-ContentType,
+  eContent [0] EXPLICIT OCTET STRING OPTIONAL }
+
+-- We don't use CertificateList here since we only want
+-- to read the raw data.
+pkcs-7-CertificateRevocationLists ::= SET OF ANY
+
+pkcs-7-CertificateChoices ::= CHOICE {
+-- Although the paper uses Certificate type, we
+-- don't use it since, we don't need to parse it.
+-- We only need to read and store it.
+  certificate ANY
+}
+
+pkcs-7-CertificateSet ::= SET OF pkcs-7-CertificateChoices
+
+pkcs-7-SignerInfos ::= SET OF ANY -- this is not correct but we don't use it
+ -- anyway
+
+
+-- BEGIN of RFC2986
+
+-- Certificate requests
+pkcs-10-CertificationRequestInfo ::= SEQUENCE {
+     version       INTEGER { v1(0) },
+     subject       Name,
+     subjectPKInfo SubjectPublicKeyInfo,
+     attributes    [0] Attributes
+}
+
+Attributes ::= SET OF Attribute
+
+pkcs-10-CertificationRequest ::= SEQUENCE {
+     certificationRequestInfo pkcs-10-CertificationRequestInfo,
+     signatureAlgorithm AlgorithmIdentifier,
+     signature          BIT STRING
+}
+
+-- stuff from PKCS#9
+
+pkcs-9-ub-challengePassword   INTEGER ::= 255
+
+pkcs-9-certTypes OBJECT IDENTIFIER ::= {pkcs-9 22}
+pkcs-9-crlTypes OBJECT IDENTIFIER ::= {pkcs-9 23}
+
+pkcs-9-at-challengePassword OBJECT IDENTIFIER   ::= {pkcs-9 7}
+
+pkcs-9-challengePassword        ::= CHOICE {
+      printableString       PrintableString (SIZE (1..pkcs-9-ub-challengePassword)),
+      utf8String            UTF8String (SIZE (1..pkcs-9-ub-challengePassword)) }
+
+pkcs-9-at-localKeyId               OBJECT IDENTIFIER ::= {pkcs-9 21}
+
+pkcs-9-localKeyId ::= OCTET STRING
+
+pkcs-9-at-friendlyName             OBJECT IDENTIFIER ::= {pkcs-9 20}
+
+pkcs-9-friendlyName ::= BMPString      (SIZE (1..255))
+
+-- PKCS #8 stuff
+
+-- Private-key information syntax
+
+pkcs-8-PrivateKeyInfo ::= SEQUENCE {
+  version pkcs-8-Version,
+  privateKeyAlgorithm AlgorithmIdentifier,
+  privateKey pkcs-8-PrivateKey,
+  attributes [0] Attributes OPTIONAL }
+
+pkcs-8-Version ::= INTEGER {v1(0)}
+
+pkcs-8-PrivateKey ::= OCTET STRING
+
+pkcs-8-Attributes ::= SET OF Attribute
+
+-- Encrypted private-key information syntax
+
+pkcs-8-EncryptedPrivateKeyInfo ::= SEQUENCE {
+    encryptionAlgorithm AlgorithmIdentifier,
+    encryptedData pkcs-8-EncryptedData 
+}
+
+pkcs-8-EncryptedData ::= OCTET STRING
+
+-- PKCS #5 stuff
+
+pkcs-5 OBJECT IDENTIFIER ::=
+       { pkcs 5 }
+
+pkcs-5-encryptionAlgorithm OBJECT IDENTIFIER ::=
+       { iso(1) member-body(2) us(840) rsadsi(113549) 3 }
+
+pkcs-5-des-EDE3-CBC OBJECT IDENTIFIER ::= {pkcs-5-encryptionAlgorithm 7}
+
+pkcs-5-des-EDE3-CBC-params ::= OCTET STRING (SIZE(8))
+
+pkcs-5-id-PBES2 OBJECT IDENTIFIER ::= {pkcs-5 13}
+
+pkcs-5-PBES2-params ::= SEQUENCE {
+  keyDerivationFunc AlgorithmIdentifier,
+  encryptionScheme AlgorithmIdentifier }
+
+-- PBKDF2
+
+pkcs-5-id-PBKDF2 OBJECT IDENTIFIER ::= {pkcs-5 12}
+
+-- pkcs-5-id-hmacWithSHA1 OBJECT IDENTIFIER ::= {iso(1) member-body(2) us(840) rsadsi(113549) 2 7}
+
+-- pkcs-5-algid-hmacWithSHA1 AlgorithmIdentifier ::=
+--   {algorithm pkcs-5-id-hmacWithSHA1, parameters NULL : NULL}
+
+pkcs-5-PBKDF2-params ::= SEQUENCE {
+  salt CHOICE {
+    specified OCTET STRING,
+    otherSource AlgorithmIdentifier
+  },
+  iterationCount INTEGER (1..MAX),
+  keyLength INTEGER (1..MAX) OPTIONAL,
+  prf AlgorithmIdentifier OPTIONAL -- DEFAULT pkcs-5-id-hmacWithSHA1 
+}
+
+-- PKCS #12 stuff
+
+pkcs-12 OBJECT IDENTIFIER ::= {pkcs 12}
+
+pkcs-12-PFX ::= SEQUENCE {
+        version         INTEGER {v3(3)},
+        authSafe        pkcs-7-ContentInfo,
+        macData         pkcs-12-MacData OPTIONAL
+}
+
+pkcs-12-PbeParams ::= SEQUENCE {
+        salt    OCTET STRING,
+        iterations INTEGER
+}
+
+pkcs-12-MacData ::= SEQUENCE {
+        mac             pkcs-7-DigestInfo,
+        macSalt         OCTET STRING,
+        iterations      INTEGER DEFAULT 1
+-- Note: The default is for historical reasons and its use is
+-- deprecated. A higher value, like 1024 is recommended.
+}
+
+pkcs-12-AuthenticatedSafe ::= SEQUENCE OF pkcs-7-ContentInfo
+        -- Data if unencrypted
+        -- EncryptedData if password-encrypted
+        -- EnvelopedData if public key-encrypted
+
+pkcs-12-SafeContents ::= SEQUENCE OF pkcs-12-SafeBag
+
+pkcs-12-SafeBag ::= SEQUENCE {
+        bagId           OBJECT IDENTIFIER,
+        bagValue        [0] EXPLICIT ANY DEFINED BY badId,
+        bagAttributes   SET OF pkcs-12-PKCS12Attribute OPTIONAL
+}
+
+-- Bag types
+
+
+pkcs-12-bagtypes OBJECT IDENTIFIER ::= {pkcs-12 10 1}
+
+pkcs-12-keyBag OBJECT IDENTIFIER ::= {pkcs-12-bagtypes 1}
+pkcs-12-pkcs8ShroudedKeyBag OBJECT IDENTIFIER ::= {pkcs-12-bagtypes 2}
+pkcs-12-certBag OBJECT IDENTIFIER ::= {pkcs-12-bagtypes 3}
+pkcs-12-crlBag OBJECT IDENTIFIER ::= {pkcs-12-bagtypes 4}
+
+pkcs-12-KeyBag ::= pkcs-8-PrivateKeyInfo
+
+-- Shrouded KeyBag
+
+pkcs-12-PKCS8ShroudedKeyBag ::= pkcs-8-EncryptedPrivateKeyInfo
+
+-- CertBag
+
+pkcs-12-CertBag ::= SEQUENCE {
+        certId    OBJECT IDENTIFIER,
+        certValue [0] EXPLICIT ANY DEFINED BY certId
+}
+
+-- x509Certificate BAG-TYPE ::= {OCTET STRING IDENTIFIED BY {pkcs-9-certTypes 1}}
+-- DER-encoded X.509 certificate stored in OCTET STRING
+
+pkcs-12-CRLBag ::= SEQUENCE {
+        crlId           OBJECT IDENTIFIER,
+        crlValue        [0] EXPLICIT ANY DEFINED BY crlId
+}
+
+-- x509CRL BAG-TYPE ::=
+--      {OCTET STRING IDENTIFIED BY {pkcs-9-crlTypes 1}}
+-- DER-encoded X.509 CRL stored in OCTET STRING
+
+pkcs-12-PKCS12Attribute ::= Attribute
+
+-- PKCS #7 stuff (needed in PKCS 12)
+
+pkcs-7-data OBJECT IDENTIFIER ::= { iso(1) member-body(2)
+    us(840) rsadsi(113549) pkcs(1) pkcs7(7) 1 }
+
+pkcs-7-encryptedData OBJECT IDENTIFIER ::= { iso(1) member-body(2)
+    us(840) rsadsi(113549) pkcs(1) pkcs7(7) 6 }
+
+pkcs-7-Data ::= OCTET STRING
+
+pkcs-7-EncryptedData ::= SEQUENCE {
+    version pkcs-7-CMSVersion,
+    encryptedContentInfo pkcs-7-EncryptedContentInfo,
+    unprotectedAttrs [1] IMPLICIT pkcs-7-UnprotectedAttributes OPTIONAL }
+
+pkcs-7-EncryptedContentInfo ::= SEQUENCE {
+    contentType pkcs-7-ContentType,
+    contentEncryptionAlgorithm pkcs-7-ContentEncryptionAlgorithmIdentifier,
+    encryptedContent [0] IMPLICIT pkcs-7-EncryptedContent OPTIONAL }
+
+pkcs-7-ContentEncryptionAlgorithmIdentifier ::= AlgorithmIdentifier
+
+pkcs-7-EncryptedContent ::= OCTET STRING
+
+pkcs-7-UnprotectedAttributes ::= SET SIZE (1..MAX) OF Attribute
+
+-- LDAP stuff
+-- may not be correct
+
+id-at-ldap-DC AttributeType ::= { 0 9 2342 19200300 100 1 25 }
+
+ldap-DC ::= IA5String
+
+id-at-ldap-UID AttributeType ::= { 0 9 2342 19200300 100 1 1 }
+
+ldap-UID ::= DirectoryString
+
+-- rfc3039
+
+id-pda  OBJECT IDENTIFIER ::= { id-pkix 9 }
+
+id-pda-dateOfBirth          AttributeType ::= { id-pda 1 }
+DateOfBirth ::=             GeneralizedTime
+
+id-pda-placeOfBirth         AttributeType ::= { id-pda 2 }
+PlaceOfBirth ::=            DirectoryString
+
+id-pda-gender               AttributeType ::= { id-pda 3 }
+Gender ::=                  PrintableString (SIZE(1))
+                            -- "M", "F", "m" or "f"
+
+id-pda-countryOfCitizenship AttributeType ::= { id-pda 4 }
+CountryOfCitizenship ::=    PrintableString (SIZE (2))
+                            -- ISO 3166 Country Code
+
+id-pda-countryOfResidence   AttributeType ::= { id-pda 5 }
+CountryOfResidence ::=      PrintableString (SIZE (2))
+                            -- ISO 3166 Country Code
+
+-- rfc3820
+
+id-pe-proxyCertInfo OBJECT IDENTIFIER ::= { id-pe 14 }
+
+id-ppl-inheritAll OBJECT IDENTIFIER ::= { id-pkix 21 1 }
+id-ppl-independent OBJECT IDENTIFIER ::= { id-pkix 21 2 }
+
+ProxyCertInfo ::= SEQUENCE {
+        pCPathLenConstraint     INTEGER (0..MAX) OPTIONAL,
+        proxyPolicy             ProxyPolicy }
+
+ProxyPolicy ::= SEQUENCE {
+        policyLanguage  OBJECT IDENTIFIER,
+        policy          OCTET STRING OPTIONAL }
+
+-- rfc3920 section 5.1.1
+
+id-on  OBJECT IDENTIFIER ::= { id-pkix 8 }  -- other name forms
+
+id-on-xmppAddr  OBJECT IDENTIFIER ::= { id-on 5 }
+
+XmppAddr ::= UTF8String
+
+END
diff --git a/src/daemon/https/tls/pkix_asn1_tab.c b/src/daemon/https/tls/pkix_asn1_tab.c
new file mode 100644
index 00000000..3370bb46
--- /dev/null
+++ b/src/daemon/https/tls/pkix_asn1_tab.c
@@ -0,0 +1,1130 @@
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <libtasn1.h>
+
+extern const ASN1_ARRAY_TYPE pkix_asn1_tab[] = {
+  {"PKIX1", 536875024, 0},
+  {0, 1073741836, 0},
+  {"id-ce", 1879048204, 0},
+  {"joint-iso-ccitt", 1073741825, "2"},
+  {"ds", 1073741825, "5"},
+  {0, 1, "29"},
+  {"id-ce-authorityKeyIdentifier", 1879048204, 0},
+  {0, 1073741825, "id-ce"},
+  {0, 1, "35"},
+  {"AuthorityKeyIdentifier", 1610612741, 0},
+  {"keyIdentifier", 1610637314, "KeyIdentifier"},
+  {0, 4104, "0"},
+  {"authorityCertIssuer", 1610637314, "GeneralNames"},
+  {0, 4104, "1"},
+  {"authorityCertSerialNumber", 536895490, "CertificateSerialNumber"},
+  {0, 4104, "2"},
+  {"KeyIdentifier", 1073741831, 0},
+  {"id-ce-subjectKeyIdentifier", 1879048204, 0},
+  {0, 1073741825, "id-ce"},
+  {0, 1, "14"},
+  {"SubjectKeyIdentifier", 1073741826, "KeyIdentifier"},
+  {"id-ce-keyUsage", 1879048204, 0},
+  {0, 1073741825, "id-ce"},
+  {0, 1, "15"},
+  {"KeyUsage", 1610874886, 0},
+  {"digitalSignature", 1073741825, "0"},
+  {"nonRepudiation", 1073741825, "1"},
+  {"keyEncipherment", 1073741825, "2"},
+  {"dataEncipherment", 1073741825, "3"},
+  {"keyAgreement", 1073741825, "4"},
+  {"keyCertSign", 1073741825, "5"},
+  {"cRLSign", 1073741825, "6"},
+  {"encipherOnly", 1073741825, "7"},
+  {"decipherOnly", 1, "8"},
+  {"id-ce-privateKeyUsagePeriod", 1879048204, 0},
+  {0, 1073741825, "id-ce"},
+  {0, 1, "16"},
+  {"PrivateKeyUsagePeriod", 1610612741, 0},
+  {"notBefore", 1619025937, 0},
+  {0, 4104, "0"},
+  {"notAfter", 545284113, 0},
+  {0, 4104, "1"},
+  {"id-ce-certificatePolicies", 1879048204, 0},
+  {0, 1073741825, "id-ce"},
+  {0, 1, "32"},
+  {"CertificatePolicies", 1612709899, 0},
+  {"MAX", 1074266122, "1"},
+  {0, 2, "PolicyInformation"},
+  {"PolicyInformation", 1610612741, 0},
+  {"policyIdentifier", 1073741826, "CertPolicyId"},
+  {"policyQualifiers", 538984459, 0},
+  {"MAX", 1074266122, "1"},
+  {0, 2, "PolicyQualifierInfo"},
+  {"CertPolicyId", 1073741836, 0},
+  {"PolicyQualifierInfo", 1610612741, 0},
+  {"policyQualifierId", 1073741826, "PolicyQualifierId"},
+  {"qualifier", 541065229, 0},
+  {"policyQualifierId", 1, 0},
+  {"PolicyQualifierId", 1073741836, 0},
+  {"CPSuri", 1073741826, "IA5String"},
+  {"UserNotice", 1610612741, 0},
+  {"noticeRef", 1073758210, "NoticeReference"},
+  {"explicitText", 16386, "DisplayText"},
+  {"NoticeReference", 1610612741, 0},
+  {"organization", 1073741826, "DisplayText"},
+  {"noticeNumbers", 536870923, 0},
+  {0, 3, 0},
+  {"DisplayText", 1610612754, 0},
+  {"visibleString", 1612709890, "VisibleString"},
+  {"200", 524298, "1"},
+  {"bmpString", 1612709890, "BMPString"},
+  {"200", 524298, "1"},
+  {"utf8String", 538968066, "UTF8String"},
+  {"200", 524298, "1"},
+  {"id-ce-policyMappings", 1879048204, 0},
+  {0, 1073741825, "id-ce"},
+  {0, 1, "33"},
+  {"PolicyMappings", 1612709899, 0},
+  {"MAX", 1074266122, "1"},
+  {0, 536870917, 0},
+  {"issuerDomainPolicy", 1073741826, "CertPolicyId"},
+  {"subjectDomainPolicy", 2, "CertPolicyId"},
+  {"DirectoryString", 1610612754, 0},
+  {"teletexString", 1612709890, "TeletexString"},
+  {"MAX", 524298, "1"},
+  {"printableString", 1612709890, "PrintableString"},
+  {"MAX", 524298, "1"},
+  {"universalString", 1612709890, "UniversalString"},
+  {"MAX", 524298, "1"},
+  {"utf8String", 1612709890, "UTF8String"},
+  {"MAX", 524298, "1"},
+  {"bmpString", 1612709890, "BMPString"},
+  {"MAX", 524298, "1"},
+  {"ia5String", 538968066, "IA5String"},
+  {"MAX", 524298, "1"},
+  {"id-ce-subjectAltName", 1879048204, 0},
+  {0, 1073741825, "id-ce"},
+  {0, 1, "17"},
+  {"SubjectAltName", 1073741826, "GeneralNames"},
+  {"GeneralNames", 1612709899, 0},
+  {"MAX", 1074266122, "1"},
+  {0, 2, "GeneralName"},
+  {"GeneralName", 1610612754, 0},
+  {"otherName", 1610620930, "AnotherName"},
+  {0, 4104, "0"},
+  {"rfc822Name", 1610620930, "IA5String"},
+  {0, 4104, "1"},
+  {"dNSName", 1610620930, "IA5String"},
+  {0, 4104, "2"},
+  {"x400Address", 1610620930, "ORAddress"},
+  {0, 4104, "3"},
+  {"directoryName", 1610620930, "RDNSequence"},
+  {0, 2056, "4"},
+  {"ediPartyName", 1610620930, "EDIPartyName"},
+  {0, 4104, "5"},
+  {"uniformResourceIdentifier", 1610620930, "IA5String"},
+  {0, 4104, "6"},
+  {"iPAddress", 1610620935, 0},
+  {0, 4104, "7"},
+  {"registeredID", 536879116, 0},
+  {0, 4104, "8"},
+  {"AnotherName", 1610612741, 0},
+  {"type-id", 1073741836, 0},
+  {"value", 541073421, 0},
+  {0, 1073743880, "0"},
+  {"type-id", 1, 0},
+  {"EDIPartyName", 1610612741, 0},
+  {"nameAssigner", 1610637314, "DirectoryString"},
+  {0, 4104, "0"},
+  {"partyName", 536879106, "DirectoryString"},
+  {0, 4104, "1"},
+  {"id-ce-issuerAltName", 1879048204, 0},
+  {0, 1073741825, "id-ce"},
+  {0, 1, "18"},
+  {"IssuerAltName", 1073741826, "GeneralNames"},
+  {"id-ce-subjectDirectoryAttributes", 1879048204, 0},
+  {0, 1073741825, "id-ce"},
+  {0, 1, "9"},
+  {"SubjectDirectoryAttributes", 1612709899, 0},
+  {"MAX", 1074266122, "1"},
+  {0, 2, "Attribute"},
+  {"id-ce-basicConstraints", 1879048204, 0},
+  {0, 1073741825, "id-ce"},
+  {0, 1, "19"},
+  {"BasicConstraints", 1610612741, 0},
+  {"cA", 1610645508, 0},
+  {0, 131081, 0},
+  {"pathLenConstraint", 537411587, 0},
+  {"0", 10, "MAX"},
+  {"id-ce-nameConstraints", 1879048204, 0},
+  {0, 1073741825, "id-ce"},
+  {0, 1, "30"},
+  {"NameConstraints", 1610612741, 0},
+  {"permittedSubtrees", 1610637314, "GeneralSubtrees"},
+  {0, 4104, "0"},
+  {"excludedSubtrees", 536895490, "GeneralSubtrees"},
+  {0, 4104, "1"},
+  {"GeneralSubtrees", 1612709899, 0},
+  {"MAX", 1074266122, "1"},
+  {0, 2, "GeneralSubtree"},
+  {"GeneralSubtree", 1610612741, 0},
+  {"base", 1073741826, "GeneralName"},
+  {"minimum", 1610653698, "BaseDistance"},
+  {0, 1073741833, "0"},
+  {0, 4104, "0"},
+  {"maximum", 536895490, "BaseDistance"},
+  {0, 4104, "1"},
+  {"BaseDistance", 1611137027, 0},
+  {"0", 10, "MAX"},
+  {"id-ce-policyConstraints", 1879048204, 0},
+  {0, 1073741825, "id-ce"},
+  {0, 1, "36"},
+  {"PolicyConstraints", 1610612741, 0},
+  {"requireExplicitPolicy", 1610637314, "SkipCerts"},
+  {0, 4104, "0"},
+  {"inhibitPolicyMapping", 536895490, "SkipCerts"},
+  {0, 4104, "1"},
+  {"SkipCerts", 1611137027, 0},
+  {"0", 10, "MAX"},
+  {"id-ce-cRLDistributionPoints", 1879048204, 0},
+  {0, 1073741825, "id-ce"},
+  {0, 1, "31"},
+  {"CRLDistributionPoints", 1612709899, 0},
+  {"MAX", 1074266122, "1"},
+  {0, 2, "DistributionPoint"},
+  {"DistributionPoint", 1610612741, 0},
+  {"distributionPoint", 1610637314, "DistributionPointName"},
+  {0, 2056, "0"},
+  {"reasons", 1610637314, "ReasonFlags"},
+  {0, 4104, "1"},
+  {"cRLIssuer", 536895490, "GeneralNames"},
+  {0, 4104, "2"},
+  {"DistributionPointName", 1610612754, 0},
+  {"fullName", 1610620930, "GeneralNames"},
+  {0, 4104, "0"},
+  {"nameRelativeToCRLIssuer", 536879106, "RelativeDistinguishedName"},
+  {0, 4104, "1"},
+  {"ReasonFlags", 1610874886, 0},
+  {"unused", 1073741825, "0"},
+  {"keyCompromise", 1073741825, "1"},
+  {"cACompromise", 1073741825, "2"},
+  {"affiliationChanged", 1073741825, "3"},
+  {"superseded", 1073741825, "4"},
+  {"cessationOfOperation", 1073741825, "5"},
+  {"certificateHold", 1073741825, "6"},
+  {"privilegeWithdrawn", 1073741825, "7"},
+  {"aACompromise", 1, "8"},
+  {"id-ce-extKeyUsage", 1879048204, 0},
+  {0, 1073741825, "id-ce"},
+  {0, 1, "37"},
+  {"ExtKeyUsageSyntax", 1612709899, 0},
+  {"MAX", 1074266122, "1"},
+  {0, 2, "KeyPurposeId"},
+  {"KeyPurposeId", 1073741836, 0},
+  {"id-kp-serverAuth", 1879048204, 0},
+  {0, 1073741825, "id-kp"},
+  {0, 1, "1"},
+  {"id-kp-clientAuth", 1879048204, 0},
+  {0, 1073741825, "id-kp"},
+  {0, 1, "2"},
+  {"id-kp-codeSigning", 1879048204, 0},
+  {0, 1073741825, "id-kp"},
+  {0, 1, "3"},
+  {"id-kp-emailProtection", 1879048204, 0},
+  {0, 1073741825, "id-kp"},
+  {0, 1, "4"},
+  {"id-kp-ipsecEndSystem", 1879048204, 0},
+  {0, 1073741825, "id-kp"},
+  {0, 1, "5"},
+  {"id-kp-ipsecTunnel", 1879048204, 0},
+  {0, 1073741825, "id-kp"},
+  {0, 1, "6"},
+  {"id-kp-ipsecUser", 1879048204, 0},
+  {0, 1073741825, "id-kp"},
+  {0, 1, "7"},
+  {"id-kp-timeStamping", 1879048204, 0},
+  {0, 1073741825, "id-kp"},
+  {0, 1, "8"},
+  {"id-pe-authorityInfoAccess", 1879048204, 0},
+  {0, 1073741825, "id-pe"},
+  {0, 1, "1"},
+  {"AuthorityInfoAccessSyntax", 1612709899, 0},
+  {"MAX", 1074266122, "1"},
+  {0, 2, "AccessDescription"},
+  {"AccessDescription", 1610612741, 0},
+  {"accessMethod", 1073741836, 0},
+  {"accessLocation", 2, "GeneralName"},
+  {"id-ce-cRLNumber", 1879048204, 0},
+  {0, 1073741825, "id-ce"},
+  {0, 1, "20"},
+  {"CRLNumber", 1611137027, 0},
+  {"0", 10, "MAX"},
+  {"id-ce-issuingDistributionPoint", 1879048204, 0},
+  {0, 1073741825, "id-ce"},
+  {0, 1, "28"},
+  {"IssuingDistributionPoint", 1610612741, 0},
+  {"distributionPoint", 1610637314, "DistributionPointName"},
+  {0, 4104, "0"},
+  {"onlyContainsUserCerts", 1610653700, 0},
+  {0, 1073872905, 0},
+  {0, 4104, "1"},
+  {"onlyContainsCACerts", 1610653700, 0},
+  {0, 1073872905, 0},
+  {0, 4104, "2"},
+  {"onlySomeReasons", 1610637314, "ReasonFlags"},
+  {0, 4104, "3"},
+  {"indirectCRL", 536911876, 0},
+  {0, 1073872905, 0},
+  {0, 4104, "4"},
+  {"id-ce-deltaCRLIndicator", 1879048204, 0},
+  {0, 1073741825, "id-ce"},
+  {0, 1, "27"},
+  {"BaseCRLNumber", 1073741826, "CRLNumber"},
+  {"id-ce-cRLReasons", 1879048204, 0},
+  {0, 1073741825, "id-ce"},
+  {0, 1, "21"},
+  {"CRLReason", 1610874901, 0},
+  {"unspecified", 1073741825, "0"},
+  {"keyCompromise", 1073741825, "1"},
+  {"cACompromise", 1073741825, "2"},
+  {"affiliationChanged", 1073741825, "3"},
+  {"superseded", 1073741825, "4"},
+  {"cessationOfOperation", 1073741825, "5"},
+  {"certificateHold", 1073741825, "6"},
+  {"removeFromCRL", 1, "8"},
+  {"id-ce-certificateIssuer", 1879048204, 0},
+  {0, 1073741825, "id-ce"},
+  {0, 1, "29"},
+  {"CertificateIssuer", 1073741826, "GeneralNames"},
+  {"id-ce-holdInstructionCode", 1879048204, 0},
+  {0, 1073741825, "id-ce"},
+  {0, 1, "23"},
+  {"HoldInstructionCode", 1073741836, 0},
+  {"holdInstruction", 1879048204, 0},
+  {"joint-iso-itu-t", 1073741825, "2"},
+  {"member-body", 1073741825, "2"},
+  {"us", 1073741825, "840"},
+  {"x9cm", 1073741825, "10040"},
+  {0, 1, "2"},
+  {"id-holdinstruction-none", 1879048204, 0},
+  {0, 1073741825, "holdInstruction"},
+  {0, 1, "1"},
+  {"id-holdinstruction-callissuer", 1879048204, 0},
+  {0, 1073741825, "holdInstruction"},
+  {0, 1, "2"},
+  {"id-holdinstruction-reject", 1879048204, 0},
+  {0, 1073741825, "holdInstruction"},
+  {0, 1, "3"},
+  {"id-ce-invalidityDate", 1879048204, 0},
+  {0, 1073741825, "id-ce"},
+  {0, 1, "24"},
+  {"InvalidityDate", 1082130449, 0},
+  {"VisibleString", 1610620935, 0},
+  {0, 4360, "26"},
+  {"NumericString", 1610620935, 0},
+  {0, 4360, "18"},
+  {"IA5String", 1610620935, 0},
+  {0, 4360, "22"},
+  {"TeletexString", 1610620935, 0},
+  {0, 4360, "20"},
+  {"PrintableString", 1610620935, 0},
+  {0, 4360, "19"},
+  {"UniversalString", 1610620935, 0},
+  {0, 4360, "28"},
+  {"BMPString", 1610620935, 0},
+  {0, 4360, "30"},
+  {"UTF8String", 1610620935, 0},
+  {0, 4360, "12"},
+  {"id-pkix", 1879048204, 0},
+  {"iso", 1073741825, "1"},
+  {"identified-organization", 1073741825, "3"},
+  {"dod", 1073741825, "6"},
+  {"internet", 1073741825, "1"},
+  {"security", 1073741825, "5"},
+  {"mechanisms", 1073741825, "5"},
+  {"pkix", 1, "7"},
+  {"id-pe", 1879048204, 0},
+  {0, 1073741825, "id-pkix"},
+  {0, 1, "1"},
+  {"id-qt", 1879048204, 0},
+  {0, 1073741825, "id-pkix"},
+  {0, 1, "2"},
+  {"id-kp", 1879048204, 0},
+  {0, 1073741825, "id-pkix"},
+  {0, 1, "3"},
+  {"id-ad", 1879048204, 0},
+  {0, 1073741825, "id-pkix"},
+  {0, 1, "48"},
+  {"id-qt-cps", 1879048204, 0},
+  {0, 1073741825, "id-qt"},
+  {0, 1, "1"},
+  {"id-qt-unotice", 1879048204, 0},
+  {0, 1073741825, "id-qt"},
+  {0, 1, "2"},
+  {"id-ad-ocsp", 1879048204, 0},
+  {0, 1073741825, "id-ad"},
+  {0, 1, "1"},
+  {"id-ad-caIssuers", 1879048204, 0},
+  {0, 1073741825, "id-ad"},
+  {0, 1, "2"},
+  {"Attribute", 1610612741, 0},
+  {"type", 1073741826, "AttributeType"},
+  {"values", 536870927, 0},
+  {0, 2, "AttributeValue"},
+  {"AttributeType", 1073741836, 0},
+  {"AttributeValue", 1614807053, 0},
+  {"type", 1, 0},
+  {"AttributeTypeAndValue", 1610612741, 0},
+  {"type", 1073741826, "AttributeType"},
+  {"value", 2, "AttributeValue"},
+  {"id-at", 1879048204, 0},
+  {"joint-iso-ccitt", 1073741825, "2"},
+  {"ds", 1073741825, "5"},
+  {0, 1, "4"},
+  {"id-at-initials", 1880096780, "AttributeType"},
+  {0, 1073741825, "id-at"},
+  {0, 1, "43"},
+  {"X520initials", 1073741826, "DirectoryString"},
+  {"id-at-generationQualifier", 1880096780, "AttributeType"},
+  {0, 1073741825, "id-at"},
+  {0, 1, "44"},
+  {"X520generationQualifier", 1073741826, "DirectoryString"},
+  {"id-at-surname", 1880096780, "AttributeType"},
+  {0, 1073741825, "id-at"},
+  {0, 1, "4"},
+  {"X520surName", 1073741826, "DirectoryString"},
+  {"id-at-givenName", 1880096780, "AttributeType"},
+  {0, 1073741825, "id-at"},
+  {0, 1, "42"},
+  {"X520givenName", 1073741826, "DirectoryString"},
+  {"id-at-name", 1880096780, "AttributeType"},
+  {0, 1073741825, "id-at"},
+  {0, 1, "41"},
+  {"X520name", 1073741826, "DirectoryString"},
+  {"id-at-commonName", 1880096780, "AttributeType"},
+  {0, 1073741825, "id-at"},
+  {0, 1, "3"},
+  {"X520CommonName", 1073741826, "DirectoryString"},
+  {"id-at-localityName", 1880096780, "AttributeType"},
+  {0, 1073741825, "id-at"},
+  {0, 1, "7"},
+  {"X520LocalityName", 1073741826, "DirectoryString"},
+  {"id-at-stateOrProvinceName", 1880096780, "AttributeType"},
+  {0, 1073741825, "id-at"},
+  {0, 1, "8"},
+  {"X520StateOrProvinceName", 1073741826, "DirectoryString"},
+  {"id-at-organizationName", 1880096780, "AttributeType"},
+  {0, 1073741825, "id-at"},
+  {0, 1, "10"},
+  {"X520OrganizationName", 1073741826, "DirectoryString"},
+  {"id-at-organizationalUnitName", 1880096780, "AttributeType"},
+  {0, 1073741825, "id-at"},
+  {0, 1, "11"},
+  {"X520OrganizationalUnitName", 1073741826, "DirectoryString"},
+  {"id-at-title", 1880096780, "AttributeType"},
+  {0, 1073741825, "id-at"},
+  {0, 1, "12"},
+  {"X520Title", 1073741826, "DirectoryString"},
+  {"id-at-description", 1880096780, "AttributeType"},
+  {0, 1073741825, "id-at"},
+  {0, 1, "13"},
+  {"X520Description", 1073741826, "DirectoryString"},
+  {"id-at-dnQualifier", 1880096780, "AttributeType"},
+  {0, 1073741825, "id-at"},
+  {0, 1, "46"},
+  {"X520dnQualifier", 1073741826, "PrintableString"},
+  {"id-at-countryName", 1880096780, "AttributeType"},
+  {0, 1073741825, "id-at"},
+  {0, 1, "6"},
+  {"X520countryName", 1612709890, "PrintableString"},
+  {0, 1048586, "2"},
+  {"id-at-serialNumber", 1880096780, "AttributeType"},
+  {0, 1073741825, "id-at"},
+  {0, 1, "5"},
+  {"X520serialNumber", 1073741826, "PrintableString"},
+  {"id-at-telephoneNumber", 1880096780, "AttributeType"},
+  {0, 1073741825, "id-at"},
+  {0, 1, "20"},
+  {"X520telephoneNumber", 1073741826, "PrintableString"},
+  {"id-at-facsimileTelephoneNumber", 1880096780, "AttributeType"},
+  {0, 1073741825, "id-at"},
+  {0, 1, "23"},
+  {"X520facsimileTelephoneNumber", 1073741826, "PrintableString"},
+  {"id-at-pseudonym", 1880096780, "AttributeType"},
+  {0, 1073741825, "id-at"},
+  {0, 1, "65"},
+  {"X520pseudonym", 1073741826, "DirectoryString"},
+  {"id-at-name", 1880096780, "AttributeType"},
+  {0, 1073741825, "id-at"},
+  {0, 1, "41"},
+  {"X520name", 1073741826, "DirectoryString"},
+  {"id-at-streetAddress", 1880096780, "AttributeType"},
+  {0, 1073741825, "id-at"},
+  {0, 1, "9"},
+  {"X520streetAddress", 1073741826, "DirectoryString"},
+  {"id-at-postalAddress", 1880096780, "AttributeType"},
+  {0, 1073741825, "id-at"},
+  {0, 1, "16"},
+  {"X520postalAddress", 1073741826, "PostalAddress"},
+  {"PostalAddress", 1610612747, 0},
+  {0, 2, "DirectoryString"},
+  {"pkcs", 1879048204, 0},
+  {"iso", 1073741825, "1"},
+  {"member-body", 1073741825, "2"},
+  {"us", 1073741825, "840"},
+  {"rsadsi", 1073741825, "113549"},
+  {"pkcs", 1, "1"},
+  {"pkcs-9", 1879048204, 0},
+  {0, 1073741825, "pkcs"},
+  {0, 1, "9"},
+  {"emailAddress", 1880096780, "AttributeType"},
+  {0, 1073741825, "pkcs-9"},
+  {0, 1, "1"},
+  {"Pkcs9email", 1612709890, "IA5String"},
+  {"ub-emailaddress-length", 524298, "1"},
+  {"Name", 1610612754, 0},
+  {"rdnSequence", 2, "RDNSequence"},
+  {"RDNSequence", 1610612747, 0},
+  {0, 2, "RelativeDistinguishedName"},
+  {"DistinguishedName", 1073741826, "RDNSequence"},
+  {"RelativeDistinguishedName", 1612709903, 0},
+  {"MAX", 1074266122, "1"},
+  {0, 2, "AttributeTypeAndValue"},
+  {"Certificate", 1610612741, 0},
+  {"tbsCertificate", 1073741826, "TBSCertificate"},
+  {"signatureAlgorithm", 1073741826, "AlgorithmIdentifier"},
+  {"signature", 6, 0},
+  {"TBSCertificate", 1610612741, 0},
+  {"version", 1610653698, "Version"},
+  {0, 1073741833, "v1"},
+  {0, 2056, "0"},
+  {"serialNumber", 1073741826, "CertificateSerialNumber"},
+  {"signature", 1073741826, "AlgorithmIdentifier"},
+  {"issuer", 1073741826, "Name"},
+  {"validity", 1073741826, "Validity"},
+  {"subject", 1073741826, "Name"},
+  {"subjectPublicKeyInfo", 1073741826, "SubjectPublicKeyInfo"},
+  {"issuerUniqueID", 1610637314, "UniqueIdentifier"},
+  {0, 4104, "1"},
+  {"subjectUniqueID", 1610637314, "UniqueIdentifier"},
+  {0, 4104, "2"},
+  {"extensions", 536895490, "Extensions"},
+  {0, 2056, "3"},
+  {"Version", 1610874883, 0},
+  {"v1", 1073741825, "0"},
+  {"v2", 1073741825, "1"},
+  {"v3", 1, "2"},
+  {"CertificateSerialNumber", 1073741827, 0},
+  {"Validity", 1610612741, 0},
+  {"notBefore", 1073741826, "Time"},
+  {"notAfter", 2, "Time"},
+  {"Time", 1610612754, 0},
+  {"utcTime", 1090519057, 0},
+  {"generalTime", 8388625, 0},
+  {"UniqueIdentifier", 1073741830, 0},
+  {"SubjectPublicKeyInfo", 1610612741, 0},
+  {"algorithm", 1073741826, "AlgorithmIdentifier"},
+  {"subjectPublicKey", 6, 0},
+  {"Extensions", 1612709899, 0},
+  {"MAX", 1074266122, "1"},
+  {0, 2, "Extension"},
+  {"Extension", 1610612741, 0},
+  {"extnID", 1073741836, 0},
+  {"critical", 1610645508, 0},
+  {0, 131081, 0},
+  {"extnValue", 7, 0},
+  {"CertificateList", 1610612741, 0},
+  {"tbsCertList", 1073741826, "TBSCertList"},
+  {"signatureAlgorithm", 1073741826, "AlgorithmIdentifier"},
+  {"signature", 6, 0},
+  {"TBSCertList", 1610612741, 0},
+  {"version", 1073758210, "Version"},
+  {"signature", 1073741826, "AlgorithmIdentifier"},
+  {"issuer", 1073741826, "Name"},
+  {"thisUpdate", 1073741826, "Time"},
+  {"nextUpdate", 1073758210, "Time"},
+  {"revokedCertificates", 1610629131, 0},
+  {0, 536870917, 0},
+  {"userCertificate", 1073741826, "CertificateSerialNumber"},
+  {"revocationDate", 1073741826, "Time"},
+  {"crlEntryExtensions", 16386, "Extensions"},
+  {"crlExtensions", 536895490, "Extensions"},
+  {0, 2056, "0"},
+  {"AlgorithmIdentifier", 1610612741, 0},
+  {"algorithm", 1073741836, 0},
+  {"parameters", 541081613, 0},
+  {"algorithm", 1, 0},
+  {"pkcs-1", 1879048204, 0},
+  {0, 1073741825, "pkcs"},
+  {0, 1, "1"},
+  {"rsaEncryption", 1879048204, 0},
+  {0, 1073741825, "pkcs-1"},
+  {0, 1, "1"},
+  {"md2WithRSAEncryption", 1879048204, 0},
+  {0, 1073741825, "pkcs-1"},
+  {0, 1, "2"},
+  {"md5WithRSAEncryption", 1879048204, 0},
+  {0, 1073741825, "pkcs-1"},
+  {0, 1, "4"},
+  {"sha1WithRSAEncryption", 1879048204, 0},
+  {0, 1073741825, "pkcs-1"},
+  {0, 1, "5"},
+  {"id-dsa-with-sha1", 1879048204, 0},
+  {"iso", 1073741825, "1"},
+  {"member-body", 1073741825, "2"},
+  {"us", 1073741825, "840"},
+  {"x9-57", 1073741825, "10040"},
+  {"x9algorithm", 1073741825, "4"},
+  {0, 1, "3"},
+  {"Dss-Sig-Value", 1610612741, 0},
+  {"r", 1073741827, 0},
+  {"s", 3, 0},
+  {"dhpublicnumber", 1879048204, 0},
+  {"iso", 1073741825, "1"},
+  {"member-body", 1073741825, "2"},
+  {"us", 1073741825, "840"},
+  {"ansi-x942", 1073741825, "10046"},
+  {"number-type", 1073741825, "2"},
+  {0, 1, "1"},
+  {"DomainParameters", 1610612741, 0},
+  {"p", 1073741827, 0},
+  {"g", 1073741827, 0},
+  {"q", 1073741827, 0},
+  {"j", 1073758211, 0},
+  {"validationParms", 16386, "ValidationParms"},
+  {"ValidationParms", 1610612741, 0},
+  {"seed", 1073741830, 0},
+  {"pgenCounter", 3, 0},
+  {"id-dsa", 1879048204, 0},
+  {"iso", 1073741825, "1"},
+  {"member-body", 1073741825, "2"},
+  {"us", 1073741825, "840"},
+  {"x9-57", 1073741825, "10040"},
+  {"x9algorithm", 1073741825, "4"},
+  {0, 1, "1"},
+  {"Dss-Parms", 1610612741, 0},
+  {"p", 1073741827, 0},
+  {"q", 1073741827, 0},
+  {"g", 3, 0},
+  {"ORAddress", 1610612741, 0},
+  {"built-in-standard-attributes", 1073741826, "BuiltInStandardAttributes"},
+  {"built-in-domain-defined-attributes", 1073758210,
+   "BuiltInDomainDefinedAttributes"},
+  {"extension-attributes", 16386, "ExtensionAttributes"},
+  {"BuiltInStandardAttributes", 1610612741, 0},
+  {"country-name", 1073758210, "CountryName"},
+  {"administration-domain-name", 1073758210, "AdministrationDomainName"},
+  {"network-address", 1610637314, "NetworkAddress"},
+  {0, 2056, "0"},
+  {"terminal-identifier", 1610637314, "TerminalIdentifier"},
+  {0, 2056, "1"},
+  {"private-domain-name", 1610637314, "PrivateDomainName"},
+  {0, 2056, "2"},
+  {"organization-name", 1610637314, "OrganizationName"},
+  {0, 2056, "3"},
+  {"numeric-user-identifier", 1610637314, "NumericUserIdentifier"},
+  {0, 2056, "4"},
+  {"personal-name", 1610637314, "PersonalName"},
+  {0, 2056, "5"},
+  {"organizational-unit-names", 536895490, "OrganizationalUnitNames"},
+  {0, 2056, "6"},
+  {"CountryName", 1610620946, 0},
+  {0, 1073746952, "1"},
+  {"x121-dcc-code", 1612709890, "NumericString"},
+  {0, 1048586, "ub-country-name-numeric-length"},
+  {"iso-3166-alpha2-code", 538968066, "PrintableString"},
+  {0, 1048586, "ub-country-name-alpha-length"},
+  {"AdministrationDomainName", 1610620946, 0},
+  {0, 1073744904, "2"},
+  {"numeric", 1612709890, "NumericString"},
+  {"ub-domain-name-length", 524298, "0"},
+  {"printable", 538968066, "PrintableString"},
+  {"ub-domain-name-length", 524298, "0"},
+  {"NetworkAddress", 1073741826, "X121Address"},
+  {"X121Address", 1612709890, "NumericString"},
+  {"ub-x121-address-length", 524298, "1"},
+  {"TerminalIdentifier", 1612709890, "PrintableString"},
+  {"ub-terminal-id-length", 524298, "1"},
+  {"PrivateDomainName", 1610612754, 0},
+  {"numeric", 1612709890, "NumericString"},
+  {"ub-domain-name-length", 524298, "1"},
+  {"printable", 538968066, "PrintableString"},
+  {"ub-domain-name-length", 524298, "1"},
+  {"OrganizationName", 1612709890, "PrintableString"},
+  {"ub-organization-name-length", 524298, "1"},
+  {"NumericUserIdentifier", 1612709890, "NumericString"},
+  {"ub-numeric-user-id-length", 524298, "1"},
+  {"PersonalName", 1610612750, 0},
+  {"surname", 1814044674, "PrintableString"},
+  {0, 1073745928, "0"},
+  {"ub-surname-length", 524298, "1"},
+  {"given-name", 1814061058, "PrintableString"},
+  {0, 1073745928, "1"},
+  {"ub-given-name-length", 524298, "1"},
+  {"initials", 1814061058, "PrintableString"},
+  {0, 1073745928, "2"},
+  {"ub-initials-length", 524298, "1"},
+  {"generation-qualifier", 740319234, "PrintableString"},
+  {0, 1073745928, "3"},
+  {"ub-generation-qualifier-length", 524298, "1"},
+  {"OrganizationalUnitNames", 1612709899, 0},
+  {"ub-organizational-units", 1074266122, "1"},
+  {0, 2, "OrganizationalUnitName"},
+  {"OrganizationalUnitName", 1612709890, "PrintableString"},
+  {"ub-organizational-unit-name-length", 524298, "1"},
+  {"BuiltInDomainDefinedAttributes", 1612709899, 0},
+  {"ub-domain-defined-attributes", 1074266122, "1"},
+  {0, 2, "BuiltInDomainDefinedAttribute"},
+  {"BuiltInDomainDefinedAttribute", 1610612741, 0},
+  {"type", 1612709890, "PrintableString"},
+  {"ub-domain-defined-attribute-type-length", 524298, "1"},
+  {"value", 538968066, "PrintableString"},
+  {"ub-domain-defined-attribute-value-length", 524298, "1"},
+  {"ExtensionAttributes", 1612709903, 0},
+  {"ub-extension-attributes", 1074266122, "1"},
+  {0, 2, "ExtensionAttribute"},
+  {"ExtensionAttribute", 1610612741, 0},
+  {"extension-attribute-type", 1611145219, 0},
+  {0, 1073743880, "0"},
+  {"0", 10, "ub-extension-attributes"},
+  {"extension-attribute-value", 541073421, 0},
+  {0, 1073743880, "1"},
+  {"extension-attribute-type", 1, 0},
+  {"common-name", 1342177283, "1"},
+  {"CommonName", 1612709890, "PrintableString"},
+  {"ub-common-name-length", 524298, "1"},
+  {"teletex-common-name", 1342177283, "2"},
+  {"TeletexCommonName", 1612709890, "TeletexString"},
+  {"ub-common-name-length", 524298, "1"},
+  {"teletex-organization-name", 1342177283, "3"},
+  {"TeletexOrganizationName", 1612709890, "TeletexString"},
+  {"ub-organization-name-length", 524298, "1"},
+  {"teletex-personal-name", 1342177283, "4"},
+  {"TeletexPersonalName", 1610612750, 0},
+  {"surname", 1814044674, "TeletexString"},
+  {0, 1073743880, "0"},
+  {"ub-surname-length", 524298, "1"},
+  {"given-name", 1814061058, "TeletexString"},
+  {0, 1073743880, "1"},
+  {"ub-given-name-length", 524298, "1"},
+  {"initials", 1814061058, "TeletexString"},
+  {0, 1073743880, "2"},
+  {"ub-initials-length", 524298, "1"},
+  {"generation-qualifier", 740319234, "TeletexString"},
+  {0, 1073743880, "3"},
+  {"ub-generation-qualifier-length", 524298, "1"},
+  {"teletex-organizational-unit-names", 1342177283, "5"},
+  {"TeletexOrganizationalUnitNames", 1612709899, 0},
+  {"ub-organizational-units", 1074266122, "1"},
+  {0, 2, "TeletexOrganizationalUnitName"},
+  {"TeletexOrganizationalUnitName", 1612709890, "TeletexString"},
+  {"ub-organizational-unit-name-length", 524298, "1"},
+  {"pds-name", 1342177283, "7"},
+  {"PDSName", 1612709890, "PrintableString"},
+  {"ub-pds-name-length", 524298, "1"},
+  {"physical-delivery-country-name", 1342177283, "8"},
+  {"PhysicalDeliveryCountryName", 1610612754, 0},
+  {"x121-dcc-code", 1612709890, "NumericString"},
+  {0, 1048586, "ub-country-name-numeric-length"},
+  {"iso-3166-alpha2-code", 538968066, "PrintableString"},
+  {0, 1048586, "ub-country-name-alpha-length"},
+  {"postal-code", 1342177283, "9"},
+  {"PostalCode", 1610612754, 0},
+  {"numeric-code", 1612709890, "NumericString"},
+  {"ub-postal-code-length", 524298, "1"},
+  {"printable-code", 538968066, "PrintableString"},
+  {"ub-postal-code-length", 524298, "1"},
+  {"physical-delivery-office-name", 1342177283, "10"},
+  {"PhysicalDeliveryOfficeName", 1073741826, "PDSParameter"},
+  {"physical-delivery-office-number", 1342177283, "11"},
+  {"PhysicalDeliveryOfficeNumber", 1073741826, "PDSParameter"},
+  {"extension-OR-address-components", 1342177283, "12"},
+  {"ExtensionORAddressComponents", 1073741826, "PDSParameter"},
+  {"physical-delivery-personal-name", 1342177283, "13"},
+  {"PhysicalDeliveryPersonalName", 1073741826, "PDSParameter"},
+  {"physical-delivery-organization-name", 1342177283, "14"},
+  {"PhysicalDeliveryOrganizationName", 1073741826, "PDSParameter"},
+  {"extension-physical-delivery-address-components", 1342177283, "15"},
+  {"ExtensionPhysicalDeliveryAddressComponents", 1073741826, "PDSParameter"},
+  {"unformatted-postal-address", 1342177283, "16"},
+  {"UnformattedPostalAddress", 1610612750, 0},
+  {"printable-address", 1814052875, 0},
+  {"ub-pds-physical-address-lines", 1074266122, "1"},
+  {0, 538968066, "PrintableString"},
+  {"ub-pds-parameter-length", 524298, "1"},
+  {"teletex-string", 740311042, "TeletexString"},
+  {"ub-unformatted-address-length", 524298, "1"},
+  {"street-address", 1342177283, "17"},
+  {"StreetAddress", 1073741826, "PDSParameter"},
+  {"post-office-box-address", 1342177283, "18"},
+  {"PostOfficeBoxAddress", 1073741826, "PDSParameter"},
+  {"poste-restante-address", 1342177283, "19"},
+  {"PosteRestanteAddress", 1073741826, "PDSParameter"},
+  {"unique-postal-name", 1342177283, "20"},
+  {"UniquePostalName", 1073741826, "PDSParameter"},
+  {"local-postal-attributes", 1342177283, "21"},
+  {"LocalPostalAttributes", 1073741826, "PDSParameter"},
+  {"PDSParameter", 1610612750, 0},
+  {"printable-string", 1814052866, "PrintableString"},
+  {"ub-pds-parameter-length", 524298, "1"},
+  {"teletex-string", 740311042, "TeletexString"},
+  {"ub-pds-parameter-length", 524298, "1"},
+  {"extended-network-address", 1342177283, "22"},
+  {"ExtendedNetworkAddress", 1610612754, 0},
+  {"e163-4-address", 1610612741, 0},
+  {"number", 1612718082, "NumericString"},
+  {0, 1073743880, "0"},
+  {"ub-e163-4-number-length", 524298, "1"},
+  {"sub-address", 538992642, "NumericString"},
+  {0, 1073743880, "1"},
+  {"ub-e163-4-sub-address-length", 524298, "1"},
+  {"psap-address", 536879106, "PresentationAddress"},
+  {0, 2056, "0"},
+  {"PresentationAddress", 1610612741, 0},
+  {"pSelector", 1610637319, 0},
+  {0, 2056, "0"},
+  {"sSelector", 1610637319, 0},
+  {0, 2056, "1"},
+  {"tSelector", 1610637319, 0},
+  {0, 2056, "2"},
+  {"nAddresses", 538976271, 0},
+  {0, 1073743880, "3"},
+  {"MAX", 1074266122, "1"},
+  {0, 7, 0},
+  {"terminal-type", 1342177283, "23"},
+  {"TerminalType", 1610874883, 0},
+  {"telex", 1073741825, "3"},
+  {"teletex", 1073741825, "4"},
+  {"g3-facsimile", 1073741825, "5"},
+  {"g4-facsimile", 1073741825, "6"},
+  {"ia5-terminal", 1073741825, "7"},
+  {"videotex", 1, "8"},
+  {"teletex-domain-defined-attributes", 1342177283, "6"},
+  {"TeletexDomainDefinedAttributes", 1612709899, 0},
+  {"ub-domain-defined-attributes", 1074266122, "1"},
+  {0, 2, "TeletexDomainDefinedAttribute"},
+  {"TeletexDomainDefinedAttribute", 1610612741, 0},
+  {"type", 1612709890, "TeletexString"},
+  {"ub-domain-defined-attribute-type-length", 524298, "1"},
+  {"value", 538968066, "TeletexString"},
+  {"ub-domain-defined-attribute-value-length", 524298, "1"},
+  {"ub-name", 1342177283, "32768"},
+  {"ub-common-name", 1342177283, "64"},
+  {"ub-locality-name", 1342177283, "128"},
+  {"ub-state-name", 1342177283, "128"},
+  {"ub-organization-name", 1342177283, "64"},
+  {"ub-organizational-unit-name", 1342177283, "64"},
+  {"ub-title", 1342177283, "64"},
+  {"ub-match", 1342177283, "128"},
+  {"ub-emailaddress-length", 1342177283, "128"},
+  {"ub-common-name-length", 1342177283, "64"},
+  {"ub-country-name-alpha-length", 1342177283, "2"},
+  {"ub-country-name-numeric-length", 1342177283, "3"},
+  {"ub-domain-defined-attributes", 1342177283, "4"},
+  {"ub-domain-defined-attribute-type-length", 1342177283, "8"},
+  {"ub-domain-defined-attribute-value-length", 1342177283, "128"},
+  {"ub-domain-name-length", 1342177283, "16"},
+  {"ub-extension-attributes", 1342177283, "256"},
+  {"ub-e163-4-number-length", 1342177283, "15"},
+  {"ub-e163-4-sub-address-length", 1342177283, "40"},
+  {"ub-generation-qualifier-length", 1342177283, "3"},
+  {"ub-given-name-length", 1342177283, "16"},
+  {"ub-initials-length", 1342177283, "5"},
+  {"ub-integer-options", 1342177283, "256"},
+  {"ub-numeric-user-id-length", 1342177283, "32"},
+  {"ub-organization-name-length", 1342177283, "64"},
+  {"ub-organizational-unit-name-length", 1342177283, "32"},
+  {"ub-organizational-units", 1342177283, "4"},
+  {"ub-pds-name-length", 1342177283, "16"},
+  {"ub-pds-parameter-length", 1342177283, "30"},
+  {"ub-pds-physical-address-lines", 1342177283, "6"},
+  {"ub-postal-code-length", 1342177283, "16"},
+  {"ub-surname-length", 1342177283, "40"},
+  {"ub-terminal-id-length", 1342177283, "24"},
+  {"ub-unformatted-address-length", 1342177283, "180"},
+  {"ub-x121-address-length", 1342177283, "16"},
+  {"pkcs-7-ContentInfo", 1610612741, 0},
+  {"contentType", 1073741826, "pkcs-7-ContentType"},
+  {"content", 541073421, 0},
+  {0, 1073743880, "0"},
+  {"contentType", 1, 0},
+  {"pkcs-7-DigestInfo", 1610612741, 0},
+  {"digestAlgorithm", 1073741826, "pkcs-7-DigestAlgorithmIdentifier"},
+  {"digest", 2, "pkcs-7-Digest"},
+  {"pkcs-7-Digest", 1073741831, 0},
+  {"pkcs-7-ContentType", 1073741836, 0},
+  {"pkcs-7-SignedData", 1610612741, 0},
+  {"version", 1073741826, "pkcs-7-CMSVersion"},
+  {"digestAlgorithms", 1073741826, "pkcs-7-DigestAlgorithmIdentifiers"},
+  {"encapContentInfo", 1073741826, "pkcs-7-EncapsulatedContentInfo"},
+  {"certificates", 1610637314, "pkcs-7-CertificateSet"},
+  {0, 4104, "0"},
+  {"crls", 1610637314, "pkcs-7-CertificateRevocationLists"},
+  {0, 4104, "1"},
+  {"signerInfos", 2, "pkcs-7-SignerInfos"},
+  {"pkcs-7-CMSVersion", 1610874883, 0},
+  {"v0", 1073741825, "0"},
+  {"v1", 1073741825, "1"},
+  {"v2", 1073741825, "2"},
+  {"v3", 1073741825, "3"},
+  {"v4", 1, "4"},
+  {"pkcs-7-DigestAlgorithmIdentifiers", 1610612751, 0},
+  {0, 2, "pkcs-7-DigestAlgorithmIdentifier"},
+  {"pkcs-7-DigestAlgorithmIdentifier", 1073741826, "AlgorithmIdentifier"},
+  {"pkcs-7-EncapsulatedContentInfo", 1610612741, 0},
+  {"eContentType", 1073741826, "pkcs-7-ContentType"},
+  {"eContent", 536895495, 0},
+  {0, 2056, "0"},
+  {"pkcs-7-CertificateRevocationLists", 1610612751, 0},
+  {0, 13, 0},
+  {"pkcs-7-CertificateChoices", 1610612754, 0},
+  {"certificate", 13, 0},
+  {"pkcs-7-CertificateSet", 1610612751, 0},
+  {0, 2, "pkcs-7-CertificateChoices"},
+  {"pkcs-7-SignerInfos", 1610612751, 0},
+  {0, 13, 0},
+  {"pkcs-10-CertificationRequestInfo", 1610612741, 0},
+  {"version", 1610874883, 0},
+  {"v1", 1, "0"},
+  {"subject", 1073741826, "Name"},
+  {"subjectPKInfo", 1073741826, "SubjectPublicKeyInfo"},
+  {"attributes", 536879106, "Attributes"},
+  {0, 4104, "0"},
+  {"Attributes", 1610612751, 0},
+  {0, 2, "Attribute"},
+  {"pkcs-10-CertificationRequest", 1610612741, 0},
+  {"certificationRequestInfo", 1073741826,
+   "pkcs-10-CertificationRequestInfo"},
+  {"signatureAlgorithm", 1073741826, "AlgorithmIdentifier"},
+  {"signature", 6, 0},
+  {"pkcs-9-ub-challengePassword", 1342177283, "255"},
+  {"pkcs-9-certTypes", 1879048204, 0},
+  {0, 1073741825, "pkcs-9"},
+  {0, 1, "22"},
+  {"pkcs-9-crlTypes", 1879048204, 0},
+  {0, 1073741825, "pkcs-9"},
+  {0, 1, "23"},
+  {"pkcs-9-at-challengePassword", 1879048204, 0},
+  {0, 1073741825, "pkcs-9"},
+  {0, 1, "7"},
+  {"pkcs-9-challengePassword", 1610612754, 0},
+  {"printableString", 1612709890, "PrintableString"},
+  {"pkcs-9-ub-challengePassword", 524298, "1"},
+  {"utf8String", 538968066, "UTF8String"},
+  {"pkcs-9-ub-challengePassword", 524298, "1"},
+  {"pkcs-9-at-localKeyId", 1879048204, 0},
+  {0, 1073741825, "pkcs-9"},
+  {0, 1, "21"},
+  {"pkcs-9-localKeyId", 1073741831, 0},
+  {"pkcs-9-at-friendlyName", 1879048204, 0},
+  {0, 1073741825, "pkcs-9"},
+  {0, 1, "20"},
+  {"pkcs-9-friendlyName", 1612709890, "BMPString"},
+  {"255", 524298, "1"},
+  {"pkcs-8-PrivateKeyInfo", 1610612741, 0},
+  {"version", 1073741826, "pkcs-8-Version"},
+  {"privateKeyAlgorithm", 1073741826, "AlgorithmIdentifier"},
+  {"privateKey", 1073741826, "pkcs-8-PrivateKey"},
+  {"attributes", 536895490, "Attributes"},
+  {0, 4104, "0"},
+  {"pkcs-8-Version", 1610874883, 0},
+  {"v1", 1, "0"},
+  {"pkcs-8-PrivateKey", 1073741831, 0},
+  {"pkcs-8-Attributes", 1610612751, 0},
+  {0, 2, "Attribute"},
+  {"pkcs-8-EncryptedPrivateKeyInfo", 1610612741, 0},
+  {"encryptionAlgorithm", 1073741826, "AlgorithmIdentifier"},
+  {"encryptedData", 2, "pkcs-8-EncryptedData"},
+  {"pkcs-8-EncryptedData", 1073741831, 0},
+  {"pkcs-5", 1879048204, 0},
+  {0, 1073741825, "pkcs"},
+  {0, 1, "5"},
+  {"pkcs-5-encryptionAlgorithm", 1879048204, 0},
+  {"iso", 1073741825, "1"},
+  {"member-body", 1073741825, "2"},
+  {"us", 1073741825, "840"},
+  {"rsadsi", 1073741825, "113549"},
+  {0, 1, "3"},
+  {"pkcs-5-des-EDE3-CBC", 1879048204, 0},
+  {0, 1073741825, "pkcs-5-encryptionAlgorithm"},
+  {0, 1, "7"},
+  {"pkcs-5-des-EDE3-CBC-params", 1612709895, 0},
+  {0, 1048586, "8"},
+  {"pkcs-5-id-PBES2", 1879048204, 0},
+  {0, 1073741825, "pkcs-5"},
+  {0, 1, "13"},
+  {"pkcs-5-PBES2-params", 1610612741, 0},
+  {"keyDerivationFunc", 1073741826, "AlgorithmIdentifier"},
+  {"encryptionScheme", 2, "AlgorithmIdentifier"},
+  {"pkcs-5-id-PBKDF2", 1879048204, 0},
+  {0, 1073741825, "pkcs-5"},
+  {0, 1, "12"},
+  {"pkcs-5-PBKDF2-params", 1610612741, 0},
+  {"salt", 1610612754, 0},
+  {"specified", 1073741831, 0},
+  {"otherSource", 2, "AlgorithmIdentifier"},
+  {"iterationCount", 1611137027, 0},
+  {"1", 10, "MAX"},
+  {"keyLength", 1611153411, 0},
+  {"1", 10, "MAX"},
+  {"prf", 16386, "AlgorithmIdentifier"},
+  {"pkcs-12", 1879048204, 0},
+  {0, 1073741825, "pkcs"},
+  {0, 1, "12"},
+  {"pkcs-12-PFX", 1610612741, 0},
+  {"version", 1610874883, 0},
+  {"v3", 1, "3"},
+  {"authSafe", 1073741826, "pkcs-7-ContentInfo"},
+  {"macData", 16386, "pkcs-12-MacData"},
+  {"pkcs-12-PbeParams", 1610612741, 0},
+  {"salt", 1073741831, 0},
+  {"iterations", 3, 0},
+  {"pkcs-12-MacData", 1610612741, 0},
+  {"mac", 1073741826, "pkcs-7-DigestInfo"},
+  {"macSalt", 1073741831, 0},
+  {"iterations", 536903683, 0},
+  {0, 9, "1"},
+  {"pkcs-12-AuthenticatedSafe", 1610612747, 0},
+  {0, 2, "pkcs-7-ContentInfo"},
+  {"pkcs-12-SafeContents", 1610612747, 0},
+  {0, 2, "pkcs-12-SafeBag"},
+  {"pkcs-12-SafeBag", 1610612741, 0},
+  {"bagId", 1073741836, 0},
+  {"bagValue", 1614815245, 0},
+  {0, 1073743880, "0"},
+  {"badId", 1, 0},
+  {"bagAttributes", 536887311, 0},
+  {0, 2, "pkcs-12-PKCS12Attribute"},
+  {"pkcs-12-bagtypes", 1879048204, 0},
+  {0, 1073741825, "pkcs-12"},
+  {0, 1073741825, "10"},
+  {0, 1, "1"},
+  {"pkcs-12-keyBag", 1879048204, 0},
+  {0, 1073741825, "pkcs-12-bagtypes"},
+  {0, 1, "1"},
+  {"pkcs-12-pkcs8ShroudedKeyBag", 1879048204, 0},
+  {0, 1073741825, "pkcs-12-bagtypes"},
+  {0, 1, "2"},
+  {"pkcs-12-certBag", 1879048204, 0},
+  {0, 1073741825, "pkcs-12-bagtypes"},
+  {0, 1, "3"},
+  {"pkcs-12-crlBag", 1879048204, 0},
+  {0, 1073741825, "pkcs-12-bagtypes"},
+  {0, 1, "4"},
+  {"pkcs-12-KeyBag", 1073741826, "pkcs-8-PrivateKeyInfo"},
+  {"pkcs-12-PKCS8ShroudedKeyBag", 1073741826,
+   "pkcs-8-EncryptedPrivateKeyInfo"},
+  {"pkcs-12-CertBag", 1610612741, 0},
+  {"certId", 1073741836, 0},
+  {"certValue", 541073421, 0},
+  {0, 1073743880, "0"},
+  {"certId", 1, 0},
+  {"pkcs-12-CRLBag", 1610612741, 0},
+  {"crlId", 1073741836, 0},
+  {"crlValue", 541073421, 0},
+  {0, 1073743880, "0"},
+  {"crlId", 1, 0},
+  {"pkcs-12-PKCS12Attribute", 1073741826, "Attribute"},
+  {"pkcs-7-data", 1879048204, 0},
+  {"iso", 1073741825, "1"},
+  {"member-body", 1073741825, "2"},
+  {"us", 1073741825, "840"},
+  {"rsadsi", 1073741825, "113549"},
+  {"pkcs", 1073741825, "1"},
+  {"pkcs7", 1073741825, "7"},
+  {0, 1, "1"},
+  {"pkcs-7-encryptedData", 1879048204, 0},
+  {"iso", 1073741825, "1"},
+  {"member-body", 1073741825, "2"},
+  {"us", 1073741825, "840"},
+  {"rsadsi", 1073741825, "113549"},
+  {"pkcs", 1073741825, "1"},
+  {"pkcs7", 1073741825, "7"},
+  {0, 1, "6"},
+  {"pkcs-7-Data", 1073741831, 0},
+  {"pkcs-7-EncryptedData", 1610612741, 0},
+  {"version", 1073741826, "pkcs-7-CMSVersion"},
+  {"encryptedContentInfo", 1073741826, "pkcs-7-EncryptedContentInfo"},
+  {"unprotectedAttrs", 536895490, "pkcs-7-UnprotectedAttributes"},
+  {0, 4104, "1"},
+  {"pkcs-7-EncryptedContentInfo", 1610612741, 0},
+  {"contentType", 1073741826, "pkcs-7-ContentType"},
+  {"contentEncryptionAlgorithm", 1073741826,
+   "pkcs-7-ContentEncryptionAlgorithmIdentifier"},
+  {"encryptedContent", 536895490, "pkcs-7-EncryptedContent"},
+  {0, 4104, "0"},
+  {"pkcs-7-ContentEncryptionAlgorithmIdentifier", 1073741826,
+   "AlgorithmIdentifier"},
+  {"pkcs-7-EncryptedContent", 1073741831, 0},
+  {"pkcs-7-UnprotectedAttributes", 1612709903, 0},
+  {"MAX", 1074266122, "1"},
+  {0, 2, "Attribute"},
+  {"id-at-ldap-DC", 1880096780, "AttributeType"},
+  {0, 1073741825, "0"},
+  {0, 1073741825, "9"},
+  {0, 1073741825, "2342"},
+  {0, 1073741825, "19200300"},
+  {0, 1073741825, "100"},
+  {0, 1073741825, "1"},
+  {0, 1, "25"},
+  {"ldap-DC", 1073741826, "IA5String"},
+  {"id-at-ldap-UID", 1880096780, "AttributeType"},
+  {0, 1073741825, "0"},
+  {0, 1073741825, "9"},
+  {0, 1073741825, "2342"},
+  {0, 1073741825, "19200300"},
+  {0, 1073741825, "100"},
+  {0, 1073741825, "1"},
+  {0, 1, "1"},
+  {"ldap-UID", 1073741826, "DirectoryString"},
+  {"id-pda", 1879048204, 0},
+  {0, 1073741825, "id-pkix"},
+  {0, 1, "9"},
+  {"id-pda-dateOfBirth", 1880096780, "AttributeType"},
+  {0, 1073741825, "id-pda"},
+  {0, 1, "1"},
+  {"DateOfBirth", 1082130449, 0},
+  {"id-pda-placeOfBirth", 1880096780, "AttributeType"},
+  {0, 1073741825, "id-pda"},
+  {0, 1, "2"},
+  {"PlaceOfBirth", 1073741826, "DirectoryString"},
+  {"id-pda-gender", 1880096780, "AttributeType"},
+  {0, 1073741825, "id-pda"},
+  {0, 1, "3"},
+  {"Gender", 1612709890, "PrintableString"},
+  {0, 1048586, "1"},
+  {"id-pda-countryOfCitizenship", 1880096780, "AttributeType"},
+  {0, 1073741825, "id-pda"},
+  {0, 1, "4"},
+  {"CountryOfCitizenship", 1612709890, "PrintableString"},
+  {0, 1048586, "2"},
+  {"id-pda-countryOfResidence", 1880096780, "AttributeType"},
+  {0, 1073741825, "id-pda"},
+  {0, 1, "5"},
+  {"CountryOfResidence", 1612709890, "PrintableString"},
+  {0, 1048586, "2"},
+  {"id-pe-proxyCertInfo", 1879048204, 0},
+  {0, 1073741825, "id-pe"},
+  {0, 1, "14"},
+  {"id-ppl-inheritAll", 1879048204, 0},
+  {0, 1073741825, "id-pkix"},
+  {0, 1073741825, "21"},
+  {0, 1, "1"},
+  {"id-ppl-independent", 1879048204, 0},
+  {0, 1073741825, "id-pkix"},
+  {0, 1073741825, "21"},
+  {0, 1, "2"},
+  {"ProxyCertInfo", 1610612741, 0},
+  {"pCPathLenConstraint", 1611153411, 0},
+  {"0", 10, "MAX"},
+  {"proxyPolicy", 2, "ProxyPolicy"},
+  {"ProxyPolicy", 1610612741, 0},
+  {"policyLanguage", 1073741836, 0},
+  {"policy", 16391, 0},
+  {"id-on", 1879048204, 0},
+  {0, 1073741825, "id-pkix"},
+  {0, 1, "8"},
+  {"id-on-xmppAddr", 1879048204, 0},
+  {0, 1073741825, "id-on"},
+  {0, 1, "5"},
+  {"XmppAddr", 2, "UTF8String"},
+  {0, 0, 0}
+};
diff --git a/src/daemon/https/tls/x509_b64.c b/src/daemon/https/tls/x509_b64.c
new file mode 100644
index 00000000..50a9b475
--- /dev/null
+++ b/src/daemon/https/tls/x509_b64.c
@@ -0,0 +1,599 @@
+/*
+ * Copyright (C) 2000, 2001, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+/* Functions that relate to base64 encoding and decoding.
+ */
+
+#include "gnutls_int.h"
+#include "gnutls_errors.h"
+#include <gnutls_datum.h>
+#include <x509_b64.h>
+
+static const uint8_t b64table[] =
+  "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+
+static const uint8_t asciitable[128] = {
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0x3e, 0xff, 0xff, 0xff, 0x3f,
+  0x34, 0x35, 0x36, 0x37, 0x38, 0x39,
+  0x3a, 0x3b, 0x3c, 0x3d, 0xff, 0xff,
+  0xff, 0xf1, 0xff, 0xff, 0xff, 0x00,   /* 0xf1 for '=' */
+  0x01, 0x02, 0x03, 0x04, 0x05, 0x06,
+  0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c,
+  0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12,
+  0x13, 0x14, 0x15, 0x16, 0x17, 0x18,
+  0x19, 0xff, 0xff, 0xff, 0xff, 0xff,
+  0xff, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e,
+  0x1f, 0x20, 0x21, 0x22, 0x23, 0x24,
+  0x25, 0x26, 0x27, 0x28, 0x29, 0x2a,
+  0x2b, 0x2c, 0x2d, 0x2e, 0x2f, 0x30,
+  0x31, 0x32, 0x33, 0xff, 0xff, 0xff,
+  0xff, 0xff
+};
+
+inline static int
+encode (char *result, const uint8_t * data, int left)
+{
+
+  int data_len;
+
+  if (left > 3)
+    data_len = 3;
+  else
+    data_len = left;
+
+  switch (data_len)
+    {
+    case 3:
+      result[0] = b64table[(data[0] >> 2)];
+      result[1] =
+        b64table[(((((data[0] & 0x03) & 0xff) << 4) & 0xff) |
+                  (data[1] >> 4))];
+      result[2] =
+        b64table[((((data[1] & 0x0f) << 2) & 0xff) | (data[2] >> 6))];
+      result[3] = b64table[(((data[2] << 2) & 0xff) >> 2)];
+      break;
+    case 2:
+      result[0] = b64table[(data[0] >> 2)];
+      result[1] =
+        b64table[(((((data[0] & 0x03) & 0xff) << 4) & 0xff) |
+                  (data[1] >> 4))];
+      result[2] = b64table[(((data[1] << 4) & 0xff) >> 2)];
+      result[3] = '=';
+      break;
+    case 1:
+      result[0] = b64table[(data[0] >> 2)];
+      result[1] = b64table[(((((data[0] & 0x03) & 0xff) << 4) & 0xff))];
+      result[2] = '=';
+      result[3] = '=';
+      break;
+    default:
+      return -1;
+    }
+
+  return 4;
+
+}
+
+/* data must be 4 bytes
+ * result should be 3 bytes
+ */
+#define TOASCII(c) (c < 127 ? asciitable[c] : 0xff)
+inline static int
+decode (uint8_t * result, const opaque * data)
+{
+  uint8_t a1, a2;
+  int ret = 3;
+
+  a1 = TOASCII (data[0]);
+  a2 = TOASCII (data[1]);
+  if (a1 == 0xff || a2 == 0xff)
+    return -1;
+  result[0] = ((a1 << 2) & 0xff) | ((a2 >> 4) & 0xff);
+
+  a1 = a2;
+  a2 = TOASCII (data[2]);
+  if (a2 == 0xff)
+    return -1;
+  result[1] = ((a1 << 4) & 0xff) | ((a2 >> 2) & 0xff);
+
+  a1 = a2;
+  a2 = TOASCII (data[3]);
+  if (a2 == 0xff)
+    return -1;
+  result[2] = ((a1 << 6) & 0xff) | (a2 & 0xff);
+
+  if (data[2] == '=')
+    ret--;
+
+  if (data[3] == '=')
+    ret--;
+  return ret;
+}
+
+/* encodes data and puts the result into result (locally allocated)
+ * The result_size is the return value
+ */
+int
+_gnutls_base64_encode (const uint8_t * data, size_t data_size,
+                       uint8_t ** result)
+{
+  unsigned int i, j;
+  int ret, tmp;
+  char tmpres[4];
+
+  ret = B64SIZE (data_size);
+
+  (*result) = gnutls_malloc (ret + 1);
+  if ((*result) == NULL)
+    return GNUTLS_E_MEMORY_ERROR;
+
+  for (i = j = 0; i < data_size; i += 3, j += 4)
+    {
+      tmp = encode (tmpres, &data[i], data_size - i);
+      if (tmp == -1)
+        {
+          gnutls_free ((*result));
+          return GNUTLS_E_MEMORY_ERROR;
+        }
+      memcpy (&(*result)[j], tmpres, tmp);
+    }
+  (*result)[ret] = 0;           /* null terminated */
+
+  return ret;
+}
+
+#define INCR(what, size) \
+        do { \
+        what+=size; \
+        if (what > ret) { \
+                gnutls_assert(); \
+                gnutls_free( (*result)); *result = NULL; \
+                return GNUTLS_E_INTERNAL_ERROR; \
+        } \
+        } while(0)
+
+/* encodes data and puts the result into result (locally allocated)
+ * The result_size (including the null terminator) is the return value.
+ */
+int
+_gnutls_fbase64_encode (const char *msg, const uint8_t * data,
+                        int data_size, uint8_t ** result)
+{
+  int i, ret, tmp, j;
+  char tmpres[4];
+  uint8_t *ptr;
+  uint8_t top[80];
+  uint8_t bottom[80];
+  int pos, bytes, top_len, bottom_len;
+  size_t msglen = strlen (msg);
+
+  if (msglen > 50)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_BASE64_ENCODING_ERROR;
+    }
+
+  memset (bottom, 0, sizeof (bottom));
+  memset (top, 0, sizeof (top));
+
+  strcat (top, "-----BEGIN ");  /* Flawfinder: ignore */
+  strcat (top, msg);            /* Flawfinder: ignore */
+  strcat (top, "-----");        /* Flawfinder: ignore */
+
+  strcat (bottom, "\n-----END ");       /* Flawfinder: ignore */
+  strcat (bottom, msg);         /* Flawfinder: ignore */
+  strcat (bottom, "-----\n");   /* Flawfinder: ignore */
+
+  top_len = strlen (top);
+  bottom_len = strlen (bottom);
+
+  ret = B64FSIZE (msglen, data_size);
+
+  (*result) = gnutls_calloc (1, ret + 1);
+  if ((*result) == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  bytes = pos = 0;
+  INCR (bytes, top_len);
+  pos = top_len;
+
+  strcpy (*result, top);        /* Flawfinder: ignore */
+
+  for (i = j = 0; i < data_size; i += 3, j += 4)
+    {
+
+      tmp = encode (tmpres, &data[i], data_size - i);
+      if (tmp == -1)
+        {
+          gnutls_assert ();
+          gnutls_free ((*result));
+          *result = NULL;
+          return GNUTLS_E_BASE64_ENCODING_ERROR;
+        }
+
+      INCR (bytes, 4);
+      ptr = &(*result)[j + pos];
+
+      if ((j) % 64 == 0)
+        {
+          INCR (bytes, 1);
+          pos++;
+          *ptr++ = '\n';
+        }
+      *ptr++ = tmpres[0];
+
+      if ((j + 1) % 64 == 0)
+        {
+          INCR (bytes, 1);
+          pos++;
+          *ptr++ = '\n';
+        }
+      *ptr++ = tmpres[1];
+
+      if ((j + 2) % 64 == 0)
+        {
+          INCR (bytes, 1);
+          pos++;
+          *ptr++ = '\n';
+        }
+      *ptr++ = tmpres[2];
+
+      if ((j + 3) % 64 == 0)
+        {
+          INCR (bytes, 1);
+          pos++;
+          *ptr++ = '\n';
+        }
+      *ptr++ = tmpres[3];
+    }
+
+  INCR (bytes, bottom_len);
+
+  memcpy (&(*result)[bytes - bottom_len], bottom, bottom_len);
+  (*result)[bytes] = 0;
+
+  return ret + 1;
+}
+
+/**
+  * gnutls_pem_base64_encode - This function will convert raw data to Base64 encoded
+  * @msg: is a message to be put in the header
+  * @data: contain the raw data
+  * @result: the place where base64 data will be copied
+  * @result_size: holds the size of the result
+  *
+  * This function will convert the given data to printable data, using the base64 
+  * encoding. This is the encoding used in PEM messages. If the provided
+  * buffer is not long enough GNUTLS_E_SHORT_MEMORY_BUFFER is returned.
+  *
+  * The output string will be null terminated, although the size will not include
+  * the terminating null.
+  * 
+  **/
+int
+gnutls_pem_base64_encode (const char *msg, const gnutls_datum_t * data,
+                          char *result, size_t * result_size)
+{
+  opaque *ret;
+  int size;
+
+  size = _gnutls_fbase64_encode (msg, data->data, data->size, &ret);
+  if (size < 0)
+    return size;
+
+  if (result == NULL || *result_size < (unsigned) size)
+    {
+      gnutls_free (ret);
+      *result_size = size;
+      return GNUTLS_E_SHORT_MEMORY_BUFFER;
+    }
+  else
+    {
+      memcpy (result, ret, size);
+      gnutls_free (ret);
+      *result_size = size - 1;
+    }
+
+  return 0;
+}
+
+/**
+  * gnutls_pem_base64_encode_alloc - This function will convert raw data to Base64 encoded
+  * @msg: is a message to be put in the encoded header
+  * @data: contains the raw data
+  * @result: will hold the newly allocated encoded data
+  *
+  * This function will convert the given data to printable data, using the base64 
+  * encoding. This is the encoding used in PEM messages. This function will
+  * allocate the required memory to hold the encoded data.
+  *
+  * You should use gnutls_free() to free the returned data.
+  * 
+  **/
+int
+gnutls_pem_base64_encode_alloc (const char *msg,
+                                const gnutls_datum_t * data,
+                                gnutls_datum_t * result)
+{
+  opaque *ret;
+  int size;
+
+  if (result == NULL)
+    return GNUTLS_E_INVALID_REQUEST;
+
+  size = _gnutls_fbase64_encode (msg, data->data, data->size, &ret);
+  if (size < 0)
+    return size;
+
+  result->data = ret;
+  result->size = size - 1;
+  return 0;
+}
+
+
+/* decodes data and puts the result into result (locally allocated)
+ * The result_size is the return value
+ */
+int
+_gnutls_base64_decode (const uint8_t * data, size_t data_size,
+                       uint8_t ** result)
+{
+  unsigned int i, j;
+  int ret, tmp, est;
+  uint8_t tmpres[3];
+
+  est = ((data_size * 3) / 4) + 1;
+  (*result) = gnutls_malloc (est);
+  if ((*result) == NULL)
+    return GNUTLS_E_MEMORY_ERROR;
+
+  ret = 0;
+  for (i = j = 0; i < data_size; i += 4, j += 3)
+    {
+      tmp = decode (tmpres, &data[i]);
+      if (tmp < 0)
+        {
+          gnutls_free (*result);
+          *result = NULL;
+          return tmp;
+        }
+      memcpy (&(*result)[j], tmpres, tmp);
+      ret += tmp;
+    }
+  return ret;
+}
+
+/* copies data to result but removes newlines and <CR>
+ * returns the size of the data copied.
+ */
+inline static int
+cpydata (const uint8_t * data, int data_size, uint8_t ** result)
+{
+  int i, j;
+
+  (*result) = gnutls_malloc (data_size);
+  if (*result == NULL)
+    return GNUTLS_E_MEMORY_ERROR;
+
+  for (j = i = 0; i < data_size; i++)
+    {
+      if (data[i] == '\n' || data[i] == '\r')
+        continue;
+      (*result)[j] = data[i];
+      j++;
+    }
+  return j;
+}
+
+/* Searches the given string for ONE PEM encoded certificate, and
+ * stores it in the result.
+ *
+ * The result_size is the return value
+ */
+#define ENDSTR "-----\n"
+#define ENDSTR2 "-----\r"
+int
+_gnutls_fbase64_decode (const char *header, const opaque * data,
+                        size_t data_size, uint8_t ** result)
+{
+  int ret;
+  static const char top[] = "-----BEGIN ";
+  static const char bottom[] = "\n-----END ";
+  uint8_t *rdata;
+  int rdata_size;
+  uint8_t *kdata;
+  int kdata_size;
+  char pem_header[128];
+
+  _gnutls_str_cpy (pem_header, sizeof (pem_header), top);
+  if (header != NULL)
+    _gnutls_str_cat (pem_header, sizeof (pem_header), header);
+
+  rdata = memmem (data, data_size, pem_header, strlen (pem_header));
+
+  if (rdata == NULL)
+    {
+      gnutls_assert ();
+      _gnutls_debug_log ("Could not find '%s'\n", pem_header);
+      return GNUTLS_E_BASE64_UNEXPECTED_HEADER_ERROR;
+    }
+
+  data_size -= (unsigned long int) rdata - (unsigned long int) data;
+
+  if (data_size < 4 + strlen (bottom))
+    {
+      gnutls_assert ();
+      return GNUTLS_E_BASE64_DECODING_ERROR;
+    }
+
+  kdata = memmem (rdata, data_size, ENDSTR, sizeof (ENDSTR) - 1);
+  /* allow CR as well.
+   */
+  if (kdata == NULL)
+    kdata = memmem (rdata, data_size, ENDSTR2, sizeof (ENDSTR2) - 1);
+
+  if (kdata == NULL)
+    {
+      gnutls_assert ();
+      _gnutls_x509_log ("Could not find '%s'\n", ENDSTR);
+      return GNUTLS_E_BASE64_DECODING_ERROR;
+    }
+  data_size -= strlen (ENDSTR);
+  data_size -= (unsigned long int) kdata - (unsigned long int) rdata;
+
+  rdata = kdata + strlen (ENDSTR);
+
+  /* position is now after the ---BEGIN--- headers */
+
+  kdata = memmem (rdata, data_size, bottom, strlen (bottom));
+  if (kdata == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_BASE64_DECODING_ERROR;
+    }
+
+  /* position of kdata is before the ----END--- footer 
+   */
+  rdata_size = (unsigned long int) kdata - (unsigned long int) rdata;
+
+  if (rdata_size < 4)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_BASE64_DECODING_ERROR;
+    }
+
+  kdata_size = cpydata (rdata, rdata_size, &kdata);
+
+  if (kdata_size < 0)
+    {
+      gnutls_assert ();
+      return kdata_size;
+    }
+
+  if (kdata_size < 4)
+    {
+      gnutls_assert ();
+      gnutls_free (kdata);
+      return GNUTLS_E_BASE64_DECODING_ERROR;
+    }
+
+  if ((ret = _gnutls_base64_decode (kdata, kdata_size, result)) < 0)
+    {
+      gnutls_free (kdata);
+      gnutls_assert ();
+      return GNUTLS_E_BASE64_DECODING_ERROR;
+    }
+  gnutls_free (kdata);
+
+  return ret;
+}
+
+/**
+  * gnutls_pem_base64_decode - This function will decode base64 encoded data
+  * @header: A null terminated string with the PEM header (eg. CERTIFICATE)
+  * @b64_data: contain the encoded data
+  * @result: the place where decoded data will be copied
+  * @result_size: holds the size of the result
+  *
+  * This function will decode the given encoded data. If the header given
+  * is non null this function will search for "-----BEGIN header" and decode
+  * only this part. Otherwise it will decode the first PEM packet found.
+  *
+  * Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the buffer given is not long enough,
+  * or 0 on success.
+  **/
+int
+gnutls_pem_base64_decode (const char *header,
+                          const gnutls_datum_t * b64_data,
+                          unsigned char *result, size_t * result_size)
+{
+  opaque *ret;
+  int size;
+
+  size =
+    _gnutls_fbase64_decode (header, b64_data->data, b64_data->size, &ret);
+  if (size < 0)
+    return size;
+
+  if (result == NULL || *result_size < (unsigned) size)
+    {
+      gnutls_free (ret);
+      *result_size = size;
+      return GNUTLS_E_SHORT_MEMORY_BUFFER;
+    }
+  else
+    {
+      memcpy (result, ret, size);
+      gnutls_free (ret);
+      *result_size = size;
+    }
+
+  return 0;
+}
+
+/**
+  * gnutls_pem_base64_decode_alloc - This function will decode base64 encoded data
+  * @header: The PEM header (eg. CERTIFICATE)
+  * @b64_data: contains the encoded data
+  * @result: the place where decoded data lie
+  *
+  * This function will decode the given encoded data. The decoded data
+  * will be allocated, and stored into result.
+  * If the header given is non null this function will search for 
+  * "-----BEGIN header" and decode only this part. Otherwise it will decode the 
+  * first PEM packet found.
+  *
+  * You should use gnutls_free() to free the returned data.
+  *
+  **/
+int
+gnutls_pem_base64_decode_alloc (const char *header,
+                                const gnutls_datum_t * b64_data,
+                                gnutls_datum_t * result)
+{
+  opaque *ret;
+  int size;
+
+  if (result == NULL)
+    return GNUTLS_E_INVALID_REQUEST;
+
+  size =
+    _gnutls_fbase64_decode (header, b64_data->data, b64_data->size, &ret);
+  if (size < 0)
+    return size;
+
+  result->data = ret;
+  result->size = size;
+  return 0;
+}
diff --git a/src/daemon/https/tls/x509_b64.h b/src/daemon/https/tls/x509_b64.h
new file mode 100644
index 00000000..539bec42
--- /dev/null
+++ b/src/daemon/https/tls/x509_b64.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
+ *
+ * Author: Nikos Mavrogiannopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA
+ *
+ */
+
+int _gnutls_base64_encode (const uint8_t * data, size_t data_size,
+                           uint8_t ** result);
+int _gnutls_fbase64_encode (const char *msg, const uint8_t * data,
+                            int data_size, uint8_t ** result);
+int _gnutls_base64_decode (const uint8_t * data, size_t data_size,
+                           uint8_t ** result);
+int _gnutls_fbase64_decode (const char *header, const uint8_t * data,
+                            size_t data_size, uint8_t ** result);
+
+#define B64SIZE( data_size) ((data_size%3==0)?((data_size*4)/3):(4+((data_size/3)*4)))
+
+/* The size for B64 encoding + newlines plus header
+ */
+
+#define HEADSIZE( hsize) \
+        sizeof("-----BEGIN ")-1+sizeof("-----")-1+ \
+        sizeof("\n-----END ")-1+sizeof("-----\n")-1+hsize+hsize
+
+#define B64FSIZE( hsize, dsize) \
+        (B64SIZE(dsize) + HEADSIZE(hsize) + /*newlines*/ \
+        B64SIZE(dsize)/64 + (((B64SIZE(dsize) % 64) > 0) ? 1 : 0))