luna - wolfssl/wrapper/Ada/wolfssl.adb

   1-- wolfssl.adb
   2--
   3-- Copyright (C) 2006-2026 wolfSSL Inc.
   4--
   5-- This file is part of wolfSSL.
   6--
   7-- wolfSSL is free software; you can redistribute it and/or modify
   8-- it under the terms of the GNU General Public License as published by
   9-- the Free Software Foundation; either version 3 of the License, or
  10-- (at your option) any later version.
  11--
  12-- wolfSSL is distributed in the hope that it will be useful,
  13-- but WITHOUT ANY WARRANTY; without even the implied warranty of
  14-- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15-- GNU General Public License for more details.
  16--
  17-- You should have received a copy of the GNU General Public License
  18-- along with this program; if not, write to the Free Software
  19-- Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  20--
  21with Ada.Unchecked_Conversion;
  22
  23package body WolfSSL is
  24
  25   subtype size_t is Interfaces.C.size_t; use type size_t;
  26
  27   subtype long is Interfaces.C.long;
  28   subtype unsigned_long is Interfaces.C.unsigned_long;
  29
  30   --  The first value in the Byte_Type range (Byte_Type'First),
  31   --  used as the null byte (0).
  32   nul : constant Byte_Type := Byte_Type'First;
  33
  34   --  WOLFSSL_SUCCESS : constant int := Get_WolfSSL_Success;
  35
  36   function Initialize_WolfSSL return int with
  37     Convention    => C,
  38     External_Name => "wolfSSL_Init",
  39     Import        => True;
  40
  41   function Finalize_WolfSSL return int with
  42     Convention    => C,
  43     External_Name => "wolfSSL_Cleanup",
  44     Import        => True;
  45
  46   function Initialize return Subprogram_Result is
  47      Result : constant int := Initialize_WolfSSL;
  48   begin
  49      return Subprogram_Result (Result);
  50   end Initialize;
  51
  52   function Finalize return Subprogram_Result is
  53      Result : constant int := Finalize_WolfSSL;
  54   begin
  55      return Subprogram_Result (Result);
  56   end Finalize;
  57
  58   function Is_Valid (Context : Context_Type) return Boolean is
  59   begin
  60      return Context /= null;
  61   end Is_Valid;
  62
  63   function Is_Valid (Method : Method_Type) return Boolean is
  64   begin
  65      return Method /= null;
  66   end Is_Valid;
  67
  68   function WolfTLSv1_2_Server_Method return Method_Type with
  69     Convention    => C,
  70     External_Name => "wolfTLSv1_2_server_method",
  71     Import        => True;
  72
  73   function TLSv1_2_Server_Method return Method_Type is
  74   begin
  75      return WolfTLSv1_2_Server_Method;
  76   end TLSv1_2_Server_Method;
  77
  78   function WolfTLSv1_2_Client_Method return Method_Type with
  79     Convention    => C,
  80     External_Name => "wolfTLSv1_2_client_method",
  81     Import        => True;
  82
  83   function TLSv1_2_Client_Method return Method_Type is
  84   begin
  85      return WolfTLSv1_2_Client_Method;
  86   end TLSv1_2_Client_Method;
  87
  88   function WolfTLSv1_3_Server_Method return Method_Type with
  89     Convention    => C,
  90     External_Name => "wolfTLSv1_3_server_method",
  91     Import        => True;
  92
  93   function TLSv1_3_Server_Method return Method_Type is
  94   begin
  95      return WolfTLSv1_3_Server_Method;
  96   end TLSv1_3_Server_Method;
  97
  98   function WolfTLSv1_3_Client_Method return Method_Type with
  99     Convention    => C,
 100     External_Name => "wolfTLSv1_3_client_method",
 101     Import        => True;
 102
 103   function TLSv1_3_Client_Method return Method_Type is
 104   begin
 105      return WolfTLSv1_3_Client_Method;
 106   end TLSv1_3_Client_Method;
 107
 108   function WolfDTLSv1_2_Server_Method return Method_Type with
 109     Convention    => C,
 110     External_Name => "wolfDTLSv1_2_server_method",
 111     Import        => True;
 112
 113   function DTLSv1_2_Server_Method return Method_Type is
 114   begin
 115      return WolfDTLSv1_2_Server_Method;
 116   end DTLSv1_2_Server_Method;
 117
 118   function WolfDTLSv1_2_Client_Method return Method_Type with
 119     Convention    => C,
 120     External_Name => "wolfDTLSv1_2_client_method",
 121     Import        => True;
 122
 123   function DTLSv1_2_Client_Method return Method_Type is
 124   begin
 125      return WolfDTLSv1_2_Client_Method;
 126   end DTLSv1_2_Client_Method;
 127
 128   function WolfDTLSv1_3_Server_Method return Method_Type with
 129     Convention    => C,
 130     External_Name => "wolfDTLSv1_3_server_method",
 131     Import        => True;
 132
 133   function DTLSv1_3_Server_Method return Method_Type is
 134   begin
 135      return WolfDTLSv1_3_Server_Method;
 136   end DTLSv1_3_Server_Method;
 137
 138   function WolfDTLSv1_3_Client_Method return Method_Type with
 139     Convention    => C,
 140     External_Name => "wolfDTLSv1_3_client_method",
 141     Import        => True;
 142
 143   function DTLSv1_3_Client_Method return Method_Type is
 144   begin
 145      return WolfDTLSv1_3_Client_Method;
 146   end DTLSv1_3_Client_Method;
 147
 148   function WolfSSL_CTX_new (Method : Method_Type)
 149                             return Context_Type with
 150     Convention => C, External_Name => "wolfSSL_CTX_new", Import => True;
 151
 152   procedure Create_Context (Method  : in out Method_Type;
 153                             Context : out Context_Type) is
 154   begin
 155      Context := WolfSSL_CTX_new (Method);
 156      Method := null;
 157   end Create_Context;
 158
 159   procedure WolfSSL_CTX_free (Context : Context_Type) with
 160     Convention => C, External_Name => "wolfSSL_CTX_free", Import => True;
 161
 162   procedure Free (Context : in out Context_Type) is
 163   begin
 164      if Context /= null then
 165         WolfSSL_CTX_free (Context);
 166      end if;
 167      Context := null;
 168   end Free;
 169
 170   type Opaque_X509_Store_Context is limited null record;
 171   type X509_Store_Context is access Opaque_X509_Store_Context with
 172     Convention => C;
 173
 174   type Verify_Callback is access function
 175     (A : int;
 176      Context : X509_Store_Context)
 177      return int
 178     with Convention => C;
 179
 180   procedure WolfSSL_CTX_Set_Verify (Context  : Context_Type;
 181                                     Mode     : int;
 182                                     Callback : Verify_Callback) with
 183     Convention    => C,
 184     External_Name => "wolfSSL_CTX_set_verify",
 185     Import        => True;
 186   --  This function sets the verification method for remote peers and
 187   --  also allows a verify callback to be registered with the SSL
 188   --  context. The verify callback will be called only when a
 189   --  verification failure has occurred. If no verify callback is
 190   --  desired, the NULL pointer can be used for verify_callback.
 191   --  The verification mode of peer certificates is a logically OR'd
 192   --  list of flags. The possible flag values include:
 193   --  SSL_VERIFY_NONE Client mode: the client will not verify the
 194   --  certificate received from the server and the handshake will
 195   --  continue as normal. Server mode: the server will not send a
 196   --  certificate request to the client. As such, client verification
 197   --  will not be enabled. SSL_VERIFY_PEER Client mode: the client will
 198   --  verify the certificate received from the server during the
 199   --  handshake. This is turned on by default in wolfSSL, therefore,
 200   --  using this option has no effect. Server mode: the server will send
 201   --  a certificate request to the client and verify the client
 202   --  certificate received. SSL_VERIFY_FAIL_IF_NO_PEER_CERT Client mode:
 203   --  no effect when used on the client side. Server mode:
 204   --  the verification will fail on the server side if the client fails
 205   --  to send a certificate when requested to do so (when using
 206   --  SSL_VERIFY_PEER on the SSL server).
 207   --  SSL_VERIFY_FAIL_EXCEPT_PSK Client mode: no effect when used on
 208   --  the client side. Server mode: the verification is the same as
 209   --  SSL_VERIFY_FAIL_IF_NO_PEER_CERT except in the case of a
 210   --  PSK connection. If a PSK connection is being made then the
 211   --  connection will go through without a peer cert.
 212
 213   function "or" (Left, Right : Mode_Type) return Mode_Type is
 214      L : constant Unsigned_32 := Unsigned_32 (Left);
 215      R : constant Unsigned_32 := Unsigned_32 (Right);
 216   begin
 217      return Mode_Type (L or R);
 218   end "or";
 219
 220   procedure Set_Verify (Context : Context_Type;
 221                         Mode    : Mode_Type) is
 222      pragma Warnings (Off, "pragma Restrictions (No_Exception_Propagation)");
 223      --  The values that Set_Verify may be called with have first
 224      --  been int values, then converted into Mode_Type values and
 225      --  here they are converted back to int. This can never fail
 226      --  unless there is hardware failure or cosmic radiation has
 227      --  done a bit flip.
 228      V : constant int := int (Mode);
 229      pragma Warnings (On, "pragma Restrictions (No_Exception_Propagation)");
 230   begin
 231      WolfSSL_CTX_Set_Verify (Context  => Context,
 232                              Mode     => V,
 233                              Callback => null);
 234   end Set_Verify;
 235
 236   function WolfSSL_Get_Verify (Context : Context_Type) return int with
 237     Convention    => C,
 238     External_Name => "wolfSSL_CTX_get_verify_mode",
 239     Import        => True;
 240
 241   function Get_Verify (Context : Context_Type) return Mode_Type is
 242   begin
 243      return Mode_Type (WolfSSL_Get_Verify (Context));
 244   end Get_Verify;
 245
 246   function Use_Certificate_File (Context : Context_Type;
 247                                  File    : Byte_Array;
 248                                  Format  : int)
 249                                  return int with
 250     Convention    => C,
 251     External_Name => "wolfSSL_CTX_use_certificate_file",
 252     Import        => True;
 253
 254   function Use_Certificate_File (Context : Context_Type;
 255                                  File    : String;
 256                                  Format  : File_Format)
 257                                  return Subprogram_Result is
 258   begin
 259      declare
 260         Ctx : constant Context_Type := Context;
 261         F : Byte_Array (1 .. File'Length + 1);
 262         Result : int;
 263      begin
 264         for I in File'Range loop
 265            F (F'First + Byte_Index (I - File'First)) := Byte_Type (File (I));
 266         end loop;
 267         F (F'Last) := nul;
 268         Result := Use_Certificate_File (Ctx, F, int (Format));
 269         return Subprogram_Result (Result);
 270      end;
 271   exception
 272      when others =>
 273         return Exception_Error;
 274   end Use_Certificate_File;
 275
 276   function Use_Certificate_Buffer (Context : Context_Type;
 277                                    Input   : Byte_Array;
 278                                    Size    : long;
 279                                    Format  : int)
 280                                    return int with
 281     Convention    => C,
 282     External_Name => "wolfSSL_CTX_use_certificate_buffer",
 283     Import        => True;
 284
 285   function Use_Certificate_Buffer (Context : Context_Type;
 286                                    Input   : Byte_Array;
 287                                    Format  : File_Format)
 288                                    return Subprogram_Result is
 289      Result : int;
 290   begin
 291      Result := Use_Certificate_Buffer (Context, Input,
 292                                        Input'Length, int (Format));
 293      return Subprogram_Result (Result);
 294   exception
 295      when others =>
 296         return Exception_Error;
 297   end Use_Certificate_Buffer;
 298
 299   function Use_Private_Key_File (Context : Context_Type;
 300                                  File    : Byte_Array;
 301                                  Format  : int)
 302                                  return int with
 303     Convention    => C,
 304     External_Name => "wolfSSL_CTX_use_PrivateKey_file",
 305     Import        => True;
 306
 307   function Use_Private_Key_File (Context : Context_Type;
 308                                  File    : String;
 309                                  Format  : File_Format)
 310                                  return Subprogram_Result is
 311   begin
 312      declare
 313         Ctx : constant Context_Type := Context;
 314         F : Byte_Array (1 .. File'Length + 1);
 315         Result : int;
 316      begin
 317         for I in File'Range loop
 318            F (F'First + Byte_Index (I - File'First)) := Byte_Type (File (I));
 319         end loop;
 320         F (F'Last) := nul;
 321         Result := Use_Private_Key_File (Ctx, F, int (Format));
 322         return Subprogram_Result (Result);
 323      end;
 324   exception
 325      when others =>
 326         return Exception_Error;
 327   end Use_Private_Key_File;
 328
 329   function Use_Private_Key_Buffer (Context : Context_Type;
 330                                    Input   : Byte_Array;
 331                                    Size    : long;
 332                                    Format  : int)
 333                                    return int with
 334     Convention    => C,
 335     External_Name => "wolfSSL_CTX_use_PrivateKey_buffer",
 336     Import        => True;
 337
 338   function Use_Private_Key_Buffer (Context : Context_Type;
 339                                    Input   : Byte_Array;
 340                                    Format  : File_Format)
 341                                    return Subprogram_Result is
 342      Result : int;
 343   begin
 344      Result := Use_Private_Key_Buffer (Context, Input,
 345                                        Input'Length, int (Format));
 346      return Subprogram_Result (Result);
 347   exception
 348      when others =>
 349         return Exception_Error;
 350   end Use_Private_Key_Buffer;
 351
 352   function Load_Verify_Locations1
 353     (Context : Context_Type;
 354      File    : Byte_Array;
 355      Path    : Byte_Array) return int with
 356     Convention    => C,
 357     External_Name => "wolfSSL_CTX_load_verify_locations",
 358     Import        => True;
 359   --  This function loads PEM-formatted CA certificate files into
 360   --  the SSL context (WOLFSSL_CTX). These certificates will be treated
 361   --  as trusted root certificates and used to verify certs received
 362   --  from peers during the SSL handshake. The root certificate file,
 363   --  provided by the file argument, may be a single certificate or a
 364   --  file containing multiple certificates. If multiple CA certs are
 365   --  included in the same file, wolfSSL will load them in the same order
 366   --  they are presented in the file. The path argument is a pointer to
 367   --  the name of a directory that contains certificates of trusted
 368   --  root CAs. If the value of file is not NULL, path may be specified
 369   --  as NULL if not needed. If path is specified and NO_WOLFSSL_DIR was
 370   --  not defined when building the library, wolfSSL will load all
 371   --  CA certificates located in the given directory. This function will
 372   --  attempt to load all files in the directory. This function expects
 373   --  PEM formatted CERT_TYPE file with header "--BEGIN CERTIFICATE--".
 374
 375   function Load_Verify_Locations2
 376     (Context : Context_Type;
 377      File    : Byte_Array;
 378      Path    : access Interfaces.C.char) return int with
 379     Convention    => C,
 380     External_Name => "wolfSSL_CTX_load_verify_locations",
 381     Import        => True;
 382
 383   function Load_Verify_Locations3
 384     (Context : Context_Type;
 385      File    : access Interfaces.C.char;
 386      Path    : Byte_Array) return int with
 387     Convention    => C,
 388     External_Name => "wolfSSL_CTX_load_verify_locations",
 389     Import        => True;
 390
 391   function Load_Verify_Locations4
 392     (Context : Context_Type;
 393      File    : access Interfaces.C.char;
 394      Path    : access Interfaces.C.char) return int with
 395     Convention    => C,
 396     External_Name => "wolfSSL_CTX_load_verify_locations",
 397     Import        => True;
 398
 399   function Load_Verify_Locations (Context : Context_Type;
 400                                   File    : String;
 401                                   Path    : String)
 402                                   return Subprogram_Result is
 403   begin
 404      declare
 405         Ctx : constant Context_Type := Context;
 406         F : aliased Byte_Array := (1 .. File'Length + 1 => '#');
 407         P : aliased Byte_Array := (1 .. Path'Length + 1 => '#');
 408         Result : int;
 409      begin
 410         if File = "" then
 411            if Path = "" then
 412               Result := Load_Verify_Locations4 (Ctx, null, null);
 413            else
 414               for I in Path'Range loop
 415                  P (P'First + Byte_Index (I - Path'First)) :=
 416                    Byte_Type (Path (I));
 417               end loop;
 418               P (P'Last) := nul;
 419               Result := Load_Verify_Locations3 (Ctx, null, P);
 420            end if;
 421         else
 422            for I in File'Range loop
 423               F (F'First + Byte_Index (I - File'First)) :=
 424                 Byte_Type (File (I));
 425            end loop;
 426            F (F'Last) := nul;
 427            if Path = "" then
 428               Result := Load_Verify_Locations2 (Ctx, F, null);
 429            else
 430               for I in Path'Range loop
 431                  P (P'First + Byte_Index (I - Path'First)) :=
 432                    Byte_Type (Path (I));
 433               end loop;
 434               P (P'Last) := nul;
 435               Result := Load_Verify_Locations1 (Context => Ctx,
 436                                                 File    => F,
 437                                                 Path    => P);
 438            end if;
 439         end if;
 440         return Subprogram_Result (Result);
 441      end;
 442   exception
 443      when others =>
 444         return Exception_Error;
 445   end Load_Verify_Locations;
 446
 447   function Load_Verify_Buffer
 448     (Context : Context_Type;
 449      Input   : Byte_Array;
 450      Size    : int;
 451      Format  : int) return int with
 452     Convention    => C,
 453     External_Name => "wolfSSL_CTX_load_verify_buffer",
 454     Import        => True;
 455
 456   function Load_Verify_Buffer (Context : Context_Type;
 457                                Input   : Byte_Array;
 458                                Format  : File_Format)
 459                                return Subprogram_Result is
 460      Result : int;
 461   begin
 462      Result := Load_Verify_Buffer (Context => Context,
 463                                    Input   => Input,
 464                                    Size    => Input'Length,
 465                                    Format  => int(Format));
 466      return Subprogram_Result (Result);
 467   exception
 468      when others =>
 469         return Exception_Error;
 470   end Load_Verify_Buffer;
 471
 472   function Is_Valid (Ssl : WolfSSL_Type) return Boolean is
 473   begin
 474      return Ssl /= null;
 475   end Is_Valid;
 476
 477   function WolfSSL_New (Context : Context_Type)
 478                         return WolfSSL_Type with
 479     Convention    => C,
 480     External_Name => "wolfSSL_new",
 481     Import        => True;
 482
 483   procedure Create_WolfSSL (Context : Context_Type;
 484                             Ssl     : out WolfSSL_Type) is
 485   begin
 486      Ssl := WolfSSL_New (Context);
 487   end Create_WolfSSL;
 488
 489   function Use_Certificate_File (Ssl     : WolfSSL_Type;
 490                                  File    : Byte_Array;
 491                                  Format  : int)
 492                                  return int with
 493     Convention    => C,
 494     External_Name => "wolfSSL_use_certificate_file",
 495     Import        => True;
 496
 497   function Use_Certificate_File (Ssl     : WolfSSL_Type;
 498                                  File    : String;
 499                                  Format  : File_Format)
 500                                  return Subprogram_Result is
 501   begin
 502      declare
 503         F : Byte_Array (1 .. File'Length + 1);
 504         Result : int;
 505      begin
 506         for I in File'Range loop
 507            F (F'First + Byte_Index (I - File'First)) :=
 508              Byte_Type (File (I));
 509         end loop;
 510         F (F'Last) := nul;
 511         Result := Use_Certificate_File (Ssl, F, int (Format));
 512         return Subprogram_Result (Result);
 513      end;
 514   exception
 515      when others =>
 516         return Exception_Error;
 517   end Use_Certificate_File;
 518
 519   function Use_Certificate_Buffer (Ssl     : WolfSSL_Type;
 520                                    Input   : Byte_Array;
 521                                    Size    : long;
 522                                    Format  : int)
 523                                    return int with
 524     Convention    => C,
 525     External_Name => "wolfSSL_use_certificate_buffer",
 526     Import        => True;
 527
 528   function Use_Certificate_Buffer (Ssl     : WolfSSL_Type;
 529                                    Input   : Byte_Array;
 530                                    Format  : File_Format)
 531                                    return Subprogram_Result is
 532      Result : int;
 533   begin
 534      Result := Use_Certificate_Buffer (Ssl, Input,
 535                                        Input'Length, int (Format));
 536      return Subprogram_Result (Result);
 537   exception
 538      when others =>
 539         return Exception_Error;
 540   end Use_Certificate_Buffer;
 541
 542   function Use_Private_Key_File (Ssl     : WolfSSL_Type;
 543                                  File    : Byte_Array;
 544                                  Format  : int)
 545                                  return int with
 546     Convention    => C,
 547     External_Name => "wolfSSL_use_PrivateKey_file",
 548     Import        => True;
 549
 550   function Use_Private_Key_File (Ssl     : WolfSSL_Type;
 551                                  File    : String;
 552                                  Format  : File_Format)
 553                                  return Subprogram_Result is
 554   begin
 555      declare
 556         F : Byte_Array (1 .. File'Length + 1);
 557         Result : int;
 558      begin
 559         for I in File'Range loop
 560            F (F'First + Byte_Index (I - File'First)) := Byte_Type (File (I));
 561         end loop;
 562         F (F'Last) := nul;
 563         Result := Use_Private_Key_File (Ssl, F, int (Format));
 564         return Subprogram_Result (Result);
 565      end;
 566   exception
 567      when others =>
 568         return Exception_Error;
 569   end Use_Private_Key_File;
 570
 571   function Use_Private_Key_Buffer (Ssl     : WolfSSL_Type;
 572                                    Input   : Byte_Array;
 573                                    Size    : long;
 574                                    Format  : int)
 575                                    return int with
 576     Convention    => C,
 577     External_Name => "wolfSSL_use_PrivateKey_buffer",
 578     Import        => True;
 579
 580   function Use_Private_Key_Buffer (Ssl     : WolfSSL_Type;
 581                                    Input   : Byte_Array;
 582                                    Format  : File_Format)
 583                                    return Subprogram_Result is
 584      Result : int;
 585   begin
 586      Result := Use_Private_Key_Buffer (Ssl, Input,
 587                                        Input'Length, int (Format));
 588      return Subprogram_Result (Result);
 589   exception
 590      when others =>
 591         return Exception_Error;
 592   end Use_Private_Key_Buffer;
 593
 594   function WolfSSL_Set_Fd (Ssl : WolfSSL_Type; Fd : int) return int with
 595     Convention    => C,
 596     External_Name => "wolfSSL_set_fd",
 597     Import        => True;
 598
 599   function Attach (Ssl    : WolfSSL_Type;
 600                    Socket : Integer)
 601                    return Subprogram_Result is
 602      Result : constant int := WolfSSL_Set_Fd (Ssl, int (Socket));
 603   begin
 604      return Subprogram_Result (Result);
 605   end Attach;
 606
 607   procedure WolfSSL_Keep_Arrays (Ssl : WolfSSL_Type) with
 608     Convention    => C,
 609     External_Name => "wolfSSL_KeepArrays",
 610     Import        => True;
 611
 612   procedure Keep_Arrays (Ssl : WolfSSL_Type) is
 613   begin
 614      WolfSSL_Keep_Arrays (Ssl);
 615   end Keep_Arrays;
 616
 617   function WolfSSL_Accept (Ssl : WolfSSL_Type) return int with
 618     Convention    => C,
 619     External_Name => "wolfSSL_accept",
 620     Import        => True;
 621
 622   function Accept_Connection (Ssl : WolfSSL_Type)
 623                               return Subprogram_Result is
 624      Result : constant int := WolfSSL_Accept (Ssl);
 625   begin
 626      return Subprogram_Result (Result);
 627   end Accept_Connection;
 628
 629   procedure WolfSSL_Free_Arrays (Ssl : WolfSSL_Type) with
 630     Convention    => C,
 631     External_Name => "wolfSSL_FreeArrays",
 632     Import        => True;
 633
 634   procedure Free_Arrays (Ssl : WolfSSL_Type) is
 635   begin
 636      WolfSSL_Free_Arrays (Ssl);
 637   end Free_Arrays;
 638
 639   function WolfSSL_Read (Ssl  : WolfSSL_Type;
 640                          Data : out Byte_Array;
 641                          Sz   : int) return int with
 642     Convention    => C,
 643     External_Name => "wolfSSL_read",
 644     Import        => True;
 645   --  This function reads sz bytes from the SSL session (ssl) internal
 646   --  read buffer into the buffer data. The bytes read are removed from
 647   --  the internal receive buffer. If necessary wolfSSL_read() will
 648   --  negotiate an SSL/TLS session if the handshake has not already
 649   --  been performed yet by wolfSSL_connect() or wolfSSL_accept().
 650   --  The SSL/TLS protocol uses SSL records which have a maximum size
 651   --  of 16kB (the max record size can be controlled by the
 652   --  MAX_RECORD_SIZE define in /wolfssl/internal.h). As such, wolfSSL
 653   --  needs to read an entire SSL record internally before it is able
 654   --  to process and decrypt the record. Because of this, a call to
 655   --  wolfSSL_read() will only be able to return the maximum buffer
 656   --  size which has been decrypted at the time of calling. There may
 657   --  be additional not-yet-decrypted data waiting in the internal
 658   --  wolfSSL receive buffer which will be retrieved and decrypted with
 659   --  the next call to wolfSSL_read(). If sz is larger than the number
 660   --  of bytes in the internal read buffer, SSL_read() will return
 661   --  the bytes available in the internal read buffer. If no bytes are
 662   --  buffered in the internal read buffer yet, a call to wolfSSL_read()
 663   --  will trigger processing of the next record.
 664   --
 665   --  The integer returned is the number of bytes read upon success.
 666   --  0 will be returned upon failure. This may be caused by a either
 667   --  a clean (close notify alert) shutdown or just that the peer closed
 668   --  the connection. Call wolfSSL_get_error() for the specific
 669   --  error code. SSL_FATAL_ERROR will be returned upon failure when
 670   --  either an error occurred or, when using non-blocking sockets,
 671   --  the SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE error was received
 672   --  and and the application needs to call wolfSSL_read() again.
 673   --  Use wolfSSL_get_error() to get a specific error code.
 674
 675   procedure Read (Ssl : WolfSSL_Type;
 676                   Result : out Read_Result) is
 677   begin
 678      Result := (Success => False,  --  In case of exception.
 679                 Last    => 0,
 680                 Code    => Subprogram_Result (Exception_Error));
 681      declare
 682         Data   : Byte_Array (1 .. Byte_Index'Last);
 683         Size   : int;
 684      begin
 685         Size := WolfSSL_Read (Ssl, Data, int (Byte_Index'Last));
 686         if Size <= 0 then
 687            Result := (Success => False,
 688                       Last    => 0,
 689                       Code    => Subprogram_Result (Size));
 690         else
 691            Result := (Success => True,
 692                       Last    => Byte_Index (Size),
 693                       Buffer  => Data (1 .. Byte_Index (Size)));
 694         end if;
 695      end;
 696   exception
 697      when others =>
 698         null;
 699   end Read;
 700
 701   function WolfSSL_Write (Ssl  : WolfSSL_Type;
 702                           Data : Byte_Array;
 703                           Sz   : int) return int with
 704     Convention    => C,
 705     External_Name => "wolfSSL_write",
 706     Import        => True;
 707
 708   procedure Write (Ssl  : WolfSSL_Type;
 709                    Data : Byte_Array;
 710                    Result : out Write_Result) is
 711   begin
 712      Result := (Success => False,
 713                 Code    => Subprogram_Result (Exception_Error));
 714      declare
 715         Size   : constant int := Data'Length;
 716         R : int;
 717      begin
 718         R := WolfSSL_Write (Ssl, Data, Size);
 719         if R > 0 then
 720            Result := (Success       => True,
 721                       Bytes_Written => Byte_Index (R));
 722         else
 723            Result := (Success => False, Code => Subprogram_Result (R));
 724         end if;
 725      end;
 726   exception
 727      when others =>
 728         null;
 729   end Write;
 730
 731   function WolfSSL_Shutdown (Ssl : WolfSSL_Type) return int with
 732     Convention    => C,
 733     External_Name => "wolfSSL_shutdown",
 734     Import        => True;
 735
 736   function Shutdown (Ssl : WolfSSL_Type) return Subprogram_Result is
 737      Result : constant int := WolfSSL_Shutdown (Ssl);
 738   begin
 739      return Subprogram_Result (Result);
 740   end Shutdown;
 741
 742   function WolfSSL_Connect (Ssl : WolfSSL_Type) return int with
 743     Convention    => C,
 744     External_Name => "wolfSSL_connect",
 745     Import        => True;
 746
 747   function Connect (Ssl : WolfSSL_Type) return Subprogram_Result is
 748      Result : constant int := WolfSSL_Connect (Ssl);
 749   begin
 750      return Subprogram_Result (Result);
 751   end Connect;
 752
 753   procedure WolfSSL_Free (Ssl : WolfSSL_Type) with
 754     Convention    => C,
 755     External_Name => "wolfSSL_free",
 756     Import        => True;
 757
 758   procedure Free (Ssl : in out WolfSSL_Type) is
 759   begin
 760      if Ssl /= null then
 761         WolfSSL_Free (Ssl);
 762      end if;
 763      Ssl := null;
 764   end Free;
 765
 766   function WolfSSL_Get_Error (Ssl : WolfSSL_Type;
 767                               Ret : int) return int with
 768     Convention    => C,
 769     External_Name => "wolfSSL_get_error",
 770     Import        => True;
 771
 772   function Get_Error (Ssl    : WolfSSL_Type;
 773                       Result : Subprogram_Result) return Error_Code is
 774   begin
 775      return Error_Code (WolfSSL_Get_Error (Ssl, int (Result)));
 776   end Get_Error;
 777
 778   procedure WolfSSL_Error_String (Error : unsigned_long;
 779                                   Data  : out Byte_Array;
 780                                   Size  : unsigned_long) with
 781     Convention    => C,
 782     External_Name => "wolfSSL_ERR_error_string_n",
 783     Import        => True;
 784
 785   procedure Error (Code    : in  Error_Code;
 786                    Message : in out Error_Message) is
 787      use type Byte_Type;
 788      -- Use unchecked conversion instead of type conversion to mimic C style
 789      -- conversion from int to unsigned long, avoiding the Ada overflow check.
 790      function To_Unsigned_Long is new Ada.Unchecked_Conversion
 791        (Source => long,
 792         Target => unsigned_long);
 793   begin
 794      declare
 795         S : String (1 .. Error_Message_Index'Last);
 796         B : Byte_Array (1 .. size_t (Error_Message_Index'Last));
 797         L : Positive;
 798      begin
 799         WolfSSL_Error_String (Error => To_Unsigned_Long (long (Code)),
 800                               Data  => B,
 801                               Size  => To_Unsigned_Long (long (B'Last)));
 802         for I in B'Range loop
 803            L := S'First + Natural (I - B'First);
 804            S (L) := Character (B (I));
 805            exit when B (I) = nul;
 806         end loop;
 807         if S (L) = Character (nul) then
 808            Message := (Last => L - 1,
 809                        Text => S (1 .. L - 1));
 810         else
 811            Message := (Last => L,
 812                        Text => S (1 .. L));
 813         end if;
 814      end;
 815   exception
 816      when others =>
 817         null;
 818   end Error;
 819
 820   function Get_WolfSSL_Max_Error_Size return int with
 821     Convention    => C,
 822     External_Name => "get_wolfssl_max_error_size",
 823     Import        => True;
 824
 825   function Max_Error_Size return Natural is
 826   begin
 827      return Natural (Get_WolfSSL_Max_Error_Size);
 828   end Max_Error_Size;
 829
 830   function Is_Valid (Key : RNG_Type) return Boolean is
 831   begin
 832      return Key /= null;
 833   end Is_Valid;
 834
 835   function Ada_New_RNG return RNG_Type with
 836     Convention    => C,
 837     External_Name => "ada_new_rng",
 838     Import        => True;
 839
 840   procedure Ada_Free_RNG (Key : in RNG_Type) with
 841     Convention    => C,
 842     External_Name => "ada_free_rng",
 843     Import        => True;
 844
 845
 846
 847   procedure Free_RNG (Key : in out RNG_Type) is
 848   begin
 849      if Key = null then
 850         return;
 851      end if;
 852
 853      --  wc_rng_free() already calls wc_FreeRng() internally.
 854      Ada_Free_RNG (Key);
 855
 856      --  Prevent accidental double-free and make Is_Valid return False.
 857      Key := null;
 858   end Free_RNG;
 859
 860   procedure Create_RNG (Key    : in out RNG_Type;
 861                         Result : out Integer) is
 862   begin
 863      declare
 864         R : int;
 865      begin
 866         --  Allocate RNG using the C wrapper, which internally calls
 867         --  wc_rng_new(NULL, 0, NULL) as required.
 868         Key := Ada_New_RNG;
 869
 870         if Key = null then
 871            Result := Exception_Error;
 872            return;
 873         end if;
 874
 875         --  wc_rng_new() already calls wc_InitRng() internally, so no extra init.
 876         Result := 0;
 877      end;
 878   exception
 879      when others =>
 880         Result := Exception_Error;
 881   end Create_RNG;
 882
 883   function WC_RNG_Generate_Block (RNG    : not null RNG_Type;
 884                                   Output : out Byte_Array;
 885                                   Size   : int) return int with
 886     Convention    => C,
 887     External_Name => "wc_RNG_GenerateBlock",
 888     Import        => True;
 889
 890   procedure RNG_Generate_Block (RNG    : RNG_Type;
 891                                 Output : out Byte_Array;
 892                                 Result : out Integer) is
 893   begin
 894      declare
 895         R : int;
 896      begin
 897         R := WC_RNG_Generate_Block (RNG, Output, Output'Length);
 898         Result := Integer (R);
 899      end;
 900   exception
 901      when others =>
 902         Result := Exception_Error;
 903   end RNG_Generate_Block;
 904
 905   type Unsigned_8 is mod 2 ** 8;
 906
 907   function To_C (Value : Unsigned_8) return WolfSSL.Byte_Type is
 908   begin
 909      return WolfSSL.Byte_Type'Val (Value);
 910   end To_C;
 911
 912   function WC_PBKDF2 (Output     : out Byte_Array;
 913                       Password   : Byte_Array;
 914                       P_Length   : int;
 915                       Salt       : Byte_Array;
 916                       S_Length   : int;
 917                       Iterations : int;
 918                       Key_Length : int;
 919                       Hash_Type  : int) return int with
 920     Convention    => C,
 921     External_Name => "wc_PBKDF2",
 922     Import        => True;
 923
 924   function Ada_MD5 return int with
 925     Convention    => C,
 926     External_Name => "ada_md5",
 927     Import        => True;
 928
 929   function Ada_SHA return int with
 930     Convention    => C,
 931     External_Name => "ada_sha",
 932     Import        => True;
 933
 934   function Ada_SHA256 return int with
 935     Convention    => C,
 936     External_Name => "ada_sha256",
 937     Import        => True;
 938
 939   function Ada_SHA384 return int with
 940     Convention    => C,
 941     External_Name => "ada_sha384",
 942     Import        => True;
 943
 944   function Ada_SHA512 return int with
 945     Convention    => C,
 946     External_Name => "ada_sha512",
 947     Import        => True;
 948
 949   function Ada_SHA3_224 return int with
 950     Convention    => C,
 951     External_Name => "ada_sha3_224",
 952     Import        => True;
 953
 954   function Ada_SHA3_256 return int with
 955     Convention    => C,
 956     External_Name => "ada_sha3_256",
 957     Import        => True;
 958
 959   function Ada_SHA3_384 return int with
 960     Convention    => C,
 961     External_Name => "ada_sha3_384",
 962     Import        => True;
 963
 964   function Ada_SHA3_512 return int with
 965     Convention    => C,
 966     External_Name => "ada_sha3_512",
 967     Import        => True;
 968
 969   procedure PBKDF2 (Output     : out Byte_Array;
 970                     Password   : Byte_Array;
 971                     Salt       : Byte_Array;
 972                     Iterations : Positive;
 973                     Key_Length : Positive;
 974                     HMAC       : HMAC_Hash;
 975                     Result     : out Integer) is
 976   begin
 977      declare
 978         R : int;
 979         H : int;
 980      begin
 981         case HMAC is
 982            when MD5      => H := Ada_MD5;
 983            when SHA      => H := Ada_SHA;
 984            when SHA256   => H := Ada_SHA256;
 985            when SHA384   => H := Ada_SHA384;
 986            when SHA512   => H := Ada_SHA512;
 987            when SHA3_224 => H := Ada_SHA3_224;
 988            when SHA3_256 => H := Ada_SHA3_256;
 989            when SHA3_384 => H := Ada_SHA3_384;
 990            when SHA3_512 => H := Ada_SHA3_512;
 991         end case;
 992         R := WC_PBKDF2 (Output     => Output,
 993                         Password   => Password,
 994                         P_Length   => Password'Length,
 995                         Salt       => Salt,
 996                         S_Length   => Salt'Length,
 997                         Iterations => int (Iterations),
 998                         Key_Length => int (Key_Length),
 999                         Hash_Type  => H);
1000         Result := Integer (R);
1001      end;
1002   exception
1003      when others =>
1004         Result := Exception_Error;
1005   end PBKDF2;
1006
1007   function Ada_RSA_Set_RNG (Key : not null RSA_Key_Type;
1008                             RNG : not null RNG_Type) return int with
1009     Convention    => C,
1010     External_Name => "ada_RsaSetRNG",
1011     Import        => True;
1012
1013   procedure Rsa_Set_RNG (Key    : in out Rsa_Key_Type;
1014                          RNG    : in out RNG_Type;
1015                          Result : out Integer) is
1016   begin
1017      declare
1018         R : int;
1019      begin
1020         R := Ada_RSA_Set_RNG (Key, RNG);
1021         Result := Integer (R);
1022      end;
1023   exception
1024      when others =>
1025         Result := Exception_Error;
1026   end Rsa_Set_RNG;
1027
1028   function Is_Valid (Key : RSA_Key_Type) return Boolean is
1029   begin
1030      return Key /= null;
1031   end Is_Valid;
1032
1033   function Ada_New_RSA return RSA_Key_Type with
1034     Convention    => C,
1035     External_Name => "ada_new_rsa",
1036     Import        => True;
1037
1038   procedure Ada_Free_RSA (Key : in RSA_Key_Type) with
1039     Convention    => C,
1040     External_Name => "ada_free_rsa",
1041     Import        => True;
1042
1043   procedure Free_RSA (Key : in out RSA_Key_Type) is
1044   begin
1045      if Key = null then
1046         return;
1047      end if;
1048
1049      --  wc_DeleteRsaKey() already calls wc_FreeRsaKey() internally.
1050      Ada_Free_RSA (Key);
1051
1052      --  Prevent accidental double-free and make Is_Valid return False.
1053      Key := null;
1054   end Free_RSA;
1055
1056   procedure Create_RSA (Key    : in out RSA_Key_Type;
1057                         Result : out Integer) is
1058   begin
1059      --  Allocate and initialize RSA key using the C wrapper.
1060      --  The wrapper uses wc_NewRsaKey() and returns NULL on failure.
1061      Key := Ada_New_RSA;
1062
1063      if Key = null then
1064         Result := Exception_Error;
1065         return;
1066      end if;
1067
1068      --  wc_NewRsaKey() already calls wc_InitRsaKey_ex() internally.
1069      Result := 0;
1070
1071   exception
1072      when others =>
1073         --  Avoid leaking the dynamically allocated RSA key on failure.
1074         if Key /= null then
1075            Ada_Free_RSA (Key);
1076            Key := null;
1077         end if;
1078         Result := Exception_Error;
1079   end Create_RSA;
1080
1081   function RSA_Public_Key_Decode (Input : Byte_Array;
1082                                   Index : in out int;
1083                                   Key   : not null RSA_Key_Type;
1084                                   Size  : int) return int with
1085     Convention    => C,
1086     External_Name => "wc_RsaPublicKeyDecode",
1087     Import        => True;
1088
1089   procedure Rsa_Public_Key_Decode (Input : Byte_Array;
1090                                    Index : in out Byte_Index;
1091                                    Key   : in out RSA_Key_Type;
1092                                    Size  : Integer;
1093                                    Result : out Integer) is
1094   begin
1095      declare
1096         I : aliased int := int (Index);
1097         R : constant int :=
1098           RSA_Public_Key_Decode (Input, I, Key, int (Size));
1099      begin
1100         Index := WolfSSL.Byte_Index (I);
1101         Result := Integer (R);
1102      end;
1103   exception
1104      when others =>
1105         Result := Exception_Error;
1106   end Rsa_Public_Key_Decode;
1107
1108   function RSA_Private_Key_Decode (Input : Byte_Array;
1109                                    Index : in out int;
1110                                    Key   : not null RSA_Key_Type;
1111                                    Size  : int) return int with
1112     Convention    => C,
1113     External_Name => "wc_RsaPrivateKeyDecode",
1114     Import        => True;
1115
1116   procedure Rsa_Private_Key_Decode (Input : Byte_Array;
1117                                     Index : in out Byte_Index;
1118                                     Key   : in out RSA_Key_Type;
1119                                     Size  : Integer;
1120                                     Result : out Integer) is
1121   begin
1122      declare
1123         I : aliased int := int (Index);
1124         R : constant int :=
1125           RSA_Private_Key_Decode (Input, I, Key, int (Size));
1126      begin
1127         Index := WolfSSL.Byte_Index (I);
1128         Result := Integer (R);
1129      end;
1130   exception
1131      when others =>
1132         Result := Exception_Error;
1133   end Rsa_Private_Key_Decode;
1134
1135   function RSA_SSL_Sign (Input      : Byte_Array;
1136                          In_Length  : int;
1137                          Output     : in out Byte_Array;
1138                          Out_Length : int;
1139                          RSA        : not null RSA_Key_Type;
1140                          RNG        : not null RNG_Type)
1141                          return int with
1142     Convention    => C,
1143     External_Name => "wc_RsaSSL_Sign",
1144     Import        => True;
1145
1146   procedure Rsa_SSL_Sign (Input  : Byte_Array;
1147                           Output : in out Byte_Array;
1148                           RSA    : in out RSA_Key_Type;
1149                           RNG    : in out RNG_Type;
1150                           Result : out Integer) is
1151   begin
1152      declare
1153         R : constant int :=
1154           RSA_SSL_Sign (Input,
1155                         Input'Length,
1156                         Output,
1157                         Output'Length,
1158                         RSA,
1159                         RNG);
1160      begin
1161         Result := Integer (R);
1162      end;
1163   exception
1164      when others =>
1165         Result := Exception_Error;
1166   end Rsa_SSL_Sign;
1167
1168   function WC_RSA_SSL_Verify (Input      : Byte_Array;
1169                               In_Length  : int;
1170                               Output     : in out Byte_Array;
1171                               Out_Length : int;
1172                               RSA        : not null RSA_Key_Type)
1173                               return int with
1174     Convention    => C,
1175     External_Name => "wc_RsaSSL_Verify",
1176     Import        => True;
1177
1178   procedure Rsa_SSL_Verify (Input  : Byte_Array;
1179                             Output : in out Byte_Array;
1180                             RSA    : in out RSA_Key_Type;
1181                             Result : out Integer) is
1182   begin
1183      declare
1184         R : constant int :=
1185           WC_RSA_SSL_Verify (Input,
1186                              Input'Length,
1187                              Output,
1188                              Output'Length,
1189                              RSA);
1190      begin
1191         Result := Integer (R);
1192      end;
1193   exception
1194      when others =>
1195         Result := Exception_Error;
1196   end Rsa_SSL_Verify;
1197
1198   function WC_RSA_Public_Encrypt (Input      : Byte_Array;
1199                                   In_Length  : int;
1200                                   Output     : in out Byte_Array;
1201                                   Out_Length : int;
1202                                   RSA        : not null RSA_Key_Type;
1203                                   RNG        : not null RNG_Type)
1204                                   return int with
1205     Convention    => C,
1206     External_Name => "wc_RsaPublicEncrypt",
1207     Import        => True;
1208
1209   procedure RSA_Public_Encrypt (Input  : Byte_Array;
1210                                 Output : in out Byte_Array;
1211                                 Index  :    out Byte_Index;
1212                                 RSA    : in out RSA_Key_Type;
1213                                 RNG    : in out RNG_Type;
1214                                 Result : out Integer) is
1215   begin
1216      Index := 0;
1217      declare
1218         R : constant int :=
1219           WC_RSA_Public_Encrypt (Input,
1220                                  Input'Length,
1221                                  Output,
1222                                  Output'Length,
1223                                  RSA,
1224                                  RNG);
1225      begin
1226         Result := Integer (R);
1227         if Result >= 0 then
1228            Index := Byte_Index (Result);
1229         end if;
1230      end;
1231   exception
1232      when others =>
1233         Result := Exception_Error;
1234   end RSA_Public_Encrypt;
1235
1236   function WC_RSA_Private_Decrypt (Input      : Byte_Array;
1237                                    In_Length  : int;
1238                                    Output     : in out Byte_Array;
1239                                    Out_Length : int;
1240                                    RSA        : not null RSA_Key_Type)
1241                                    return int with
1242     Convention    => C,
1243     External_Name => "wc_RsaPrivateDecrypt",
1244     Import        => True;
1245
1246   procedure RSA_Private_Decrypt (Input  : Byte_Array;
1247                                  Output : in out Byte_Array;
1248                                  Index  :    out Byte_Index;
1249                                  RSA    : in out RSA_Key_Type;
1250                                  Result :    out Integer) is
1251   begin
1252      Index := 0;
1253      declare
1254         R : constant int :=
1255           WC_RSA_Private_Decrypt (Input,
1256                                   Input'Length,
1257                                   Output,
1258                                   Output'Length,
1259                                   RSA);
1260      begin
1261         Result := Integer (R);
1262         if Result >= 0 then
1263            Index := Byte_Index (Result);
1264         end if;
1265      end;
1266   exception
1267      when others =>
1268         Result := Exception_Error;
1269   end RSA_Private_Decrypt;
1270
1271   function Init_SHA256 (SHA256 : not null Sha256_Type) return int with
1272     Convention    => C,
1273     External_Name => "wc_InitSha256",
1274     Import        => True;
1275
1276   function SHA256_Update (SHA256 : not null Sha256_Type;
1277                           Byte   : Byte_Array;
1278                           Length : int) return int with
1279     Convention    => C,
1280     External_Name => "wc_Sha256Update",
1281     Import        => True;
1282
1283   function SHA256_Final (SHA256 : not null Sha256_Type;
1284                          Hash   : out Byte_Array) return int with
1285     Convention    => C,
1286     External_Name => "wc_Sha256Final",
1287     Import        => True;
1288
1289   function Is_Valid (SHA256 : SHA256_Type) return Boolean is
1290   begin
1291      return SHA256 /= null;
1292   end Is_Valid;
1293
1294   function Ada_New_SHA256 return SHA256_Type with
1295     Convention    => C,
1296     External_Name => "ada_new_sha256",
1297     Import        => True;
1298
1299   procedure Ada_Free_SHA256 (SHA256 : in SHA256_Type) with
1300     Convention    => C,
1301     External_Name => "ada_free_sha256",
1302     Import        => True;
1303
1304   procedure Free_SHA256 (SHA256 : in out SHA256_Type) is
1305      --  Ensure any internal wolfCrypt resources are released (hardware locks,
1306      --  etc.) before releasing the object storage itself.
1307      procedure WC_Sha256_Free (SHA256 : not null SHA256_Type) with
1308        Convention    => C,
1309        External_Name => "wc_Sha256Free",
1310        Import        => True;
1311   begin
1312      if SHA256 = null then
1313         return;
1314      end if;
1315
1316      WC_Sha256_Free (SHA256);
1317      Ada_Free_SHA256 (SHA256);
1318
1319      --  Prevent accidental double-free and make Is_Valid return False.
1320      SHA256 := null;
1321   end Free_SHA256;
1322
1323   procedure Create_SHA256 (SHA256 : in out SHA256_Type;
1324                            Result : out Integer) is
1325   begin
1326      declare
1327         R : int;
1328      begin
1329         SHA256 := Ada_New_SHA256;
1330
1331         if SHA256 = null then
1332            Result := Exception_Error;
1333            return;
1334         end if;
1335
1336         R := Init_SHA256 (SHA256);
1337         Result := Integer (R);
1338
1339         if Result /= 0 then
1340            --  Avoid leaking the dynamically allocated SHA256 on init failure.
1341            --  Also clear the handle to prevent accidental double-free by caller.
1342            Ada_Free_SHA256 (SHA256);
1343            SHA256 := null;
1344         end if;
1345      end;
1346   exception
1347      when others =>
1348         Result := Exception_Error;
1349   end Create_SHA256;
1350
1351   procedure Update_SHA256 (SHA256 : in out SHA256_Type;
1352                            Byte   : Byte_Array;
1353                            Result : out Integer) is
1354   begin
1355      declare
1356         R : int;
1357      begin
1358         R := SHA256_Update (SHA256, Byte, Byte'Length);
1359         Result := Integer (R);
1360      end;
1361   exception
1362      when others =>
1363         Result := Exception_Error;
1364   end Update_SHA256;
1365
1366   procedure Finalize_SHA256 (SHA256 : in out SHA256_Type;
1367                              Hash   : out SHA256_Hash;
1368                              Result : out Integer) is
1369      R : int;
1370   begin
1371      R := SHA256_Final (SHA256, Hash);
1372      Result := Integer (R);
1373   exception
1374      when others =>
1375         Result := Exception_Error;
1376   end Finalize_SHA256;
1377
1378   function WC_Get_Invalid_Device_Identifier return int with
1379     Convention    => C,
1380     External_Name => "get_wolfssl_invalid_devid",
1381     Import        => True;
1382
1383   function Invalid_Device return Device_Identifier is
1384   begin
1385      return Device_Identifier (WC_Get_Invalid_Device_Identifier);
1386   end Invalid_Device;
1387
1388   function Is_Valid (AES : AES_Type) return Boolean is
1389   begin
1390      return AES /= null;
1391   end Is_Valid;
1392
1393   function Ada_New_AES (Device : int)
1394                         return AES_Type with
1395     Convention    => C,
1396     External_Name => "ada_new_aes",
1397     Import        => True;
1398
1399   procedure Ada_Free_AES (AES : in AES_Type) with
1400     Convention    => C,
1401     External_Name => "ada_free_aes",
1402     Import        => True;
1403
1404   procedure Create_AES (Device : Device_Identifier;
1405                         AES    : in out AES_Type;
1406                         Result : out Integer) is
1407   begin
1408      declare
1409         R : int;
1410      begin
1411         --  Allocate and initialize AES using the C wrapper.
1412         --  The wrapper is expected to call wc_AesNew(NULL, devId, &ret) and
1413         --  return NULL on failure.
1414         AES := Ada_New_AES (int (Device));
1415
1416         if AES = null then
1417            Result := Exception_Error;
1418            return;
1419         end if;
1420
1421         --  wc_AesNew() already calls wc_AesInit() internally, so no extra init.
1422         Result := 0;
1423      end;
1424   exception
1425      when others =>
1426         --  Avoid leaking the dynamically allocated AES on failure.
1427         if AES /= null then
1428            Ada_Free_AES (AES);
1429            AES := null;
1430         end if;
1431         Result := Exception_Error;
1432   end Create_AES;
1433
1434   function AES_Set_Key (AES : not null AES_Type;
1435                         Key : Byte_Array;
1436                         Length : int;
1437                         IV : Byte_Array;
1438                         Dir : int) return int with
1439     Convention    => C,
1440     External_Name => "wc_AesSetKey",
1441     Import        => True;
1442
1443   procedure AES_Set_Key (AES    : AES_Type;
1444                          Key    : Byte_Array;
1445                          Length : Integer;
1446                          IV     : Byte_Array;
1447                          Dir    : Integer;
1448                          Result : out Integer) is
1449   begin
1450      declare
1451         R : int;
1452      begin
1453         R := AES_Set_Key (AES, Key, int (Length), IV, int (Dir));
1454         Result := Integer (R);
1455      end;
1456   exception
1457      when others =>
1458         Result := Exception_Error;
1459   end AES_Set_Key;
1460
1461   function AES_Set_IV (AES : not null AES_Type;
1462                        IV : Byte_Array) return int with
1463     Convention    => C,
1464     External_Name => "wc_AesSetIV",
1465     Import        => True;
1466
1467   procedure AES_Set_IV (AES : AES_Type;
1468                         IV  : Byte_Array;
1469                         Result : out Integer) is
1470   begin
1471      declare
1472         R : int;
1473      begin
1474         R := AES_Set_IV (AES, IV);
1475         Result := Integer (R);
1476      end;
1477   exception
1478      when others =>
1479         Result := Exception_Error;
1480   end AES_Set_IV;
1481
1482   function AES_Set_Cbc_Encrypt (AES : not null AES_Type;
1483                                 Output : out Byte_Array;
1484                                 Input : Byte_Array;
1485                                 Size : int) return int with
1486     Convention    => C,
1487     External_Name => "wc_AesCbcEncrypt",
1488     Import        => True;
1489
1490   procedure AES_Set_Cbc_Encrypt (AES : AES_Type;
1491                                  Output : out Byte_Array;
1492                                  Input : Byte_Array;
1493                                  Size : Integer;
1494                                  Result : out Integer) is
1495   begin
1496      declare
1497         R : int;
1498      begin
1499         R := AES_Set_Cbc_Encrypt (AES, Output, Input, int (Size));
1500         Result := Integer (R);
1501      end;
1502   exception
1503      when others =>
1504         Result := Exception_Error;
1505   end AES_Set_Cbc_Encrypt;
1506
1507   function AES_Set_Cbc_Decrypt (AES : not null AES_Type;
1508                                 Output : out Byte_Array;
1509                                 Input : Byte_Array;
1510                                 Size : int) return int with
1511     Convention    => C,
1512     External_Name => "wc_AesCbcDecrypt",
1513     Import        => True;
1514
1515   procedure AES_Set_Cbc_Decrypt (AES : AES_Type;
1516                                  Output : out Byte_Array;
1517                                  Input : Byte_Array;
1518                                  Size : Integer;
1519                                  Result : out Integer) is
1520   begin
1521      declare
1522         R : int;
1523      begin
1524         R := AES_Set_Cbc_Decrypt (AES, Output, Input, int (Size));
1525         Result := Integer (R);
1526      end;
1527   exception
1528      when others =>
1529         Result := Exception_Error;
1530   end AES_Set_Cbc_Decrypt;
1531
1532   procedure AES_Free (AES : in out AES_Type;
1533                       Result : out Integer) is
1534   begin
1535      if AES = null then
1536         Result := Exception_Error;
1537         return;
1538      end if;
1539
1540      --  wc_AesDelete() already calls wc_AesFree() internally.
1541      Ada_Free_AES (AES);
1542      AES := null;
1543      Result := 0;
1544   exception
1545      when others =>
1546         Result := Exception_Error;
1547   end AES_Free;
1548
1549begin
1550   null;
1551end WolfSSL;