.TH SSL 3 .SH NAMEssl \- SSL record layer.SH SYNOPSIS.nf.B bind -a #D /net .B /net/ssl/clone.BI /net/ssl/ n .BI /net/ssl/ n /ctl.BI /net/ssl/ n /data.BI /net/ssl/ n /encalgs.BI /net/ssl/ n /hashalgs.BI /net/ssl/ n /secretin.BI /net/ssl/ n /secretout.fi.SH DESCRIPTIONThe SSL device provides the interface to the Secure Socket Layerdevice implementing the record layer protocol of SSLv2(but not the handshake protocol, which is responsible formutual authentication and key exchange.)The.I ssldevice can be thought of as a filter providing optional encryptionand anti-tampering..PPThe top level directory contains a.B clonefile and subdirectories numbered from zero to the number of connectionsconfigured.Opening the.B clonefile reserves a connection.  The file descriptor returned from the.IR open (2)will point to the control file,.BR ctl ,of the newly allocated connection.  Reading the.B ctlfile returns a textstring representing the number of theconnection..PPA connection is controlled by writing text strings to the associated.B ctlfile.  After a connection has been established data may be read fromand written to the data file..PPThe SSL protocol provides a stream connection that preserves.BR read / writeboundaries.  As long as reads always specify buffers that areof equal or greater lengths than the writes at the other end of theconnection, one write will correspond to one read..PPOptions are set by writing control messages to the.B ctlfile of the connection..PPThe following control messages are supported:.TP.BI fd \ open-file-descriptorRun the SSL protocol over the existing file descriptor..TP.BI alg \ cryptoalgsConnections start in.B alg clearwhich means no encryption or digesting.Writing.B alg shato the control file turns on SHA-1 digest authenticationfor the data channel.Similarly, writing.B alg rc4_128enables encryption.Both can be turned on at once by.BR "alg sha rc4_128" .The digest mode.B shamay be replaced by.BR md5 .The encryption mode.B rc4_128may be replaced by.BR rc4_40 ,.BR rc4_128 ,.BR rc4_256 ,.BR des_40_ecb ,.BR des_40_cbc ,.BR des_56_ecb ,and.BR des_56_cbc .The mode may be changed at any time during the connection..TP.BI secretin \ base64-secretThe secret for decrypting and authenticating incoming messagescan be specified either as a base64 encoded string by writing to thecontrol file, or as a binary byte string using the interface below..TP.BI secretout \ base64-secretThe secret for encrypting and hashing outgoing messagescan be specified either as a base64 encoded string by writing to thecontrol file, or as a binary byte string using the interface below..PPBefore enabling digesting or encryption, shared secrets must be agreed upon withthe remote side, one for each direction of transmission,and loaded as shown above or by writing to the files.I secretinand.IR secretout .If either the incoming or outgoing secret is not specified, the other secretis assumed to work for both directions..PPThe encryption and hash algoritms actually included in the kernelmay be smaller than the set presented here.  Reading.I encalgsand .I hashalgswill give the actual space-separated list of algorithms implemented..SH "SEE ALSO".IR listen (8),.IR dial (2).SH SOURCE.B /sys/src/9/port/devssl.c.SH BUGSMessages longer than 4096 bytes are truncated.