kibi-swipl-linux-x64-gnu 1.0.0

package/lib/swipl/doc/packages/examples/ssl/etc/server/server-cert.pem

@@ -0,0 +1,85 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            9d:c0:87:97:a0:f6:3f:7d
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C=NL, ST=Noord-Holland, O=Diff Automatisering, OU=Support group, CN=J. van der Steen/emailAddress=info@diff.nl
+        Validity
+            Not Before: Apr  1 09:35:37 2020 GMT
+            Not After : Apr  1 09:35:37 2021 GMT
+        Subject: C=NL, ST=Noord-Holland, L=Amsterdam, O=Diff Automatisering, OU=Server, CN=J. van der Steen/emailAddress=J.van.der.Steen@diff.nl
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:e7:6c:7a:c1:e9:17:aa:ea:d8:32:73:66:b3:62:
+                    ee:3c:7d:c8:e4:3c:59:67:57:67:8d:98:61:24:31:
+                    98:23:8f:ef:c3:41:2a:0f:82:1e:6a:6f:2d:00:9e:
+                    bf:19:ad:6b:46:42:17:c2:1e:cc:27:b5:c7:66:7a:
+                    a5:7b:cc:8c:15:0a:1c:d2:c5:87:23:94:88:42:5e:
+                    42:9f:41:22:5a:ad:71:b2:29:54:23:39:cd:05:db:
+                    cf:6d:3b:8e:9a:b0:f3:e6:ca:9f:2d:39:28:d6:1c:
+                    76:da:34:54:27:f9:a0:0f:1d:ae:32:30:c4:7f:9e:
+                    53:18:64:27:2f:05:2b:bf:66:ce:39:52:99:8e:10:
+                    1a:80:bf:5e:3a:54:fb:85:da:fc:a7:2d:90:99:42:
+                    c7:e2:cf:6a:db:56:1d:3b:bc:0e:97:bf:c5:d4:58:
+                    c4:76:33:a2:25:8c:56:94:b4:8d:a9:d3:ab:76:2a:
+                    f9:4c:15:de:d1:b8:23:66:3f:36:9a:4b:51:9e:1a:
+                    27:e5:f0:38:a3:2a:2a:ab:cd:1c:88:7c:e4:df:82:
+                    44:6f:e9:c1:0d:6f:55:98:f4:c0:06:41:ff:1f:c7:
+                    30:6a:9a:14:57:73:bd:e0:a7:f7:43:0f:f4:ae:49:
+                    b3:48:de:42:fd:0d:be:26:e1:39:4d:24:b8:36:d7:
+                    16:43
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            Netscape Comment: 
+                OpenSSL Generated Certificate
+            X509v3 Subject Key Identifier: 
+                01:84:17:EF:98:0D:F4:DD:FC:24:63:09:EF:2F:E6:BE:52:97:7C:17
+            X509v3 Authority Key Identifier: 
+                keyid:E2:7B:60:8C:77:BB:B2:74:B8:FD:D6:2C:A9:D3:B9:35:97:12:87:EC
+
+    Signature Algorithm: sha256WithRSAEncryption
+         9a:b1:75:61:08:bb:ca:dc:b9:cd:3e:5e:30:f8:86:20:2c:e1:
+         47:41:50:c6:a3:e5:b0:d2:08:43:eb:86:9e:5c:2c:7b:4c:40:
+         f9:f2:64:1d:7d:9e:f7:31:78:ef:12:05:ff:b9:4e:48:dc:0c:
+         b9:9d:df:6f:3e:27:e4:a4:55:b7:61:70:9c:6d:97:30:78:5f:
+         72:7a:61:ad:68:96:e6:db:7f:fe:3a:82:52:71:88:42:08:67:
+         ce:13:00:af:8f:e1:fd:bb:fd:c8:a4:cc:a9:4e:93:8f:c2:91:
+         b8:e8:22:86:c0:65:36:e7:25:fb:c3:ca:bb:23:b2:33:fa:41:
+         2c:9c:e7:d8:9f:14:82:1f:a7:ea:20:77:8d:7b:82:3f:22:ea:
+         9b:87:8f:86:eb:f7:15:14:17:12:c0:90:6b:cd:7b:e1:9f:da:
+         96:aa:59:7c:21:01:98:2f:d6:19:e4:7d:60:04:d3:64:65:a3:
+         7b:a4:0f:59:d0:ce:90:1b:e0:6b:55:4f:94:d2:a5:aa:0f:c4:
+         05:b9:e8:e4:7e:11:33:db:77:3f:73:ab:ea:2d:6e:00:07:7e:
+         5a:6c:42:79:dc:06:86:85:3f:44:25:e7:d6:44:b8:b2:2e:f4:
+         f1:a4:60:97:3f:b3:74:29:d7:ec:6d:f1:c4:9c:7b:e4:57:a3:
+         3c:be:17:bb
+-----BEGIN CERTIFICATE-----
+MIIEPjCCAyagAwIBAgIJAJ3Ah5eg9j99MA0GCSqGSIb3DQEBCwUAMIGTMQswCQYD
+VQQGEwJOTDEWMBQGA1UECAwNTm9vcmQtSG9sbGFuZDEcMBoGA1UECgwTRGlmZiBB
+dXRvbWF0aXNlcmluZzEWMBQGA1UECwwNU3VwcG9ydCBncm91cDEZMBcGA1UEAwwQ
+Si4gdmFuIGRlciBTdGVlbjEbMBkGCSqGSIb3DQEJARYMaW5mb0BkaWZmLm5sMB4X
+DTIwMDQwMTA5MzUzN1oXDTIxMDQwMTA5MzUzN1owgasxCzAJBgNVBAYTAk5MMRYw
+FAYDVQQIDA1Ob29yZC1Ib2xsYW5kMRIwEAYDVQQHDAlBbXN0ZXJkYW0xHDAaBgNV
+BAoME0RpZmYgQXV0b21hdGlzZXJpbmcxDzANBgNVBAsMBlNlcnZlcjEZMBcGA1UE
+AwwQSi4gdmFuIGRlciBTdGVlbjEmMCQGCSqGSIb3DQEJARYXSi52YW4uZGVyLlN0
+ZWVuQGRpZmYubmwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDnbHrB
+6Req6tgyc2azYu48fcjkPFlnV2eNmGEkMZgjj+/DQSoPgh5qby0Anr8ZrWtGQhfC
+HswntcdmeqV7zIwVChzSxYcjlIhCXkKfQSJarXGyKVQjOc0F289tO46asPPmyp8t
+OSjWHHbaNFQn+aAPHa4yMMR/nlMYZCcvBSu/Zs45UpmOEBqAv146VPuF2vynLZCZ
+Qsfiz2rbVh07vA6Xv8XUWMR2M6IljFaUtI2p06t2KvlMFd7RuCNmPzaaS1GeGifl
+8DijKiqrzRyIfOTfgkRv6cENb1WY9MAGQf8fxzBqmhRXc73gp/dDD/SuSbNI3kL9
+Db4m4TlNJLg21xZDAgMBAAGjezB5MAkGA1UdEwQCMAAwLAYJYIZIAYb4QgENBB8W
+HU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1UdDgQWBBQBhBfvmA30
+3fwkYwnvL+a+Upd8FzAfBgNVHSMEGDAWgBTie2CMd7uydLj91iyp07k1lxKH7DAN
+BgkqhkiG9w0BAQsFAAOCAQEAmrF1YQi7yty5zT5eMPiGICzhR0FQxqPlsNIIQ+uG
+nlwse0xA+fJkHX2e9zF47xIF/7lOSNwMuZ3fbz4n5KRVt2FwnG2XMHhfcnphrWiW
+5tt//jqCUnGIQghnzhMAr4/h/bv9yKTMqU6Tj8KRuOgihsBlNucl+8PKuyOyM/pB
+LJzn2J8Ugh+n6iB3jXuCPyLqm4ePhuv3FRQXEsCQa8174Z/alqpZfCEBmC/WGeR9
+YATTZGWje6QPWdDOkBvga1VPlNKlqg/EBbno5H4RM9t3P3Or6i1uAAd+WmxCedwG
+hoU/RCXn1kS4si708aRglz+zdCnX7G3xxJx75FejPL4Xuw==
+-----END CERTIFICATE-----

package/lib/swipl/doc/packages/examples/ssl/etc/server/server-key.pem

@@ -0,0 +1,30 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIFDjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIUZoWaoXwEL4CAggA
+MBQGCCqGSIb3DQMHBAiLJma8RXDpzQSCBMhVAz+QXJhiJw5epX1BiJL7j/09s8mb
+uXxgpJhE40kAbwAvykq6FOmjubrE6bPx0n8Dk4b/KroKjjS6DV0AX4jvrep43T/z
+IRHqjDdYOHAyIi9yXQGsFkeHdIEo7vXU1zA4Om+K3wreK07Pz4YfiKAWF6/6xJj4
+fue8zXGgLB6fiWQs4EbH7EiCYgVuypU50sUa/AnpWXe9ITVBssjeHCjTphxHtL8j
+rT+JBv0XpdAYcBOX4irk8zEq+432/RL7DPi2ercBpDQeaAsMfyTOrhptUkAcyj0/
+PTFsrxchtyS5HQbR7yKhio2bxAGCinsWD/WSLU95RzT83rSgMth4q9nURqVKE7Y1
+LsnMa9YIyITdKPSzyA8rmcylghK23PDGhYDw1pZIhbpcGNjiLSyI4js68urIwpK1
+xdQv9Oouq8U5SJNLH7jNJVIfmtOIVnJEy+GoSgNtQn7f9LrLfZtccWNsejuKxvDi
+NKmhrUvoMLD7lN6CH7CWtUe3o523Q/a4XXJYnTrFz4viKS8ig5ljfzOzq1XimJJb
+/EmKStoiRIeTC0MBmCu0uo43oaT+AihvZZB+TPUV/L0T0kV7rd0n59RxFmwOlO7j
+iSOz1cy2jmILiDh4gAdH43H6WG6I38q23rLyt/EMVh/1DgJlndfdVVKk4VvFT/Bx
+MjgEEvrf/VC7idy6mQea4tWJ+lXag64phwXt0zja3v/tVKhVJPyFlFLgslve7ZKt
+8r8nFTFcZSyVt2Qi+kRL3Iuu/lRkvOcaeK5VdtjV4PV+Pmk6VvecptSr2pkfUTdy
+wFgKWBjwruINfcIoFyegL4cUyWWcQDwSfWTT0WAWt6kLvf0xjK6jjcFvFn46RHFf
+zQbnmyqo20nKRhR88EJTuqevyLRUG1EBQwSyWuq4m/5XTy5nFIWcWIx6bF/hsk9C
+ZB/aq2+4pw6oZlEb7yXdaLvlRXuhmiqUbff2xW/lcG77AWDm3as0J7O6OZg+7170
+DdP99viL/K1+O0gZZDkl/YGdJgy6eHA0GXC1Xz6vARRxexxwvJQfXb5R2FnMENxm
+sCTqZwIXYPCWnQ7IoRUHl4q8uMTdxCZiIoXglzX+O5XTxPUOYk8HeEohIppAt5l/
+dB9lMfQmM/GEOXYlI8gEPNJ4vVBiulpzbIfHT9qAZVpH4+++Hwo6xYT2z/L46Ax2
+IlFS1TMd9f9PkPf/Vh+aezcw6YfIUEJ6YTuOjmSgSpPshQKC4mgTtIayOEJTuBih
+EAf+nq940RaKlittUi5s1YZbxwkV+YXz6DsK6L4UypmU2Dlg/aWaEFQsIUULSNgi
+FrlzJZwRJdFhcQhvkr2WUk5JxcScydPRqhhk7ZL2EVzgGqdNfg3aq9jZGBQYthqL
+DxcSQcrolOj2p2DUAUGJdtBGpzddz77qB81E4Sy3rsratycaDBARADORqrPEXdSi
+DBhSFCCARpZtIxALPjANLL8Jx1kz9H4bZcp0z+M9l+pSfjpXEbWOKD/OpCqlvhCK
+4EiLhYYoUZWPQeZf0khgIZk9n0PvnUb5oJYONdnCb4fBgEDUMQ0wijCw3D5QMC0Y
+Es2tHhIGqwxjaI5SmmOET1tYznInffvsWhvN8WESirISrjM9KZx608bpHRV47oXi
+O7g=
+-----END ENCRYPTED PRIVATE KEY-----

package/lib/swipl/doc/packages/examples/ssl/https.pl

@@ -0,0 +1,267 @@
+/*  Part of SWI-Prolog
+
+    Author:        Jan Wielemaker
+    E-mail:        J.Wielemaker@vu.nl
+    WWW:           http://www.swi-prolog.org
+
+    This demo code is released in the _public domain_, which implies
+    you may copy, modify and reuse this code without restriction.
+*/
+
+:- module(https,
+          [ http_download/2,                    % +URL, -String
+
+            http_server/1,                      % ?Port
+            https_server/1,                     % ?Port
+            https_server_with_client_cert/1,    % ?Port
+
+            http_client/2,                      % +Port, +Page
+            https_client/2,                     % +Port, +Page
+            https_client_with_client_cert/2     % +Port, +Page
+          ]).
+
+% Include  our  dependencies.  The  conditions  are  to  accomodate  for
+% different locations of some of  the  files   in  the  source  tree and
+% examples tree.
+
+:- prolog_load_context(directory, D),
+   atom_concat(D, '/..', DD),
+   asserta(user:file_search_path(library, DD)).
+:- if(exists_source(library(http/examples/demo_body))).
+:- use_module(library(http/examples/demo_body)).    % location in source tree
+:- elif(exists_source(swi(doc/packages/examples/http/demo_body))).
+:- use_module(swi(doc/packages/examples/http/demo_body)).
+:- else.
+:- use_module(library(http/demo_body)).             % location in demo tree
+:- endif.
+:- use_module(library(http/thread_httpd)).
+:- if(exists_source(library(http/http_ssl_plugin))).
+:- use_module(library(http/http_ssl_plugin)).
+:- else.
+:- use_module(http_ssl_plugin).
+:- endif.
+:- use_module(library(debug)).
+
+/** <module> Demo HTTPS server
+
+This demo illustrates how to use the SSL library for dealing with HTTPS.
+It provides examples for simple download of HTTPS documents from the web
+and provides demo code  for  several   HTTPS  servers  and corresponding
+client code using  (self-signed)  certificates.   The  certificates  are
+provided in the  `etc`  directory.  These   certificates  are  the  same
+certificates that are used for testing the SSL library. You may use them
+for testing purposes, but you should not  use them for your own services
+because the private key is not so private.
+
+This demo implements three different servers:
+
+  - http_server/1 implements a typical HTTP server.
+  - https_server/1 implements a typical HTTPS server.
+  - https_server_with_client_cert/1 implements a server that asks
+
+The startup sequence to run the  server   at  port  1443 is shown below.
+Directing your browser to the indicated URL should cause your browser to
+warn you about an untrusted certificate. After accepting you can use the
+simple demo through HTTPS.
+
+  ==
+  $ swipl https.pl
+  ...
+  ?- https_server(1443).
+  % Started server at https://localhost:1443/
+  true.
+  ==
+
+The demo is primarily intended to  access   from  a  browser, but at the
+bottom of this file are predicates to access the server from Prolog. The
+first argument is the port and must be the same as the value returned by
+or given to the *_server predicate. The   second  is the location on the
+server, e.g., `/`, `/quit`, `/env`, etc.
+
+  - http_client/2 accesses http_server/1.
+  - https_client/2 accesses https_server/1.
+  - https_client_with_client_cert/2 accesses https_server_with_client_cert/1.
+
+An example session is given  below.  Now   that  you  can either run the
+client calls from the Prolog window in   which you started the server or
+load this file into another Prolog.
+
+  ==
+  ?- https_client(1443, '/quit').
+  Bye Bye
+  true.
+  ==
+*/
+
+%!  http_download(+URL, -Data) is det.
+%
+%   Download data from an HTTP or HTTPS   server.  If HTTPS is used,
+%   the certificate is verified  by   the  system's root certificate
+%   store.  This  means  you  cannot  download  from  servers  using
+%   self-signed certificates, but  you  can   download  from  proper
+%   public websites with official authorized keys.  For example:
+%
+%     ==
+%     ?- http_download('https://raw.githubusercontent.com\c
+%                      /SWI-Prolog/packages-ssl/master/README.md',
+%                      String).
+%     ==
+
+http_download(URL, String) :-
+    http_open(URL, In, []),
+    call_cleanup(
+        read_string(In, _, String),
+        close(In)).
+
+%!  http_server(?Port) is det.
+%
+%   Our baseline is a plain HTTP server.  No HTTPS involved here. We
+%   give it for the case you want to do timing and other experiments
+%   comparing the HTTP with HTTPS.
+
+http_server(Port) :-
+    http_server(reply,
+                [ port(Port)
+                ]).
+
+
+%!  https_server(?Port) is det.
+%
+%   Start an HTTPS demo server at Port.   Compared  to a normal HTTP
+%   server, this requires two additional SSL components:
+%
+%     1. The server certificate.  This is basically a public
+%     key, so there is no need to keep this secret.
+%     2. The server private key.  If someone manages to grab
+%     this key, he can setup a server that claims to be you.
+%     There are two ways to protect it.  One is to make sure
+%     the file cannot be obtained and the other is to protect
+%     it using a password and make sure that the password is
+%     kept secret.  Our server uses a password, but it is not
+%     very secret.  See also the `pem_password_hook` option
+%     of ssl_context/3.
+%
+%   Note that anyone can access this  server. You can implement HTTP
+%   authentication or cookie based password login in the application
+%   to realise a safe login procedure  where attackers cannot easily
+%   steal the HTTP authentication token or cookie.
+
+https_server(Port) :-
+    http_server(reply,
+                [ port(Port),
+                  ssl([ certificate_file('etc/server/server-cert.pem'),
+                        key_file('etc/server/server-key.pem'),
+                        password("apenoot1")
+                      ])
+                ]).
+
+
+%!  https_server_with_client_cert(?Port)
+%
+%   Our second server  is  a  setup   that  is  typically  used  for
+%   administrative tasks where users  are   handed  a certificate to
+%   login. In our example, we use the client certificate and private
+%   key that can be found in etc/client.   First  of all, we need to
+%   combine these into a `.p12` (PKCS12)   file.  This is done using
+%   `openssl`  as  below.  We  provide  the    .p12  file  for  your
+%   convenience.
+%
+%     ==
+%     $ openssl pkcs12 -export \
+%           -inkey client-key.pem -in client-cert.pem \
+%           -name jan -out client-cert.p12
+%     Enter pass phrase for client-key.pem: apenoot2
+%     Enter Export Password: secret
+%     ==
+%
+%   Next, import `client-cert.p12` into your   browser. For firefox,
+%   this is in   Edit/Preference/Advanced/View  Certificates/Import.
+%   When requested for the password, enter "secret".
+
+https_server_with_client_cert(Port) :-
+    http_server(reply,
+                [ port(Port),
+                  ssl([ certificate_file('etc/server/server-cert.pem'),
+                        key_file('etc/server/server-key.pem'),
+                        password("apenoot1"),
+                        peer_cert(true),
+                        cacert_file('etc/demoCA/cacert.pem'),
+                        cert_verify_hook(client_cert_verify)
+                      ])
+                ]).
+
+%!  client_cert_verify(+SSL,
+%!                     +ProblemCert, +AllCerts, +FirstCer,
+%!                     +Error) is semidet.
+%
+%   This hook is called for  validating   the  peer certificate. The
+%   certificate has already been validated   against the known _root
+%   certificates_ and Error either contains   `verified` to indicate
+%   that this part of the  validation   was  successful or a message
+%   from OpenSSL indicating why it did   not verify. The certificate
+%   is accepted if this hook  succeeds,   regardless  of the initial
+%   verification. If this hook  is   not  defined, certificates that
+%   verify against the root certificates are accepted and others are
+%   rejected, i.e., the default implementation  behaves as `Error ==
+%   verified`.
+
+% :- debug(cert_verify_hook).
+
+:- public
+    client_cert_verify/5.
+
+client_cert_verify(_SSL, _Problem, _AllCerts, First, Error) :-
+    debug(cert_verify_hook,
+          'Handling client certificate verification~n\c
+              Certificate: ~p, error: ~w~n', [First, Error]).
+
+
+                 /*******************************
+                 *            CLIENTS           *
+                 *******************************/
+
+:- use_module(library(http/http_open)).
+
+%!  http_client(+Port, +Page) is det.
+%
+%   Access the server created with http_server/1. Note that the only
+%   significant difference to  https_client/2  is   the  URL  scheme
+%   (`http` vs. `https`.
+
+http_client(Port, Page) :-
+    format(atom(URL), 'http://localhost:~d~w', [Port, Page]),
+    http_open(URL, In,
+              [
+                  ]),
+    copy_stream_data(In, current_output),
+    close(In).
+
+%!  https_client(+Port, +Page) is det.
+%
+%   Access the server created with https_server/1.  Note that, as we
+%   are using a self-signed  certificate,  we   pass  our  own  root
+%   certificate instead of using the system one.
+
+https_client(Port, Page) :-
+    format(atom(URL), 'https://localhost:~d~w', [Port, Page]),
+    http_open(URL, In,
+              [ cacert_file('etc/demoCA/cacert.pem')
+              ]),
+    copy_stream_data(In, current_output),
+    close(In).
+
+%!  https_client_with_client_cert(+Port, +Page) is det.
+%
+%   Access the server created  with https_server_with_client_cert/1,
+%   providing our client certificate.
+
+https_client_with_client_cert(Port, Page) :-
+    format(atom(URL), 'https://localhost:~d~w', [Port, Page]),
+    http_open(URL, In,
+              [ cacert_file('etc/demoCA/cacert.pem'),
+                certificate_file('etc/client/client-cert.pem'),
+                key_file('etc/client/client-key.pem'),
+                password('apenoot2')
+              ]),
+    copy_stream_data(In, current_output),
+    close(In).

package/lib/swipl/doc/packages/examples/ssl/server.pl

@@ -0,0 +1,106 @@
+/*  Part of SWI-Prolog
+
+    Author:        Jan van der Steen and Jan Wielemaker
+    E-mail:        J.van.der.Steen@diff.nl and jan@swi.psy.uva.nl
+    WWW:           http://www.swi-prolog.org
+    Copyright (c)  2004-2011, SWI-Prolog Foundation
+    All rights reserved.
+
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions
+    are met:
+
+    1. Redistributions of source code must retain the above copyright
+       notice, this list of conditions and the following disclaimer.
+
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in
+       the documentation and/or other materials provided with the
+       distribution.
+
+    THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+    "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+    LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+    FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+    INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+    BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+    LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+    CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+    LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
+    ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+*/
+
+:- module(server,
+          [ server/0
+          ]).
+:- use_module(library(debug),[debug/1,debug/3]).
+:- autoload(library(readutil),[read_line_to_codes/2]).
+:- autoload(library(socket),
+	    [ tcp_socket/1,
+	      tcp_setopt/2,
+	      tcp_bind/2,
+	      tcp_listen/2,
+	      tcp_accept/3,
+	      tcp_open_socket/3,
+	      tcp_close_socket/1
+	    ]).
+:- autoload(library(ssl),[ssl_context/3,ssl_negotiate/5]).
+
+:- debug(connection).
+
+server :-
+    ssl_context(server, SSL,
+                [ peer_cert(true),
+                  cacert_file('etc/demoCA/cacert.pem'),
+                  certificate_file('etc/server/server-cert.pem'),
+                  key_file('etc/server/server-key.pem'),
+                  cert_verify_hook(get_cert_verify),
+                  close_notify(true),
+                  % password('apenoot1'),
+                  pem_password_hook(get_server_pwd)
+                ]),
+    Port = 1111,
+    tcp_socket(Socket),
+    tcp_setopt(Socket, reuseaddr),
+    tcp_bind(Socket, localhost:Port),
+    tcp_listen(Socket, 5),
+    thread_create(server_loop(SSL, Socket), _, []).
+
+server_loop(SSL, Server) :-
+    tcp_accept(Server, Socket, Peer),
+    debug(connection, 'Connection from ~p', [Peer]),
+    setup_call_cleanup(tcp_open_socket(Socket, Read, Write),
+                       handle_client(SSL, Read, Write),
+                       tcp_close_socket(Socket)),
+    server_loop(SSL, Server).
+
+handle_client(SSL, Read, Write) :-
+    catch(ssl_negotiate(SSL, Read, Write, SSLRead, SSLWrite),
+          Exception,
+          true),
+    (   nonvar(Exception)
+    ->  format("Exception during negotation: ~w~n", [Exception])
+    ;   copy_client(SSLRead, SSLWrite),
+        call_cleanup(close(SSLRead), close(SSLWrite))
+    ).
+
+copy_client(In, Out) :-
+    read_line_to_codes(In, Line),
+    (   Line == end_of_file
+    ->  true
+    ;   format('Got ~s~n', [Line]),
+        format(Out, '~s~n', [Line]),
+        flush_output(Out),
+        copy_client(In, Out)
+    ).
+
+get_server_pwd(_SSL, apenoot1) :-
+    format('Returning password from server passwd hook~n').
+
+get_cert_verify(_SSL, Certificate, _AllCerts, _FirstCert, Error) :-
+    format('Handling detailed certificate verification~n'),
+    format('Certificate: ~w, error: ~w~n', [Certificate, Error]),
+    format('Server accepts the client certificate~n').
+