Everything is on my files page as StuffIt archives.

• Dial: the TCP library itself with finger, HTTPS and Gemini examples
• BearSSL: the TLS and crypto library, built from git 7bea48e with a tiny patch to make it C89 friendly
• Certificates: loads cacert.pem root certificates at run time so BearSSL can check who it's talking to
• cJSON: a JSON parser which compiled as-is, nice surprise

Pick what you need but BearSSL is mandatory for now even if you don't intend to use TLS.

I wanted the API to stay small and easy to grasp. Here is a complete finger client for example:

#include <stdio.h>
#include "Dial.h"

int main(void)
{
        DialConn *conn;
        char buf[512];
        long n;

        Dial_Init();
        if(Dial_Open("typed-hole.org", 79, 15, &conn) == noErr) {
                Dial_SendString(conn, "julien" kDialCRLF);
                while((n = Dial_Receive(conn, buf, sizeof(buf) - 1)) > 0) {
                        buf[n] = '\0';
                        printf("%s", buf);
                }
                Dial_Close(conn);
        }
        Dial_Shutdown();
        return 0;
}

Pretty straightforward I'd say.

Note the kDialCRLF, by default CodeWarrior maps \n to CR and \r to LF (classic Mac convention apparently) so writing "\r\n" sends LF CR instead of CR LF. kDialCRLF spells out the bytes so it's always correct.

For TLS you load the root certificates once and open the connection with Dial_OpenTLS instead. kDialVerifyCert means the server's certificate has to be signed by one of the roots.

Certificates_Load("cacert.pem");
Dial_Init();
Dial_OpenTLS("lobste.rs", 443, 30, kDialVerifyCert, &conn);
Dial_SendString(conn, "GET /newest.json HTTP/1.0" kDialCRLF
                      "Host: lobste.rs" kDialCRLF kDialCRLF);
total = Dial_ReceiveAll(conn, &response);

Dial_ReceiveAll reads until the server closes and gives you back a buffer that grows as needed, just free() it when done. Add cJSON et voilà the latest lobste.rs stories in a SIOUX window.

The roots come from curl's copy of Mozilla's list. Updating them is just downloading a new cacert.pem (WebOne helps here) and dropping it next to the app, no recompiling needed. Loading the 118 roots takes less than a second on my G4.

Most Gemini capsules use self-signed certificates and the protocol recommends "trust on first use" instead of CAs. That's what kDialAnyCert is for, the host name is still checked but not who signed the certificate nor its dates.

Dial_OpenTLS("9til.de", 1965, 30, kDialAnyCert, &conn);
Dial_SendString(conn, "gemini://9til.de/" kDialCRLF);
total = Dial_ReceiveAll(conn, &response);

A Gemini request is just the URL and the answer is a status line like 20 text/gemini followed by the page. Simple enough for the G4 :p

• Calls block until they are done.
• A TLS handshake takes a second on my G4 and doesn't yield while computing.
• OS 9 has no secure random number source so the TLS keys are seeded from the clock. Fine for reading stuff but I wouldn't send secrets with it yet.
• If every lookup fails after 10 seconds with -3162 check your DNS server. Mine wasn't answering plain UDP DNS, only DNS over TLS so nothing to do with my code but I spent a good while staring at it.

The crypto is all BearSSL, the tricky part was the Mac glue around it: converting the Mac's local time since 1904 into the GMT date BearSSL wants and finding something random enough to seed it with and setting up certificates checks.

• BearSSL's client example, Dial's TLS works the same way but on top of Open Transport
• BearSSL's API docs and headers, mostly bearssl_ssl.h and bearssl_x509.h
• tools/certs.c from BearSSL's brssl tool, used as-is to load cacert.pem and accept self-signed certificates
• Apple's Technote 1064 and Inside Macintosh for the Mac clock and time zone

Other classic Mac TLS projects worth a look: macTLS, Certainly, ssheven and Crypto Ancienne. Also macTLS has a plan to implement randomness properly.

That's it for Dial, now onto the more interesting part, creating cool apps with it like TurboCastor since castor9 is already a thing :)