Added test suite that depends on openconnect.

tests/Makefile.am

@@ -0,0 +1,6 @@
+EXTRA_DIST = ca-key.pem ca.pem common.sh server-cert.pem server-key.pem test1.config \
+	test1.passwd test2.config user-cert.pem user-key.pem
+
+dist_check_SCRIPTS = test1 test2
+
+TESTS = test1 test2

tests/ca-key.pem

@@ -0,0 +1,55 @@
+
+-----BEGIN RSA PRIVATE KEY-----
+MIIFfgIBAAKCATEAtGsnmCWvwf8eyrB+9Ni87UOGZ1Rd2rQewpBfgzwCEfwTcoWy
+iKRlQQt2XyO+ip/+eUtzOy7HSzy/FsmXVTUX86FySzDC4CeUEvNWAObOgksRXaQe
+m/r6uRsqTRi1uqXmDMeoqKFtqoiE3JYOsmwcNarnx5Q9+dXHwqINS7NuevcIX8UJ
+zRWTGveY3ypMZokk7R/QFmOBZaVYO6HNJWKbmYFUCBcY7HwvCKI7KFcynRdHCob7
+YrFBmeb73qjqIH7zG+666pohZCmS8q1z5RkFnTdT4hGfGF8iuuKLDQCMni+nhz1A
+vkqipZIIDC5hwFh8mpnh1qyDOSXPPhvt66NtncvFON7Bx26bNBS+MD6CkB65Spp2
+5O8zDEaiMXL2w2EL+KpnifSl5XY3oSmfgHmqdQIDAQABAoIBMQCAiid3esIx0PW7
+KuwIvbI8yHMlgzIq81FHBV1HPqWq8pFYcnC0cYvCP8xiFDFYyoyfFmZOsBFFRU5P
+iejLyDv8U/X+JAtzcD9LERshIU/X/Guu75LvRm0DHJuSuhwfkrrIOCetnPVpHkKq
+di6aZ/PhOJZR1wggy3K69IHMgVYhPYc11EgbWVepSuYbeSNdmjA40QWMLfCu3V65
+SwpX0+LnFVc1eJmFrE5wYNe0pomce4J3FWsn8Yu3G5EumWV50KOGKSLklSd+pTdu
+VSxwQMRQn9oKBx3zgyr16PlhJkR4+Q+PA4WIN/IYIUV9SxfsMaij7wgLpxXLxJdM
+3gvxi36pv/Pkax6IdNKRXss4dzd8LBUy3uUKu23TxTCkDrW04MPrN7rRqlh1jvBw
+6KihBoEBAoGZAO02FxxbPPTRVFxjFHgV6EFSSvhPeEkRagoV9o6fn1N3kWTS08fl
+xKO1NDtFYCoZSnbRdgomrMinsYIukrLUQu1TKMrhJ1RDyZfRtfZT429k9iptXq87
+5hVtirC+QoePF+SYwenwvKO7qapODb8COagg6ds1lySj5IuzqVYFV68yyZUP+Flp
+MHn0YFWJF42UV6sSvuGqfuYlAoGZAMK1e+7cRZFnp/zIbgeYG8Ss+vQKgpeuyDJv
+qclkD7HztouQgCw791vMgaXW9y+Rgdkced7eheqI8RGenHbKGifNVQD3Mbl8mkEN
+pu8eVqbOX758fHZz0Iaum3ZWrkSihNpuUcl4dZRz5NfOdxPmltrJCI+7uHOMztzH
+oMu6gQhh+F3lSDUpHdvhWvIshZQu9EbyxFfNyDoRAoGZAILZPoBW19YYDlf0E5t2
+QiqeMVqtw6VSpNKxcNMVu/Z300zxev8egIzpbMlxKG2wi8HlIx7QXKlGz4UHGcbp
+jY2KPMtEzcQOrIpBlQUvGxscbynSMNOqz+1sAoAiQ2KxjTV9CiJ4uCX9Y8bczXpa
+yOE0Xqub8Sa1/WEOls8rnUW4VzgRmiX//0yWf/lO6R4hAQcODRtASEW9AoGZAJ6/
+ixkXfJztr3gZDiSg7tru0fjQ7OKwvUbp5btuGqHS+51UpjvqdGXjGj1VQ9oDv6N9
+ZRvBv9uV5T6hXB457xNOhSSxZlg98CJj+BvzV2DO2B8drfiBup1klRnp2FHbU4gn
+9ATYcr0jtIwDKPEPyyT8TT+rJNsJDcvR8xbHq9Zi0jXz72hwaojQdu8GP66ujbme
+y1hvTfWRAoGZALNT3AbF9EDnJmZlS30MWtBggw83UhszC8XN2tY30AsvsDOS6a0F
+/aQ45EKyCvnqtsCOmB6giDsKRaVncp6lIHSH4kHKT7UvlKadWDW5CNWGR3puoHLk
+UVhyNvBTKo6lPqXqUsVxp16TKeeQKF+DuYuuNZN3pXXsHTiHkRMDCRVEqz7UnZEc
+/Bq/Kh2aOkelkX2S27QzTZGL
+-----END RSA PRIVATE KEY-----
+-----BEGIN CERTIFICATE-----
+MIIDtDCCAmygAwIBAgIETeC0yjANBgkqhkiG9w0BAQsFADAZMRcwFQYDVQQDEw5H
+bnVUTFMgVGVzdCBDQTAeFw0xMTA1MjgwODM5MzlaFw0zODEwMTIwODM5NDBaMC8x
+LTArBgNVBAMTJEdudVRMUyBUZXN0IFNlcnZlciAoUlNBIGNlcnRpZmljYXRlKTCC
+AVIwDQYJKoZIhvcNAQEBBQADggE/ADCCAToCggExALRrJ5glr8H/HsqwfvTYvO1D
+hmdUXdq0HsKQX4M8AhH8E3KFsoikZUELdl8jvoqf/nlLczsux0s8vxbJl1U1F/Oh
+ckswwuAnlBLzVgDmzoJLEV2kHpv6+rkbKk0Ytbql5gzHqKihbaqIhNyWDrJsHDWq
+58eUPfnVx8KiDUuzbnr3CF/FCc0Vkxr3mN8qTGaJJO0f0BZjgWWlWDuhzSVim5mB
+VAgXGOx8LwiiOyhXMp0XRwqG+2KxQZnm+96o6iB+8xvuuuqaIWQpkvKtc+UZBZ03
+U+IRnxhfIrriiw0AjJ4vp4c9QL5KoqWSCAwuYcBYfJqZ4dasgzklzz4b7eujbZ3L
+xTjewcdumzQUvjA+gpAeuUqaduTvMwxGojFy9sNhC/iqZ4n0peV2N6Epn4B5qnUC
+AwEAAaOBjTCBijAMBgNVHRMBAf8EAjAAMBQGA1UdEQQNMAuCCWxvY2FsaG9zdDAT
+BgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHQ8BAf8EBQMDB6AAMB0GA1UdDgQWBBR2
+B1hM6rUp9S2ABoyDSoINCeyT3jAfBgNVHSMEGDAWgBRNVrdqAFjxZ5L0pnVVG45T
+AQPvzzANBgkqhkiG9w0BAQsFAAOCATEAdNWmTsh5uIfngyhOWwm7pK2+vgUMY8nH
+gMoMFHt0yuxuImcUMXu3LRS1dZSoCJACBpTFGi/Dg2U0qvOHQcEmc3OwNqHB90R3
+LG5jUSCtq/bYW7h/6Gd9KeWCgZczaHbQ9IPTjLH1dLswVPt+fXKB6Eh0ggSrGATE
+/wRZT/XgDCW8t4C+2+TmJ8ZEzvU87KAPQ9rUBS1+p3EUAR/FfMApApsEig1IZ+ZD
+5joaGBW7zh1H0B9mEKidRvD7yuRJyzAcvD25nT15NLW0QR3dEeXosLc720xxJl1h
+h8NJ7YOvn323mOjR9er4i4D6iJlXmJ8tvN9vakCankWvBzb7plFn2sfMQqICFpRc
+w075D8hdQxfpGffL2tEeKSgjyNHXS7x3dFhUpN3IQjUi2x4f2e/ZXg==
+-----END CERTIFICATE-----

tests/ca.pem

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDPzCCAfegAwIBAgIEUdguzDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD
+QTAiGA8yMDEzMDcwNjE0NTA1MloYDzIwMjMwNTE1MTQ1MDUyWjANMQswCQYDVQQD
+EwJDQTCCAVIwDQYJKoZIhvcNAQEBBQADggE/ADCCAToCggExALRrJ5glr8H/Hsqw
+fvTYvO1DhmdUXdq0HsKQX4M8AhH8E3KFsoikZUELdl8jvoqf/nlLczsux0s8vxbJ
+l1U1F/OhckswwuAnlBLzVgDmzoJLEV2kHpv6+rkbKk0Ytbql5gzHqKihbaqIhNyW
+DrJsHDWq58eUPfnVx8KiDUuzbnr3CF/FCc0Vkxr3mN8qTGaJJO0f0BZjgWWlWDuh
+zSVim5mBVAgXGOx8LwiiOyhXMp0XRwqG+2KxQZnm+96o6iB+8xvuuuqaIWQpkvKt
+c+UZBZ03U+IRnxhfIrriiw0AjJ4vp4c9QL5KoqWSCAwuYcBYfJqZ4dasgzklzz4b
+7eujbZ3LxTjewcdumzQUvjA+gpAeuUqaduTvMwxGojFy9sNhC/iqZ4n0peV2N6Ep
+n4B5qnUCAwEAAaNDMEEwDwYDVR0TAQH/BAUwAwEB/zAPBgNVHQ8BAf8EBQMDBwQA
+MB0GA1UdDgQWBBRIIzRTCokxOEpa6sq20qbezh0rGDANBgkqhkiG9w0BAQsFAAOC
+ATEAa1kdd8E1PkM06Isw0S/thEll0rAYsNHwSX17IDUWocTTQlmVXBXcvLqM04QT
+z7WNG4eushLhRpSn8LJQkf4RgvAxOMIjHM9troDbPVoec6k8fZrJ8jfXurOgoOVP
+g+hScT3VDvxgiOVwgXSe2XBryGDaviRuSOHlfy5GPVirLJLZwpcX6RpsHMX9rrZX
+ghvf8dwm4To9H5wT0Le2FnZRoLOTMmpr49bfKJqy/U7AUHaf4saSdkdEIaGOxkPk
+x+SFlr9TjavnJvL0TApkvfNZ1aOVHRHINgaFYHQJ4U0jQ/g7lPmD+UtZWnvSMNXH
+yct5cKOyP4j7Kla1sKPs+oamOQ7pR1Z/GwBxe48FvO7VDi7EkugLwlzoXC2G+4Jg
+fJbi9Ui2FmXEeKkX34f1ONNj9Q==
+-----END CERTIFICATE-----

tests/common.sh

@@ -0,0 +1,52 @@
+#!/bin/sh
+#
+# Copyright (C) 2011-2012 Free Software Foundation, Inc.
+#
+# This file is part of GnuTLS.
+#
+# The launch_server() function was contributed by Cedric Arbogast.
+#
+# This file is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This file is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this file; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+
+fail() {
+   PID=$1
+   shift;
+   echo "Failure: $1" >&2
+   kill $PID
+   exit 1
+}
+
+launch_server() {
+       PARENT=$1;
+       shift;
+       $SERV $* >/dev/null 2>&1 &
+       LOCALPID="$!";
+       trap "[ ! -z \"${LOCALPID}\" ] && kill ${LOCALPID};" 15
+       wait "${LOCALPID}"
+       LOCALRET="$?"
+       if [ "${LOCALRET}" != "0" ] && [ "${LOCALRET}" != "143" ] ; then
+               # Houston, we'v got a problem...
+               echo "Failed to launch the server !"
+               test -z "${PARENT}" || kill -10 ${PARENT}
+               exit 1
+       fi
+}
+
+wait_server() {
+	trap "kill $1" 1 15 2
+	sleep 2
+}
+
+trap "fail \"Failed to launch the server, aborting test... \"" 10 

tests/server-cert.pem

@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDkTCCAkmgAwIBAgIEUdgu8DANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD
+QTAiGA8yMDEzMDcwNjE0NTEyOVoYDzIwMjMwNTE1MTQ1MTI5WjAUMRIwEAYDVQQD
+Ewlsb2NhbGhvc3QwggFSMA0GCSqGSIb3DQEBAQUAA4IBPwAwggE6AoIBMQCnOivs
+PxSwLBn28W6QHb+OqfbpcIQJh/NQ81/DlFD6LGTWV4BY4Zb87tC9BBV+X3+lM/j8
+u5HvN3nDWtv4Ge0DryLW6Tcs6FPCt4srEfCkh5l54LrMmWbhFgkVlN5fTqoY0lnd
+YJx2X8WWldRjeL+8E7nFUcFStWrgi9AzgMFrjsL4pql97YAZRXcMoQXVjbRmzVLZ
+IVumQy7c+tl7Eqz8lx/xS/5Fx9tIRunqNS5jEUs8Nn5E6FvraAcy+eI0gXTGk759
+KNPYisSqAuFAmmt/XDTTvvOo6dpAseXqtR2/LjZJWOlXdiZ/yjHg5+RKQ5dt3dk5
+7lAIWER9egIOo/+GAkyek0ZJ5GWU6VxTsFcIl6oy3S7EtB0NCIM7hvhy32QrJ5ZU
+yNncTSf6qMVoedgdAgMBAAGjgY0wgYowDAYDVR0TAQH/BAIwADAUBgNVHREEDTAL
+gglsb2NhbGhvc3QwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDwYDVR0PAQH/BAUDAweg
+ADAdBgNVHQ4EFgQUqCVH9o9E1jUb72ys0de5boT536MwHwYDVR0jBBgwFoAUSCM0
+UwqJMThKWurKttKm3s4dKxgwDQYJKoZIhvcNAQELBQADggExAK7dBCSwM/OJw+6s
+9MJAb7Ygi9xhHSq30Hg3M7DaPC7J9rZB6+IAVb3poOZAtDDtyTqvXH7qY5UMjJC9
+GsFmHPI/OSk2xuJJpG+ZJaP54b7kzTtUD6UCHETsgBk2aNuqNhjXR2fYnR9QME0C
+zZWIDV+5DFEBI97ln30N6PcXvIxp7Rsac3qwzvwt3zL+23kTwgM+DoRPoPO0PHr/
+eQ9hvRU5wA2Vc47zhUXIFy1Jmx7Sf//pw0/wq46VUAjDZ5B09EoCpzBNvOD7P+cF
+FQQ7SId8h8OQ2uOWxT2baeJX0pVbVv+qwOOB1F0q3sjx0dZa/2rxOUZ3wnHG9j8j
+LZSUkZxGpPQffCSpSPma5RhYff8/BncdA8soT0dyEfXIX5V91IXnrlI8XZrADvJM
+zzJKdNg=
+-----END CERTIFICATE-----

tests/server-key.pem

@@ -0,0 +1,165 @@
+Public Key Info:
+	Public Key Algorithm: RSA
+	Key Security Level: Normal (2432 bits)
+
+modulus:
+	00:a7:3a:2b:ec:3f:14:b0:2c:19:f6:f1:6e:90:1d:
+	bf:8e:a9:f6:e9:70:84:09:87:f3:50:f3:5f:c3:94:
+	50:fa:2c:64:d6:57:80:58:e1:96:fc:ee:d0:bd:04:
+	15:7e:5f:7f:a5:33:f8:fc:bb:91:ef:37:79:c3:5a:
+	db:f8:19:ed:03:af:22:d6:e9:37:2c:e8:53:c2:b7:
+	8b:2b:11:f0:a4:87:99:79:e0:ba:cc:99:66:e1:16:
+	09:15:94:de:5f:4e:aa:18:d2:59:dd:60:9c:76:5f:
+	c5:96:95:d4:63:78:bf:bc:13:b9:c5:51:c1:52:b5:
+	6a:e0:8b:d0:33:80:c1:6b:8e:c2:f8:a6:a9:7d:ed:
+	80:19:45:77:0c:a1:05:d5:8d:b4:66:cd:52:d9:21:
+	5b:a6:43:2e:dc:fa:d9:7b:12:ac:fc:97:1f:f1:4b:
+	fe:45:c7:db:48:46:e9:ea:35:2e:63:11:4b:3c:36:
+	7e:44:e8:5b:eb:68:07:32:f9:e2:34:81:74:c6:93:
+	be:7d:28:d3:d8:8a:c4:aa:02:e1:40:9a:6b:7f:5c:
+	34:d3:be:f3:a8:e9:da:40:b1:e5:ea:b5:1d:bf:2e:
+	36:49:58:e9:57:76:26:7f:ca:31:e0:e7:e4:4a:43:
+	97:6d:dd:d9:39:ee:50:08:58:44:7d:7a:02:0e:a3:
+	ff:86:02:4c:9e:93:46:49:e4:65:94:e9:5c:53:b0:
+	57:08:97:aa:32:dd:2e:c4:b4:1d:0d:08:83:3b:86:
+	f8:72:df:64:2b:27:96:54:c8:d9:dc:4d:27:fa:a8:
+	c5:68:79:d8:1d:
+
+public exponent:
+	01:00:01:
+
+private exponent:
+	79:2b:86:6d:fd:5b:41:38:03:6c:52:8e:59:70:a4:
+	bf:7b:da:44:55:d9:e6:8a:12:bd:22:4b:ce:8c:66:
+	8c:8f:a4:55:47:3b:e1:ab:3c:5b:73:b3:de:71:da:
+	1d:22:97:7c:1e:07:99:21:54:61:f0:61:93:32:ff:
+	d6:6a:fa:b9:43:aa:cb:ec:5a:a5:78:86:50:bd:eb:
+	e2:3e:72:8e:d5:0e:59:28:84:52:02:09:70:a9:25:
+	d5:f4:73:98:bd:88:34:ca:1e:81:71:22:8e:07:61:
+	45:76:b5:59:8a:41:eb:c6:a3:42:1d:b6:25:f6:fc:
+	45:4e:29:83:58:15:4e:99:38:1f:31:ab:f8:6a:21:
+	fa:ad:c1:d0:6d:d0:ab:67:ad:43:1c:1d:9e:e5:33:
+	e2:68:f9:e2:fa:d8:9a:e7:36:e0:20:8c:25:4d:e9:
+	17:95:4b:71:38:df:18:71:cd:e0:a0:7f:b2:58:fe:
+	8b:c0:1c:d2:96:4a:17:14:bf:1c:3b:e8:b5:54:2b:
+	8d:47:50:a7:77:56:61:a8:e3:79:dd:70:88:5f:89:
+	a1:f8:78:0d:47:ef:32:98:c1:47:88:d8:33:ed:95:
+	10:90:7f:f1:57:cb:2b:18:c9:58:a1:de:ef:1c:70:
+	5a:58:3c:86:3d:96:17:ad:9c:fd:0b:eb:d8:33:a4:
+	5f:7f:db:97:c0:78:b4:94:56:56:0a:83:b3:d3:02:
+	c6:6f:08:dc:0d:22:8f:2a:4b:25:7a:34:97:8e:63:
+	49:8a:39:d1:c1:1e:9b:93:41:c5:9c:b6:50:9e:ff:
+	7a:37:e4:c1:
+
+prime1:
+	00:cb:13:4a:a3:8f:ad:5c:63:89:30:f3:3b:eb:25:
+	85:d9:6c:ad:6d:50:f8:03:00:d3:1e:e3:ae:ad:54:
+	7a:9b:21:1a:72:18:a6:54:e4:32:58:8d:66:37:65:
+	8c:f7:8f:37:65:ec:f8:ef:2e:a9:c1:78:bb:04:90:
+	aa:fe:0a:f2:7c:80:82:32:c7:db:ef:bc:10:c6:ff:
+	e0:d4:2e:b9:3a:0e:cc:29:28:81:b8:41:78:37:80:
+	69:39:5e:97:44:36:d6:cd:39:af:14:c2:df:f3:67:
+	b7:d4:a7:49:da:f4:d3:ee:14:10:e4:5c:3f:4a:62:
+	52:81:34:d0:8e:f3:7e:d4:42:0a:34:e2:f9:a7:bc:
+	03:f9:c0:48:e8:9b:7f:da:08:ec:db:82:fd:a2:aa:
+	0f:5d:71:
+
+prime2:
+	00:d2:cf:2d:81:00:28:43:76:b3:76:10:3f:04:57:
+	63:94:fa:bb:08:6a:a2:7d:99:4b:0f:ad:76:11:da:
+	5c:2a:2b:33:0a:05:0d:f8:51:9a:4d:b3:40:4b:53:
+	63:c8:c1:96:45:c7:42:35:cf:05:cf:8a:e2:aa:bd:
+	dc:96:c0:fd:c8:c4:dc:4c:0b:1f:43:74:04:cf:13:
+	f5:fa:ea:b6:0d:82:92:8c:03:bd:e9:7b:b1:f2:d0:
+	df:fd:c5:1b:6e:66:b7:ce:f6:12:65:34:c8:15:01:
+	da:36:5e:f9:d8:ad:37:86:52:2b:ea:9f:f5:75:6b:
+	91:b3:01:6f:52:e9:e9:07:16:db:ba:65:e2:49:cc:
+	4f:70:11:39:5c:fa:d2:da:d4:0c:24:17:c4:68:6f:
+	d4:7f:6d:
+
+coefficient:
+	3b:96:f2:06:96:22:14:a2:fe:27:09:2f:43:b0:22:
+	a6:f4:ae:33:c2:f8:be:d5:03:96:7d:4a:d1:eb:7b:
+	9d:51:bd:77:1d:3f:79:ef:62:1d:c3:e9:c2:9a:53:
+	df:ec:33:9b:32:36:f6:e7:40:e8:6c:1b:16:3d:4e:
+	94:97:94:02:5d:cc:23:45:6b:53:8d:b8:7c:0e:24:
+	f9:5c:30:e4:e3:76:5b:f6:1f:74:3d:ca:e7:ef:a0:
+	1e:d3:c8:a2:54:d2:db:06:4b:0d:b0:b9:64:ca:dd:
+	68:44:51:d6:07:c5:ac:5b:e7:11:4b:76:b0:78:ba:
+	aa:b1:af:06:64:0d:27:1a:85:2d:a8:5a:c1:d7:c1:
+	2e:f6:ef:fe:f6:0d:d6:f1:18:fc:0b:14:b1:d7:76:
+	51:1b:
+
+exp1:
+	76:ce:d4:8e:18:92:ee:48:75:8d:23:e0:dc:53:d9:
+	99:38:d1:c5:f0:e7:08:aa:c4:d9:7f:8f:44:6c:f6:
+	46:27:f9:d6:e2:c0:fd:4d:7c:7e:fe:4a:dd:02:16:
+	95:07:3e:fb:ec:c6:3e:f8:e7:eb:fe:fc:3b:51:80:
+	18:9c:c2:fd:40:19:ec:27:ad:6e:f6:72:42:5a:95:
+	68:cd:e5:24:28:60:1d:7c:4b:58:47:45:54:03:56:
+	8c:6f:e0:c3:d1:e9:9d:ab:af:d8:cf:a2:42:3f:5d:
+	f7:95:df:c9:b0:0f:05:6c:cb:ed:2e:63:00:db:c1:
+	35:42:76:fa:0b:4f:1a:53:80:b1:2c:51:af:66:7a:
+	54:f5:c0:32:06:37:a8:92:2c:30:c8:d4:27:04:a3:
+	74:a1:
+
+exp2:
+	18:07:41:5a:88:d8:0e:08:83:a0:1b:6d:f3:62:ba:
+	99:0a:93:32:fc:64:95:08:5a:03:e9:73:a1:c9:4f:
+	e4:06:94:84:b9:da:c3:c9:19:5b:6d:e9:10:2c:eb:
+	1c:c0:e4:0e:04:0e:49:ef:d4:eb:b9:1a:e8:f7:47:
+	23:6f:cf:fd:88:62:cb:d0:20:ba:21:89:42:c9:35:
+	aa:6a:02:62:3b:d5:d4:5b:c0:d3:d2:23:90:57:ba:
+	90:44:5d:42:12:37:35:41:db:0a:ea:1f:3c:35:bf:
+	d7:9e:af:bf:c0:ce:a9:62:c8:5a:af:ec:dc:7b:6c:
+	5a:08:f9:d5:6b:90:02:1c:da:e2:be:26:32:df:34:
+	d6:c3:3f:d4:97:4a:5d:62:fa:17:4b:16:3a:09:35:
+	21:69:
+
+
+Public Key ID: A8:25:47:F6:8F:44:D6:35:1B:EF:6C:AC:D1:D7:B9:6E:84:F9:DF:A3
+Public key's random art:
++--[ RSA 2432]----+
+|            +    |
+|         . . =   |
+|      o o . . .  |
+|     o =     =  o|
+|    . + S   . O.o|
+|     = . o   * o.|
+|    .   . . . o. |
+|              .+.|
+|             Eo.=|
++-----------------+
+
+-----BEGIN RSA PRIVATE KEY-----
+MIIFegIBAAKCATEApzor7D8UsCwZ9vFukB2/jqn26XCECYfzUPNfw5RQ+ixk1leA
+WOGW/O7QvQQVfl9/pTP4/LuR7zd5w1rb+BntA68i1uk3LOhTwreLKxHwpIeZeeC6
+zJlm4RYJFZTeX06qGNJZ3WCcdl/FlpXUY3i/vBO5xVHBUrVq4IvQM4DBa47C+Kap
+fe2AGUV3DKEF1Y20Zs1S2SFbpkMu3PrZexKs/Jcf8Uv+RcfbSEbp6jUuYxFLPDZ+
+ROhb62gHMvniNIF0xpO+fSjT2IrEqgLhQJprf1w0077zqOnaQLHl6rUdvy42SVjp
+V3Ymf8ox4OfkSkOXbd3ZOe5QCFhEfXoCDqP/hgJMnpNGSeRllOlcU7BXCJeqMt0u
+xLQdDQiDO4b4ct9kKyeWVMjZ3E0n+qjFaHnYHQIDAQABAoIBMHkrhm39W0E4A2xS
+jllwpL972kRV2eaKEr0iS86MZoyPpFVHO+GrPFtzs95x2h0il3weB5khVGHwYZMy
+/9Zq+rlDqsvsWqV4hlC96+I+co7VDlkohFICCXCpJdX0c5i9iDTKHoFxIo4HYUV2
+tVmKQevGo0IdtiX2/EVOKYNYFU6ZOB8xq/hqIfqtwdBt0KtnrUMcHZ7lM+Jo+eL6
+2JrnNuAgjCVN6ReVS3E43xhxzeCgf7JY/ovAHNKWShcUvxw76LVUK41HUKd3VmGo
+43ndcIhfiaH4eA1H7zKYwUeI2DPtlRCQf/FXyysYyVih3u8ccFpYPIY9lhetnP0L
+69gzpF9/25fAeLSUVlYKg7PTAsZvCNwNIo8qSyV6NJeOY0mKOdHBHpuTQcWctlCe
+/3o35MECgZkAyxNKo4+tXGOJMPM76yWF2WytbVD4AwDTHuOurVR6myEachimVOQy
+WI1mN2WM9483Zez47y6pwXi7BJCq/gryfICCMsfb77wQxv/g1C65Og7MKSiBuEF4
+N4BpOV6XRDbWzTmvFMLf82e31KdJ2vTT7hQQ5Fw/SmJSgTTQjvN+1EIKNOL5p7wD
++cBI6Jt/2gjs24L9oqoPXXECgZkA0s8tgQAoQ3azdhA/BFdjlPq7CGqifZlLD612
+EdpcKiszCgUN+FGaTbNAS1NjyMGWRcdCNc8Fz4riqr3clsD9yMTcTAsfQ3QEzxP1
++uq2DYKSjAO96Xux8tDf/cUbbma3zvYSZTTIFQHaNl752K03hlIr6p/1dWuRswFv
+UunpBxbbumXiScxPcBE5XPrS2tQMJBfEaG/Uf20CgZh2ztSOGJLuSHWNI+DcU9mZ
+ONHF8OcIqsTZf49EbPZGJ/nW4sD9TXx+/krdAhaVBz777MY++Ofr/vw7UYAYnML9
+QBnsJ61u9nJCWpVozeUkKGAdfEtYR0VUA1aMb+DD0emdq6/Yz6JCP133ld/JsA8F
+bMvtLmMA28E1Qnb6C08aU4CxLFGvZnpU9cAyBjeokiwwyNQnBKN0oQKBmBgHQVqI
+2A4Ig6AbbfNiupkKkzL8ZJUIWgPpc6HJT+QGlIS52sPJGVtt6RAs6xzA5A4EDknv
+1Ou5Guj3RyNvz/2IYsvQILohiULJNapqAmI71dRbwNPSI5BXupBEXUISNzVB2wrq
+Hzw1v9eer7/AzqliyFqv7Nx7bFoI+dVrkAIc2uK+JjLfNNbDP9SXSl1i+hdLFjoJ
+NSFpAoGYO5byBpYiFKL+JwkvQ7AipvSuM8L4vtUDln1K0et7nVG9dx0/ee9iHcPp
+wppT3+wzmzI29udA6GwbFj1OlJeUAl3MI0VrU424fA4k+Vww5ON2W/YfdD3K5++g
+HtPIolTS2wZLDbC5ZMrdaERR1gfFrFvnEUt2sHi6qrGvBmQNJxqFLahawdfBLvbv
+/vYN1vEY/AsUsdd2URs=
+-----END RSA PRIVATE KEY-----

tests/test1

@@ -0,0 +1,56 @@
+#!/bin/sh
+#
+# Copyright (C) 2013 Nikos Mavrogiannopoulos
+#
+# This file is part of GnuTLS.
+#
+# GnuTLS is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by the
+# Free Software Foundation; either version 3 of the License, or (at
+# your option) any later version.
+#
+# GnuTLS is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with GnuTLS; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+
+SERV="${SERV:-../src/ocserv}"
+
+#this test can only be run as root
+id|grep root >/dev/null 2>&1
+if [ $? != 0 ];then
+	exit 77
+fi
+
+if ! test -x /usr/sbin/openconnect;then
+	echo "You need openconnect to run this test"
+	exit 77
+fi
+
+. ./common.sh
+
+echo "Testing local backend with username-password..."
+
+launch_server -d -f -c test1.config & PID=$!
+wait_server $PID
+
+echo "Connecting to obtain cookie..."
+( echo "test" | openconnect -q localhost:4443 -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) ||
+	fail $PID "Could not receive cookie from server"
+
+echo "Connecting to obtain cookie with wrong password..."
+( echo "tost" | openconnect -q localhost:4443 -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) &&
+	fail $PID "Received cookie when we shouldn't"
+
+#echo "Normal connection..."
+#( echo "test" | openconnect -q localhost:4443 -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true ) ||
+#	fail $PID "Could not connect to server"
+
+kill $PID
+wait
+
+exit 0

tests/test1.config

@@ -0,0 +1,183 @@
+# User authentication method. Could be set multiple times and in that case
+# all should succeed.
+# Options: certificate, pam. 
+#auth = "certificate"
+auth = "plain[./test1.passwd]"
+#auth = "pam"
+
+# A banner to be displayed on clients
+#banner = "Welcome"
+
+# Use listen-host to limit to specific IPs or to the IPs of a provided hostname.
+#listen-host = [IP|HOSTNAME]
+
+# Limit the number of clients. Unset or set to zero for unlimited.
+#max-clients = 1024
+max-clients = 16
+
+# Limit the number of client connections to one every X milliseconds 
+# (X is the provided value). Set to zero for no limit.
+#rate-limit-ms = 100
+
+# Limit the number of identical clients (i.e., users connecting multiple times)
+# Unset or set to zero for unlimited.
+max-same-clients = 2
+
+# TCP and UDP port number
+tcp-port = 4443
+udp-port = 4443
+
+# Keepalive in seconds
+keepalive = 32400
+
+# Dead peer detection in seconds
+dpd = 440
+
+# MTU discovery (DPD must be enabled)
+try-mtu-discovery = false
+
+# The key and the certificates of the server
+# The key may be a file, or any URL supported by GnuTLS (e.g., 
+# tpmkey:uuid=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx;storage=user
+# or pkcs11:object=my-vpn-key;object-type=private)
+#
+# There may be multiple certificate and key pairs and each key
+# should correspond to the preceding certificate.
+server-cert = ./server-cert.pem
+server-key = ./server-key.pem
+
+# Diffie-Hellman parameters. Only needed if you require support
+# for the DHE ciphersuites (by default this server supports ECDHE).
+# Can be generated using:
+# certtool --generate-dh-params --outfile /path/to/dh.pem
+#dh-params = /path/to/dh.pem
+
+# If you have a certificate from a CA that provides an OCSP
+# service you may provide a fresh OCSP status response within
+# the TLS handshake. That will prevent the client from connecting
+# independently on the OCSP server.
+# You can update this response periodically using:
+# ocsptool --ask --load-cert=your_cert --load-issuer=your_ca --outfile response
+# Make sure that you replace the following file in an atomic way.
+#ocsp-response = /path/to/ocsp.der
+
+# In case PKCS #11 or TPM keys are used the PINs should be available
+# in files. The srk-pin-file is applicable to TPM keys only (It's the storage
+# root key).
+#pin-file = /path/to/pin.txt
+#srk-pin-file = /path/to/srkpin.txt
+
+# The Certificate Authority that will be used
+# to verify clients if certificate authentication
+# is set.
+#ca-cert = /path/to/ca.pem
+
+# The object identifier that will be used to read the user ID in the client certificate.
+# The object identifier should be part of the certificate's DN
+# Useful OIDs are: 
+#  CN = 2.5.4.3, UID = 0.9.2342.19200300.100.1.1
+#cert-user-oid = 0.9.2342.19200300.100.1.1
+
+# The object identifier that will be used to read the user group in the client 
+# certificate. The object identifier should be part of the certificate's DN
+# Useful OIDs are: 
+#  OU (organizational unit) = 2.5.4.11 
+#cert-group-oid = 2.5.4.11
+
+# A revocation list of ca-cert is set
+#crl = /path/to/crl.pem
+
+# GnuTLS priority string
+tls-priorities = "PERFORMANCE:%SERVER_PRECEDENCE:%COMPAT"
+
+# To enforce perfect forward secrecy (PFS) on the main channel.
+#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA"
+
+# The time (in seconds) that a client is allowed to stay connected prior
+# to authentication
+auth-timeout = 40
+
+# The time (in seconds) that a client is not allowed to reconnect after 
+# a failed authentication attempt.
+#min-reauth-time = 2
+
+# Cookie validity time (in seconds)
+# Once a client is authenticated he's provided a cookie with
+# which he can reconnect. This option sets the maximum lifetime
+# of that cookie.
+cookie-validity = 172800
+
+# Script to call when a client connects and obtains an IP
+# Parameters are passed on the environment.
+# REASON, USERNAME, GROUPNAME, HOSTNAME (the hostname selected by client), 
+# DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP
+# in the P-t-P connection), IP_REMOTE (the VPN IP of the client). REASON
+# may be "connect" or "disconnect".
+#connect-script = /usr/bin/myscript
+#disconnect-script = /usr/bin/myscript
+
+# UTMP
+use-utmp = true
+
+# PID file
+pid-file = /var/run/ocserv.pid
+
+# The default server directory. Does not require any devices present.
+#chroot-dir = /path/to/chroot
+
+# socket file used for IPC, will be appended with .PID
+# It must be accessible within the chroot environment (if any)
+socket-file = /var/run/ocserv-socket
+
+# The user the worker processes will be run as. It should be
+# unique (no other services run as this user).
+run-as-user = nobody
+run-as-group = nogroup
+
+# Network settings
+
+device = vpns
+
+# The default domain to be advertised
+default-domain = example.com
+
+ipv4-network = 192.168.1.0
+ipv4-netmask = 255.255.255.0
+# Use the keywork local to advertize the local P-t-P address as DNS server
+# ipv4-dns = 192.168.2.1
+ipv4-dns = local
+
+# The NBNS server (if any)
+#ipv4-nbns = 192.168.2.3
+
+#ipv6-address = 
+#ipv6-mask = 
+#ipv6-dns = 
+
+# Prior to leasing any IP from the pool ping it to verify that
+# it is not in use by another (unrelated to this server) host.
+ping-leases = false
+
+# Leave empty to assign the default MTU of the device
+# mtu = 
+
+route = 192.168.1.0/255.255.255.0
+#route = 192.168.5.0/255.255.255.0
+
+#
+# The following options are for (experimental) AnyConnect client 
+# compatibility. They are only available if the server is built 
+# with --enable-anyconnect
+#
+
+# Client profile xml. A sample file exists in doc/profile.xml.
+# This file must be accessible from inside the worker's chroot. 
+# The profile is ignored by the openconnect client.
+#user-profile = profile.xml
+
+# Unless set to false it is required for clients to present their
+# certificate even if they are authenticating via a previously granted
+# cookie. Legacy CISCO clients do not do that, and thus this option
+# should be set for them.
+#always-require-cert = false
+

tests/test1.passwd

@@ -0,0 +1 @@
+test:tost:$5$i6SNmLDCgBNjyJ7q$SZ4bVJb7I/DLgXo3txHBVohRFBjOtdbxGQZp.DOnrA.

tests/test2

@@ -0,0 +1,61 @@
+#!/bin/sh
+#
+# Copyright (C) 2013 Nikos Mavrogiannopoulos
+#
+# This file is part of GnuTLS.
+#
+# GnuTLS is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by the
+# Free Software Foundation; either version 3 of the License, or (at
+# your option) any later version.
+#
+# GnuTLS is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with GnuTLS; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+
+SERV="${SERV:-../src/ocserv}"
+
+#this test can only be run as root
+id|grep root >/dev/null 2>&1
+if [ $? != 0 ];then
+	exit 77
+fi
+
+if ! test -x /usr/sbin/openconnect;then
+	echo "You need openconnect to run this test"
+	exit 77
+fi
+
+. ./common.sh
+
+echo "Testing local backend with username-password and certificate..."
+
+launch_server -d -f -c test2.config & PID=$!
+wait_server $PID
+
+echo -n "Connecting to obtain cookie (without certificate)..."
+( echo "test" | openconnect -q localhost:4443 -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) &&
+	fail $PID "Connected without certificate!"
+
+echo ok
+
+echo -n "Connecting to obtain cookie (with certificate)..."
+( echo "test" | openconnect -q localhost:4443 --sslkey ./user-key.pem -c ./user-cert.pem -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --cookieonly >/dev/null 2>&1 ) ||
+	fail $PID "Could not connect with certificate!"
+
+echo ok
+
+
+#echo "Normal connection..."
+#( echo "test" | openconnect -q localhost:4443 -u test --servercert=d66b507ae074d03b02eafca40d35f87dd81049d3 --script=/bin/true ) ||
+#	fail $PID "Could not connect to server"
+
+kill $PID
+wait
+
+exit 0

tests/test2.config

@@ -0,0 +1,183 @@
+# User authentication method. Could be set multiple times and in that case
+# all should succeed.
+# Options: certificate, pam. 
+auth = "certificate"
+auth = "plain[./test1.passwd]"
+#auth = "pam"
+
+# A banner to be displayed on clients
+#banner = "Welcome"
+
+# Use listen-host to limit to specific IPs or to the IPs of a provided hostname.
+#listen-host = [IP|HOSTNAME]
+
+# Limit the number of clients. Unset or set to zero for unlimited.
+#max-clients = 1024
+max-clients = 16
+
+# Limit the number of client connections to one every X milliseconds 
+# (X is the provided value). Set to zero for no limit.
+#rate-limit-ms = 100
+
+# Limit the number of identical clients (i.e., users connecting multiple times)
+# Unset or set to zero for unlimited.
+max-same-clients = 2
+
+# TCP and UDP port number
+tcp-port = 4443
+udp-port = 4443
+
+# Keepalive in seconds
+keepalive = 32400
+
+# Dead peer detection in seconds
+dpd = 440
+
+# MTU discovery (DPD must be enabled)
+try-mtu-discovery = false
+
+# The key and the certificates of the server
+# The key may be a file, or any URL supported by GnuTLS (e.g., 
+# tpmkey:uuid=xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx;storage=user
+# or pkcs11:object=my-vpn-key;object-type=private)
+#
+# There may be multiple certificate and key pairs and each key
+# should correspond to the preceding certificate.
+server-cert = ./server-cert.pem
+server-key = ./server-key.pem
+
+# Diffie-Hellman parameters. Only needed if you require support
+# for the DHE ciphersuites (by default this server supports ECDHE).
+# Can be generated using:
+# certtool --generate-dh-params --outfile /path/to/dh.pem
+#dh-params = /path/to/dh.pem
+
+# If you have a certificate from a CA that provides an OCSP
+# service you may provide a fresh OCSP status response within
+# the TLS handshake. That will prevent the client from connecting
+# independently on the OCSP server.
+# You can update this response periodically using:
+# ocsptool --ask --load-cert=your_cert --load-issuer=your_ca --outfile response
+# Make sure that you replace the following file in an atomic way.
+#ocsp-response = /path/to/ocsp.der
+
+# In case PKCS #11 or TPM keys are used the PINs should be available
+# in files. The srk-pin-file is applicable to TPM keys only (It's the storage
+# root key).
+#pin-file = /path/to/pin.txt
+#srk-pin-file = /path/to/srkpin.txt
+
+# The Certificate Authority that will be used
+# to verify clients if certificate authentication
+# is set.
+ca-cert = ./ca.pem
+
+# The object identifier that will be used to read the user ID in the client certificate.
+# The object identifier should be part of the certificate's DN
+# Useful OIDs are: 
+#  CN = 2.5.4.3, UID = 0.9.2342.19200300.100.1.1
+cert-user-oid = 0.9.2342.19200300.100.1.1
+
+# The object identifier that will be used to read the user group in the client 
+# certificate. The object identifier should be part of the certificate's DN
+# Useful OIDs are: 
+#  OU (organizational unit) = 2.5.4.11 
+#cert-group-oid = 2.5.4.11
+
+# A revocation list of ca-cert is set
+#crl = /path/to/crl.pem
+
+# GnuTLS priority string
+tls-priorities = "PERFORMANCE:%SERVER_PRECEDENCE:%COMPAT"
+
+# To enforce perfect forward secrecy (PFS) on the main channel.
+#tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-RSA"
+
+# The time (in seconds) that a client is allowed to stay connected prior
+# to authentication
+auth-timeout = 40
+
+# The time (in seconds) that a client is not allowed to reconnect after 
+# a failed authentication attempt.
+#min-reauth-time = 2
+
+# Cookie validity time (in seconds)
+# Once a client is authenticated he's provided a cookie with
+# which he can reconnect. This option sets the maximum lifetime
+# of that cookie.
+cookie-validity = 172800
+
+# Script to call when a client connects and obtains an IP
+# Parameters are passed on the environment.
+# REASON, USERNAME, GROUPNAME, HOSTNAME (the hostname selected by client), 
+# DEVICE, IP_REAL (the real IP of the client), IP_LOCAL (the local IP
+# in the P-t-P connection), IP_REMOTE (the VPN IP of the client). REASON
+# may be "connect" or "disconnect".
+#connect-script = /usr/bin/myscript
+#disconnect-script = /usr/bin/myscript
+
+# UTMP
+use-utmp = true
+
+# PID file
+pid-file = /var/run/ocserv.pid
+
+# The default server directory. Does not require any devices present.
+#chroot-dir = /path/to/chroot
+
+# socket file used for IPC, will be appended with .PID
+# It must be accessible within the chroot environment (if any)
+socket-file = /var/run/ocserv-socket
+
+# The user the worker processes will be run as. It should be
+# unique (no other services run as this user).
+run-as-user = nobody
+run-as-group = nogroup
+
+# Network settings
+
+device = vpns
+
+# The default domain to be advertised
+default-domain = example.com
+
+ipv4-network = 192.168.1.0
+ipv4-netmask = 255.255.255.0
+# Use the keywork local to advertize the local P-t-P address as DNS server
+# ipv4-dns = 192.168.2.1
+ipv4-dns = local
+
+# The NBNS server (if any)
+#ipv4-nbns = 192.168.2.3
+
+#ipv6-address = 
+#ipv6-mask = 
+#ipv6-dns = 
+
+# Prior to leasing any IP from the pool ping it to verify that
+# it is not in use by another (unrelated to this server) host.
+ping-leases = false
+
+# Leave empty to assign the default MTU of the device
+# mtu = 
+
+route = 192.168.1.0/255.255.255.0
+#route = 192.168.5.0/255.255.255.0
+
+#
+# The following options are for (experimental) AnyConnect client 
+# compatibility. They are only available if the server is built 
+# with --enable-anyconnect
+#
+
+# Client profile xml. A sample file exists in doc/profile.xml.
+# This file must be accessible from inside the worker's chroot. 
+# The profile is ignored by the openconnect client.
+#user-profile = profile.xml
+
+# Unless set to false it is required for clients to present their
+# certificate even if they are authenticating via a previously granted
+# cookie. Legacy CISCO clients do not do that, and thus this option
+# should be set for them.
+#always-require-cert = false
+

tests/user-cert.pem

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDjDCCAkSgAwIBAgIEUdgvFDANBgkqhkiG9w0BAQsFADANMQswCQYDVQQDEwJD
+QTAiGA8yMDEzMDcwNjE0NTIwNVoYDzIwMjMwNTE1MTQ1MjA1WjAnMQ8wDQYDVQQD
+EwZBIHVzZXIxFDASBgoJkiaJk/IsZAEBEwR0ZXN0MIIBUjANBgkqhkiG9w0BAQEF
+AAOCAT8AMIIBOgKCATEAq1SY/KnGFZWdpsGUhJSReR542y1IUZllAQLAQFJJXetw
+vCbvaDkeBJHi28tvk0BFHiKOcVpYiSh5XhoyJT6LnTs0fxn40C83t2Iyt1OlQyzF
+Xeys+TX6FCs0ZvHWp6HQg5pW9BmDvL8RdDAtqChboqt6xs2cXPhR6akMSNtxu7E0
+d/fu3l14wEgKNw1lHjsrFAOJcvJS7V8AxQZg6oAg0EPsZrzSJtvwKT5q+WIgvlgm
+RLrXjG92pgUg5Ji3xHJ6Xd9PDSPsLpxx7DD5FF/IdQurZ/Z9+012ZEql1fq0CFCd
+E8ePwnmwtD4vidMzJ02fi9NgJAersnI9KaXESuw8BNJJPiYb7HoQPcpFWoCLTSqW
+Y08tYygPO0dHynwsFUEy1eDJvqVVLLNrRipWsRvtKQIDAQABo3YwdDAMBgNVHRMB
+Af8EAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMA8GA1UdDwEB/wQFAwMHoAAwHQYD
+VR0OBBYEFIsBCUs7kezjIbkd7I1rTF2eQIBeMB8GA1UdIwQYMBaAFEgjNFMKiTE4
+SlrqyrbSpt7OHSsYMA0GCSqGSIb3DQEBCwUAA4IBMQBrveOQ1xHPbA3jvfRhzVeD
+Qb4qkkbd+kRsYBzvPh4v4eJbRYhqHlAtjZbEx4B1WXtUa/uGsPFtRQnbSN4gCodg
+MF418FLEVUTB/+F8PdZtWMoc/b8EmpsQNQX80QE8r7tkMV5Zj+9vDTXlwAd3DjEg
+juMu8aZN8b6FW98ESJ2MycnBuOPi0ktVg+nYe3Evjon8TafxsL9Hm5fEhd3DPTgV
+NghzEIcI9uYcTimopfUkuA3p2bgZJx1zNf57gR9KgWqTzaJx12AOCO7qyCtEG+RF
+bP5EaNaGrYlPfp/5GiqXD2vrXW44s1sTueNKEDJb3Km0oU6z+U+R3rzMNpFEuuA0
+dPdotHsO207sKAMBzwpjxCN1C0tBneBos8u/tVw9UpMguuq48Iz3puzNo6pPKv8g
+-----END CERTIFICATE-----

tests/user-key.pem

@@ -0,0 +1,165 @@
+Public Key Info:
+	Public Key Algorithm: RSA
+	Key Security Level: Normal (2432 bits)
+
+modulus:
+	00:ab:54:98:fc:a9:c6:15:95:9d:a6:c1:94:84:94:
+	91:79:1e:78:db:2d:48:51:99:65:01:02:c0:40:52:
+	49:5d:eb:70:bc:26:ef:68:39:1e:04:91:e2:db:cb:
+	6f:93:40:45:1e:22:8e:71:5a:58:89:28:79:5e:1a:
+	32:25:3e:8b:9d:3b:34:7f:19:f8:d0:2f:37:b7:62:
+	32:b7:53:a5:43:2c:c5:5d:ec:ac:f9:35:fa:14:2b:
+	34:66:f1:d6:a7:a1:d0:83:9a:56:f4:19:83:bc:bf:
+	11:74:30:2d:a8:28:5b:a2:ab:7a:c6:cd:9c:5c:f8:
+	51:e9:a9:0c:48:db:71:bb:b1:34:77:f7:ee:de:5d:
+	78:c0:48:0a:37:0d:65:1e:3b:2b:14:03:89:72:f2:
+	52:ed:5f:00:c5:06:60:ea:80:20:d0:43:ec:66:bc:
+	d2:26:db:f0:29:3e:6a:f9:62:20:be:58:26:44:ba:
+	d7:8c:6f:76:a6:05:20:e4:98:b7:c4:72:7a:5d:df:
+	4f:0d:23:ec:2e:9c:71:ec:30:f9:14:5f:c8:75:0b:
+	ab:67:f6:7d:fb:4d:76:64:4a:a5:d5:fa:b4:08:50:
+	9d:13:c7:8f:c2:79:b0:b4:3e:2f:89:d3:33:27:4d:
+	9f:8b:d3:60:24:07:ab:b2:72:3d:29:a5:c4:4a:ec:
+	3c:04:d2:49:3e:26:1b:ec:7a:10:3d:ca:45:5a:80:
+	8b:4d:2a:96:63:4f:2d:63:28:0f:3b:47:47:ca:7c:
+	2c:15:41:32:d5:e0:c9:be:a5:55:2c:b3:6b:46:2a:
+	56:b1:1b:ed:29:
+
+public exponent:
+	01:00:01:
+
+private exponent:
+	5d:97:20:db:24:82:a8:57:ca:7e:c5:50:33:fc:54:
+	5b:2d:62:27:98:5c:e0:f6:42:4e:83:0a:32:18:c1:
+	2b:24:e9:b8:5e:2c:79:6a:7a:13:54:fd:ef:c2:f9:
+	78:1e:ab:a3:02:8d:7d:2e:35:1e:f7:95:14:ea:8a:
+	69:fd:f8:96:33:39:42:15:15:ed:e3:5d:34:37:d8:
+	2c:7c:ec:d1:fd:2a:f3:5b:ce:41:74:52:df:a1:9a:
+	46:81:e5:18:3d:34:82:2f:55:40:92:8f:7c:13:83:
+	9d:4c:94:24:3f:a7:8e:fc:cd:5c:bc:04:a6:64:9f:
+	9a:5c:55:f1:96:ae:52:31:42:d0:26:07:be:40:a1:
+	2d:a8:2c:ac:56:0c:de:ae:c3:a1:73:2d:2a:35:65:
+	47:74:b0:9b:70:b9:d8:ad:12:74:50:b3:00:fb:86:
+	72:d5:00:e8:02:b2:d1:e3:d5:87:3f:cc:b6:f3:26:
+	fe:25:c1:b5:59:bd:e0:c9:fa:d9:ba:47:f8:43:ea:
+	af:cf:4d:92:ae:db:9d:11:49:ec:50:33:2a:b6:44:
+	40:ac:06:c7:f6:64:2e:42:25:81:20:d5:f6:76:79:
+	b9:fb:bd:d2:c5:5d:f7:28:16:9d:cc:13:cd:d9:55:
+	e3:ca:c7:d2:38:f1:92:32:d6:ba:db:73:b6:dc:b6:
+	5f:66:89:e3:4c:9e:d6:b8:d2:01:ee:a8:d2:69:64:
+	dd:5c:1a:7e:4c:e4:1d:5b:37:94:29:3c:93:3d:43:
+	bb:33:8f:10:23:14:12:b0:33:24:58:c3:ae:97:4c:
+	3d:c5:c1:81:
+
+prime1:
+	00:c1:9c:0d:4e:aa:1b:2e:c4:14:e6:78:ed:0b:76:
+	90:af:da:3d:5e:15:6f:7d:9c:97:4d:71:a3:1d:6a:
+	47:94:25:20:9d:98:f4:d0:3b:d6:be:be:12:39:e7:
+	d7:82:3d:54:3d:f7:76:06:e2:ac:5d:e6:1f:34:fd:
+	bc:9d:9c:8b:f5:4f:83:89:8f:79:ea:9e:5e:a5:5c:
+	e9:b4:71:ae:59:43:ff:ec:03:f6:57:3c:d6:33:0b:
+	ba:4d:39:3f:90:62:b2:4f:af:e0:21:7a:5a:0f:93:
+	f4:fc:5f:ba:29:b9:af:67:18:3f:0e:23:3d:de:d9:
+	bc:47:ad:de:56:11:d1:e3:c0:7e:29:bb:67:ac:1b:
+	6a:af:5a:30:19:0c:14:49:af:db:1a:82:10:60:e1:
+	d1:98:dd:
+
+prime2:
+	00:e2:8a:9d:80:b5:29:33:06:44:d2:e3:77:bd:34:
+	3e:c0:df:98:cc:ab:f3:ba:73:3c:19:5c:d8:ed:c8:
+	22:bc:b9:8f:4f:1a:d8:0d:08:e2:e2:ca:e8:3c:13:
+	aa:23:1b:3d:75:d4:7c:e2:4e:cd:ca:d0:fc:b7:77:
+	70:57:54:e1:1c:22:a2:3e:0f:a7:59:c0:5a:4f:b1:
+	e8:62:55:85:07:7d:03:a4:8f:82:eb:2d:21:fc:cb:
+	d5:b7:3c:77:a5:9d:67:a6:ab:95:5d:1e:d3:a3:49:
+	78:9b:75:2c:07:e9:bd:ba:0f:66:69:7e:2e:50:2f:
+	76:5f:e9:28:f8:e1:c9:ce:77:4a:48:ee:92:d1:d5:
+	dc:29:2f:3f:29:7a:12:b0:d6:f9:8d:68:e4:82:45:
+	ec:3a:bd:
+
+coefficient:
+	00:82:d2:e4:3b:e3:aa:9e:99:75:0d:73:e4:e9:38:
+	f5:5e:73:e4:c2:3a:24:55:4e:ea:58:f7:2a:f2:0f:
+	ff:42:d7:e2:ef:49:d2:25:8d:86:02:a7:2b:c9:45:
+	1e:ee:a0:1c:60:58:3e:4c:bb:40:99:42:20:ff:c7:
+	3f:4e:68:8c:8b:f4:e8:41:fe:f4:79:00:a4:7e:64:
+	67:95:8e:bf:c3:45:28:dc:da:57:b9:aa:20:ac:66:
+	b0:c8:11:b2:9a:c2:60:ac:24:32:7f:17:e4:6c:dc:
+	24:43:56:22:50:86:29:a7:38:fb:4e:8c:e1:9a:c8:
+	42:a4:59:ab:49:32:bd:0b:65:30:37:06:95:29:63:
+	88:09:11:0b:0a:f3:34:82:f6:54:68:cc:71:e9:ea:
+	9f:48:0f:
+
+exp1:
+	78:8e:dc:b6:74:34:32:fd:c4:69:f3:38:e0:1f:77:
+	5f:19:4d:87:4d:5f:bc:5f:0a:d4:1d:83:cd:a8:45:
+	64:19:6e:62:d4:40:f5:7d:9d:6d:ee:db:58:95:66:
+	5b:e2:26:97:e3:84:ea:2a:b1:dc:52:94:72:21:e2:
+	16:5e:c9:c3:fa:3c:55:27:33:6a:86:2d:37:59:50:
+	e9:9c:b4:4d:3f:8b:98:02:ab:9d:8c:f3:70:9b:c7:
+	e9:98:51:5d:6e:27:cc:79:1e:de:99:da:84:c2:c4:
+	15:76:e2:6c:63:04:b6:f4:a1:27:03:88:de:40:c4:
+	fd:f9:65:6e:40:f0:6a:9a:8d:b5:1c:ce:24:9c:79:
+	e5:31:0a:ac:3e:1a:4f:fc:22:3a:32:6d:52:76:ab:
+	56:3d:
+
+exp2:
+	00:9b:74:5b:58:72:f8:6e:97:22:ab:44:84:6a:45:
+	6b:ba:96:b5:17:dd:f7:46:3e:c5:42:f2:3f:ba:0b:
+	d8:2a:81:7b:21:e1:5d:d8:b3:fc:5d:7c:b7:98:62:
+	36:22:19:13:37:c4:34:5e:67:8d:38:5b:e8:cf:4d:
+	1a:be:12:f4:d6:85:bd:a7:b0:be:3a:0c:90:ec:97:
+	3c:cc:1d:bb:47:c4:35:b7:ba:f3:2f:c6:ac:c7:f8:
+	68:13:71:5e:f9:3a:e6:61:ac:e4:b6:1d:ed:44:e3:
+	a9:eb:a3:a0:2f:5d:ea:5f:bf:29:9b:c2:86:ad:67:
+	a4:67:74:6c:35:3d:5b:6a:5e:d9:8e:ea:87:bd:8e:
+	6f:a1:a3:56:48:74:08:57:69:6d:9d:e8:18:c6:7c:
+	8c:fa:51:
+
+
+Public Key ID: 8B:01:09:4B:3B:91:EC:E3:21:B9:1D:EC:8D:6B:4C:5D:9E:40:80:5E
+Public key's random art:
++--[ RSA 2432]----+
+| o=o             |
+|..oE..           |
+|.+=.o            |
+|o.*....          |
+| * B +..S        |
+|. * o oo .       |
+| o .  . .        |
+|  +              |
+| .               |
++-----------------+
+
+-----BEGIN RSA PRIVATE KEY-----
+MIIFfAIBAAKCATEAq1SY/KnGFZWdpsGUhJSReR542y1IUZllAQLAQFJJXetwvCbv
+aDkeBJHi28tvk0BFHiKOcVpYiSh5XhoyJT6LnTs0fxn40C83t2Iyt1OlQyzFXeys
++TX6FCs0ZvHWp6HQg5pW9BmDvL8RdDAtqChboqt6xs2cXPhR6akMSNtxu7E0d/fu
+3l14wEgKNw1lHjsrFAOJcvJS7V8AxQZg6oAg0EPsZrzSJtvwKT5q+WIgvlgmRLrX
+jG92pgUg5Ji3xHJ6Xd9PDSPsLpxx7DD5FF/IdQurZ/Z9+012ZEql1fq0CFCdE8eP
+wnmwtD4vidMzJ02fi9NgJAersnI9KaXESuw8BNJJPiYb7HoQPcpFWoCLTSqWY08t
+YygPO0dHynwsFUEy1eDJvqVVLLNrRipWsRvtKQIDAQABAoIBMF2XINskgqhXyn7F
+UDP8VFstYieYXOD2Qk6DCjIYwSsk6bheLHlqehNU/e/C+Xgeq6MCjX0uNR73lRTq
+imn9+JYzOUIVFe3jXTQ32Cx87NH9KvNbzkF0Ut+hmkaB5Rg9NIIvVUCSj3wTg51M
+lCQ/p478zVy8BKZkn5pcVfGWrlIxQtAmB75AoS2oLKxWDN6uw6FzLSo1ZUd0sJtw
+uditEnRQswD7hnLVAOgCstHj1Yc/zLbzJv4lwbVZveDJ+tm6R/hD6q/PTZKu250R
+SexQMyq2RECsBsf2ZC5CJYEg1fZ2ebn7vdLFXfcoFp3ME83ZVePKx9I48ZIy1rrb
+c7bctl9mieNMnta40gHuqNJpZN1cGn5M5B1bN5QpPJM9Q7szjxAjFBKwMyRYw66X
+TD3FwYECgZkAwZwNTqobLsQU5njtC3aQr9o9XhVvfZyXTXGjHWpHlCUgnZj00DvW
+vr4SOefXgj1UPfd2BuKsXeYfNP28nZyL9U+DiY956p5epVzptHGuWUP/7AP2VzzW
+Mwu6TTk/kGKyT6/gIXpaD5P0/F+6KbmvZxg/DiM93tm8R63eVhHR48B+KbtnrBtq
+r1owGQwUSa/bGoIQYOHRmN0CgZkA4oqdgLUpMwZE0uN3vTQ+wN+YzKvzunM8GVzY
+7cgivLmPTxrYDQji4sroPBOqIxs9ddR84k7NytD8t3dwV1ThHCKiPg+nWcBaT7Ho
+YlWFB30DpI+C6y0h/MvVtzx3pZ1npquVXR7To0l4m3UsB+m9ug9maX4uUC92X+ko
++OHJzndKSO6S0dXcKS8/KXoSsNb5jWjkgkXsOr0CgZh4jty2dDQy/cRp8zjgH3df
+GU2HTV+8XwrUHYPNqEVkGW5i1ED1fZ1t7ttYlWZb4iaX44TqKrHcUpRyIeIWXsnD
++jxVJzNqhi03WVDpnLRNP4uYAqudjPNwm8fpmFFdbifMeR7emdqEwsQVduJsYwS2
+9KEnA4jeQMT9+WVuQPBqmo21HM4knHnlMQqsPhpP/CI6Mm1SdqtWPQKBmQCbdFtY
+cvhulyKrRIRqRWu6lrUX3fdGPsVC8j+6C9gqgXsh4V3Ys/xdfLeYYjYiGRM3xDRe
+Z404W+jPTRq+EvTWhb2nsL46DJDslzzMHbtHxDW3uvMvxqzH+GgTcV75OuZhrOS2
+He1E46nro6AvXepfvymbwoatZ6RndGw1PVtqXtmO6oe9jm+ho1ZIdAhXaW2d6BjG
+fIz6UQKBmQCC0uQ746qemXUNc+TpOPVec+TCOiRVTupY9yryD/9C1+LvSdIljYYC
+pyvJRR7uoBxgWD5Mu0CZQiD/xz9OaIyL9OhB/vR5AKR+ZGeVjr/DRSjc2le5qiCs
+ZrDIEbKawmCsJDJ/F+Rs3CRDViJQhimnOPtOjOGayEKkWatJMr0LZTA3BpUpY4gJ
+EQsK8zSC9lRozHHp6p9IDw==
+-----END RSA PRIVATE KEY-----