26 files changed, 775 insertions, 889 deletions

diff --git a/src/daemon/connection_https.c b/src/daemon/connection_https.c
index d275bb19..d91e6b90 100644
--- a/src/daemon/connection_https.c
+++ b/src/daemon/connection_https.c
@@ -37,7 +37,7 @@
 #include "gnutls_int.h"
 #include "gnutls_record.h"
 
-/* TODO rm #include "gnutls_errors.h" */
+/* TODO #include rm "gnutls_errors.h" */
 #include "gnutls_errors.h"
 
 /* forward declarations used when setting secure connection callbacks */
@@ -168,6 +168,9 @@ MHD_tls_connection_handle_idle (struct MHD_Connection *connection)
 
   switch (connection->state)
     {
+    /* on newly created connections we might reach here before any reply has been received */
+    case MHD_TLS_CONNECTION_INIT:
+      return MHD_YES;
       /* close connection if necessary */
     case MHD_CONNECTION_CLOSED:
       MHD_tls_connection_close (connection);
diff --git a/src/daemon/daemon.c b/src/daemon/daemon.c
index 34a9bac6..84662dbd 100644
--- a/src/daemon/daemon.c
+++ b/src/daemon/daemon.c
@@ -32,6 +32,7 @@
 #if HTTPS_SUPPORT
 #include "gnutls_int.h"
 #include "gnutls_global.h"
+#include "auth_anon.h"
 #endif
 
 /**
@@ -56,26 +57,14 @@
  */
 #define DEBUG_CONNECT MHD_NO
 
-#if HTTPS_SUPPORT
-/* initialize security aspects of the HTTPS daemon */
+/* TODO unite with code in gnutls_priority.c */
 static int
-MHD_TLS_init (struct MHD_Daemon *daemon)
+MHD_init_daemon_certificate (struct MHD_Daemon *daemon)
 {
-  int i;
-  priority_st st;
   gnutls_datum_t key;
   gnutls_datum_t cert;
 
-  gnutls_global_set_log_function (MHD_tls_log_func);
-
-  /* setup server certificate */
-  gnutls_certificate_allocate_credentials (&daemon->x509_cret);
-
-  /* TODO remove if unused
-     gnutls_certificate_set_x509_trust_file(x509_cret, CAFILE,GNUTLS_X509_FMT_PEM);
-     gnutls_certificate_set_x509_crl_file(x509_cret, CRLFILE, GNUTLS_X509_FMT_PEM); */
-
-  /* sets a certificate private key pair */
+  /* certificate & key loaded from file */
   if (daemon->https_cert_path && daemon->https_key_path)
     {
       /* test for private key & certificate file exsitance */
@@ -98,20 +87,21 @@ MHD_TLS_init (struct MHD_Daemon *daemon)
           CLOSE (daemon->socket_fd);
           return -1;
         }
-      gnutls_certificate_set_x509_key_file (daemon->x509_cret,
-                                            daemon->https_cert_path,
-                                            daemon->https_key_path,
-                                            GNUTLS_X509_FMT_PEM);
+      return gnutls_certificate_set_x509_key_file (daemon->x509_cred,
+                                                   daemon->https_cert_path,
+                                                   daemon->https_key_path,
+                                                   GNUTLS_X509_FMT_PEM);
     }
+  /* certificate & key loaded from memory */
   else if (daemon->https_mem_cert && daemon->https_mem_key)
     {
-      key.data = (char *) daemon->https_mem_key;
+      key.data = (unsigned char *) daemon->https_mem_key;
       key.size = strlen (daemon->https_mem_key);
-      cert.data = (char *) daemon->https_mem_cert;
+      cert.data = (unsigned char *) daemon->https_mem_cert;
       cert.size = strlen (daemon->https_mem_cert);
 
-      gnutls_certificate_set_x509_key_mem (daemon->x509_cret, &cert, &key,
-                                           GNUTLS_X509_FMT_PEM);
+      return gnutls_certificate_set_x509_key_mem (daemon->x509_cred, &cert,
+                                                  &key, GNUTLS_X509_FMT_PEM);
     }
   else
     {
@@ -120,29 +110,44 @@ MHD_TLS_init (struct MHD_Daemon *daemon)
 #endif
       return MHD_NO;
     }
+}
 
-  /* generate DH parameters if necessary */
-  st = daemon->priority_cache->kx;
-  for (i = 0; i < st.algorithms; i++)
+/* initialize security aspects of the HTTPS daemon */
+int
+MHD_TLS_init (struct MHD_Daemon *daemon)
+{
+  int ret;
+
+  switch (daemon->cred_type)
     {
-      /* initialize Diffie Hellman parameters if necessary */
-      /* TODO add other cipher suits */
-      if (st.priority[i] == MHD_GNUTLS_KX_DHE_RSA)
-        {
-          gnutls_dh_params_init (&daemon->dh_params);
-          gnutls_dh_params_generate2 (daemon->dh_params, 1024);
-          break;
-        }
+    case MHD_GNUTLS_CRD_ANON:
+      ret = gnutls_anon_allocate_server_credentials (&daemon->anon_cred);
+      ret += gnutls_dh_params_init (&daemon->dh_params);
+      if (ret != 0) {
+                return GNUTLS_E_MEMORY_ERROR;
+          }
+      gnutls_dh_params_generate2 (daemon->dh_params, 1024);
+      gnutls_anon_set_server_dh_params (daemon->anon_cred, daemon->dh_params);
+      break;
+    case MHD_GNUTLS_CRD_CERTIFICATE:
+      ret = gnutls_certificate_allocate_credentials (&daemon->x509_cred) ;
+      if (ret != 0) {
+                return GNUTLS_E_MEMORY_ERROR;
+          }
+      if ((ret = MHD_init_daemon_certificate (daemon)) != 0)
+        return ret;
+    default:
+#if HAVE_MESSAGES
+      MHD_DLOG (daemon,
+                "Error: no daemon credentials type found. f: %s, l: %d\n",
+                __FUNCTION__, __LINE__);
+#endif
+      break;
     }
 
-  gnutls_certificate_set_dh_params (daemon->x509_cret, daemon->dh_params);
-
-  /* TODO address error case return value */
-  return MHD_YES;
+  return MHD_NO;
 }
 
-/* TODO unite with code in gnutls_priority.c */
-/* this is used to set HTTPS related daemon priorities */
 inline static int
 _set_priority (priority_st * st, const int *list)
 {
@@ -152,7 +157,7 @@ _set_priority (priority_st * st, const int *list)
     num++;
   if (num > MAX_ALGOS)
     num = MAX_ALGOS;
-  st->algorithms = num;
+  st->num_algorithms = num;
 
   for (i = 0; i < num; i++)
     {
@@ -161,7 +166,6 @@ _set_priority (priority_st * st, const int *list)
 
   return 0;
 }
-#endif /* HTTPS_SUPPORT */
 
 /**
  * Obtain the select sets for this daemon.
@@ -300,12 +304,13 @@ gnutls_push_param_adapter (void *connection,
 }
 #endif
 
+
 /**
  * Handle an individual TLS connection.
  */
 #if HTTPS_SUPPORT
 static void *
-MHD_TLS_handle_connection (void *data)
+MHD_TLS_init_connection (void *data)
 {
   struct MHD_Connection *con = data;
 
@@ -320,16 +325,37 @@ MHD_TLS_handle_connection (void *data)
   /* sets cipher priorities */
   gnutls_priority_set (con->tls_session, con->daemon->priority_cache);
 
-  /* set needed credentials for certificate authentication. */
-  gnutls_credentials_set (con->tls_session, MHD_GNUTLS_CRD_CERTIFICATE,
-                          con->daemon->x509_cret);
+  switch (con->daemon->cred_type)
+    {
+      /* set needed credentials for certificate authentication. */
+    case MHD_GNUTLS_CRD_CERTIFICATE:
+      gnutls_credentials_set (con->tls_session, MHD_GNUTLS_CRD_CERTIFICATE,
+                              con->daemon->x509_cred);
+      break;
+    case MHD_GNUTLS_CRD_ANON:
+      /* set needed credentials for anonymous authentication. */
+      gnutls_credentials_set (con->tls_session, MHD_GNUTLS_CRD_ANON,
+                              con->daemon->anon_cred);
+      gnutls_dh_set_prime_bits (con->tls_session, 1024);
+      break;
+    default:
+
+#if HAVE_MESSAGES
+      MHD_DLOG (con->daemon,
+                "Error: couldn't init HTTPS session. no appropriate KX algorithm found. f: %s, l: %d\n",
+                __FUNCTION__, __LINE__);
+#endif
+      break;
+    }
 
   /* TODO avoid gnutls blocking recv / write calls
      gnutls_transport_set_pull_function(tls_session, &recv);
      gnutls_transport_set_push_function(tls_session, &send);
    */
 
-  gnutls_transport_set_ptr (con->tls_session, con->socket_fd);
+  gnutls_transport_set_ptr (con->tls_session,
+                            (gnutls_transport_ptr_t) ((void *) con->
+                                                      socket_fd));
 
   return MHD_handle_connection (data);
 }
@@ -489,7 +515,7 @@ MHD_accept_connection (struct MHD_Daemon *daemon)
 #if HTTPS_SUPPORT
       if (daemon->options & MHD_USE_SSL)
         res_thread_create = pthread_create (&connection->pid, NULL,
-                                            &MHD_TLS_handle_connection,
+                                            &MHD_TLS_init_connection,
                                             connection);
       else
 #endif
@@ -768,7 +794,7 @@ MHD_select_thread (void *cls)
  */
 struct MHD_Daemon *
 MHD_start_daemon_va (unsigned int options,
-                     unsigned short port,
+                     unsigned short port, char *ip,
                      MHD_AcceptPolicyCallback apc,
                      void *apc_cls,
                      MHD_AccessHandlerCallback dh, void *dh_cls, va_list ap)
@@ -875,6 +901,7 @@ MHD_start_daemon_va (unsigned int options,
       pthread_mutex_unlock (&gnutls_init_mutex);
       /* set default priorities */
       gnutls_priority_init (&retVal->priority_cache, "", NULL);
+      retVal->cred_type = MHD_GNUTLS_CRD_CERTIFICATE;
     }
 #endif
   /* initializes the argument pointer variable */
@@ -906,7 +933,7 @@ MHD_start_daemon_va (unsigned int options,
 #if HTTPS_SUPPORT
         case MHD_OPTION_PROTOCOL_VERSION:
           _set_priority (&retVal->priority_cache->protocol,
-                                   va_arg (ap, const int *));
+                         va_arg (ap, const int *));
           break;
         case MHD_OPTION_HTTPS_KEY_PATH:
           retVal->https_key_path = va_arg (ap, const char *);
@@ -920,8 +947,11 @@ MHD_start_daemon_va (unsigned int options,
         case MHD_OPTION_HTTPS_MEM_CERT:
           retVal->https_mem_cert = va_arg (ap, const char *);
           break;
+        case MHD_OPTION_CRED_TYPE:
+          retVal->cred_type = va_arg (ap, const int);
+          break;
         case MHD_OPTION_KX_PRIORITY:
-          _set_priority (&retVal->priority_cache->cipher,
+          _set_priority (&retVal->priority_cache->kx,
                          va_arg (ap, const int *));
           break;
         case MHD_OPTION_CIPHER_ALGORITHM:
@@ -929,16 +959,17 @@ MHD_start_daemon_va (unsigned int options,
                          va_arg (ap, const int *));
           break;
         case MHD_OPTION_MAC_ALGO:
-             _set_priority (&retVal->priority_cache->mac,
-                                    va_arg (ap, const int *));
-                 break;
+          _set_priority (&retVal->priority_cache->mac,
+                         va_arg (ap, const int *));
+          break;
 #endif
         default:
 #if HAVE_MESSAGES
           if (opt > MHD_HTTPS_OPTION_START && opt < MHD_HTTPS_OPTION_END)
             {
               fprintf (stderr,
-                       "Error: HTTPS option %d passed to non HTTPS daemon\n", opt);
+                       "Error: HTTPS option %d passed to non HTTPS daemon\n",
+                       opt);
             }
           else
             {
@@ -952,7 +983,7 @@ MHD_start_daemon_va (unsigned int options,
 
 #if HTTPS_SUPPORT
   /* initialize HTTPS daemon certificate aspects & send / recv functions */
-  if (options & MHD_USE_SSL && MHD_NO == MHD_TLS_init (retVal))
+  if (options & MHD_USE_SSL && MHD_TLS_init (retVal) != 0)
     {
 #if HAVE_MESSAGES
       MHD_DLOG (retVal, "Failed to initialize HTTPS daemon\n");
@@ -985,18 +1016,244 @@ MHD_start_daemon (unsigned int options,
                   unsigned short port,
                   MHD_AcceptPolicyCallback apc,
                   void *apc_cls,
-                  MHD_AccessHandlerCallback dh, void *dh_cls, ...){
-
-        int ret;
-        va_list ap;
-        va_start (ap, dh_cls);
-        ret = MHD_start_daemon_va (options,
-            port,
-            apc,
-            apc_cls,
-            dh, dh_cls, ap);
-        va_end (ap);
-        return ret;
+                  MHD_AccessHandlerCallback dh, void *dh_cls, ...)
+{
+  const int on = 1;
+  struct MHD_Daemon *retVal;
+
+  /* listeningss sockets used by the daemon */
+  int socket_fd;
+  va_list ap;
+
+  struct sockaddr_in servaddr4;
+  struct sockaddr_in6 servaddr6;
+  const struct sockaddr *servaddr;
+  socklen_t addrlen;
+  enum MHD_OPTION opt;
+
+  if ((port == 0) || (dh == NULL))
+    return NULL;
+  if ((options & MHD_USE_IPv6) != 0)
+    socket_fd = SOCKET (PF_INET6, SOCK_STREAM, 0);
+  else
+    socket_fd = SOCKET (PF_INET, SOCK_STREAM, 0);
+  if (socket_fd < 0)
+    {
+#if HAVE_MESSAGES
+      if ((options & MHD_USE_DEBUG) != 0)
+        fprintf (stderr, "Call to socket failed: %s\n", STRERROR (errno));
+#endif
+      return NULL;
+    }
+  if ((SETSOCKOPT (socket_fd,
+                   SOL_SOCKET,
+                   SO_REUSEADDR,
+                   &on, sizeof (on)) < 0) && (options & MHD_USE_DEBUG) != 0)
+    {
+#if HAVE_MESSAGES
+      fprintf (stderr, "setsockopt failed: %s\n", STRERROR (errno));
+#endif
+    }
+  if ((options & MHD_USE_IPv6) != 0)
+    {
+      memset (&servaddr6, 0, sizeof (struct sockaddr_in6));
+      servaddr6.sin6_family = AF_INET6;
+      servaddr6.sin6_port = htons (port);
+      servaddr = (struct sockaddr *) &servaddr6;
+      addrlen = sizeof (struct sockaddr_in6);
+    }
+  else
+    {
+      memset (&servaddr4, 0, sizeof (struct sockaddr_in));
+      servaddr4.sin_family = AF_INET;
+      servaddr4.sin_port = htons (port);
+      servaddr = (struct sockaddr *) &servaddr4;
+      addrlen = sizeof (struct sockaddr_in);
+    }
+  if (BIND (socket_fd, servaddr, addrlen) < 0)
+    {
+#if HAVE_MESSAGES
+      if ((options & MHD_USE_DEBUG) != 0)
+        fprintf (stderr,
+                 "Failed to bind to port %u: %s\n", port, STRERROR (errno));
+#endif
+      CLOSE (socket_fd);
+      return NULL;
+    }
+  if (LISTEN (socket_fd, 20) < 0)
+    {
+#if HAVE_MESSAGES
+      if ((options & MHD_USE_DEBUG) != 0)
+        fprintf (stderr,
+                 "Failed to listen for connections: %s\n", STRERROR (errno));
+#endif
+      CLOSE (socket_fd);
+      return NULL;
+    }
+
+  /* allocate the mhd daemon */
+
+  retVal = malloc (sizeof (struct MHD_Daemon));
+
+  if (retVal == NULL)
+    {
+      CLOSE (socket_fd);
+      return NULL;
+    }
+
+  memset (retVal, 0, sizeof (struct MHD_Daemon));
+  retVal->options = options;
+  retVal->port = port;
+  retVal->apc = apc;
+  retVal->apc_cls = apc_cls;
+  retVal->socket_fd = socket_fd;
+  retVal->default_handler = dh;
+  retVal->default_handler_cls = dh_cls;
+  retVal->max_connections = MHD_MAX_CONNECTIONS_DEFAULT;
+  retVal->pool_size = MHD_POOL_SIZE_DEFAULT;
+  retVal->connection_timeout = 0;       /* no timeout */
+#if HTTPS_SUPPORT
+  if (options & MHD_USE_SSL)
+    {
+      /* lock gnutls_global mutex since it uses reference counting */
+      pthread_mutex_lock (&gnutls_init_mutex);
+      gnutls_global_init ();
+      pthread_mutex_unlock (&gnutls_init_mutex);
+      /* set default priorities */
+      gnutls_priority_init (&retVal->priority_cache, "", NULL);
+      retVal->cred_type = MHD_GNUTLS_CRD_CERTIFICATE;
+    }
+#endif
+  /* initializes the argument pointer variable */
+
+  va_start (ap, dh_cls);
+
+  /*
+   * loop through daemon options
+   */
+  while (MHD_OPTION_END != (opt = va_arg (ap, enum MHD_OPTION)))
+    {
+      switch (opt)
+        {
+        case MHD_OPTION_CONNECTION_MEMORY_LIMIT:
+          retVal->pool_size = va_arg (ap, unsigned int);
+          break;
+        case MHD_OPTION_CONNECTION_LIMIT:
+          retVal->max_connections = va_arg (ap, unsigned int);
+          break;
+        case MHD_OPTION_CONNECTION_TIMEOUT:
+          retVal->connection_timeout = va_arg (ap, unsigned int);
+          break;
+        case MHD_OPTION_NOTIFY_COMPLETED:
+          retVal->notify_completed =
+            va_arg (ap, MHD_RequestCompletedCallback);
+          retVal->notify_completed_cls = va_arg (ap, void *);
+          break;
+        case MHD_OPTION_PER_IP_CONNECTION_LIMIT:
+          retVal->per_ip_connection_limit = va_arg (ap, unsigned int);
+          break;
+#if HTTPS_SUPPORT
+        case MHD_OPTION_PROTOCOL_VERSION:
+          _set_priority (&retVal->priority_cache->protocol,
+                         va_arg (ap, const int *));
+          break;
+        case MHD_OPTION_HTTPS_KEY_PATH:
+          retVal->https_key_path = va_arg (ap, const char *);
+          break;
+        case MHD_OPTION_HTTPS_CERT_PATH:
+          retVal->https_cert_path = va_arg (ap, const char *);
+          break;
+        case MHD_OPTION_HTTPS_MEM_KEY:
+          retVal->https_mem_key = va_arg (ap, const char *);
+          break;
+        case MHD_OPTION_HTTPS_MEM_CERT:
+          retVal->https_mem_cert = va_arg (ap, const char *);
+          break;
+        case MHD_OPTION_CRED_TYPE:
+          retVal->cred_type = va_arg (ap, const int);
+          break;
+        case MHD_OPTION_KX_PRIORITY:
+          _set_priority (&retVal->priority_cache->kx,
+                         va_arg (ap, const int *));
+          break;
+        case MHD_OPTION_CIPHER_ALGORITHM:
+          _set_priority (&retVal->priority_cache->cipher,
+                         va_arg (ap, const int *));
+          break;
+        case MHD_OPTION_MAC_ALGO:
+          _set_priority (&retVal->priority_cache->mac,
+                         va_arg (ap, const int *));
+          break;
+#endif
+        default:
+#if HAVE_MESSAGES
+          if (opt > MHD_HTTPS_OPTION_START && opt < MHD_HTTPS_OPTION_END)
+            {
+              fprintf (stderr,
+                       "Error: HTTPS option %d passed to non HTTPS daemon\n",
+                       opt);
+            }
+          else
+            {
+              fprintf (stderr,
+                       "Invalid MHD_OPTION argument! (Did you terminate the list with MHD_OPTION_END?)\n");
+            }
+#endif
+          abort ();
+        }
+    }
+  va_end (ap);
+
+  /* initialize HTTPS daemon certificate aspects & send / recv functions */
+  if (options & MHD_USE_SSL && MHD_TLS_init (retVal) != 0)
+    {
+#if HAVE_MESSAGES
+      MHD_DLOG (retVal, "Failed to initialize HTTPS daemon\n");
+#endif
+      free (retVal);
+      return NULL;
+    }
+
+  if (((0 != (options & MHD_USE_THREAD_PER_CONNECTION)) || (0 != (options
+                                                                  &
+                                                                  MHD_USE_SELECT_INTERNALLY)))
+      && (0 !=
+          pthread_create (&retVal->pid, NULL, &MHD_select_thread, retVal)))
+    {
+#if HAVE_MESSAGES
+      MHD_DLOG (retVal, "Failed to create listen thread: %s\n",
+                STRERROR (errno));
+#endif
+      free (retVal);
+      CLOSE (socket_fd);
+      return NULL;
+    }
+
+  return retVal;
+}
+
+
+/*
+ * start the MHD_Daemon while binding to a specific ip address.
+ *
+ * TODO : address adding ip parameter to MHD_start_daemon
+ */
+struct MHD_Daemon *
+MHD_start_daemon_ip (unsigned int options,
+                     unsigned short port, char *ip,
+                     MHD_AcceptPolicyCallback apc,
+                     void *apc_cls,
+                     MHD_AccessHandlerCallback dh, void *dh_cls, ...)
+{
+
+  gnutls_global_set_log_level (5);
+
+  struct MHD_Daemon *ret;
+  va_list ap;
+  va_start (ap, dh_cls);
+  ret = MHD_start_daemon_va (options, port, ip, apc, apc_cls, dh, dh_cls, ap);
+  va_end (ap);
+  return ret;
 }
 
 /**
@@ -1066,7 +1323,10 @@ MHD_stop_daemon (struct MHD_Daemon *daemon)
     {
       gnutls_priority_deinit (daemon->priority_cache);
 
-      gnutls_certificate_free_credentials (daemon->x509_cret);
+      if (daemon->x509_cred)
+        gnutls_certificate_free_credentials (daemon->x509_cred);
+      if (daemon->anon_cred)
+        gnutls_anon_free_server_credentials (daemon->anon_cred);
 
       /* lock gnutls_global mutex since it uses reference counting */
       pthread_mutex_lock (&gnutls_init_mutex);
diff --git a/src/daemon/https/tls/Makefile.am b/src/daemon/https/tls/Makefile.am
index 40d49e08..3155e0bd 100644
--- a/src/daemon/https/tls/Makefile.am
+++ b/src/daemon/https/tls/Makefile.am
@@ -43,7 +43,6 @@ gnutls_compress.c \
 gnutls_compress_int.c \
 gnutls_constate.c \
 gnutls_datum.c \
-gnutls_db.c \
 gnutls_dh.c \
 gnutls_dh_primes.c \
 gnutls_errors.c \
diff --git a/src/daemon/https/tls/auth_cert.h b/src/daemon/https/tls/auth_cert.h
index 86e0230f..e49a6089 100644
--- a/src/daemon/https/tls/auth_cert.h
+++ b/src/daemon/https/tls/auth_cert.h
@@ -34,6 +34,7 @@
 /* This structure may be complex, but it's the only way to
  * support a server that has multiple certificates
  */
+
 typedef struct gnutls_certificate_credentials_st
 {
   gnutls_dh_params_t dh_params;
@@ -45,7 +46,7 @@ typedef struct gnutls_certificate_credentials_st
 
   gnutls_cert **cert_list;
   /* contains a list of a list of certificates.
-   * eg (X509): [0] certificate1, certificate11, certificate111 
+   * eg (X509): [0] certificate1, certificate11, certificate111
    * (if more than one, one certificate certifies the one before)
    *       [1] certificate2, certificate22, ...
    */
@@ -75,14 +76,14 @@ typedef struct gnutls_certificate_credentials_st
   /* X509 specific stuff */
 
   gnutls_x509_crt_t *x509_ca_list;
-  unsigned x509_ncas;           /* number of CAs in the ca_list 
+  unsigned x509_ncas;           /* number of CAs in the ca_list
                                  */
 
   gnutls_x509_crl_t *x509_crl_list;
-  unsigned x509_ncrls;          /* number of CRLs in the crl_list 
+  unsigned x509_ncrls;          /* number of CRLs in the crl_list
                                  */
 
-  unsigned int verify_flags;    /* flags to be used at 
+  unsigned int verify_flags;    /* flags to be used at
                                  * certificate verification.
                                  */
   unsigned int verify_depth;
diff --git a/src/daemon/https/tls/ext_cert_type.c b/src/daemon/https/tls/ext_cert_type.c
index 6f1c17bc..a1bec6a1 100644
--- a/src/daemon/https/tls/ext_cert_type.c
+++ b/src/daemon/https/tls/ext_cert_type.c
@@ -150,10 +150,10 @@ _gnutls_cert_type_send_params (gnutls_session_t session, opaque * data,
   if (session->security_parameters.entity == GNUTLS_CLIENT)
     {
 
-      if (session->internals.priorities.cert_type.algorithms > 0)
+      if (session->internals.priorities.cert_type.num_algorithms > 0)
         {
 
-          len = session->internals.priorities.cert_type.algorithms;
+          len = session->internals.priorities.cert_type.num_algorithms;
 
           if (len == 1 &&
               session->internals.priorities.cert_type.priority[0] ==
diff --git a/src/daemon/https/tls/gnutls_alert.c b/src/daemon/https/tls/gnutls_alert.c
index dfa35f85..29422dab 100644
--- a/src/daemon/https/tls/gnutls_alert.c
+++ b/src/daemon/https/tls/gnutls_alert.c
@@ -148,7 +148,7 @@ gnutls_alert_send (gnutls_session_t session, gnutls_alert_level_t level,
   * alert should be sent to the peer indicating that no renegotiation will
   * be performed.
   *
-  * If there is no mapping to a valid alert the alert to indicate internal error 
+  * If there is no mapping to a valid alert the alert to indicate internal error
   * is returned.
   *
   **/
@@ -163,7 +163,7 @@ gnutls_error_to_alert (int err, int *level)
       /* GNUTLS_A_DECRYPTION_FAILED is not sent, because
        * it is not defined in SSL3. Note that we must
        * not distinguish Decryption failures from mac
-       * check failures, due to the possibility of some 
+       * check failures, due to the possibility of some
        * attacks.
        */
       ret = GNUTLS_A_BAD_RECORD_MAC;
diff --git a/src/daemon/https/tls/gnutls_algorithms.c b/src/daemon/https/tls/gnutls_algorithms.c
index 56435345..1809afda 100644
--- a/src/daemon/https/tls/gnutls_algorithms.c
+++ b/src/daemon/https/tls/gnutls_algorithms.c
@@ -767,7 +767,7 @@ _gnutls_mac_priority (gnutls_session_t session,
                       gnutls_mac_algorithm_t algorithm)
 {                               /* actually returns the priority */
   unsigned int i;
-  for (i = 0; i < session->internals.priorities.mac.algorithms; i++)
+  for (i = 0; i < session->internals.priorities.mac.num_algorithms; i++)
     {
       if (session->internals.priorities.mac.priority[i] == algorithm)
         return i;
@@ -893,7 +893,7 @@ _gnutls_compression_priority (gnutls_session_t session,
                               gnutls_compression_method_t algorithm)
 {                               /* actually returns the priority */
   unsigned int i;
-  for (i = 0; i < session->internals.priorities.compression.algorithms; i++)
+  for (i = 0; i < session->internals.priorities.compression.num_algorithms; i++)
     {
       if (session->internals.priorities.compression.priority[i] == algorithm)
         return i;
@@ -1040,7 +1040,7 @@ _gnutls_cipher_priority (gnutls_session_t session,
                          gnutls_cipher_algorithm_t algorithm)
 {
   unsigned int i;
-  for (i = 0; i < session->internals.priorities.cipher.algorithms; i++)
+  for (i = 0; i < session->internals.priorities.cipher.num_algorithms; i++)
     {
       if (session->internals.priorities.cipher.priority[i] == algorithm)
         return i;
@@ -1176,7 +1176,7 @@ _gnutls_kx_priority (gnutls_session_t session,
                      gnutls_kx_algorithm_t algorithm)
 {
   unsigned int i;
-  for (i = 0; i < session->internals.priorities.kx.algorithms; i++)
+  for (i = 0; i < session->internals.priorities.kx.num_algorithms; i++)
     {
       if (session->internals.priorities.kx.priority[i] == algorithm)
         return i;
@@ -1276,7 +1276,7 @@ _gnutls_version_priority (gnutls_session_t session, gnutls_protocol_t version)
       return -1;
     }
 
-  for (i = 0; i < session->internals.priorities.protocol.algorithms; i++)
+  for (i = 0; i < session->internals.priorities.protocol.num_algorithms; i++)
     {
       if (session->internals.priorities.protocol.priority[i] == version)
         return i;
@@ -1294,7 +1294,7 @@ _gnutls_version_lowest (gnutls_session_t session)
       return MHD_GNUTLS_VERSION_UNKNOWN;
     }
   else
-    for (i = 0; i < session->internals.priorities.protocol.algorithms; i++)
+    for (i = 0; i < session->internals.priorities.protocol.num_algorithms; i++)
       {
         if (session->internals.priorities.protocol.priority[i] < min)
           min = session->internals.priorities.protocol.priority[i];
@@ -1316,7 +1316,7 @@ _gnutls_version_max (gnutls_session_t session)
       return MHD_GNUTLS_VERSION_UNKNOWN;
     }
   else
-    for (i = 0; i < session->internals.priorities.protocol.algorithms; i++)
+    for (i = 0; i < session->internals.priorities.protocol.num_algorithms; i++)
       {
         if (session->internals.priorities.protocol.priority[i] > max)
           max = session->internals.priorities.protocol.priority[i];
@@ -1886,7 +1886,7 @@ _gnutls_supported_ciphersuites (gnutls_session_t session,
 
 /* returns the TLS numbers of the compression methods we support
  */
-#define SUPPORTED_COMPRESSION_METHODS session->internals.priorities.compression.algorithms
+#define SUPPORTED_COMPRESSION_METHODS session->internals.priorities.compression.num_algorithms
 int
 _gnutls_supported_compression_methods (gnutls_session_t session,
                                        uint8_t ** comp)
diff --git a/src/daemon/https/tls/gnutls_anon_cred.c b/src/daemon/https/tls/gnutls_anon_cred.c
index 919315ef..fd0917f8 100644
--- a/src/daemon/https/tls/gnutls_anon_cred.c
+++ b/src/daemon/https/tls/gnutls_anon_cred.c
@@ -62,8 +62,9 @@ int
 gnutls_anon_allocate_server_credentials (gnutls_anon_server_credentials_t *
                                          sc)
 {
-
   *sc = gnutls_calloc (1, sizeof (anon_server_credentials_st));
+  if (*sc == NULL)
+            return GNUTLS_E_MEMORY_ERROR;
 
   return 0;
 }
diff --git a/src/daemon/https/tls/gnutls_db.c b/src/daemon/https/tls/gnutls_db.c
deleted file mode 100644
index 806961c1..00000000
--- a/src/daemon/https/tls/gnutls_db.c
+++ /dev/null
@@ -1,386 +0,0 @@
-/*
- * Copyright (C) 2000, 2002, 2003, 2004, 2005 Free Software Foundation
- *
- * Author: Nikos Mavrogiannopoulos
- *
- * This file is part of GNUTLS.
- *
- * The GNUTLS library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public License
- * as published by the Free Software Foundation; either version 2.1 of
- * the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
- * USA
- *
- */
-
-/* This file contains functions that manipulate a database backend
- * for resumed sessions. 
- */
-
-#include "gnutls_int.h"
-#include "gnutls_errors.h"
-// #include "gnutls_session.h"
-#include <gnutls_db.h>
-#include "debug.h"
-#include <gnutls_session_pack.h>
-#include <gnutls_datum.h>
-
-/**
-  * gnutls_db_set_retrieve_function - Sets the function that will be used to get data
-  * @session: is a #gnutls_session_t structure.
-  * @retr_func: is the function.
-  *
-  * Sets the function that will be used to retrieve data from the resumed
-  * sessions database. This function must return a gnutls_datum_t containing the
-  * data on success, or a gnutls_datum_t containing null and 0 on failure.
-  *
-  * The datum's data must be allocated using the function
-  * gnutls_malloc().
-  *
-  * The first argument to retr_func() will be null unless gnutls_db_set_ptr() 
-  * has been called.
-  *
-  **/
-void
-gnutls_db_set_retrieve_function (gnutls_session_t session,
-                                 gnutls_db_retr_func retr_func)
-{
-  session->internals.db_retrieve_func = retr_func;
-}
-
-/**
-  * gnutls_db_set_remove_function - Sets the function that will be used to remove data
-  * @session: is a #gnutls_session_t structure.
-  * @rem_func: is the function.
-  *
-  * Sets the function that will be used to remove data from the resumed
-  * sessions database. This function must return 0 on success.
-  *
-  * The first argument to rem_func() will be null unless gnutls_db_set_ptr() 
-  * has been called.
-  *
-  **/
-void
-gnutls_db_set_remove_function (gnutls_session_t session,
-                               gnutls_db_remove_func rem_func)
-{
-  session->internals.db_remove_func = rem_func;
-}
-
-/**
-  * gnutls_db_set_store_function - Sets the function that will be used to put data
-  * @session: is a #gnutls_session_t structure.
-  * @store_func: is the function
-  *
-  * Sets the function that will be used to store data from the resumed
-  * sessions database. This function must remove 0 on success. 
-  *
-  * The first argument to store_func() will be null unless gnutls_db_set_ptr() 
-  * has been called.
-  *
-  **/
-void
-gnutls_db_set_store_function (gnutls_session_t session,
-                              gnutls_db_store_func store_func)
-{
-  session->internals.db_store_func = store_func;
-}
-
-/**
-  * gnutls_db_set_ptr - Sets a pointer to be sent to db functions
-  * @session: is a #gnutls_session_t structure.
-  * @ptr: is the pointer
-  *
-  * Sets the pointer that will be provided to db store, retrieve and delete functions, as
-  * the first argument. 
-  *
-  **/
-void
-gnutls_db_set_ptr (gnutls_session_t session, void *ptr)
-{
-  session->internals.db_ptr = ptr;
-}
-
-/**
-  * gnutls_db_get_ptr - Returns the pointer which is sent to db functions
-  * @session: is a #gnutls_session_t structure.
-  *
-  * Returns the pointer that will be sent to db store, retrieve and delete functions, as
-  * the first argument. 
-  *
-  **/
-void *
-gnutls_db_get_ptr (gnutls_session_t session)
-{
-  return session->internals.db_ptr;
-}
-
-/**
-  * gnutls_db_set_cache_expiration - Sets the expiration time for resumed sessions.
-  * @session: is a #gnutls_session_t structure.
-  * @seconds: is the number of seconds.
-  *
-  * Sets the expiration time for resumed sessions. The default is 3600 (one hour)
-  * at the time writing this.
-  **/
-void
-gnutls_db_set_cache_expiration (gnutls_session_t session, int seconds)
-{
-  session->internals.expire_time = seconds;
-}
-
-/**
-  * gnutls_db_check_entry - checks if the given db entry has expired
-  * @session: is a #gnutls_session_t structure.
-  * @session_entry: is the session data (not key)
-  *
-  * This function returns GNUTLS_E_EXPIRED, if the database entry
-  * has expired or 0 otherwise. This function is to be used when
-  * you want to clear unnesessary session which occupy space in your
-  * backend.
-  *
-  **/
-int
-gnutls_db_check_entry (gnutls_session_t session, gnutls_datum_t session_entry)
-{
-  time_t timestamp;
-
-  timestamp = time (0);
-
-  if (session_entry.data != NULL)
-    if (timestamp -
-        ((security_parameters_st *) (session_entry.data))->timestamp <=
-        session->internals.expire_time
-        || ((security_parameters_st *) (session_entry.data))->
-        timestamp > timestamp
-        || ((security_parameters_st *) (session_entry.data))->timestamp == 0)
-      return GNUTLS_E_EXPIRED;
-
-  return 0;
-}
-
-/* The format of storing data is:
- * (forget it). Check gnutls_session_pack.c
- */
-int
-_gnutls_server_register_current_session (gnutls_session_t session)
-{
-  gnutls_datum_t key;
-  gnutls_datum_t content;
-  int ret = 0;
-
-  key.data = session->security_parameters.session_id;
-  key.size = session->security_parameters.session_id_size;
-
-  if (session->internals.resumable == RESUME_FALSE)
-    {
-      gnutls_assert ();
-      return GNUTLS_E_INVALID_SESSION;
-    }
-
-  if (session->security_parameters.session_id == NULL
-      || session->security_parameters.session_id_size == 0)
-    {
-      gnutls_assert ();
-      return GNUTLS_E_INVALID_SESSION;
-    }
-
-/* copy data */
-  ret = _gnutls_session_pack (session, &content);
-  if (ret < 0)
-    {
-      gnutls_assert ();
-      return ret;
-    }
-
-  ret = _gnutls_store_session (session, key, content);
-  _gnutls_free_datum (&content);
-
-  return ret;
-}
-
-/* Checks if both db_store and db_retrieve functions have
- * been set up.
- */
-static int
-_gnutls_db_func_is_ok (gnutls_session_t session)
-{
-  if (session->internals.db_store_func != NULL &&
-      session->internals.db_retrieve_func != NULL &&
-      session->internals.db_remove_func != NULL)
-    return 0;
-  else
-    return GNUTLS_E_DB_ERROR;
-}
-
-
-int
-_gnutls_server_restore_session (gnutls_session_t session,
-                                uint8_t * session_id, int session_id_size)
-{
-  gnutls_datum_t data;
-  gnutls_datum_t key;
-  int ret;
-
-  key.data = session_id;
-  key.size = session_id_size;
-
-  if (_gnutls_db_func_is_ok (session) != 0)
-    {
-      gnutls_assert ();
-      return GNUTLS_E_INVALID_SESSION;
-    }
-
-  data = _gnutls_retrieve_session (session, key);
-
-  if (data.data == NULL)
-    {
-      gnutls_assert ();
-      return GNUTLS_E_INVALID_SESSION;
-    }
-
-  /* expiration check is performed inside */
-  ret = gnutls_session_set_data (session, data.data, data.size);
-  if (ret < 0)
-    {
-      gnutls_assert ();
-      return ret;
-    }
-
-  gnutls_free (data.data);
-
-  return 0;
-}
-
-int
-_gnutls_db_remove_session (gnutls_session_t session, uint8_t * session_id,
-                           int session_id_size)
-{
-  gnutls_datum_t key;
-
-  key.data = session_id;
-  key.size = session_id_size;
-
-  return _gnutls_remove_session (session, key);
-}
-
-
-/* Stores session data to the db backend.
- */
-int
-_gnutls_store_session (gnutls_session_t session,
-                       gnutls_datum_t session_id, gnutls_datum_t session_data)
-{
-  int ret = 0;
-
-  if (session->internals.resumable == RESUME_FALSE)
-    {
-      gnutls_assert ();
-      return GNUTLS_E_INVALID_SESSION;
-    }
-
-  if (_gnutls_db_func_is_ok (session) != 0)
-    {
-      return GNUTLS_E_DB_ERROR;
-    }
-
-  if (session_id.data == NULL || session_id.size == 0)
-    {
-      gnutls_assert ();
-      return GNUTLS_E_INVALID_SESSION;
-    }
-
-  if (session_data.data == NULL || session_data.size == 0)
-    {
-      gnutls_assert ();
-      return GNUTLS_E_INVALID_SESSION;
-    }
-  /* if we can't read why bother writing? */
-
-  if (session->internals.db_store_func != NULL)
-    ret =
-      session->internals.db_store_func (session->internals.db_ptr,
-                                        session_id, session_data);
-
-  return (ret == 0 ? ret : GNUTLS_E_DB_ERROR);
-
-}
-
-/* Retrieves session data from the db backend.
- */
-gnutls_datum_t
-_gnutls_retrieve_session (gnutls_session_t session, gnutls_datum_t session_id)
-{
-  gnutls_datum_t ret = { NULL, 0 };
-
-  if (session_id.data == NULL || session_id.size == 0)
-    {
-      gnutls_assert ();
-      return ret;
-    }
-
-  if (session->internals.db_retrieve_func != NULL)
-    ret =
-      session->internals.db_retrieve_func (session->internals.db_ptr,
-                                           session_id);
-
-  return ret;
-
-}
-
-/* Removes session data from the db backend.
- */
-int
-_gnutls_remove_session (gnutls_session_t session, gnutls_datum_t session_id)
-{
-  int ret = 0;
-
-  if (_gnutls_db_func_is_ok (session) != 0)
-    {
-      return GNUTLS_E_DB_ERROR;
-    }
-
-  if (session_id.data == NULL || session_id.size == 0)
-    return GNUTLS_E_INVALID_SESSION;
-
-  /* if we can't read why bother writing? */
-  if (session->internals.db_remove_func != NULL)
-    ret =
-      session->internals.db_remove_func (session->internals.db_ptr,
-                                         session_id);
-
-  return (ret == 0 ? ret : GNUTLS_E_DB_ERROR);
-
-}
-
-/**
-  * gnutls_db_remove_session - This function will remove the current session data from the database
-  * @session: is a #gnutls_session_t structure.
-  *
-  * This function will remove the current session data from the session
-  * database. This will prevent future handshakes reusing these session
-  * data. This function should be called if a session was terminated
-  * abnormally, and before gnutls_deinit() is called.
-  *
-  * Normally gnutls_deinit() will remove abnormally terminated sessions.
-  *
-  **/
-void
-gnutls_db_remove_session (gnutls_session_t session)
-{
-  /* if the session has failed abnormally it has 
-   * to be removed from the db 
-   */
-  _gnutls_db_remove_session (session,
-                             session->security_parameters.session_id,
-                             session->security_parameters.session_id_size);
-}
diff --git a/src/daemon/https/tls/gnutls_db.h b/src/daemon/https/tls/gnutls_db.h
deleted file mode 100644
index 9adece4e..00000000
--- a/src/daemon/https/tls/gnutls_db.h
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Copyright (C) 2000, 2001, 2002, 2003, 2004, 2005 Free Software Foundation
- *
- * Author: Nikos Mavrogiannopoulos
- *
- * This file is part of GNUTLS.
- *
- * The GNUTLS library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public License
- * as published by the Free Software Foundation; either version 2.1 of
- * the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
- * USA
- *
- */
-
-int _gnutls_server_register_current_session (gnutls_session_t session);
-int _gnutls_server_restore_session (gnutls_session_t session,
-                                    uint8_t * session_id,
-                                    int session_id_size);
-int _gnutls_db_remove_session (gnutls_session_t session, uint8_t * session_id,
-                               int session_id_size);
-int _gnutls_store_session (gnutls_session_t session,
-                           gnutls_datum_t session_id,
-                           gnutls_datum_t session_data);
-gnutls_datum_t _gnutls_retrieve_session (gnutls_session_t session,
-                                         gnutls_datum_t session_id);
-int _gnutls_remove_session (gnutls_session_t session,
-                            gnutls_datum_t session_id);
diff --git a/src/daemon/https/tls/gnutls_handshake.c b/src/daemon/https/tls/gnutls_handshake.c
index b304bdcb..5f56822e 100644
--- a/src/daemon/https/tls/gnutls_handshake.c
+++ b/src/daemon/https/tls/gnutls_handshake.c
@@ -37,7 +37,6 @@
 #include "gnutls_handshake.h"
 #include "gnutls_num.h"
 #include "gnutls_hash_int.h"
-#include "gnutls_db.h"
 #include "gnutls_extensions.h"
 #include "gnutls_supplemental.h"
 #include "gnutls_auth_int.h"
@@ -338,7 +337,7 @@ _gnutls_read_client_hello (gnutls_session_t session, opaque * data,
                            int datalen)
 {
   uint8_t session_id_len;
-  int pos = 0, ret;
+  int pos = 0, ret = 0;
   uint16_t suite_size, comp_size;
   gnutls_protocol_t adv_version;
   int neg_version;
@@ -383,10 +382,10 @@ _gnutls_read_client_hello (gnutls_session_t session, opaque * data,
     }
   DECR_LEN (len, session_id_len);
 
-  ret = _gnutls_server_restore_session (session, &data[pos], session_id_len);
   pos += session_id_len;
 
-  if (ret == 0)
+  /* TODO rm if support for resumed sessions won't be supported */
+  if (0)
     {                           /* resumed! */
       resume_copy_required_values (session);
       session->internals.resumed = RESUME_TRUE;
@@ -2647,12 +2646,6 @@ _gnutls_handshake_common (gnutls_session_t session)
       IMED_RET ("recv handshake final 2", ret);
     }
 
-  if (session->security_parameters.entity == GNUTLS_SERVER)
-    {
-      /* in order to support session resuming */
-      _gnutls_server_register_current_session (session);
-    }
-
   /* clear handshake buffer */
   _gnutls_handshake_hash_buffers_clear (session);
   return ret;
diff --git a/src/daemon/https/tls/gnutls_int.h b/src/daemon/https/tls/gnutls_int.h
index 5d30ac58..7791b554 100644
--- a/src/daemon/https/tls/gnutls_int.h
+++ b/src/daemon/https/tls/gnutls_int.h
@@ -380,7 +380,7 @@ typedef struct
 typedef struct
   {
     unsigned int priority[MAX_ALGOS];
-    unsigned int algorithms;
+    unsigned int num_algorithms;
   } priority_st;
 
 /* For the external api */
@@ -391,6 +391,8 @@ struct gnutls_priority_st
     priority_st kx;
     priority_st compression;
     priority_st protocol;
+
+    /* certificate type : x509, OpenPGP, etc. */
     priority_st cert_type;
 
     /* to disable record padding */
diff --git a/src/daemon/https/tls/gnutls_priority.c b/src/daemon/https/tls/gnutls_priority.c
index 0dfb27e3..cea6446b 100644
--- a/src/daemon/https/tls/gnutls_priority.c
+++ b/src/daemon/https/tls/gnutls_priority.c
@@ -56,7 +56,7 @@ gnutls_cipher_set_priority (gnutls_session_t session, const int *list)
     num++;
   if (num > MAX_ALGOS)
     num = MAX_ALGOS;
-  session->internals.priorities.cipher.algorithms = num;
+  session->internals.priorities.cipher.num_algorithms = num;
 
   for (i = 0; i < num; i++)
     {
@@ -75,7 +75,7 @@ _set_priority (priority_st * st, const int *list)
     num++;
   if (num > MAX_ALGOS)
     num = MAX_ALGOS;
-  st->algorithms = num;
+  st->num_algorithms = num;
 
   for (i = 0; i < num; i++)
     {
diff --git a/src/daemon/https/tls/gnutls_record.c b/src/daemon/https/tls/gnutls_record.c
index e52cf922..68c83330 100644
--- a/src/daemon/https/tls/gnutls_record.c
+++ b/src/daemon/https/tls/gnutls_record.c
@@ -35,7 +35,6 @@
 #include "gnutls_hash_int.h"
 #include "gnutls_cipher_int.h"
 #include "gnutls_algorithms.h"
-#include "gnutls_db.h"
 #include "gnutls_auth_int.h"
 #include "gnutls_num.h"
 #include "gnutls_record.h"
@@ -289,7 +288,7 @@ session_is_valid (gnutls_session_t session)
   return 0;
 }
 
-/* Copies the record version into the headers. The 
+/* Copies the record version into the headers. The
  * version must have 2 bytes at least.
  */
 inline static void
@@ -316,7 +315,7 @@ copy_record_version (gnutls_session_t session,
 /* This function behaves exactly like write(). The only difference is
  * that it accepts, the gnutls_session_t and the content_type_t of data to
  * send (if called by the user the Content is specific)
- * It is intended to transfer data, under the current session.    
+ * It is intended to transfer data, under the current session.
  *
  * Oct 30 2001: Removed capability to send data more than MAX_RECORD_SIZE.
  * This makes the function much easier to read, and more error resistant
@@ -376,7 +375,7 @@ _gnutls_send_int (gnutls_session_t session,
   else
     data2send_size = sizeofdata;
 
-  /* Only encrypt if we don't have data to send 
+  /* Only encrypt if we don't have data to send
    * from the previous run. - probably interrupted.
    */
   if (session->internals.record_send_buffer.length > 0)
@@ -469,7 +468,7 @@ _gnutls_send_int (gnutls_session_t session,
   return retval;
 }
 
-/* This function is to be called if the handshake was successfully 
+/* This function is to be called if the handshake was successfully
  * completed. This sends a Change Cipher Spec packet to the peer.
  */
 ssize_t
@@ -556,8 +555,8 @@ record_check_headers (gnutls_session_t session,
                       uint16_t * length, uint16_t * header_size)
 {
 
-  /* Read the first two bytes to determine if this is a 
-   * version 2 message 
+  /* Read the first two bytes to determine if this is a
+   * version 2 message
    */
 
   if (htype == GNUTLS_HANDSHAKE_CLIENT_HELLO && type == GNUTLS_HANDSHAKE
@@ -565,7 +564,7 @@ record_check_headers (gnutls_session_t session,
     {
 
       /* if msb set and expecting handshake message
-       * it should be SSL 2 hello 
+       * it should be SSL 2 hello
        */
       version[0] = 3;           /* assume SSL 3.0 */
       version[1] = 0;
@@ -593,7 +592,7 @@ record_check_headers (gnutls_session_t session,
       version[0] = headers[1];
       version[1] = headers[2];
 
-      /* No DECR_LEN, since headers has enough size. 
+      /* No DECR_LEN, since headers has enough size.
        */
       *length = _gnutls_read_uint16 (&headers[3]);
     }
@@ -676,7 +675,7 @@ record_check_type (gnutls_session_t session,
            */
           if (data[1] == GNUTLS_A_CLOSE_NOTIFY && data[0] != GNUTLS_AL_FATAL)
             {
-              /* If we have been expecting for an alert do 
+              /* If we have been expecting for an alert do
                */
               session->internals.read_eof = 1;
               return GNUTLS_E_INT_RET_0;        /* EOF */
@@ -911,7 +910,7 @@ begin:
     }
 
   /* Here we check if the Type of the received packet is
-   * ok. 
+   * ok.
    */
   if ((ret = check_recv_type (recv_type)) < 0)
     {
@@ -952,7 +951,7 @@ begin:
       return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
     }
 
-  /* check if we have that data into buffer. 
+  /* check if we have that data into buffer.
    */
   if ((ret = _gnutls_io_read_buffered (session, &recv_data,
                                        header_size + length, recv_type))
@@ -1017,7 +1016,7 @@ begin:
                                    read_sequence_number),
      _gnutls_packet2str (recv_type), recv_type, decrypted_length);
 
-  /* increase sequence number 
+  /* increase sequence number
    */
   if (_gnutls_uint64pp (&session->connection_state.read_sequence_number) != 0)
     {
@@ -1037,7 +1036,7 @@ begin:
       return ret;
     }
 
-  /* Get Application data from buffer 
+  /* Get Application data from buffer
    */
   if ((recv_type == type) && (type == GNUTLS_APPLICATION_DATA || type
                               == GNUTLS_HANDSHAKE
@@ -1051,7 +1050,7 @@ begin:
           return ret;
         }
 
-      /* if the buffer just got empty 
+      /* if the buffer just got empty
        */
       if (_gnutls_record_buffer_get_size (type, session) == 0)
         {
@@ -1066,11 +1065,11 @@ begin:
     {
       gnutls_assert ();
       return GNUTLS_E_UNEXPECTED_PACKET;
-      /* we didn't get what we wanted to 
+      /* we didn't get what we wanted to
        */
     }
 
-  /* (originally for) TLS 1.0 CBC protection. 
+  /* (originally for) TLS 1.0 CBC protection.
    * Actually this code is called if we just received
    * an empty packet. An empty TLS packet is usually
    * sent to protect some vulnerabilities in the CBC mode.
diff --git a/src/daemon/https/tls/gnutls_session.c b/src/daemon/https/tls/gnutls_session.c
index 541cc699..fb9b5e80 100644
--- a/src/daemon/https/tls/gnutls_session.c
+++ b/src/daemon/https/tls/gnutls_session.c
@@ -24,7 +24,7 @@
 #include "gnutls_int.h"
 #include "gnutls_errors.h"
 #include "debug.h"
-#include <gnutls_session_pack.h>
+#include "gnutls_session_pack.h"
 #include <gnutls_datum.h>
 
 /**
@@ -123,10 +123,10 @@ gnutls_session_get_data2 (gnutls_session_t session, gnutls_datum_t * data)
   *
   * Returns the current session id. This can be used if you want to check if
   * the next session you tried to resume was actually resumed.
-  * This is because resumed sessions have the same sessionID with the 
+  * This is because resumed sessions have the same sessionID with the
   * original session.
   *
-  * Session id is some data set by the server, that identify the current session. 
+  * Session id is some data set by the server, that identify the current session.
   * In TLS 1.0 and SSL 3.0 session id is always less than 32 bytes.
   *
   * Returns zero on success.
diff --git a/src/daemon/https/tls/gnutls_session_pack.c b/src/daemon/https/tls/gnutls_session_pack.c
index ed4945b6..3e549c4c 100644
--- a/src/daemon/https/tls/gnutls_session_pack.c
+++ b/src/daemon/https/tls/gnutls_session_pack.c
@@ -54,6 +54,169 @@ static int unpack_security_parameters (gnutls_session_t session,
 static int pack_security_parameters (gnutls_session_t session,
                                      gnutls_datum_t * packed_session);
 
+/* Packs the ANON session authentication data. */
+#ifdef ENABLE_ANON
+
+/* Format:
+ *      1 byte the credentials type
+ *      4 bytes the size of the whole structure
+ *      2 bytes the size of secret key in bits
+ *      4 bytes the size of the prime
+ *      x bytes the prime
+ *      4 bytes the size of the generator
+ *      x bytes the generator
+ *      4 bytes the size of the public key
+ *      x bytes the public key
+ */
+static int
+pack_anon_auth_info (gnutls_session_t session, gnutls_datum_t * packed_session)
+{
+  anon_auth_info_t info = _gnutls_get_auth_info (session);
+  int pos = 0;
+  size_t pack_size;
+
+  if (info)
+    pack_size = 2 + 4 * 3 + info->dh.prime.size +
+      info->dh.generator.size + info->dh.public_key.size;
+  else
+    pack_size = 0;
+
+  packed_session->size = PACK_HEADER_SIZE + pack_size + sizeof (uint32_t);
+
+  /* calculate the size and allocate the data.
+   */
+  packed_session->data =
+    gnutls_malloc (packed_session->size + MAX_SEC_PARAMS);
+
+  if (packed_session->data == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_MEMORY_ERROR;
+    }
+
+  packed_session->data[0] = MHD_GNUTLS_CRD_ANON;
+  _gnutls_write_uint32 (pack_size, &packed_session->data[PACK_HEADER_SIZE]);
+  pos += 4 + PACK_HEADER_SIZE;
+
+  if (pack_size > 0)
+    {
+      _gnutls_write_uint16 (info->dh.secret_bits, &packed_session->data[pos]);
+      pos += 2;
+
+      _gnutls_write_datum32 (&packed_session->data[pos], info->dh.prime);
+      pos += 4 + info->dh.prime.size;
+      _gnutls_write_datum32 (&packed_session->data[pos], info->dh.generator);
+      pos += 4 + info->dh.generator.size;
+      _gnutls_write_datum32 (&packed_session->data[pos], info->dh.public_key);
+      pos += 4 + info->dh.public_key.size;
+
+    }
+
+  return 0;
+}
+
+/* Format:
+ *      1 byte the credentials type
+ *      4 bytes the size of the whole structure
+ *      2 bytes the size of secret key in bits
+ *      4 bytes the size of the prime
+ *      x bytes the prime
+ *      4 bytes the size of the generator
+ *      x bytes the generator
+ *      4 bytes the size of the public key
+ *      x bytes the public key
+ */
+static int
+unpack_anon_auth_info (gnutls_session_t session,
+                       const gnutls_datum_t * packed_session)
+{
+  size_t pack_size;
+  int pos = 0, size, ret;
+  anon_auth_info_t info;
+
+  if (packed_session->data[0] != MHD_GNUTLS_CRD_ANON)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  pack_size = _gnutls_read_uint32 (&packed_session->data[PACK_HEADER_SIZE]);
+  pos += PACK_HEADER_SIZE + 4;
+
+
+  if (pack_size == 0)
+    return 0;                   /* nothing to be done */
+
+  /* a simple check for integrity */
+  if (pack_size + PACK_HEADER_SIZE + 4 > packed_session->size)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INVALID_REQUEST;
+    }
+
+  /* client and serer have the same auth_info here
+   */
+  ret =
+    _gnutls_auth_info_set (session, MHD_GNUTLS_CRD_ANON,
+                           sizeof (anon_auth_info_st), 1);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      return ret;
+    }
+
+  info = _gnutls_get_auth_info (session);
+  if (info == NULL)
+    {
+      gnutls_assert ();
+      return GNUTLS_E_INTERNAL_ERROR;
+    }
+
+  info->dh.secret_bits = _gnutls_read_uint16 (&packed_session->data[pos]);
+  pos += 2;
+
+  size = _gnutls_read_uint32 (&packed_session->data[pos]);
+  pos += 4;
+  ret = _gnutls_set_datum (&info->dh.prime, &packed_session->data[pos], size);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+  pos += size;
+
+  size = _gnutls_read_uint32 (&packed_session->data[pos]);
+  pos += 4;
+  ret =
+    _gnutls_set_datum (&info->dh.generator, &packed_session->data[pos], size);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+  pos += size;
+
+  size = _gnutls_read_uint32 (&packed_session->data[pos]);
+  pos += 4;
+  ret =
+    _gnutls_set_datum (&info->dh.public_key, &packed_session->data[pos],
+                       size);
+  if (ret < 0)
+    {
+      gnutls_assert ();
+      goto error;
+    }
+  pos += size;
+
+  return 0;
+
+error:
+  _gnutls_free_datum (&info->dh.prime);
+  _gnutls_free_datum (&info->dh.generator);
+  _gnutls_free_datum (&info->dh.public_key);
+  return ret;
+}
+#endif /* ANON */
 
 /* Since auth_info structures contain malloced data, this function
  * is required in order to pack these structures in a vector in
@@ -121,7 +284,7 @@ _gnutls_session_pack (gnutls_session_t session,
 
     }
 
-  /* Auth_info structures copied. Now copy security_parameters_st. 
+  /* Auth_info structures copied. Now copy security_parameters_st.
    * packed_session must have allocated space for the security parameters.
    */
   ret = pack_security_parameters (session, packed_session);
@@ -201,7 +364,7 @@ _gnutls_session_unpack (gnutls_session_t session,
 
     }
 
-  /* Auth_info structures copied. Now copy security_parameters_st. 
+  /* Auth_info structures copied. Now copy security_parameters_st.
    * packed_session must have allocated space for the security parameters.
    */
   ret = unpack_security_parameters (session, packed_session);
@@ -477,7 +640,7 @@ error:
 /* Packs the SRP session authentication data.
  */
 
-/* Format: 
+/* Format:
  *      1 byte the credentials type
  *      4 bytes the size of the SRP username (x)
  *      x bytes the SRP username
@@ -569,167 +732,12 @@ unpack_srp_auth_info (gnutls_session_t session,
 #endif
 
 
-#ifdef ENABLE_ANON
-/* Packs the ANON session authentication data.
- */
-
-/* Format: 
- *      1 byte the credentials type
- *      4 bytes the size of the whole structure
- *      2 bytes the size of secret key in bits
- *      4 bytes the size of the prime
- *      x bytes the prime
- *      4 bytes the size of the generator
- *      x bytes the generator
- *      4 bytes the size of the public key
- *      x bytes the public key
- */
-static int
-pack_anon_auth_info (gnutls_session_t session,
-                     gnutls_datum_t * packed_session)
-{
-  anon_auth_info_t info = _gnutls_get_auth_info (session);
-  int pos = 0;
-  size_t pack_size;
-
-  if (info)
-    pack_size = 2 + 4 * 3 + info->dh.prime.size +
-      info->dh.generator.size + info->dh.public_key.size;
-  else
-    pack_size = 0;
-
-  packed_session->size = PACK_HEADER_SIZE + pack_size + sizeof (uint32_t);
-
-  /* calculate the size and allocate the data.
-   */
-  packed_session->data =
-    gnutls_malloc (packed_session->size + MAX_SEC_PARAMS);
-
-  if (packed_session->data == NULL)
-    {
-      gnutls_assert ();
-      return GNUTLS_E_MEMORY_ERROR;
-    }
-
-  packed_session->data[0] = MHD_GNUTLS_CRD_ANON;
-  _gnutls_write_uint32 (pack_size, &packed_session->data[PACK_HEADER_SIZE]);
-  pos += 4 + PACK_HEADER_SIZE;
-
-  if (pack_size > 0)
-    {
-      _gnutls_write_uint16 (info->dh.secret_bits, &packed_session->data[pos]);
-      pos += 2;
-
-      _gnutls_write_datum32 (&packed_session->data[pos], info->dh.prime);
-      pos += 4 + info->dh.prime.size;
-      _gnutls_write_datum32 (&packed_session->data[pos], info->dh.generator);
-      pos += 4 + info->dh.generator.size;
-      _gnutls_write_datum32 (&packed_session->data[pos], info->dh.public_key);
-      pos += 4 + info->dh.public_key.size;
-
-    }
-
-  return 0;
-}
-
-
-static int
-unpack_anon_auth_info (gnutls_session_t session,
-                       const gnutls_datum_t * packed_session)
-{
-  size_t pack_size;
-  int pos = 0, size, ret;
-  anon_auth_info_t info;
-
-  if (packed_session->data[0] != MHD_GNUTLS_CRD_ANON)
-    {
-      gnutls_assert ();
-      return GNUTLS_E_INVALID_REQUEST;
-    }
-
-  pack_size = _gnutls_read_uint32 (&packed_session->data[PACK_HEADER_SIZE]);
-  pos += PACK_HEADER_SIZE + 4;
-
-
-  if (pack_size == 0)
-    return 0;                   /* nothing to be done */
-
-  /* a simple check for integrity */
-  if (pack_size + PACK_HEADER_SIZE + 4 > packed_session->size)
-    {
-      gnutls_assert ();
-      return GNUTLS_E_INVALID_REQUEST;
-    }
-
-  /* client and serer have the same auth_info here
-   */
-  ret =
-    _gnutls_auth_info_set (session, MHD_GNUTLS_CRD_ANON,
-                           sizeof (anon_auth_info_st), 1);
-  if (ret < 0)
-    {
-      gnutls_assert ();
-      return ret;
-    }
-
-  info = _gnutls_get_auth_info (session);
-  if (info == NULL)
-    {
-      gnutls_assert ();
-      return GNUTLS_E_INTERNAL_ERROR;
-    }
-
-  info->dh.secret_bits = _gnutls_read_uint16 (&packed_session->data[pos]);
-  pos += 2;
-
-  size = _gnutls_read_uint32 (&packed_session->data[pos]);
-  pos += 4;
-  ret = _gnutls_set_datum (&info->dh.prime, &packed_session->data[pos], size);
-  if (ret < 0)
-    {
-      gnutls_assert ();
-      goto error;
-    }
-  pos += size;
-
-  size = _gnutls_read_uint32 (&packed_session->data[pos]);
-  pos += 4;
-  ret =
-    _gnutls_set_datum (&info->dh.generator, &packed_session->data[pos], size);
-  if (ret < 0)
-    {
-      gnutls_assert ();
-      goto error;
-    }
-  pos += size;
-
-  size = _gnutls_read_uint32 (&packed_session->data[pos]);
-  pos += 4;
-  ret =
-    _gnutls_set_datum (&info->dh.public_key, &packed_session->data[pos],
-                       size);
-  if (ret < 0)
-    {
-      gnutls_assert ();
-      goto error;
-    }
-  pos += size;
-
-  return 0;
-
-error:
-  _gnutls_free_datum (&info->dh.prime);
-  _gnutls_free_datum (&info->dh.generator);
-  _gnutls_free_datum (&info->dh.public_key);
-  return ret;
-}
-#endif /* ANON */
 
 #ifdef ENABLE_PSK
 /* Packs the PSK session authentication data.
  */
 
-/* Format: 
+/* Format:
  *      1 byte the credentials type
  *      4 bytes the size of the whole structure
  *      4 bytes the size of the PSK username (x)
@@ -909,7 +917,7 @@ error:
 /* Packs the security parameters.
  */
 
-/* Format: 
+/* Format:
  *      4 bytes the total security data size
  *      1 byte the entity type (client/server)
  *      1 byte the key exchange algorithm used
@@ -947,7 +955,7 @@ error:
  *
  *      2 bytes the number of server name extensions (up to MAX_SERVER_NAME_EXTENSIONS)
  *      1 byte the first name type
- *      2 bytes the size of the first name 
+ *      2 bytes the size of the first name
  *      x bytes the first name (MAX_SERVER_NAME_SIZE)
  *       and so on...
  *
diff --git a/src/daemon/https/tls/gnutls_state.c b/src/daemon/https/tls/gnutls_state.c
index 3fde3db4..3931b393 100644
--- a/src/daemon/https/tls/gnutls_state.c
+++ b/src/daemon/https/tls/gnutls_state.c
@@ -32,7 +32,6 @@
 #include <gnutls_auth_int.h>
 #include <gnutls_num.h>
 #include <gnutls_datum.h>
-#include <gnutls_db.h>
 #include <gnutls_record.h>
 #include <gnutls_handshake.h>
 #include <gnutls_dh.h>
@@ -154,11 +153,11 @@ _gnutls_session_cert_type_supported (gnutls_session_t session,
         }
     }
 
-  if (session->internals.priorities.cert_type.algorithms == 0 && cert_type
+  if (session->internals.priorities.cert_type.num_algorithms == 0 && cert_type
       == DEFAULT_CERT_TYPE)
     return 0;
 
-  for (i = 0; i < session->internals.priorities.cert_type.algorithms; i++)
+  for (i = 0; i < session->internals.priorities.cert_type.num_algorithms; i++)
     {
       if (session->internals.priorities.cert_type.priority[i] == cert_type)
         {
diff --git a/src/daemon/https/tls/gnutls_x509.c b/src/daemon/https/tls/gnutls_x509.c
index 7c84fa0a..a9b6829d 100644
--- a/src/daemon/https/tls/gnutls_x509.c
+++ b/src/daemon/https/tls/gnutls_x509.c
@@ -93,9 +93,9 @@ check_bits (gnutls_x509_crt_t crt, unsigned int max_bits)
   * _gnutls_x509_cert_verify_peers - This function returns the peer's certificate status
   * @session: is a gnutls session
   *
-  * This function will try to verify the peer's certificate and return its status (TRUSTED, REVOKED etc.). 
+  * This function will try to verify the peer's certificate and return its status (TRUSTED, REVOKED etc.).
   * The return value (status) should be one of the gnutls_certificate_status_t enumerated elements.
-  * However you must also check the peer's name in order to check if the verified certificate belongs to the 
+  * However you must also check the peer's name in order to check if the verified certificate belongs to the
   * actual peer. Returns a negative error code in case of an error, or GNUTLS_E_NO_CERTIFICATE_FOUND if no certificate was sent.
   *
   -*/
@@ -178,7 +178,7 @@ _gnutls_x509_cert_verify_peers (gnutls_session_t session,
 
     }
 
-  /* Verify certificate 
+  /* Verify certificate
    */
   ret =
     gnutls_x509_crt_list_verify (peer_certificate_list,
@@ -522,7 +522,7 @@ parse_pem_cert_mem (gnutls_cert ** cert_list, unsigned *ncerts,
         }
       _gnutls_free_datum (&tmp);        /* free ptr2 */
 
-      /* now we move ptr after the pem header 
+      /* now we move ptr after the pem header
        */
       ptr++;
       /* find the next certificate (if any)
@@ -794,18 +794,18 @@ read_key_file (gnutls_certificate_credentials_t res,
   * @key: is the private key, or %NULL
   * @type: is PEM or DER
   *
-  * This function sets a certificate/private key pair in the 
+  * This function sets a certificate/private key pair in the
   * gnutls_certificate_credentials_t structure. This function may be called
   * more than once (in case multiple keys/certificates exist for the
   * server).
   *
-  * Currently are supported: RSA PKCS-1 encoded private keys, 
+  * Currently are supported: RSA PKCS-1 encoded private keys,
   * DSA private keys.
   *
   * DSA private keys are encoded the OpenSSL way, which is an ASN.1
   * DER sequence of 6 INTEGERs - version, p, q, g, pub, priv.
   *
-  * Note that the keyUsage (2.5.29.15) PKIX extension in X.509 certificates 
+  * Note that the keyUsage (2.5.29.15) PKIX extension in X.509 certificates
   * is supported. This means that certificates intended for signing cannot
   * be used for ciphersuites that require encryption.
   *
@@ -825,7 +825,7 @@ gnutls_certificate_set_x509_key_mem (gnutls_certificate_credentials_t
 {
   int ret;
 
-  /* this should be first 
+  /* this should be first
    */
   if ((ret = read_key_mem (res, key ? key->data : NULL,
                            key ? key->size : 0, type)) < 0)
@@ -867,7 +867,7 @@ gnutls_certificate_set_x509_key (gnutls_certificate_credentials_t res,
 {
   int ret, i;
 
-  /* this should be first 
+  /* this should be first
    */
 
   res->pkey =
@@ -956,7 +956,7 @@ gnutls_certificate_set_x509_key_file (gnutls_certificate_credentials_t
 {
   int ret;
 
-  /* this should be first 
+  /* this should be first
    */
   if ((ret = read_key_file (res, KEYFILE, type)) < 0)
     return ret;
@@ -983,7 +983,7 @@ generate_rdn_seq (gnutls_certificate_credentials_t res)
   unsigned size, i;
   opaque *pdata;
 
-  /* Generate the RDN sequence 
+  /* Generate the RDN sequence
    * This will be sent to clients when a certificate
    * request message is sent.
    */
@@ -1036,11 +1036,8 @@ generate_rdn_seq (gnutls_certificate_credentials_t res)
   return 0;
 }
 
-
-
-
-/* Returns 0 if it's ok to use the gnutls_kx_algorithm_t with this 
- * certificate (uses the KeyUsage field). 
+/* Returns 0 if it's ok to use the gnutls_kx_algorithm_t with this
+ * certificate (uses the KeyUsage field).
  */
 int
 _gnutls_check_key_usage (const gnutls_cert * cert, gnutls_kx_algorithm_t alg)
@@ -1158,7 +1155,7 @@ parse_pem_ca_mem (gnutls_x509_crt_t ** cert_list, unsigned *ncerts,
           return ret;
         }
 
-      /* now we move ptr after the pem header 
+      /* now we move ptr after the pem header
        */
       ptr++;
       size--;
@@ -1452,7 +1449,7 @@ parse_pem_crl_mem (gnutls_x509_crl_t ** crl_list, unsigned *ncrls,
           return ret;
         }
 
-      /* now we move ptr after the pem header 
+      /* now we move ptr after the pem header
        */
       ptr++;
       /* find the next certificate (if any)
diff --git a/src/daemon/https/x509/pkcs12.h b/src/daemon/https/x509/pkcs12.h
index 41878ff2..3c75dff5 100644
--- a/src/daemon/https/x509/pkcs12.h
+++ b/src/daemon/https/x509/pkcs12.h
@@ -23,7 +23,6 @@
  */
 
 /* TODO clean */
-
 #ifndef GNUTLS_PKCS12_H
 #define GNUTLS_PKCS12_H
 
diff --git a/src/daemon/internal.h b/src/daemon/internal.h
index 612b18da..796e5ad1 100644
--- a/src/daemon/internal.h
+++ b/src/daemon/internal.h
@@ -627,8 +627,13 @@ struct MHD_Daemon
   unsigned short port;
 
 #if HTTPS_SUPPORT
-  /* server credintials */
-  gnutls_certificate_credentials_t x509_cret;
+  gnutls_credentials_type_t cred_type;
+
+  /* server x509 credintials */
+  gnutls_certificate_credentials_t x509_cred;
+
+  /* credentials used for anonymous authentication */
+  gnutls_anon_server_credentials_t anon_cred;
 
   /* cipher priority cache */
   gnutls_priority_t priority_cache;
diff --git a/src/include/microhttpd.h b/src/include/microhttpd.h
index a934c16e..8a1fe022 100644
--- a/src/include/microhttpd.h
+++ b/src/include/microhttpd.h
@@ -64,8 +64,6 @@
  * depend on your platform; for possible suggestions consult
  * "platform.h" in the MHD distribution).
  *
- * TODO:
- * - Add option codes for SSL support
  */
 
 #ifndef MHD_MICROHTTPD_H
@@ -380,6 +378,13 @@ enum MHD_OPTION
   MHD_OPTION_HTTPS_MEM_CERT,
 
   /*
+   * daemon credentials type. either certificate or anonymous,
+   * this option should be followed by one of the values listed in
+   * gnutls_credentials_type_t.
+   */
+  MHD_OPTION_CRED_TYPE,
+
+  /*
    * SSL/TLS protocol version
    *
    * Memory pointer to a zero terminated int array representing the
@@ -714,11 +719,17 @@ typedef int
  */
 struct MHD_Daemon *
 MHD_start_daemon_va (unsigned int options,
-                     unsigned short port,
+                     unsigned short port, char * ip,
                      MHD_AcceptPolicyCallback apc,
                      void *apc_cls,
                      MHD_AccessHandlerCallback dh, void *dh_cls, va_list ap);
 
+struct MHD_Daemon *
+MHD_start_daemon_ip (unsigned int options,
+                           unsigned short port, char *ip,
+                           MHD_AcceptPolicyCallback apc,
+                           void *apc_cls,
+                           MHD_AccessHandlerCallback dh, void *dh_cls, ...);
 
 /*
  * Variadic version of MHD_start_daemon_va. This function will delegate calls
@@ -1025,6 +1036,7 @@ typedef enum
   MHD_GNUTLS_KX_SRP_DSS
 } gnutls_kx_algorithm_t;
 
+/* server credentials type */
 typedef enum
 {
   MHD_GNUTLS_CRD_CERTIFICATE = 1,
@@ -1034,6 +1046,7 @@ typedef enum
   MHD_GNUTLS_CRD_IA
 } gnutls_credentials_type_t;
 
+/* mac algorithm */
 typedef enum
 {
   MHD_GNUTLS_MAC_UNKNOWN = 0,
@@ -1056,7 +1069,7 @@ typedef enum
   MHD_GNUTLS_DIG_SHA256 = MHD_GNUTLS_MAC_SHA256
 } gnutls_digest_algorithm_t;
 
-
+/* compression method */
 typedef enum
 {
   MHD_GNUTLS_COMP_UNKNOWN = 0,
@@ -1067,6 +1080,7 @@ typedef enum
                                  */
 } gnutls_compression_method_t;
 
+/* protocol type */
 typedef enum
 {
   MHD_GNUTLS_SSL3 = 1,
@@ -1076,6 +1090,7 @@ typedef enum
   MHD_GNUTLS_VERSION_UNKNOWN = 0xff
 } gnutls_protocol_t;
 
+/* certificate_type */
 typedef enum
 {
   MHD_GNUTLS_CRT_UNKNOWN = 0,
diff --git a/src/testcurl/https/tls_alert_test.c b/src/testcurl/https/tls_alert_test.c
index 67b489b7..4c8b482d 100644
--- a/src/testcurl/https/tls_alert_test.c
+++ b/src/testcurl/https/tls_alert_test.c
@@ -62,7 +62,7 @@ setup (gnutls_session_t * session,
        gnutls_datum_t * cert, gnutls_certificate_credentials_t * xcred)
 {
   int ret;
-  const char **err_pos;
+  const char ** err_pos;
 
   gnutls_certificate_allocate_credentials (xcred);
 
diff --git a/src/testcurl/https/tls_authentication_test.c b/src/testcurl/https/tls_authentication_test.c
index a12ce93f..58d95cf1 100644
--- a/src/testcurl/https/tls_authentication_test.c
+++ b/src/testcurl/https/tls_authentication_test.c
@@ -39,10 +39,12 @@
 
 extern int curl_check_version (const char *req_version, ...);
 
+const int DEBUG_GNUTLS_LOG_LEVEL = 6;
 const char *ca_cert_file_name = "ca_cert_pem";
 const char *test_file_name = "https_test_file";
 const char test_file_data[] = "Hello World\n";
 
+
 struct CBC
 {
   char *buf;
@@ -173,8 +175,8 @@ test_daemon_get (FILE * test_fd, char *cipher_suite, int proto_version)
 #endif
   curl_easy_setopt (c, CURLOPT_URL, url);
   curl_easy_setopt (c, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_0);
-  curl_easy_setopt (c, CURLOPT_TIMEOUT, 3L);
-  curl_easy_setopt (c, CURLOPT_CONNECTTIMEOUT, 3L);
+  curl_easy_setopt (c, CURLOPT_TIMEOUT, 10L);
+  curl_easy_setopt (c, CURLOPT_CONNECTTIMEOUT, 10L);
   curl_easy_setopt (c, CURLOPT_WRITEFUNCTION, &copyBuffer);
   curl_easy_setopt (c, CURLOPT_FILE, &cbc);
 
@@ -224,14 +226,13 @@ test_secure_get (FILE * test_fd, char *cipher_suite, int proto_version)
 {
   int ret;
   struct MHD_Daemon *d;
-  int kx[] = { MHD_GNUTLS_KX_DHE_RSA, 0 };
 
-  d = MHD_start_daemon (MHD_USE_THREAD_PER_CONNECTION | MHD_USE_SSL |
+  d = MHD_start_daemon(MHD_USE_THREAD_PER_CONNECTION | MHD_USE_SSL |
                         MHD_USE_DEBUG, 42433,
                         NULL, NULL, &http_ahc, NULL,
                         MHD_OPTION_HTTPS_MEM_KEY, srv_signed_key_pem,
                         MHD_OPTION_HTTPS_MEM_CERT, srv_signed_cert_pem,
-                        MHD_OPTION_KX_PRIORITY, kx, MHD_OPTION_END);
+                        MHD_OPTION_END);
 
   if (d == NULL)
     {
@@ -308,7 +309,7 @@ main (int argc, char *const *argv)
   FILE *test_fd;
   unsigned int errorCount = 0;
 
-  /* gnutls_global_set_log_level (11); */
+  gnutls_global_set_log_level (DEBUG_GNUTLS_LOG_LEVEL);
 
   if (curl_check_version (MHD_REQ_CURL_VERSION))
     {
@@ -330,7 +331,7 @@ main (int argc, char *const *argv)
     }
 
   errorCount +=
-    test_secure_get (test_fd, "AES256-SHA", CURL_SSLVERSION_SSLv3);
+    test_secure_get (test_fd, "AES256-SHA", CURL_SSLVERSION_TLSv1);
 
   if (errorCount != 0)
     fprintf (stderr, "Failed test: %s.\n", argv[0]);
diff --git a/src/testcurl/https/tls_daemon_options_test.c b/src/testcurl/https/tls_daemon_options_test.c
index 95accebb..59205199 100644
--- a/src/testcurl/https/tls_daemon_options_test.c
+++ b/src/testcurl/https/tls_daemon_options_test.c
@@ -32,6 +32,7 @@
 #include "gnutls.h"
 #include <curl/curl.h>
 
+#define DEBUG_CURL_VERBOSE 0
 #define PAGE_NOT_FOUND "<html><head><title>File not found</title></head><body>File not found</body></html>"
 
 #define MHD_E_MEM "Error: memory error\n"
@@ -42,6 +43,7 @@
 
 #include "tls_test_keys.h"
 
+const int DEBUG_GNUTLS_LOG_LEVEL = 0;
 const char *test_file_name = "https_test_file";
 const char test_file_data[] = "Hello World\n";
 
@@ -123,7 +125,7 @@ http_ahc (void *cls, struct MHD_Connection *connection,
  * @param test_fd: file to attempt transfering
  */
 static int
-test_https_transfer (FILE * test_fd, char * cipher_suite, int proto_version)
+test_https_transfer (FILE * test_fd, char *cipher_suite, int proto_version)
 {
   CURL *c;
   CURLcode errornum;
@@ -172,7 +174,7 @@ test_https_transfer (FILE * test_fd, char * cipher_suite, int proto_version)
            doc_path, test_file_name);
 
   c = curl_easy_init ();
-#ifdef DEBUG
+#if DEBUG_CURL_VERBOSE
   curl_easy_setopt (c, CURLOPT_VERBOSE, 1);
 #endif
   curl_easy_setopt (c, CURLOPT_URL, url);
@@ -249,14 +251,11 @@ setupTestFile ()
 }
 
 static int
-setup (struct MHD_Daemon **d, enum MHD_OPTION option, void * value )
+setup (struct MHD_Daemon **d, va_list arg_list)
 {
-  *d = MHD_start_daemon (MHD_USE_THREAD_PER_CONNECTION | MHD_USE_SSL |
-                         MHD_USE_DEBUG, 42433,
-                         NULL, NULL, &http_ahc, NULL,
-                         MHD_OPTION_HTTPS_MEM_KEY, srv_key_pem,
-                         MHD_OPTION_HTTPS_MEM_CERT, srv_self_signed_cert_pem,
-                         option, value, MHD_OPTION_END);
+  *d = MHD_start_daemon_va (MHD_USE_THREAD_PER_CONNECTION | MHD_USE_SSL |
+                            MHD_USE_DEBUG, 42433, "127.0.0.1",
+                            NULL, NULL, &http_ahc, NULL, arg_list);
 
   if (*d == NULL)
     {
@@ -273,19 +272,37 @@ teardown (struct MHD_Daemon *d)
   MHD_stop_daemon (d);
 }
 
+/* TODO test_wrap: change sig to (setup_func, test, va_list test_arg) & move to test_util.c */
 int
-test_wrap (int
+test_wrap (char *test_name, int
            (*test) (FILE * test_fd, char *cipher_suite, int proto_version),
-           FILE * test_fd, char *cipher_suite, int proto_version,
-           enum MHD_OPTION option, void * value)
+           FILE * test_fd, char *cipher_suite, int proto_version, ...)
 {
   int ret;
+  va_list arg_list;
   struct MHD_Daemon *d;
 
-  if (setup (&d, option, value) != 0)
-    return -1;
+  va_start (arg_list, proto_version);
+  if (setup (&d, arg_list) != 0)
+    {
+      va_end (arg_list);
+      return -1;
+    }
+
+  fprintf (stdout, "running test: %s ", test_name);
   ret = test (test_fd, cipher_suite, proto_version);
+
+  if (ret == 0)
+    {
+      fprintf (stdout, "[pass]\n");
+    }
+  else
+    {
+      fprintf (stdout, "[fail]\n");
+    }
+
   teardown (d);
+  va_end (arg_list);
   return ret;
 }
 
@@ -336,6 +353,9 @@ test_file_certificates (FILE * test_fd, char *cipher_suite, int proto_version)
   return ret;
 }
 
+/*
+ * test server refuses to negotiate connections with unsupported protocol versions
+ */
 int
 test_protocol_version (FILE * test_fd, char *cipher_suite,
                        int curl_proto_version)
@@ -344,7 +364,7 @@ test_protocol_version (FILE * test_fd, char *cipher_suite,
   CURLcode errornum;
 
   c = curl_easy_init ();
-#ifdef DEBUG
+#if DEBUG_CURL_VERBOSE
   curl_easy_setopt (c, CURLOPT_VERBOSE, 1);
 #endif
   curl_easy_setopt (c, CURLOPT_URL, "https://localhost:42433/");
@@ -384,7 +404,7 @@ main (int argc, char *const *argv)
   FILE *test_fd;
   unsigned int errorCount = 0;
 
-  gnutls_global_set_log_level(11);
+  gnutls_global_set_log_level (DEBUG_GNUTLS_LOG_LEVEL);
 
   if (curl_check_version (MHD_REQ_CURL_VERSION))
     {
@@ -403,54 +423,61 @@ main (int argc, char *const *argv)
       return -1;
     }
 
-  int mac[] = {MHD_GNUTLS_MAC_SHA1, 0};
-  int p [] = {MHD_GNUTLS_SSL3, 0};
+  int mac[] = { MHD_GNUTLS_MAC_SHA1, 0 };
+  int p[] = { MHD_GNUTLS_SSL3, 0 };
   int cipher[] = { MHD_GNUTLS_CIPHER_3DES_CBC, 0 };
-  int kx[] = { MHD_GNUTLS_KX_DHE_RSA, 0 };
-
-
-//  errorCount +=
-//    test_wrap (&test_https_transfer, test_fd, "AES256-SHA",
-//               CURL_SSLVERSION_TLSv1, MHD_OPTION_END, 0);
-//  errorCount +=
-//    test_wrap (&test_file_certificates, test_fd, "AES256-SHA",
-//               CURL_SSLVERSION_TLSv1, MHD_OPTION_END, 0);
-//
-//  errorCount +=
-//    test_wrap (&test_protocol_version, test_fd, "AES256-SHA",
-//               CURL_SSLVERSION_TLSv1, MHD_OPTION_PROTOCOL_VERSION, p);
-//
-//  errorCount +=
-//     test_wrap (&test_https_transfer, test_fd, "DES-CBC3-SHA",
-//                CURL_SSLVERSION_TLSv1, MHD_OPTION_CIPHER_ALGORITHM, cipher);
+  int kx[] = { MHD_GNUTLS_KX_ANON_DH, 0 };
 
   errorCount +=
-          test_wrap (&test_https_transfer, test_fd, "AES256-SHA",
-                    CURL_SSLVERSION_TLSv1, MHD_OPTION_MAC_ALGO, mac);
-
-  //  errorCount +=
-  //         test_wrap (&test_https_transfer, test_fd, "EDH-RSA-DES-CBC3-SHA",
-  //                    CURL_SSLVERSION_TLSv1, MHD_OPTION_KX_PRIORITY, kx);
+    test_wrap ("https_transfer", &test_https_transfer, test_fd, "AES256-SHA",
+               CURL_SSLVERSION_TLSv1,
+               MHD_OPTION_HTTPS_MEM_KEY, srv_key_pem,
+               MHD_OPTION_HTTPS_MEM_CERT, srv_self_signed_cert_pem,
+               MHD_OPTION_END);
+  errorCount +=
+    test_wrap ("file certificates", &test_file_certificates, test_fd,
+               "AES256-SHA", CURL_SSLVERSION_TLSv1, MHD_OPTION_HTTPS_MEM_KEY,
+               srv_key_pem, MHD_OPTION_HTTPS_MEM_CERT,
+               srv_self_signed_cert_pem, MHD_OPTION_END);
+  errorCount +=
+    test_wrap ("protocol_version", &test_protocol_version, test_fd,
+               "AES256-SHA", CURL_SSLVERSION_TLSv1, MHD_OPTION_HTTPS_MEM_KEY,
+               srv_key_pem, MHD_OPTION_HTTPS_MEM_CERT,
+               srv_self_signed_cert_pem, MHD_OPTION_PROTOCOL_VERSION, p,
+               MHD_OPTION_END);
+  errorCount +=
+    test_wrap ("cipher DES-CBC3-SHA", &test_https_transfer, test_fd,
+               "DES-CBC3-SHA", CURL_SSLVERSION_TLSv1,
+               MHD_OPTION_HTTPS_MEM_KEY, srv_key_pem,
+               MHD_OPTION_HTTPS_MEM_CERT, srv_self_signed_cert_pem,
+               MHD_OPTION_CIPHER_ALGORITHM, cipher, MHD_OPTION_END);
+  errorCount +=
+    test_wrap ("mac SH1", &test_https_transfer, test_fd, "AES256-SHA",
+               CURL_SSLVERSION_TLSv1, MHD_OPTION_HTTPS_MEM_KEY, srv_key_pem,
+               MHD_OPTION_HTTPS_MEM_CERT, srv_self_signed_cert_pem,
+               MHD_OPTION_MAC_ALGO, mac, MHD_OPTION_END);
+  errorCount +=
+    test_wrap ("kx ANON_DH", &test_https_transfer, test_fd,
+               "ADH-DES-CBC3-SHA", CURL_SSLVERSION_TLSv1,
+               MHD_OPTION_HTTPS_MEM_KEY, srv_key_pem,
+               MHD_OPTION_HTTPS_MEM_CERT, srv_self_signed_cert_pem,
+               MHD_OPTION_CRED_TYPE, MHD_GNUTLS_CRD_ANON,
+               MHD_OPTION_CIPHER_ALGORITHM, cipher, MHD_OPTION_KX_PRIORITY,
+               kx, MHD_OPTION_END);
 
   /*gnutls_mac_algorithm_t mac[] = {
-                                  {MHD_GNUTLS_MAC_MD5, 0}, 0};
-  gnutls_mac_algorithm_t * cur_mac;
-
-  for ( cur_mac = &mac[0]; (*cur_mac) != 0; cur_mac++ ){
-    option[0] = MHD_GNUTLS_MAC_SHA1;
-    errorCount +=
-        test_wrap (&test_https_transfer, test_fd, "AES256-SHA",
-                  CURL_SSLVERSION_TLSv1, MHD_OPTION_MAC_ALGO, option);
-  }*/
-
+     {MHD_GNUTLS_MAC_MD5, 0}, 0};
+     gnutls_mac_algorithm_t * cur_mac;
 
+     for ( cur_mac = &mac[0]; (*cur_mac) != 0; cur_mac++ ){
+     option[0] = MHD_GNUTLS_MAC_SHA1;
+     errorCount +=
+     test_wrap (&test_https_transfer, test_fd, "AES256-SHA",
+     CURL_SSLVERSION_TLSv1, MHD_OPTION_MAC_ALGO, option);
+     } */
 
   if (errorCount != 0)
     fprintf (stderr, "Failed test: %s.\n", argv[0]);
-  else
-    {
-      fprintf (stderr, "ok\n");
-    }
 
   curl_global_cleanup ();
   fclose (test_fd);
diff --git a/src/testcurl/https/tls_session_time_out_test.c b/src/testcurl/https/tls_session_time_out_test.c
index 846bdd10..745c8d53 100644
--- a/src/testcurl/https/tls_session_time_out_test.c
+++ b/src/testcurl/https/tls_session_time_out_test.c
@@ -101,7 +101,6 @@ static int
 test_tls_session_time_out (gnutls_session_t session)
 {
   int sd, ret;
-  char *url = "https://localhost:42433/";
   struct sockaddr_in sa;
 
   sd = socket (AF_INET, SOCK_STREAM, 0);
@@ -153,8 +152,8 @@ main (int argc, char *const *argv)
   gnutls_global_init ();
   gnutls_global_set_log_level (11);
 
-  d = MHD_start_daemon (MHD_USE_THREAD_PER_CONNECTION | MHD_USE_SSL |
-                        MHD_USE_DEBUG, 42433,
+  d = MHD_start_daemon_ip(MHD_USE_THREAD_PER_CONNECTION | MHD_USE_SSL |
+                        MHD_USE_DEBUG, 42433, "127.0.0.1",
                         NULL, NULL, &http_ahc, NULL,
                         MHD_OPTION_CONNECTION_TIMEOUT, TIME_OUT,
                         MHD_OPTION_HTTPS_MEM_KEY, srv_key_pem,
diff --git a/src/testcurl/https/tls_test_keys.h b/src/testcurl/https/tls_test_keys.h
index aca0639c..871f99b1 100644
--- a/src/testcurl/https/tls_test_keys.h
+++ b/src/testcurl/https/tls_test_keys.h
@@ -24,105 +24,106 @@
 
 /* Certificate Authority key */
 const char ca_key_pem[] =
-  "-----BEGIN RSA PRIVATE KEY-----\n"
-  "MIIEpAIBAAKCAQEA3vzPUd2yRjeHy9Yi22uX1vGnUPmB5zS+77/B9LubTqnNJ9eB\n"
-  "jiMegQJsJWFQT/CW8FurYiSMXIuTBirZX7NO6/rlcqifdfKLotSUuXLu5DBvMLCv\n"
-  "nQ73wCIdCJoVyJbRN0ExHsyGwCDCxaHuY8FlkIsfYo17SNmJNaMSUqdoAZoelmbq\n"
-  "r9oVciRCQGgrmwEJdPj7EAofWSudV77y85j5rV/t51eNy5liS2qXnoFEmeqTuBo1\n"
-  "1cSmRbv5dkCHbx+youLyZG39KxB0MZ124Na3qbUY41BPNj1XBljyAoHyY0J1iDqS\n"
-  "0Zo+njEW6vRbmSMkrA1kH45+alN50X11mSgfoQIDAQABAoIBAAmLu+4Ushpdi5Sd\n"
-  "P1cidjDFXfDaao5I2LTroghpnNyfaiT+zbj1jctu7K1luuX+Lh7+ZKIGH6RhVP8g\n"
-  "R9eYBeyWHDsWJwPqCQJkrHR7LCkEfgkRAkaUZsSgzTqCWqUAeFa/xaQcdDcOu/nR\n"
-  "DKMUexYmz4ZU+VJxPhWHzGuxhxM85uJOPK3rCaYCJoo1vMpF7MeFFvVljhSdyht5\n"
-  "KD0w6qP0Y+vDe4cD/4W3wq82qXCFPA5oImjSJveEIJumPIjOyLFF+9p9V6hzg8Em\n"
-  "48cpXcV3SsbaqTr6mSQl6b15zVwWq4CCt4mkeu6vK9PGzdnBiUmWaSXfprDwHaB3\n"
-  "t1N0GRECgYEA5gP0gmZQDDJTlaGK9Z6pWiwpMBUoYcnqvCn8MQ5uPQn+KZir19AJ\n"
-  "PkVLfWT9Dcaf3+2d0kBBgGYFWL+wK8DgrqALiLJfM6gP3Ts7G6Bis4GFdWY9aUnT\n"
-  "6ZhRYdzetVArhTZBRKh8ERQNPy4TmzWDtjVUAfezUcvXqOjl9H5Q01ECgYEA+C2b\n"
-  "i05t/RYcU0eFVYK8Yfl3jZJiopMdYwXCSCO21Ag2i0fjKC89rCmLlliffSSuDtNk\n"
-  "xFsaSjns8Vyl7sjMcAOfsGokiUIcFnK/LyVoc3ie2NCiLVzw6zKK8lJ4bhn4afnv\n"
-  "N9RKXP76emb8MaZroKlKkhMR8f2BvzXbv2NyU1ECgYEAtJeAXu1zhc/xnjaiQqxa\n"
-  "rMilYfIKrZR571hLgDyjQttYqVIMAbp9t11yorYqlKlRFuCaG9yFUQlIw2BlMkUS\n"
-  "YyiXRbE+W/Fk2z7I7qzjMarMnNsz9jmX3vzPULW4ScTzFnj9j6l1F3eV2vgTPrYq\n"
-  "fmGqXo0bRmp0HVMWUPrn/LECgYEA3qHTQkHGS16VZGPpiY8xPVbUV8z07NC6cQVO\n"
-  "hvZ64XTIsWN4tKjEU3glf2bbFCFef3BFmhv71pBmLRMmy7GYK/gkPdbKFdOXbM/d\n"
-  "EAcnz0ZqgSeQBM+2U9dQbBdtb5+eiDsszNGFMC2QN1PBcyzOqh6UBbxTwdjfls9S\n"
-  "5Trp6TECgYAzCZmmJuBW6WDK5ttOF/do6r0aurHr2mOr8oYxmBkhI3wphyUMNuaH\n"
-  "rUk+R8LAmC1U4MbvvqoZH27xe+xd25mn6whitgZBH3DIetN7myDJep8wEG6aW4R5\n"
-  "S82zk+LQJ7LTa1nPVPMS10qUXSH9cjShhszfeRIQM+lWbPoaEuo3yQ==\n"
-  "-----END RSA PRIVATE KEY-----\n";
+        "-----BEGIN RSA PRIVATE KEY-----\n"
+        "MIIEowIBAAKCAQEAthkEJMVt/l06gPJQCfdMKJdYXdQZGSBkOroWGZfs0oYBcSU3\n"
+        "JeszCWwDgzw5Ac4o2no9/P7FLVm6+zaIO9gexVi2p1fDhT1+6Lir7O6waS94vLdu\n"
+        "jxdJPGfakZTktRAA3MBbC1XuMYPYXZ6nUrRkmHLeG6Oj+L0U3iVq0ZjLYjekCmqV\n"
+        "FXRaDmoLWkmxplKz6UyzUXmNlyU4EzLpek2NjTtEUxh0Te+wD4RivBhCPGr7PRlY\n"
+        "JhjkTk1u75HP41yQC6MnnfY3IALWwuabBQsreR0W0h17lB3YHdHKjP5xJfEeJPtb\n"
+        "625+lHQpH4nfzGcna/RFok6xRpjZu7mB3t7XGwIDAQABAoIBABhD2x5/RHn5uFsI\n"
+        "bwv07SwXhsnyAmoru89rjphYe1FOVBDcsa2W2tUtlIY/VyVbcGw0j+APnvy9EUJ6\n"
+        "cMrwsKEBgk1oT4CIwkmGmjpXUCCkF8Wl99CPfM3U1PZDTfqmqEbCRx+KktP8Sq+m\n"
+        "/YryyNjbracnNilmIMq9V6+YWbm7kJHRLVQWHqh/ljji+kCx5y9VII7HYz4217Er\n"
+        "I5HrnPJodmYrH5Tj8Hj9NY7Ok/IeqD186fPuYH/qf9zWcyg7aa0rTPt/E4XjeOjU\n"
+        "kxb68+Ybozm0EY1ypa1Yxf3B4hkyrlQ5lfzDSBKqvQkGA92yNDPYiZX71nDHDj9H\n"
+        "wf8tWlECgYEAxN8bnMXzmGLbNJUQFuEFBCDFE/tAMhBWcN6eyupIwyXXNA8/xGnJ\n"
+        "rYO4U08YrgvQ6d71xLXAJnsypeJ3FsyIXDar21o5DwVj1ON0nW6xuXsfQWYGEsXm\n"
+        "fDVf4LVO+P58uAnM3+lKXWMwsw7/ja9VECrOvfTlf7CwwIPfmRzxZEMCgYEA7Mn+\n"
+        "PBO352EXzXbGTuLY9iFXo3GL4EXB2nbkXBdTxEbPl+ICjg/1MPtRN9l03y8l06/G\n"
+        "MpbxkpPnSXdjXQ1fgXfG9FuKS89BNUfoEfG/3015w49ZAcBYRmvCSGTspu/hshdQ\n"
+        "iom2AFy2aRXfvsoUlePRccs1/7RKclK7ahfdwEkCgYBXQOLGCt25rialGWO2ICjO\n"
+        "+Y8fGf4Lsj39bE1IdammBAFrK08ByDkAVB6/nZC8orQG0zBt7HerFnMOHl7VlfTh\n"
+        "mcF1SHl9dNAYLG8kz0ipgi4KGCOc8mUCq81AlFrZ9EBmeMF6g7TXyvxsf7s3mnvC\n"
+        "3JYgjoegnjjYOhpBjBhYbQKBgQCpwJmBakVyG/obcyXx0dDmirqwUquLaZbyzj8i\n"
+        "AhssX/NdGErqm2gU6GauWjfd9IfyvVWiWPHwOhYaZfuW7wpj34GDFskLVhaSYu1t\n"
+        "R9lc9cbwOqj9h24Bdik/CxNZDinIKcy0tMsEcXLX3TWdKnQdjMhPAvbATPj+Am+X\n"
+        "PGrd+QKBgF5U2i0d2Mgw/JmlVCY79uD9eERivF5HLOYv3XUr9N1/bgIqKSQnrKJC\n"
+        "pXC+ZHP9yTmcznwFkbMbJ9cTwMVU1n+hguvyjIJHmmeGrpBuaiT4HwPgV6IZY3N2\n"
+        "a05cOyYYE3I7h9fQs1MfZRK44rRiXycwb+HA4lwuFWTI7h5qdc/U\n"
+        "-----END RSA PRIVATE KEY-----\n";
 
 /* Certificate Authority cert */
 const char ca_cert_pem[] =
-  "-----BEGIN CERTIFICATE-----\n"
-  "MIIC6DCCAdKgAwIBAgIESHv2uDALBgkqhkiG9w0BAQUwFzEVMBMGA1UEAxMMdGVz\n"
-  "dF9jYV9jZXJ0MB4XDTA4MDcxNTAxMDA0MFoXDTA5MDcxNTAxMDA0MFowFzEVMBMG\n"
-  "A1UEAxMMdGVzdF9jYV9jZXJ0MIIBHzALBgkqhkiG9w0BAQEDggEOADCCAQkCggEA\n"
-  "3vzPUd2yRjeHy9Yi22uX1vGnUPmB5zS+77/B9LubTqnNJ9eBjiMegQJsJWFQT/CW\n"
-  "8FurYiSMXIuTBirZX7NO6/rlcqifdfKLotSUuXLu5DBvMLCvnQ73wCIdCJoVyJbR\n"
-  "N0ExHsyGwCDCxaHuY8FlkIsfYo17SNmJNaMSUqdoAZoelmbqr9oVciRCQGgrmwEJ\n"
-  "dPj7EAofWSudV77y85j5rV/t51eNy5liS2qXnoFEmeqTuBo11cSmRbv5dkCHbx+y\n"
-  "ouLyZG39KxB0MZ124Na3qbUY41BPNj1XBljyAoHyY0J1iDqS0Zo+njEW6vRbmSMk\n"
-  "rA1kH45+alN50X11mSgfoQIDAQABo0MwQTAPBgNVHRMBAf8EBTADAQH/MA8GA1Ud\n"
-  "DwEB/wQFAwMHBAAwHQYDVR0OBBYEFB3x03+3Qa2SDwRF6RkNcjg9zRHJMAsGCSqG\n"
-  "SIb3DQEBBQOCAQEAjPoKMve8aqtL8fFXfSkYwLJUwuTG4E4mX804O5dsdvOEWR2/\n"
-  "UQm5IDiAZ3fnHE8zh0C1Kg+dWnCv0i1Q5CYZJ5sSY3tKikG5UBPVJGV1tT0vDfmJ\n"
-  "X7b52y35eN8qe5DsdyDAcF2GNRBU8opkLkyXb8U095AQiCHzTPpiesZd5phJlMPm\n"
-  "AJaB4VtHAykDMeKd7HJAeelRi/1dP8xsYNc1z67cSrkt2f+B0WAyuAUBBr1NdYmS\n"
-  "duegptXCh8OeGEL/v6mbIWoszDbOjk/0zwsgW8BD/eXaZgPPEUtmHizYPIRPdeW1\n"
-  "MSCwccjl/XjDkIoN8kKss4Ftt+Wyajjjxeh6YA==\n" "-----END CERTIFICATE-----\n";
+        "-----BEGIN CERTIFICATE-----\n"
+        "MIIC6DCCAdKgAwIBAgIESJ2sXDALBgkqhkiG9w0BAQUwFzEVMBMGA1UEAxMMdGVz\n"
+        "dF9jYV9jZXJ0MB4XDTA4MDgwOTE0NDAyOFoXDTA5MDgwOTE0NDAyOFowFzEVMBMG\n"
+        "A1UEAxMMdGVzdF9jYV9jZXJ0MIIBHzALBgkqhkiG9w0BAQEDggEOADCCAQkCggEA\n"
+        "thkEJMVt/l06gPJQCfdMKJdYXdQZGSBkOroWGZfs0oYBcSU3JeszCWwDgzw5Ac4o\n"
+        "2no9/P7FLVm6+zaIO9gexVi2p1fDhT1+6Lir7O6waS94vLdujxdJPGfakZTktRAA\n"
+        "3MBbC1XuMYPYXZ6nUrRkmHLeG6Oj+L0U3iVq0ZjLYjekCmqVFXRaDmoLWkmxplKz\n"
+        "6UyzUXmNlyU4EzLpek2NjTtEUxh0Te+wD4RivBhCPGr7PRlYJhjkTk1u75HP41yQ\n"
+        "C6MnnfY3IALWwuabBQsreR0W0h17lB3YHdHKjP5xJfEeJPtb625+lHQpH4nfzGcn\n"
+        "a/RFok6xRpjZu7mB3t7XGwIDAQABo0MwQTAPBgNVHRMBAf8EBTADAQH/MA8GA1Ud\n"
+        "DwEB/wQFAwMHBAAwHQYDVR0OBBYEFGTWojUUrKbS/Uid9S3hPxmgKeaxMAsGCSqG\n"
+        "SIb3DQEBBQOCAQEAWP1f/sfNsvA/oz7OJSBCsQxAnjrKMIXgbVnop+4bEWPxk4e9\n"
+        "TETSk5MMXt2BfaCtaLZw19Zbqlh4ZFuVw+QC1GTa0xlagHiRgXU2DOvPT5+y+XUR\n"
+        "TSy0Pqou7spgEkLcFxlXYlx3tpDu+Awmx9DBGHMCysVynnEzeBYW4woCfBG2UiVA\n"
+        "iHVz6jBc4bBkylKVkA42GiroExuPc+W9qtHGuVX045R7gz78KK0CMIObdySbogBe\n"
+        "gYZUbyVvPVHINEc929PoV12dHP7wrKnqPbiwb+h1SHui8bVinE+1JY3mRB1VGVTa\n"
+        "rgvlVGs2S+Zq48XMs4aeLgHkGWFAIXbpX34HSw==\n"
+        "-----END CERTIFICATE-----\n";
 
 /* test server CA signed certificates */
 const char srv_signed_cert_pem[] =
-  "-----BEGIN CERTIFICATE-----\n"
-  "MIIDHzCCAgmgAwIBAgIESHv6kTALBgkqhkiG9w0BAQUwFzEVMBMGA1UEAxMMdGVz\n"
-  "dF9jYV9jZXJ0MB4XDTA4MDcxNTAxMTcwNVoXDTA5MDcxNTAxMTcwNVowGzEZMBcG\n"
-  "A1UEAxMQdGVzdF9zZXJ2ZXJfY2VydDCCAR8wCwYJKoZIhvcNAQEBA4IBDgAwggEJ\n"
-  "AoIBAJIY2+Wn+TRHIJ92tpNvCIE6FOsGclRxOFJwK0T6k3SK68LwQ9PkQTTB/DJu\n"
-  "+hU2u6w6lt1+Q8PHTDMLtnkEeXnxPn1uQZnnMEBcHAGY1U99iJh0At68AyoG7nkb\n"
-  "AzgzxxjMom+dEhGEFHOg9JKmJp138RzIWcMN2l4pKIryiBUh5AWt/7uqtA+9fQMq\n"
-  "nOeO8OU5FM3eKevl3VSZ6usptbePbUDNs5uEmG+PTR0bc2rYgGeC4+wExWcJ+CAq\n"
-  "voNVPno//MoMeJjWgXqF4wTBFdfsewngkflwRDPuZuLsxVrKnIx6jsBKIMuhVuxT\n"
-  "66vnEmuR34TUIzLlVPcJ5wmby2UCAwEAAaN2MHQwDAYDVR0TAQH/BAIwADATBgNV\n"
-  "HSUEDDAKBggrBgEFBQcDATAPBgNVHQ8BAf8EBQMDByAAMB0GA1UdDgQWBBSHX75y\n"
-  "gpEjstognUu4If50qWXQaDAfBgNVHSMEGDAWgBQd8dN/t0Gtkg8ERekZDXI4Pc0R\n"
-  "yTALBgkqhkiG9w0BAQUDggEBAF56YMCdp0C88ZF9yaXJZ4PMuTpW83Mhg5Ar0a9H\n"
-  "DasF58p8eeRLhsTJPi+NpFSMTujEabGS3+8l6Iu5F5stFgvbvnjLHdYu2Pjakos8\n"
-  "NjZCCkuEmIO4PLd6h5ToOZf3ZXNHmFjRTtKHQKNrYizlHlgnEDcUbU4gB5KOg3jU\n"
-  "rv/Mtar+5LRK7KvByswp26nRH1ijGV23sy9StK7tV/cJPe/UkxyUfSQwUmQzzWe6\n"
-  "QGAQtppUjGabWXjuLuOUyiG5LReYC5ri7XZuVekCAfUHbOdPYTHPczvpKBnUyKIv\n"
-  "BRKOarmNfNc3w5G7Ast3jNOE2JfiJ8+x9+rMWI01PlWVYvQ=\n"
-  "-----END CERTIFICATE-----\n";
+        "-----BEGIN CERTIFICATE-----\n"
+        "MIIDBDCCAe6gAwIBAgIESJ2sXzALBgkqhkiG9w0BAQUwFzEVMBMGA1UEAxMMdGVz\n"
+        "dF9jYV9jZXJ0MB4XDTA4MDgwOTE0NDAzMloXDTA5MDgwOTE0NDAzNVowADCCAR8w\n"
+        "CwYJKoZIhvcNAQEBA4IBDgAwggEJAoIBAOb6G6WJrrNC48NSh5i4eT7J1BCqlMB4\n"
+        "e0No+td/PQf+sPywbQToYGiPfOFfMyge1G6SyRpXavKbPwuw1BN183WoYzID5mtz\n"
+        "shAOl/JRhdusScFijS3pITiNK4G5NLToCP4KZhqguqHUzEdanifSb/D4x54Rq/Tc\n"
+        "A7oHGp0wjdWC/AMtGWv6v55xMe00ALZ1zDxCOi8nri9W7mLy+hyduETCq+1Y7uHl\n"
+        "mqbAk8D7ruu0JtNU2N8WuJJcAtxgZhCCfIHTgAUWqepeRBM8cy8uu0tywgxcJiyt\n"
+        "Uu1wXQHnnpWrr/9r6IfhjFpc9pr5giHBeM4KdlU49UsYgaS1tAZsDJcCAwEAAaN2\n"
+        "MHQwDAYDVR0TAQH/BAIwADATBgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHQ8BAf8E\n"
+        "BQMDB6AAMB0GA1UdDgQWBBSxP229okDqlKyMCyg0cnzbf+eb4DAfBgNVHSMEGDAW\n"
+        "gBRk1qI1FKym0v1InfUt4T8ZoCnmsTALBgkqhkiG9w0BAQUDggEBAEabY4FLsFQr\n"
+        "PACNe3p5tU3hWvvQ9S1pRlfnc/z1o+k9NDWTHlNjXfVTl6/6cIKHA+r8SvRks27+\n"
+        "lScfxFkiCi22YC7uPbn8fW1nWcsqEkK4e0TDekSUi1o6SDx6cU07kMpx3iKvpLs3\n"
+        "5QiCFjivMjrY8pEFJIke/ucI8QuLVZLLUSdTHb9Ck128PtPKA4y2uZA/MmYS/OtR\n"
+        "/UZN67pJ+BqcQBE5vNolWQTM+NxfMzb48IV9q32HRT4HErvUjLIWV0nwwedUSdDG\n"
+        "63tr9jp0GF6b5Eum0MTVV/zbBxfyRFg+Q8xRn70zJlB/W7byaFq/95Rpfqjdnta2\n"
+        "aO/omlvGHrI=\n"
+        "-----END CERTIFICATE-----\n";
 
 /* test server key */
 const char srv_signed_key_pem[] =
-  "-----BEGIN RSA PRIVATE KEY-----\n"
-  "MIIEpAIBAAKCAQEAkhjb5af5NEcgn3a2k28IgToU6wZyVHE4UnArRPqTdIrrwvBD\n"
-  "0+RBNMH8Mm76FTa7rDqW3X5Dw8dMMwu2eQR5efE+fW5BmecwQFwcAZjVT32ImHQC\n"
-  "3rwDKgbueRsDODPHGMyib50SEYQUc6D0kqYmnXfxHMhZww3aXikoivKIFSHkBa3/\n"
-  "u6q0D719Ayqc547w5TkUzd4p6+XdVJnq6ym1t49tQM2zm4SYb49NHRtzatiAZ4Lj\n"
-  "7ATFZwn4ICq+g1U+ej/8ygx4mNaBeoXjBMEV1+x7CeCR+XBEM+5m4uzFWsqcjHqO\n"
-  "wEogy6FW7FPrq+cSa5HfhNQjMuVU9wnnCZvLZQIDAQABAoIBABISPh0FrocfZzMi\n"
-  "YYoSGWi2sQCzTvAQAyn7UvbY0eWAC5KU2qb6nHA0sIfif0+hcgxnQOML68DrRYso\n"
-  "3zzP52DEjPjB6x5o4OiNHC+8YmJPQlatPu+jLPcFXXkgdMD+cpmoMk2BDcuZ3VfC\n"
-  "KI59O9iNjgcD50p/y6uLBsdNIbUPSMe8ONWT7f5DN/DqEL+3tVZaRAOL+C8iKYf4\n"
-  "EPI5z6gOyL0aEpulbMKc0YoZZ2kDmu5IyMLgkF3DJV440Y/6IGan88ZSjk6i/d7f\n"
-  "ciKVtzIIbr5ubbuGe3htphTpRP0aA5WuVTzHrKk83/u3hG1RFv1q/cRD28tVUIII\n"
-  "0pcwLmECgYEAwMdaR5Y2NqBk/fOvU/oCDAQ6w8jmIa4zMxskvq9Pr753jhT13j+T\n"
-  "eQ1A590PF4PPvGFTqJ2vl3kj6JT5dzu7mGKoJLFsnttpw+0NYUgp0waPPZx010pp\n"
-  "QGeyQ/cPsZEZkCehh9c5CsfO1YpjKLV/wdpBQ2xAnkV5dfFmzlzLOTECgYEAwgJf\n"
-  "gxlR9Jgv7Qg/6Prs+SarqT4xDsJKKbD7wH2jveGFXVnkYTPVstwLCAus4LaLFKZ9\n"
-  "1POQDUgO24E1GzuL7mqSuvymdl5gZICfpkHstOAfpqep96pUv4aI9BY/g5l4Lvep\n"
-  "9c52tgQGwz0qgBUJBi6AvzxqRkBsxrXjX2m7KHUCgYEAtjx94ohkTXWIouy2xFrl\n"
-  "jnh9GNGUgyhK7Dfvn3bYjJkwKZc06dkNzvQxdD5r4t3PBhS3YgFWmYmB4X7a6NUF\n"
-  "vMMekjlLJkziib1Q1bLDHuLni+WYKmEEaEbepRMrub8h/D0KnQBewwspQoJkxHn3\n"
-  "AMkSwurVlwi0DkOa3N+pmTECgYBXyCUZN1qqtjVxJXttWiPg88tWD2q5B9XwmUC/\n"
-  "rtlor+LdAzBffsmhXQiswkOdhVrWpCJpOS8jo0f9r6+su7ury5LKgkh7ZGZu8vfJ\n"
-  "jSiiCoqnqFMyWWJxKllLP8nLLKSBc9P2AU4bOyUoL8PMIjhsEJx2asqXMM1G98OC\n"
-  "R1/EhQKBgQCmSkabsj8u5iEScicyJU87/sVkRIRE0GhjU8uuvcTe+dRiHuj2CENx\n"
-  "hh967E0nUCiJzx3is0/nYByDles9W4BLEA8JSuM5r6E7UifHR4XwIi2tQcNhCWIu\n"
-  "vGbfvxwqcm7Uj3XHb1GbYK5nnaRNailoJ7iyqHWxB1Q3iFIiMipcfg==\n"
-  "-----END RSA PRIVATE KEY-----\n";
+        "-----BEGIN RSA PRIVATE KEY-----\n"
+        "MIIEowIBAAKCAQEA5vobpYmus0Ljw1KHmLh5PsnUEKqUwHh7Q2j61389B/6w/LBt\n"
+        "BOhgaI984V8zKB7UbpLJGldq8ps/C7DUE3XzdahjMgPma3OyEA6X8lGF26xJwWKN\n"
+        "LekhOI0rgbk0tOgI/gpmGqC6odTMR1qeJ9Jv8PjHnhGr9NwDugcanTCN1YL8Ay0Z\n"
+        "a/q/nnEx7TQAtnXMPEI6LyeuL1buYvL6HJ24RMKr7Vju4eWapsCTwPuu67Qm01TY\n"
+        "3xa4klwC3GBmEIJ8gdOABRap6l5EEzxzLy67S3LCDFwmLK1S7XBdAeeelauv/2vo\n"
+        "h+GMWlz2mvmCIcF4zgp2VTj1SxiBpLW0BmwMlwIDAQABAoIBACJGvGKQ74V3qDAc\n"
+        "p7WwroF0Vw2QGtoDJxumUQ84uRheIeqlzc/cIi5yGLCjPYa3KIQuMTzA+0R8aFs2\n"
+        "RwqKRvJPZkUOUhvhA+whFkhl86zZQOq7UsMc5Qqs3Gd4UguEoYz9gxBxiLCqURRH\n"
+        "rM+xCV6jtI/PBIsmOUFae4cXJP0pljUXyYmwwb/WrsvnJXf9Gz8/VLZGBMchMH7R\n"
+        "MwD7xdwc/ht2XfZ0TuDntpJDtj0JrW9i/Cxt8PnNhQjgLsAe+oUUZt7Bo+vXBxhu\n"
+        "JPKj6BHcj768l+gDn5zzaXKq0eF7mMXc7fgAp0u8lJkC0LxLq/WmIfqw4Z4mEjkX\n"
+        "DremIoUCgYEA53vX9Hd8V85hCfeaTDf3B5q6g9kIliR+Y2tX2aSqN06df9J/KOdL\n"
+        "G/lEQn4rsOOtOwyTU2luPmcr0XgbXA1T1kj56+UZrxtRducsdsVbVixzD2KswtJO\n"
+        "wUH6XAJNdpI++64TuZadnKAaKiqim7CPzQYrBXYKKRFGSDd50urkTRMCgYEA/3CG\n"
+        "NMaG3qtzQceQUw7BBAhey387MR+1FUQHQ7xoq2jc3yAx4H2NEyGa6wL5CtFKn5In\n"
+        "BP6f30sk2ilXRv5pbIIiS8Xzngxy3m17GH33YrSc3ff/u+LWgR/EOVpa9F+sMAjp\n"
+        "ohDgI8iH8GtahrRA0BxQKfNIo2zUTqNwFP88xu0CgYADOY1zoWqBCqX9bo6euzTc\n"
+        "zUIF7jMZbF66Yddyd8HLTXQSQMt2tWotdJaH2pwfNbzHEtDGm7RmeCd7HpI7ARCG\n"
+        "7rNUnvdxog7LekL7UJqKI8pij3xapnVkadfkCkAsA7OO7AjoT/nYIb7bkYZ8ZsRK\n"
+        "FejphZB0rAHvpZ4z2wPdMwKBgQCfkr70RzVH81lcNXwutt/TUhtOCxyCMqmgMFBN\n"
+        "e2zz791TMjyWXjh8RBkQSVok7NwuVVI055AeIUZTV1IjkplvZNhh97aZ/HLiCwjE\n"
+        "IyUhL21zqRLEYA/auGqP3adGVGIv29GAIgSztfleMuJplj+LArT9j/LHzRvQSH+j\n"
+        "TlO8fQKBgE5og4pTfPrD0A7W/Li1HDGf8Ylb+DZlxoyMriW82Z/zCBvYvn1UvQRi\n"
+        "b8f3IQFXuXdf3Bx4C91kQJPovxDp14FOHJxO7F32fGMnJaU2kyp4sf4WAJZZOLnd\n"
+        "l64hMUsgYPI8qfsanAudD4gTAsLEP+ueWqkcb3SJNLSoQAtcGzYs\n"
+        "-----END RSA PRIVATE KEY-----\n";
 
 /* test server self signed certificates */
 const char srv_self_signed_cert_pem[] =