diff --git a/programs/test/ssl_test.c b/programs/test/ssl_test.c
new file mode 100644
index 0000000..44ff7d8
--- /dev/null
+++ b/programs/test/ssl_test.c
@@ -0,0 +1,580 @@
+/*
+ *  SSL/TLS stress testing program
+ *
+ *  Copyright (C) 2006-2007  Christophe Devine
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License along
+ *  with this program; if not, write to the Free Software Foundation, Inc.,
+ *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#ifndef _CRT_SECURE_NO_DEPRECATE
+#define _CRT_SECURE_NO_DEPRECATE 1
+#endif
+
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+#include "xyssl/net.h"
+#include "xyssl/ssl.h"
+#include "xyssl/havege.h"
+#include "xyssl/timing.h"
+#include "xyssl/certs.h"
+
+#define OPMODE_NONE             0
+#define OPMODE_CLIENT           1
+#define OPMODE_SERVER           2
+
+#define IOMODE_BLOCK            0
+#define IOMODE_NONBLOCK         1
+
+#define COMMAND_READ            1
+#define COMMAND_WRITE           2
+#define COMMAND_BOTH            3
+
+#define DFL_OPMODE              OPMODE_NONE
+#define DFL_IOMODE              IOMODE_BLOCK
+#define DFL_SERVER_NAME         "localhost"
+#define DFL_SERVER_PORT         4433
+#define DFL_COMMAND             COMMAND_READ
+#define DFL_BUFFER_SIZE         1024
+#define DFL_MAX_BYTES           0
+#define DFL_DEBUG_LEVEL         0
+#define DFL_CONN_TIMEOUT        0
+#define DFL_MAX_CONNECTIONS     0
+#define DFL_SESSION_REUSE       1
+#define DFL_SESSION_LIFETIME    86400
+#define DFL_FORCE_CIPHER        0
+
+/*
+ * server-specific data
+ */
+char *dhm_G = "4";
+char *dhm_P = 
+"E4004C1F94182000103D883A448B3F802CE4B44A83301270002C20D0321CFD00" \
+"11CCEF784C26A400F43DFB901BCA7538F2C6B176001CF5A0FD16D2C48B1D0C1C" \
+"F6AC8E1DA6BCC3B4E1F96B0564965300FFA1D0B601EB2800F489AA512C4B248C" \
+"01F76949A60BB7F00A40B1EAB64BDD48E8A700D60B7F1200FA8E77B0A979DABF";
+
+int server_fd = -1;
+
+/*
+ * global options
+ */
+struct options
+{
+    int opmode;                 /* operation mode (client or server)    */
+    int iomode;                 /* I/O mode (blocking or non-blocking)  */
+    char *server_name;          /* hostname of the server (client only) */
+    int server_port;            /* port on which the ssl service runs   */
+    int command;                /* what to do: read or write operation  */
+    int buffer_size;            /* size of the send/receive buffer      */
+    int max_bytes;              /* max. # of bytes before a reconnect   */
+    int debug_level;            /* level of debugging                   */
+    int conn_timeout;           /* max. delay before a reconnect        */
+    int max_connections;        /* max. number of reconnections         */
+    int session_reuse;          /* flag to reuse the keying material    */
+    int session_lifetime;       /* if reached, session data is expired  */
+    int force_cipher[2];        /* protocol/cipher to use, or all       */
+};
+
+/*
+ * Although this PRNG has good statistical properties (eg. passes
+ * DIEHARD), it is not cryptographically secure.
+ */
+unsigned long int lcppm5( unsigned long int *state )
+{
+    unsigned long int u, v;
+
+    u = v = state[4] ^ 1;
+    state[u & 3] ^= u;
+    u ^= (v << 12) ^ (v >> 12);
+    u ^= v * state[0]; v >>= 8;
+    u ^= v * state[1]; v >>= 8;
+    u ^= v * state[2]; v >>= 8;
+    u ^= v * state[3];
+    u &= 0xFFFFFFFF;
+    state[4] = u;
+
+    return( u );
+}
+
+void my_debug( void *ctx, int level, char *str )
+{
+    if( level < ((struct options *) ctx)->debug_level )
+        fprintf( stderr, "%s", str );
+}
+
+/*
+ * perform a single SSL connection
+ */
+static int ssl_test( struct options *opt )
+{
+    int ret, i;
+    int client_fd;
+    int bytes_to_read;
+    int bytes_to_write;
+    int offset_to_read;
+    int offset_to_write;
+
+    long int nb_read;
+    long int nb_written;
+
+    unsigned long read_state[5];
+    unsigned long write_state[5];
+
+    unsigned char *read_buf;
+    unsigned char *write_buf;
+
+    struct hr_time t;
+    havege_state hs;
+    ssl_context ssl;
+    ssl_session ssn;
+    x509_cert srvcert;
+    rsa_context rsa;
+
+    ret = 1;
+
+    havege_init( &hs );
+    get_timer( &t, 1 );
+
+    memset( read_state, 0, sizeof( read_state ) );
+    memset( write_state, 0, sizeof( write_state ) );
+
+    memset( &srvcert, 0, sizeof( x509_cert ) );
+    memset( &rsa, 0, sizeof( rsa_context ) );
+
+    if( opt->opmode == OPMODE_CLIENT )
+    {
+        if( ( ret = net_connect( &client_fd, opt->server_name,
+                                             opt->server_port ) ) != 0 )
+        {
+            printf( "  ! net_connect returned %d\n\n", ret );
+            return( ret );
+        }
+
+        if( ( ret = ssl_init( &ssl ) ) != 0 )
+        {
+            printf( "  ! ssl_init returned %d\n\n", ret );
+            return( ret );
+        }
+
+        ssl_set_endpoint( &ssl, SSL_IS_CLIENT );
+    }
+
+    if( opt->opmode == OPMODE_SERVER )
+    {
+        ret =  x509parse_crt( &srvcert, (unsigned char *) test_srv_crt,
+                              strlen( test_srv_crt ) );
+        if( ret != 0 )
+        {
+            printf( "  !  x509parse_crt returned %d\n\n", ret );
+            goto exit;
+        }
+
+        ret =  x509parse_crt( &srvcert, (unsigned char *) test_ca_crt,
+                              strlen( test_ca_crt ) );
+        if( ret != 0 )
+        {
+            printf( "  !  x509parse_crt returned %d\n\n", ret );
+            goto exit;
+        }
+
+        ret =  x509parse_key( &rsa, (unsigned char *) test_srv_key,
+                              strlen( test_srv_key ), NULL, 0 );
+        if( ret != 0 )
+        {
+            printf( "  !  x509parse_key returned %d\n\n", ret );
+            goto exit;
+        }
+
+        if( server_fd < 0 )
+        {
+            if( ( ret = net_bind( &server_fd, NULL,
+                                   opt->server_port ) ) != 0 )
+            {
+                printf( "  ! net_bind returned %d\n\n", ret );
+                return( ret );
+            }
+        }
+
+        if( ( ret = net_accept( server_fd, &client_fd, NULL ) ) != 0 )
+        {
+            printf( "  ! net_accept returned %d\n\n", ret );
+            return( ret );
+        }
+
+        if( ( ret = ssl_init( &ssl ) ) != 0 )
+        {
+            printf( "  ! ssl_init returned %d\n\n", ret );
+            return( ret );
+        }
+
+        ssl_set_endpoint( &ssl, SSL_IS_SERVER );
+        ssl_set_dh_param( &ssl, dhm_P, dhm_G );
+        ssl_set_ca_chain( &ssl, srvcert.next, NULL );
+        ssl_set_own_cert( &ssl, &srvcert, &rsa );
+    }
+
+    ssl_set_authmode( &ssl, SSL_VERIFY_NONE );
+
+    ssl_set_rng( &ssl, havege_rand, &hs );
+    ssl_set_dbg( &ssl, my_debug, opt );
+    ssl_set_bio( &ssl, net_recv, &client_fd,
+                       net_send, &client_fd );
+
+    ssl_set_session( &ssl, opt->session_reuse,
+                           opt->session_lifetime, &ssn );
+
+    if( opt->force_cipher[0] == DFL_FORCE_CIPHER )
+          ssl_set_ciphers( &ssl, ssl_default_ciphers );
+    else  ssl_set_ciphers( &ssl, opt->force_cipher );
+
+    if( opt->iomode == IOMODE_NONBLOCK )
+        net_set_nonblock( client_fd );
+
+     read_buf = (unsigned char *) malloc( opt->buffer_size );
+    write_buf = (unsigned char *) malloc( opt->buffer_size );
+
+    if( read_buf == NULL || write_buf == NULL )
+    {
+        printf( "  ! malloc(%d bytes) failed\n\n", opt->buffer_size );
+        goto exit;
+    }
+
+    nb_read = bytes_to_read = 0;
+    nb_written = bytes_to_write = 0;
+
+    while( 1 )
+    {
+        if( opt->command & COMMAND_WRITE )
+        {
+            if( bytes_to_write == 0 )
+            {
+                while( bytes_to_write == 0 )
+                    bytes_to_write = rand() % opt->buffer_size;
+
+                for( i = 0; i < bytes_to_write; i++ )
+                    write_buf[i] = (unsigned char) lcppm5( write_state );
+
+                offset_to_write = 0;
+            }
+
+            ret = ssl_write( &ssl, write_buf + offset_to_write,
+                             bytes_to_write );
+
+            if( ret >= 0 )
+            {
+                nb_written += ret;
+                bytes_to_write  -= ret;
+                offset_to_write += ret;
+            }
+
+            if( ret == XYSSL_ERR_SSL_PEER_CLOSE_NOTIFY ||
+                ret == XYSSL_ERR_NET_CONN_RESET )
+            {
+                ret = 0;
+                goto exit;
+            }
+
+            if( ret < 0 && ret != XYSSL_ERR_NET_TRY_AGAIN )
+            {
+                printf( "  ! ssl_write returned %d\n\n", ret );
+                break;
+            }
+        }
+
+        if( opt->command & COMMAND_READ )
+        {
+            if( bytes_to_read == 0 )
+            {
+                bytes_to_read = rand() % opt->buffer_size;
+                offset_to_read = 0;
+            }
+
+            ret = ssl_read( &ssl, read_buf + offset_to_read,
+                            bytes_to_read );
+
+            if( ret >= 0 )
+            {
+                for( i = 0; i < ret; i++ )
+                {
+                    if( read_buf[offset_to_read + i] !=
+                        (unsigned char) lcppm5( read_state ) )
+                    {
+                        ret = 1;
+                        printf( "  ! plaintext mismatch\n\n" );
+                        goto exit;
+                    }
+                }
+
+                nb_read += ret;
+                bytes_to_read -= ret;
+                offset_to_read += ret;
+            }
+
+            if( ret == XYSSL_ERR_SSL_PEER_CLOSE_NOTIFY ||
+                ret == XYSSL_ERR_NET_CONN_RESET )
+            {
+                ret = 0;
+                goto exit;
+            }
+
+            if( ret < 0 && ret != XYSSL_ERR_NET_TRY_AGAIN )
+            {
+                printf( "  ! ssl_read returned %d\n\n", ret );
+                break;
+            }
+        }
+
+        ret = 0;
+
+        if( opt->max_bytes != 0 &&
+            ( opt->max_bytes <= nb_read ||
+              opt->max_bytes <= nb_written ) )
+            break;
+
+        if( opt->conn_timeout != 0 &&
+            opt->conn_timeout <= (int) get_timer( &t, 0 ) )
+            break;
+    }
+
+exit:
+
+    fflush( stdout );
+
+    if( read_buf != NULL )
+        free( read_buf );
+
+    if( write_buf != NULL )
+        free( write_buf );
+
+    ssl_close_notify( &ssl );
+    x509_free( &srvcert );
+    rsa_free( &rsa );
+    ssl_free( &ssl );
+    net_close( client_fd );
+
+    return( ret );
+}
+
+#define USAGE \
+    "\n usage: ssl_test opmode=<> command=<>...\n"               \
+    "\n acceptable parameters:\n"                                \
+    "    opmode=client/server        default: <none>\n"          \
+    "    iomode=block/nonblock       default: block\n"           \
+    "    server_name=%%s              default: localhost\n"      \
+    "    server_port=%%d              default: 4433\n"           \
+    "    command=read/write/both     default: read\n"            \
+    "    buffer_size=%%d (bytes)      default: 1024\n"           \
+    "    max_bytes=%%d (bytes)        default: 0 (no limit)\n"   \
+    "    debug_level=%%d              default: 0 (disabled)\n"   \
+    "    conn_timeout=%%d (ms)        default: 0 (no timeout)\n" \
+    "    max_connections=%%d          default: 0 (no limit)\n"   \
+    "    session_reuse=on/off        default: on (enabled)\n"    \
+    "    session_lifetime=%%d (s)     default: 86400\n"          \
+    "    force_cipher=<name>         default: all enabled\n"     \
+    " acceptable cipher names:\n"                                \
+    "    SSL_RSA_RC4_128_MD5         SSL_RSA_RC4_128_SHA\n"      \
+    "    SSL_RSA_DES_168_SHA         SSL_EDH_RSA_DES_168_SHA\n"  \
+    "    SSL_RSA_AES_128_SHA         SSL_EDH_RSA_AES_256_SHA\n"  \
+    "    SSL_RSA_AES_256_SHA\n\n"
+
+int main( int argc, char *argv[] )
+{
+    int i, j, n;
+    int ret = 1;
+    int nb_conn;
+    char *p, *q;
+    struct options opt;
+
+    if( argc == 1 )
+    {
+    usage:
+        printf( USAGE );
+        goto exit;
+    }
+
+    opt.opmode                  = DFL_OPMODE;
+    opt.iomode                  = DFL_IOMODE;
+    opt.server_name             = DFL_SERVER_NAME;
+    opt.server_port             = DFL_SERVER_PORT;
+    opt.command                 = DFL_COMMAND;
+    opt.buffer_size             = DFL_BUFFER_SIZE;
+    opt.max_bytes               = DFL_MAX_BYTES;
+    opt.debug_level             = DFL_DEBUG_LEVEL;
+    opt.conn_timeout            = DFL_CONN_TIMEOUT;
+    opt.max_connections         = DFL_MAX_CONNECTIONS;
+    opt.session_reuse           = DFL_SESSION_REUSE;
+    opt.session_lifetime        = DFL_SESSION_LIFETIME;
+    opt.force_cipher[0]         = DFL_FORCE_CIPHER;
+
+    for( i = 1; i < argc; i++ )
+    {
+        n = strlen( argv[i] );
+
+        for( j = 0; j < n; j++ )
+        {
+            if( argv[i][j] >= 'A' && argv[i][j] <= 'Z' )
+                argv[i][j] |= 0x20;
+        }
+
+        p = argv[i];
+        if( ( q = strchr( p, '=' ) ) == NULL )
+            continue;
+        *q++ = '\0';
+
+        if( strcmp( p, "opmode" ) == 0 )
+        {
+            if( strcmp( q, "client" ) == 0 )
+                opt.opmode = OPMODE_CLIENT;
+            else
+            if( strcmp( q, "server" ) == 0 )
+                opt.opmode = OPMODE_SERVER;
+            else goto usage;
+        }
+
+        if( strcmp( p, "iomode" ) == 0 )
+        {
+            if( strcmp( q, "block" ) == 0 )
+                opt.iomode = IOMODE_BLOCK;
+            else
+            if( strcmp( q, "nonblock" ) == 0 )
+                opt.iomode = IOMODE_NONBLOCK;
+            else goto usage;
+        }
+
+        if( strcmp( p, "server_name" ) == 0 )
+            opt.server_name = q;
+
+        if( strcmp( p, "server_port" ) == 0 )
+        {
+            opt.server_port = atoi( q );
+            if( opt.server_port < 1 || opt.server_port > 65535 )
+                goto usage;
+        }
+
+        if( strcmp( p, "command" ) == 0 )
+        {
+            if( strcmp( q, "read" ) == 0 )
+                opt.command = COMMAND_READ;
+            else
+            if( strcmp( q, "write" ) == 0 )
+                opt.command = COMMAND_WRITE;
+            else
+            if( strcmp( q, "both" ) == 0 )
+            {
+                opt.iomode  = IOMODE_NONBLOCK;
+                opt.command = COMMAND_BOTH;
+            }
+            else goto usage;
+        }
+
+        if( strcmp( p, "buffer_size" ) == 0 )
+        {
+            opt.buffer_size = atoi( q );
+            if( opt.buffer_size < 1 || opt.buffer_size > 1048576 )
+                goto usage;
+        }
+
+        if( strcmp( p, "max_bytes" ) == 0 )
+            opt.max_bytes = atoi( q );
+
+        if( strcmp( p, "debug_level" ) == 0 )
+            opt.debug_level = atoi( q );
+
+        if( strcmp( p, "conn_timeout" ) == 0 )
+            opt.conn_timeout = atoi( q );
+
+        if( strcmp( p, "max_connections" ) == 0 )
+            opt.max_connections = atoi( q );
+
+        if( strcmp( p, "session_reuse" ) == 0 )
+        {
+            if( strcmp( q, "on" ) == 0 )
+                opt.session_reuse = 1;
+            else
+            if( strcmp( q, "off" ) == 0 )
+                opt.session_reuse = 0;
+            else
+                goto usage;
+        }
+
+        if( strcmp( p, "session_lifetime" ) == 0 )
+            opt.session_lifetime = atoi( q );
+
+        if( strcmp( p, "force_cipher" ) == 0 )
+        {
+            opt.force_cipher[0] = -1;
+
+            if( strcmp( q, "ssl_rsa_rc4_128_md5" ) == 0 )
+                opt.force_cipher[0] = SSL_RSA_RC4_128_MD5;
+
+            if( strcmp( q, "ssl_rsa_rc4_128_sha" ) == 0 )
+                opt.force_cipher[0] = SSL_RSA_RC4_128_SHA;
+
+            if( strcmp( q, "ssl_rsa_des_168_sha" ) == 0 )
+                opt.force_cipher[0] = SSL_RSA_DES_168_SHA;
+
+            if( strcmp( q, "ssl_edh_rsa_des_168_sha" ) == 0 )
+                opt.force_cipher[0] = SSL_EDH_RSA_DES_168_SHA;
+
+            if( strcmp( q, "ssl_rsa_aes_128_sha" ) == 0 )
+                opt.force_cipher[0] = SSL_RSA_AES_128_SHA;
+
+            if( strcmp( q, "ssl_rsa_aes_256_sha" ) == 0 )
+                opt.force_cipher[0] = SSL_RSA_AES_256_SHA;
+
+            if( strcmp( q, "ssl_edh_rsa_aes_256_sha" ) == 0 )
+                opt.force_cipher[0] = SSL_EDH_RSA_AES_256_SHA;
+
+            if( opt.force_cipher[0] < 0 )
+                goto usage;
+
+            opt.force_cipher[1] = 0;
+        }
+    }
+
+    switch( opt.opmode )
+    {
+        case OPMODE_CLIENT:
+            break;
+
+        case OPMODE_SERVER:
+            break;
+
+        default:
+            goto usage;
+    }
+
+    nb_conn = 0;
+
+    do {
+        nb_conn++;
+        ret = ssl_test( &opt );
+        if( opt.max_connections != 0 &&
+            opt.max_connections <= nb_conn )
+            break;
+    }
+    while( ret == 0 );
+
+exit:
+
+#ifdef WIN32
+    printf( "  Press Enter to exit this program.\n" );
+    fflush( stdout ); getchar();
+#endif
+
+    return( ret );
+}