Add the shared TLS 1.2 client kit

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/KitTest.java

@@ -0,0 +1,47 @@
+import com.minamp.net.*;
+import java.io.*;
+import java.util.*;
+
+public class KitTest {
+    public static void main(String[] a) throws Exception {
+        final File dir = new File(a[0]);
+        CertVerifier.setRootStore(new CertVerifier.RootStore() {
+            public List<byte[]> find(byte[] subj) {
+                String h = CertVerifier.sha1Hex(subj);
+                List<byte[]> out = null;
+                for (int i = 0; ; i++) {
+                    File f = new File(dir, h + "-" + i + ".der");
+                    if (!f.exists()) return out;
+                    try { if (out == null) out = new ArrayList<byte[]>(); out.add(java.nio.file.Files.readAllBytes(f.toPath())); } catch (IOException e) { return null; }
+                }
+            }
+        });
+        int fail = 0;
+        String[] urls = {"https://rss.anosanube.ovh/api/greader.php/reader/api/0/token", "https://nxc.anosanube.ovh/status.php", "https://nxc.anosanube.ovh/status.php", "https://abs.anosanube.ovh/ping"};
+        for (String u : urls) {
+            long t0 = System.currentTimeMillis();
+            try {
+                Http.Response r = Http.get(u, null, 20000);
+                String b = r.readString();
+                System.out.println("ok   " + r.code + " " + u + " " + (System.currentTimeMillis() - t0) + "ms " + b.length() + "b");
+            } catch (IOException e) { fail++; System.out.println("FAIL " + u + ": " + e); }
+        }
+        // wrong pin -> Untrusted(changed)
+        CertVerifier.setPin("00:11");
+        try { Http.get("https://nxc.anosanube.ovh/status.php", null, 20000).readAll(); fail++; System.out.println("FAIL pin mismatch accepted"); }
+        catch (CertVerifier.Untrusted u) { System.out.println("ok   pin mismatch -> Untrusted changed=" + u.changed + " fp=" + u.fingerprint.substring(0, 11) + " subj=" + u.subject + " exp=" + u.expires);
+            CertVerifier.setPin(u.fingerprint);
+            Http.Response r = Http.get("https://nxc.anosanube.ovh/status.php", null, 20000); r.readAll();
+            System.out.println("ok   pinned leaf accepted: " + r.code);
+        }
+        CertVerifier.setPin("");
+        // self-signed -> Untrusted(!changed)
+        try { Http.get("https://self-signed.badssl.com/", null, 20000).readAll(); fail++; System.out.println("FAIL self-signed accepted"); }
+        catch (CertVerifier.Untrusted u) { System.out.println("ok   self-signed -> Untrusted changed=" + u.changed); }
+        catch (IOException e) { System.out.println("??   self-signed: " + e); }
+        try { Http.get("https://wrong.host.badssl.com/", null, 20000).readAll(); fail++; System.out.println("FAIL wrong host accepted"); }
+        catch (IOException e) { System.out.println("ok   wrong host: " + e.getMessage()); }
+        System.out.println(DiagLog.dump());
+        System.out.println(fail == 0 ? "ALL OK" : fail + " FAILED");
+    }
+}