ssl: Handle socket option inheritance when pooling of accept sockets is used

Implement a listen socket tracker process that holds the emulated socket
options so that it is possible to implement a destructive ssl:setopts
on SSL/TLS listen sockets without changing the options of the internal
socket as we want that socket to have the internal socket option values.

11 files changed, 442 insertions, 78 deletions

diff --git a/lib/ssl/src/Makefile b/lib/ssl/src/Makefile
index 131b615277..7c4c8ec2cc 100644
--- a/lib/ssl/src/Makefile
+++ b/lib/ssl/src/Makefile
@@ -1,7 +1,7 @@
 #
 # %CopyrightBegin%
 #
-# Copyright Ericsson AB 1999-2013. All Rights Reserved.
+# Copyright Ericsson AB 1999-2014. All Rights Reserved.
 #
 # The contents of this file are subject to the Erlang Public License,
 # Version 1.1, (the "License"); you may not use this file except in
@@ -66,6 +66,7 @@ MODULES= \
 	ssl_session \
 	ssl_session_cache \
 	ssl_socket \
+	ssl_listen_tracker_sup \
 	tls_record \
 	dtls_record \
 	ssl_record \
diff --git a/lib/ssl/src/ssl.app.src b/lib/ssl/src/ssl.app.src
index 99839f6149..36681e2897 100644
--- a/lib/ssl/src/ssl.app.src
+++ b/lib/ssl/src/ssl.app.src
@@ -28,6 +28,7 @@
 	       ssl_srp_primes,
 	       ssl_alert,
 	       ssl_socket,
+	       ssl_listen_tracker_sup,	
 	       %% Erlang Distribution over SSL/TLS
 	       inet_tls_dist,
 	       ssl_tls_dist_proxy,
diff --git a/lib/ssl/src/ssl.erl b/lib/ssl/src/ssl.erl
index 866312f332..26947ceff9 100644
--- a/lib/ssl/src/ssl.erl
+++ b/lib/ssl/src/ssl.erl
@@ -97,17 +97,17 @@ connect(Socket, SslOptions) when is_port(Socket) ->
 connect(Socket, SslOptions0, Timeout) when is_port(Socket) ->
     {Transport,_,_,_} = proplists:get_value(cb_info, SslOptions0,
 					      {gen_tcp, tcp, tcp_closed, tcp_error}),
-    EmulatedOptions = emulated_options(),
+    EmulatedOptions = ssl_socket:emulated_options(),
     {ok, SocketValues} = ssl_socket:getopts(Transport, Socket, EmulatedOptions),
     try handle_options(SslOptions0 ++ SocketValues, client) of
 	{ok, #config{transport_info = CbInfo, ssl = SslOptions, emulated = EmOpts,
 		     connection_cb = ConnectionCb}} ->
 
-	    ok = ssl_socket:setopts(Transport, Socket, internal_inet_values()),
+	    ok = ssl_socket:setopts(Transport, Socket, ssl_socket:internal_inet_values()),
 	    case ssl_socket:peername(Transport, Socket) of
 		{ok, {Address, Port}} ->
 		    ssl_connection:connect(ConnectionCb, Address, Port, Socket,
-					   {SslOptions, EmOpts},
+					   {SslOptions, emulated_socket_options(EmOpts, #socket_options{})},
 					   self(), CbInfo, Timeout);
 		{error, Error} ->
 		    {error, Error}
@@ -141,10 +141,13 @@ listen(Port, Options0) ->
     try
 	{ok, Config} = handle_options(Options0, server),
 	ConnectionCb = connection_cb(Options0),
-	#config{transport_info = {Transport, _, _, _}, inet_user = Options, connection_cb = ConnectionCb} = Config,
+	#config{transport_info = {Transport, _, _, _}, inet_user = Options, connection_cb = ConnectionCb,
+		ssl = SslOpts, emulated = EmOpts} = Config,
 	case Transport:listen(Port, Options) of
 	    {ok, ListenSocket} ->
-		{ok, #sslsocket{pid = {ListenSocket, Config}}};
+		ok = ssl_socket:setopts(Transport, ListenSocket, ssl_socket:internal_inet_values()),
+		{ok, Tracker} = ssl_socket:inherit_tracker(ListenSocket, EmOpts, SslOpts),
+		{ok, #sslsocket{pid = {ListenSocket, Config#config{emulated = Tracker}}}};
 	    Err = {error, _} ->
 		Err
 	end
@@ -164,21 +167,16 @@ transport_accept(ListenSocket) ->
     transport_accept(ListenSocket, infinity).
 
 transport_accept(#sslsocket{pid = {ListenSocket,
-				   #config{transport_info = CbInfo,
+				   #config{transport_info =  {Transport,_,_, _} =CbInfo,
 					   connection_cb = ConnectionCb,
-					   ssl = SslOpts}}}, Timeout) ->
-    %% The setopt could have been invoked on the listen socket
-    %% and options should be inherited.
-    EmOptions = emulated_options(),
-    {Transport,_,_, _} = CbInfo,
-    {ok, SocketValues} = ssl_socket:getopts(Transport, ListenSocket, EmOptions),
-    ok = ssl_socket:setopts(Transport, ListenSocket, internal_inet_values()),
+					   ssl = SslOpts,
+					   emulated = Tracker}}}, Timeout) ->   
     case Transport:accept(ListenSocket, Timeout) of
 	{ok, Socket} ->
-	    ok = ssl_socket:setopts(Transport, ListenSocket, SocketValues),
+	    {ok, EmOpts} = ssl_socket:get_emulated_opts(Tracker),
 	    {ok, Port} = ssl_socket:port(Transport, Socket),
 	    ConnArgs = [server, "localhost", Port, Socket,
-			{SslOpts, socket_options(SocketValues)}, self(), CbInfo],
+			{SslOpts, emulated_socket_options(EmOpts, #socket_options{})}, self(), CbInfo],
 	    ConnectionSup = connection_sup(ConnectionCb),
 	    case ConnectionSup:start_child(ConnArgs) of
 		{ok, Pid} ->
@@ -223,16 +221,16 @@ ssl_accept(#sslsocket{} = Socket, SslOptions, Timeout) ->
 ssl_accept(Socket, SslOptions, Timeout) when is_port(Socket) -> 
     {Transport,_,_,_} =
 	proplists:get_value(cb_info, SslOptions, {gen_tcp, tcp, tcp_closed, tcp_error}),
-    EmulatedOptions = emulated_options(),
+    EmulatedOptions = ssl_socket:emulated_options(),
     {ok, SocketValues} = ssl_socket:getopts(Transport, Socket, EmulatedOptions),
     ConnetionCb = connection_cb(SslOptions),
     try handle_options(SslOptions ++ SocketValues, server) of
 	{ok, #config{transport_info = CbInfo, ssl = SslOpts, emulated = EmOpts}} ->
-	    ok = ssl_socket:setopts(Transport, Socket, internal_inet_values()),
+	    ok = ssl_socket:setopts(Transport, Socket, ssl_socket:internal_inet_values()),
 	    {ok, Port} = ssl_socket:port(Transport, Socket),
 	    ssl_connection:ssl_accept(ConnetionCb, Port, Socket,
-				   {SslOpts, EmOpts},
-				   self(), CbInfo, Timeout)
+				      {SslOpts, emulated_socket_options(EmOpts, #socket_options{})},
+				      self(), CbInfo, Timeout)
     catch
 	Error = {error, _Reason} -> Error
     end.
@@ -367,7 +365,7 @@ cipher_suites(all) ->
 %%--------------------------------------------------------------------
 getopts(#sslsocket{pid = Pid}, OptionTags) when is_pid(Pid), is_list(OptionTags) ->
     ssl_connection:get_opts(Pid, OptionTags);
-getopts(#sslsocket{pid = {ListenSocket,  #config{transport_info = {Transport,_,_,_}}}},
+getopts(#sslsocket{pid = {_,  #config{transport_info = {Transport,_,_,_}}}} = ListenSocket,
 	OptionTags) when is_list(OptionTags) ->
     try ssl_socket:getopts(Transport, ListenSocket, OptionTags) of
 	{ok, _} = Result ->
@@ -375,8 +373,8 @@ getopts(#sslsocket{pid = {ListenSocket,  #config{transport_info = {Transport,_,_
 	{error, InetError} ->
 	    {error, {options, {socket_options, OptionTags, InetError}}}
     catch
-	_:_ ->
-	    {error, {options, {socket_options, OptionTags}}}
+	_:Error ->
+	    {error, {options, {socket_options, OptionTags, Error}}}
     end;
 getopts(#sslsocket{}, OptionTags) ->
     {error, {options, {socket_options, OptionTags}}}.
@@ -396,7 +394,7 @@ setopts(#sslsocket{pid = Pid}, Options0) when is_pid(Pid), is_list(Options0)  ->
 	    {error, {options, {not_a_proplist, Options0}}}
     end;
 
-setopts(#sslsocket{pid = {ListenSocket, #config{transport_info = {Transport,_,_,_}}}}, Options) when is_list(Options) ->
+setopts(#sslsocket{pid = {_, #config{transport_info = {Transport,_,_,_}}}} = ListenSocket, Options) when is_list(Options) ->
     try ssl_socket:setopts(Transport, ListenSocket, Options) of
 	ok ->
 	    ok;
@@ -547,7 +545,8 @@ do_connect(Address, Port,
     {Transport, _, _, _} = CbInfo,
     try Transport:connect(Address, Port,  SocketOpts, Timeout) of
 	{ok, Socket} ->
-	    ssl_connection:connect(ConnetionCb, Address, Port, Socket, {SslOpts,EmOpts},
+	    ssl_connection:connect(ConnetionCb, Address, Port, Socket, 
+				   {SslOpts, emulated_socket_options(EmOpts, #socket_options{})},
 				   self(), CbInfo, Timeout);
 	{error, Reason} ->
 	    {error, Reason}
@@ -900,40 +899,24 @@ ca_cert_default(verify_peer, {Fun,_}, _) when is_function(Fun) ->
 %% some trusted certs.
 ca_cert_default(verify_peer, undefined, _) ->
     "".
-
-emulated_options() ->
-    [mode, packet, active, header, packet_size].
-
-internal_inet_values() ->
-    [{packet_size,0},{packet, 0},{header, 0},{active, false},{mode,binary}].
-
-socket_options(InetValues) ->
-    #socket_options{
-		mode   = proplists:get_value(mode, InetValues, lists),
-		header = proplists:get_value(header, InetValues, 0),
-		active = proplists:get_value(active, InetValues, active),
-		packet = proplists:get_value(packet, InetValues, 0),
-		packet_size = proplists:get_value(packet_size, InetValues)
-	       }.
-
 emulated_options(Opts) ->
-    emulated_options(Opts, internal_inet_values(), #socket_options{}).
-
-emulated_options([{mode,Opt}|Opts], Inet, Emulated) ->
-    validate_inet_option(mode,Opt),
-    emulated_options(Opts, Inet, Emulated#socket_options{mode=Opt});
-emulated_options([{header,Opt}|Opts], Inet, Emulated) ->
-    validate_inet_option(header,Opt),
-    emulated_options(Opts, Inet, Emulated#socket_options{header=Opt});
-emulated_options([{active,Opt}|Opts], Inet, Emulated) ->
-    validate_inet_option(active,Opt),
-    emulated_options(Opts, Inet, Emulated#socket_options{active=Opt});
-emulated_options([{packet,Opt}|Opts], Inet, Emulated) ->
-    validate_inet_option(packet,Opt),
-    emulated_options(Opts, Inet, Emulated#socket_options{packet=Opt});
-emulated_options([{packet_size,Opt}|Opts], Inet, Emulated) ->
-    validate_inet_option(packet_size,Opt),
-    emulated_options(Opts, Inet, Emulated#socket_options{packet_size=Opt});
+    emulated_options(Opts, ssl_socket:internal_inet_values(), ssl_socket:default_inet_values()).
+
+emulated_options([{mode, Value} = Opt |Opts], Inet, Emulated) ->
+    validate_inet_option(mode, Value),
+    emulated_options(Opts, Inet, [Opt | proplists:delete(mode, Emulated)]);
+emulated_options([{header, Value} = Opt | Opts], Inet, Emulated) ->
+    validate_inet_option(header, Value),
+    emulated_options(Opts, Inet,  [Opt | proplists:delete(header, Emulated)]);
+emulated_options([{active, Value} = Opt |Opts], Inet, Emulated) ->
+    validate_inet_option(active, Value),
+    emulated_options(Opts, Inet, [Opt | proplists:delete(active, Emulated)]);
+emulated_options([{packet, Value} = Opt |Opts], Inet, Emulated) ->
+    validate_inet_option(packet, Value),
+    emulated_options(Opts, Inet, [Opt | proplists:delete(packet, Emulated)]);
+emulated_options([{packet_size, Value} = Opt | Opts], Inet, Emulated) ->
+    validate_inet_option(packet_size, Value),
+    emulated_options(Opts, Inet, [Opt | proplists:delete(packet_size, Emulated)]);
 emulated_options([Opt|Opts], Inet, Emulated) ->
     emulated_options(Opts, [Opt|Inet], Emulated);
 emulated_options([], Inet,Emulated) ->
@@ -1072,3 +1055,17 @@ assert_proplist([inet6 | Rest]) ->
     assert_proplist(Rest);
 assert_proplist([Value | _]) ->
     throw({option_not_a_key_value_tuple, Value}).
+
+emulated_socket_options(InetValues, #socket_options{
+				       mode   = Mode,
+				       header = Header,
+				       active = Active,
+				       packet = Packet,
+				       packet_size = Size}) ->
+    #socket_options{
+       mode   = proplists:get_value(mode, InetValues, Mode),
+       header = proplists:get_value(header, InetValues, Header),
+       active = proplists:get_value(active, InetValues, Active),
+       packet = proplists:get_value(packet, InetValues, Packet),
+       packet_size = proplists:get_value(packet_size, InetValues, Size)
+      }.
diff --git a/lib/ssl/src/ssl_dist_sup.erl b/lib/ssl/src/ssl_dist_sup.erl
index 22614a2d34..58efeaf892 100644
--- a/lib/ssl/src/ssl_dist_sup.erl
+++ b/lib/ssl/src/ssl_dist_sup.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2011-2013. All Rights Reserved.
+%% Copyright Ericsson AB 2011-2014. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -45,9 +45,11 @@ start_link() ->
 init([]) ->    
     SessionCertManager = session_and_cert_manager_child_spec(),
     ConnetionManager = connection_manager_child_spec(),
+    ListenOptionsTracker = listen_options_tracker_child_spec(), 
     ProxyServer = proxy_server_child_spec(),
 
-    {ok, {{one_for_all, 10, 3600}, [SessionCertManager, ConnetionManager,
+    {ok, {{one_for_all, 10, 3600}, [SessionCertManager, ConnetionManager, 
+				    ListenOptionsTracker,
 				    ProxyServer]}}.
 
 %%--------------------------------------------------------------------
@@ -68,7 +70,7 @@ connection_manager_child_spec() ->
     StartFunc = {tls_connection_sup, start_link_dist, []},
     Restart = permanent, 
     Shutdown = 4000,
-    Modules = [ssl_connection],
+    Modules = [tls_connection_sup],
     Type = supervisor,
     {Name, StartFunc, Restart, Shutdown, Type, Modules}.
 
@@ -81,3 +83,11 @@ proxy_server_child_spec() ->
     Type = worker,
     {Name, StartFunc, Restart, Shutdown, Type, Modules}.
 
+listen_options_tracker_child_spec() ->
+    Name = ssl_socket_dist,  
+    StartFunc = {ssl_listen_tracker_sup, start_link_dist, []},
+    Restart = permanent, 
+    Shutdown = 4000,
+    Modules = [ssl_socket],
+    Type = supervisor,
+    {Name, StartFunc, Restart, Shutdown, Type, Modules}.
diff --git a/lib/ssl/src/ssl_internal.hrl b/lib/ssl/src/ssl_internal.hrl
index 8bf5b30a83..fd0d87bd5f 100644
--- a/lib/ssl/src/ssl_internal.hrl
+++ b/lib/ssl/src/ssl_internal.hrl
@@ -116,14 +116,6 @@
 	  honor_cipher_order = false
 	  }).
 
--record(config, {ssl,               %% SSL parameters
-		 inet_user,         %% User set inet options
-		 emulated,          %% #socket_option{} emulated
-		 inet_ssl,          %% inet options for internal ssl socket
-		 transport_info,                 %% Callback info
-		 connection_cb
-		}).
-
 -record(socket_options,
 	{
 	  mode   = list, 
@@ -133,6 +125,15 @@
 	  active = true
 	 }).
 
+-record(config, {ssl,               %% SSL parameters
+		 inet_user,         %% User set inet options
+		 emulated,          %% Emulated option list or "inherit_tracker" pid 
+		 inet_ssl,          %% inet options for internal ssl socket
+		 transport_info,                 %% Callback info
+		 connection_cb
+		}).
+
+
 -type state_name()           :: hello | abbreviated | certify | cipher | connection.
 -type gen_fsm_state_return() :: {next_state, state_name(), term()} |
 				{next_state, state_name(), term(), timeout()} |
diff --git a/lib/ssl/src/ssl_listen_tracker_sup.erl b/lib/ssl/src/ssl_listen_tracker_sup.erl
new file mode 100644
index 0000000000..29f40e846d
--- /dev/null
+++ b/lib/ssl/src/ssl_listen_tracker_sup.erl
@@ -0,0 +1,71 @@
+%%
+%% %CopyrightBegin%
+%% 
+%% Copyright Ericsson AB 2014-2014. All Rights Reserved.
+%% 
+%% The contents of this file are subject to the Erlang Public License,
+%% Version 1.1, (the "License"); you may not use this file except in
+%% compliance with the License. You should have received a copy of the
+%% Erlang Public License along with this software. If not, it can be
+%% retrieved online at http://www.erlang.org/.
+%% 
+%% Software distributed under the License is distributed on an "AS IS"
+%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+%% the License for the specific language governing rights and limitations
+%% under the License.
+%% 
+%% %CopyrightEnd%
+%%
+
+%%
+%%----------------------------------------------------------------------
+%% Purpose: Supervisor for a listen options tracker
+%%----------------------------------------------------------------------
+-module(ssl_listen_tracker_sup).
+
+-behaviour(supervisor).
+
+%% API
+-export([start_link/0, start_link_dist/0]).
+-export([start_child/1, start_child_dist/1]).
+
+%% Supervisor callback
+-export([init/1]).
+
+%%%=========================================================================
+%%%  API
+%%%=========================================================================
+start_link() ->
+    supervisor:start_link({local, tracker_name(normal)}, ?MODULE, []).
+
+start_link_dist() ->
+    supervisor:start_link({local, tracker_name(dist)}, ?MODULE, []).
+
+start_child(Args) ->
+    supervisor:start_child(tracker_name(normal), Args).
+
+start_child_dist(Args) ->
+    supervisor:start_child(tracker_name(dist), Args).
+  
+%%%=========================================================================
+%%%  Supervisor callback
+%%%=========================================================================
+init(_O) ->
+    RestartStrategy = simple_one_for_one,
+    MaxR = 0,
+    MaxT = 3600,
+   
+    Name = undefined, % As simple_one_for_one is used.
+    StartFunc = {ssl_socket, start_link, []},
+    Restart = temporary, % E.g. should not be restarted
+    Shutdown = 4000,
+    Modules = [ssl_socket],
+    Type = worker,
+    
+    ChildSpec = {Name, StartFunc, Restart, Shutdown, Type, Modules},
+    {ok, {{RestartStrategy, MaxR, MaxT}, [ChildSpec]}}.
+
+tracker_name(normal) ->
+    ?MODULE;
+tracker_name(dist) ->
+    list_to_atom(atom_to_list(?MODULE) ++ "dist").
diff --git a/lib/ssl/src/ssl_socket.erl b/lib/ssl/src/ssl_socket.erl
index 1b6e637cd3..e42d637301 100644
--- a/lib/ssl/src/ssl_socket.erl
+++ b/lib/ssl/src/ssl_socket.erl
@@ -1,20 +1,72 @@
+%%
+%% %CopyrightBegin%
+%%
+%% Copyright Ericsson AB 1998-2014. All Rights Reserved.
+%%
+%% The contents of this file are subject to the Erlang Public License,
+%% Version 1.1, (the "License"); you may not use this file except in
+%% compliance with the License. You should have received a copy of the
+%% Erlang Public License along with this software. If not, it can be
+%% retrieved online at http://www.erlang.org/.
+%%
+%% Software distributed under the License is distributed on an "AS IS"
+%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+%% the License for the specific language governing rights and limitations
+%% under the License.
+%%
+%% %CopyrightEnd%
+%%
 -module(ssl_socket).
 
+-behaviour(gen_server).
+
 -include("ssl_internal.hrl").
 -include("ssl_api.hrl").
 
 -export([socket/4, setopts/3, getopts/3, peername/2, sockname/2, port/2]).
+-export([emulated_options/0, internal_inet_values/0, default_inet_values/0,
+	 init/1, start_link/2, terminate/2, inherit_tracker/3, get_emulated_opts/1, 
+	 set_emulated_opts/2, handle_call/3, handle_cast/2,
+	 handle_info/2, code_change/3]).
+
+-record(state, {
+	  emulated_opts,
+	  port
+	 }).
 
+%%--------------------------------------------------------------------
+%%% Internal API
+%%--------------------------------------------------------------------
 socket(Pid, Transport, Socket, ConnectionCb) ->
     #sslsocket{pid = Pid, 
 	       %% "The name "fd" is keept for backwards compatibility
 	       fd = {Transport, Socket, ConnectionCb}}.
-
+setopts(gen_tcp, #sslsocket{pid = {ListenSocket, #config{emulated = Tracker}}}, Options) ->
+    {SockOpts, EmulatedOpts} = split_options(Options),
+    ok = set_emulated_opts(Tracker, EmulatedOpts),
+    inet:setopts(ListenSocket, SockOpts);
+setopts(_, #sslsocket{pid = {ListenSocket, #config{transport_info = {Transport,_,_,_},
+						  emulated = Tracker}}}, Options) ->
+    {SockOpts, EmulatedOpts} = split_options(Options),
+    ok = set_emulated_opts(Tracker, EmulatedOpts),
+    Transport:setopts(ListenSocket, SockOpts);
+%%% Following clauses will not be called for emulated options, they are  handled in the connection process
 setopts(gen_tcp, Socket, Options) ->
     inet:setopts(Socket, Options);
 setopts(Transport, Socket, Options) ->
     Transport:setopts(Socket, Options).
 
+getopts(gen_tcp,  #sslsocket{pid = {ListenSocket, #config{emulated = Tracker}}}, Options) ->
+    {SockOptNames, EmulatedOptNames} = split_options(Options),
+    EmulatedOpts = get_emulated_opts(Tracker, EmulatedOptNames),
+    SocketOpts = get_socket_opts(ListenSocket, SockOptNames, inet),
+    {ok, EmulatedOpts ++ SocketOpts}; 
+getopts(Transport,  #sslsocket{pid = {ListenSocket, #config{emulated = Tracker}}}, Options) ->
+    {SockOptNames, EmulatedOptNames} = split_options(Options),
+    EmulatedOpts = get_emulated_opts(Tracker, EmulatedOptNames),
+    SocketOpts = get_socket_opts(ListenSocket, SockOptNames, Transport),
+    {ok, EmulatedOpts ++ SocketOpts}; 
+%%% Following clauses will not be called for emulated options, they are  handled in the connection process
 getopts(gen_tcp, Socket, Options) ->
     inet:getopts(Socket, Options);
 getopts(Transport, Socket, Options) ->
@@ -34,3 +86,144 @@ port(gen_tcp, Socket) ->
     inet:port(Socket);
 port(Transport, Socket) ->
     Transport:port(Socket).
+
+emulated_options() ->
+    [mode, packet, active, header, packet_size].
+
+internal_inet_values() ->
+    [{packet_size,0}, {packet, 0}, {header, 0}, {active, false}, {mode,binary}].
+
+default_inet_values() ->
+    [{packet_size, 0}, {packet,0}, {header, 0}, {active, true}, {mode, list}].
+
+inherit_tracker(ListenSocket, EmOpts, #ssl_options{erl_dist = false}) ->
+    ssl_listen_tracker_sup:start_child([ListenSocket, EmOpts]);
+inherit_tracker(ListenSocket, EmOpts, #ssl_options{erl_dist = true}) ->
+    ssl_listen_tracker_sup:start_child_dist([ListenSocket, EmOpts]).
+
+get_emulated_opts(TrackerPid, EmOptNames) -> 
+    {ok, EmOpts} = get_emulated_opts(TrackerPid),
+    lists:map(fun(Name) -> {value, Value} = lists:keysearch(Name, 1, EmOpts),
+			   Value end,
+	      EmOptNames).
+
+get_emulated_opts(TrackerPid) -> 
+    call(TrackerPid, get_emulated_opts).
+set_emulated_opts(TrackerPid, InetValues) -> 
+    call(TrackerPid, {set_emulated_opts, InetValues}).
+
+%%====================================================================
+%% ssl_listen_tracker_sup API
+%%====================================================================
+
+start_link(Port, SockOpts) ->
+    gen_server:start_link(?MODULE, [Port, SockOpts], []).
+
+%%--------------------------------------------------------------------
+-spec init(list()) -> {ok, #state{}}.
+%% Possible return values not used now. 
+%% |  {ok, #state{}, timeout()} | ignore | {stop, term()}.		  
+%%
+%% Description: Initiates the server
+%%--------------------------------------------------------------------
+init([Port, Opts]) ->
+    process_flag(trap_exit, true),
+    true = link(Port),
+    {ok, #state{emulated_opts = Opts, port = Port}}.
+
+%%--------------------------------------------------------------------
+-spec handle_call(msg(), from(), #state{}) -> {reply, reply(), #state{}}. 
+%% Possible return values not used now.  
+%%					      {reply, reply(), #state{}, timeout()} |
+%%					      {noreply, #state{}} |
+%%					      {noreply, #state{}, timeout()} |
+%%					      {stop, reason(), reply(), #state{}} |
+%%					      {stop, reason(), #state{}}.
+%%
+%% Description: Handling call messages
+%%--------------------------------------------------------------------
+handle_call({set_emulated_opts, Opts0}, _From,
+	    #state{emulated_opts = Opts1} = State) ->
+    Opts = do_set_emulated_opts(Opts0, Opts1),
+    {reply, ok, State#state{emulated_opts = Opts}};
+handle_call(get_emulated_opts, _From,
+	    #state{emulated_opts = Opts} = State) ->
+    {reply, {ok, Opts}, State}.
+
+%%--------------------------------------------------------------------
+-spec  handle_cast(msg(), #state{}) -> {noreply, #state{}}.
+%% Possible return values not used now.  
+%%				      | {noreply, #state{}, timeout()} |
+%%				       {stop, reason(), #state{}}.
+%%
+%% Description: Handling cast messages
+%%--------------------------------------------------------------------
+handle_cast(_, State)-> 
+    {noreply, State}.
+
+%%--------------------------------------------------------------------
+-spec handle_info(msg(), #state{}) -> {noreply, #state{}}.
+%% Possible return values not used now.
+%%				      |{noreply, #state{}, timeout()} |
+%%				      {stop, reason(), #state{}}.
+%%
+%% Description: Handling all non call/cast messages
+%%-------------------------------------------------------------------
+handle_info({'EXIT', Port, _}, #state{port = Port} = State) ->
+    {stop, normal, State}.
+
+
+%%--------------------------------------------------------------------
+-spec terminate(reason(), #state{}) -> ok.
+%%		       
+%% Description: This function is called by a gen_server when it is about to
+%% terminate. It should be the opposite of Module:init/1 and do any necessary
+%% cleaning up. When it returns, the gen_server terminates with Reason.
+%% The return value is ignored.
+%%--------------------------------------------------------------------
+terminate(_Reason, _State) ->
+    ok.
+
+%%--------------------------------------------------------------------
+-spec code_change(term(), #state{}, list()) -> {ok, #state{}}.			 
+%%
+%% Description: Convert process state when code is changed
+%%--------------------------------------------------------------------
+code_change(_OldVsn, State, _Extra) ->
+    {ok, State}.
+
+%%--------------------------------------------------------------------
+%%% Internal functions
+%%--------------------------------------------------------------------
+call(Pid, Msg) ->
+    gen_server:call(Pid, Msg, infinity).
+
+split_options(Opts) ->
+    split_options(Opts, emulated_options(), [], []).
+split_options([], _, SocketOpts, EmuOpts) ->
+    {SocketOpts, EmuOpts};
+split_options([{Name, _} = Opt | Opts], Emu, SocketOpts, EmuOpts) ->
+    case lists:member(Name, Emu) of
+	true ->
+	    split_options(Opts, Emu, SocketOpts, [Opt | EmuOpts]);
+	false ->
+	    split_options(Opts, Emu, [Opt | SocketOpts], EmuOpts)
+    end;
+split_options([Name | Opts], Emu, SocketOptNames, EmuOptNames) ->
+    case lists:member(Name, Emu) of
+	true ->
+	    split_options(Opts, Emu, SocketOptNames, [Name | EmuOptNames]);
+	false ->
+	    split_options(Opts, Emu, [Name | SocketOptNames], EmuOptNames)
+    end.
+
+do_set_emulated_opts([], Opts) ->
+    Opts;
+do_set_emulated_opts([{Name,_} = Opt | Rest], Opts) ->
+    do_set_emulated_opts(Rest, [Opt | proplists:delete(Name, Opts)]).
+
+get_socket_opts(_, [], _) ->
+    [];
+get_socket_opts(ListenSocket, SockOptNames, Cb) ->
+    {ok, Opts} = Cb:getopts(ListenSocket, SockOptNames),
+    Opts.
diff --git a/lib/ssl/src/ssl_sup.erl b/lib/ssl/src/ssl_sup.erl
index e1aeb11ca4..7cccf8d5a5 100644
--- a/lib/ssl/src/ssl_sup.erl
+++ b/lib/ssl/src/ssl_sup.erl
@@ -47,8 +47,10 @@ init([]) ->
     TLSConnetionManager = tls_connection_manager_child_spec(),
     %% Not supported yet
     %%DTLSConnetionManager = tls_connection_manager_child_spec(),
-
-    {ok, {{one_for_all, 10, 3600}, [SessionCertManager, TLSConnetionManager]}}.
+    %% Handles emulated options so that they inherited by the accept socket, even when setopts is performed on 
+    %% the listen socket
+    ListenOptionsTracker = listen_options_tracker_child_spec(), 
+    {ok, {{one_for_all, 10, 3600}, [SessionCertManager, TLSConnetionManager, ListenOptionsTracker]}}.
 
 
 manager_opts() ->
@@ -85,7 +87,7 @@ tls_connection_manager_child_spec() ->
     StartFunc = {tls_connection_sup, start_link, []},
     Restart = permanent, 
     Shutdown = 4000,
-    Modules = [tls_connection, ssl_connection],
+    Modules = [tls_connection_sup],
     Type = supervisor,
     {Name, StartFunc, Restart, Shutdown, Type, Modules}.
 
@@ -98,6 +100,17 @@ tls_connection_manager_child_spec() ->
 %%     Type = supervisor,
 %%     {Name, StartFunc, Restart, Shutdown, Type, Modules}.
 
+
+listen_options_tracker_child_spec() ->
+    Name = ssl_socket,  
+    StartFunc = {ssl_listen_tracker_sup, start_link, []},
+    Restart = permanent, 
+    Shutdown = 4000,
+    Modules = [ssl_socket],
+    Type = supervisor,
+    {Name, StartFunc, Restart, Shutdown, Type, Modules}.
+
+
 session_cb_init_args() ->
     case application:get_env(ssl, session_cb_init_args) of
 	{ok, Args} when is_list(Args) ->
diff --git a/lib/ssl/src/tls_connection_sup.erl b/lib/ssl/src/tls_connection_sup.erl
index 6f0d8a7262..7a637c212a 100644
--- a/lib/ssl/src/tls_connection_sup.erl
+++ b/lib/ssl/src/tls_connection_sup.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %% 
-%% Copyright Ericsson AB 2007-2013. All Rights Reserved.
+%% Copyright Ericsson AB 2007-2014. All Rights Reserved.
 %% 
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -59,7 +59,7 @@ init(_O) ->
     StartFunc = {tls_connection, start_link, []},
     Restart = temporary, % E.g. should not be restarted
     Shutdown = 4000,
-    Modules = [tls_connection],
+    Modules = [tls_connection, ssl_connection],
     Type = worker,
     
     ChildSpec = {Name, StartFunc, Restart, Shutdown, Type, Modules},
diff --git a/lib/ssl/test/ssl_basic_SUITE.erl b/lib/ssl/test/ssl_basic_SUITE.erl
index 406be65c3b..36858db4b4 100644
--- a/lib/ssl/test/ssl_basic_SUITE.erl
+++ b/lib/ssl/test/ssl_basic_SUITE.erl
@@ -139,7 +139,8 @@ api_tests() ->
      ssl_accept_timeout,
      ssl_recv_timeout,
      versions_option,
-     server_name_indication_option
+     server_name_indication_option,
+     accept_pool
     ].
 
 session_tests() ->
@@ -3124,6 +3125,53 @@ server_name_indication_option(Config) when is_list(Config) ->
     ssl_test_lib:close(Server),
     ssl_test_lib:close(Client0),
     ssl_test_lib:close(Client1).
+%%--------------------------------------------------------------------
+
+accept_pool() ->
+    [{doc,"Test having an accept pool."}].
+accept_pool(Config) when is_list(Config) ->
+    ClientOpts = ?config(client_opts, Config),
+    ServerOpts = ?config(server_opts, Config),  
+
+    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+    Server0 = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
+					{from, self()}, 
+					{accepters, 3},
+					{mfa, {ssl_test_lib, send_recv_result_active, []}},
+					{options, ServerOpts}]),
+    Port = ssl_test_lib:inet_port(Server0),
+    [Server1, Server2] = ssl_test_lib:accepters(2),
+
+    Client0 = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
+					 {host, Hostname},
+					 {from, self()}, 
+					 {mfa, {ssl_test_lib, send_recv_result_active, []}},
+					 {options, ClientOpts}
+					]),
+    
+    Client1 = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
+					 {host, Hostname},
+					 {from, self()}, 
+					 {mfa, {ssl_test_lib, send_recv_result_active, []}},
+					 {options, ClientOpts}
+					]),
+    
+    Client2 = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
+					 {host, Hostname},
+					 {from, self()}, 
+					 {mfa, {ssl_test_lib, send_recv_result_active, []}},
+					 {options, ClientOpts}
+					]),
+    
+    ssl_test_lib:check_ok([Server0, Server1, Server2, Client0, Client1, Client2]),
+    
+    ssl_test_lib:close(Server0),
+    ssl_test_lib:close(Server1),
+    ssl_test_lib:close(Server2),
+    ssl_test_lib:close(Client0),
+    ssl_test_lib:close(Client1),
+    ssl_test_lib:close(Client2).
+    
 
 %%--------------------------------------------------------------------
 %% Internal functions ------------------------------------------------
diff --git a/lib/ssl/test/ssl_test_lib.erl b/lib/ssl/test/ssl_test_lib.erl
index 59f10d53a6..69b222fc43 100644
--- a/lib/ssl/test/ssl_test_lib.erl
+++ b/lib/ssl/test/ssl_test_lib.erl
@@ -67,7 +67,16 @@ run_server(Opts) ->
     run_server(ListenSocket, Opts).
 
 run_server(ListenSocket, Opts) ->
-    do_run_server(ListenSocket, connect(ListenSocket, Opts), Opts).
+    Accepters = proplists:get_value(accepters, Opts, 1),
+    run_server(ListenSocket, Opts, Accepters). 
+    
+run_server(ListenSocket, Opts, 1) ->
+    do_run_server(ListenSocket, connect(ListenSocket, Opts), Opts);
+run_server(ListenSocket, Opts, N) ->
+    Pid = proplists:get_value(from, Opts),
+    Server = spawn(?MODULE, run_server, [ListenSocket, Opts, 1]),
+    Pid ! {accepter, N, Server},
+    run_server(ListenSocket, Opts, N-1).
 
 do_run_server(_, {error, timeout} = Result, Opts)  ->
     Pid = proplists:get_value(from, Opts),
@@ -290,7 +299,16 @@ wait_for_result(Server, ServerMsg, Client, ClientMsg) ->
 	%%     Unexpected
     end.
 
-
+check_ok([]) ->
+    ok;
+check_ok(Pids) ->
+    receive 
+	{Pid, ok} ->
+	    check_ok(lists:delete(Pid, Pids));
+	Other ->
+	    ct:fail({expected, {"pid()", ok}, got, Other})
+    end.
+	
 wait_for_result(Pid, Msg) -> 
     receive 
 	{Pid, Msg} -> 
@@ -679,6 +697,17 @@ run_client_error(Opts) ->
     Error = rpc:call(Node, Transport, connect, [Host, Port, Options]),
     Pid ! {self(), Error}.
 
+accepters(N) ->
+    accepters([], N).
+
+accepters(Acc, 0) ->
+    Acc;
+accepters(Acc, N) ->
+    receive 
+	{accepter, _, Server} ->
+	    accepters([Server| Acc], N-1)
+    end.
+
 inet_port(Pid) when is_pid(Pid)->
     receive
 	{Pid, {port, Port}} ->