inets: Add tests using external proxy running on localhost

6 files changed, 1296 insertions, 1 deletions

diff --git a/lib/inets/test/Makefile b/lib/inets/test/Makefile
index 0fc98eff6f..0ca99e8692 100644
--- a/lib/inets/test/Makefile
+++ b/lib/inets/test/Makefile
@@ -149,6 +149,7 @@ INETS_ROOT = ../../inets
 
 MODULES =                 		\
 	inets_test_lib    		\
+	erl_make_certs                  \
 	ftp_SUITE 	  		\
 	ftp_format_SUITE  		\
 	ftp_solaris8_sparc_test		\
@@ -169,6 +170,7 @@ MODULES =                 		\
 	http_format_SUITE 		\
 	httpc_SUITE	  		\
 	httpc_cookie_SUITE		\
+	httpc_proxy_SUITE		\
 	httpd_SUITE       		\
 	httpd_basic_SUITE		\
 	httpd_mod 	  		\
@@ -213,7 +215,7 @@ INETS_FILES = inets.config $(INETS_SPECS)
 
 INETS_DATADIRS = inets_SUITE_data inets_sup_SUITE_data 
 HTTPD_DATADIRS = httpd_test_data httpd_SUITE_data
-HTTPC_DATADIRS = httpc_SUITE_data
+HTTPC_DATADIRS = httpc_SUITE_data httpc_proxy_SUITE_data
 FTP_DATADIRS   = ftp_SUITE_data  
 
 DATADIRS     = $(INETS_DATADIRS) $(HTTPD_DATADIRS) $(HTTPC_DATADIRS) $(FTP_DATADIRS)
diff --git a/lib/inets/test/erl_make_certs.erl b/lib/inets/test/erl_make_certs.erl
new file mode 100644
index 0000000000..bac88dc277
--- /dev/null
+++ b/lib/inets/test/erl_make_certs.erl
@@ -0,0 +1,429 @@
+%%
+%% %CopyrightBegin%
+%%
+%% Copyright Ericsson AB 2011. All Rights Reserved.
+%%
+%% The contents of this file are subject to the Erlang Public License,
+%% Version 1.1, (the "License"); you may not use this file except in
+%% compliance with the License. You should have received a copy of the
+%% Erlang Public License along with this software. If not, it can be
+%% retrieved online at http://www.erlang.org/.
+%%
+%% Software distributed under the License is distributed on an "AS IS"
+%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+%% the License for the specific language governing rights and limitations
+%% under the License.
+%%
+%% %CopyrightEnd%
+%%
+
+%% Create test certificates
+
+-module(erl_make_certs).
+-include_lib("public_key/include/public_key.hrl").
+
+-export([make_cert/1, gen_rsa/1, verify_signature/3, write_pem/3]).
+-compile(export_all).
+
+%%--------------------------------------------------------------------
+%% @doc  Create and return a der encoded certificate
+%%   Option                                         Default
+%%   -------------------------------------------------------
+%%   digest                                         sha1
+%%   validity                                       {date(), date() + week()}
+%%   version                                        3
+%%   subject                                        [] list of the following content
+%%      {name,  Name}
+%%      {email, Email}
+%%      {city,  City}
+%%      {state, State}
+%%      {org, Org}
+%%      {org_unit, OrgUnit}
+%%      {country, Country}
+%%      {serial, Serial}
+%%      {title, Title}
+%%      {dnQualifer, DnQ}
+%%   issuer = {Issuer, IssuerKey}                   true (i.e. a ca cert is created)
+%%                                                  (obs IssuerKey migth be {Key, Password}
+%%   key = KeyFile|KeyBin|rsa|dsa                   Subject PublicKey rsa or dsa generates key
+%%
+%%
+%%   (OBS: The generated keys are for testing only)
+%% @spec ([{::atom(), ::term()}]) -> {Cert::binary(), Key::binary()}
+%% @end
+%%--------------------------------------------------------------------
+
+make_cert(Opts) ->
+    SubjectPrivateKey = get_key(Opts),
+    {TBSCert, IssuerKey} = make_tbs(SubjectPrivateKey, Opts),
+    Cert = public_key:pkix_sign(TBSCert, IssuerKey),
+    true = verify_signature(Cert, IssuerKey, undef), %% verify that the keys where ok
+    {Cert, encode_key(SubjectPrivateKey)}.
+
+%%--------------------------------------------------------------------
+%% @doc Writes pem files in Dir with FileName ++ ".pem" and FileName ++ "_key.pem"
+%% @spec (::string(), ::string(), {Cert,Key}) -> ok
+%% @end
+%%--------------------------------------------------------------------
+write_pem(Dir, FileName, {Cert, Key = {_,_,not_encrypted}}) when is_binary(Cert) ->
+    ok = der_to_pem(filename:join(Dir, FileName ++ ".pem"),
+			       [{'Certificate', Cert, not_encrypted}]),
+    ok = der_to_pem(filename:join(Dir, FileName ++ "_key.pem"), [Key]).
+
+%%--------------------------------------------------------------------
+%% @doc Creates a rsa key (OBS: for testing only)
+%%   the size are in bytes
+%% @spec (::integer()) -> {::atom(), ::binary(), ::opaque()}
+%% @end
+%%--------------------------------------------------------------------
+gen_rsa(Size) when is_integer(Size) ->
+    Key = gen_rsa2(Size),
+    {Key, encode_key(Key)}.
+
+%%--------------------------------------------------------------------
+%% @doc Creates a dsa key (OBS: for testing only)
+%%   the sizes are in bytes
+%% @spec (::integer()) -> {::atom(), ::binary(), ::opaque()}
+%% @end
+%%--------------------------------------------------------------------
+gen_dsa(LSize,NSize) when is_integer(LSize), is_integer(NSize) ->
+    Key = gen_dsa2(LSize, NSize),
+    {Key, encode_key(Key)}.
+
+%%--------------------------------------------------------------------
+%% @doc Verifies cert signatures
+%% @spec (::binary(), ::tuple()) -> ::boolean()
+%% @end
+%%--------------------------------------------------------------------
+verify_signature(DerEncodedCert, DerKey, _KeyParams) ->
+    Key = decode_key(DerKey),
+    case Key of
+	#'RSAPrivateKey'{modulus=Mod, publicExponent=Exp} ->
+	    public_key:pkix_verify(DerEncodedCert,
+				   #'RSAPublicKey'{modulus=Mod, publicExponent=Exp});
+	#'DSAPrivateKey'{p=P, q=Q, g=G, y=Y} ->
+	    public_key:pkix_verify(DerEncodedCert, {Y, #'Dss-Parms'{p=P, q=Q, g=G}})
+    end.
+
+%%%%%%%%%%%%%%%%%%%%%%%%% Implementation %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+get_key(Opts) ->
+    case proplists:get_value(key, Opts) of
+	undefined -> make_key(rsa, Opts);
+	rsa ->       make_key(rsa, Opts);
+	dsa ->       make_key(dsa, Opts);
+	Key ->
+	    Password = proplists:get_value(password, Opts, no_passwd),
+	    decode_key(Key, Password)
+    end.
+
+decode_key({Key, Pw}) ->
+    decode_key(Key, Pw);
+decode_key(Key) ->
+    decode_key(Key, no_passwd).
+
+
+decode_key(#'RSAPublicKey'{} = Key,_) ->
+    Key;
+decode_key(#'RSAPrivateKey'{} = Key,_) ->
+    Key;
+decode_key(#'DSAPrivateKey'{} = Key,_) ->
+    Key;
+decode_key(PemEntry = {_,_,_}, Pw) ->
+    public_key:pem_entry_decode(PemEntry, Pw);
+decode_key(PemBin, Pw) ->
+    [KeyInfo] = public_key:pem_decode(PemBin),
+    decode_key(KeyInfo, Pw).
+
+encode_key(Key = #'RSAPrivateKey'{}) ->
+    {ok, Der} = 'OTP-PUB-KEY':encode('RSAPrivateKey', Key),
+    {'RSAPrivateKey', list_to_binary(Der), not_encrypted};
+encode_key(Key = #'DSAPrivateKey'{}) ->
+    {ok, Der} = 'OTP-PUB-KEY':encode('DSAPrivateKey', Key),
+    {'DSAPrivateKey', list_to_binary(Der), not_encrypted}.
+
+make_tbs(SubjectKey, Opts) ->
+    Version = list_to_atom("v"++integer_to_list(proplists:get_value(version, Opts, 3))),
+
+    IssuerProp = proplists:get_value(issuer, Opts, true),
+    {Issuer, IssuerKey}  = issuer(IssuerProp, Opts, SubjectKey),
+
+    {Algo, Parameters} = sign_algorithm(IssuerKey, Opts),
+
+    SignAlgo = #'SignatureAlgorithm'{algorithm  = Algo,
+				     parameters = Parameters},
+    Subject = case IssuerProp of
+		  true -> %% Is a Root Ca
+		      Issuer;
+		  _ ->
+		      subject(proplists:get_value(subject, Opts),false)
+	      end,
+
+    {#'OTPTBSCertificate'{serialNumber = trunc(random:uniform()*100000000)*10000 + 1,
+			  signature    = SignAlgo,
+			  issuer       = Issuer,
+			  validity     = validity(Opts),
+			  subject      = Subject,
+			  subjectPublicKeyInfo = publickey(SubjectKey),
+			  version      = Version,
+			  extensions   = extensions(Opts)
+			 }, IssuerKey}.
+
+issuer(true, Opts, SubjectKey) ->
+    %% Self signed
+    {subject(proplists:get_value(subject, Opts), true), SubjectKey};
+issuer({Issuer, IssuerKey}, _Opts, _SubjectKey) when is_binary(Issuer) ->
+    {issuer_der(Issuer), decode_key(IssuerKey)};
+issuer({File, IssuerKey}, _Opts, _SubjectKey) when is_list(File) ->
+    {ok, [{cert, Cert, _}|_]} = pem_to_der(File),
+    {issuer_der(Cert), decode_key(IssuerKey)}.
+
+issuer_der(Issuer) ->
+    Decoded = public_key:pkix_decode_cert(Issuer, otp),
+    #'OTPCertificate'{tbsCertificate=Tbs} = Decoded,
+    #'OTPTBSCertificate'{subject=Subject} = Tbs,
+    Subject.
+
+subject(undefined, IsRootCA) ->
+    User = if IsRootCA -> "RootCA"; true -> user() end,
+    Opts = [{email, User ++ "@erlang.org"},
+	    {name, User},
+	    {city, "Stockholm"},
+	    {country, "SE"},
+	    {org, "erlang"},
+	    {org_unit, "testing dep"}],
+    subject(Opts);
+subject(Opts, _) ->
+    subject(Opts).
+
+user() ->
+    case os:getenv("USER") of
+	false ->
+	    "test_user";
+	User ->
+	    User
+    end.
+
+subject(SubjectOpts) when is_list(SubjectOpts) ->
+    Encode = fun(Opt) ->
+		     {Type,Value} = subject_enc(Opt),
+		     [#'AttributeTypeAndValue'{type=Type, value=Value}]
+	     end,
+    {rdnSequence, [Encode(Opt) || Opt <- SubjectOpts]}.
+
+%% Fill in the blanks
+subject_enc({name,  Name}) ->       {?'id-at-commonName', {printableString, Name}};
+subject_enc({email, Email}) ->      {?'id-emailAddress', Email};
+subject_enc({city,  City}) ->       {?'id-at-localityName', {printableString, City}};
+subject_enc({state, State}) ->      {?'id-at-stateOrProvinceName', {printableString, State}};
+subject_enc({org, Org}) ->          {?'id-at-organizationName', {printableString, Org}};
+subject_enc({org_unit, OrgUnit}) -> {?'id-at-organizationalUnitName', {printableString, OrgUnit}};
+subject_enc({country, Country}) ->  {?'id-at-countryName', Country};
+subject_enc({serial, Serial}) ->    {?'id-at-serialNumber', Serial};
+subject_enc({title, Title}) ->      {?'id-at-title', {printableString, Title}};
+subject_enc({dnQualifer, DnQ}) ->   {?'id-at-dnQualifier', DnQ};
+subject_enc(Other) ->               Other.
+
+
+extensions(Opts) ->
+    case proplists:get_value(extensions, Opts, []) of
+	false ->
+	    asn1_NOVALUE;
+	Exts  ->
+	    lists:flatten([extension(Ext) || Ext <- default_extensions(Exts)])
+    end.
+
+default_extensions(Exts) ->
+    Def = [{key_usage,undefined},
+	   {subject_altname, undefined},
+	   {issuer_altname, undefined},
+	   {basic_constraints, default},
+	   {name_constraints, undefined},
+	   {policy_constraints, undefined},
+	   {ext_key_usage, undefined},
+	   {inhibit_any, undefined},
+	   {auth_key_id, undefined},
+	   {subject_key_id, undefined},
+	   {policy_mapping, undefined}],
+    Filter = fun({Key, _}, D) -> lists:keydelete(Key, 1, D) end,
+    Exts ++ lists:foldl(Filter, Def, Exts).
+
+extension({_, undefined}) -> [];
+extension({basic_constraints, Data}) ->
+    case Data of
+	default ->
+	    #'Extension'{extnID = ?'id-ce-basicConstraints',
+			 extnValue = #'BasicConstraints'{cA=true},
+			 critical=true};
+	false ->
+	    [];
+	Len when is_integer(Len) ->
+	    #'Extension'{extnID = ?'id-ce-basicConstraints',
+			 extnValue = #'BasicConstraints'{cA=true, pathLenConstraint=Len},
+			 critical=true};
+	_ ->
+	    #'Extension'{extnID = ?'id-ce-basicConstraints',
+			 extnValue = Data}
+    end;
+extension({Id, Data, Critical}) ->
+    #'Extension'{extnID = Id, extnValue = Data, critical = Critical}.
+
+
+publickey(#'RSAPrivateKey'{modulus=N, publicExponent=E}) ->
+    Public = #'RSAPublicKey'{modulus=N, publicExponent=E},
+    Algo = #'PublicKeyAlgorithm'{algorithm= ?rsaEncryption, parameters='NULL'},
+    #'OTPSubjectPublicKeyInfo'{algorithm = Algo,
+			       subjectPublicKey = Public};
+publickey(#'DSAPrivateKey'{p=P, q=Q, g=G, y=Y}) ->
+    Algo = #'PublicKeyAlgorithm'{algorithm= ?'id-dsa',
+				 parameters={params, #'Dss-Parms'{p=P, q=Q, g=G}}},
+    #'OTPSubjectPublicKeyInfo'{algorithm = Algo, subjectPublicKey = Y}.
+
+validity(Opts) ->
+    DefFrom0 = calendar:gregorian_days_to_date(calendar:date_to_gregorian_days(date())-1),
+    DefTo0   = calendar:gregorian_days_to_date(calendar:date_to_gregorian_days(date())+7),
+    {DefFrom, DefTo} = proplists:get_value(validity, Opts, {DefFrom0, DefTo0}),
+    Format = fun({Y,M,D}) -> lists:flatten(io_lib:format("~w~2..0w~2..0w000000Z",[Y,M,D])) end,
+    #'Validity'{notBefore={generalTime, Format(DefFrom)},
+		notAfter ={generalTime, Format(DefTo)}}.
+
+sign_algorithm(#'RSAPrivateKey'{}, Opts) ->
+    Type = case proplists:get_value(digest, Opts, sha1) of
+	       sha1 ->   ?'sha1WithRSAEncryption';
+	       sha512 -> ?'sha512WithRSAEncryption';
+	       sha384 -> ?'sha384WithRSAEncryption';
+	       sha256 -> ?'sha256WithRSAEncryption';
+	       md5    -> ?'md5WithRSAEncryption';
+	       md2    -> ?'md2WithRSAEncryption'
+	   end,
+    {Type, 'NULL'};
+sign_algorithm(#'DSAPrivateKey'{p=P, q=Q, g=G}, _Opts) ->
+    {?'id-dsa-with-sha1', {params,#'Dss-Parms'{p=P, q=Q, g=G}}}.
+
+make_key(rsa, _Opts) ->
+    %% (OBS: for testing only)
+    gen_rsa2(64);
+make_key(dsa, _Opts) ->
+    gen_dsa2(128, 20).  %% Bytes i.e. {1024, 160}
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%% RSA key generation  (OBS: for testing only)
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+-define(SMALL_PRIMES, [65537,97,89,83,79,73,71,67,61,59,53,
+		       47,43,41,37,31,29,23,19,17,13,11,7,5,3]).
+
+gen_rsa2(Size) ->
+    P = prime(Size),
+    Q = prime(Size),
+    N = P*Q,
+    Tot = (P - 1) * (Q - 1),
+    [E|_] = lists:dropwhile(fun(Candidate) -> (Tot rem Candidate) == 0 end, ?SMALL_PRIMES),
+    {D1,D2} = extended_gcd(E, Tot),
+    D = erlang:max(D1,D2),
+    case D < E of
+	true ->
+	    gen_rsa2(Size);
+	false ->
+	    {Co1,Co2} = extended_gcd(Q, P),
+	    Co = erlang:max(Co1,Co2),
+	    #'RSAPrivateKey'{version = 'two-prime',
+			     modulus = N,
+			     publicExponent  = E,
+			     privateExponent = D,
+			     prime1 = P,
+			     prime2 = Q,
+			     exponent1 = D rem (P-1),
+			     exponent2 = D rem (Q-1),
+			     coefficient = Co
+			    }
+    end.
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%% DSA key generation  (OBS: for testing only)
+%% See http://en.wikipedia.org/wiki/Digital_Signature_Algorithm
+%% and the fips_186-3.pdf
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+gen_dsa2(LSize, NSize) ->
+    Q  = prime(NSize),  %% Choose N-bit prime Q
+    X0 = prime(LSize),
+    P0 = prime((LSize div 2) +1),
+
+    %% Choose L-bit prime modulus P such that p–1 is a multiple of q.
+    case dsa_search(X0 div (2*Q*P0), P0, Q, 1000) of
+	error ->
+	    gen_dsa2(LSize, NSize);
+	P ->
+	    G = crypto:mod_exp(2, (P-1) div Q, P), % Choose G a number whose multiplicative order modulo p is q.
+	    %%                 such that This may be done by setting g = h^(p–1)/q mod p, commonly h=2 is used.
+
+	    X = prime(20),               %% Choose x by some random method, where 0 < x < q.
+	    Y = crypto:mod_exp(G, X, P), %% Calculate y = g^x mod p.
+
+	    #'DSAPrivateKey'{version=0, p=P, q=Q, g=G, y=Y, x=X}
+    end.
+
+%% See fips_186-3.pdf
+dsa_search(T, P0, Q, Iter) when Iter > 0 ->
+    P = 2*T*Q*P0 + 1,
+    case is_prime(crypto:mpint(P), 50) of
+	true -> P;
+	false -> dsa_search(T+1, P0, Q, Iter-1)
+    end;
+dsa_search(_,_,_,_) ->
+    error.
+
+
+%%%%%%% Crypto Math %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+prime(ByteSize) ->
+    Rand = odd_rand(ByteSize),
+    crypto:erlint(prime_odd(Rand, 0)).
+
+prime_odd(Rand, N) ->
+    case is_prime(Rand, 50) of
+	true ->
+	    Rand;
+	false ->
+	    NotPrime = crypto:erlint(Rand),
+	    prime_odd(crypto:mpint(NotPrime+2), N+1)
+    end.
+
+%% see http://en.wikipedia.org/wiki/Fermat_primality_test
+is_prime(_, 0) -> true;
+is_prime(Candidate, Test) ->
+    CoPrime = odd_rand(<<0,0,0,4, 10000:32>>, Candidate),
+    case crypto:mod_exp(CoPrime, Candidate, Candidate) of
+	CoPrime -> is_prime(Candidate, Test-1);
+	_       -> false
+    end.
+
+odd_rand(Size) ->
+    Min = 1 bsl (Size*8-1),
+    Max = (1 bsl (Size*8))-1,
+    odd_rand(crypto:mpint(Min), crypto:mpint(Max)).
+
+odd_rand(Min,Max) ->
+    Rand = <<Sz:32, _/binary>> = crypto:rand_uniform(Min,Max),
+    BitSkip = (Sz+4)*8-1,
+    case Rand of
+	Odd  = <<_:BitSkip,  1:1>> -> Odd;
+	Even = <<_:BitSkip,  0:1>> ->
+	    crypto:mpint(crypto:erlint(Even)+1)
+    end.
+
+extended_gcd(A, B) ->
+    case A rem B of
+	0 ->
+	    {0, 1};
+	N ->
+	    {X, Y} = extended_gcd(B, N),
+	    {Y, X-Y*(A div B)}
+    end.
+
+pem_to_der(File) ->
+    {ok, PemBin} = file:read_file(File),
+    public_key:pem_decode(PemBin).
+
+der_to_pem(File, Entries) ->
+    PemBin = public_key:pem_encode(Entries),
+    file:write_file(File, PemBin).
diff --git a/lib/inets/test/httpc_proxy_SUITE.erl b/lib/inets/test/httpc_proxy_SUITE.erl
new file mode 100644
index 0000000000..2475489bb3
--- /dev/null
+++ b/lib/inets/test/httpc_proxy_SUITE.erl
@@ -0,0 +1,575 @@
+%%
+%% %CopyrightBegin%
+%%
+%% Copyright Ericsson AB 2012. All Rights Reserved.
+%%
+%% The contents of this file are subject to the Erlang Public License,
+%% Version 1.1, (the "License"); you may not use this file except in
+%% compliance with the License. You should have received a copy of the
+%% Erlang Public License along with this software. If not, it can be
+%% retrieved online at http://www.erlang.org/.
+%%
+%% Software distributed under the License is distributed on an "AS IS"
+%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+%% the License for the specific language governing rights and limitations
+%% under the License.
+%%
+%% %CopyrightEnd%
+%%
+%%
+
+%%
+%% ts:run(inets, httpc_proxy_SUITE, [batch]).
+%% ct:run("../inets_test", httpc_proxy_SUITE).
+%%
+
+-module(httpc_proxy_SUITE).
+
+-include_lib("common_test/include/ct.hrl").
+
+-include_lib("kernel/include/file.hrl").
+-include("inets_test_lib.hrl").
+
+%% Note: This directive should only be used in test suites.
+-compile(export_all).
+
+-define(LOCAL_PROXY_SCRIPT, "server_proxy.sh").
+-define(p(F, A), % Debug printout
+	begin
+	    io:format(
+	      "~w ~w: " ++ begin F end,
+	      [self(),?MODULE] ++ begin A end)
+	end).
+
+%%--------------------------------------------------------------------
+%% Common Test interface functions -----------------------------------
+%%--------------------------------------------------------------------
+
+suite() ->
+    [{ct_hooks,[ts_install_cth]}].
+
+all() ->
+    [{group,local_proxy},
+     {group,local_proxy_https}].
+
+groups() ->
+    [{local_proxy,[],
+      [http_emulate_lower_versions
+       |local_proxy_cases()]},
+     {local_proxy_https,[],
+      local_proxy_cases()}].
+
+%% internal functions
+
+local_proxy_cases() ->
+    [http_head,
+     http_get,
+     http_options,
+     http_trace,
+     http_post,
+     http_put,
+     http_delete,
+     http_headers,
+     http_proxy_auth,
+     http_doesnotexist,
+     http_stream,
+     http_not_modified_otp_6821].
+
+%%--------------------------------------------------------------------
+
+init_per_suite(Config0) ->
+    case init_apps([crypto,public_key], Config0) of
+	Config when is_list(Config) ->
+	    make_cert_files(dsa, "server-", Config),
+	    Config;
+	Other ->
+	    Other
+    end.
+
+end_per_suite(_Config) ->
+    [app_stop(App) || App <- r(suite_apps())],
+    ok.
+
+%% internal functions
+
+suite_apps() ->
+    [crypto,public_key].
+
+%%--------------------------------------------------------------------
+
+init_per_group(local_proxy, Config) ->
+    init_local_proxy([{protocol,http}|Config]);
+init_per_group(local_proxy_https, Config) ->
+    init_local_proxy([{protocol,https}|Config]).
+
+end_per_group(Group, Config)
+  when
+      Group =:= local_proxy;
+      Group =:= local_proxy_https ->
+    rcmd_local_proxy(["stop"], Config),
+    Config;
+end_per_group(_, Config) ->
+    Config.
+
+%%--------------------------------------------------------------------
+
+init_per_testcase(Case, Config0) ->
+    ct:timetrap({seconds,30}),
+    Apps = apps(Case, Config0),
+    case init_apps(Apps, Config0) of
+	Config when is_list(Config) ->
+	    case app_start(inets, Config) of
+		ok ->
+		    Config;
+		Error ->
+		    [app_stop(N) || N <- [inets|r(Apps)]],
+		    ct:fail({could_not_init_inets,Error})
+	    end;
+	E3 ->
+	    E3
+    end.
+
+end_per_testcase(_Case, Config) ->
+    app_stop(inets),
+    Config.
+
+%% internal functions
+
+apps(_Case, Config) ->
+    case ?config(protocol, Config) of
+	https ->
+	    [ssl];
+	_ ->
+	    []
+    end.
+
+%%--------------------------------------------------------------------
+%% Test Cases --------------------------------------------------------
+%%--------------------------------------------------------------------
+
+http_head(doc) ->
+    ["Test http/https HEAD request."];
+http_head(Config) when is_list(Config) ->
+    Method = head,
+    URL = url("/index.html", Config),
+    Request = {URL,[]},
+    HttpOpts = [],
+    Opts = [],
+    {ok,{{_,200,_},[_|_],[]}} =
+	httpc:request(Method, Request, HttpOpts, Opts),
+    ok.
+
+%%--------------------------------------------------------------------
+
+http_get(doc) ->
+    ["Test http/https GET request."];
+http_get(Config) when is_list(Config) ->
+    Method = get,
+    URL = url("/index.html", Config),
+    Request = {URL,[]},
+    Timeout = timer:seconds(1),
+    ConnTimeout = Timeout + timer:seconds(1),
+
+    HttpOpts1 = [{timeout,Timeout},{connect_timeout,ConnTimeout}],
+    Opts1 = [],
+    {ok,{{_,200,_},[_|_],[_|_]=B1}} =
+	httpc:request(Method, Request, HttpOpts1, Opts1),
+    inets_test_lib:check_body(B1),
+
+    HttpOpts2 = [],
+    Opts2 = [{body_format,binary}],
+    {ok,{{_,200,_},[_|_],B2}} =
+	httpc:request(Method, Request, HttpOpts2, Opts2),
+    inets_test_lib:check_body(binary_to_list(B2)).
+
+%%--------------------------------------------------------------------
+
+http_options(doc) ->
+    ["Perform an OPTIONS request."];
+http_options(Config) when is_list(Config) ->
+    Method = options,
+    URL = url("/index.html", Config),
+    Request = {URL,[]},
+    HttpOpts = [],
+    Opts = [],
+    {ok,{{_,200,_},Headers,_}} =
+	httpc:request(Method, Request, HttpOpts, Opts),
+    {value,_} = lists:keysearch("allow", 1, Headers),
+    ok.
+
+%%--------------------------------------------------------------------
+
+http_trace(doc) ->
+    ["Perform a TRACE request."];
+http_trace(Config) when is_list(Config) ->
+    Method = trace,
+    URL = url("/index.html", Config),
+    Request = {URL,[]},
+    HttpOpts = [],
+    Opts = [],
+    {ok,{{_,200,_},[_|_],"TRACE "++_}} =
+	httpc:request(Method, Request, HttpOpts, Opts),
+    ok.
+
+%%--------------------------------------------------------------------
+
+http_post(doc) ->
+    ["Perform a POST request that goes through a proxy. When the "
+     "request goes to an ordinary file it seems the POST data "
+     "is ignored."];
+http_post(Config) when is_list(Config) ->
+    Method = post,
+    URL = url("/index.html", Config),
+    Request = {URL,[],"text/plain","foobar"},
+    HttpOpts = [],
+    Opts = [],
+    {ok,{{_,200,_},[_|_],[_|_]}} =
+	httpc:request(Method, Request, HttpOpts, Opts),
+    ok.
+
+%%--------------------------------------------------------------------
+
+http_put(doc) ->
+    ["Perform a PUT request. The server will not allow it "
+     "but we only test sending the request."];
+http_put(Config) when is_list(Config) ->
+    Method = put,
+    URL = url("/put.html", Config),
+    Content =
+	"<html><body> <h1>foo</h1> <p>bar</p> </body></html>",
+    Request = {URL,[],"html",Content},
+    HttpOpts = [],
+    Opts = [],
+    {ok,{{_,405,_},[_|_],[_|_]}} =
+	httpc:request(Method, Request, HttpOpts, Opts),
+    ok.
+
+%%--------------------------------------------------------------------
+
+http_delete(doc) ->
+    ["Perform a DELETE request that goes through a proxy. Note the server "
+     "will reject the request with a 405 Method Not Allowed,"
+     "but this is just a test of sending the request."];
+http_delete(Config) when is_list(Config) ->
+    Method = delete,
+    URL = url("/delete.html", Config),
+    Request = {URL,[]},
+    HttpOpts = [],
+    Opts = [],
+    {ok,{{_,405,_},[_|_],[_|_]}} =
+	httpc:request(Method, Request, HttpOpts, Opts),
+    ok.
+
+%%--------------------------------------------------------------------
+
+http_headers(doc) ->
+    ["Use as many request headers as possible"];
+http_headers(Config) when is_list(Config) ->
+    Method = get,
+    URL = url("/index.html", Config),
+    Headers =
+	[{"Accept",
+	  "text/*, text/html, text/html;level=1, */*"},
+	 {"Accept-Charset",
+	  "iso-8859-5, unicode-1-1;q=0.8"},
+	 {"Accept-Encoding", "*"},
+	 {"Accept-Language",
+	  "sv, en-gb;q=0.8, en;q=0.7"},
+	 {"User-Agent", "inets"},
+	 {"Max-Forwards","5"},
+	 {"Referer",
+	  "http://otp.ericsson.se:8000/product/internal"}],
+    Request = {URL,Headers},
+    HttpOpts = [],
+    Opts = [],
+    {ok,{{_,200,_},[_|_],[_|_]}} =
+	httpc:request(Method, Request, HttpOpts, Opts),
+    ok.
+
+%%--------------------------------------------------------------------
+
+http_proxy_auth(doc) ->
+    ["Test the code for sending of proxy authorization."];
+http_proxy_auth(Config) when is_list(Config) ->
+    %% Our proxy seems to ignore the header, however our proxy
+    %% does not requirer an auth header, but we want to know
+    %% atleast the code for sending the header does not crash!
+    Method = get,
+    URL = url("/index.html", Config),
+    Request = {URL,[]},
+    HttpOpts = [{proxy_auth,{"foo","bar"}}],
+    Opts = [],
+    {ok,{{_,200,_},[_|_],[_|_]}} =
+	httpc:request(Method, Request, HttpOpts, Opts),
+    ok.
+
+%%--------------------------------------------------------------------
+
+http_doesnotexist(doc) ->
+    ["Test that we get a 404 when the page is not found."];
+http_doesnotexist(Config) when is_list(Config) ->
+    Method = get,
+    URL = url("/doesnotexist.html", Config),
+    Request = {URL,[]},
+    HttpOpts = [{proxy_auth,{"foo","bar"}}],
+    Opts = [],
+    {ok,{{_,404,_},[_|_],[_|_]}} =
+	httpc:request(Method, Request, HttpOpts, Opts),
+    ok.
+
+%%--------------------------------------------------------------------
+
+http_stream(doc) ->
+    ["Test the option stream for asynchronous requests"];
+http_stream(Config) when is_list(Config) ->
+    Method = get,
+    URL = url("/index.html", Config),
+    Request = {URL,[]},
+    HttpOpts = [],
+
+    Opts1 = [{body_format,binary}],
+    {ok,{{_,200,_},[_|_],Body}} =
+	httpc:request(Method, Request, HttpOpts, Opts1),
+
+    Opts2 = [{sync,false},{stream,self}],
+    {ok,RequestId} =
+	httpc:request(Method, Request, HttpOpts, Opts2),
+    receive
+	{http,{RequestId,stream_start,[_|_]}} ->
+	    ok
+    end,
+    case http_stream(RequestId, <<>>) of
+	Body -> ok
+    end.
+    %% StreamedBody = http_stream(RequestId, <<>>),
+    %% Body =:= StreamedBody,
+    %% ok.
+
+http_stream(RequestId, Body) ->
+    receive
+	{http,{RequestId,stream,Bin}} ->
+	    http_stream(RequestId, <<Body/binary,Bin/binary>>);
+	{http,{RequestId,stream_end,_Headers}} ->
+	    Body
+    end.
+
+%%--------------------------------------------------------------------
+
+http_emulate_lower_versions(doc) ->
+    ["Perform requests as 0.9 and 1.0 clients."];
+http_emulate_lower_versions(Config) when is_list(Config) ->
+    Method = get,
+    URL = url("/index.html", Config),
+    Request = {URL,[]},
+    Opts = [],
+
+    HttpOpts1 = [{version,"HTTP/0.9"}],
+    {ok,[_|_]=B1} =
+	httpc:request(Method, Request, HttpOpts1, Opts),
+    inets_test_lib:check_body(B1),
+
+    HttpOpts2 = [{version,"HTTP/1.0"}],
+    {ok,{{_,200,_},[_|_],[_|_]=B2}} =
+	httpc:request(Method, Request, HttpOpts2, Opts),
+    inets_test_lib:check_body(B2),
+
+    HttpOpts3 = [{version,"HTTP/1.1"}],
+    {ok,{{_,200,_},[_|_],[_|_]=B3}} =
+	httpc:request(Method, Request, HttpOpts3, Opts),
+    inets_test_lib:check_body(B3),
+
+    ok.
+
+%%--------------------------------------------------------------------
+http_not_modified_otp_6821(doc) ->
+    ["If unmodified no body should be returned"];
+http_not_modified_otp_6821(Config) when is_list(Config) ->
+    Method = get,
+    URL = url("/index.html", Config),
+    Opts = [],
+
+    Request1 = {URL,[]},
+    HttpOpts1 = [],
+    {ok,{{_,200,_},ReplyHeaders,[_|_]}} =
+	 httpc:request(Method, Request1, HttpOpts1, Opts),
+     ETag = header_value("etag", ReplyHeaders),
+     LastModified = header_value("last-modified", ReplyHeaders),
+
+     Request2 =
+	 {URL,
+	  [{"If-None-Match",ETag},
+	   {"If-Modified-Since",LastModified}]},
+     HttpOpts2 = [{timeout,15000}], % Limit wait for bug result
+     {ok,{{_,304,_},_,[]}} = % Page Unchanged
+	 httpc:request(Method, Request2, HttpOpts2, Opts),
+
+     ok.
+
+header_value(Name, [{HeaderName,HeaderValue}|Headers]) ->
+    case string:to_lower(HeaderName) of
+	Name ->
+	    HeaderValue;
+	_ ->
+	    header_value(Name, Headers)
+    end.
+
+%%--------------------------------------------------------------------
+%% Internal Functions ------------------------------------------------
+%%--------------------------------------------------------------------
+
+init_apps([], Config) ->
+    Config;
+init_apps([App|Apps], Config) ->
+    case app_start(App, Config) of
+	ok ->
+	    init_apps(Apps, Config);
+	Error ->
+	    Msg =
+		lists:flatten(
+		  io_lib:format(
+		    "Could not start ~p due to ~p.~n",
+		    [App, Error])),
+	    {skip,Msg}
+    end.
+
+app_start(App, Config) ->
+    try
+	case App of
+	    crypto ->
+		crypto:stop(),
+		ok = crypto:start();
+	    inets ->
+		application:stop(App),
+		ok = application:start(App),
+		case ?config(proxy, Config) of
+		    undefined -> ok;
+		    {_,ProxySpec} ->
+			ok = httpc:set_options([{proxy,ProxySpec}])
+		end;
+	    _ ->
+		application:stop(App),
+		ok = application:start(App)
+	end
+    catch
+	Class:Reason ->
+	    {exception,Class,Reason}
+    end.
+
+app_stop(App) ->
+    application:stop(App).
+
+make_cert_files(Alg, Prefix, Config) ->
+    PrivDir = ?config(priv_dir, Config),
+    CaInfo = {CaCert,_} = erl_make_certs:make_cert([{key,Alg}]),
+    {Cert,CertKey} = erl_make_certs:make_cert([{key,Alg},{issuer,CaInfo}]),
+    CaCertFile = filename:join(PrivDir, Prefix++"cacerts.pem"),
+    CertFile = filename:join(PrivDir, Prefix++"cert.pem"),
+    KeyFile = filename:join(PrivDir, Prefix++"key.pem"),
+    der_to_pem(CaCertFile, [{'Certificate', CaCert, not_encrypted}]),
+    der_to_pem(CertFile, [{'Certificate', Cert, not_encrypted}]),
+    der_to_pem(KeyFile, [CertKey]),
+    ok.
+
+der_to_pem(File, Entries) ->
+    PemBin = public_key:pem_encode(Entries),
+    file:write_file(File, PemBin).
+
+
+
+url(AbsPath, Config) ->
+    Protocol = ?config(protocol, Config),
+    {ServerName,ServerPort} = ?config(Protocol, Config),
+    atom_to_list(Protocol) ++ "://" ++
+	ServerName ++ ":" ++ integer_to_list(ServerPort) ++
+	AbsPath.
+
+%%--------------------------------------------------------------------
+
+init_local_proxy(Config) ->
+    case os:type() of
+	{unix,_} ->
+	    case rcmd_local_proxy(["start"], Config) of
+		{0,[":STARTED:"++String]} ->
+		    init_local_proxy_string(String, Config);
+		{_,[":SKIP:"++_|_]}=Reason ->
+		    {skip,Reason};
+		Error ->
+		    rcmd_local_proxy(["stop"], Config),
+		    ct:fail({local_proxy_start_failed,Error})
+	    end;
+	_ ->
+	    {skip,"Platform can not run local proxy start script"}
+    end.
+
+init_local_proxy_string(String, Config) ->
+    {Proxy,Server} = split($|, String),
+    {ProxyName,ProxyPort} = split($:, Proxy),
+    {ServerName,ServerPorts} = split($:, Server),
+    {ServerHttpPort,ServerHttpsPort} = split($:, ServerPorts),
+    [{proxy,{local,{{ProxyName,list_to_integer(ProxyPort)},[]}}},
+     {http,{ServerName,list_to_integer(ServerHttpPort)}},
+     {https,{ServerName,list_to_integer(ServerHttpsPort)}}
+     |Config].
+
+rcmd_local_proxy(Args, Config) ->
+    DataDir = ?config(data_dir, Config),
+    PrivDir = ?config(priv_dir, Config),
+    Script = filename:join(DataDir, ?LOCAL_PROXY_SCRIPT),
+    rcmd(Script, Args, [{cd,PrivDir}]).
+
+rcmd(Cmd, Args, Opts) ->
+    Port =
+	erlang:open_port(
+	  {spawn_executable,Cmd},
+	  [{args,Args},{line,80},exit_status,eof,hide|Opts]),
+    rcmd_loop(Port, [], [], undefined, false).
+
+rcmd_loop(Port, Lines, Buf, Exit, EOF) ->
+    receive
+	{Port,{data,{Flag,Line}}} ->
+	    case Flag of
+		noeol ->
+		    rcmd_loop(Port, Lines, r(Line, Buf), Exit, EOF);
+		eol ->
+		    rcmd_loop(Port, [r(Buf, Line)|Lines], [], Exit, EOF)
+	    end;
+	{Port,{exit_status,Status}} when Exit =:= undefined ->
+	    case EOF of
+		true ->
+		    rcmd_close(Port, Lines, Buf, Status);
+		false ->
+		    rcmd_loop(Port, Lines, Buf, Status, EOF)
+	    end;
+	{Port,eof} when EOF =:= false ->
+	    case Exit of
+		undefined ->
+		    rcmd_loop(Port, Lines, Buf, Exit, true);
+		Status ->
+		    rcmd_close(Port, Lines, Buf, Status)
+	    end;
+	{Port,_}=Unexpected ->
+	    ct:fail({unexpected_from_port,Unexpected})
+    end.
+
+rcmd_close(Port, Lines, Buf, Status) ->
+    catch port_close(Port),
+    case Buf of
+	[] ->
+	    {Status,Lines};
+	_ ->
+	    {Status,[r(Buf)|Lines]}
+    end.
+
+%%--------------------------------------------------------------------
+
+%% Split on first match of X in Ys, do not include X in neither part
+split(X, Ys) ->
+    split(X, Ys, []).
+%%
+split(X, [X|Ys], Rs) ->
+    {r(Rs),Ys};
+split(X, [Y|Ys], Rs) ->
+    split(X, Ys, [Y|Rs]).
+
+r(L) -> lists:reverse(L).
+r(L, R) -> lists:reverse(L, R).
diff --git a/lib/inets/test/httpc_proxy_SUITE_data/apache2/apache2.conf b/lib/inets/test/httpc_proxy_SUITE_data/apache2/apache2.conf
new file mode 100644
index 0000000000..37af88c510
--- /dev/null
+++ b/lib/inets/test/httpc_proxy_SUITE_data/apache2/apache2.conf
@@ -0,0 +1,87 @@
+## Simple Apache 2 configuration file for daily test very local http server
+##
+## %CopyrightBegin%
+##
+## Copyright Ericsson AB 2012. All Rights Reserved.
+##
+## The contents of this file are subject to the Erlang Public License,
+## Version 1.1, (the "License"); you may not use this file except in
+## compliance with the License. You should have received a copy of the
+## Erlang Public License along with this software. If not, it can be
+## retrieved online at http://www.erlang.org/.
+##
+## Software distributed under the License is distributed on an "AS IS"
+## basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+## the License for the specific language governing rights and limitations
+## under the License.
+##
+## %CopyrightEnd%
+##
+## Author: Raimo Niskanen, Erlang/OTP
+#
+LockFile ${APACHE_LOCK_DIR}/accept.lock
+PidFile ${APACHE_PID_FILE}
+
+Timeout 300
+
+User ${APACHE_RUN_USER}
+Group ${APACHE_RUN_GROUP}
+
+DefaultType text/plain
+HostnameLookups Off
+ErrorLog ${APACHE_LOG_DIR}/error.log
+LogLevel warn
+
+Include ${APACHE_MODS_DIR}/*.load
+Include ${APACHE_MODS_DIR}/*.conf
+
+Listen ${APACHE_HTTP_PORT} http
+
+<IfModule mod_ssl.c>
+	Listen ${APACHE_HTTPS_PORT} https
+	SSLMutex file:${APACHE_LOCK_DIR}/ssl_mutex
+</IfModule>
+
+#<IfModule mod_gnutls.c>
+#	Listen 8443
+#</IfModule>
+
+#LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
+LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
+#LogFormat "%h %l %u %t \"%r\" %>s %O" common
+#LogFormat "%{Referer}i -> %U" referer
+#LogFormat "%{User-agent}i" agent
+
+CustomLog ${APACHE_LOG_DIR}/access.log combined
+
+<Directory />
+	AllowOverride None
+	Order Deny,Allow
+	Deny from all
+</Directory>
+
+ServerTokens Minimal
+ServerSignature Off
+KeepAlive On
+KeepAliveTimeout 5
+
+ServerName ${APACHE_SERVER_NAME}
+ServerAdmin webmaster@${APACHE_SERVER_NAME}
+DocumentRoot ${APACHE_DOCROOT}
+<Directory ${APACHE_DOCROOT}>
+	Options Indexes FollowSymLinks MultiViews
+	AllowOverride None
+	Order allow,deny
+	Allow from all
+</Directory>
+
+<VirtualHost *:${APACHE_HTTP_PORT}>
+</VirtualHost>
+
+<IfModule mod_ssl.c>
+	<VirtualHost *:${APACHE_HTTPS_PORT}>
+		SSLCertificateFile ${APACHE_CERTS_DIR}/server-cert.pem
+		SSLCertificateKeyFile ${APACHE_CERTS_DIR}/server-key.pem
+		SSLEngine on
+	</VirtualHost>
+</IfModule>
diff --git a/lib/inets/test/httpc_proxy_SUITE_data/apache2/htdocs/index.html b/lib/inets/test/httpc_proxy_SUITE_data/apache2/htdocs/index.html
new file mode 100644
index 0000000000..1c70d95348
--- /dev/null
+++ b/lib/inets/test/httpc_proxy_SUITE_data/apache2/htdocs/index.html
@@ -0,0 +1,4 @@
+<html><body><h1>It works!</h1>
+<p>This is the default web page for this server.</p>
+<p>The web server software is running but no content has been added, yet.</p>
+</body></html>
diff --git a/lib/inets/test/httpc_proxy_SUITE_data/server_proxy.sh b/lib/inets/test/httpc_proxy_SUITE_data/server_proxy.sh
new file mode 100755
index 0000000000..d5f18c937f
--- /dev/null
+++ b/lib/inets/test/httpc_proxy_SUITE_data/server_proxy.sh
@@ -0,0 +1,198 @@
+#! /bin/sh
+##
+## Command file to handle external webserver and proxy
+## apache2 and tinyproxy.
+##
+## %CopyrightBegin%
+##
+## Copyright Ericsson AB 2012. All Rights Reserved.
+##
+## The contents of this file are subject to the Erlang Public License,
+## Version 1.1, (the "License"); you may not use this file except in
+## compliance with the License. You should have received a copy of the
+## Erlang Public License along with this software. If not, it can be
+## retrieved online at http://www.erlang.org/.
+##
+## Software distributed under the License is distributed on an "AS IS"
+## basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+## the License for the specific language governing rights and limitations
+## under the License.
+##
+## %CopyrightEnd%
+##
+## Author: Raimo Niskanen, Erlang/OTP
+#
+
+PATH=/usr/local/bin:/usr/local/sbin:/bin:/usr/bin:/sbin:/usr/sbin
+SHELL=/bin/sh
+unset CDPATH ENV BASH_ENV
+IFS='
+	 '
+
+APACHE_MODS_AVAILABLE_DIR="/etc/apache2/mods-available"
+MODS="authz_host.load mime.conf mime.load ssl.conf ssl.load"
+
+APACHE_HTTP_PORT=8080
+APACHE_HTTPS_PORT=8443
+APACHE_SERVER_NAME=localhost
+export APACHE_HTTP_PORT APACHE_HTTPS_PORT APACHE_SERVER_NAME
+
+PROXY_SERVER_NAME=localhost
+PROXY_PORT=8000
+export PROXY_SERVER_NAME PROXY_PORT
+
+# All stdout goes to the calling erlang port, therefore
+# these helpers push all side info to stderr.
+status () { echo "$@"; }
+info () { echo "$@" 1>&2; }
+die () { REASON="$?"; status "$@"; exit "$REASON"; }
+cmd () { "$@" 1>&2; }
+silent () { "$@" 1>/dev/null 2>&1; }
+
+wait_for_pidfile () {
+    PIDFILE="${1:?Missing argument: PidFile}"
+    for t in 1 1 1 2 2 3 3 3 4; do
+	PID="`head -1 "$1" 2>/dev/null`" && [ :"$PID" != : ] && break
+	sleep $t
+    done
+    [ :"$PID" = : ] && die ":ERROR:No or empty PidFile: $1"
+    info "Started $PIDFILE[$PID]."
+}
+
+kill_and_wait () {
+    PID_FILE="${1:?Missing argument: PidFile}"
+    if [ -f "$PID_FILE" ]; then
+	PID="`head -1 "$PID_FILE" 2>/dev/null`"
+	[ :"$PID" = : ] && \
+	    info "Empty Pid file: $1"
+	info "Stopping $1 [$PID]..."
+	shift
+	case :"${1:?Missing argument: kill command}" in
+	    :kill)
+		[ :"$PID" = : ] || cmd kill "$PID";;
+	    :*)
+		cmd "$@";;
+	esac
+	wait "$PID"
+	for t in 1 1 1 2; do
+	    sleep $t
+	    [ -e "$PID_FILE" ] || break
+	done
+	silent rm "$PID_FILE"
+    else
+	info "No pid file: $1"
+    fi
+}
+
+
+PRIV_DIR="`pwd`"
+DATA_DIR="`dirname "$0"`"
+DATA_DIR="`cd "$DATA_DIR" && pwd`"
+
+silent type apache2ctl || \
+    die ":SKIP: Can not find apache2ctl."
+silent type tinyproxy || \
+    die ":SKIP: Can not find tinyproxy."
+
+[ -d "$APACHE_MODS_AVAILABLE_DIR" ] || \
+    die ":SKIP:Can not locate modules dir $APACHE_MODS_AVAILABLE_DIR."
+
+silent mkdir apache2 tinyproxy
+cd apache2 || \
+    die ":ERROR:Can not cd to apache2"
+CWD="`pwd`"
+(cd ../tinyproxy) || \
+    die ":ERROR:Can not cd to ../tinyproxy"
+
+unset APACHE_HTTPD APACHE_LYNX APACHE_STATUSURL
+
+## apache2ctl envvars variables
+APACHE_CONFDIR="$DATA_DIR/apache2"
+[ -f "$APACHE_CONFDIR"/apache2.conf ] || \
+    die ":SKIP:No config file: $APACHE_CONFDIR/apache2.conf."
+APACHE_RUN_USER=`id | sed 's/^uid=[0-9]\{1,\}(\([^)]*\)).*/\1/'`
+APACHE_RUN_GROUP=`id | sed 's/.*[ 	]gid=[0-9]\{1,\}(\([^)]*\)).*/\1/'`
+APACHE_RUN_DIR="$CWD/run"
+APACHE_PID_FILE="$APACHE_RUN_DIR/pid"
+APACHE_LOCK_DIR="$CWD/lock"
+APACHE_LOG_DIR="$CWD/log"
+export APACHE_CONFDIR APACHE_RUN_USER APACHE_RUN_GROUP
+export APACHE_RUN_DIR APACHE_PID_FILE
+export APACHE_LOCK_DIR APACHE_LOG_DIR
+silent cmd mkdir "$APACHE_CONFDIR"
+silent cmd mkdir "$APACHE_RUN_DIR" "$APACHE_LOCK_DIR" "$APACHE_LOG_DIR"
+
+## Our apache2.conf additional variables
+APACHE_MODS_DIR="$CWD/mods"
+APACHE_DOCROOT="$APACHE_CONFDIR/htdocs"
+APACHE_CERTS_DIR="$PRIV_DIR"
+export APACHE_MODS_DIR APACHE_DOCROOT APACHE_CERTS_DIR
+[ -d "$APACHE_MODS_DIR" ] || {
+    cmd mkdir "$APACHE_MODS_DIR"
+    for MOD in $MODS; do
+	cmd ln -s "$APACHE_MODS_AVAILABLE_DIR/$MOD" "$APACHE_MODS_DIR" || {
+	    die ":ERROR:ln of apache 2 module $MOD failed"
+	}
+    done
+}
+
+case :"${1:?}" in
+
+    :start)
+	info "Starting apache2..."
+	cmd apache2ctl start
+	[ $? = 0 ] || \
+	    die ":ERROR: apache2 did not start."
+	wait_for_pidfile "$APACHE_PID_FILE"
+
+	info "Starting tinyproxy..."
+	cmd cd ../tinyproxy || \
+	    die ":ERROR:Can not cd to `pwd`/../tinyproxy"
+	cat >tinyproxy.conf <<EOF
+Port $PROXY_PORT
+
+Listen 127.0.0.1
+BindSame yes
+Timeout 600
+
+DefaultErrorFile "default.html"
+Logfile "tinyproxy.log"
+PidFile "tinyproxy.pid"
+
+MaxClients 100
+MinSpareServers 2
+MaxSpareServers 8
+StartServers 2
+MaxRequestsPerChild 0
+
+ViaProxyName "tinyproxy"
+
+ConnectPort $APACHE_HTTPS_PORT
+EOF
+	(tinyproxy -d -c tinyproxy.conf 1>/dev/null 2>&1 </dev/null &)&
+	wait_for_pidfile tinyproxy.pid
+
+	status ":STARTED:$PROXY_SERVER_NAME:$PROXY_PORT|\
+$APACHE_SERVER_NAME:$APACHE_HTTP_PORT:$APACHE_HTTPS_PORT"
+	exit 0
+	;;
+
+    :stop)
+	kill_and_wait ../tinyproxy/tinyproxy.pid kill
+	kill_and_wait "$APACHE_PID_FILE" apache2ctl stop
+
+	status ":STOPPED:"
+	exit 0
+	;;
+
+    :apache2ctl)
+	shift
+	cmd apache2ctl ${1+"$@"}
+	exit
+	;;
+
+    :*)
+	(exit 1); die ":ERROR: I do not know of command '$1'."
+	;;
+
+esac