ssl: Continue moving test form basic_SUITE to more appropriate suites

6 files changed, 778 insertions, 1013 deletions

diff --git a/lib/ssl/test/Makefile b/lib/ssl/test/Makefile
index 2fb0dcb114..0925c0facc 100644
--- a/lib/ssl/test/Makefile
+++ b/lib/ssl/test/Makefile
@@ -37,6 +37,7 @@ VSN=$(SSL_VSN)
 
 MODULES = \
 	ssl_test_lib \
+	ssl_app_env_SUITE\
 	ssl_alert_SUITE\
 	ssl_bench_test_lib \
 	ssl_dist_test_lib \
diff --git a/lib/ssl/test/ssl_api_SUITE.erl b/lib/ssl/test/ssl_api_SUITE.erl
index 75075dff74..3db3f73adc 100644
--- a/lib/ssl/test/ssl_api_SUITE.erl
+++ b/lib/ssl/test/ssl_api_SUITE.erl
@@ -45,15 +45,29 @@ all() ->
 groups() ->
     [
      %%{'tlsv1.3', [], gen_api_tests() ++ handshake_paus_tests()},
-     {'tlsv1.3', [], gen_api_tests() -- [secret_connection_info, dh_params, honor_server_cipher_order, honor_client_cipher_order]},
-     {'tlsv1.2', [],  gen_api_tests() ++ handshake_paus_tests()},
-     {'tlsv1.1', [],  gen_api_tests() ++ handshake_paus_tests()},
-     {'tlsv1', [],  gen_api_tests() ++ handshake_paus_tests() ++ beast_mitigation_test()},
-     {'sslv3', [],  gen_api_tests() ++ beast_mitigation_test()},
-     {'dtlsv1.2', [], gen_api_tests() -- [invalid_keyfile, invalid_certfile, invalid_cacertfile]  ++ handshake_paus_tests()},
-     {'dtlsv1', [],  gen_api_tests() -- [invalid_keyfile, invalid_certfile, invalid_cacertfile] ++ handshake_paus_tests()}
+     {'tlsv1.3', [], gen_api_tests() -- [secret_connection_info, dh_params, honor_server_cipher_order, honor_client_cipher_order,
+                                        new_options_in_handshake]
+      ++ since_1_2()},
+     {'tlsv1.2', [],  gen_api_tests() ++ since_1_2() ++ handshake_paus_tests() ++ pre_1_3()},
+     {'tlsv1.1', [],  gen_api_tests() ++ handshake_paus_tests() ++ pre_1_3()},
+     {'tlsv1', [],  gen_api_tests() ++ handshake_paus_tests() ++ pre_1_3() ++ beast_mitigation_test()},
+     {'sslv3', [],  gen_api_tests() -- [new_options_in_handshake] ++ beast_mitigation_test() ++ pre_1_3()},
+     {'dtlsv1.2', [], gen_api_tests() -- [invalid_keyfile, invalid_certfile, invalid_cacertfile,
+                                         invalid_options, new_options_in_handshake]  ++ handshake_paus_tests() ++ pre_1_3()},
+     {'dtlsv1', [],  gen_api_tests() -- [invalid_keyfile, invalid_certfile, invalid_cacertfile,
+                                         invalid_options, new_options_in_handshake] ++ handshake_paus_tests() ++ pre_1_3()}
     ].
 
+since_1_2() ->
+    [
+     conf_signature_algs,
+     no_common_signature_algs
+    ].
+
+pre_1_3() ->
+    [
+     default_reject_anonymous
+    ].
 gen_api_tests() ->
     [
      peercert,
@@ -83,9 +97,14 @@ gen_api_tests() ->
      honor_client_cipher_order,
      ipv6,
      der_input,
+     reuseaddr,
+     new_options_in_handshake,
+     max_handshake_size,
      invalid_certfile,
      invalid_cacertfile,
-     invalid_keyfile
+     invalid_keyfile,
+     options_not_proplist,
+     invalid_options
     ].
 
 handshake_paus_tests() ->
@@ -167,6 +186,8 @@ init_per_testcase(_TestCase, Config) ->
     ct:timetrap({seconds, 10}),
     Config.
 
+end_per_testcase(internal_active_n, _Config) ->
+    application:unset_env(ssl, internal_active_n);
 end_per_testcase(_TestCase, Config) ->     
     Config.
 
@@ -345,6 +366,59 @@ dh_params(Config) when is_list(Config) ->
     ssl_test_lib:close(Client).
 
 %%--------------------------------------------------------------------
+conf_signature_algs() ->
+    [{doc,"Test to set the signature_algs option on both client and server"}].
+conf_signature_algs(Config) when is_list(Config) -> 
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
+    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+    Server = 
+	ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
+				   {from, self()}, 
+				   {mfa, {ssl_test_lib, send_recv_result, []}},
+				   {options,  [{active, false}, {signature_algs, [{sha256, rsa}]} | ServerOpts]}]),
+    Port = ssl_test_lib:inet_port(Server),
+    Client = 
+	ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
+				   {host, Hostname},
+				   {from, self()}, 
+				   {mfa, {ssl_test_lib, send_recv_result, []}},
+				   {options, [{active, false}, {signature_algs, [{sha256, rsa}]} | ClientOpts]}]),
+    
+    ct:log("Testcase ~p, Client ~p  Server ~p ~n",
+			 [self(), Client, Server]),
+    
+    ssl_test_lib:check_result(Server, ok, Client, ok),
+    
+    ssl_test_lib:close(Server),
+    ssl_test_lib:close(Client).
+
+
+%%--------------------------------------------------------------------
+no_common_signature_algs()  ->
+    [{doc,"Set the signature_algs option so that there client and server does not share any hash sign algorithms"}].
+no_common_signature_algs(Config) when is_list(Config) ->
+    
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
+
+    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+
+
+    Server = ssl_test_lib:start_server_error([{node, ServerNode}, {port, 0},
+					      {from, self()},
+					      {options, [{signature_algs, [{sha256, rsa}]}
+							 | ServerOpts]}]),
+    Port = ssl_test_lib:inet_port(Server),
+    Client = ssl_test_lib:start_client_error([{node, ClientNode}, {port, Port},
+                                              {host, Hostname},
+                                              {from, self()},
+                                              {options, [{signature_algs, [{sha384, rsa}]}
+                                                         | ClientOpts]}]),
+    
+    ssl_test_lib:check_server_alert(Server, Client, insufficient_security).
+
+%%--------------------------------------------------------------------
 
 handshake_continue() ->
     [{doc, "Test API function ssl:handshake_continue/3"}].
@@ -470,7 +544,7 @@ versions(Config) when is_list(Config) ->
     [_|_] = Versions = ssl:versions(),
     ct:log("~p~n", [Versions]).
 
-
+%%--------------------------------------------------------------------
 %% Test case adapted from gen_tcp_misc_SUITE.
 active_n() ->
     [{doc,"Test {active,N} option"}].
@@ -555,8 +629,6 @@ active_n(Config) when is_list(Config) ->
     ok = ssl:close(LS),
     ok.
 
-%%--------------------------------------------------------------------
-
 hibernate() ->
     [{doc,"Check that an SSL connection that is started with option "
       "{hibernate_after, 1000} indeed hibernates after 1000ms of "
@@ -1289,6 +1361,213 @@ invalid_cacertfile(Config) when is_list(Config) ->
 			      Client1, {error, closed}),
     ok.
 
+%%--------------------------------------------------------------------
+reuseaddr() ->
+    [{doc,"Test reuseaddr option"}].
+
+reuseaddr(Config) when is_list(Config) ->
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
+    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+    Server =
+	ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+				   {from, self()},
+				   {mfa, {ssl_test_lib, no_result, []}},
+				   {options,  [{active, false}, {reuseaddr, true}| ServerOpts]}]),
+    Port = ssl_test_lib:inet_port(Server),
+    Client =
+	ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
+				   {host, Hostname},
+				   {from, self()},
+				   {mfa, {ssl_test_lib, no_result, []}},
+				   {options, [{active, false} | ClientOpts]}]),
+    ssl_test_lib:close(Server),
+    ssl_test_lib:close(Client),
+    
+    Server1 =
+	ssl_test_lib:start_server([{node, ServerNode}, {port, Port},
+				   {from, self()},
+				   {mfa, {ssl_test_lib, send_recv_result, []}},
+				   {options,  [{active, false}, {reuseaddr, true} | ServerOpts]}]),
+    Client1 =
+	ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
+				   {host, Hostname},
+				   {from, self()},
+				   {mfa, {ssl_test_lib, send_recv_result, []}},
+				   {options, [{active, false} | ClientOpts]}]),
+
+    ssl_test_lib:check_result(Server1, ok, Client1, ok),
+    ssl_test_lib:close(Server1),
+    ssl_test_lib:close(Client1).
+
+%%--------------------------------------------------------------------
+new_options_in_handshake() ->
+    [{doc,"Test that you can set ssl options in handshake/3 and not only in tcp upgrade"}].
+new_options_in_handshake(Config) when is_list(Config) -> 
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
+    Version = ssl_test_lib:protocol_version(Config),
+    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+
+    [_, Cipher | _] = ssl:filter_cipher_suites(ssl:cipher_suites(all, Version), 
+                                               [{key_exchange,
+                                                 fun(dhe_rsa) ->
+                                                         true;
+                                                    (ecdhe_rsa) ->
+                                                         true;
+                                                    (ecdh_rsa) ->
+                                                         true;
+                                                    (rsa) ->
+                                                         true;
+                                                    (_) ->
+                                                         false
+                                                 end
+                                                }]),
+    
+    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
+					{from, self()}, 
+					{ssl_extra_opts, [{versions, [Version]},
+							  {ciphers,[Cipher]}]}, %% To be set in ssl_accept/3
+					{mfa, {?MODULE, connection_info_result, []}},
+					{options, ServerOpts}]),
+    
+    Port = ssl_test_lib:inet_port(Server),
+    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
+					{host, Hostname},
+					{from, self()}, 
+					{mfa, {?MODULE, connection_info_result, []}},
+					{options, [{ciphers, [Cipher]} | ClientOpts]}]),
+    
+    ct:log("Testcase ~p, Client ~p  Server ~p ~n",
+		       [self(), Client, Server]),
+
+    ServerMsg = ClientMsg = {ok, {Version, Cipher}},
+   
+    ssl_test_lib:check_result(Server, ServerMsg, Client, ClientMsg),
+    
+    ssl_test_lib:close(Server),
+    ssl_test_lib:close(Client).
+
+%%-------------------------------------------------------------------
+max_handshake_size() ->
+    [{doc,"Test that we can set max_handshake_size to max value."}].
+
+max_handshake_size(Config) when is_list(Config) -> 
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),  
+
+    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
+					{from, self()}, 
+					{mfa, {ssl_test_lib, send_recv_result_active, []}},
+					{options,  [{max_handshake_size, 8388607} |ServerOpts]}]),
+    Port = ssl_test_lib:inet_port(Server),
+    
+    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
+					{host, Hostname},
+					{from, self()}, 
+					{mfa, {ssl_test_lib, send_recv_result_active, []}},
+					{options, [{max_handshake_size, 8388607} | ClientOpts]}]),
+ 
+    ssl_test_lib:check_result(Server, ok, Client, ok).
+  
+
+%%-------------------------------------------------------------------
+options_not_proplist() ->
+    [{doc,"Test what happens if an option is not a key value tuple"}].
+
+options_not_proplist(Config) when is_list(Config) ->
+    BadOption =  {client_preferred_next_protocols, 
+		  client, [<<"spdy/3">>,<<"http/1.1">>], <<"http/1.1">>},
+    {option_not_a_key_value_tuple, BadOption} =
+	ssl:connect("twitter.com", 443, [binary, {active, false}, 
+					 BadOption]).
+
+%%-------------------------------------------------------------------
+invalid_options() ->
+    [{doc,"Test what happens when we give invalid options"}].
+       
+invalid_options(Config) when is_list(Config) -> 
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_verify_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
+    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+    
+    Check = fun(Client, Server, {versions, [sslv2, sslv3]} = Option) ->
+		    ssl_test_lib:check_result(Server, 
+					      {error, {options, {sslv2, Option}}}, 
+					      Client,
+					      {error, {options, {sslv2, Option}}});
+	       (Client, Server, Option) ->
+		    ssl_test_lib:check_result(Server, 
+					      {error, {options, Option}}, 
+					      Client,
+					      {error, {options, Option}})
+	    end,
+
+    TestOpts = 
+         [{versions, [sslv2, sslv3]}, 
+          {verify, 4}, 
+          {verify_fun, function},
+          {fail_if_no_peer_cert, 0}, 
+          {verify_client_once, 1},
+          {depth, four}, 
+          {certfile, 'cert.pem'}, 
+          {keyfile,'key.pem' }, 
+          {password, foo},
+          {cacertfile, ""}, 
+          {dhfile,'dh.pem' },
+          {ciphers, [{foo, bar, sha, ignore}]},
+          {reuse_session, foo},
+          {reuse_sessions, 0},
+          {renegotiate_at, "10"},
+          {mode, depech},
+          {packet, 8.0},
+          {packet_size, "2"},
+          {header, a},
+          {active, trice},
+          {key, 'key.pem' }],
+
+    [begin
+	 Server =
+	     ssl_test_lib:start_server_error([{node, ServerNode}, {port, 0},
+					{from, self()},
+					{options, [TestOpt | ServerOpts]}]),
+	 %% Will never reach a point where port is used.
+	 Client =
+	     ssl_test_lib:start_client_error([{node, ClientNode}, {port, 0},
+					      {host, Hostname}, {from, self()},
+					      {options, [TestOpt | ClientOpts]}]),
+	 Check(Client, Server, TestOpt),
+	 ok
+     end || TestOpt <- TestOpts],
+    ok.
+%%-------------------------------------------------------------------
+
+default_reject_anonymous()->
+    [{doc,"Test that by default anonymous cipher suites are rejected "}].
+default_reject_anonymous(Config) when is_list(Config) ->
+    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
+    Version = ssl_test_lib:protocol_version(Config),
+    TLSVersion = ssl_test_lib:tls_version(Version),
+    
+   [CipherSuite | _] = ssl_test_lib:ecdh_dh_anonymous_suites(TLSVersion),
+    
+    Server = ssl_test_lib:start_server_error([{node, ServerNode}, {port, 0},
+					      {from, self()},
+					      {options, ServerOpts}]),
+    Port = ssl_test_lib:inet_port(Server),
+    Client = ssl_test_lib:start_client_error([{node, ClientNode}, {port, Port},
+                                              {host, Hostname},
+                                              {from, self()},
+                                              {options,
+                                               [{ciphers,[CipherSuite]} |
+                                                ClientOpts]}]),
+
+    ssl_test_lib:check_server_alert(Server, Client, insufficient_security).
+
+%%-------------------------------------------------------------------
 %% Note that these test only test that the options are valid to set. As application data
 %% is a stream you can not test that the send acctually splits it up as when it arrives
 %% again at the user layer it may be concatenated. But COVER can show that the split up
@@ -1302,7 +1581,7 @@ rizzo_disabled(Config) ->
     ServerOpts =  [{beast_mitigation, disabled} | ssl_test_lib:ssl_options(server_rsa_opts, Config)],
     
     ssl_test_lib:basic_test(ClientOpts, ServerOpts, Config).
-
+%%-------------------------------------------------------------------
 rizzo_zero_n() ->
      [{doc, "Test zero_n beast mitigation option (same affect as original disable option) for SSL 3.0 and TLS 1.0"}].
 
@@ -1311,7 +1590,7 @@ rizzo_zero_n(Config) ->
     ServerOpts =  [{beast_mitigation, zero_n} | ssl_test_lib:ssl_options(server_rsa_opts, Config)],
     
     ssl_test_lib:basic_test(ClientOpts, ServerOpts, Config).
-
+%%-------------------------------------------------------------------
 rizzo_one_n_minus_one () ->
      [{doc, "Test beast_mitigation option one_n_minus_one (same affect as default) for SSL 3.0 and TLS 1.0"}].
 
diff --git a/lib/ssl/test/ssl_app_env_SUITE.erl b/lib/ssl/test/ssl_app_env_SUITE.erl
new file mode 100644
index 0000000000..27fbcb8e47
--- /dev/null
+++ b/lib/ssl/test/ssl_app_env_SUITE.erl
@@ -0,0 +1,171 @@
+%%
+%% %CopyrightBegin%
+%%
+%% Copyright Ericsson AB 2019-2019. All Rights Reserved.
+%%
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
+%%
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
+%%
+%% %CopyrightEnd%
+%%
+
+%%
+-module(ssl_app_env_SUITE).
+
+%% Note: This directive should only be used in test suites.
+-compile(export_all).
+-include_lib("common_test/include/ct.hrl").
+-include_lib("ssl/src/ssl_api.hrl").
+
+-define(SLEEP, 500).
+%%--------------------------------------------------------------------
+%% Common Test interface functions -----------------------------------
+%%--------------------------------------------------------------------
+
+all() ->
+    [
+     {group, 'tlsv1.3'},
+     {group, 'tlsv1.2'},
+     {group, 'tlsv1.1'},
+     {group, 'tlsv1'},
+     {group, 'sslv3'},
+     {group, 'dtlsv1.2'},
+     {group, 'dtlsv1'}
+    ].
+
+groups() ->
+    [
+     {'tlsv1.3', [], tests()},
+     {'tlsv1.2', [],  tests()},
+     {'tlsv1.1', [],  tests()},
+     {'tlsv1', [],  tests()},
+     {'sslv3', [],  tests()},
+     {'dtlsv1.2', [], tests()},
+     {'dtlsv1', [],  tests()}
+    ].
+
+tests() ->
+    [
+     internal_active_1,
+     protocol_versions,
+     empty_protocol_versions
+    ].
+
+
+init_per_suite(Config0) ->
+    catch crypto:stop(),
+    try crypto:start() of
+	ok ->
+	    ssl_test_lib:clean_start(),
+	    ssl_test_lib:make_rsa_cert(Config0)
+    catch _:_ ->
+	    {skip, "Crypto did not start"}
+    end.
+
+end_per_suite(_Config) ->
+    ssl:stop(),
+    application:unload(ssl),
+    application:stop(crypto).
+
+
+init_per_group(GroupName, Config) ->
+    case ssl_test_lib:is_tls_version(GroupName) of
+	true ->
+	    case ssl_test_lib:sufficient_crypto_support(GroupName) of
+		true ->
+		    [{client_type, erlang},
+                     {server_type, erlang} | ssl_test_lib:init_tls_version(GroupName, Config)];
+		false ->
+		    {skip, "Missing crypto support"}
+	    end;
+	_ ->
+	    ssl:start(),
+	    Config
+    end.
+
+end_per_group(GroupName, Config) ->
+    case ssl_test_lib:is_tls_version(GroupName) of
+        true ->
+            ssl_test_lib:clean_tls_version(Config);
+        false ->
+            Config
+    end.
+
+init_per_testcase(internal_active_1, Config) ->
+    ssl:stop(),
+    application:load(ssl),
+    application:set_env(ssl, internal_active_n, 1),
+    ssl:start(),
+    ct:timetrap({seconds, 5}),
+    Config;
+init_per_testcase(protocol_versions, Config) ->
+    Version = ssl_test_lib:protocol_version(Config),
+    case atom_to_list(Version) of
+        "d" ++ _ ->
+            ssl:stop(),
+            application:load(ssl),
+            application:set_env(ssl, dtls_protocol_version, [Version]),
+            ssl:start();
+        _ ->  
+            ssl:stop(),
+            application:load(ssl),
+            application:set_env(ssl, protocol_version, [Version]),
+            ssl:start()
+    end,
+    ct:timetrap({seconds, 5}),
+    Config;
+init_per_testcase(empty_protocol_versions, Config)  ->
+    ssl:stop(),
+    application:load(ssl),
+    ssl_test_lib:clean_env(),
+    application:set_env(ssl, protocol_version, []),
+    application:set_env(ssl, dtls_protocol_version, []),
+    ssl:start(),
+    ct:timetrap({seconds, 5}),
+    Config;
+init_per_testcase(_TestCase, Config) ->
+    ct:timetrap({seconds, 5}),
+    Config.
+
+end_per_testcase(_, _Config) ->
+    ssl_test_lib:clean_start().
+
+%%--------------------------------------------------------------------
+%% Test Cases --------------------------------------------------------
+%%--------------------------------------------------------------------
+%%--------------------------------------------------------------------
+internal_active_1() ->
+    [{doc,"Test internal active 1 (behave as internal active once)"}].
+
+internal_active_1(Config) when is_list(Config) ->
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
+    ssl_test_lib:basic_test(ClientOpts, ServerOpts, Config).
+    
+%%--------------------------------------------------------------------
+protocol_versions() ->
+    [{doc,"Test to set a list of protocol versions in app environment."}].
+
+protocol_versions(Config) when is_list(Config) -> 
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
+    ssl_test_lib:basic_test(ClientOpts, ServerOpts, Config).
+
+%%--------------------------------------------------------------------
+empty_protocol_versions() ->
+    [{doc,"Test to set an empty list of protocol versions in app environment."}].
+
+empty_protocol_versions(Config) when is_list(Config) -> 
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
+    ssl_test_lib:basic_test(ClientOpts, ServerOpts, Config).
+
diff --git a/lib/ssl/test/ssl_basic_SUITE.erl b/lib/ssl/test/ssl_basic_SUITE.erl
index 71c9e55c2b..355cd31070 100644
--- a/lib/ssl/test/ssl_basic_SUITE.erl
+++ b/lib/ssl/test/ssl_basic_SUITE.erl
@@ -26,15 +26,8 @@
 -compile(export_all).
 
 -include_lib("common_test/include/ct.hrl").
--include_lib("public_key/include/public_key.hrl").
+-include_lib("ssl/src/ssl_api.hrl").
 
--include("ssl_api.hrl").
--include("ssl_cipher.hrl").
--include("ssl_internal.hrl").
--include("ssl_alert.hrl").
--include("ssl_internal.hrl").
--include("tls_record.hrl").
--include("tls_handshake.hrl").
 
 -define(TIMEOUT, 20000).
 -define(EXPIRE, 10).
@@ -49,86 +42,35 @@
 all() -> 
     [
      {group, basic},
-     {group, options},
-     {group, options_tls},
-     {group, 'dtlsv1.2'},
-     {group, 'dtlsv1'},
-     %%{group, 'tlsv1.3'},
-     {group, 'tlsv1.2'},
-     {group, 'tlsv1.1'},
-     {group, 'tlsv1'},
-     {group, 'sslv3'}
+     {group, options}
     ].
 
 groups() ->
     [{basic, [], basic_tests()},
-     {options, [], options_tests()},
-     {options_tls, [], options_tests_tls()},
-     {'dtlsv1.2', [], all_versions_groups()},
-     {'dtlsv1', [], all_versions_groups()},
-     {'tlsv1.2', [], all_versions_groups() ++ tls_versions_groups() ++ [conf_signature_algs, no_common_signature_algs]},
-     {'tlsv1.1', [], all_versions_groups() ++ tls_versions_groups()},
-     {'tlsv1', [], all_versions_groups() ++ tls_versions_groups()},
-     {'sslv3', [], all_versions_groups() ++ tls_versions_groups() -- [tls_ciphersuite_vs_version]},
-     {api,[], api_tests()},
-     {api_tls,[], api_tests_tls()},
-     {ciphers, [], cipher_tests()}
+     {options, [], options_tests()}
     ].
 
-tls_versions_groups ()->
-    [
-     {group, api_tls}].
-
-all_versions_groups ()->
-    [{group, api},
-     {group, ciphers}].
-
-
 basic_tests() ->
     [app,
      appup,    
      version_option,
      connect_twice,
      connect_dist,
-     clear_pem_cache,
      defaults,
      fallback,
-     cipher_format
+     cipher_format,
+     tls_versions_option,
+     eccs,
+     cipher_suites,
+     old_cipher_suites,
+     cipher_suites_mix     
     ].
 
 options_tests() ->
     [
-     ssl_options_not_proplist,
-     protocol_versions,
-     empty_protocol_versions,
-     reuseaddr,
      unordered_protocol_versions_server,
-     unordered_protocol_versions_client,
-     max_handshake_size].
-
-options_tests_tls() ->
-    [tls_misc_ssl_options,
-     tls_tcp_reuseaddr].
-
-api_tests() ->
-    [eccs,
-     accept_pool,
-     internal_active_1,
-     cipher_suites
-    ].
-
-api_tests_tls() ->
-    [tls_versions_option,
-     tls_socket_options,
-     new_options_in_accept
-    ].
-
-cipher_tests() ->
-    [old_cipher_suites,
-     cipher_suites_mix,     
-     default_reject_anonymous].
+     unordered_protocol_versions_client].
 
-%%--------------------------------------------------------------------
 init_per_suite(Config0) ->
     catch crypto:stop(),
     try crypto:start() of
@@ -151,122 +93,6 @@ end_per_suite(_Config) ->
     application:stop(crypto).
 
 %%--------------------------------------------------------------------
-
-init_per_group(GroupName, Config) when GroupName == options_tls;
-                                       GroupName == options;
-                                       GroupName == basic;
-                                       GroupName == session ->
-    ssl_test_lib:clean_tls_version(Config);
-%% Do not automatically configure TLS version for the 'tlsv1.3' group
-init_per_group('tlsv1.3' = GroupName, Config) ->
-    case ssl_test_lib:sufficient_crypto_support(GroupName) of
-        true ->
-            ssl:start(),
-            Config;
-        false ->
-            {skip, "Missing crypto support"}
-    end;
-init_per_group(GroupName, Config) ->
-    ssl_test_lib:clean_tls_version(Config),                          
-    case ssl_test_lib:is_tls_version(GroupName) andalso ssl_test_lib:sufficient_crypto_support(GroupName) of
-	true ->
-	    ssl_test_lib:init_tls_version(GroupName, Config);
-	_ ->
-	    case ssl_test_lib:sufficient_crypto_support(GroupName) of
-		true ->
-		    ssl:start(),
-		    Config;
-		false ->
-		    {skip, "Missing crypto support"}
-	    end
-    end.
-
-end_per_group(GroupName, Config) ->
-  case ssl_test_lib:is_tls_version(GroupName) of
-      true ->
-          ssl_test_lib:clean_tls_version(Config);
-      false ->
-          Config
-  end.
-
-%%--------------------------------------------------------------------
-init_per_testcase(Case, Config) when Case ==  unordered_protocol_versions_client;
-				     Case == unordered_protocol_versions_server->
-    case proplists:get_value(supported, ssl:versions()) of
-	['tlsv1.2' | _] ->
-	    ct:timetrap({seconds, 5}),
-	    Config;
-	_ ->
-	    {skip, "TLS 1.2 need but not supported on this platform"}
-    end;
-
-init_per_testcase(protocol_versions, Config)  ->
-    ssl:stop(),
-    application:load(ssl),
-    %% For backwards compatibility sslv2 should be filtered out.
-    application:set_env(ssl, protocol_version, [sslv2, sslv3, tlsv1]),
-    ssl:start(),
-    ct:timetrap({seconds, 5}),
-    Config;
-
-init_per_testcase(empty_protocol_versions, Config)  ->
-    ssl:stop(),
-    application:load(ssl),
-    ssl_test_lib:clean_env(),
-    application:set_env(ssl, protocol_version, []),
-    ssl:start(),
-    ct:timetrap({seconds, 5}),
-    Config;
-
-init_per_testcase(fallback, Config)  ->
-    case tls_record:highest_protocol_version([]) of
-	{3, N} when N > 1 ->
-	    ct:timetrap({seconds, 5}),
-	    Config;
-	_ ->
-	    {skip, "Not relevant if highest supported version is less than 3.2"}
-    end;
-
-init_per_testcase(version_option, Config) ->
-    ssl_test_lib:ct_log_supported_protocol_versions(Config),
-    ct:timetrap({seconds, 10}),
-    Config;
-
-init_per_testcase(reuse_session, Config) ->
-    ssl_test_lib:ct_log_supported_protocol_versions(Config),
-    ct:timetrap({seconds, 10}),
-    Config;
-
-
-init_per_testcase(TestCase, Config) when TestCase == clear_pem_cache;
-						TestCase == der_input;
-						TestCase == defaults ->
-    ssl_test_lib:ct_log_supported_protocol_versions(Config),
-    %% White box test need clean start
-    ssl:stop(),
-    ssl:start(),
-    ct:timetrap({seconds, 20}),
-    Config;
-
-
-init_per_testcase(accept_pool, Config) ->
-    ct:timetrap({seconds, 5}),
-    case proplists:get_value(protocol, Config) of
-	dtls ->
-            {skip, "Not yet supported on DTLS sockets"};
-	_ ->
-	    ssl_test_lib:ct_log_supported_protocol_versions(Config),
-	    Config
-    end;
-
-init_per_testcase(internal_active_1, Config) ->
-    ssl:stop(),
-    application:load(ssl),
-    application:set_env(ssl, internal_active_n, 1),
-    ssl:start(),
-    ct:timetrap({seconds, 5}),
-    Config;
-
 init_per_testcase(eccs, Config) ->
     case ssl:eccs() of
         [] ->
@@ -281,23 +107,8 @@ init_per_testcase(_TestCase, Config) ->
     ct:timetrap({seconds, 5}),
     Config.
 
-end_per_testcase(reuse_session_expired, Config) ->
-    application:unset_env(ssl, session_lifetime),
-    application:unset_env(ssl, session_delay_cleanup_time),
-    end_per_testcase(default_action, Config);
-
-end_per_testcase(internal_active_n, Config) ->
-    application:unset_env(ssl, internal_active_n),
-    end_per_testcase(default_action, Config);
-
-end_per_testcase(Case, Config) when Case == protocol_versions;
-				    Case == empty_protocol_versions->
-    application:unset_env(ssl, protocol_versions),
-    end_per_testcase(default_action, Config);
-
 end_per_testcase(_TestCase, Config) ->
     Config.
-
 %%--------------------------------------------------------------------
 %% Test Cases --------------------------------------------------------
 %%--------------------------------------------------------------------
@@ -311,128 +122,76 @@ appup() ->
 appup(Config) when is_list(Config) ->
     ok = ?t:appup_test(ssl).
 %%--------------------------------------------------------------------
-new_options_in_accept() ->
-    [{doc,"Test that you can set ssl options in ssl_accept/3 and not only in tcp upgrade"}].
-new_options_in_accept(Config) when is_list(Config) -> 
-    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
-    ServerOpts0 = ssl_test_lib:ssl_options(server_dsa_opts, Config),
-    [_ , _ | ServerSslOpts] = ssl_test_lib:ssl_options(server_opts, Config), %% Remove non ssl opts
-    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-    Version = ssl_test_lib:protocol_options(Config, [{tls, sslv3}, {dtls, dtlsv1}]),
-    Cipher = ssl_test_lib:protocol_options(Config, [{tls, #{key_exchange =>rsa,
-                                                            cipher => rc4_128,
-                                                            mac => sha,
-                                                            prf => default_prf
-                                                           }}, 
-                                                    {dtls, #{key_exchange =>rsa,
-                                                             cipher => aes_128_cbc,
-                                                             mac => sha,
-                                                             prf => default_prf
-                                                            }}]),
-    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-					{from, self()}, 
-					{ssl_extra_opts, [{versions, [Version]},
-							  {ciphers,[Cipher]} | ServerSslOpts]}, %% To be set in ssl_accept/3
-					{mfa, {?MODULE, connection_info_result, []}},
-					{options, proplists:delete(cacertfile, ServerOpts0)}]),
-    
-    Port = ssl_test_lib:inet_port(Server),
-    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
-					{host, Hostname},
-					{from, self()}, 
-					{mfa, {?MODULE, connection_info_result, []}},
-					{options, [{versions, [Version]},
-						   {ciphers,[Cipher]} | ClientOpts]}]),
-    
-    ct:log("Testcase ~p, Client ~p  Server ~p ~n",
-		       [self(), Client, Server]),
-
-    ServerMsg = ClientMsg = {ok, {Version, Cipher}},
+version_option() ->
+    [{doc, "Use version option and do no specify ciphers list. Bug specified incorrect ciphers"}].
+version_option(Config) when is_list(Config) ->
+    Versions = proplists:get_value(supported, ssl:versions()),
+    [version_option_test(Config, Version) || Version <- Versions].
    
-    ssl_test_lib:check_result(Server, ServerMsg, Client, ClientMsg),
-    
-    ssl_test_lib:close(Server),
-    ssl_test_lib:close(Client).
-
 %%--------------------------------------------------------------------
-protocol_versions() ->
-    [{doc,"Test to set a list of protocol versions in app environment."}].
-
-protocol_versions(Config) when is_list(Config) -> 
-    basic_test(Config).
-
-%%--------------------------------------------------------------------
-empty_protocol_versions() ->
-    [{doc,"Test to set an empty list of protocol versions in app environment."}].
-
-empty_protocol_versions(Config) when is_list(Config) -> 
-    basic_test(Config).
-
-
-%%--------------------------------------------------------------------
-
-%%--------------------------------------------------------------------
-connect_dist() ->
-    [{doc,"Test a simple connect as is used by distribution"}].
-
-connect_dist(Config) when is_list(Config) -> 
-    ClientOpts0 = ssl_test_lib:ssl_options(client_kc_opts, Config),
-    ClientOpts = [{ssl_imp, new},{active, false}, {packet,4}|ClientOpts0],
-    ServerOpts0 = ssl_test_lib:ssl_options(server_kc_opts, Config),
-    ServerOpts = [{ssl_imp, new},{active, false}, {packet,4}|ServerOpts0],
+connect_twice() ->
+    [{doc,""}].
+connect_twice(Config) when is_list(Config) ->
+    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
 
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
 
-    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-					{from, self()}, 
-					{mfa, {?MODULE, connect_dist_s, []}},
-					{options, ServerOpts}]),
+    Server =
+	ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+				   {from, self()},
+				   {mfa, {ssl_test_lib, send_recv_result, []}},
+				   {options,  [{keepalive, true},{active, false}
+					       | ServerOpts]}]),
     Port = ssl_test_lib:inet_port(Server),
-    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
-					{host, Hostname},
-					{from, self()}, 
-					{mfa, {?MODULE, connect_dist_c, []}},
-					{options, ClientOpts}]),
-    
-    ssl_test_lib:check_result(Server, ok, Client, ok),
+    Client =
+	ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
+				   {host, Hostname},
+				   {from, self()},
+				   {mfa, {ssl_test_lib, send_recv_result, []}},
+				   {options, [{keepalive, true},{active, false}
+					      | ClientOpts]}]),
+    Server ! listen,
 
-    ssl_test_lib:close(Server),
-    ssl_test_lib:close(Client).
+    {Client1, #sslsocket{}} =
+	ssl_test_lib:start_client([return_socket,
+				   {node, ClientNode}, {port, Port},
+				   {host, Hostname},
+				   {from, self()},
+				   {mfa, {ssl_test_lib, send_recv_result, []}},
+				   {options, [{keepalive, true},{active, false}
+					      | ClientOpts]}]),
 
-%%--------------------------------------------------------------------
+    ct:log("Testcase ~p, Client ~p  Server ~p ~n",
+			 [self(), Client, Server]),
+
+    ssl_test_lib:check_result(Server, ok, Client, ok),
+    ssl_test_lib:check_result(Server, ok, Client1, ok),
 
-clear_pem_cache() ->
-    [{doc,"Test that internal reference tabel is cleaned properly even when "
-     " the PEM cache is cleared" }].
-clear_pem_cache(Config) when is_list(Config) -> 
-    {status, _, _, StatusInfo} = sys:get_status(whereis(ssl_manager)),
-    [_, _,_, _, Prop] = StatusInfo,
-    State = ssl_test_lib:state(Prop),
-    [_,{FilRefDb, _} |_] = element(6, State),
-    {Server, Client} = basic_verify_test_no_close(Config),
-    CountReferencedFiles = fun({_, -1}, Acc) ->
-				   Acc;
-			      ({_, N}, Acc) ->
-				   N + Acc
-			   end,
-    
-    2 = ets:foldl(CountReferencedFiles, 0, FilRefDb), 
-    ssl:clear_pem_cache(),
-    _ = sys:get_status(whereis(ssl_manager)),
-    {Server1, Client1} = basic_verify_test_no_close(Config),
-    4 =  ets:foldl(CountReferencedFiles, 0, FilRefDb), 
     ssl_test_lib:close(Server),
     ssl_test_lib:close(Client),
-    ct:sleep(2000),
-    _ = sys:get_status(whereis(ssl_manager)),
-    2 =  ets:foldl(CountReferencedFiles, 0, FilRefDb), 
-    ssl_test_lib:close(Server1),
-    ssl_test_lib:close(Client1),
-    ct:sleep(2000),
-    _ = sys:get_status(whereis(ssl_manager)),
-    0 =  ets:foldl(CountReferencedFiles, 0, FilRefDb).
+    ssl_test_lib:close(Client1).
+defaults(Config) when is_list(Config)->
+    Versions = ssl:versions(),
+    true = lists:member(sslv3, proplists:get_value(available, Versions)),
+    false = lists:member(sslv3,  proplists:get_value(supported, Versions)),
+    true = lists:member('tlsv1', proplists:get_value(available, Versions)),
+    false = lists:member('tlsv1',  proplists:get_value(supported, Versions)),
+    true = lists:member('tlsv1.1', proplists:get_value(available, Versions)),
+    false = lists:member('tlsv1.1',  proplists:get_value(supported, Versions)),
+    true = lists:member('tlsv1.2', proplists:get_value(available, Versions)),
+    true = lists:member('tlsv1.2',  proplists:get_value(supported, Versions)),    
+    false = lists:member({rsa,rc4_128,sha}, ssl:cipher_suites()),
+    true = lists:member({rsa,rc4_128,sha}, ssl:cipher_suites(all)),
+    false = lists:member({rsa,des_cbc,sha}, ssl:cipher_suites()),
+    true = lists:member({rsa,des_cbc,sha}, ssl:cipher_suites(all)),
+    false = lists:member({dhe_rsa,des_cbc,sha}, ssl:cipher_suites()),
+    true = lists:member({dhe_rsa,des_cbc,sha}, ssl:cipher_suites(all)),
+    true = lists:member('dtlsv1.2', proplists:get_value(available_dtls, Versions)),
+    true = lists:member('dtlsv1', proplists:get_value(available_dtls, Versions)),
+    true = lists:member('dtlsv1.2', proplists:get_value(supported_dtls, Versions)),
+    false = lists:member('dtlsv1', proplists:get_value(supported_dtls, Versions)).
 
-%%--------------------------------------------------------------------
 
 fallback() ->
     [{doc, "Test TLS_FALLBACK_SCSV downgrade prevention"}].
@@ -458,7 +217,6 @@ fallback(Config) when is_list(Config) ->
                                                             | ClientOpts]}]),
     ssl_test_lib:check_server_alert(Server, Client, inappropriate_fallback).
    
-
 %%--------------------------------------------------------------------
 cipher_format() ->
     [{doc, "Test that cipher conversion from maps | tuples | stings to binarys works"}].
@@ -568,108 +326,81 @@ cipher_suites_mix(Config) when is_list(Config) ->
     ssl_test_lib:check_result(Server, ok, Client, ok),
     ssl_test_lib:close(Server),
     ssl_test_lib:close(Client).
-%%--------------------------------------------------------------------
-tls_socket_options() ->
-    [{doc,"Test API function getopts/2 and setopts/2"}].
+unordered_protocol_versions_server() ->
+    [{doc,"Test that the highest protocol is selected even" 
+      " when it is not first in the versions list."}].
 
-tls_socket_options(Config) when is_list(Config) -> 
+unordered_protocol_versions_server(Config) when is_list(Config) -> 
     ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),  
+
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-    Values = [{mode, list}, {packet, 0}, {header, 0},
-		      {active, true}],    
-    %% Shall be the reverse order of Values! 
-    Options = [active, header, packet, mode],
-    
-    NewValues = [{mode, binary}, {active, once}],
-    %% Shall be the reverse order of NewValues! 
-    NewOptions = [active, mode],
-    
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
 					{from, self()}, 
-			   {mfa, {?MODULE, tls_socket_options_result, 
-				  [Options, Values, NewOptions, NewValues]}},
-			   {options, ServerOpts}]),
+					{mfa, {?MODULE, protocol_info_result, []}},
+					{options, [{versions, ['tlsv1.1', 'tlsv1.2']} | ServerOpts]}]),
     Port = ssl_test_lib:inet_port(Server),
+    
     Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
 					{host, Hostname},
-			   {from, self()}, 
-			   {mfa, {?MODULE, tls_socket_options_result, 
-				  [Options, Values, NewOptions, NewValues]}},
-			   {options, ClientOpts}]),
-    
-    ssl_test_lib:check_result(Server, ok, Client, ok),
-
-    ssl_test_lib:close(Server),
-    
-    {ok, Listen} = ssl:listen(0, ServerOpts),
-    {ok,[{mode,list}]} = ssl:getopts(Listen, [mode]),
-    ok = ssl:setopts(Listen, [{mode, binary}]),
-    {ok,[{mode, binary}]} = ssl:getopts(Listen, [mode]),
-    {ok,[{recbuf, _}]} = ssl:getopts(Listen, [recbuf]),
-    ssl:close(Listen).
+					{from, self()}, 
+					{mfa, {?MODULE, protocol_info_result, []}},
+					{options, ClientOpts}]),
 
-tls_socket_options_result(Socket, Options, DefaultValues, NewOptions, NewValues) ->
-    %% Test get/set emulated opts
-    {ok, DefaultValues} = ssl:getopts(Socket, Options), 
-    ssl:setopts(Socket, NewValues),
-    {ok, NewValues} = ssl:getopts(Socket, NewOptions),
-    %% Test get/set inet opts
-    {ok,[{nodelay,false}]} = ssl:getopts(Socket, [nodelay]),  
-    ssl:setopts(Socket, [{nodelay, true}]),
-    {ok,[{nodelay, true}]} = ssl:getopts(Socket, [nodelay]),
-    {ok, All} = ssl:getopts(Socket, []),
-    ct:log("All opts ~p~n", [All]),
-    ok.
+    ServerMsg = ClientMsg = {ok,'tlsv1.2'},    
+    ssl_test_lib:check_result(Server, ServerMsg, Client, ClientMsg).
 
 %%--------------------------------------------------------------------
-tls_misc_ssl_options() ->
-    [{doc,"Test what happens when we give valid options"}].
+unordered_protocol_versions_client() ->
+    [{doc,"Test that the highest protocol is selected even" 
+      " when it is not first in the versions list."}].
 
-tls_misc_ssl_options(Config) when is_list(Config) ->
+unordered_protocol_versions_client(Config) when is_list(Config) -> 
     ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),  
+
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-    
-    %% Check that ssl options not tested elsewhere are filtered away e.i. not passed to inet.
-    TestOpts = [{depth, 1}, 
-		{key, undefined}, 
-		{password, []},
-		{reuse_session, fun(_,_,_,_) -> true end},
-		{cb_info, {gen_tcp, tcp, tcp_closed, tcp_error}}],
-    
-   Server = 
-	ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-				   {from, self()}, 
-				   {mfa, {ssl_test_lib, send_recv_result_active, []}},
-				   {options,  TestOpts ++ ServerOpts}]),
+    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
+					{from, self()}, 
+					{mfa, {?MODULE, protocol_info_result, []}},
+					{options, ServerOpts }]),
     Port = ssl_test_lib:inet_port(Server),
-    Client = 
-	ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
-				   {host, Hostname},
-				   {from, self()}, 
-				   {mfa, {ssl_test_lib, send_recv_result_active, []}},
-				   {options, TestOpts ++ ClientOpts}]),
-
-    ct:log("Testcase ~p, Client ~p  Server ~p ~n",
-			 [self(), Client, Server]),
     
-    ssl_test_lib:check_result(Server, ok, Client, ok),
-    ssl_test_lib:close(Server),
-    ssl_test_lib:close(Client).
+    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
+					{host, Hostname},
+					{from, self()}, 
+					{mfa, {?MODULE, protocol_info_result, []}},
+					{options,  [{versions, ['tlsv1.1', 'tlsv1.2']} | ClientOpts]}]),
 
-%%--------------------------------------------------------------------
-ssl_options_not_proplist() ->
-    [{doc,"Test what happens if an option is not a key value tuple"}].
+    ServerMsg = ClientMsg = {ok, 'tlsv1.2'},    
+    ssl_test_lib:check_result(Server, ServerMsg, Client, ClientMsg).
+  
+connect_dist() ->
+    [{doc,"Test a simple connect as is used by distribution"}].
 
-ssl_options_not_proplist(Config) when is_list(Config) ->
-    BadOption =  {client_preferred_next_protocols, 
-		  client, [<<"spdy/3">>,<<"http/1.1">>], <<"http/1.1">>},
-    {option_not_a_key_value_tuple, BadOption} =
-	ssl:connect("twitter.com", 443, [binary, {active, false}, 
-					 BadOption]).
+connect_dist(Config) when is_list(Config) -> 
+    ClientOpts0 = ssl_test_lib:ssl_options(client_kc_opts, Config),
+    ClientOpts = [{ssl_imp, new},{active, false}, {packet,4}|ClientOpts0],
+    ServerOpts0 = ssl_test_lib:ssl_options(server_kc_opts, Config),
+    ServerOpts = [{ssl_imp, new},{active, false}, {packet,4}|ServerOpts0],
 
+    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
 
+    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
+					{from, self()}, 
+					{mfa, {?MODULE, connect_dist_s, []}},
+					{options, ServerOpts}]),
+    Port = ssl_test_lib:inet_port(Server),
+    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
+					{host, Hostname},
+					{from, self()}, 
+					{mfa, {?MODULE, connect_dist_c, []}},
+					{options, ClientOpts}]),
+    
+    ssl_test_lib:check_result(Server, ok, Client, ok),
+
+    ssl_test_lib:close(Server),
+    ssl_test_lib:close(Client).
 eccs() ->
     [{doc, "Test API functions eccs/0 and eccs/1"}].
 
@@ -685,445 +416,6 @@ eccs(Config) when is_list(Config) ->
     true = lists:sort(All) =:= lists:usort(Tls ++ Tls1 ++ Tls2),
     ok.
 
-%%--------------------------------------------------------------------
-send_recv() ->
-    [{doc,""}].
-send_recv(Config) when is_list(Config) -> 
-    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
-    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-    Server = 
-	ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-				   {from, self()}, 
-				   {mfa, {ssl_test_lib, send_recv_result, []}},
-				   {options,  [{active, false} | ServerOpts]}]),
-    Port = ssl_test_lib:inet_port(Server),
-    Client = 
-	ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
-				   {host, Hostname},
-				   {from, self()}, 
-				   {mfa, {ssl_test_lib, send_recv_result, []}},
-				   {options, [{active, false} | ClientOpts]}]),
-    
-    ct:log("Testcase ~p, Client ~p  Server ~p ~n",
-			 [self(), Client, Server]),
-    
-    ssl_test_lib:check_result(Server, ok, Client, ok),
-    
-    ssl_test_lib:close(Server),
-    ssl_test_lib:close(Client).
-
-%%--------------------------------------------------------------------
-version_option() ->
-    [{doc, "Use version option and do no specify ciphers list. Bug specified incorrect ciphers"}].
-version_option(Config) when is_list(Config) ->
-    Versions = proplists:get_value(supported, ssl:versions()),
-    [version_option_test(Config, Version) || Version <- Versions].
-   
-
-internal_active_1() ->
-    [{doc,"Test internal active 1 (behave as internal active once)"}].
-
-internal_active_1(Config) when is_list(Config) ->
-    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
-    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-    Server = 
-	ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-				   {from, self()}, 
-				   {mfa, {ssl_test_lib, send_recv_result_active, []}},
-				   {options,  [{active, true} | ServerOpts]}]),
-    Port = ssl_test_lib:inet_port(Server),
-    Client = 
-	ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
-				   {host, Hostname},
-				   {from, self()}, 
-				   {mfa, {ssl_test_lib, send_recv_result_active, []}},
-				   {options, [{active, true} | ClientOpts]}]),
-        
-    ssl_test_lib:check_result(Server, ok, Client, ok),
-    
-    ssl_test_lib:close(Server),
-    ssl_test_lib:close(Client).
-    
-
-%%--------------------------------------------------------------------
-invalid_options() ->
-    [{doc,"Test what happens when we give invalid options"}].
-       
-invalid_options(Config) when is_list(Config) -> 
-    ClientOpts = ssl_test_lib:ssl_options(client_rsa_verify_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
-    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-    
-    Check = fun(Client, Server, {versions, [sslv2, sslv3]} = Option) ->
-		    ssl_test_lib:check_result(Server, 
-					      {error, {options, {sslv2, Option}}}, 
-					      Client,
-					      {error, {options, {sslv2, Option}}});
-	       (Client, Server, Option) ->
-		    ssl_test_lib:check_result(Server, 
-					      {error, {options, Option}}, 
-					      Client,
-					      {error, {options, Option}})
-	    end,
-
-    TestOpts = 
-         [{versions, [sslv2, sslv3]}, 
-          {verify, 4}, 
-          {verify_fun, function},
-          {fail_if_no_peer_cert, 0}, 
-          {verify_client_once, 1},
-          {depth, four}, 
-          {certfile, 'cert.pem'}, 
-          {keyfile,'key.pem' }, 
-          {password, foo},
-          {cacertfile, ""}, 
-          {dhfile,'dh.pem' },
-          {ciphers, [{foo, bar, sha, ignore}]},
-          {reuse_session, foo},
-          {reuse_sessions, 0},
-          {renegotiate_at, "10"},
-          {mode, depech},
-          {packet, 8.0},
-          {packet_size, "2"},
-          {header, a},
-          {active, trice},
-          {key, 'key.pem' }],
-
-    [begin
-	 Server =
-	     ssl_test_lib:start_server_error([{node, ServerNode}, {port, 0},
-					{from, self()},
-					{options, [TestOpt | ServerOpts]}]),
-	 %% Will never reach a point where port is used.
-	 Client =
-	     ssl_test_lib:start_client_error([{node, ClientNode}, {port, 0},
-					      {host, Hostname}, {from, self()},
-					      {options, [TestOpt | ClientOpts]}]),
-	 Check(Client, Server, TestOpt),
-	 ok
-     end || TestOpt <- TestOpts],
-    ok.
-
-
-%%--------------------------------------------------------------------
-default_reject_anonymous()->
-    [{doc,"Test that by default anonymous cipher suites are rejected "}].
-default_reject_anonymous(Config) when is_list(Config) ->
-    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
-    Version = ssl_test_lib:protocol_version(Config),
-    TLSVersion = ssl_test_lib:tls_version(Version),
-    
-   [CipherSuite | _] = ssl_test_lib:ecdh_dh_anonymous_suites(TLSVersion),
-    
-    Server = ssl_test_lib:start_server_error([{node, ServerNode}, {port, 0},
-					      {from, self()},
-					      {options, ServerOpts}]),
-    Port = ssl_test_lib:inet_port(Server),
-    Client = ssl_test_lib:start_client_error([{node, ClientNode}, {port, Port},
-                                              {host, Hostname},
-                                              {from, self()},
-                                              {options,
-                                               [{ciphers,[CipherSuite]} |
-                                                ClientOpts]}]),
-
-    ssl_test_lib:check_server_alert(Server, Client, insufficient_security).
-
-%%--------------------------------------------------------------------
-defaults(Config) when is_list(Config)->
-    Versions = ssl:versions(),
-    true = lists:member(sslv3, proplists:get_value(available, Versions)),
-    false = lists:member(sslv3,  proplists:get_value(supported, Versions)),
-    true = lists:member('tlsv1', proplists:get_value(available, Versions)),
-    false = lists:member('tlsv1',  proplists:get_value(supported, Versions)),
-    true = lists:member('tlsv1.1', proplists:get_value(available, Versions)),
-    false = lists:member('tlsv1.1',  proplists:get_value(supported, Versions)),
-    true = lists:member('tlsv1.2', proplists:get_value(available, Versions)),
-    true = lists:member('tlsv1.2',  proplists:get_value(supported, Versions)),    
-    false = lists:member({rsa,rc4_128,sha}, ssl:cipher_suites()),
-    true = lists:member({rsa,rc4_128,sha}, ssl:cipher_suites(all)),
-    false = lists:member({rsa,des_cbc,sha}, ssl:cipher_suites()),
-    true = lists:member({rsa,des_cbc,sha}, ssl:cipher_suites(all)),
-    false = lists:member({dhe_rsa,des_cbc,sha}, ssl:cipher_suites()),
-    true = lists:member({dhe_rsa,des_cbc,sha}, ssl:cipher_suites(all)),
-    true = lists:member('dtlsv1.2', proplists:get_value(available_dtls, Versions)),
-    true = lists:member('dtlsv1', proplists:get_value(available_dtls, Versions)),
-    true = lists:member('dtlsv1.2', proplists:get_value(supported_dtls, Versions)),
-    false = lists:member('dtlsv1', proplists:get_value(supported_dtls, Versions)).
-
-%%--------------------------------------------------------------------
-reuseaddr() ->
-    [{doc,"Test reuseaddr option"}].
-
-reuseaddr(Config) when is_list(Config) ->
-    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
-    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-    Server =
-	ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
-				   {from, self()},
-				   {mfa, {ssl_test_lib, no_result, []}},
-				   {options,  [{active, false} | ServerOpts]}]),
-    Port = ssl_test_lib:inet_port(Server),
-    Client =
-	ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
-				   {host, Hostname},
-				   {from, self()},
-				   {mfa, {ssl_test_lib, no_result, []}},
-				   {options, [{active, false} | ClientOpts]}]),
-    ssl_test_lib:close(Server),
-    ssl_test_lib:close(Client),
-    
-    Server1 =
-	ssl_test_lib:start_server([{node, ServerNode}, {port, Port},
-				   {from, self()},
-				   {mfa, {ssl_test_lib, send_recv_result, []}},
-				   {options,  [{active, false} | ServerOpts]}]),
-    Client1 =
-	ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
-				   {host, Hostname},
-				   {from, self()},
-				   {mfa, {ssl_test_lib, send_recv_result, []}},
-				   {options, [{active, false} | ClientOpts]}]),
-
-    ssl_test_lib:check_result(Server1, ok, Client1, ok),
-    ssl_test_lib:close(Server1),
-    ssl_test_lib:close(Client1).
-
-%%--------------------------------------------------------------------
-tls_tcp_reuseaddr() ->
-    [{doc, "Reference test case."}].
-tls_tcp_reuseaddr(Config) when is_list(Config) ->
-    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-    Server =
-	ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
-				   {from, self()},
-				   {transport, gen_tcp},
-				   {mfa, {ssl_test_lib, no_result, []}},
-				   {options,  [{active, false}, {reuseaddr, true}]}]),
-    Port = ssl_test_lib:inet_port(Server),
-    Client =
-	ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
-				   {host, Hostname},
-                                   {transport, gen_tcp},
-				   {from, self()},
-				   {mfa, {ssl_test_lib, no_result, []}},
-				   {options, [{active, false}]}]),
-    ssl_test_lib:close(Server),
-    ssl_test_lib:close(Client),
-    
-    Server1 =
-	ssl_test_lib:start_server([{node, ServerNode}, {port, Port},
-				   {from, self()},
-				   {transport, gen_tcp},
-				   {mfa, {?MODULE, tcp_send_recv_result, []}},
-				   {options,  [{active, false}, {reuseaddr, true}]}]),
-    Client1 =
-	ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
-				   {host, Hostname},
-				   {from, self()},
-                                   {transport, gen_tcp}, 
-				   {mfa, {?MODULE, tcp_send_recv_result, []}},
-				   {options, [{active, false}]}]),
-
-    ssl_test_lib:check_result(Server1, ok, Client1, ok),
-    ssl_test_lib:close(Server1),
-    ssl_test_lib:close(Client1).
-
-
-%%--------------------------------------------------------------------
-tls_ciphersuite_vs_version()  ->
-    [{doc,"Test a SSLv3 client cannot negotiate a TLSv* cipher suite."}].
-tls_ciphersuite_vs_version(Config) when is_list(Config) ->
-    
-    {_ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
-    
-    Server = ssl_test_lib:start_server_error([{node, ServerNode}, {port, 0},
-					      {from, self()},
-					      {options, ServerOpts}]),
-    Port = ssl_test_lib:inet_port(Server),
-    
-    {ok, Socket} = gen_tcp:connect(Hostname, Port, [binary, {active, false}]),
-    ok = gen_tcp:send(Socket, 
-		      <<22, 3,0, 49:16, % handshake, SSL 3.0, length
-			1, 45:24, % client_hello, length
-			3,0, % SSL 3.0
-			16#deadbeef:256, % 32 'random' bytes = 256 bits
-			0, % no session ID
-			%% three cipher suites -- null, one with sha256 hash and one with sha hash
-			6:16, 0,255, 0,61, 0,57, 
-			1, 0 % no compression
-		      >>),
-    {ok, <<22, RecMajor:8, RecMinor:8, _RecLen:16, 2, HelloLen:24>>} = gen_tcp:recv(Socket, 9, 10000),
-    {ok, <<HelloBin:HelloLen/binary>>} = gen_tcp:recv(Socket, HelloLen, 5000),
-    ServerHello = tls_handshake:decode_handshake({RecMajor, RecMinor}, 2, HelloBin),
-    case ServerHello of
-	#server_hello{server_version = {3,0}, cipher_suite = <<0,57>>} -> 
-	    ok;
-	_ ->
-	    ct:fail({unexpected_server_hello, ServerHello})
-    end.
-			
-%%--------------------------------------------------------------------
-conf_signature_algs() ->
-    [{doc,"Test to set the signature_algs option on both client and server"}].
-conf_signature_algs(Config) when is_list(Config) -> 
-    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
-    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-    Server = 
-	ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-				   {from, self()}, 
-				   {mfa, {ssl_test_lib, send_recv_result, []}},
-				   {options,  [{active, false}, {signature_algs, [{sha, rsa}]} | ServerOpts]}]),
-    Port = ssl_test_lib:inet_port(Server),
-    Client = 
-	ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
-				   {host, Hostname},
-				   {from, self()}, 
-				   {mfa, {ssl_test_lib, send_recv_result, []}},
-				   {options, [{active, false}, {signature_algs, [{sha, rsa}]} | ClientOpts]}]),
-    
-    ct:log("Testcase ~p, Client ~p  Server ~p ~n",
-			 [self(), Client, Server]),
-    
-    ssl_test_lib:check_result(Server, ok, Client, ok),
-    
-    ssl_test_lib:close(Server),
-    ssl_test_lib:close(Client).
-
-
-%%--------------------------------------------------------------------
-no_common_signature_algs()  ->
-    [{doc,"Set the signature_algs option so that there client and server does not share any hash sign algorithms"}].
-no_common_signature_algs(Config) when is_list(Config) ->
-    
-    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
-
-    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-
-
-    Server = ssl_test_lib:start_server_error([{node, ServerNode}, {port, 0},
-					      {from, self()},
-					      {options, [{signature_algs, [{sha256, rsa}]}
-							 | ServerOpts]}]),
-    Port = ssl_test_lib:inet_port(Server),
-    Client = ssl_test_lib:start_client_error([{node, ClientNode}, {port, Port},
-                                              {host, Hostname},
-                                              {from, self()},
-                                              {options, [{signature_algs, [{sha384, rsa}]}
-                                                         | ClientOpts]}]),
-    
-    ssl_test_lib:check_server_alert(Server, Client, insufficient_security).
-
-
-%%--------------------------------------------------------------------
-connect_twice() ->
-    [{doc,""}].
-connect_twice(Config) when is_list(Config) ->
-    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
-
-    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-
-    Server =
-	ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
-				   {from, self()},
-				   {mfa, {ssl_test_lib, send_recv_result, []}},
-				   {options,  [{keepalive, true},{active, false}
-					       | ServerOpts]}]),
-    Port = ssl_test_lib:inet_port(Server),
-    Client =
-	ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
-				   {host, Hostname},
-				   {from, self()},
-				   {mfa, {ssl_test_lib, send_recv_result, []}},
-				   {options, [{keepalive, true},{active, false}
-					      | ClientOpts]}]),
-    Server ! listen,
-
-    {Client1, #sslsocket{}} =
-	ssl_test_lib:start_client([return_socket,
-				   {node, ClientNode}, {port, Port},
-				   {host, Hostname},
-				   {from, self()},
-				   {mfa, {ssl_test_lib, send_recv_result, []}},
-				   {options, [{keepalive, true},{active, false}
-					      | ClientOpts]}]),
-
-    ct:log("Testcase ~p, Client ~p  Server ~p ~n",
-			 [self(), Client, Server]),
-
-    ssl_test_lib:check_result(Server, ok, Client, ok),
-    ssl_test_lib:check_result(Server, ok, Client1, ok),
-
-    ssl_test_lib:close(Server),
-    ssl_test_lib:close(Client),
-    ssl_test_lib:close(Client1).
-
-%%--------------------------------------------------------------------
-new_server_wants_peer_cert() ->
-    [{doc, "Test that server configured to do client certification does"
-      " not reuse session without a client certificate."}].
-new_server_wants_peer_cert(Config) when is_list(Config) ->
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
-    VServerOpts = [{verify, verify_peer}, {fail_if_no_peer_cert, true}
-		  | ssl_test_lib:ssl_options(server_verification_opts, Config)],
-    ClientOpts = ssl_test_lib:ssl_options(client_verification_opts, Config),
-
-    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-
-    Server =
-	ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
-				   {from, self()},
-				   {mfa, {?MODULE, peercert_result, []}},
-				   {options,  [ServerOpts]}]),
-    Port = ssl_test_lib:inet_port(Server),
-    Client =
-	ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
-				   {host, Hostname},
-				   {from, self()},
-				   {mfa, {ssl_test_lib, no_result, []}},
-				   {options, ClientOpts}]),
-
-    Monitor = erlang:monitor(process, Server),
-    ssl_test_lib:close(Server),
-    ssl_test_lib:close(Client),
-    receive
-	{'DOWN', Monitor, _, _, _} ->
-	    ok
-    end,
-    
-    Server1 = ssl_test_lib:start_server([{node, ServerNode}, {port, Port},
-					 {from, self()},
-					 {mfa, {?MODULE, peercert_result, []}},
-					 {options,  VServerOpts}]), 
-    Client1 =
-	ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
-				   {host, Hostname},
-				   {from, self()},
-				   {mfa, {ssl_test_lib, no_result, []}},
-				   {options, [ClientOpts]}]),
-
-    CertFile = proplists:get_value(certfile, ClientOpts),
-    [{'Certificate', BinCert, _}]= ssl_test_lib:pem_to_der(CertFile),
-
-    ServerMsg = {error, no_peercert},
-    Sever1Msg = {ok, BinCert},
-   
-    ssl_test_lib:check_result(Server, ServerMsg, Server1, Sever1Msg),
-
-    ssl_test_lib:close(Server1),
-    ssl_test_lib:close(Client),
-    ssl_test_lib:close(Client1).
-
-%%--------------------------------------------------------------------
-
 tls_versions_option() ->
     [{doc,"Test API versions option to connect/listen."}].
 tls_versions_option(Config) when is_list(Config) ->
@@ -1160,128 +452,6 @@ tls_versions_option(Config) when is_list(Config) ->
 
 
 %%--------------------------------------------------------------------
-unordered_protocol_versions_server() ->
-    [{doc,"Test that the highest protocol is selected even" 
-      " when it is not first in the versions list."}].
-
-unordered_protocol_versions_server(Config) when is_list(Config) -> 
-    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),  
-
-    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-					{from, self()}, 
-					{mfa, {?MODULE, protocol_info_result, []}},
-					{options, [{versions, ['tlsv1.1', 'tlsv1.2']} | ServerOpts]}]),
-    Port = ssl_test_lib:inet_port(Server),
-    
-    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
-					{host, Hostname},
-					{from, self()}, 
-					{mfa, {?MODULE, protocol_info_result, []}},
-					{options, ClientOpts}]),
-
-    ServerMsg = ClientMsg = {ok,'tlsv1.2'},    
-    ssl_test_lib:check_result(Server, ServerMsg, Client, ClientMsg).
-
-%%--------------------------------------------------------------------
-unordered_protocol_versions_client() ->
-    [{doc,"Test that the highest protocol is selected even" 
-      " when it is not first in the versions list."}].
-
-unordered_protocol_versions_client(Config) when is_list(Config) -> 
-    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),  
-
-    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-					{from, self()}, 
-					{mfa, {?MODULE, protocol_info_result, []}},
-					{options, ServerOpts }]),
-    Port = ssl_test_lib:inet_port(Server),
-    
-    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
-					{host, Hostname},
-					{from, self()}, 
-					{mfa, {?MODULE, protocol_info_result, []}},
-					{options,  [{versions, ['tlsv1.1', 'tlsv1.2']} | ClientOpts]}]),
-
-    ServerMsg = ClientMsg = {ok, 'tlsv1.2'},    
-    ssl_test_lib:check_result(Server, ServerMsg, Client, ClientMsg).
-  
-%%--------------------------------------------------------------------
-max_handshake_size() ->
-    [{doc,"Test that we can set max_handshake_size to max value."}].
-
-max_handshake_size(Config) when is_list(Config) -> 
-    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),  
-
-    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-					{from, self()}, 
-					{mfa, {ssl_test_lib, send_recv_result_active, []}},
-					{options,  [{max_handshake_size, 8388607} |ServerOpts]}]),
-    Port = ssl_test_lib:inet_port(Server),
-    
-    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
-					{host, Hostname},
-					{from, self()}, 
-					{mfa, {ssl_test_lib, send_recv_result_active, []}},
-					{options, [{max_handshake_size, 8388607} | ClientOpts]}]),
- 
-    ssl_test_lib:check_result(Server, ok, Client, ok).
-  
-
-%%--------------------------------------------------------------------
-
-accept_pool() ->
-    [{doc,"Test having an accept pool."}].
-accept_pool(Config) when is_list(Config) ->
-    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),  
-
-    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-    Server0 = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-					{from, self()}, 
-					{accepters, 3},
-					{mfa, {ssl_test_lib, send_recv_result_active, []}},
-					{options, ServerOpts}]),
-    Port = ssl_test_lib:inet_port(Server0),
-    [Server1, Server2] = ssl_test_lib:accepters(2),
-
-    Client0 = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
-					 {host, Hostname},
-					 {from, self()}, 
-					 {mfa, {ssl_test_lib, send_recv_result_active, []}},
-					 {options, ClientOpts}
-					]),
-    
-    Client1 = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
-					 {host, Hostname},
-					 {from, self()}, 
-					 {mfa, {ssl_test_lib, send_recv_result_active, []}},
-					 {options, ClientOpts}
-					]),
-    
-    Client2 = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
-					 {host, Hostname},
-					 {from, self()}, 
-					 {mfa, {ssl_test_lib, send_recv_result_active, []}},
-					 {options, ClientOpts}
-					]),
-
-    ssl_test_lib:check_ok([Server0, Server1, Server2, Client0, Client1, Client2]),
-    
-    ssl_test_lib:close(Server0),
-    ssl_test_lib:close(Server1),
-    ssl_test_lib:close(Server2),
-    ssl_test_lib:close(Client0),
-    ssl_test_lib:close(Client1),
-    ssl_test_lib:close(Client2).
-    
-
-%%--------------------------------------------------------------------
 %% Internal functions ------------------------------------------------
 %%--------------------------------------------------------------------
 send_recv_result(Socket) ->
@@ -1293,47 +463,6 @@ tcp_send_recv_result(Socket) ->
     {ok,"Hello world"} = gen_tcp:recv(Socket, 11),
     ok.
 
-basic_verify_test_no_close(Config) ->
-    ClientOpts = ssl_test_lib:ssl_options(client_rsa_verify_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_rsa_verify_opts, Config),
-
-    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-
-    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
-					{from, self()},
-					{mfa, {ssl_test_lib, send_recv_result_active, []}},
-					{options, ServerOpts}]),
-    Port = ssl_test_lib:inet_port(Server),
-    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
-					{host, Hostname},
-					{from, self()},
-					{mfa, {ssl_test_lib, send_recv_result_active, []}},
-					{options, ClientOpts}]),
-
-    ssl_test_lib:check_result(Server, ok, Client, ok),
-    {Server, Client}.
-
-basic_test(Config) ->
-    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
-
-    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
-
-    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
-					{from, self()},
-					{mfa, {ssl_test_lib, send_recv_result_active, []}},
-					{options, ServerOpts}]),
-    Port = ssl_test_lib:inet_port(Server),
-    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
-					{host, Hostname},
-					{from, self()},
-					{mfa, {ssl_test_lib, send_recv_result_active, []}},
-					{options, ClientOpts}]),
-
-    ssl_test_lib:check_result(Server, ok, Client, ok),
-    ssl_test_lib:close(Server),
-    ssl_test_lib:close(Client).
-
 result_ok(_Socket) ->
     ok.
 
@@ -1386,6 +515,3 @@ version_option_test(Config, Version) ->
     ssl_test_lib:close(Server),
     ssl_test_lib:close(Client).
 
-connection_info_result(Socket) ->
-    {ok, Info} = ssl:connection_information(Socket, [protocol, selected_cipher_suite]),
-    {ok, {proplists:get_value(protocol, Info), proplists:get_value(selected_cipher_suite, Info)}}.
diff --git a/lib/ssl/test/ssl_pem_cache_SUITE.erl b/lib/ssl/test/ssl_pem_cache_SUITE.erl
index 6f11e2bbe8..3c7f6ab20f 100644
--- a/lib/ssl/test/ssl_pem_cache_SUITE.erl
+++ b/lib/ssl/test/ssl_pem_cache_SUITE.erl
@@ -34,7 +34,10 @@
 %% Common Test interface functions -----------------------------------
 %%--------------------------------------------------------------------
 all() ->
-    [pem_cleanup, invalid_insert].
+    [
+     pem_cleanup, 
+     clear_pem_cache,
+     invalid_insert].
 
 groups() ->
     [].
@@ -110,6 +113,37 @@ pem_cleanup(Config)when is_list(Config) ->
     ssl_test_lib:close(Client),
     false = Size == Size1.
 
+clear_pem_cache() ->
+    [{doc,"Test that internal reference tabel is cleaned properly even when "
+     " the PEM cache is cleared" }].
+clear_pem_cache(Config) when is_list(Config) -> 
+    {status, _, _, StatusInfo} = sys:get_status(whereis(ssl_manager)),
+    [_, _,_, _, Prop] = StatusInfo,
+    State = ssl_test_lib:state(Prop),
+    [_,{FilRefDb, _} |_] = element(6, State),
+    {Server, Client} = basic_verify_test_no_close(Config),
+    CountReferencedFiles = fun({_, -1}, Acc) ->
+				   Acc;
+			      ({_, N}, Acc) ->
+				   N + Acc
+			   end,
+    
+    2 = ets:foldl(CountReferencedFiles, 0, FilRefDb), 
+    ssl:clear_pem_cache(),
+    _ = sys:get_status(whereis(ssl_manager)),
+    {Server1, Client1} = basic_verify_test_no_close(Config),
+    4 =  ets:foldl(CountReferencedFiles, 0, FilRefDb), 
+    ssl_test_lib:close(Server),
+    ssl_test_lib:close(Client),
+    ct:sleep(2000),
+    _ = sys:get_status(whereis(ssl_manager)),
+    2 =  ets:foldl(CountReferencedFiles, 0, FilRefDb), 
+    ssl_test_lib:close(Server1),
+    ssl_test_lib:close(Client1),
+    ct:sleep(2000),
+    _ = sys:get_status(whereis(ssl_manager)),
+    0 =  ets:foldl(CountReferencedFiles, 0, FilRefDb).
+
 invalid_insert() ->
     [{doc, "Test that insert of invalid pem does not cause empty cache entry"}].
 invalid_insert(Config)when is_list(Config) ->      
@@ -163,3 +197,22 @@ later()->
     Gregorian = calendar:datetime_to_gregorian_seconds(DateTime),
     calendar:gregorian_seconds_to_datetime(Gregorian + (2 * ?CLEANUP_INTERVAL)).
 	
+basic_verify_test_no_close(Config) ->
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
+
+    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+
+    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+					{from, self()},
+					{mfa, {ssl_test_lib, send_recv_result_active, []}},
+					{options, ServerOpts}]),
+    Port = ssl_test_lib:inet_port(Server),
+    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
+					{host, Hostname},
+					{from, self()},
+					{mfa, {ssl_test_lib, send_recv_result_active, []}},
+					{options, ClientOpts}]),
+
+    ssl_test_lib:check_result(Server, ok, Client, ok),
+    {Server, Client}.
diff --git a/lib/ssl/test/tls_api_SUITE.erl b/lib/ssl/test/tls_api_SUITE.erl
index 6a61e844c5..f0c3e93f37 100644
--- a/lib/ssl/test/tls_api_SUITE.erl
+++ b/lib/ssl/test/tls_api_SUITE.erl
@@ -27,6 +27,7 @@
 -include_lib("ssl/src/ssl_record.hrl").
 -include_lib("ssl/src/ssl_internal.hrl").
 -include_lib("ssl/src/ssl_api.hrl").
+-include_lib("ssl/src/tls_handshake.hrl").
 
 -define(SLEEP, 500).
 
@@ -49,7 +50,7 @@ groups() ->
      {'tlsv1.2', [],  api_tests()},
      {'tlsv1.1', [],  api_tests()},
      {'tlsv1', [],  api_tests()},
-     {'sslv3', [],  api_tests()}
+     {'sslv3', [],  api_tests() ++ [ssl3_cipher_suite_limitation]}
     ].
 
 api_tests() ->
@@ -70,7 +71,9 @@ api_tests() ->
      peername,
      sockname,
      tls_server_handshake_timeout,
-     transport_close
+     transport_close,
+     emulated_options,
+     accept_pool
     ].
 
 init_per_suite(Config0) ->
@@ -601,6 +604,124 @@ transport_close(Config) when is_list(Config) ->
     {error, _} = ssl:send(SslS, "Hello world").
 
 %%--------------------------------------------------------------------
+ssl3_cipher_suite_limitation()  ->
+    [{doc,"Test a SSLv3 client cannot negotiate a TLSv* cipher suite."}].
+ssl3_cipher_suite_limitation(Config) when is_list(Config) ->
+    
+    {_ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
+    
+    Server = ssl_test_lib:start_server_error([{node, ServerNode}, {port, 0},
+					      {from, self()},
+					      {options, ServerOpts}]),
+    Port = ssl_test_lib:inet_port(Server),
+    
+    {ok, Socket} = gen_tcp:connect(Hostname, Port, [binary, {active, false}]),
+    ok = gen_tcp:send(Socket, 
+		      <<22, 3,0, 49:16, % handshake, SSL 3.0, length
+			1, 45:24, % client_hello, length
+			3,0, % SSL 3.0
+			16#deadbeef:256, % 32 'random' bytes = 256 bits
+			0, % no session ID
+			%% three cipher suites -- null, one with sha256 hash and one with sha hash
+			6:16, 0,255, 0,61, 0,57, 
+			1, 0 % no compression
+		      >>),
+    {ok, <<22, RecMajor:8, RecMinor:8, _RecLen:16, 2, HelloLen:24>>} = gen_tcp:recv(Socket, 9, 10000),
+    {ok, <<HelloBin:HelloLen/binary>>} = gen_tcp:recv(Socket, HelloLen, 5000),
+    ServerHello = tls_handshake:decode_handshake({RecMajor, RecMinor}, 2, HelloBin),
+    case ServerHello of
+	#server_hello{server_version = {3,0}, cipher_suite = <<0,57>>} -> 
+	    ok;
+	_ ->
+	    ct:fail({unexpected_server_hello, ServerHello})
+    end.
+%%--------------------------------------------------------------------
+emulated_options() ->
+    [{doc,"Test API function getopts/2 and setopts/2"}].
+
+emulated_options(Config) when is_list(Config) -> 
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
+    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+    Values = [{mode, list}, {packet, 0}, {header, 0},
+		      {active, true}],    
+    %% Shall be the reverse order of Values! 
+    Options = [active, header, packet, mode],
+    
+    NewValues = [{mode, binary}, {active, once}],
+    %% Shall be the reverse order of NewValues! 
+    NewOptions = [active, mode],
+    
+    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
+					{from, self()}, 
+			   {mfa, {?MODULE, tls_socket_options_result, 
+				  [Options, Values, NewOptions, NewValues]}},
+			   {options, ServerOpts}]),
+    Port = ssl_test_lib:inet_port(Server),
+    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
+					{host, Hostname},
+			   {from, self()}, 
+			   {mfa, {?MODULE, tls_socket_options_result, 
+				  [Options, Values, NewOptions, NewValues]}},
+			   {options, ClientOpts}]),
+    
+    ssl_test_lib:check_result(Server, ok, Client, ok),
+
+    ssl_test_lib:close(Server),
+    
+    {ok, Listen} = ssl:listen(0, ServerOpts),
+    {ok,[{mode,list}]} = ssl:getopts(Listen, [mode]),
+    ok = ssl:setopts(Listen, [{mode, binary}]),
+    {ok,[{mode, binary}]} = ssl:getopts(Listen, [mode]),
+    {ok,[{recbuf, _}]} = ssl:getopts(Listen, [recbuf]),
+    ssl:close(Listen).
+accept_pool() ->
+    [{doc,"Test having an accept pool."}].
+accept_pool(Config) when is_list(Config) ->
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),  
+
+    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+    Server0 = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
+					{from, self()}, 
+					{accepters, 3},
+					{mfa, {ssl_test_lib, send_recv_result_active, []}},
+					{options, ServerOpts}]),
+    Port = ssl_test_lib:inet_port(Server0),
+    [Server1, Server2] = ssl_test_lib:accepters(2),
+
+    Client0 = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
+					 {host, Hostname},
+					 {from, self()}, 
+					 {mfa, {ssl_test_lib, send_recv_result_active, []}},
+					 {options, ClientOpts}
+					]),
+    
+    Client1 = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
+					 {host, Hostname},
+					 {from, self()}, 
+					 {mfa, {ssl_test_lib, send_recv_result_active, []}},
+					 {options, ClientOpts}
+					]),
+    
+    Client2 = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
+					 {host, Hostname},
+					 {from, self()}, 
+					 {mfa, {ssl_test_lib, send_recv_result_active, []}},
+					 {options, ClientOpts}
+					]),
+
+    ssl_test_lib:check_ok([Server0, Server1, Server2, Client0, Client1, Client2]),
+    
+    ssl_test_lib:close(Server0),
+    ssl_test_lib:close(Server1),
+    ssl_test_lib:close(Server2),
+    ssl_test_lib:close(Client0),
+    ssl_test_lib:close(Client1),
+    ssl_test_lib:close(Client2).
+    
+%%--------------------------------------------------------------------
 %% Internal functions ------------------------------------------------
 %%--------------------------------------------------------------------
 
@@ -703,3 +824,17 @@ sockname_result(S) ->
 
 peername_result(S) ->
     ssl:peername(S).
+
+tls_socket_options_result(Socket, Options, DefaultValues, NewOptions, NewValues) ->
+    %% Test get/set emulated opts
+    {ok, DefaultValues} = ssl:getopts(Socket, Options), 
+    ssl:setopts(Socket, NewValues),
+    {ok, NewValues} = ssl:getopts(Socket, NewOptions),
+    %% Test get/set inet opts
+    {ok,[{nodelay,false}]} = ssl:getopts(Socket, [nodelay]),  
+    ssl:setopts(Socket, [{nodelay, true}]),
+    {ok,[{nodelay, true}]} = ssl:getopts(Socket, [nodelay]),
+    {ok, All} = ssl:getopts(Socket, []),
+    ct:log("All opts ~p~n", [All]),
+    ok.
+