Merge branch 'master' of super:otp into bmk/snmp/compiler/misc/OTP-9618

74 files changed, 2566 insertions, 1792 deletions

diff --git a/lib/diameter/bin/diameterc b/lib/diameter/bin/diameterc
index f5cf3ebc10..c0e83ea1a4 100755
--- a/lib/diameter/bin/diameterc
+++ b/lib/diameter/bin/diameterc
@@ -33,19 +33,24 @@
 
 usage() ->
     io:format(
-      "~w [options] file~n"
+      "~w [options] dict~n"
       "~n"
       "  Compile a diameter dictionary file (.dia) to Erlang source (.erl)~n"
       "  and/or header (.hrl) files.~n"
       "~n"
       "  options:~n"
-      "      -h      = print this message~n"
-      "      -v      = verbose output~n"
-      "      -o dir  = set the output directory (default .)~n"
-      "      -i dir  = set an include directory for inherited beams~n"
-      "      -E      = no .erl output~n"
-      "      -H      = no .hrl output~n"
-      "      -d      = write intermediate files (.spec and .forms)~n",
+      "~n"
+      "      --name name       = set @name~n"
+      "      --prefix prefix   = set @prefix~n"
+      "      --inherits dict|- = set/clear @inherits~n"
+      "~n"
+      "      -h        = print this message~n"
+      "      -v        = verbose output~n"
+      "      -o dir    = set the output directory (default .)~n"
+      "      -i dir    = set an include directory for inherited beams~n"
+      "      -E        = no .erl output~n"
+      "      -H        = no .hrl output~n"
+      "      -d        = write intermediate files (.spec and .forms)~n",
       [?MODULE]).
 
 main(Args) ->
@@ -109,9 +114,17 @@ arg(["-o", Dir | Args], #argv{options = Opts} = A) ->
     arg(Args, A#argv{options = [{outdir, Dir} | Opts]});
 
 arg(["-i", Dir | Args], #argv{options = Opts} = A) ->
-    true = dir_exists(Dir),
     arg(Args, A#argv{options = Opts ++ [{include, Dir}]});
 
+arg(["--name", Name | Args], #argv{options = Opts} = A) ->
+    arg(Args, A#argv{options = [{name, Name} | Opts]});
+    
+arg(["--prefix", Name | Args], #argv{options = Opts} = A) ->
+    arg(Args, A#argv{options = [{prefix, Name} | Opts]});
+    
+arg(["--inherits", Dict | Args], #argv{options = Opts} = A) ->
+    arg(Args, A#argv{options = Opts ++ [{inherits, Dict}]});
+
 arg(["-E" | Args], #argv{output = Output} = A) ->
     arg(Args, A#argv{output = lists:delete(erl, Output)});
 
@@ -120,10 +133,10 @@ arg(["-H" | Args], #argv{output = Output} = A) ->
 
 arg(["-d" | Args], #argv{options = Opts, output = Output} = A) ->
     arg(Args, A#argv{options = [debug | Opts],
-                            output = [spec | Output]});
+                     output = [spec | Output]});
 
 arg([[$- = M, C, H | T] | Args], A)  %% clustered options
-  when C /= $i, C /= $o ->
+  when C /= $i, C /= $o, C /= $- ->
     arg([[M,C], [M,H|T] | Args], A);
 
 arg([File], A) ->
diff --git a/lib/diameter/configure.in b/lib/diameter/configure.in
index 9aca3859c5..8acfb28fed 100644
--- a/lib/diameter/configure.in
+++ b/lib/diameter/configure.in
@@ -132,7 +132,6 @@ dnl </STANDALONE DIAMETER>
 
 AC_OUTPUT(
 	Makefile:Makefile.in
-	src/app/diameter.mk:src/app/diameter.mk.in
 	make/$host/rules.mk:make/rules.mk.in
 	)
 
diff --git a/lib/diameter/doc/src/Makefile b/lib/diameter/doc/src/Makefile
index 1453138cb6..bc3e649e6b 100644
--- a/lib/diameter/doc/src/Makefile
+++ b/lib/diameter/doc/src/Makefile
@@ -126,8 +126,6 @@ debug opt:
 info:
 	@echo "->Makefile<-"
 	@echo ""
-	@echo "DOCSUPPORT = $(DOCSUPPORT)"
-	@echo ""
 	@echo "INDEX_FILE   = $(INDEX_FILE)"
 	@echo "INDEX_SRC    = $(INDEX_SRC)"
 	@echo "INDEX_TARGET = $(INDEX_TARGET)"
@@ -141,10 +139,6 @@ info:
 	@echo ""
 	@echo "GIF_FILES             = $(GIF_FILES)"
 	@echo ""
-	@echo "TEX_FILES_USERS_GUIDE = $(TEX_FILES_USERS_GUIDE)"
-	@echo "TEX_FILES_REF_MAN     = $(TEX_FILES_REF_MAN)"
-	@echo "TEX_FILES_BOOK        = $(TEX_FILES_BOOK)"
-	@echo ""
 	@echo "MAN1_FILES            = $(MAN1_FILES)"
 	@echo "MAN3_FILES            = $(MAN3_FILES)"
 	@echo "MAN4_FILES            = $(MAN4_FILES)"
diff --git a/lib/diameter/doc/src/depend.sed b/lib/diameter/doc/src/depend.sed
index 5973c4586e..42de597f15 100644
--- a/lib/diameter/doc/src/depend.sed
+++ b/lib/diameter/doc/src/depend.sed
@@ -21,14 +21,18 @@
 # massaged in Makefile.
 #
 
-/^<com>\([^<]*\)<\/com>/b rf
-/^<module>\([^<]*\)<\/module>/b rf
+/^<com>/b c
+/^<module>/b c
 
 /^<chapter>/!d
 
+# Chapter: html basename is same as xml.
 s@@$(HTMLDIR)/%FILE%.html: %FILE%.xml@
 q
 
-:rf
-s@@$(HTMLDIR)/\1.html: %FILE%.xml@
+# Reference: html basename is from contents of com/module element.
+:c
+s@^[^>]*>@@
+s@<.*@@
+s@.*@$(HTMLDIR)/&.html: %FILE%.xml@
 q
diff --git a/lib/diameter/doc/src/diameter.xml b/lib/diameter/doc/src/diameter.xml
index 2cad70e3bc..43c497f50a 100644
--- a/lib/diameter/doc/src/diameter.xml
+++ b/lib/diameter/doc/src/diameter.xml
@@ -367,6 +367,19 @@ capabilities exchange message.
 Optional, defaults to the empty list.</p>
 </item>
 
+<tag><c>{'Inband-Security-Id', [Unsigned32()]}</c></tag>
+<item>
+<p>
+Values of Inband-Security-Id AVPs sent in an outgoing
+capabilities exchange message.
+Optional, defaults to the empty list, which is equivalent to a
+list containing only 0 (= NO_INBAND_SECURITY).</p>
+
+<p>
+If 1 (= TLS) is specified then TLS is selected if the CER/CEA received
+from the peer offers it.</p>
+</item>
+
 <tag><c>{'Acct-Application-Id', [Unsigned32()]}</c></tag>
 <item>
 <p>
@@ -683,6 +696,14 @@ in question.</p>
 AVP's used to construct outgoing CER/CEA messages.
 Any AVP specified takes precedence over a corresponding value specified
 for the service in question.</p>
+
+<p>
+Specifying a capability as a transport option
+may be particularly appropriate for Inband-Security-Id in case
+TLS is desired over TCP as implemented by
+<seealso marker="diameter_tcp">diameter_tcp(3)</seealso> but
+not over SCTP as implemented by
+<seealso marker="diameter_sctp">diameter_sctp(3)</seealso>.</p>
 </item>
 
 <tag><c>{watchdog_timer, TwInit}</c></tag>
diff --git a/lib/diameter/doc/src/diameter_compile.xml b/lib/diameter/doc/src/diameter_compile.xml
index 72bac30709..60e08d41da 100644
--- a/lib/diameter/doc/src/diameter_compile.xml
+++ b/lib/diameter/doc/src/diameter_compile.xml
@@ -64,9 +64,10 @@ Defaults to the current working directory.</p>
 <item>
 <p>
 Specifies a directory to add to the code path.
-Typically used to point at beam files corresponding to dictionaries
-included by the one being compiled (using the <c>@includes</c> directive):
-inclusion is a beam dependency, not an erl/hrl dependency.</p>
+Use to point at beam files corresponding to dictionaries
+inherited by the one being compiled using <c>@inherits</c> or
+<c>--inherits</c>.
+Inheritance is a beam dependency, not an erl/hrl dependency.</p>
 
 <p>
 Multiple <c>-i</c> options can be specified.</p>
@@ -84,6 +85,31 @@ Supresses erl generation.</p>
 Supresses hrl generation.</p>
 </item>
 
+<tag><![CDATA[--name <name>]]></tag>
+<item>
+<p>
+Set <c>@name</c> in the dictionary file.
+Overrides any setting in the file itself.</p>
+</item>
+
+<tag><![CDATA[--prefix <prefix>]]></tag>
+<item>
+<p>
+Set <c>@prefix</c> in the dictionary file.
+Overrides any setting in the file itself.</p>
+</item>
+
+<tag><![CDATA[--inherits <dict>]]></tag>
+<item>
+<p>
+Append an <c>@inherits</c> to the dictionary file.
+Specifying <c>'-'</c> as the dictionary has the effect of clearing
+any previous inherits, effectively ignoring previous inherits.</p>
+
+<p>
+Multiple <c>--inherits</c> options can be specified.</p>
+</item>
+
 </taglist>
 
 </item>
diff --git a/lib/diameter/doc/src/diameter_soc.xml b/lib/diameter/doc/src/diameter_soc.xml
index 4f8581a904..6b9ef9f756 100644
--- a/lib/diameter/doc/src/diameter_soc.xml
+++ b/lib/diameter/doc/src/diameter_soc.xml
@@ -57,9 +57,13 @@ including the P Flag in the AVP header.</p>
 
 <item>
 <p>
-There is no TLS support.
-It's unclear (aka uninvestigated) how TLS would impact
-diameter but IPsec can be used without it needing to know.</p>
+There is no TLS support over SCTP.
+RFC 3588 requires that a Diameter server support TLS but in
+practise this seems to mean TLS over SCTP since there are limitations
+with running over SCTP: see RFC 6083 (DTLS over SCTP), which is a
+response to RFC 3436 (TLS over SCTP).
+The current RFC 3588 draft acknowledges this by equating
+TLS with TLS/TCP and DTLS/SCTP but we do not yet support DTLS.</p>
 </item>
 
 <item>
diff --git a/lib/diameter/doc/src/diameter_tcp.xml b/lib/diameter/doc/src/diameter_tcp.xml
index a502e53972..e6b53383c0 100644
--- a/lib/diameter/doc/src/diameter_tcp.xml
+++ b/lib/diameter/doc/src/diameter_tcp.xml
@@ -43,7 +43,14 @@ It can be specified as the value of a transport_module option to
 <seealso
 marker="diameter#add_transport">diameter:add_transport/2</seealso>
 and implements the behaviour documented in
-<seealso marker="diameter_transport">diameter_transport(3)</seealso>.</p>
+<seealso marker="diameter_transport">diameter_transport(3)</seealso>.
+TLS security is supported, both as an upgrade following
+capabilities exchange as specified by RFC 3588 and
+at connection establishment as in the current draft standard.</p>
+
+<p>
+Note that the ssl application is required for TLS and must be started
+before configuring TLS capability on diameter transports.</p>
 
 <marker id="start"/>
 </description>
@@ -60,10 +67,15 @@ and implements the behaviour documented in
 <v>Type = connect | accept</v>
 <v>Ref = reference()</v>
 <v>Svc = #diameter_service{}</v>
-<v>Opt = {raddr, ip_address()} | {rport, integer()} | term()</v>
+<v>Opt = OwnOpt | SslOpt | OtherOpt</v>
 <v>Pid = pid()</v>
 <v>LAddr = ip_address()</v>
 <v>Reason = term()</v>
+<v>OwnOpt = {raddr, ip_address()}
+          | {rport, integer()}
+          | {port, integer()}</v>
+<v>SslOpt = {ssl_options, true | list()}</v>
+<v>OtherOpt = term()</v>
 </type>
 <desc>
 
@@ -74,17 +86,42 @@ marker="diameter_transport#start">diameter_transport(3)</seealso>.</p>
 <p>
 The only diameter_tcp-specific argument is the options list.
 Options <c>raddr</c> and <c>rport</c> specify the remote address
-and port for a connecting transport and not valid for a listening
+and port for a connecting transport and are not valid for a listening
 transport.
-Remaining options are any accepted by gen_tcp:connect/3 for
-a connecting transport, or gen_tcp:listen/2 for a listening transport,
-with the exception of <c>binary</c>, <c>packet</c> and <c>active</c>.
+Option <c>ssl_options</c> must be specified for a transport
+that must be able to support TLS: a value of <c>true</c> results in a
+TLS handshake immediately upon connection establishment while
+list() specifies options to be passed to ssl:connect/2 of ssl:ssl_accept/2
+after capabilities exchange if TLS is negotiated.
+Remaining options are any accepted by ssl:connect/3 or gen_tcp:connect/3 for
+a connecting transport, or ssl:listen/3 or gen_tcp:listen/2 for
+a listening transport, depending on whether or not <c>{ssl_options, true}</c>
+has been specified.
+Options <c>binary</c>, <c>packet</c> and <c>active</c> cannot be specified.
 Also, option <c>port</c> can be specified for a listening transport
 to specify the local listening port, the default being the standardized
 3868 if unspecified.
 Note that option <c>ip</c> specifies the local address.</p>
 
 <p>
+An <c>ssl_options</c> list must be specified if and only if
+the transport in question has specified an Inband-Security-Id
+AVP with value TLS on the relevant call to
+<seealso
+marker="diameter#start_service">start_service/2</seealso> or
+<seealso
+marker="diameter#add_transport">add_transport/2</seealso>,
+so that the transport process will receive notification of
+whether or not to commence with a TLS handshake following capabilities
+exchange.
+Failing to specify an options list on a TLS-capable transport
+for which TLS is negotiated will cause TLS handshake to fail.
+Failing to specify TLS capability when <c>ssl_options</c> has been
+specified will cause the transport process to wait for a notification
+that will not be forthcoming, which will eventually cause the RFC 3539
+watchdog to take down the connection.</p>
+
+<p>
 If the service specifies more than one Host-IP-Address and
 option <c>ip</c> is unspecified then then the
 first of the service's addresses is used as the local address.</p>
@@ -104,6 +141,7 @@ The returned local address list has length one.</p>
 <title>SEE ALSO</title>
 
 <p>
+<seealso marker="diameter">diameter(3)</seealso>,
 <seealso marker="diameter_transport">diameter_transport(3)</seealso></p>
 
 </section>
diff --git a/lib/diameter/doc/src/diameter_transport.xml b/lib/diameter/doc/src/diameter_transport.xml
index 37cc871e75..087a90b099 100644
--- a/lib/diameter/doc/src/diameter_transport.xml
+++ b/lib/diameter/doc/src/diameter_transport.xml
@@ -143,6 +143,34 @@ connection.
 Pid is the pid() of the parent process.</p>
 </item>
 
+<tag><c>{diameter, {tls, Ref, Type, Bool}}</c></tag>
+<item>
+<p>
+Indication of whether or not capabilities exchange has selected
+inband security using TLS.
+Ref is a reference() that must be included in the
+<c>{diameter, {tls, Ref}}</c> reply message to the transport's
+parent process (see below).
+Type is either <c>connect</c> or <c>accept</c> depending on
+whether the process has been started for a connecting or listening
+transport respectively.
+Bool is a boolean() indicating whether or not the transport connection
+should be upgraded to TLS.</p>
+
+<p>
+If TLS is requested (Bool = true) then a connecting process should
+initiate a TLS handshake with the peer and an accepting process should
+prepare to accept a handshake.
+A successful handshake should be followed by a <c>{diameter, {tls, Ref}}</c>
+message to the parent process.
+A failed handshake should cause the process to exit.</p>
+
+<p>
+This message is only sent to a transport process over whose
+<c>Inband-Security-Id</c> configuration has indicated support for
+TLS.</p>
+</item>
+
 </taglist>
 
 <p>
@@ -184,6 +212,16 @@ How the <c>transport_data</c> is used/interpreted is up to the
 transport module.</p>
 </item>
 
+<tag><c>{diameter, {tls, Ref}}</c></tag>
+<item>
+<p>
+Acknowledgment of a successful TLS handshake.
+Ref is the reference() received in the
+<c>{diameter, {tls, Ref, Type, Bool}}</c> message in response
+to which the reply is sent.
+A transport must exit if a handshake is not successful.</p>
+</item>
+
 </taglist>
 
 </section>
diff --git a/lib/diameter/make/rules.mk.in b/lib/diameter/make/rules.mk.in
index 6318f2bc9c..cd3c297d75 100644
--- a/lib/diameter/make/rules.mk.in
+++ b/lib/diameter/make/rules.mk.in
@@ -112,8 +112,6 @@ $(EBIN)/%.beam: $(ESRC)/%.erl
 # ----------------------------------------------------
 # export VSN
 
-# DOCSUPPORT = 1
-
 # TOPDOCDIR=../../../../doc
 
 DOCDIR = ..
diff --git a/lib/diameter/src/compiler/.gitignore b/lib/diameter/src/.gitignore
index d9f072e262..feeb378fd8 100644
--- a/lib/diameter/src/compiler/.gitignore
+++ b/lib/diameter/src/.gitignore
@@ -1,3 +1,2 @@
 
 /depend.mk
-
diff --git a/lib/diameter/src/Makefile b/lib/diameter/src/Makefile
index 6935eb053e..a057632d15 100644
--- a/lib/diameter/src/Makefile
+++ b/lib/diameter/src/Makefile
@@ -16,28 +16,225 @@
 # 
 # %CopyrightEnd%
 
-ifneq ($(ERL_TOP),)
-include $(ERL_TOP)/make/target.mk
-include $(ERL_TOP)/make/$(TARGET)/otp.mk
-else
+ifeq ($(ERL_TOP),)
 include $(DIAMETER_TOP)/make/target.mk
 include $(DIAMETER_TOP)/make/$(TARGET)/rules.mk
+else
+include $(ERL_TOP)/make/target.mk
+include $(ERL_TOP)/make/$(TARGET)/otp.mk
 endif
 
 # ----------------------------------------------------
-# Common Macros
+# Application version
 # ----------------------------------------------------
 
-include subdirs.mk
+include ../vsn.mk
 
-SPECIAL_TARGETS =
+VSN = $(DIAMETER_VSN)
 
 # ----------------------------------------------------
-# Default Subdir Targets
+# Release directory specification
 # ----------------------------------------------------
-ifneq ($(ERL_TOP),)
-include $(ERL_TOP)/make/otp_subdir.mk
+
+RELSYSDIR = $(RELEASE_PATH)/lib/diameter-$(VSN)
+
+# Where to put/find things.
+EBIN   = ../ebin
+INCDIR = ../include
+
+# Dumbed down to make 3.80. In 3.81 and later it's just $(realpath $(EBIN)).
+ABS_EBIN := $(shell cd $(EBIN) && pwd)
+
+# Where make should look for dependencies.
+VPATH = .:base:compiler:transport:gen
+
+# ----------------------------------------------------
+# Target specs
+# ----------------------------------------------------
+
+include modules.mk
+
+DICT_MODULES = $(DICTS:%=gen/diameter_gen_%)
+DICT_ERLS    = $(DICT_MODULES:%=%.erl)
+DICT_HRLS    = $(DICT_MODULES:%=%.hrl)
+
+# Modules to build before compiling dictionaries.
+COMPILER_MODULES = $(filter compiler/%, $(CT_MODULES))
+
+# All handwritten modules.
+MODULES = \
+	$(RT_MODULES) \
+	$(CT_MODULES)
+
+# Modules whose names are inserted into the app file.
+APP_MODULES = \
+	$(RT_MODULES) \
+	$(DICT_MODULES)
+
+# Modules for which to build beams.
+TARGET_MODULES = \
+	$(APP_MODULES) \
+	$(CT_MODULES)
+
+# What to build for the 'opt' target.
+TARGET_FILES = \
+	$(patsubst %,$(EBIN)/%.$(EMULATOR),$(notdir $(TARGET_MODULES))) \
+	$(APP_TARGET) \
+	$(APPUP_TARGET)
+
+# Subdirectories of src to release modules into.
+TARGET_DIRS = $(sort $(dir $(TARGET_MODULES)))
+
+APP_FILE   = diameter.app
+APP_SRC    = $(APP_FILE).src
+APP_TARGET = $(EBIN)/$(APP_FILE)
+
+APPUP_FILE   = diameter.appup
+APPUP_SRC    = $(APPUP_FILE).src
+APPUP_TARGET = $(EBIN)/$(APPUP_FILE)
+
+# ----------------------------------------------------
+# Flags
+# ----------------------------------------------------
+
+ifeq ($(TYPE),debug)
+ERL_COMPILE_FLAGS += -Ddebug
+endif
+
+ERL_COMPILE_FLAGS += \
+	+'{parse_transform,sys_pre_attributes}' \
+	+'{attribute,insert,app_vsn,$(APP_VSN)}' \
+	+warn_export_vars \
+	+warn_unused_vars \
+	-pa $(ABS_EBIN) \
+	-I $(INCDIR) \
+	-I gen
+# -pa is to be able to include_lib from the include directory: the
+# path must contain the application name.
+
+# ----------------------------------------------------
+# Targets
+# ----------------------------------------------------
+
+# erl/hrl from dictionary file.
+gen/diameter_gen_%.erl gen/diameter_gen_%.hrl: dict/%.dia
+	../bin/diameterc -o gen -i $(EBIN) $<
+
+opt: $(TARGET_FILES)
+
+debug:
+	@$(MAKE) TYPE=debug opt
+
+# Generate the app file.
+$(APP_TARGET): $(APP_SRC) ../vsn.mk modules.mk
+	M=`echo $(notdir $(APP_MODULES)) | tr ' ' ,`; \
+	sed -e 's;%VSN%;$(VSN);' \
+	    -e "s;%MODULES%;$$M;" \
+	  $< > $@
+
+$(APPUP_TARGET): $(APPUP_SRC) ../vsn.mk
+	sed -e 's;%VSN%;$(VSN);' $< > $@
+
+app:  $(APP_TARGET) $(APPUP_TARGET)
+dict: $(DICT_ERLS)
+
+docs:
+
+list = echo $(1):; echo $($(1)) | tr ' ' '\n' | sort | sed 's@^@  @'
+
+info:
+	@echo ========================================
+	@$(call list,DICTS)
+	@echo
+	@$(call list,RT_MODULES)
+	@echo
+	@$(call list,CT_MODULES)
+	@echo
+	@$(call list,TARGET_MODULES)
+	@echo
+	@$(call list,TARGET_DIRS)
+	@echo
+	@$(call list,EXTERNAL_HRLS)
+	@echo
+	@$(call list,INTERNAL_HRLS)
+	@echo
+	@$(call list,EXAMPLES)
+	@echo
+	@$(call list,BINS)
+	@echo ========================================
+
+clean:
+	rm -f $(TARGET_FILES) $(DICT_ERLS) $(DICT_HRLS)
+	rm -f depend.mk
+
+# ----------------------------------------------------
+# Release targets
+# ----------------------------------------------------
+
+ifeq ($(ERL_TOP),)
+include $(DIAMETER_TOP)/make/release_targets.mk
 else
-include $(DIAMETER_TOP)/make/subdir.mk
+include $(ERL_TOP)/make/otp_release_targets.mk
 endif
-#include ../make/subdir.mk
+
+# Can't $(INSTALL_DIR) more than on directory at a time on Solaris.
+
+release_spec: opt
+	for d in bin ebin examples include src/dict $(TARGET_DIRS:%/=src/%); do \
+	    $(INSTALL_DIR) $(RELSYSDIR)/$$d; \
+	done
+	$(INSTALL_SCRIPT) $(BINS:%=../bin/%) $(RELSYSDIR)/bin
+	$(INSTALL_DATA) $(TARGET_FILES) $(RELSYSDIR)/ebin
+	$(INSTALL_DATA) $(EXAMPLES:%=../examples/%) $(RELSYSDIR)/examples
+	$(INSTALL_DATA) $(EXTERNAL_HRLS:%=../include/%) $(DICT_HRLS) \
+	                $(RELSYSDIR)/include
+	$(INSTALL_DATA) $(DICTS:%=dict/%.dia) $(RELSYSDIR)/src/dict
+	$(MAKE) $(TARGET_DIRS:%/=release_src_%)
+
+$(TARGET_DIRS:%/=release_src_%): release_src_%:
+	$(INSTALL_DATA) $(filter $*/%,$(TARGET_MODULES:%=%.erl) \
+	                              $(INTERNAL_HRLS)) \
+	                $(RELSYSDIR)/src/$*
+
+release_docs_spec:
+
+# ----------------------------------------------------
+# Dependencies
+# ----------------------------------------------------
+
+gen/diameter_gen_base_accounting.erl gen/diameter_gen_relay.erl \
+gen/diameter_gen_base_accounting.hrl gen/diameter_gen_relay.hrl: \
+	$(EBIN)/diameter_gen_base_rfc3588.$(EMULATOR)
+
+gen/diameter_gen_base_rfc3588.erl gen/diameter_gen_base_rfc3588.hrl: \
+	$(COMPILER_MODULES:compiler/%=$(EBIN)/%.$(EMULATOR))
+
+$(DICT_MODULES:%=$(EBIN)/%.$(EMULATOR)): \
+	$(INCDIR)/diameter.hrl \
+	$(INCDIR)/diameter_gen.hrl
+
+depend: depend.mk
+
+# Generate dependencies makefile.
+depend.mk: depend.sed $(MODULES:%=%.erl) Makefile
+	(for f in $(MODULES); do \
+	     (echo $$f; cat $$f.erl) | sed -f $<; \
+	 done) \
+	> $@
+
+-include depend.mk
+
+.PRECIOUS: $(DICT_ERLS) $(DICT_HRLS)
+.PHONY: app clean depend dict info release_subdir
+.PHONY: debug opt release_docs_spec release_spec
+.PHONY: $(TARGET_DIRS:%/=%) $(TARGET_DIRS:%/=release_src_%)
+
+# ----------------------------------------------------
+# Targets using secondary expansion (make >= 3.81)
+# ----------------------------------------------------
+
+.SECONDEXPANSION:
+
+# Make beams from a subdirectory.
+$(TARGET_DIRS:%/=%): \
+  $$(patsubst $$@/%,$(EBIN)/%.$(EMULATOR),$$(filter $$@/%,$(TARGET_MODULES)))
diff --git a/lib/diameter/src/app/.gitignore b/lib/diameter/src/app/.gitignore
deleted file mode 100644
index d388e61877..0000000000
--- a/lib/diameter/src/app/.gitignore
+++ /dev/null
@@ -1,6 +0,0 @@
-
-/diameter_gen_*.erl
-/diameter_gen_*.hrl
-/depend.mk
-/diameter.mk
-
diff --git a/lib/diameter/src/app/Makefile b/lib/diameter/src/app/Makefile
deleted file mode 100644
index 96b7736a90..0000000000
--- a/lib/diameter/src/app/Makefile
+++ /dev/null
@@ -1,218 +0,0 @@
-#
-# %CopyrightBegin%
-#
-# Copyright Ericsson AB 2010-2011. All Rights Reserved.
-#
-# The contents of this file are subject to the Erlang Public License,
-# Version 1.1, (the "License"); you may not use this file except in
-# compliance with the License. You should have received a copy of the
-# Erlang Public License along with this software. If not, it can be
-# retrieved online at http://www.erlang.org/.
-#
-# Software distributed under the License is distributed on an "AS IS"
-# basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-# the License for the specific language governing rights and limitations
-# under the License.
-#
-# %CopyrightEnd%
-#
-#
-
-ifneq ($(ERL_TOP),)
-include $(ERL_TOP)/make/target.mk
-EBIN = ../../ebin
-include $(ERL_TOP)/make/$(TARGET)/otp.mk
-else
-include $(DIAMETER_TOP)/make/target.mk
-EBIN = ../../ebin
-include $(DIAMETER_TOP)/make/$(TARGET)/rules.mk
-endif
-
-
-
-# ----------------------------------------------------
-# Application version
-# ----------------------------------------------------
-
-include ../../vsn.mk
-
-VSN=$(DIAMETER_VSN)
-
-# ----------------------------------------------------
-# Release directory specification
-# ----------------------------------------------------
-
-RELSYSDIR = $(RELEASE_PATH)/lib/diameter-$(VSN)
-
-INCDIR = ../../include
-
-# ----------------------------------------------------
-# Target Specs
-# ----------------------------------------------------
-
-include modules.mk
-
-diameter_gen_base_accounting.erl: \
-	$(EBIN)/diameter_gen_base_rfc3588.beam
-diameter_gen_relay.erl: \
-	$(EBIN)/diameter_gen_base_rfc3588.beam
-
-SPEC_MODULES = \
-	$(SPEC_FILES:%.dia=%)
-
-SPEC_ERL_FILES = \
-	$(SPEC_FILES:%.dia=%.erl)
-
-SPEC_HRL_FILES = \
-	$(SPEC_FILES:%.dia=%.hrl)
-
-MODULES = \
-	$(RUNTIME_MODULES) \
-	$(HELP_MODULES)
-
-APP_MODULES = \
-	$(RUNTIME_MODULES) \
-	$(SPEC_MODULES)
-
-TARGET_MODULES = \
-	$(APP_MODULES) \
-	$(HELP_MODULES)
-
-TARGET_FILES = \
-	$(TARGET_MODULES:%=$(EBIN)/%.$(EMULATOR)) \
-	$(APP_TARGET) \
-	$(APPUP_TARGET)
-
-ESCRIPT_FILES = \
-	../../bin/diameterc
-
-APP_FILE   = diameter.app
-APP_SRC    = $(APP_FILE).src
-APP_TARGET = $(EBIN)/$(APP_FILE)
-
-APPUP_FILE   = diameter.appup
-APPUP_SRC    = $(APPUP_FILE).src
-APPUP_TARGET = $(EBIN)/$(APPUP_FILE)
-
-# ----------------------------------------------------
-# FLAGS
-# ----------------------------------------------------
-
-ifeq ($(TYPE),debug)
-ERL_COMPILE_FLAGS += -Ddebug
-endif
-
-include diameter.mk
-
-ERL_COMPILE_FLAGS += \
-    $(DIAMETER_ERL_COMPILE_FLAGS) \
-    -I$(INCDIR)
-
-# ----------------------------------------------------
-# Targets
-# ----------------------------------------------------
-
-debug:
-	@$(MAKE) TYPE=debug opt
-
-opt: $(TARGET_FILES)
-
-clean:
-	rm -f $(TARGET_FILES) $(SPEC_ERL_FILES) $(SPEC_HRL_FILES)
-	rm -f $(APP_TARGET) $(APPUP_TARGET)
-	rm -f errs core *~ diameter_gen_*.forms diameter_gen_*.spec
-	rm -f depend.mk
-
-docs:
-
-info:
-	@echo ""
-	@echo "SPEC_FILES = $(FILES)"
-	@echo "MODULES    = $(MODULES)"
-	@echo ""
-	@echo "EXTERNAL_HRL_FILES = $(EXTERNAL_HRL_FILES)"
-	@echo "INTERNAL_HRL_FILES = $(INTERNAL_HRL_FILES)"
-	@echo ""
-	@echo "EXAMPLE_FILES = $(EXAMPLE_FILES)"
-	@echo ""
-
-# ----------------------------------------------------
-# Special Build Targets
-# ----------------------------------------------------
-
-# Generate the app file and then modules into in. This shouldn't know
-# about ../transport but good enough for now.
-$(APP_TARGET): $(APP_SRC) \
-               ../../vsn.mk \
-               modules.mk \
-               ../transport/modules.mk
-	sed -e 's;%VSN%;$(VSN);' $< > $@
-	M=`echo $(APP_MODULES) | sed -e 's/^ *//' -e 's/ *$$//' -e 'y/ /,/'`; \
-	echo "/%APP_MODULES%/s//$$M/;w;q" | tr ';' '\n' \
-	| ed -s $@
-	$(MAKE) -C ../transport $(APP_TARGET) APP_TARGET=$(APP_TARGET)
-
-$(APPUP_TARGET): $(APPUP_SRC) ../../vsn.mk
-	sed -e 's;%VSN%;$(VSN);' $< > $@
-
-compiler:
-	$(MAKE) -C ../$@
-
-app: $(APP_TARGET) $(APPUP_TARGET)
-
-# erl/hrl from application spec
-diameter_gen_%.erl diameter_gen_%.hrl: diameter_gen_%.dia
-	../../bin/diameterc -i $(EBIN) -o $(@D) $<
-
-$(SPEC_MODULES:%=$(EBIN)/%.$(EMULATOR)): $(EBIN)/diameter_exprecs.$(EMULATOR)
-
-# ----------------------------------------------------
-# Release Target
-# ----------------------------------------------------
-
-ifneq ($(ERL_TOP),)
-include $(ERL_TOP)/make/otp_release_targets.mk
-else
-include $(DIAMETER_TOP)/make/release_targets.mk
-endif
-
-release_spec: opt
-	$(INSTALL_DIR)  $(RELSYSDIR)/bin
-	$(INSTALL_DIR)  $(RELSYSDIR)/ebin
-	$(INSTALL_DIR)  $(RELSYSDIR)/src/app
-	$(INSTALL_DIR)  $(RELSYSDIR)/include
-	$(INSTALL_DIR)  $(RELSYSDIR)/examples
-	$(INSTALL_SCRIPT) $(ESCRIPT_FILES) $(RELSYSDIR)/bin
-	$(INSTALL_DATA) $(TARGET_FILES) $(RELSYSDIR)/ebin
-	$(INSTALL_DATA) $(MODULES:%=%.erl) $(SPEC_ERL_FILES) $(RELSYSDIR)/src/app
-	$(INSTALL_DATA) $(SPEC_FILES) $(RELSYSDIR)/src/app
-	$(INSTALL_DATA) $(INTERNAL_HRL_FILES) $(RELSYSDIR)/src/app
-	$(INSTALL_DATA) $(EXTERNAL_HRL_FILES) $(SPEC_HRL_FILES) $(RELSYSDIR)/include
-	$(INSTALL_DATA) $(EXAMPLE_FILES) $(RELSYSDIR)/examples
-
-release_docs_spec:
-
-# ----------------------------------------------------
-# Dependencies
-# ----------------------------------------------------
-
-$(SPEC_FILES:%.dia=$(EBIN)/%.$(EMULATOR)): \
-	$(DIAMETER_TOP)/include/diameter.hrl \
-	$(DIAMETER_TOP)/include/diameter_gen.hrl
-
-depend: depend.mk
-
-# Generate dependencies makefile. It's assumed that the compile target
-# has already been made since it's currently not smart enough to not
-# force a rebuild of those beams dependent on generated hrls, and this
-# is a no-no at make release.
-depend.mk: depend.sed $(MODULES:%=%.erl) Makefile
-	(for f in $(MODULES); do \
-	     sed -f $< $$f.erl | sed "s@/@/$$f@"; \
-	 done) \
-	> $@
-
--include depend.mk
-
-.PRECIOUS: $(SPEC_ERL_FILES) $(SPEC_HRL_FILES)
-.PHONY: app clean debug depend info opt compiler release_spec release_docs_spec
diff --git a/lib/diameter/src/app/diameter.mk.in b/lib/diameter/src/app/diameter.mk.in
deleted file mode 100644
index c161064303..0000000000
--- a/lib/diameter/src/app/diameter.mk.in
+++ /dev/null
@@ -1,47 +0,0 @@
-#-*-makefile-*-   ; force emacs to enter makefile-mode
-
-# %CopyrightBegin%
-#
-# Copyright Ericsson AB 2010-2011. All Rights Reserved.
-#
-# The contents of this file are subject to the Erlang Public License,
-# Version 1.1, (the "License"); you may not use this file except in
-# compliance with the License. You should have received a copy of the
-# Erlang Public License along with this software. If not, it can be
-# retrieved online at http://www.erlang.org/.
-#
-# Software distributed under the License is distributed on an "AS IS"
-# basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-# the License for the specific language governing rights and limitations
-# under the License.
-#
-# %CopyrightEnd%
-
-DIAMETER_TOP = @DIAMETER_TOP@
-
-# ifneq ($(PREFIX),)
-# ifeq ($(TESTROOT),)
-# TESTROOT = $(PREFIX)
-# endif
-# endif
-
-ifeq ($(USE_DIAMETER_TEST_CODE), true)
-ERL_COMPILE_FLAGS += -DDIAMETER_TEST_CODE=mona_lisa_spelar_doom
-endif
-
-ifeq ($(USE_DIAMETER_HIPE), true)
-ERL_COMPILE_FLAGS += +native
-endif
-
-ifeq ($(WARN_UNUSED_WARS), true)
-ERL_COMPILE_FLAGS += +warn_unused_vars
-endif
-
-DIAMETER_APP_VSN_COMPILE_FLAGS = \
-	+'{parse_transform,sys_pre_attributes}' \
-	+'{attribute,insert,app_vsn,$(APP_VSN)}'
-
-DIAMETER_ERL_COMPILE_FLAGS += \
-	-pa $(DIAMETER_TOP)/ebin  \
-	$(DIAMETER_APP_VSN_COMPILE_FLAGS) 
-
diff --git a/lib/diameter/src/app/diameter_gen_base_accounting.dia b/lib/diameter/src/app/diameter_gen_base_accounting.dia
deleted file mode 100644
index 64e95dddb5..0000000000
--- a/lib/diameter/src/app/diameter_gen_base_accounting.dia
+++ /dev/null
@@ -1,68 +0,0 @@
-;;
-;; %CopyrightBegin%
-;;
-;; Copyright Ericsson AB 2010-2011. All Rights Reserved.
-;;
-;; The contents of this file are subject to the Erlang Public License,
-;; Version 1.1, (the "License"); you may not use this file except in
-;; compliance with the License. You should have received a copy of the
-;; Erlang Public License along with this software. If not, it can be
-;; retrieved online at http://www.erlang.org/.
-;;
-;; Software distributed under the License is distributed on an "AS IS"
-;; basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-;; the License for the specific language governing rights and limitations
-;; under the License.
-;;
-;; %CopyrightEnd%
-;;
-
-@id 3
-@prefix diameter_base_accounting
-@vendor 0 IETF
-
-@inherits diameter_gen_base_rfc3588
-
-@messages
-
-      ACR  ::= < Diameter Header: 271, REQ, PXY >
-                < Session-Id >
-                { Origin-Host }
-                { Origin-Realm }
-                { Destination-Realm }
-                { Accounting-Record-Type }
-                { Accounting-Record-Number }
-                [ Acct-Application-Id ]
-                [ Vendor-Specific-Application-Id ]
-                [ User-Name ]
-                [ Accounting-Sub-Session-Id ]
-                [ Acct-Session-Id ]
-                [ Acct-Multi-Session-Id ]
-                [ Acct-Interim-Interval ]
-                [ Accounting-Realtime-Required ]
-                [ Origin-State-Id ]
-                [ Event-Timestamp ]
-              * [ Proxy-Info ]
-              * [ Route-Record ]
-              * [ AVP ]
-
-      ACA  ::= < Diameter Header: 271, PXY >
-                < Session-Id >
-                { Result-Code }
-                { Origin-Host }
-                { Origin-Realm }
-                { Accounting-Record-Type }
-                { Accounting-Record-Number }
-                [ Acct-Application-Id ]
-                [ Vendor-Specific-Application-Id ]
-                [ User-Name ]
-                [ Accounting-Sub-Session-Id ]
-                [ Acct-Session-Id ]
-                [ Acct-Multi-Session-Id ]
-                [ Error-Reporting-Host ]
-                [ Acct-Interim-Interval ]
-                [ Accounting-Realtime-Required ]
-                [ Origin-State-Id ]
-                [ Event-Timestamp ]
-              * [ Proxy-Info ]
-              * [ AVP ]
diff --git a/lib/diameter/src/app/diameter_gen_base_rfc3588.dia b/lib/diameter/src/app/diameter_gen_base_rfc3588.dia
deleted file mode 100644
index 4a12e21acd..0000000000
--- a/lib/diameter/src/app/diameter_gen_base_rfc3588.dia
+++ /dev/null
@@ -1,413 +0,0 @@
-;;
-;; %CopyrightBegin%
-;;
-;; Copyright Ericsson AB 2010-2011. All Rights Reserved.
-;;
-;; The contents of this file are subject to the Erlang Public License,
-;; Version 1.1, (the "License"); you may not use this file except in
-;; compliance with the License. You should have received a copy of the
-;; Erlang Public License along with this software. If not, it can be
-;; retrieved online at http://www.erlang.org/.
-;;
-;; Software distributed under the License is distributed on an "AS IS"
-;; basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-;; the License for the specific language governing rights and limitations
-;; under the License.
-;;
-;; %CopyrightEnd%
-;;
-
-@id 0
-@prefix diameter_base
-@vendor 0 IETF
-
-@avp_types
-
-   Acct-Interim-Interval             85    Unsigned32    M
-   Accounting-Realtime-Required     483    Enumerated    M
-   Acct-Multi-Session-Id             50    UTF8String    M
-   Accounting-Record-Number         485    Unsigned32    M
-   Accounting-Record-Type           480    Enumerated    M
-   Acct-Session-Id                   44   OctetString    M
-   Accounting-Sub-Session-Id        287    Unsigned64    M
-   Acct-Application-Id              259    Unsigned32    M
-   Auth-Application-Id              258    Unsigned32    M
-   Auth-Request-Type                274    Enumerated    M
-   Authorization-Lifetime           291    Unsigned32    M
-   Auth-Grace-Period                276    Unsigned32    M
-   Auth-Session-State               277    Enumerated    M
-   Re-Auth-Request-Type             285    Enumerated    M
-   Class                             25   OctetString    M
-   Destination-Host                 293     DiamIdent    M
-   Destination-Realm                283     DiamIdent    M
-   Disconnect-Cause                 273    Enumerated    M
-   E2E-Sequence                     300       Grouped    M
-   Error-Message                    281    UTF8String    -
-   Error-Reporting-Host             294     DiamIdent    -
-   Event-Timestamp                   55          Time    M
-   Experimental-Result              297       Grouped    M
-   Experimental-Result-Code         298    Unsigned32    M
-   Failed-AVP                       279       Grouped    M
-   Firmware-Revision                267    Unsigned32    -
-   Host-IP-Address                  257       Address    M
-   Inband-Security-Id               299    Unsigned32    M
-   Multi-Round-Time-Out             272    Unsigned32    M
-   Origin-Host                      264     DiamIdent    M
-   Origin-Realm                     296     DiamIdent    M
-   Origin-State-Id                  278    Unsigned32    M
-   Product-Name                     269    UTF8String    -
-   Proxy-Host                       280     DiamIdent    M
-   Proxy-Info                       284       Grouped    M
-   Proxy-State                       33   OctetString    M
-   Redirect-Host                    292       DiamURI    M
-   Redirect-Host-Usage              261    Enumerated    M
-   Redirect-Max-Cache-Time          262    Unsigned32    M
-   Result-Code                      268    Unsigned32    M
-   Route-Record                     282     DiamIdent    M
-   Session-Id                       263    UTF8String    M
-   Session-Timeout                   27    Unsigned32    M
-   Session-Binding                  270    Unsigned32    M
-   Session-Server-Failover          271    Enumerated    M
-   Supported-Vendor-Id              265    Unsigned32    M
-   Termination-Cause                295    Enumerated    M
-   User-Name                          1    UTF8String    M
-   Vendor-Id                        266    Unsigned32    M
-   Vendor-Specific-Application-Id   260       Grouped    M
-
-@messages
-
-      CER  ::= < Diameter Header: 257, REQ >
-                { Origin-Host }
-                { Origin-Realm }
-             1* { Host-IP-Address }
-                { Vendor-Id }
-                { Product-Name }
-                [ Origin-State-Id ]
-              * [ Supported-Vendor-Id ]
-              * [ Auth-Application-Id ]
-              * [ Inband-Security-Id ]
-              * [ Acct-Application-Id ]
-              * [ Vendor-Specific-Application-Id ]
-                [ Firmware-Revision ]
-              * [ AVP ]
-
-      CEA  ::= < Diameter Header: 257 >
-                { Result-Code }
-                { Origin-Host }
-                { Origin-Realm }
-             1* { Host-IP-Address }
-                { Vendor-Id }
-                { Product-Name }
-                [ Origin-State-Id ]
-                [ Error-Message ]
-              * [ Failed-AVP ]
-              * [ Supported-Vendor-Id ]
-              * [ Auth-Application-Id ]
-              * [ Inband-Security-Id ]
-              * [ Acct-Application-Id ]
-              * [ Vendor-Specific-Application-Id ]
-                [ Firmware-Revision ]
-              * [ AVP ]
-
-      DPR   ::= < Diameter Header: 282, REQ >
-                 { Origin-Host }
-                 { Origin-Realm }
-                 { Disconnect-Cause }
-
-      DPA   ::= < Diameter Header: 282 >
-                 { Result-Code }
-                 { Origin-Host }
-                 { Origin-Realm }
-                 [ Error-Message ]
-               * [ Failed-AVP ]
-
-      DWR   ::= < Diameter Header: 280, REQ >
-                 { Origin-Host }
-                 { Origin-Realm }
-                 [ Origin-State-Id ]
-
-      DWA   ::= < Diameter Header: 280 >
-                 { Result-Code }
-                 { Origin-Host }
-                 { Origin-Realm }
-                 [ Error-Message ]
-               * [ Failed-AVP ]
-                 [ Origin-State-Id ]
-
-   answer-message  ::= < Diameter Header: code, ERR [PXY] >
-                     0*1< Session-Id >
-                        { Origin-Host }
-                        { Origin-Realm }
-                        { Result-Code }
-                        [ Origin-State-Id ]
-                        [ Error-Reporting-Host ]
-                        [ Proxy-Info ]
-                      * [ AVP ]
-
-      RAR   ::= < Diameter Header: 258, REQ, PXY >
-                 < Session-Id >
-                 { Origin-Host }
-                 { Origin-Realm }
-                 { Destination-Realm }
-                 { Destination-Host }
-                 { Auth-Application-Id }
-                 { Re-Auth-Request-Type }
-                 [ User-Name ]
-                 [ Origin-State-Id ]
-               * [ Proxy-Info ]
-               * [ Route-Record ]
-               * [ AVP ]
-
-      RAA   ::= < Diameter Header: 258, PXY >
-                 < Session-Id >
-                 { Result-Code }
-                 { Origin-Host }
-                 { Origin-Realm }
-                 [ User-Name ]
-                 [ Origin-State-Id ]
-                 [ Error-Message ]
-                 [ Error-Reporting-Host ]
-               * [ Failed-AVP ]
-               * [ Redirect-Host ]
-                 [ Redirect-Host-Usage ]
-                 [ Redirect-Max-Cache-Time ]
-               * [ Proxy-Info ]
-               * [ AVP ]
-
-      STR  ::= < Diameter Header: 275, REQ, PXY >
-                < Session-Id >
-                { Origin-Host }
-                { Origin-Realm }
-                { Destination-Realm }
-                { Auth-Application-Id }
-                { Termination-Cause }
-                [ User-Name ]
-                [ Destination-Host ]
-              * [ Class ]
-                [ Origin-State-Id ]
-              * [ Proxy-Info ]
-              * [ Route-Record ]
-              * [ AVP ]
-
-      STA   ::= < Diameter Header: 275, PXY >
-                 < Session-Id >
-                 { Result-Code }
-                 { Origin-Host }
-                 { Origin-Realm }
-                 [ User-Name ]
-               * [ Class ]
-                 [ Error-Message ]
-                 [ Error-Reporting-Host ]
-               * [ Failed-AVP ]
-                 [ Origin-State-Id ]
-               * [ Redirect-Host ]
-                 [ Redirect-Host-Usage ]
-                 [ Redirect-Max-Cache-Time ]
-               * [ Proxy-Info ]
-               * [ AVP ]
-
-      ASR   ::= < Diameter Header: 274, REQ, PXY >
-                 < Session-Id >
-                 { Origin-Host }
-                 { Origin-Realm }
-                 { Destination-Realm }
-                 { Destination-Host }
-                 { Auth-Application-Id }
-                 [ User-Name ]
-                 [ Origin-State-Id ]
-               * [ Proxy-Info ]
-               * [ Route-Record ]
-               * [ AVP ]
-
-      ASA   ::= < Diameter Header: 274, PXY >
-                 < Session-Id >
-                 { Result-Code }
-                 { Origin-Host }
-                 { Origin-Realm }
-                 [ User-Name ]
-                 [ Origin-State-Id ]
-                 [ Error-Message ]
-                 [ Error-Reporting-Host ]
-               * [ Failed-AVP ]
-               * [ Redirect-Host ]
-                 [ Redirect-Host-Usage ]
-                 [ Redirect-Max-Cache-Time ]
-               * [ Proxy-Info ]
-               * [ AVP ]
-
-      ACR  ::= < Diameter Header: 271, REQ, PXY >
-                < Session-Id >
-                { Origin-Host }
-                { Origin-Realm }
-                { Destination-Realm }
-                { Accounting-Record-Type }
-                { Accounting-Record-Number }
-                [ Acct-Application-Id ]
-                [ Vendor-Specific-Application-Id ]
-                [ User-Name ]
-                [ Accounting-Sub-Session-Id ]
-                [ Acct-Session-Id ]
-                [ Acct-Multi-Session-Id ]
-                [ Acct-Interim-Interval ]
-                [ Accounting-Realtime-Required ]
-                [ Origin-State-Id ]
-                [ Event-Timestamp ]
-              * [ Proxy-Info ]
-              * [ Route-Record ]
-              * [ AVP ]
-
-      ACA  ::= < Diameter Header: 271, PXY >
-                < Session-Id >
-                { Result-Code }
-                { Origin-Host }
-                { Origin-Realm }
-                { Accounting-Record-Type }
-                { Accounting-Record-Number }
-                [ Acct-Application-Id ]
-                [ Vendor-Specific-Application-Id ]
-                [ User-Name ]
-                [ Accounting-Sub-Session-Id ]
-                [ Acct-Session-Id ]
-                [ Acct-Multi-Session-Id ]
-                [ Error-Reporting-Host ]
-                [ Acct-Interim-Interval ]
-                [ Accounting-Realtime-Required ]
-                [ Origin-State-Id ]
-                [ Event-Timestamp ]
-              * [ Proxy-Info ]
-              * [ AVP ]
-
-@enum Disconnect-Cause
-
-   REBOOTING                         0
-   BUSY                              1
-   DO_NOT_WANT_TO_TALK_TO_YOU        2
-
-@enum Redirect-Host-Usage
-
-   DONT_CACHE                        0
-   ALL_SESSION                       1
-   ALL_REALM                         2
-   REALM_AND_APPLICATION             3
-   ALL_APPLICATION                   4
-   ALL_HOST                          5
-   ALL_USER                          6
-
-@enum Auth-Request-Type
-
-   AUTHENTICATE_ONLY          1
-   AUTHORIZE_ONLY             2
-   AUTHORIZE_AUTHENTICATE     3
-
-@enum Auth-Session-State
-
-   STATE_MAINTAINED              0
-   NO_STATE_MAINTAINED           1
-
-@enum Re-Auth-Request-Type
-
-   AUTHORIZE_ONLY             0
-   AUTHORIZE_AUTHENTICATE     1
-
-@enum Termination-Cause
-
-   DIAMETER_LOGOUT                   1
-   DIAMETER_SERVICE_NOT_PROVIDED     2
-   DIAMETER_BAD_ANSWER               3
-   DIAMETER_ADMINISTRATIVE           4
-   DIAMETER_LINK_BROKEN              5
-   DIAMETER_AUTH_EXPIRED             6
-   DIAMETER_USER_MOVED               7
-   DIAMETER_SESSION_TIMEOUT          8
-
-@enum Session-Server-Failover
-
-   REFUSE_SERVICE             0
-   TRY_AGAIN                  1
-   ALLOW_SERVICE              2
-   TRY_AGAIN_ALLOW_SERVICE    3
-
-@enum Accounting-Record-Type
-
-   EVENT_RECORD                    1
-   START_RECORD                    2
-   INTERIM_RECORD                  3
-   STOP_RECORD                     4
-
-@enum Accounting-Realtime-Required
-
-   DELIVER_AND_GRANT                           1
-   GRANT_AND_STORE                             2
-   GRANT_AND_LOSE                              3
-
-@result_code Result-Code
-
-;; 7.1.1.  Informational
-   DIAMETER_MULTI_ROUND_AUTH         1001
-
-;; 7.1.2.  Success
-   DIAMETER_SUCCESS                   2001
-   DIAMETER_LIMITED_SUCCESS           2002
-
-;; 7.1.3.  Protocol Errors
-   DIAMETER_COMMAND_UNSUPPORTED       3001
-   DIAMETER_UNABLE_TO_DELIVER         3002
-   DIAMETER_REALM_NOT_SERVED          3003
-   DIAMETER_TOO_BUSY                  3004
-   DIAMETER_LOOP_DETECTED             3005
-   DIAMETER_REDIRECT_INDICATION       3006
-   DIAMETER_APPLICATION_UNSUPPORTED   3007
-   DIAMETER_INVALID_HDR_BITS          3008
-   DIAMETER_INVALID_AVP_BITS          3009
-   DIAMETER_UNKNOWN_PEER              3010
-
-;; 7.1.4.  Transient Failures
-   DIAMETER_AUTHENTICATION_REJECTED   4001
-   DIAMETER_OUT_OF_SPACE              4002
-   ELECTION_LOST                      4003
-
-;; 7.1.5.  Permanent Failures
-   DIAMETER_AVP_UNSUPPORTED           5001
-   DIAMETER_UNKNOWN_SESSION_ID        5002
-   DIAMETER_AUTHORIZATION_REJECTED    5003
-   DIAMETER_INVALID_AVP_VALUE         5004
-   DIAMETER_MISSING_AVP               5005
-   DIAMETER_RESOURCES_EXCEEDED        5006
-   DIAMETER_CONTRADICTING_AVPS        5007
-   DIAMETER_AVP_NOT_ALLOWED           5008
-   DIAMETER_AVP_OCCURS_TOO_MANY_TIMES 5009
-   DIAMETER_NO_COMMON_APPLICATION     5010
-   DIAMETER_UNSUPPORTED_VERSION       5011
-   DIAMETER_UNABLE_TO_COMPLY          5012
-   DIAMETER_INVALID_BIT_IN_HEADER     5013
-   DIAMETER_INVALID_AVP_LENGTH        5014
-   DIAMETER_INVALID_MESSAGE_LENGTH    5015
-   DIAMETER_INVALID_AVP_BIT_COMBO     5016
-   DIAMETER_NO_COMMON_SECURITY        5017
-
-@grouped 
-
-      Proxy-Info ::= < AVP Header: 284 >
-                     { Proxy-Host }
-                     { Proxy-State }
-                   * [ AVP ]
-
-      Failed-AVP ::= < AVP Header: 279 >
-                    1* {AVP}
-
-      Experimental-Result ::= < AVP Header: 297 >
-                                 { Vendor-Id }
-                                 { Experimental-Result-Code }
-
-  Vendor-Specific-Application-Id ::= < AVP Header: 260 >
-                                     1* { Vendor-Id }
-                                        [ Auth-Application-Id ]
-                                        [ Acct-Application-Id ]
-
-;; The E2E-Sequence AVP is defined in RFC 3588 as Grouped, but 
-;; there is no definition of the group - only an informal text stating
-;; that there should be a nonce (an OctetString) and a counter
-;; (integer)
-;;
-      E2E-Sequence ::= <AVP Header: 300 >
-                   2* { AVP }
diff --git a/lib/diameter/src/app/modules.mk b/lib/diameter/src/app/modules.mk
deleted file mode 100644
index c133e6f64e..0000000000
--- a/lib/diameter/src/app/modules.mk
+++ /dev/null
@@ -1,70 +0,0 @@
-#-*-makefile-*-   ; force emacs to enter makefile-mode
-
-# %CopyrightBegin%
-# 
-# Copyright Ericsson AB 2010-2011. All Rights Reserved.
-# 
-# The contents of this file are subject to the Erlang Public License,
-# Version 1.1, (the "License"); you may not use this file except in
-# compliance with the License. You should have received a copy of the
-# Erlang Public License along with this software. If not, it can be
-# retrieved online at http://www.erlang.org/.
-# 
-# Software distributed under the License is distributed on an "AS IS"
-# basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-# the License for the specific language governing rights and limitations
-# under the License.
-# 
-# %CopyrightEnd%
-
-SPEC_FILES = \
-	diameter_gen_base_rfc3588.dia \
-	diameter_gen_base_accounting.dia \
-	diameter_gen_relay.dia
-
-RUNTIME_MODULES = \
-	diameter \
-	diameter_app \
-	diameter_capx \
-	diameter_config \
-	diameter_codec \
-	diameter_dict \
-	diameter_lib \
-	diameter_misc_sup \
-	diameter_peer \
-	diameter_peer_fsm \
-	diameter_peer_fsm_sup \
-	diameter_reg \
-	diameter_service \
-	diameter_service_sup \
-	diameter_session \
-	diameter_stats \
-	diameter_sup \
-	diameter_sync \
-	diameter_types \
-	diameter_watchdog \
-	diameter_watchdog_sup
-
-HELP_MODULES = \
-	diameter_callback \
-	diameter_exprecs \
-	diameter_dbg \
-	diameter_info
-
-INTERNAL_HRL_FILES = \
-	diameter_internal.hrl \
-	diameter_types.hrl
-
-EXTERNAL_HRL_FILES = \
-	../../include/diameter.hrl \
-	../../include/diameter_gen.hrl
-
-EXAMPLE_FILES = \
-	../../examples/GNUmakefile \
-	../../examples/peer.erl \
-	../../examples/client.erl \
-	../../examples/client_cb.erl \
-	../../examples/server.erl \
-	../../examples/server_cb.erl \
-	../../examples/relay.erl \
-	../../examples/relay_cb.erl
diff --git a/lib/diameter/src/app/diameter.app.src b/lib/diameter/src/base/diameter.app.src
index a806b5c78a..c092fdb022 100644
--- a/lib/diameter/src/app/diameter.app.src
+++ b/lib/diameter/src/base/diameter.app.src
@@ -20,7 +20,7 @@
 {application, diameter,
  [{description, "Diameter protocol"},
   {vsn, "%VSN%"},
-  {modules, [%APP_MODULES%,%TRANSPORT_MODULES%]},
+  {modules, [%MODULES%]},
   {registered, []},
   {applications, [stdlib, kernel]},
   {env, []},
diff --git a/lib/diameter/src/app/diameter.appup.src b/lib/diameter/src/base/diameter.appup.src
index 6d8ceadb92..6d8ceadb92 100644
--- a/lib/diameter/src/app/diameter.appup.src
+++ b/lib/diameter/src/base/diameter.appup.src
diff --git a/lib/diameter/src/app/diameter.erl b/lib/diameter/src/base/diameter.erl
index 2f721421d8..2f721421d8 100644
--- a/lib/diameter/src/app/diameter.erl
+++ b/lib/diameter/src/base/diameter.erl
diff --git a/lib/diameter/src/app/diameter_app.erl b/lib/diameter/src/base/diameter_app.erl
index 600f7ff04d..600f7ff04d 100644
--- a/lib/diameter/src/app/diameter_app.erl
+++ b/lib/diameter/src/base/diameter_app.erl
diff --git a/lib/diameter/src/app/diameter_callback.erl b/lib/diameter/src/base/diameter_callback.erl
index 6d5c8cdca1..6d5c8cdca1 100644
--- a/lib/diameter/src/app/diameter_callback.erl
+++ b/lib/diameter/src/base/diameter_callback.erl
diff --git a/lib/diameter/src/app/diameter_capx.erl b/lib/diameter/src/base/diameter_capx.erl
index aa5318e79d..138e76411e 100644
--- a/lib/diameter/src/app/diameter_capx.erl
+++ b/lib/diameter/src/base/diameter_capx.erl
@@ -62,6 +62,7 @@
 -define(NOSECURITY, ?'DIAMETER_BASE_RESULT-CODE_DIAMETER_NO_COMMON_SECURITY').
 
 -define(NO_INBAND_SECURITY, 0).
+-define(TLS, 1).
 
 %% ===========================================================================
 
@@ -80,7 +81,7 @@ recv_CER(CER, Svc) ->
     try_it([fun rCER/2, CER, Svc]).
 
 -spec recv_CEA(#diameter_base_CEA{}, #diameter_service{})
-   -> tried({['Unsigned32'()], #diameter_caps{}}).
+   -> tried({['Unsigned32'()], ['Unsigned32'()], #diameter_caps{}}).
 
 recv_CEA(CEA, Svc) ->
     try_it([fun rCEA/2, CEA, Svc]).
@@ -126,10 +127,11 @@ mk_caps(Caps0, Opts) ->
 set_cap({Key, _}, _) ->
     ?THROW({duplicate, Key}).
 
-cap(K, V) when K == 'Origin-Host';
-               K == 'Origin-Realm';
-               K == 'Vendor-Id';
-               K == 'Product-Name' ->
+cap(K, V)
+  when K == 'Origin-Host';
+       K == 'Origin-Realm';
+       K == 'Vendor-Id';
+       K == 'Product-Name' ->
     V;
 
 cap('Host-IP-Address', Vs)
@@ -139,11 +141,8 @@ cap('Host-IP-Address', Vs)
 cap('Firmware-Revision', V) ->
     [V];
 
-%% Not documented but accept it as long as it's what we support.
-cap('Inband-Security-Id', [0] = Vs) ->  %% NO_INBAND_SECURITY
-    Vs;
-
-cap(K, Vs) when K /= 'Inband-Security-Id', is_list(Vs) ->
+cap(_, Vs)
+  when is_list(Vs) ->
     Vs;
 
 cap(K, V) ->
@@ -161,28 +160,10 @@ ipaddr(A) ->
 %%
 %% Build a CER record to send to a remote peer.
 
-bCER(#diameter_caps{origin_host = Host,
-                    origin_realm = Realm,
-                    host_ip_address = Addrs,
-                    vendor_id = Vid,
-                    product_name = Name,
-                    origin_state_id = OSI,
-                    supported_vendor_id = SVid,
-                    auth_application_id = AuId,
-                    acct_application_id = AcId,
-                    vendor_specific_application_id = VSA,
-                    firmware_revision = Rev}) ->
-    #diameter_base_CER{'Origin-Host' = Host,
-                       'Origin-Realm' = Realm,
-                       'Host-IP-Address' = Addrs,
-                       'Vendor-Id' = Vid,
-                       'Product-Name' = Name,
-                       'Origin-State-Id' = OSI,
-                       'Supported-Vendor-Id' = SVid,
-                       'Auth-Application-Id' = AuId,
-                       'Acct-Application-Id' = AcId,
-                       'Vendor-Specific-Application-Id' = VSA,
-                       'Firmware-Revision' = Rev}.
+%% Use the fact that diameter_caps has the same field names as CER.
+bCER(#diameter_caps{} = Rec) ->
+    #diameter_base_CER{}
+        = list_to_tuple([diameter_base_CER | tl(tuple_to_list(Rec))]).
 
 %% rCER/2
 %%
@@ -219,19 +200,16 @@ bCER(#diameter_caps{origin_host = Host,
 %% That is, each side sends all of its capabilities and is responsible for
 %% not sending commands that the peer doesn't support.
 
-%% TODO: Make it an option to send only common applications in CEA to
-%%       allow backwards compatibility, and also because there are likely
-%%       servers that expect this. Or maybe a callback.
-
 %% 6.10.  Inband-Security-Id AVP
 %%
 %%   NO_INBAND_SECURITY                0
 %%      This peer does not support TLS.  This is the default value, if the
 %%      AVP is omitted.
+%%
+%%   TLS                               1
+%%      This node supports TLS security, as defined by [TLS].
 
 rCER(CER, #diameter_service{capabilities = LCaps} = Svc) ->
-    #diameter_base_CER{'Inband-Security-Id' = RIS}
-        = CER,
     #diameter_base_CEA{}
         = CEA
         = cea_from_cer(bCER(LCaps)),
@@ -241,56 +219,95 @@ rCER(CER, #diameter_service{capabilities = LCaps} = Svc) ->
 
     {SApps,
      RCaps,
-     build_CEA([] == SApps,
-               RIS,
-               lists:member(?NO_INBAND_SECURITY, RIS),
-               CEA#diameter_base_CEA{'Result-Code' = ?SUCCESS,
-                                     'Inband-Security-Id' = []})}.
+     build_CEA(SApps,
+               LCaps,
+               RCaps,
+               CEA#diameter_base_CEA{'Result-Code' = ?SUCCESS})}.
 
-%% TODO: 5.3 of RFC3588 says we MUST return DIAMETER_NO_COMMON_APPLICATION
+%% TODO: 5.3 of RFC 3588 says we MUST return DIAMETER_NO_COMMON_APPLICATION
 %%       in the CEA and SHOULD disconnect the transport. However, we have
 %%       no way to guarantee the send before disconnecting.
 
-build_CEA(true, _, _, CEA) ->
+build_CEA([], _, _, CEA) ->
     CEA#diameter_base_CEA{'Result-Code' = ?NOAPP};
-build_CEA(false, [_|_], false, CEA) ->
-    CEA#diameter_base_CEA{'Result-Code' = ?NOSECURITY};
-build_CEA(false, [_|_], true, CEA) ->
-    CEA#diameter_base_CEA{'Inband-Security-Id' = [?NO_INBAND_SECURITY]};
-build_CEA(false, [], false, CEA) ->
-    CEA.
+
+build_CEA(_, LCaps, RCaps, CEA) ->
+    case common_security(LCaps, RCaps) of
+        [] ->
+            CEA#diameter_base_CEA{'Result-Code' = ?NOSECURITY};
+        [_] = IS ->
+            CEA#diameter_base_CEA{'Inband-Security-Id' = IS}
+    end.
+
+%% common_security/2
+
+common_security(#diameter_caps{inband_security_id = LS},
+                #diameter_caps{inband_security_id = RS}) ->
+    cs(LS, RS).
+
+%% Unspecified is equivalent to NO_INBAND_SECURITY.
+cs([], RS) ->
+    cs([?NO_INBAND_SECURITY], RS);
+cs(LS, []) ->
+    cs(LS, [?NO_INBAND_SECURITY]);
+
+%% Agree on TLS if both parties support it. When sending CEA, this is
+%% to ensure the peer is clear that we will be expecting a TLS
+%% handshake since there is no ssl:maybe_accept that would allow the
+%% peer to choose between TLS or not upon reception of our CEA. When
+%% receiving CEA it deals with a server that isn't explicit about its choice.
+%% TODO: Make the choice configurable.
+cs(LS, RS) ->
+    Is = ordsets:to_list(ordsets:intersection(ordsets:from_list(LS),
+                                              ordsets:from_list(RS))),
+    case lists:member(?TLS, Is) of
+        true ->
+            [?TLS];
+        false when [] == Is ->
+            Is;
+        false ->
+            [hd(Is)]  %% probably NO_INBAND_SECURITY
+    end.
+%% The only two values defined by RFC 3588 are NO_INBAND_SECURITY and
+%% TLS but don't enforce this. In theory this allows some other
+%% security mechanism we don't have to know about, although in
+%% practice something there may be a need for more synchronization
+%% than notification by way of an event subscription offers.
 
 %% cea_from_cer/1
 
+%% CER is a subset of CEA, the latter adding Result-Code and a few
+%% more AVP's.
 cea_from_cer(#diameter_base_CER{} = CER) ->
     lists:foldl(fun(F,A) -> to_cea(CER, F, A) end,
                 #diameter_base_CEA{},
                 record_info(fields, diameter_base_CER)).
 
 to_cea(CER, Field, CEA) ->
-    try ?BASE:'#info-'(diameter_base_CEA, {index, Field}) of
-        N ->
-            setelement(N, CEA, ?BASE:'#get-'(Field, CER))
+    try ?BASE:'#get-'(Field, CER) of
+        V -> ?BASE:'#set-'({Field, V}, CEA)
     catch
-        error: _ ->
-            CEA
+        error: _ -> CEA
     end.
-
+        
 %% rCEA/2
 
-rCEA(CEA, #diameter_service{capabilities = LCaps} = Svc)
-  when is_record(CEA, diameter_base_CEA) ->
-    #diameter_base_CEA{'Result-Code' = RC}
-        = CEA,
-
+rCEA(#diameter_base_CEA{'Result-Code' = RC}
+     = CEA,
+     #diameter_service{capabilities = LCaps}
+     = Svc) ->
     RC == ?SUCCESS orelse ?THROW({'Result-Code', RC}),
 
     RCaps = capx_to_caps(CEA),
     SApps = common_applications(LCaps, RCaps, Svc),
 
-    [] == SApps andalso ?THROW({no_common_apps, LCaps, RCaps}),
+    [] == SApps andalso ?THROW(no_common_applications),
+
+    IS = common_security(LCaps, RCaps),
+
+    [] == IS andalso ?THROW(no_common_security),
 
-    {SApps, RCaps};
+    {SApps, IS, RCaps};
 
 rCEA(CEA, _Svc) ->
     ?THROW({invalid, CEA}).
diff --git a/lib/diameter/src/app/diameter_codec.erl b/lib/diameter/src/base/diameter_codec.erl
index d88f42fb7c..d88f42fb7c 100644
--- a/lib/diameter/src/app/diameter_codec.erl
+++ b/lib/diameter/src/base/diameter_codec.erl
diff --git a/lib/diameter/src/app/diameter_config.erl b/lib/diameter/src/base/diameter_config.erl
index a6b48fe65b..a6b48fe65b 100644
--- a/lib/diameter/src/app/diameter_config.erl
+++ b/lib/diameter/src/base/diameter_config.erl
diff --git a/lib/diameter/src/app/diameter_dbg.erl b/lib/diameter/src/base/diameter_dbg.erl
index 5b0ac3a3b6..5b0ac3a3b6 100644
--- a/lib/diameter/src/app/diameter_dbg.erl
+++ b/lib/diameter/src/base/diameter_dbg.erl
diff --git a/lib/diameter/src/app/diameter_dict.erl b/lib/diameter/src/base/diameter_dict.erl
index 3b9ba00a3f..3b9ba00a3f 100644
--- a/lib/diameter/src/app/diameter_dict.erl
+++ b/lib/diameter/src/base/diameter_dict.erl
diff --git a/lib/diameter/src/app/diameter_info.erl b/lib/diameter/src/base/diameter_info.erl
index 39d32d07cd..39d32d07cd 100644
--- a/lib/diameter/src/app/diameter_info.erl
+++ b/lib/diameter/src/base/diameter_info.erl
diff --git a/lib/diameter/src/app/diameter_internal.hrl b/lib/diameter/src/base/diameter_internal.hrl
index 63b35550a8..63b35550a8 100644
--- a/lib/diameter/src/app/diameter_internal.hrl
+++ b/lib/diameter/src/base/diameter_internal.hrl
diff --git a/lib/diameter/src/app/diameter_lib.erl b/lib/diameter/src/base/diameter_lib.erl
index 362d593b24..362d593b24 100644
--- a/lib/diameter/src/app/diameter_lib.erl
+++ b/lib/diameter/src/base/diameter_lib.erl
diff --git a/lib/diameter/src/app/diameter_misc_sup.erl b/lib/diameter/src/base/diameter_misc_sup.erl
index 4e40476f14..4e40476f14 100644
--- a/lib/diameter/src/app/diameter_misc_sup.erl
+++ b/lib/diameter/src/base/diameter_misc_sup.erl
diff --git a/lib/diameter/src/app/diameter_peer.erl b/lib/diameter/src/base/diameter_peer.erl
index 3e78c4caef..3e78c4caef 100644
--- a/lib/diameter/src/app/diameter_peer.erl
+++ b/lib/diameter/src/base/diameter_peer.erl
diff --git a/lib/diameter/src/app/diameter_peer_fsm.erl b/lib/diameter/src/base/diameter_peer_fsm.erl
index 0252fb3809..282fa2742f 100644
--- a/lib/diameter/src/app/diameter_peer_fsm.erl
+++ b/lib/diameter/src/base/diameter_peer_fsm.erl
@@ -52,6 +52,9 @@
 -define(GOAWAY, ?'DIAMETER_BASE_DISCONNECT-CAUSE_DO_NOT_WANT_TO_TALK_TO_YOU').
 -define(REBOOT, ?'DIAMETER_BASE_DISCONNECT-CAUSE_REBOOTING').
 
+-define(NO_INBAND_SECURITY, 0).
+-define(TLS, 1).
+
 -define(LOOP_TIMEOUT, 2000).
 
 %% RFC 3588:
@@ -195,10 +198,8 @@ handle_info(T, #state{} = State) ->
             ?LOG(stop, T),
             x(T, State)
     catch
-        throw: {?MODULE, close = C, Reason} ->
-            ?LOG(C, {Reason, T}),
-            x(Reason, State);
-        throw: {?MODULE, abort, Reason}  ->
+        throw: {?MODULE, Tag, Reason}  ->
+            ?LOG(Tag, {Reason, T}),
             {stop, {shutdown, Reason}, State}
     end.
 
@@ -281,10 +282,9 @@ transition(shutdown, _) ->  %% DPR already send: ensure expected timeout
 
 %% Request to close the transport connection.
 transition({close = T, Pid}, #state{parent = Pid,
-                                    transport = TPid}
-                             = S) ->
+                                    transport = TPid}) ->
     diameter_peer:close(TPid),
-    close(T,S);
+    {stop, T};
 
 %% DPA reception has timed out.
 transition(dpa_timeout, _) ->
@@ -418,11 +418,11 @@ rcv('CER' = N, Pkt, #state{state = recv_CER} = S) ->
 
 %% Anything but CER/CEA in a non-Open state is an error, as is
 %% CER/CEA in anything but recv_CER/Wait-CEA.
-rcv(Name, _, #state{state = PS} = S)
+rcv(Name, _, #state{state = PS})
   when PS /= 'Open';
        Name == 'CER';
        Name == 'CEA' ->
-    close({Name, PS}, S);
+    {stop, {Name, PS}};
 
 rcv(N, Pkt, S)
   when N == 'DWR';
@@ -497,15 +497,20 @@ build_answer('CER',
     #diameter_service{capabilities = #diameter_caps{origin_host = OH}}
         = Svc,
 
-    {SupportedApps, #diameter_caps{origin_host = DH} = RCaps, CEA}
+    {SupportedApps,
+     #diameter_caps{origin_host = DH} = RCaps,
+     #diameter_base_CEA{'Result-Code' = RC}
+     = CEA}
         = recv_CER(CER, S),
 
     try
-        [] == SupportedApps
-            andalso ?THROW({no_common_application, 5010}),
+        2001 == RC  %% DIAMETER_SUCCESS
+            orelse ?THROW({sent_CEA, RC}),
         register_everywhere({?MODULE, connection, OH, DH})
             orelse ?THROW({election_lost, 4003}),
-        {CEA, [fun open/4, Pkt, SupportedApps, RCaps]}
+        #diameter_base_CEA{'Inband-Security-Id' = [IS]}
+            = CEA,
+        {CEA, [fun open/5, Pkt, SupportedApps, RCaps, {accept, IS}]}
     catch
         ?FAILURE({Reason, RC}) ->
             {answer('CER', S) ++ [{'Result-Code', RC}],
@@ -613,7 +618,7 @@ recv_CER(CER, #state{service = Svc}) ->
 handle_CEA(#diameter_packet{header = #diameter_header{version = V},
                             bin = Bin}
            = Pkt,
-           #state{service = Svc}
+           #state{service = #diameter_service{capabilities = LCaps}}
            = S)
   when is_binary(Bin) ->
     ?LOG(recv, 'CEA'),
@@ -626,7 +631,11 @@ handle_CEA(#diameter_packet{header = #diameter_header{version = V},
 
     [] == Errors orelse close({errors, Errors}, S),
 
-    {SApps, #diameter_caps{origin_host = DH} = RCaps} = recv_CEA(CEA, S),
+    {SApps, [IS], #diameter_caps{origin_host = DH} = RCaps}
+        = recv_CEA(CEA, S),
+
+    #diameter_caps{origin_host = OH}
+        = LCaps,
 
     %% Ensure that we don't already have a connection to the peer in
     %% question. This isn't the peer election of 3588 except in the
@@ -634,40 +643,62 @@ handle_CEA(#diameter_packet{header = #diameter_header{version = V},
     %% receive a CER/CEA, the first that arrives wins the right to a
     %% connection with the peer.
 
-    #diameter_service{capabilities = #diameter_caps{origin_host = OH}}
-        = Svc,
-
     register_everywhere({?MODULE, connection, OH, DH})
-        orelse
-        close({'CEA', DH}, S),
+        orelse close({'CEA', DH}, S),
 
-    open(DPkt, SApps, RCaps, S).
+    open(DPkt, SApps, RCaps, {connect, IS}, S).
 
 %% recv_CEA/2
 
 recv_CEA(CEA, #state{service = Svc} = S) ->
     case diameter_capx:recv_CEA(CEA, Svc) of
-        {ok, {[], _}} ->
+        {ok, {_,_}} -> %% return from old code
+            close({'CEA', update}, S);
+        {ok, {[], _, _}} ->
             close({'CEA', no_common_application}, S);
-        {ok, T} ->
+        {ok, {_, [], _}} ->
+            close({'CEA', no_common_security}, S);
+        {ok, {_,_,_} = T} ->
             T;
         {error, Reason} ->
             close({'CEA', Reason}, S)
     end.
 
-%% open/4
+%% open/5
 
-open(Pkt, SupportedApps, RCaps, #state{parent = Pid,
-                                       service = Svc}
-                                = S) ->
-    #diameter_service{capabilities = #diameter_caps{origin_host = OH}
+open(Pkt, SupportedApps, RCaps, {Type, IS}, #state{parent = Pid,
+                                                   service = Svc}
+                                            = S) ->
+    #diameter_service{capabilities = #diameter_caps{origin_host = OH,
+                                                    inband_security_id = LS}
                                    = LCaps}
         = Svc,
     #diameter_caps{origin_host = DH}
         = RCaps,
+
+    tls_ack(lists:member(?TLS, LS), Type, IS, S),
     Pid ! {open, self(), {OH,DH}, {capz(LCaps, RCaps), SupportedApps, Pkt}},
+
     S#state{state = 'Open'}.
 
+%% We've advertised TLS support: tell the transport the result
+%% and expect a reply when the handshake is complete.
+tls_ack(true, Type, IS, #state{transport = TPid} = S) ->
+    Ref = make_ref(),
+    MRef = erlang:monitor(process, TPid),
+    TPid ! {diameter, {tls, Ref, Type, IS == ?TLS}},
+    receive
+        {diameter, {tls, Ref}} ->
+            erlang:demonitor(MRef, [flush]);
+        {'DOWN', MRef, process, _, _} = T ->
+            close({tls_ack, T}, S)
+    end;
+
+%% Or not. Don't send anything to the transport so that transports
+%% not supporting TLS work as before without modification.
+tls_ack(false, _, _, _) ->
+    ok.
+
 capz(#diameter_caps{} = L, #diameter_caps{} = R) ->
     #diameter_caps{}
         = list_to_tuple([diameter_caps | lists:zip(tl(tuple_to_list(L)),
diff --git a/lib/diameter/src/app/diameter_peer_fsm_sup.erl b/lib/diameter/src/base/diameter_peer_fsm_sup.erl
index 995eaf74d0..995eaf74d0 100644
--- a/lib/diameter/src/app/diameter_peer_fsm_sup.erl
+++ b/lib/diameter/src/base/diameter_peer_fsm_sup.erl
diff --git a/lib/diameter/src/app/diameter_reg.erl b/lib/diameter/src/base/diameter_reg.erl
index 882b9da238..882b9da238 100644
--- a/lib/diameter/src/app/diameter_reg.erl
+++ b/lib/diameter/src/base/diameter_reg.erl
diff --git a/lib/diameter/src/app/diameter_service.erl b/lib/diameter/src/base/diameter_service.erl
index 421e36ccf5..421e36ccf5 100644
--- a/lib/diameter/src/app/diameter_service.erl
+++ b/lib/diameter/src/base/diameter_service.erl
diff --git a/lib/diameter/src/app/diameter_service_sup.erl b/lib/diameter/src/base/diameter_service_sup.erl
index 153fff902f..153fff902f 100644
--- a/lib/diameter/src/app/diameter_service_sup.erl
+++ b/lib/diameter/src/base/diameter_service_sup.erl
diff --git a/lib/diameter/src/app/diameter_session.erl b/lib/diameter/src/base/diameter_session.erl
index bb91e97f39..bb91e97f39 100644
--- a/lib/diameter/src/app/diameter_session.erl
+++ b/lib/diameter/src/base/diameter_session.erl
diff --git a/lib/diameter/src/app/diameter_stats.erl b/lib/diameter/src/base/diameter_stats.erl
index 71479afa95..71479afa95 100644
--- a/lib/diameter/src/app/diameter_stats.erl
+++ b/lib/diameter/src/base/diameter_stats.erl
diff --git a/lib/diameter/src/app/diameter_sup.erl b/lib/diameter/src/base/diameter_sup.erl
index e5afd23dcd..e5afd23dcd 100644
--- a/lib/diameter/src/app/diameter_sup.erl
+++ b/lib/diameter/src/base/diameter_sup.erl
diff --git a/lib/diameter/src/app/diameter_sync.erl b/lib/diameter/src/base/diameter_sync.erl
index ce2db4b3a2..ce2db4b3a2 100644
--- a/lib/diameter/src/app/diameter_sync.erl
+++ b/lib/diameter/src/base/diameter_sync.erl
diff --git a/lib/diameter/src/app/diameter_types.erl b/lib/diameter/src/base/diameter_types.erl
index 6b1b1b8d39..6b1b1b8d39 100644
--- a/lib/diameter/src/app/diameter_types.erl
+++ b/lib/diameter/src/base/diameter_types.erl
diff --git a/lib/diameter/src/app/diameter_types.hrl b/lib/diameter/src/base/diameter_types.hrl
index 02bf8a74dd..02bf8a74dd 100644
--- a/lib/diameter/src/app/diameter_types.hrl
+++ b/lib/diameter/src/base/diameter_types.hrl
diff --git a/lib/diameter/src/app/diameter_watchdog.erl b/lib/diameter/src/base/diameter_watchdog.erl
index b7c1491f4b..b7c1491f4b 100644
--- a/lib/diameter/src/app/diameter_watchdog.erl
+++ b/lib/diameter/src/base/diameter_watchdog.erl
diff --git a/lib/diameter/src/app/diameter_watchdog_sup.erl b/lib/diameter/src/base/diameter_watchdog_sup.erl
index fc837fe4ef..fc837fe4ef 100644
--- a/lib/diameter/src/app/diameter_watchdog_sup.erl
+++ b/lib/diameter/src/base/diameter_watchdog_sup.erl
diff --git a/lib/diameter/src/compiler/Makefile b/lib/diameter/src/compiler/Makefile
deleted file mode 100644
index 779013bfbc..0000000000
--- a/lib/diameter/src/compiler/Makefile
+++ /dev/null
@@ -1,131 +0,0 @@
-#
-# %CopyrightBegin%
-#
-# Copyright Ericsson AB 2010-2011. All Rights Reserved.
-#
-# The contents of this file are subject to the Erlang Public License,
-# Version 1.1, (the "License"); you may not use this file except in
-# compliance with the License. You should have received a copy of the
-# Erlang Public License along with this software. If not, it can be
-# retrieved online at http://www.erlang.org/.
-#
-# Software distributed under the License is distributed on an "AS IS"
-# basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-# the License for the specific language governing rights and limitations
-# under the License.
-#
-# %CopyrightEnd%
-#
-#
-
-ifneq ($(ERL_TOP),)
-include $(ERL_TOP)/make/target.mk
-EBIN = ../../ebin
-include $(ERL_TOP)/make/$(TARGET)/otp.mk
-else
-include $(DIAMETER_TOP)/make/target.mk
-EBIN = ../../ebin
-include $(DIAMETER_TOP)/make/$(TARGET)/rules.mk
-endif
-
-
-# ----------------------------------------------------
-# Application version
-# ----------------------------------------------------
-include ../../vsn.mk
-VSN=$(DIAMETER_VSN)
-
-# ----------------------------------------------------
-# Release directory specification
-# ----------------------------------------------------
-
-RELSYSDIR = $(RELEASE_PATH)/lib/diameter-$(VSN)
-
-INCDIR = ../../include
-
-# ----------------------------------------------------
-# Target Specs
-# ----------------------------------------------------
-
-include modules.mk
-
-ERL_FILES = \
-	$(MODULES:%=%.erl)
-
-TARGET_FILES = \
-	$(MODULES:%=$(EBIN)/%.$(EMULATOR))
-
-# ----------------------------------------------------
-# FLAGS
-# ----------------------------------------------------
-
-ifeq ($(TYPE),debug)
-ERL_COMPILE_FLAGS += -Ddebug
-endif
-
-include ../app/diameter.mk
-
-ERL_COMPILE_FLAGS += \
-	$(DIAMETER_ERL_COMPILE_FLAGS) \
-	-I$(INCDIR)
-
-# ----------------------------------------------------
-# Targets
-# ----------------------------------------------------
-
-debug:
-	@${MAKE} TYPE=debug opt
-
-opt: $(TARGET_FILES)
-
-clean:
-	rm -f $(TARGET_FILES) 
-	rm -f errs core *~
-	rm -f depend.mk
-
-docs:
-
-info:
-	@echo ""
-	@echo "ERL_FILES = $(ERL_FILES)"
-	@echo "HRL_FILES = $(HRL_FILES)"
-	@echo ""
-	@echo "TARGET_FILES = $(TARGET_FILES)"
-	@echo ""
-
-# ----------------------------------------------------
-# Release Target
-# ----------------------------------------------------
-ifneq ($(ERL_TOP),)
-include $(ERL_TOP)/make/otp_release_targets.mk
-else
-include $(DIAMETER_TOP)/make/release_targets.mk
-endif
-
-release_spec: opt
-	$(INSTALL_DIR)  $(RELSYSDIR)/ebin
-	$(INSTALL_DATA) $(TARGET_FILES) $(RELSYSDIR)/ebin
-	$(INSTALL_DIR)  $(RELSYSDIR)/src
-	$(INSTALL_DIR)  $(RELSYSDIR)/src/compiler
-	$(INSTALL_DATA) $(ERL_FILES) $(HRL_FILES) $(RELSYSDIR)/src/compiler
-
-release_docs_spec:
-
-force:
-
-# ----------------------------------------------------
-# Dependencies
-# ----------------------------------------------------
-
-depend: depend.mk
-
-# Generate dependencies makefile.
-depend.mk: ../app/depend.sed $(ERL_FILES) Makefile
-	for f in $(MODULES); do \
-	    sed -f $< $$f.erl | sed "s@/@/$$f@"; \
-	done \
-	> $@
-
--include depend.mk
-
-.PHONY: clean debug depend docs force info opt release_docs_spec release_spec
diff --git a/lib/diameter/src/compiler/diameter_codegen.erl b/lib/diameter/src/compiler/diameter_codegen.erl
index a33b07a3d3..0fd4a0b301 100644
--- a/lib/diameter/src/compiler/diameter_codegen.erl
+++ b/lib/diameter/src/compiler/diameter_codegen.erl
@@ -707,9 +707,9 @@ gen_hrl(Path, Mod, Spec) ->
     write("ENUM Macros",
           Fd,
           m_enums(PREFIX, false, get_value(enums, Spec))),
-    write("RESULT CODE Macros",
+    write("DEFINE Macros",
           Fd,
-          m_enums(PREFIX, false, get_value(result_codes, Spec))),
+          m_enums(PREFIX, false, get_value(defines, Spec))),
 
     lists:foreach(fun({M,Es}) ->
                           write("ENUM Macros from " ++ atom_to_list(M),
diff --git a/lib/diameter/src/app/diameter_exprecs.erl b/lib/diameter/src/compiler/diameter_exprecs.erl
index 5e120d6f44..5e120d6f44 100644
--- a/lib/diameter/src/app/diameter_exprecs.erl
+++ b/lib/diameter/src/compiler/diameter_exprecs.erl
diff --git a/lib/diameter/src/compiler/diameter_make.erl b/lib/diameter/src/compiler/diameter_make.erl
index 4431b88c4d..5380ee56ca 100644
--- a/lib/diameter/src/compiler/diameter_make.erl
+++ b/lib/diameter/src/compiler/diameter_make.erl
@@ -18,103 +18,61 @@
 %%
 
 %%
-%% Driver for the encoder generator utility.
+%% Module alternative to diameterc for dictionary compilation.
+%%
+%% Eg. 1> diameter_make:dict("mydict.dia").
+%%
+%%     $ erl -noshell \
+%%           -boot start_clean \
+%%           -s diameter_make dict mydict.dia \
+%%           -s init stop
 %%
 
 -module(diameter_make).
 
--export([spec/0,
-         hrl/0,
-         erl/0]).
+-export([dict/1,
+         dict/2,
+         spec/1,
+         spec/2]).
 
--spec spec() -> no_return().
--spec hrl()  -> no_return().
--spec erl()  -> no_return().
+-type opt() :: {outdir|include|name|prefix|inherits, string()}
+             | verbose
+             | debug.
 
-spec() ->
-    make(spec).
+%% dict/1-2
 
-hrl() ->
-    make(hrl).
+-spec dict(string(), [opt()])
+   -> ok.
 
-erl() ->
-    make(erl).
+dict(File, Opts) ->
+    make(File,
+         Opts,
+         spec(File, Opts),
+         [spec || _ <- [1], lists:member(debug, Opts)] ++ [erl, hrl]).
 
-%% make/1
+dict(File) ->
+    dict(File, []).
 
-make(Mode) ->
-    Args = init:get_plain_arguments(),
-    Opts = try options(Args) catch throw: help -> help(Mode) end,
-    Files = proplists:get_value(files, Opts, []),
-    lists:foreach(fun(F) -> from_file(F, Mode, Opts) end, Files),
-    halt(0).
+%% spec/2
 
-%% from_file/3
-
-from_file(F, Mode, Opts) ->
-    try to_spec(F, Mode, Opts) of
-        Spec ->
-            from_spec(F, Spec, Mode, Opts)
-    catch
-        error: Reason ->
-            io:format("==> ~p parse failure:~n~p~n",
-                      [F, {Reason, erlang:get_stacktrace()}]),
-            halt(1)
-    end.
+-spec spec(string(), [opt()])
+   -> orddict:orddict().
 
-%% to_spec/2
+spec(File, Opts) ->
+    diameter_spec_util:parse(File, Opts).
 
-%% Try to read the input as an already parsed file or else parse it.
-to_spec(F, spec, Opts) ->
-    diameter_spec_util:parse(F, Opts);
-to_spec(F, _, _) ->
-    {ok, [Spec]} = file:consult(F),
-    Spec.
+spec(File) ->
+    spec(File, []).
 
-%% from_spec/4
+%% ===========================================================================
 
-from_spec(File, Spec, Mode, Opts) ->
-    try
-        diameter_codegen:from_spec(File, Spec, Opts, Mode)
+make(_, _, _, []) ->
+    ok;
+make(File, Opts, Spec, [Mode | Rest]) ->
+    try diameter_codegen:from_spec(File, Spec, Opts, Mode) of
+        ok ->
+            make(File, Opts, Spec, Rest)
     catch
         error: Reason ->
-            io:format("==> ~p codegen failure:~n~p~n~p~n",
-                      [Mode, File, {Reason, erlang:get_stacktrace()}]),
-            halt(1)
+            {error, {Reason, Mode, erlang:get_stacktrace()}}
     end.
-
-%% options/1
-
-options(["-v" | Rest]) ->
-    [verbose | options(Rest)];
-
-options(["-o", Outdir | Rest]) ->
-    [{outdir, Outdir} | options(Rest)];
-
-options(["-i", Incdir | Rest]) ->
-    [{include, Incdir} | options(Rest)];
-
-options(["-h" | _]) ->
-    throw(help);
-
-options(["--" | Fs]) ->
-    [{files, Fs}];
-
-options(["-" ++ _ = Opt | _]) ->
-    io:fwrite("==> unknown option: ~s~n", [Opt]),
-    throw(help);
-
-options(Fs) ->  %% trailing arguments
-    options(["--" | Fs]).
-
-%% help/1
-
-help(M) ->
-    io:fwrite("Usage: ~p ~p [Options] [--] File ...~n"
-              "Options:~n"
-              " -v              verbose output~n"
-              " -h              shows this help message~n"
-              " -o OutDir       where to put the output files~n"
-              " -i IncludeDir   where to search for beams to import~n",
-              [?MODULE, M]),
-    halt(1).
diff --git a/lib/diameter/src/compiler/diameter_spec_util.erl b/lib/diameter/src/compiler/diameter_spec_util.erl
index b60886b678..62536bf06d 100644
--- a/lib/diameter/src/compiler/diameter_spec_util.erl
+++ b/lib/diameter/src/compiler/diameter_spec_util.erl
@@ -34,19 +34,38 @@
 %%
 %% Output: orddict()
 
-parse(Path, Options) ->
-    put({?MODULE, verbose}, lists:member(verbose, Options)),
+parse(Path, Opts) ->
+    put({?MODULE, verbose}, lists:member(verbose, Opts)),
     {ok, B} = file:read_file(Path),
     Chunks = chunk(B),
-    Spec = make_spec(Chunks),
+    Spec = reset(make_spec(Chunks), Opts, [name, prefix, inherits]),
     true = groups_defined(Spec),  %% sanity checks
     true = customs_defined(Spec), %%
-    Full = import_enums(import_groups(import_avps(insert_codes(Spec),
-                                                  Options))),
+    Full = import_enums(import_groups(import_avps(insert_codes(Spec), Opts))),
     true = enums_defined(Full),   %% sanity checks
     true = v_flags_set(Spec),
     Full.
 
+reset(Spec, Opts, Keys) ->
+    lists:foldl(fun(K,S) ->
+                        reset([{A,?ATOM(V)} || {A,V} <- Opts, A == K], S)
+                end,
+                Spec,
+                Keys).
+
+reset(L, Spec)
+  when is_list(L) ->
+    lists:foldl(fun reset/2, Spec, L);
+
+reset({inherits = Key, '-'}, Spec) ->
+    orddict:erase(Key, Spec);
+reset({inherits = Key, Dict}, Spec) ->
+    orddict:append(Key, Dict, Spec);
+reset({Key, Atom}, Spec) ->
+    orddict:store(Key, Atom, Spec);
+reset(_, Spec) ->
+    Spec.
+    
 %% Optional reports when running verbosely.
 report(What, Data) ->
     report(get({?MODULE, verbose}), What, Data).
@@ -204,9 +223,11 @@ chunk({avp_vendor_id = T, [{number, I}], Body}, Dict) ->
 chunk({enum, [N], Str}, Dict) ->
     append(enums, {atomize(N), parse_enums(Str)}, Dict);
 
-%% result_codes -> [{ResultName, [{Value, Name}, ...]}, ...]
-chunk({result_code, [N], Str}, Dict) ->
-    append(result_codes, {atomize(N), parse_enums(Str)}, Dict);
+%% defines -> [{DefineName, [{Value, Name}, ...]}, ...]
+chunk({define, [N], Str}, Dict) ->
+    append(defines, {atomize(N), parse_enums(Str)}, Dict);
+chunk({result_code, [_] = N, Str}, Dict) ->  %% backwards compatibility
+    chunk({define, N, Str}, Dict);
 
 %% commands -> [{Name, Abbrev}, ...]
 chunk({commands = T, [], Body}, Dict) ->
diff --git a/lib/diameter/src/compiler/modules.mk b/lib/diameter/src/compiler/modules.mk
deleted file mode 100644
index 17a311dacf..0000000000
--- a/lib/diameter/src/compiler/modules.mk
+++ /dev/null
@@ -1,27 +0,0 @@
-#-*-makefile-*-   ; force emacs to enter makefile-mode
-
-# %CopyrightBegin%
-# 
-# Copyright Ericsson AB 2010-2011. All Rights Reserved.
-# 
-# The contents of this file are subject to the Erlang Public License,
-# Version 1.1, (the "License"); you may not use this file except in
-# compliance with the License. You should have received a copy of the
-# Erlang Public License along with this software. If not, it can be
-# retrieved online at http://www.erlang.org/.
-# 
-# Software distributed under the License is distributed on an "AS IS"
-# basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-# the License for the specific language governing rights and limitations
-# under the License.
-# 
-# %CopyrightEnd%
-
-MODULES = \
-	diameter_codegen \
-	diameter_spec_scan \
-	diameter_spec_util
-
-HRL_FILES = \
-	diameter_forms.hrl
-
diff --git a/lib/diameter/src/depend.sed b/lib/diameter/src/depend.sed
new file mode 100644
index 0000000000..8f999f646f
--- /dev/null
+++ b/lib/diameter/src/depend.sed
@@ -0,0 +1,51 @@
+#
+# %CopyrightBegin%
+#
+# Copyright Ericsson AB 2010-2011. All Rights Reserved.
+#
+# The contents of this file are subject to the Erlang Public License,
+# Version 1.1, (the "License"); you may not use this file except in
+# compliance with the License. You should have received a copy of the
+# Erlang Public License along with this software. If not, it can be
+# retrieved online at http://www.erlang.org/.
+#
+# Software distributed under the License is distributed on an "AS IS"
+# basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+# the License for the specific language governing rights and limitations
+# under the License.
+#
+# %CopyrightEnd%
+#
+
+#
+# Extract include dependencies from .erl files. First line of input
+# is the path to the module in question (minus the .erl extension),
+# the rest is the contents of the module.
+#
+
+1{
+  s@^[^/]*/@@
+  h
+  d
+}
+
+# Only interested in includes of diameter hrls.
+/^-include/!d
+/"diameter/!d
+
+# Extract the name of the included files in one of two forms:
+#
+#   $(INCDIR)/diameter.hrl
+#   diameter_internal.hrl
+
+s@^-include_lib(".*/@$(INCDIR)/@
+s@^-include("@@
+s@".*@@
+
+# Retrieve the path to our module from the hold space, morph it
+# into a beam path and turn it into a dependency like this:
+#
+#   $(EBIN)/diameter_service.$(EMULATOR): $(INCDIR)/diameter.hrl
+
+G
+s@^\(.*\)\n\(.*\)@$(EBIN)/\2.$(EMULATOR): \1@
diff --git a/lib/diameter/src/dict/base_accounting.dia b/lib/diameter/src/dict/base_accounting.dia
new file mode 100644
index 0000000000..ced324078c
--- /dev/null
+++ b/lib/diameter/src/dict/base_accounting.dia
@@ -0,0 +1,69 @@
+;;
+;; %CopyrightBegin%
+;;
+;; Copyright Ericsson AB 2010-2011. All Rights Reserved.
+;;
+;; The contents of this file are subject to the Erlang Public License,
+;; Version 1.1, (the "License"); you may not use this file except in
+;; compliance with the License. You should have received a copy of the
+;; Erlang Public License along with this software. If not, it can be
+;; retrieved online at http://www.erlang.org/.
+;;
+;; Software distributed under the License is distributed on an "AS IS"
+;; basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+;; the License for the specific language governing rights and limitations
+;; under the License.
+;;
+;; %CopyrightEnd%
+;;
+
+@id 3
+@name   diameter_gen_base_accounting
+@prefix diameter_base_accounting
+@vendor 0 IETF
+
+@inherits diameter_gen_base_rfc3588
+
+@messages
+
+      ACR ::= < Diameter Header: 271, REQ, PXY >
+              < Session-Id >
+              { Origin-Host }
+              { Origin-Realm }
+              { Destination-Realm }
+              { Accounting-Record-Type }
+              { Accounting-Record-Number }
+              [ Acct-Application-Id ]
+              [ Vendor-Specific-Application-Id ]
+              [ User-Name ]
+              [ Accounting-Sub-Session-Id ]
+              [ Acct-Session-Id ]
+              [ Acct-Multi-Session-Id ]
+              [ Acct-Interim-Interval ]
+              [ Accounting-Realtime-Required ]
+              [ Origin-State-Id ]
+              [ Event-Timestamp ]
+            * [ Proxy-Info ]
+            * [ Route-Record ]
+            * [ AVP ]
+
+      ACA ::= < Diameter Header: 271, PXY >
+              < Session-Id >
+              { Result-Code }
+              { Origin-Host }
+              { Origin-Realm }
+              { Accounting-Record-Type }
+              { Accounting-Record-Number }
+              [ Acct-Application-Id ]
+              [ Vendor-Specific-Application-Id ]
+              [ User-Name ]
+              [ Accounting-Sub-Session-Id ]
+              [ Acct-Session-Id ]
+              [ Acct-Multi-Session-Id ]
+              [ Error-Reporting-Host ]
+              [ Acct-Interim-Interval ]
+              [ Accounting-Realtime-Required ]
+              [ Origin-State-Id ]
+              [ Event-Timestamp ]
+            * [ Proxy-Info ]
+            * [ AVP ]
diff --git a/lib/diameter/src/dict/base_rfc3588.dia b/lib/diameter/src/dict/base_rfc3588.dia
new file mode 100644
index 0000000000..f7a0b717cd
--- /dev/null
+++ b/lib/diameter/src/dict/base_rfc3588.dia
@@ -0,0 +1,414 @@
+;;
+;; %CopyrightBegin%
+;;
+;; Copyright Ericsson AB 2010-2011. All Rights Reserved.
+;;
+;; The contents of this file are subject to the Erlang Public License,
+;; Version 1.1, (the "License"); you may not use this file except in
+;; compliance with the License. You should have received a copy of the
+;; Erlang Public License along with this software. If not, it can be
+;; retrieved online at http://www.erlang.org/.
+;;
+;; Software distributed under the License is distributed on an "AS IS"
+;; basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+;; the License for the specific language governing rights and limitations
+;; under the License.
+;;
+;; %CopyrightEnd%
+;;
+
+@id 0
+@name   diameter_gen_base_rfc3588
+@prefix diameter_base
+@vendor 0 IETF
+
+@avp_types
+
+   Acct-Interim-Interval             85    Unsigned32    M
+   Accounting-Realtime-Required     483    Enumerated    M
+   Acct-Multi-Session-Id             50    UTF8String    M
+   Accounting-Record-Number         485    Unsigned32    M
+   Accounting-Record-Type           480    Enumerated    M
+   Acct-Session-Id                   44   OctetString    M
+   Accounting-Sub-Session-Id        287    Unsigned64    M
+   Acct-Application-Id              259    Unsigned32    M
+   Auth-Application-Id              258    Unsigned32    M
+   Auth-Request-Type                274    Enumerated    M
+   Authorization-Lifetime           291    Unsigned32    M
+   Auth-Grace-Period                276    Unsigned32    M
+   Auth-Session-State               277    Enumerated    M
+   Re-Auth-Request-Type             285    Enumerated    M
+   Class                             25   OctetString    M
+   Destination-Host                 293     DiamIdent    M
+   Destination-Realm                283     DiamIdent    M
+   Disconnect-Cause                 273    Enumerated    M
+   E2E-Sequence                     300       Grouped    M
+   Error-Message                    281    UTF8String    -
+   Error-Reporting-Host             294     DiamIdent    -
+   Event-Timestamp                   55          Time    M
+   Experimental-Result              297       Grouped    M
+   Experimental-Result-Code         298    Unsigned32    M
+   Failed-AVP                       279       Grouped    M
+   Firmware-Revision                267    Unsigned32    -
+   Host-IP-Address                  257       Address    M
+   Inband-Security-Id               299    Unsigned32    M
+   Multi-Round-Time-Out             272    Unsigned32    M
+   Origin-Host                      264     DiamIdent    M
+   Origin-Realm                     296     DiamIdent    M
+   Origin-State-Id                  278    Unsigned32    M
+   Product-Name                     269    UTF8String    -
+   Proxy-Host                       280     DiamIdent    M
+   Proxy-Info                       284       Grouped    M
+   Proxy-State                       33   OctetString    M
+   Redirect-Host                    292       DiamURI    M
+   Redirect-Host-Usage              261    Enumerated    M
+   Redirect-Max-Cache-Time          262    Unsigned32    M
+   Result-Code                      268    Unsigned32    M
+   Route-Record                     282     DiamIdent    M
+   Session-Id                       263    UTF8String    M
+   Session-Timeout                   27    Unsigned32    M
+   Session-Binding                  270    Unsigned32    M
+   Session-Server-Failover          271    Enumerated    M
+   Supported-Vendor-Id              265    Unsigned32    M
+   Termination-Cause                295    Enumerated    M
+   User-Name                          1    UTF8String    M
+   Vendor-Id                        266    Unsigned32    M
+   Vendor-Specific-Application-Id   260       Grouped    M
+
+@messages
+
+      CER ::= < Diameter Header: 257, REQ >
+              { Origin-Host }
+              { Origin-Realm }
+           1* { Host-IP-Address }
+              { Vendor-Id }
+              { Product-Name }
+              [ Origin-State-Id ]
+            * [ Supported-Vendor-Id ]
+            * [ Auth-Application-Id ]
+            * [ Inband-Security-Id ]
+            * [ Acct-Application-Id ]
+            * [ Vendor-Specific-Application-Id ]
+              [ Firmware-Revision ]
+            * [ AVP ]
+
+      CEA ::= < Diameter Header: 257 >
+              { Result-Code }
+              { Origin-Host }
+              { Origin-Realm }
+           1* { Host-IP-Address }
+              { Vendor-Id }
+              { Product-Name }
+              [ Origin-State-Id ]
+              [ Error-Message ]
+            * [ Failed-AVP ]
+            * [ Supported-Vendor-Id ]
+            * [ Auth-Application-Id ]
+            * [ Inband-Security-Id ]
+            * [ Acct-Application-Id ]
+            * [ Vendor-Specific-Application-Id ]
+              [ Firmware-Revision ]
+            * [ AVP ]
+
+      DPR ::= < Diameter Header: 282, REQ >
+              { Origin-Host }
+              { Origin-Realm }
+              { Disconnect-Cause }
+
+      DPA ::= < Diameter Header: 282 >
+              { Result-Code }
+              { Origin-Host }
+              { Origin-Realm }
+              [ Error-Message ]
+            * [ Failed-AVP ]
+
+      DWR ::= < Diameter Header: 280, REQ >
+              { Origin-Host }
+              { Origin-Realm }
+              [ Origin-State-Id ]
+
+      DWA ::= < Diameter Header: 280 >
+              { Result-Code }
+              { Origin-Host }
+              { Origin-Realm }
+              [ Error-Message ]
+            * [ Failed-AVP ]
+              [ Origin-State-Id ]
+
+   answer-message ::= < Diameter Header: code, ERR [PXY] >
+                  0*1 < Session-Id >
+                      { Origin-Host }
+                      { Origin-Realm }
+                      { Result-Code }
+                      [ Origin-State-Id ]
+                      [ Error-Reporting-Host ]
+                      [ Proxy-Info ]
+                    * [ AVP ]
+
+      RAR ::= < Diameter Header: 258, REQ, PXY >
+              < Session-Id >
+              { Origin-Host }
+              { Origin-Realm }
+              { Destination-Realm }
+              { Destination-Host }
+              { Auth-Application-Id }
+              { Re-Auth-Request-Type }
+              [ User-Name ]
+              [ Origin-State-Id ]
+            * [ Proxy-Info ]
+            * [ Route-Record ]
+            * [ AVP ]
+
+      RAA ::= < Diameter Header: 258, PXY >
+              < Session-Id >
+              { Result-Code }
+              { Origin-Host }
+              { Origin-Realm }
+              [ User-Name ]
+              [ Origin-State-Id ]
+              [ Error-Message ]
+              [ Error-Reporting-Host ]
+            * [ Failed-AVP ]
+            * [ Redirect-Host ]
+              [ Redirect-Host-Usage ]
+              [ Redirect-Max-Cache-Time ]
+            * [ Proxy-Info ]
+            * [ AVP ]
+
+      STR ::= < Diameter Header: 275, REQ, PXY >
+              < Session-Id >
+              { Origin-Host }
+              { Origin-Realm }
+              { Destination-Realm }
+              { Auth-Application-Id }
+              { Termination-Cause }
+              [ User-Name ]
+              [ Destination-Host ]
+            * [ Class ]
+              [ Origin-State-Id ]
+            * [ Proxy-Info ]
+            * [ Route-Record ]
+            * [ AVP ]
+
+      STA ::= < Diameter Header: 275, PXY >
+              < Session-Id >
+              { Result-Code }
+              { Origin-Host }
+              { Origin-Realm }
+              [ User-Name ]
+            * [ Class ]
+              [ Error-Message ]
+              [ Error-Reporting-Host ]
+            * [ Failed-AVP ]
+              [ Origin-State-Id ]
+            * [ Redirect-Host ]
+              [ Redirect-Host-Usage ]
+              [ Redirect-Max-Cache-Time ]
+            * [ Proxy-Info ]
+            * [ AVP ]
+
+      ASR ::= < Diameter Header: 274, REQ, PXY >
+              < Session-Id >
+              { Origin-Host }
+              { Origin-Realm }
+              { Destination-Realm }
+              { Destination-Host }
+              { Auth-Application-Id }
+              [ User-Name ]
+              [ Origin-State-Id ]
+            * [ Proxy-Info ]
+            * [ Route-Record ]
+            * [ AVP ]
+
+      ASA ::= < Diameter Header: 274, PXY >
+              < Session-Id >
+              { Result-Code }
+              { Origin-Host }
+              { Origin-Realm }
+              [ User-Name ]
+              [ Origin-State-Id ]
+              [ Error-Message ]
+              [ Error-Reporting-Host ]
+            * [ Failed-AVP ]
+            * [ Redirect-Host ]
+              [ Redirect-Host-Usage ]
+              [ Redirect-Max-Cache-Time ]
+            * [ Proxy-Info ]
+            * [ AVP ]
+
+      ACR ::= < Diameter Header: 271, REQ, PXY >
+              < Session-Id >
+              { Origin-Host }
+              { Origin-Realm }
+              { Destination-Realm }
+              { Accounting-Record-Type }
+              { Accounting-Record-Number }
+              [ Acct-Application-Id ]
+              [ Vendor-Specific-Application-Id ]
+              [ User-Name ]
+              [ Accounting-Sub-Session-Id ]
+              [ Acct-Session-Id ]
+              [ Acct-Multi-Session-Id ]
+              [ Acct-Interim-Interval ]
+              [ Accounting-Realtime-Required ]
+              [ Origin-State-Id ]
+              [ Event-Timestamp ]
+            * [ Proxy-Info ]
+            * [ Route-Record ]
+            * [ AVP ]
+
+      ACA ::= < Diameter Header: 271, PXY >
+              < Session-Id >
+              { Result-Code }
+              { Origin-Host }
+              { Origin-Realm }
+              { Accounting-Record-Type }
+              { Accounting-Record-Number }
+              [ Acct-Application-Id ]
+              [ Vendor-Specific-Application-Id ]
+              [ User-Name ]
+              [ Accounting-Sub-Session-Id ]
+              [ Acct-Session-Id ]
+              [ Acct-Multi-Session-Id ]
+              [ Error-Reporting-Host ]
+              [ Acct-Interim-Interval ]
+              [ Accounting-Realtime-Required ]
+              [ Origin-State-Id ]
+              [ Event-Timestamp ]
+            * [ Proxy-Info ]
+            * [ AVP ]
+
+@enum Disconnect-Cause
+
+   REBOOTING                      0
+   BUSY                           1
+   DO_NOT_WANT_TO_TALK_TO_YOU     2
+
+@enum Redirect-Host-Usage
+
+   DONT_CACHE                     0
+   ALL_SESSION                    1
+   ALL_REALM                      2
+   REALM_AND_APPLICATION          3
+   ALL_APPLICATION                4
+   ALL_HOST                       5
+   ALL_USER                       6
+
+@enum Auth-Request-Type
+
+   AUTHENTICATE_ONLY              1
+   AUTHORIZE_ONLY                 2
+   AUTHORIZE_AUTHENTICATE         3
+
+@enum Auth-Session-State
+
+   STATE_MAINTAINED               0
+   NO_STATE_MAINTAINED            1
+
+@enum Re-Auth-Request-Type
+
+   AUTHORIZE_ONLY                 0
+   AUTHORIZE_AUTHENTICATE         1
+
+@enum Termination-Cause
+
+   DIAMETER_LOGOUT                1
+   DIAMETER_SERVICE_NOT_PROVIDED  2
+   DIAMETER_BAD_ANSWER            3
+   DIAMETER_ADMINISTRATIVE        4
+   DIAMETER_LINK_BROKEN           5
+   DIAMETER_AUTH_EXPIRED          6
+   DIAMETER_USER_MOVED            7
+   DIAMETER_SESSION_TIMEOUT       8
+
+@enum Session-Server-Failover
+
+   REFUSE_SERVICE                 0
+   TRY_AGAIN                      1
+   ALLOW_SERVICE                  2
+   TRY_AGAIN_ALLOW_SERVICE        3
+
+@enum Accounting-Record-Type
+
+   EVENT_RECORD                   1
+   START_RECORD                   2
+   INTERIM_RECORD                 3
+   STOP_RECORD                    4
+
+@enum Accounting-Realtime-Required
+
+   DELIVER_AND_GRANT              1
+   GRANT_AND_STORE                2
+   GRANT_AND_LOSE                 3
+
+@define Result-Code
+
+;; 7.1.1.  Informational
+   DIAMETER_MULTI_ROUND_AUTH          1001
+
+;; 7.1.2.  Success
+   DIAMETER_SUCCESS                   2001
+   DIAMETER_LIMITED_SUCCESS           2002
+
+;; 7.1.3.  Protocol Errors
+   DIAMETER_COMMAND_UNSUPPORTED       3001
+   DIAMETER_UNABLE_TO_DELIVER         3002
+   DIAMETER_REALM_NOT_SERVED          3003
+   DIAMETER_TOO_BUSY                  3004
+   DIAMETER_LOOP_DETECTED             3005
+   DIAMETER_REDIRECT_INDICATION       3006
+   DIAMETER_APPLICATION_UNSUPPORTED   3007
+   DIAMETER_INVALID_HDR_BITS          3008
+   DIAMETER_INVALID_AVP_BITS          3009
+   DIAMETER_UNKNOWN_PEER              3010
+
+;; 7.1.4.  Transient Failures
+   DIAMETER_AUTHENTICATION_REJECTED   4001
+   DIAMETER_OUT_OF_SPACE              4002
+   ELECTION_LOST                      4003
+
+;; 7.1.5.  Permanent Failures
+   DIAMETER_AVP_UNSUPPORTED           5001
+   DIAMETER_UNKNOWN_SESSION_ID        5002
+   DIAMETER_AUTHORIZATION_REJECTED    5003
+   DIAMETER_INVALID_AVP_VALUE         5004
+   DIAMETER_MISSING_AVP               5005
+   DIAMETER_RESOURCES_EXCEEDED        5006
+   DIAMETER_CONTRADICTING_AVPS        5007
+   DIAMETER_AVP_NOT_ALLOWED           5008
+   DIAMETER_AVP_OCCURS_TOO_MANY_TIMES 5009
+   DIAMETER_NO_COMMON_APPLICATION     5010
+   DIAMETER_UNSUPPORTED_VERSION       5011
+   DIAMETER_UNABLE_TO_COMPLY          5012
+   DIAMETER_INVALID_BIT_IN_HEADER     5013
+   DIAMETER_INVALID_AVP_LENGTH        5014
+   DIAMETER_INVALID_MESSAGE_LENGTH    5015
+   DIAMETER_INVALID_AVP_BIT_COMBO     5016
+   DIAMETER_NO_COMMON_SECURITY        5017
+
+@grouped 
+
+      Proxy-Info ::= < AVP Header: 284 >
+                     { Proxy-Host }
+                     { Proxy-State }
+                   * [ AVP ]
+
+      Failed-AVP ::= < AVP Header: 279 >
+                  1* {AVP}
+
+      Experimental-Result ::= < AVP Header: 297 >
+                              { Vendor-Id }
+                              { Experimental-Result-Code }
+
+  Vendor-Specific-Application-Id ::= < AVP Header: 260 >
+                                  1* { Vendor-Id }
+                                     [ Auth-Application-Id ]
+                                     [ Acct-Application-Id ]
+
+;; The E2E-Sequence AVP is defined in RFC 3588 as Grouped, but 
+;; there is no definition of the group - only an informal text stating
+;; that there should be a nonce (an OctetString) and a counter
+;; (integer)
+;;
+      E2E-Sequence ::= <AVP Header: 300 >
+                   2* { AVP }
diff --git a/lib/diameter/src/app/diameter_gen_relay.dia b/lib/diameter/src/dict/relay.dia
index d86446e368..c22293209b 100644
--- a/lib/diameter/src/app/diameter_gen_relay.dia
+++ b/lib/diameter/src/dict/relay.dia
@@ -18,6 +18,7 @@
 ;;
 
 @id 0xFFFFFFFF
+@name   diameter_gen_relay
 @prefix diameter_relay
 @vendor 0 IETF
 
diff --git a/lib/diameter/src/gen/.gitignore b/lib/diameter/src/gen/.gitignore
new file mode 100644
index 0000000000..d490642eb7
--- /dev/null
+++ b/lib/diameter/src/gen/.gitignore
@@ -0,0 +1,2 @@
+
+/diameter_gen*rl
diff --git a/lib/diameter/src/modules.mk b/lib/diameter/src/modules.mk
new file mode 100644
index 0000000000..c7cbe598af
--- /dev/null
+++ b/lib/diameter/src/modules.mk
@@ -0,0 +1,93 @@
+#-*-makefile-*-   ; force emacs to enter makefile-mode
+
+# %CopyrightBegin%
+#
+# Copyright Ericsson AB 2010-2011. All Rights Reserved.
+#
+# The contents of this file are subject to the Erlang Public License,
+# Version 1.1, (the "License"); you may not use this file except in
+# compliance with the License. You should have received a copy of the
+# Erlang Public License along with this software. If not, it can be
+# retrieved online at http://www.erlang.org/.
+#
+# Software distributed under the License is distributed on an "AS IS"
+# basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+# the License for the specific language governing rights and limitations
+# under the License.
+#
+# %CopyrightEnd%
+
+# Runtime dictionary files in ./dict. Modules will be generated from
+# these are included in the app file.
+DICTS = \
+	base_rfc3588 \
+	base_accounting \
+	relay
+
+# Handwritten (runtime) modules included in the app file.
+RT_MODULES = \
+	base/diameter \
+	base/diameter_app \
+	base/diameter_capx \
+	base/diameter_config \
+	base/diameter_codec \
+	base/diameter_dict \
+	base/diameter_lib \
+	base/diameter_misc_sup \
+	base/diameter_peer \
+	base/diameter_peer_fsm \
+	base/diameter_peer_fsm_sup \
+	base/diameter_reg \
+	base/diameter_service \
+	base/diameter_service_sup \
+	base/diameter_session \
+	base/diameter_stats \
+	base/diameter_sup \
+	base/diameter_sync \
+	base/diameter_types \
+	base/diameter_watchdog \
+	base/diameter_watchdog_sup \
+	transport/diameter_etcp \
+	transport/diameter_etcp_sup \
+	transport/diameter_tcp \
+	transport/diameter_tcp_sup \
+	transport/diameter_sctp \
+	transport/diameter_sctp_sup \
+	transport/diameter_transport_sup
+
+# Handwritten (compile time) modules not included in the app file.
+CT_MODULES = \
+	base/diameter_callback \
+	base/diameter_dbg \
+	base/diameter_info \
+	compiler/diameter_codegen \
+	compiler/diameter_exprecs \
+	compiler/diameter_spec_scan \
+	compiler/diameter_spec_util \
+	compiler/diameter_make
+
+# Released hrl files in ../include intended for public consumption.
+EXTERNAL_HRLS = \
+	diameter.hrl \
+	diameter_gen.hrl
+
+# Released hrl files intended for private use.
+INTERNAL_HRLS = \
+	base/diameter_internal.hrl \
+	base/diameter_types.hrl \
+	compiler/diameter_forms.hrl
+
+# Released files relative to ../bin.
+BINS = \
+	diameterc
+
+# Released files relative to ../examples.
+EXAMPLES = \
+	GNUmakefile \
+	peer.erl \
+	client.erl \
+	client_cb.erl \
+	server.erl \
+	server_cb.erl \
+	relay.erl \
+	relay_cb.erl
diff --git a/lib/diameter/src/subdirs.mk b/lib/diameter/src/subdirs.mk
deleted file mode 100644
index 3e12d935bc..0000000000
--- a/lib/diameter/src/subdirs.mk
+++ /dev/null
@@ -1,21 +0,0 @@
-#-*-makefile-*-   ; force emacs to enter makefile-mode
-
-# %CopyrightBegin%
-#
-# Copyright Ericsson AB 2010-2011. All Rights Reserved.
-#
-# The contents of this file are subject to the Erlang Public License,
-# Version 1.1, (the "License"); you may not use this file except in
-# compliance with the License. You should have received a copy of the
-# Erlang Public License along with this software. If not, it can be
-# retrieved online at http://www.erlang.org/.
-#
-# Software distributed under the License is distributed on an "AS IS"
-# basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-# the License for the specific language governing rights and limitations
-# under the License.
-#
-# %CopyrightEnd%
-
-SUB_DIRS = compiler app transport
-SUB_DIRECTORIES = $(SUB_DIRS)
\ No newline at end of file
diff --git a/lib/diameter/src/transport/.gitignore b/lib/diameter/src/transport/.gitignore
deleted file mode 100644
index d9f072e262..0000000000
--- a/lib/diameter/src/transport/.gitignore
+++ /dev/null
@@ -1,3 +0,0 @@
-
-/depend.mk
-
diff --git a/lib/diameter/src/transport/Makefile b/lib/diameter/src/transport/Makefile
deleted file mode 100644
index 4b53100fd2..0000000000
--- a/lib/diameter/src/transport/Makefile
+++ /dev/null
@@ -1,141 +0,0 @@
-#
-# %CopyrightBegin%
-#
-# Copyright Ericsson AB 2010-2011. All Rights Reserved.
-#
-# The contents of this file are subject to the Erlang Public License,
-# Version 1.1, (the "License"); you may not use this file except in
-# compliance with the License. You should have received a copy of the
-# Erlang Public License along with this software. If not, it can be
-# retrieved online at http://www.erlang.org/.
-#
-# Software distributed under the License is distributed on an "AS IS"
-# basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-# the License for the specific language governing rights and limitations
-# under the License.
-#
-# %CopyrightEnd%
-#
-#
-
-ifneq ($(ERL_TOP),)
-include $(ERL_TOP)/make/target.mk
-EBIN = ../../ebin
-include $(ERL_TOP)/make/$(TARGET)/otp.mk
-else
-include $(DIAMETER_TOP)/make/target.mk
-EBIN = ../../ebin
-include $(DIAMETER_TOP)/make/$(TARGET)/rules.mk
-endif
-
-
-# ----------------------------------------------------
-# Application version
-# ----------------------------------------------------
-
-include ../../vsn.mk
-VSN=$(DIAMETER_VSN)
-
-# ----------------------------------------------------
-# Release directory specification
-# ----------------------------------------------------
-
-RELSYSDIR = $(RELEASE_PATH)/lib/diameter-$(VSN)
-
-INCDIR = ../../include
-
-# ----------------------------------------------------
-# Target Specs
-# ----------------------------------------------------
-
-include modules.mk
-
-ERL_FILES = \
-	$(MODULES:%=%.erl) 
-
-TARGET_FILES = \
-	$(MODULES:%=$(EBIN)/%.$(EMULATOR))
-
-# ----------------------------------------------------
-# FLAGS
-# ----------------------------------------------------
-
-ifeq ($(TYPE),debug)
-ERL_COMPILE_FLAGS += -Ddebug
-endif
-
-include ../app/diameter.mk
-
-ERL_COMPILE_FLAGS += \
-	$(DIAMETER_ERL_COMPILE_FLAGS) \
-	-I$(INCDIR)
-
-# ----------------------------------------------------
-# Targets
-# ----------------------------------------------------
-
-debug:
-	@${MAKE} TYPE=debug opt
-
-opt: $(TARGET_FILES) 
-
-clean:
-	rm -f $(TARGET_FILES) 
-	rm -f errs core *~
-	rm -f depend.mk
-
-docs:
-
-info:
-	@echo ""
-	@echo "ERL_FILES = $(ERL_FILES)"
-	@echo "HRL_FILES = $(HRL_FILES)"
-	@echo ""
-	@echo "TARGET_FILES = $(TARGET_FILES)"
-	@echo ""
-
-# ----------------------------------------------------
-# Special Build Targets
-# ----------------------------------------------------
-
-# Invoked from ../app to add modules to the app file.
-$(APP_TARGET): force
-	M=`echo $(MODULES) | sed -e 's/^ *//' -e 's/ *$$//' -e 'y/ /,/'`; \
-	echo "/%TRANSPORT_MODULES%/s//$$M/;w;q" | tr ';' '\n' \
-	| ed -s $@
-
-# ----------------------------------------------------
-# Release Target
-# ----------------------------------------------------
-ifneq ($(ERL_TOP),)
-include $(ERL_TOP)/make/otp_release_targets.mk
-else
-include $(DIAMETER_TOP)/make/release_targets.mk
-endif
-
-release_spec: opt
-	$(INSTALL_DIR)  $(RELSYSDIR)/ebin
-	$(INSTALL_DATA) $(TARGET_FILES) $(RELSYSDIR)/ebin
-	$(INSTALL_DIR)  $(RELSYSDIR)/src/transport
-	$(INSTALL_DATA) $(ERL_FILES) $(HRL_FILES) $(RELSYSDIR)/src/transport
-
-release_docs_spec:
-
-force:
-
-# ----------------------------------------------------
-# Dependencies
-# ----------------------------------------------------
-
-depend: depend.mk
-
-# Generate dependencies makefile.
-depend.mk: ../app/depend.sed $(ERL_FILES) Makefile
-	for f in $(MODULES); do \
-	    sed -f $< $$f.erl | sed "s@/@/$$f@"; \
-	done \
-	> $@
-
--include depend.mk
-
-.PHONY: clean debug depend docs force info opt release_docs_spec release_spec
diff --git a/lib/diameter/src/transport/diameter_sctp.erl b/lib/diameter/src/transport/diameter_sctp.erl
index 46473e7bf1..209f8c01c1 100644
--- a/lib/diameter/src/transport/diameter_sctp.erl
+++ b/lib/diameter/src/transport/diameter_sctp.erl
@@ -37,6 +37,9 @@
          code_change/3,
          terminate/2]).
 
+-export([ports/0,
+         ports/1]).
+
 -include_lib("kernel/include/inet_sctp.hrl").
 -include_lib("diameter/include/diameter.hrl").
 
@@ -118,8 +121,8 @@ s({accept, Ref} = A, Addrs, Opts) ->
 %% gen_sctp in order to be able to accept a new association only
 %% *after* an accepting transport has been spawned.
 
-s({connect = C, _}, Addrs, Opts) ->
-    diameter_sctp_sup:start_child({C, self(), Opts, Addrs}).
+s({connect = C, Ref}, Addrs, Opts) ->
+    diameter_sctp_sup:start_child({C, self(), Opts, Addrs, Ref}).
 
 %% start_link/1
 
@@ -149,28 +152,36 @@ i({listen, Ref, {Opts, Addrs}}) ->
                           socket = Sock});
 
 %% A connecting transport.
-i({connect, Pid, Opts, Addrs}) ->
+i({connect, Pid, Opts, Addrs, Ref}) ->
     {[As, Ps], Rest} = proplists:split(Opts, [raddr, rport]),
     RAs  = [diameter_lib:ipaddr(A) || {raddr, A} <- As],
     [RP] = [P || {rport, P} <- Ps] ++ [P || P <- [?DEFAULT_PORT], [] == Ps],
     {LAs, Sock} = open(Addrs, Rest, 0),
+    putr(ref, Ref),
     proc_lib:init_ack({ok, self(), LAs}),
     erlang:monitor(process, Pid),
     #transport{parent = Pid,
                mode = {connect, connect(Sock, RAs, RP, [])},
                socket = Sock};
+i({connect, _, _, _} = T) ->  %% from old code
+    x(T);
 
 %% An accepting transport spawned by diameter.
-i({accept, Pid, LPid, Sock}) ->
+i({accept, Pid, LPid, Sock, Ref})
+  when is_pid(Pid) ->
+    putr(ref, Ref),
     proc_lib:init_ack({ok, self()}),
     erlang:monitor(process, Pid),
     erlang:monitor(process, LPid),
     #transport{parent = Pid,
                mode = {accept, LPid},
                socket = Sock};
+i({accept, _, _, _} = T) ->  %% from old code
+    x(T);
 
 %% An accepting transport spawned at association establishment.
 i({accept, Ref, LPid, Sock, Id}) ->
+    putr(ref, Ref),
     proc_lib:init_ack({ok, self()}),
     MRef = erlang:monitor(process, LPid),
     %% Wait for a signal that the transport has been started before
@@ -250,13 +261,33 @@ gen_opts(Opts) ->
     [binary, {active, once} | Opts].
 
 %% ---------------------------------------------------------------------------
+%% # ports/0-1
+%% ---------------------------------------------------------------------------
+
+ports() ->
+    Ts = diameter_reg:match({?MODULE, '_', '_'}),
+    [{type(T), N, Pid} || {{?MODULE, T, {_, {_, S}}}, Pid} <- Ts,
+                          {ok, N} <- [inet:port(S)]].
+    
+ports(Ref) ->
+    Ts = diameter_reg:match({?MODULE, '_', {Ref, '_'}}),
+    [{type(T), N, Pid} || {{?MODULE, T, {R, {_, S}}}, Pid} <- Ts,
+                          R == Ref,
+                          {ok, N} <- [inet:port(S)]].
+
+type(listener) ->
+    listen;
+type(T) ->
+    T.
+
+%% ---------------------------------------------------------------------------
 %% # handle_call/3
 %% ---------------------------------------------------------------------------
 
 handle_call({{accept, Ref}, Pid}, _, #listener{ref = Ref,
                                                count = N}
                                      = S) ->
-    {TPid, NewS} = accept(Pid, S),
+    {TPid, NewS} = accept(Ref, Pid, S),
     {reply, {ok, TPid}, NewS#listener{count = N+1}};
 
 handle_call(_, _, State) ->
@@ -306,6 +337,12 @@ terminate(_, #listener{socket = Sock}) ->
 
 %% ---------------------------------------------------------------------------
 
+putr(Key, Val) ->
+    put({?MODULE, Key}, Val).
+
+getr(Key) ->
+    get({?MODULE, Key}).
+
 %% start_timer/1
 
 start_timer(#listener{count = 0} = S) ->
@@ -411,27 +448,41 @@ transition({diameter, {send, Msg}}, S) ->
 transition({diameter, {close, Pid}}, #transport{parent = Pid}) ->
     stop;
 
+%% TLS over SCTP is described in RFC 3436 but has limitations as
+%% described in RFC 6083. The latter describes DTLS over SCTP, which
+%% addresses these limitations, DTLS itself being described in RFC
+%% 4347. TLS is primarily used over TCP, which the current RFC 3588
+%% draft acknowledges by equating TLS with TLS/TCP and DTLS/SCTP.
+transition({diameter, {tls, _Ref, _Type, _Bool}}, _) ->
+    stop;
+
 %% Listener process has died.
 transition({'DOWN', _, process, Pid, _}, #transport{mode = {accept, Pid}}) ->
     stop;
 
 %% Parent process has died.
 transition({'DOWN', _, process, Pid, _}, #transport{parent = Pid}) ->
-    stop.
+    stop;
+
+%% Request for the local port number.
+transition({resolve_port, Pid}, #transport{socket = Sock})
+  when is_pid(Pid) ->
+    Pid ! inet:port(Sock),
+    ok.
 
 %% Crash on anything unexpected.
 
-%% accept/2
+%% accept/3
 %%
 %% Start a new transport process or use one that's already been
 %% started as a consequence of association establishment.
 
 %% No pending associations: spawn a new transport.
-accept(Pid, #listener{socket = Sock,
-                      tmap = T,
-                      pending = {0,_} = Q}
-            = S) ->
-    Arg = {accept, Pid, self(), Sock},
+accept(Ref, Pid, #listener{socket = Sock,
+                           tmap = T,
+                           pending = {0,_} = Q}
+                 = S) ->
+    Arg = {accept, Pid, self(), Sock, Ref},
     {ok, TPid} = diameter_sctp_sup:start_child(Arg),
     MRef = erlang:monitor(process, TPid),
     ets:insert(T, [{MRef, TPid}, {TPid, MRef}]),
@@ -442,12 +493,12 @@ accept(Pid, #listener{socket = Sock,
 
 %% Accepting transport has died. This can happen if a new transport is
 %% started before the DOWN has arrived.
-accept(Pid, #listener{pending = [TPid | {0,_} = Q]} = S) ->
+accept(Ref, Pid, #listener{pending = [TPid | {0,_} = Q]} = S) ->
     false = is_process_alive(TPid),  %% assert
-    accept(Pid, S#listener{pending = Q});
+    accept(Ref, Pid, S#listener{pending = Q});
 
 %% Pending associations: attach to the first in the queue.
-accept(Pid, #listener{ref = Ref, pending = {N,Q}} = S) ->
+accept(_, Pid, #listener{ref = Ref, pending = {N,Q}} = S) ->
     TPid = ets:first(Q),
     TPid ! {Ref, Pid},
     ets:delete(Q, TPid),
@@ -499,8 +550,14 @@ recv({[], #sctp_assoc_change{state = comm_up,
                              outbound_streams = OS,
                              inbound_streams = IS,
                              assoc_id = Id}},
-     #transport{assoc_id = undefined}
+     #transport{assoc_id = undefined,
+                mode = {T, _},
+                socket = Sock}
      = S) ->
+    Ref = getr(ref),
+    is_reference(Ref)  %% started in new code
+        andalso
+        (true = diameter_reg:add_new({?MODULE, T, {Ref, {Id, Sock}}})),
     up(S#transport{assoc_id = Id,
                    streams = {IS, OS}});
 
diff --git a/lib/diameter/src/transport/diameter_tcp.erl b/lib/diameter/src/transport/diameter_tcp.erl
index 653c114471..78dbda6888 100644
--- a/lib/diameter/src/transport/diameter_tcp.erl
+++ b/lib/diameter/src/transport/diameter_tcp.erl
@@ -37,6 +37,9 @@
          code_change/3,
          terminate/2]).
 
+-export([ports/0,
+         ports/1]).
+
 -include_lib("diameter/include/diameter.hrl").
 
 -define(ERROR(T), erlang:error({T, ?MODULE, ?LINE})).
@@ -45,6 +48,9 @@
 -define(LISTENER_TIMEOUT, 30000).
 -define(FRAGMENT_TIMEOUT, 1000).
 
+%% cb_info passed to ssl.
+-define(TCP_CB(Mod), {Mod, tcp, tcp_closed, tcp_error}).
+
 %% The same gen_server implementation supports three different kinds
 %% of processes: an actual transport process, one that will club it to
 %% death should the parent die before a connection is established, and
@@ -71,8 +77,8 @@
         {socket  :: inet:socket(),  %% accept or connect socket
          parent  :: pid(),          %% of process that started us
          module  :: module(),       %% gen_tcp-like module
-         frag = <<>> :: binary() | {tref(), frag()}}). %% message fragment
-
+         frag = <<>> :: binary() | {tref(), frag()},  %% message fragment
+         ssl     :: boolean() | [term()]}). %% ssl options
 %% The usual transport using gen_tcp can be replaced by anything
 %% sufficiently gen_tcp-like by passing a 'module' option as the first
 %% (for simplicity) transport option. The transport_module diameter_etcp
@@ -122,12 +128,18 @@ i({T, Ref, Mod, Pid, Opts, Addrs})
     %% that does nothing but kill us with the parent until call
     %% returns.
     {ok, MPid} = diameter_tcp_sup:start_child(#monitor{parent = Pid}),
-    Sock = i(T, Ref, Mod, Pid, Opts, Addrs),
+    {SslOpts, Rest} = ssl(Opts),
+    Sock = i(T, Ref, Mod, Pid, SslOpts, Rest, Addrs),
     MPid ! {stop, self()},  %% tell the monitor to die
-    setopts(Mod, Sock),
+    M = if SslOpts -> ssl; true -> Mod end,
+    setopts(M, Sock),
+    putr(ref, Ref),
     #transport{parent = Pid,
-               module = Mod,
-               socket = Sock};
+               module = M,
+               socket = Sock,
+               ssl = SslOpts};
+%% Put the reference in the process dictionary since we now use it
+%% advertise the ssl socket after TLS upgrade.
 
 %% A monitor process to kill the transport if the parent dies.
 i(#monitor{parent = Pid, transport = TPid} = S) ->
@@ -146,27 +158,51 @@ i({listen, LRef, APid, {Mod, Opts, Addrs}}) ->
     LAddr = get_addr(LA, Addrs),
     LPort = get_port(LP),
     {ok, LSock} = Mod:listen(LPort, gen_opts(LAddr, Rest)),
+    true = diameter_reg:add_new({?MODULE, listener, {LRef, {LAddr, LSock}}}),
     proc_lib:init_ack({ok, self(), {LAddr, LSock}}),
     erlang:monitor(process, APid),
-    true = diameter_reg:add_new({?MODULE, listener, {LRef, {LAddr, LSock}}}),
     start_timer(#listener{socket = LSock}).
 
-%% i/6
+ssl(Opts) ->
+    {[SslOpts], Rest} = proplists:split(Opts, [ssl_options]),
+    {ssl_opts(SslOpts), Rest}.
+
+ssl_opts([]) ->
+    false;
+ssl_opts([{ssl_options, true}]) ->
+    true;
+ssl_opts([{ssl_options, Opts}])
+  when is_list(Opts) ->
+    Opts;
+ssl_opts(L) ->
+    ?ERROR({ssl_options, L}).
+
+%% i/7
+
+%% Establish a TLS connection before capabilities exchange ...
+i(Type, Ref, Mod, Pid, true, Opts, Addrs) ->
+    i(Type, Ref, ssl, Pid, [{cb_info, ?TCP_CB(Mod)} | Opts], Addrs);
+
+%% ... or not.
+i(Type, Ref, Mod, Pid, _, Opts, Addrs) ->
+    i(Type, Ref, Mod, Pid, Opts, Addrs).
 
-i(accept, Ref, Mod, Pid, Opts, Addrs) ->
+i(accept = T, Ref, Mod, Pid, Opts, Addrs) ->
     {LAddr, LSock} = listener(Ref, {Mod, Opts, Addrs}),
     proc_lib:init_ack({ok, self(), [LAddr]}),
     Sock = ok(accept(Mod, LSock)),
+    true = diameter_reg:add_new({?MODULE, T, {Ref, Sock}}),
     diameter_peer:up(Pid),
     Sock;
 
-i(connect, _, Mod, Pid, Opts, Addrs) ->
+i(connect = T, Ref, Mod, Pid, Opts, Addrs) ->
     {[LA, RA, RP], Rest} = proplists:split(Opts, [ip, raddr, rport]),
     LAddr = get_addr(LA, Addrs),
     RAddr = get_addr(RA, []),
     RPort = get_port(RP),
     proc_lib:init_ack({ok, self(), [LAddr]}),
     Sock = ok(connect(Mod, RAddr, RPort, gen_opts(LAddr, Rest))),
+    true = diameter_reg:add_new({?MODULE, T, {Ref, Sock}}),
     diameter_peer:up(Pid, {RAddr, RPort}),
     Sock.
 
@@ -227,6 +263,43 @@ gen_opts(LAddr, Opts) ->
      | Opts].
 
 %% ---------------------------------------------------------------------------
+%% # ports/1
+%% ---------------------------------------------------------------------------
+
+ports() ->
+    Ts = diameter_reg:match({?MODULE, '_', '_'}),
+    [{type(T), resolve(T,S), Pid} || {{?MODULE, T, {_,S}}, Pid} <- Ts].
+
+ports(Ref) ->
+    Ts = diameter_reg:match({?MODULE, '_', {Ref, '_'}}),
+    [{type(T), resolve(T,S), Pid} || {{?MODULE, T, {R,S}}, Pid} <- Ts,
+                                     R == Ref].
+
+type(listener) ->
+    listen;
+type(T) ->
+    T.
+
+sock(listener, {_LAddr, Sock}) ->
+    Sock;
+sock(_, Sock) ->
+    Sock.
+
+resolve(Type, S) ->
+    Sock = sock(Type, S),
+    try
+        ok(portnr(Sock))
+    catch
+        _:_ -> Sock
+    end.
+
+portnr(Sock)
+  when is_port(Sock) ->
+    portnr(gen_tcp, Sock);
+portnr(Sock) ->
+    portnr(ssl, Sock).
+
+%% ---------------------------------------------------------------------------
 %% # handle_call/3
 %% ---------------------------------------------------------------------------
 
@@ -258,6 +331,8 @@ handle_info(T, #monitor{} = S) ->
 %% # code_change/3
 %% ---------------------------------------------------------------------------
 
+code_change(_, {transport, _, _, _, _} = S, _) ->
+    {ok, #transport{} = list_to_tuple(tuple_to_list(S) ++ [false])};
 code_change(_, State, _) ->
     {ok, State}.
 
@@ -270,6 +345,12 @@ terminate(_, _) ->
 
 %% ---------------------------------------------------------------------------
 
+putr(Key, Val) ->
+    put({?MODULE, Key}, Val).
+
+getr(Key) ->
+    get({?MODULE, Key}).
+
 %% start_timer/1
 
 start_timer(#listener{count = 0} = S) ->
@@ -332,17 +413,56 @@ t(T,S) ->
 
 %% transition/2
 
+%% Initial incoming message when we might need to upgrade to TLS:
+%% don't request another message until we know.
+transition({tcp, Sock, Bin}, #transport{socket = Sock,
+                                        parent = Pid,
+                                        frag = Head,
+                                        module = M,
+                                        ssl = Opts}
+                             = S)
+  when is_list(Opts) ->
+    case recv1(Head, Bin) of
+        {Msg, B} when is_binary(Msg) ->
+            diameter_peer:recv(Pid, Msg),
+            S#transport{frag = B};
+        Frag ->
+            setopts(M, Sock),
+            S#transport{frag = Frag}
+    end;
+
 %% Incoming message.
-transition({tcp, Sock, Data}, #transport{socket = Sock,
-                                         module = M}
-                              = S) ->
+transition({P, Sock, Bin}, #transport{socket = Sock,
+                                      module = M,
+                                      ssl = B}
+                           = S)
+  when P == tcp, not B;
+       P == ssl, B ->
+    setopts(M, Sock),
+    recv(Bin, S);
+
+%% Capabilties exchange has decided on whether or not to run over TLS.
+transition({diameter, {tls, Ref, Type, B}}, #transport{parent = Pid}
+                                            = S) ->
+    #transport{socket = Sock,
+               module = M}
+        = NS
+        = tls_handshake(Type, B, S),
+    Pid ! {diameter, {tls, Ref}},
     setopts(M, Sock),
-    recv(Data, S);
+    NS#transport{ssl = B};
 
-transition({tcp_closed, Sock}, #transport{socket = Sock}) ->
+transition({C, Sock}, #transport{socket = Sock,
+                                 ssl = B})
+  when C == tcp_closed, not B;
+       C == ssl_closed, B ->
     stop;
 
-transition({tcp_error, Sock, _Reason} = T, #transport{socket = Sock} = S) ->
+transition({E, Sock, _Reason} = T, #transport{socket = Sock,
+                                              ssl = B}
+                                   = S)
+  when E == tcp_error, not B;
+       E == ssl_error, B ->
     ?ERROR({T,S});
 
 %% Outgoing message.
@@ -367,10 +487,10 @@ transition({timeout, TRef, flush}, S) ->
     flush(TRef, S);
 
 %% Request for the local port number.
-transition({resolve_port, RPid}, #transport{socket = Sock,
-                                            module = M})
-  when is_pid(RPid) ->
-    RPid ! lport(M, Sock),
+transition({resolve_port, Pid}, #transport{socket = Sock,
+                                           module = M})
+  when is_pid(Pid) ->
+    Pid ! portnr(M, Sock),
     ok;
 
 %% Parent process has died.
@@ -379,80 +499,122 @@ transition({'DOWN', _, process, Pid, _}, #transport{parent = Pid}) ->
 
 %% Crash on anything unexpected.
 
+%% tls_handshake/3
+%%
+%% In the case that no tls message is received (eg. the service hasn't
+%% been configured to advertise TLS support) we will simply never ask
+%% for another TCP message, which will force the watchdog to
+%% eventually take us down.
+
+%% TLS has already been established with the connection.
+tls_handshake(_, _, #transport{ssl = true} = S) ->
+    S;
+
+%% Capabilities exchange negotiated TLS but transport was not
+%% configured with an options list.
+tls_handshake(_, true, #transport{ssl = false}) ->
+    ?ERROR(no_ssl_options);
+
+%% Capabilities exchange negotiated TLS: upgrade the connection.
+tls_handshake(Type, true, #transport{socket = Sock,
+                                     module = M,
+                                     ssl = Opts}
+                          = S) ->
+    {ok, SSock} = tls(Type, Sock, [{cb_info, ?TCP_CB(M)} | Opts]),
+    Ref = getr(ref),
+    is_reference(Ref)  %% started in new code
+        andalso
+        (true = diameter_reg:add_new({?MODULE, Type, {Ref, SSock}})),
+    S#transport{socket = SSock,
+                module = ssl};
+
+%% Capabilities exchange has not negotiated TLS.
+tls_handshake(_, false, S) ->
+    S.
+
+tls(connect, Sock, Opts) ->
+    ssl:connect(Sock, Opts);
+tls(accept, Sock, Opts) ->
+    ssl:ssl_accept(Sock, Opts).
+
 %% recv/2
 %%
 %% Reassemble fragmented messages and extract multple message sent
 %% using Nagle.
 
 recv(Bin, #transport{parent = Pid, frag = Head} = S) ->
-    S#transport{frag = recv(Pid, Head, Bin)}.
+    case recv1(Head, Bin) of
+        {Msg, B} when is_binary(Msg) ->
+            diameter_peer:recv(Pid, Msg),
+            recv(B, S#transport{frag = <<>>});
+        Frag ->
+            S#transport{frag = Frag}
+    end.
 
-%% recv/3
+%% recv1/2
 
 %% No previous fragment.
-recv(Pid, <<>>, Bin) ->
-    rcv(Pid, Bin);
+recv1(<<>>, Bin) ->
+    rcv(Bin);
 
-recv(Pid, {TRef, Head}, Bin) ->
+recv1({TRef, Head}, Bin) ->
     erlang:cancel_timer(TRef),
-    rcv(Pid, Head, Bin).
+    rcv(Head, Bin).
 
-%% rcv/3
+%% rcv/2
 
 %% Not even the first four bytes of the header.
-rcv(Pid, Head, Bin)
+rcv(Head, Bin)
   when is_binary(Head) ->
-    rcv(Pid, <<Head/binary, Bin/binary>>);
+    rcv(<<Head/binary, Bin/binary>>);
 
 %% Or enough to know how many bytes to extract.
-rcv(Pid, {Len, N, Head, Acc}, Bin) ->
-    rcv(Pid, Len, N + size(Bin), Head, [Bin | Acc]).
+rcv({Len, N, Head, Acc}, Bin) ->
+    rcv(Len, N + size(Bin), Head, [Bin | Acc]).
 
-%% rcv/5
+%% rcv/4
 
 %% Extract a message for which we have all bytes.
-rcv(Pid, Len, N, Head, Acc)
+rcv(Len, N, Head, Acc)
   when Len =< N ->
-    rcv(Pid, rcv1(Pid, Len, bin(Head, Acc)));
+    rcv1(Len, bin(Head, Acc));
 
 %% Wait for more packets.
-rcv(_, Len, N, Head, Acc) ->
+rcv(Len, N, Head, Acc) ->
     {start_timer(), {Len, N, Head, Acc}}.
 
 %% rcv/2
 
 %% Nothing left.
-rcv(_, <<>> = Bin) ->
+rcv(<<>> = Bin) ->
     Bin;
 
 %% Well, this isn't good. Chances are things will go south from here
 %% but if we're lucky then the bytes we have extend to an intended
 %% message boundary and we can recover by simply discarding them,
 %% which is the result of receiving them.
-rcv(Pid, <<_:1/binary, Len:24, _/binary>> = Bin)
+rcv(<<_:1/binary, Len:24, _/binary>> = Bin)
   when Len < 20 ->
-    diameter_peer:recv(Pid, Bin),
-    <<>>;
+    {Bin, <<>>};
 
 %% Enough bytes to extract a message.
-rcv(Pid, <<_:1/binary, Len:24, _/binary>> = Bin)
+rcv(<<_:1/binary, Len:24, _/binary>> = Bin)
   when Len =< size(Bin) ->
-    rcv(Pid, rcv1(Pid, Len, Bin));
+    rcv1(Len, Bin);
 
 %% Or not: wait for more packets.
-rcv(_, <<_:1/binary, Len:24, _/binary>> = Head) ->
+rcv(<<_:1/binary, Len:24, _/binary>> = Head) ->
     {start_timer(), {Len, size(Head), Head, []}};
 
 %% Not even 4 bytes yet.
-rcv(_, Head) ->
+rcv(Head) ->
     {start_timer(), Head}.
 
-%% rcv1/3
+%% rcv1/2
 
-rcv1(Pid, Len, Bin) ->
+rcv1(Len, Bin) ->
     <<Msg:Len/binary, Rest/binary>> = Bin,
-    diameter_peer:recv(Pid, Msg),
-    Rest.
+    {Msg, Rest}.
 
 %% bin/[12]
 
@@ -489,15 +651,18 @@ flush(_, S) ->
 
 %% accept/2
 
-accept(gen_tcp, LSock) ->
-    gen_tcp:accept(LSock);
+accept(ssl, LSock) ->
+    case ssl:transport_accept(LSock) of
+        {ok, Sock} ->
+            {ssl:ssl_accept(Sock), Sock};
+        {error, _} = No ->
+            No
+    end;
 accept(Mod, LSock) ->
     Mod:accept(LSock).
 
 %% connect/4
 
-connect(gen_tcp, Host, Port, Opts) ->
-    gen_tcp:connect(Host, Port, Opts);
 connect(Mod, Host, Port, Opts) ->
     Mod:connect(Host, Port, Opts).
 
@@ -505,6 +670,8 @@ connect(Mod, Host, Port, Opts) ->
 
 send(gen_tcp, Sock, Bin) ->
     gen_tcp:send(Sock, Bin);
+send(ssl, Sock, Bin) ->
+    ssl:send(Sock, Bin);
 send(M, Sock, Bin) ->
     M:send(Sock, Bin).
 
@@ -512,6 +679,8 @@ send(M, Sock, Bin) ->
 
 setopts(gen_tcp, Sock, Opts) ->
     inet:setopts(Sock, Opts);
+setopts(ssl, Sock, Opts) ->
+    ssl:setopts(Sock, Opts);
 setopts(M, Sock, Opts) ->
     M:setopts(Sock, Opts).
 
@@ -523,9 +692,16 @@ setopts(M, Sock) ->
         X  -> x({setopts, M, Sock, X})  %% possibly on peer disconnect
     end.
 
-%% lport/2
+%% portnr/2
 
-lport(gen_tcp, Sock) ->
+portnr(gen_tcp, Sock) ->
     inet:port(Sock);
-lport(M, Sock) ->
+portnr(ssl, Sock) ->
+    case ssl:sockname(Sock) of
+        {ok, {_Addr, PortNr}} ->
+            {ok, PortNr};
+        {error, _} = No ->
+            No
+    end;
+portnr(M, Sock) ->
     M:port(Sock).
diff --git a/lib/diameter/src/transport/modules.mk b/lib/diameter/src/transport/modules.mk
deleted file mode 100644
index a0dc3cf2c0..0000000000
--- a/lib/diameter/src/transport/modules.mk
+++ /dev/null
@@ -1,29 +0,0 @@
-#-*-makefile-*-   ; force emacs to enter makefile-mode
-
-# %CopyrightBegin%
-# 
-# Copyright Ericsson AB 2010-2011. All Rights Reserved.
-# 
-# The contents of this file are subject to the Erlang Public License,
-# Version 1.1, (the "License"); you may not use this file except in
-# compliance with the License. You should have received a copy of the
-# Erlang Public License along with this software. If not, it can be
-# retrieved online at http://www.erlang.org/.
-# 
-# Software distributed under the License is distributed on an "AS IS"
-# basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-# the License for the specific language governing rights and limitations
-# under the License.
-# 
-# %CopyrightEnd%
-
-MODULES = \
-	diameter_etcp \
-	diameter_etcp_sup \
-	diameter_tcp \
-	diameter_tcp_sup \
-	diameter_sctp \
-	diameter_sctp_sup \
-	diameter_transport_sup
-
-HRL_FILES =
diff --git a/lib/diameter/test/Makefile b/lib/diameter/test/Makefile
index dba1f126dc..69bcabbfbb 100644
--- a/lib/diameter/test/Makefile
+++ b/lib/diameter/test/Makefile
@@ -17,15 +17,13 @@
 # %CopyrightEnd%
 
 ifeq ($(ERL_TOP),)
-TOP = $(DIAMETER_TOP)
+include $(DIAMETER_TOP)/make/target.mk
+include $(DIAMETER_TOP)/make/$(TARGET)/rules.mk
 else
-TOP = $(ERL_TOP)
-DIAMETER_TOP = $(TOP)/lib/diameter
+include $(ERL_TOP)/make/target.mk
+include $(ERL_TOP)/make/$(TARGET)/otp.mk
 endif
 
-include $(TOP)/make/target.mk
-include $(TOP)/make/$(TARGET)/otp.mk
-
 # ----------------------------------------------------
 # Application version
 # ----------------------------------------------------
@@ -46,30 +44,22 @@ RELSYSDIR = $(RELEASE_PATH)/diameter_test
 
 include modules.mk
 
-EBIN = .
-
-HRL_FILES = $(INTERNAL_HRL_FILES)
-ERL_FILES = $(MODULES:%=%.erl)
-
-SOURCE = $(HRL_FILES) $(ERL_FILES) 
+ERL_FILES    = $(MODULES:%=%.erl)
 TARGET_FILES = $(MODULES:%=%.$(EMULATOR))
 
 SUITE_MODULES = $(filter diameter_%_SUITE, $(MODULES))
-SUITES = $(SUITE_MODULES:diameter_%_SUITE=%)
-
-RELTEST_FILES = $(TEST_SPEC_FILE) $(COVER_SPEC_FILE) $(SOURCE)
+SUITES        = $(SUITE_MODULES:diameter_%_SUITE=%)
 
 # ----------------------------------------------------
 # FLAGS
 # ----------------------------------------------------
 
-include ../src/app/diameter.mk 
-
 # This is only used to compile suite locally when running with a
 # target like 'all' below. Target release_tests only installs source.
-ERL_COMPILE_FLAGS += $(DIAMETER_ERL_COMPILE_FLAGS) \
+ERL_COMPILE_FLAGS += +warn_export_vars \
+                     +warn_unused_vars \
                      -DDIAMETER_CT=true \
-                     -I $(DIAMETER_TOP)/src/app
+                     -I ../src/gen
 
 # ----------------------------------------------------
 # Targets
@@ -77,7 +67,7 @@ ERL_COMPILE_FLAGS += $(DIAMETER_ERL_COMPILE_FLAGS) \
 
 all: $(SUITES)
 
-tests debug opt: $(TARGET_FILES)
+beam tests debug opt: $(TARGET_FILES)
 
 clean:
 	rm -f $(TARGET_FILES) 
@@ -85,62 +75,52 @@ clean:
 
 realclean: clean
 	rm -rf log
-	rm -f errs core *~
-
-.PHONY: all tests debug opt clean realclean
 
 docs:
 
+list = echo $(1):; echo $($(1)) | tr ' ' '\n' | sort | sed 's@^@  @'
+
 info:
-	@echo "TARGET_FILES = $(TARGET_FILES)"
-	@echo
-	@echo "ERL_COMPILE_FLAGS = $(ERL_COMPILE_FLAGS)"
-	@echo "ERL  = $(ERL)"
-	@echo "ERLC = $(ERLC)"
+	@echo ========================================
+	@$(call list,MODULES)
 	@echo
-	@echo "HRL_FILES    = $(HRL_FILES)"
-	@echo "ERL_FILES    = $(ERL_FILES)"
-	@echo "TARGET_FILES = $(TARGET_FILES)"
-	@echo
-	@echo "SUITE_MODULES = $(SUITE_MODULES)"
-	@echo "SUITES        = $(SUITES)"
+	@$(call list,HRL_FILES)
 	@echo
+	@$(call list,SUITES)
+	@echo ========================================
 
 help:
+	@echo ========================================
+	@echo "Useful targets:"
 	@echo
-	@echo "Targets:"
-	@echo
-	@echo "    all"
-	@echo "        Run all test suites."
+	@echo "    all:"
+	@echo "        Compile and run all test suites."
 	@echo
-	@echo "    $(SUITES)"
-	@echo "        Run a specific test suite."
+	@echo "    $(SUITES):"
+	@echo "        Compile and run a specific test suite."
 	@echo
-	@echo "    tests"
+	@echo "    beam:"
 	@echo "        Compile all test-code."
 	@echo
-	@echo "    clean | realclean"
+	@echo "    clean | realclean:"
 	@echo "        Remove generated files."
 	@echo
-	@echo "    info"
-	@echo "        Prints various environment variables."
-	@echo "        May be useful when debugging this Makefile."
-	@echo
-	@echo "    help"
-	@echo "        Print this info."
-	@echo
+	@echo "    info:"
+	@echo "        Echo some interesting variables."
+	@echo ========================================
 
-.PHONY: docs info help
+.PHONY: all beam clean debug docs help info opt realclean tests
 
 # ----------------------------------------------------
 # Special Targets
 # ----------------------------------------------------
 
 # Exit with a non-zero status if the output looks to indicate failure.
-# diameter_ct:run/1 itself can't tell (it seems).
+# diameter_ct:run/1 itself can't tell (it seems). The absolute -pa is
+# because ct will change directories.
 $(SUITES): log tests
 	$(ERL) -noshell \
-	        -pa $(DIAMETER_TOP)/ebin \
+	        -pa $(realpath ../ebin) \
 	        -sname diameter_test_$@ \
 	        -s diameter_ct run diameter_$@_SUITE \
 	        -s init stop \
@@ -156,7 +136,11 @@ log:
 # Release Targets
 # ---------------------------------------------------- 
 
-include $(TOP)/make/otp_release_targets.mk
+ifeq ($(ERL_TOP),)
+include $(DIAMETER_TOP)/make/release_targets.mk
+else
+include $(ERL_TOP)/make/otp_release_targets.mk
+endif
 
 release_spec: 
 
@@ -164,7 +148,11 @@ release_docs_spec:
 
 release_tests_spec:
 	$(INSTALL_DIR)  $(RELSYSDIR)
-	$(INSTALL_DATA) $(RELTEST_FILES) $(RELSYSDIR)
+	$(INSTALL_DATA) $(TEST_SPEC_FILE) \
+	                $(COVER_SPEC_FILE) \
+	                $(HRL_FILES) \
+	                $(ERL_FILES) \
+	                $(RELSYSDIR)
 
 .PHONY: release_spec release_docs_spec release_test_specs
 
diff --git a/lib/diameter/test/diameter_app_SUITE.erl b/lib/diameter/test/diameter_app_SUITE.erl
index 104785b4e6..d5ecdea291 100644
--- a/lib/diameter/test/diameter_app_SUITE.erl
+++ b/lib/diameter/test/diameter_app_SUITE.erl
@@ -98,6 +98,7 @@ modules(Config) ->
             diameter_dbg,
             diameter_exprecs,
             diameter_info,
+            diameter_make,
             diameter_spec_scan,
             diameter_spec_util],
     {[], Help} = {Mods -- Installed, lists:sort(Installed -- Mods)}.
@@ -147,14 +148,13 @@ appvsn(Name) ->
 %% ===========================================================================
 %% # xref/1
 %%
-%% Ensure that no function in our application calls an undefined function.
+%% Ensure that no function in our application calls an undefined function
+%% or one in an application we haven't specified as a dependency. (Almost.)
 %% ===========================================================================
 
 xref(Config) ->
     App = fetch(app, Config),
-    Mods = fetch(modules, App) -- [diameter_codegen, diameter_dbg],
-    %% Skip modules that aren't required at runtime and that have
-    %% dependencies beyond those applications listed in the app file.
+    Mods = fetch(modules, App),
 
     {ok, XRef} = xref:start(make_name(xref_test_name)),
     ok = xref:set_default(XRef, [{verbose, false}, {warnings, false}]),
@@ -164,7 +164,10 @@ xref(Config) ->
     %% stop xref from complaining about calls to module erlang, which
     %% was previously in kernel. Erts isn't an application however, in
     %% the sense that there's no .app file, and isn't listed in
-    %% applications. Seems less than ideal.
+    %% applications. Seems less than ideal. Also, diameter_tcp does
+    %% call ssl despite ssl not being listed as a dependency in the
+    %% app file since ssl is only required for TLS security: it's up
+    %% to a client who wants TLS it to start ssl.
     ok = lists:foreach(fun(A) -> add_application(XRef, A) end,
                        [?APP, erts | fetch(applications, App)]),
 
@@ -173,7 +176,11 @@ xref(Config) ->
     xref:stop(XRef),
 
     %% Only care about calls from our own application.
-    [] = lists:filter(fun({{M,_,_},_}) -> lists:member(M, Mods) end, Undefs).
+    [] = lists:filter(fun({{F,_,_},{T,_,_}}) ->
+                              lists:member(F, Mods)
+                                  andalso {F,T} /= {diameter_tcp, ssl}
+                      end,
+                      Undefs).
 
 add_application(XRef, App) ->
     add_application(XRef, App, code:lib_dir(App)).
diff --git a/lib/diameter/test/diameter_failover_SUITE.erl b/lib/diameter/test/diameter_failover_SUITE.erl
new file mode 100644
index 0000000000..c25e9682f0
--- /dev/null
+++ b/lib/diameter/test/diameter_failover_SUITE.erl
@@ -0,0 +1,262 @@
+%%
+%% %CopyrightBegin%
+%%
+%% Copyright Ericsson AB 2010-2011. All Rights Reserved.
+%%
+%% The contents of this file are subject to the Erlang Public License,
+%% Version 1.1, (the "License"); you may not use this file except in
+%% compliance with the License. You should have received a copy of the
+%% Erlang Public License along with this software. If not, it can be
+%% retrieved online at http://www.erlang.org/.
+%%
+%% Software distributed under the License is distributed on an "AS IS"
+%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+%% the License for the specific language governing rights and limitations
+%% under the License.
+%%
+%% %CopyrightEnd%
+%%
+
+%%
+%% Tests of traffic between six Diameter nodes in three realms,
+%% connected as follows.
+%%
+%%                  ----- SERVER1.REALM2
+%%                /
+%%               /  ----- SERVER2.REALM2
+%%              | /
+%%   CLIENT.REALM1 ------ SERVER3.REALM2
+%%              | \
+%%              |  \
+%%               \   ---- SERVER1.REALM3
+%%                \
+%%                  ----- SERVER2.REALM3
+%%
+
+-module(diameter_failover_SUITE).
+
+-export([suite/0,
+         all/0]).
+
+%% testcases
+-export([start/1,
+         start_services/1,
+         connect/1,
+         send_ok/1,
+         send_nok/1,
+         stop_services/1,
+         stop/1]).
+
+%% diameter callbacks
+-export([peer_up/3,
+         peer_down/3,
+         pick_peer/4,
+         prepare_request/3,
+         prepare_retransmit/3,
+         handle_answer/4,
+         handle_error/4,
+         handle_request/3]).
+
+-ifdef(DIAMETER_CT).
+-include("diameter_gen_base_rfc3588.hrl").
+-else.
+-include_lib("diameter/include/diameter_gen_base_rfc3588.hrl").
+-endif.
+
+-include_lib("diameter/include/diameter.hrl").
+-include("diameter_ct.hrl").
+
+%% ===========================================================================
+
+-define(util, diameter_util).
+
+-define(ADDR, {127,0,0,1}).
+
+-define(CLIENT,  "CLIENT.REALM1").
+-define(SERVER1, "SERVER1.REALM2").
+-define(SERVER2, "SERVER2.REALM2").
+-define(SERVER3, "SERVER3.REALM2").
+-define(SERVER4, "SERVER1.REALM3").
+-define(SERVER5, "SERVER2.REALM3").
+
+-define(SERVICES, [?CLIENT, ?SERVER1, ?SERVER2, ?SERVER3, ?SERVER4, ?SERVER5]).
+
+-define(DICT_COMMON,  ?DIAMETER_DICT_COMMON).
+
+-define(APP_ALIAS, the_app).
+-define(APP_ID, ?DICT_COMMON:id()).
+
+%% Config for diameter:start_service/2.
+-define(SERVICE(Host, Dict),
+        [{'Origin-Host', Host},
+         {'Origin-Realm', realm(Host)},
+         {'Host-IP-Address', [?ADDR]},
+         {'Vendor-Id', 12345},
+         {'Product-Name', "OTP/diameter"},
+         {'Acct-Application-Id', [Dict:id()]},
+         {application, [{alias, ?APP_ALIAS},
+                        {dictionary, Dict},
+                        {module, ?MODULE},
+                        {answer_errors, callback}]}]).
+
+-define(SUCCESS, 2001).
+
+-define(LOGOUT, ?'DIAMETER_BASE_TERMINATION-CAUSE_DIAMETER_LOGOUT').
+
+%% ===========================================================================
+
+suite() ->
+    [{timetrap, {seconds, 10}}].
+
+all() ->
+    [start,
+     start_services,
+     connect,
+     send_ok,
+     send_nok,
+     stop_services,
+     stop].
+
+%% ===========================================================================
+%% start/stop testcases
+
+start(_Config) ->
+    ok = diameter:start().
+
+start_services(_Config) ->
+    S = [server(N, ?DICT_COMMON) || N <- tl(?SERVICES)],
+
+    ok = diameter:start_service(?CLIENT, ?SERVICE(?CLIENT, ?DICT_COMMON)),
+
+    {save_config, [{?CLIENT, S}]}.
+
+connect(Config) ->
+    {_, Conns} = proplists:get_value(saved_config, Config),
+
+    lists:foreach(fun({CN,Ss}) -> connect(CN, Ss) end, Conns).
+
+stop_services(_Config) ->
+    [] = [{H,T} || H <- ?SERVICES,
+                   T <- [diameter:stop_service(H)],
+                   T /= ok].
+
+stop(_Config) ->
+    ok = diameter:stop().
+
+%% ----------------------------------------
+
+server(Name, Dict) ->
+    ok = diameter:start_service(Name, ?SERVICE(Name, Dict)),
+    {Name, ?util:listen(Name, tcp)}.
+
+connect(Name, Refs) ->
+    [{{Name, ?util:connect(Name, tcp, LRef)}, T} || {_, LRef} = T <- Refs].
+
+%% ===========================================================================
+%% traffic testcases
+
+%% Send an STR and expect success after SERVER3 answers after a couple
+%% of failovers.
+send_ok(_Config) ->
+    Req = ['STR', {'Destination-Realm', realm(?SERVER1)},
+                  {'Termination-Cause', ?LOGOUT},
+                  {'Auth-Application-Id', ?APP_ID}],
+    #diameter_base_STA{'Result-Code' = ?SUCCESS,
+                       'Origin-Host' = ?SERVER3}
+        = call(Req, [{filter, realm}]).
+
+%% Send an STR and expect failure when both servers fail.
+send_nok(_Config) ->
+    Req = ['STR', {'Destination-Realm', realm(?SERVER4)},
+                  {'Termination-Cause', ?LOGOUT},
+                  {'Auth-Application-Id', ?APP_ID}],
+    {error, failover} = call(Req, [{filter, realm}]).
+
+%% ===========================================================================
+
+realm(Host) ->
+    tl(lists:dropwhile(fun(C) -> C /= $. end, Host)).
+
+call(Req, Opts) ->
+    diameter:call(?CLIENT, ?APP_ALIAS, Req, Opts).
+    
+set([H|T], Vs) ->
+    [H | Vs ++ T].
+
+%% ===========================================================================
+%% diameter callbacks
+
+%% peer_up/3
+
+peer_up(_SvcName, _Peer, State) ->
+    State.
+
+%% peer_down/3
+
+peer_down(_SvcName, _Peer, State) ->
+    State.
+
+%% pick_peer/4
+
+%% Choose a server other than SERVER3 or SERVER5 if possible.
+pick_peer(Peers, _, ?CLIENT, _State) ->
+    case lists:partition(fun({_, #diameter_caps{origin_host = {_, OH}}}) ->
+                                 OH /= ?SERVER3 andalso OH /= ?SERVER5
+                         end,
+                         Peers)
+    of
+        {[], [Peer]} ->
+            {ok, Peer};
+        {[Peer | _], _} ->
+            {ok, Peer}
+    end.
+
+%% prepare_request/3
+
+prepare_request(Pkt, ?CLIENT, {_Ref, Caps}) ->
+    {send, prepare(Pkt, Caps)}.
+
+prepare(#diameter_packet{msg = Req}, Caps) ->
+    #diameter_caps{origin_host  = {OH, _},
+                   origin_realm = {OR, _}}
+        = Caps,
+    set(Req, [{'Session-Id', diameter:session_id(OH)},
+              {'Origin-Host',  OH},
+              {'Origin-Realm', OR}]).
+
+%% prepare_retransmit/3
+
+prepare_retransmit(Pkt, ?CLIENT, _Peer) ->
+    {send, Pkt}.
+
+%% handle_answer/4
+
+handle_answer(Pkt, _Req, ?CLIENT, _Peer) ->
+    #diameter_packet{msg = Rec, errors = []} = Pkt,
+    Rec.
+
+%% handle_error/4
+
+handle_error(Reason, _Req, ?CLIENT, _Peer) ->
+    {error, Reason}.
+
+%% handle_request/3
+
+%% Only SERVER3 actually answers.
+handle_request(Pkt, ?SERVER3, {_, Caps}) ->
+    #diameter_packet{msg = #diameter_base_STR{'Session-Id' = SId,
+                                              'Origin-Host' = ?CLIENT}}
+        = Pkt,
+    #diameter_caps{origin_host  = {OH, _},
+                   origin_realm = {OR, _}}
+        = Caps,
+
+    {reply, #diameter_base_STA{'Result-Code' = ?SUCCESS,
+                               'Session-Id' = SId,
+                               'Origin-Host' = OH,
+                               'Origin-Realm' = OR}};
+
+%% Others kill the transport to force failover.
+handle_request(_, _, {TPid, _}) ->
+    exit(TPid, kill),
+    discard.
diff --git a/lib/diameter/test/diameter_relay_SUITE.erl b/lib/diameter/test/diameter_relay_SUITE.erl
index d3d1fe690a..03f1115496 100644
--- a/lib/diameter/test/diameter_relay_SUITE.erl
+++ b/lib/diameter/test/diameter_relay_SUITE.erl
@@ -37,20 +37,22 @@
          all/0,
          groups/0,
          init_per_group/2,
-         end_per_group/2,
-         init_per_suite/1,
-         end_per_suite/1]).
+         end_per_group/2]).
 
 %% testcases
--export([send1/1,
+-export([start/1,
+         start_services/1,
+         connect/1,
+         send1/1,
          send2/1,
          send3/1,
          send4/1,
          send_loop/1,
          send_timeout_1/1,
          send_timeout_2/1,
-         remove_transports/1,
-         stop_services/1]).
+         disconnect/1,
+         stop_services/1,
+         stop/1]).
 
 %% diameter callbacks
 -export([peer_up/3,
@@ -73,6 +75,8 @@
 
 %% ===========================================================================
 
+-define(util, diameter_util).
+
 -define(ADDR, {127,0,0,1}).
 
 -define(CLIENT,  "CLIENT.REALM1").
@@ -83,6 +87,10 @@
 -define(SERVER3, "SERVER1.REALM3").
 -define(SERVER4, "SERVER2.REALM3").
 
+-define(SERVICES, [?CLIENT,
+                   ?RELAY1, ?RELAY2,
+                   ?SERVER1, ?SERVER2, ?SERVER3, ?SERVER4]).
+
 -define(DICT_COMMON,  ?DIAMETER_DICT_COMMON).
 -define(DICT_RELAY,   ?DIAMETER_DICT_RELAY).
 
@@ -102,19 +110,6 @@
                         {module, ?MODULE},
                         {answer_errors, callback}]}]).
 
-%% Config for diameter:add_transport/2. In the listening case, listen
-%% on a free port that we then lookup using the implementation detail
-%% that diameter_tcp registers the port with diameter_reg.
--define(CONNECT(PortNr),
-        {connect, [{transport_module, diameter_tcp},
-                   {transport_config, [{raddr, ?ADDR},
-                                       {rport, PortNr},
-                                       {ip, ?ADDR},
-                                       {port, 0}]}]}).
--define(LISTEN,
-        {listen, [{transport_module, diameter_tcp},
-                  {transport_config, [{ip, ?ADDR}, {port, 0}]}]}).
-
 -define(SUCCESS, 2001).
 -define(LOOP_DETECTED, 3005).
 -define(UNABLE_TO_DELIVER, 3002).
@@ -122,22 +117,21 @@
 -define(LOGOUT, ?'DIAMETER_BASE_TERMINATION-CAUSE_DIAMETER_LOGOUT').
 -define(AUTHORIZE_ONLY, ?'DIAMETER_BASE_RE-AUTH-REQUEST-TYPE_AUTHORIZE_ONLY').
 
--define(A, list_to_atom).
--define(L, atom_to_list).
-
 %% ===========================================================================
 
 suite() ->
     [{timetrap, {seconds, 10}}].
 
 all() ->
-    [{group, N} || {N, _, _} <- groups()]
-        ++ [remove_transports, stop_services].
+    [start, start_services, connect]
+        ++ tc()
+        ++ [{group, all},
+            disconnect,
+            stop_services,
+            stop].
 
 groups() ->
-    Ts = tc(),
-    [{all, [], Ts},
-     {p, [parallel], Ts}].
+    [{all, [parallel], tc()}].
 
 init_per_group(_, Config) ->
     Config.
@@ -145,32 +139,7 @@ init_per_group(_, Config) ->
 end_per_group(_, _) ->
     ok.
 
-init_per_suite(Config) ->
-    ok = diameter:start(),
-    [S1,S2,S3,S4] = S = [server(N, ?DICT_COMMON) || N <- [?SERVER1,
-                                                          ?SERVER2,
-                                                          ?SERVER3,
-                                                          ?SERVER4]],
-    [R1,R2] = R = [server(N, ?DICT_RELAY) || N <- [?RELAY1, ?RELAY2]],
-    
-    ok = diameter:start_service(?CLIENT, ?SERVICE(?CLIENT, ?DICT_COMMON)),
-
-    true = diameter:subscribe(?RELAY1),
-    true = diameter:subscribe(?RELAY2),
-    true = diameter:subscribe(?CLIENT),
-
-    [C1,C2] = connect(?RELAY1, [S1,S2]),
-    [C3,C4] = connect(?RELAY2, [S3,S4]),
-    [C5,C6] = connect(?CLIENT, [R1,R2]),
-
-    C7 = connect(?RELAY1, R2),
-
-    [{transports, {S, R, [C1,C2,C3,C4,C5,C6,C7]}} | Config].
-
-end_per_suite(_Config) ->
-    ok = diameter:stop().
-
-%% Testcases to run when services are started and connections
+%% Traffic cases run when services are started and connections
 %% established.
 tc() ->
     [send1,
@@ -181,43 +150,56 @@ tc() ->
      send_timeout_1,
      send_timeout_2].
 
-server(Host, Dict) ->
-    ok = diameter:start_service(Host, ?SERVICE(Host, Dict)),
-    {ok, LRef} = diameter:add_transport(Host, ?LISTEN),
-    {LRef, portnr(LRef)}.
-
-connect(Host, {_LRef, PortNr}) ->
-    {ok, Ref} = diameter:add_transport(Host, ?CONNECT(PortNr)),
-    ok = receive
-             #diameter_event{service = Host,
-                             info = {up, Ref, _, _, #diameter_packet{}}} ->
-                 ok
-         after 2000 ->
-                 false
-         end,
-    Ref;
-connect(Host, Ports) ->
-    [connect(Host, P) || P <- Ports].
-
-portnr(LRef) ->
-    portnr(LRef, 20).
-
-portnr(LRef, N)
-  when 0 < N ->
-    case diameter_reg:match({diameter_tcp, listener, {LRef, '_'}}) of
-        [{T, _Pid}] ->
-            {_, _, {LRef, {_Addr, LSock}}} = T,
-            {ok, PortNr} = inet:port(LSock),
-            PortNr;
-        [] ->
-            receive after 50 -> ok end,
-            portnr(LRef, N-1)
-    end.
+%% ===========================================================================
+%% start/stop testcases
 
-realm(Host) ->
-    tl(lists:dropwhile(fun(C) -> C /= $. end, Host)).
+start(_Config) ->
+    ok = diameter:start().
+
+start_services(_Config) ->
+    [S1,S2,S3,S4] = [server(N, ?DICT_COMMON) || N <- [?SERVER1,
+                                                      ?SERVER2,
+                                                      ?SERVER3,
+                                                      ?SERVER4]],
+    [R1,R2] = [server(N, ?DICT_RELAY) || N <- [?RELAY1, ?RELAY2]],
+
+    ok = diameter:start_service(?CLIENT, ?SERVICE(?CLIENT, ?DICT_COMMON)),
+
+    {save_config, [{?RELAY1, [S1,S2,R2]},
+                   {?RELAY2, [S3,S4]},
+                   {?CLIENT, [R1,R2]}]}.
+
+connect(Config) ->
+    {_, Conns} = proplists:get_value(saved_config, Config),
+
+    ?util:write_priv(Config,
+                     "cfg",
+                     lists:flatmap(fun({CN,Ss}) -> connect(CN, Ss) end,
+                                   Conns)).
+
+disconnect(Config) ->
+    lists:foreach(fun({{CN,CR},{SN,SR}}) -> ?util:disconnect(CN,CR,SN,SR) end,
+                  ?util:read_priv(Config, "cfg")).
+
+stop_services(_Config) ->
+    [] = [{H,T} || H <- ?SERVICES,
+                   T <- [diameter:stop_service(H)],
+                   T /= ok].
+
+stop(_Config) ->
+    ok = diameter:stop().
+
+%% ----------------------------------------
+
+server(Name, Dict) ->
+    ok = diameter:start_service(Name, ?SERVICE(Name, Dict)),
+    {Name, ?util:listen(Name, tcp)}.
+
+connect(Name, Refs) ->
+    [{{Name, ?util:connect(Name, tcp, LRef)}, T} || {_, LRef} = T <- Refs].
 
 %% ===========================================================================
+%% traffic testcases
 
 %% Send an STR intended for a specific server and expect success.
 send1(_Config) ->
@@ -254,40 +236,11 @@ send_timeout(Tmo) ->
                   {'Re-Auth-Request-Type', ?AUTHORIZE_ONLY}],
     call(Req, [{filter, realm}, {timeout, Tmo}]).
 
-%% Remove the client transports and expect the corresponding server
-%% transport to go down.
-remove_transports(Config) ->
-    {[S1,S2,S3,S4], [R1,R2], [C1,C2,C3,C4,C5,C6,C7]}
-        = proplists:get_value(transports, Config),
-
-    true = diameter:subscribe(?SERVER1),
-    true = diameter:subscribe(?SERVER2),
-    true = diameter:subscribe(?SERVER3),
-    true = diameter:subscribe(?SERVER4),
-    true = diameter:subscribe(?RELAY1),
-    true = diameter:subscribe(?RELAY2),
-
-    disconnect(S1, ?RELAY1, C1),
-    disconnect(S2, ?RELAY1, C2),
-    disconnect(S3, ?RELAY2, C3),
-    disconnect(S4, ?RELAY2, C4),
-    disconnect(R1, ?CLIENT, C5),
-    disconnect(R2, ?CLIENT, C6),
-    disconnect(R2, ?RELAY1, C7).
-
-disconnect({LRef, _PortNr}, Client, CRef) ->
-    ok = diameter:remove_transport(Client, CRef),
-    ok = receive #diameter_event{info = {down, LRef, _, _}} -> ok
-         after 2000 -> false
-         end.
-
-stop_services(_Config) ->
-    S = [?CLIENT, ?RELAY1, ?RELAY2, ?SERVER1, ?SERVER2, ?SERVER3, ?SERVER4],
-    Ok = [ok || _ <- S],
-    Ok = [diameter:stop_service(H) || H <- S].
-
 %% ===========================================================================
 
+realm(Host) ->
+    tl(lists:dropwhile(fun(C) -> C /= $. end, Host)).
+
 call(Server) ->
     Realm = realm(Server),
     Req = ['STR', {'Destination-Realm', Realm},
@@ -323,7 +276,7 @@ peer_down(_SvcName, _Peer, State) ->
 pick_peer([Peer | _], _, Svc, _State)
   when Svc == ?RELAY1;
        Svc == ?RELAY2;
-       Svc == ?CLIENT->
+       Svc == ?CLIENT ->
     {ok, Peer}.
 
 %% prepare_request/3
diff --git a/lib/diameter/test/diameter_tls_SUITE.erl b/lib/diameter/test/diameter_tls_SUITE.erl
new file mode 100644
index 0000000000..99f92ca0e0
--- /dev/null
+++ b/lib/diameter/test/diameter_tls_SUITE.erl
@@ -0,0 +1,411 @@
+%%
+%% %CopyrightBegin%
+%%
+%% Copyright Ericsson AB 2010-2011. All Rights Reserved.
+%%
+%% The contents of this file are subject to the Erlang Public License,
+%% Version 1.1, (the "License"); you may not use this file except in
+%% compliance with the License. You should have received a copy of the
+%% Erlang Public License along with this software. If not, it can be
+%% retrieved online at http://www.erlang.org/.
+%%
+%% Software distributed under the License is distributed on an "AS IS"
+%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+%% the License for the specific language governing rights and limitations
+%% under the License.
+%%
+%% %CopyrightEnd%
+%%
+
+%%
+%% Tests of traffic between six Diameter nodes connected as follows.
+%%
+%%                  ---- SERVER.REALM1  (TLS after capabilities exchange)
+%%                /
+%%               /  ---- SERVER.REALM2  (ditto)
+%%              | /
+%%   CLIENT.REALM0 ----- SERVER.REALM3  (no security)
+%%              | \
+%%               \  ---- SERVER.REALM4  (TLS at connection establishment)
+%%                \
+%%                  ---- SERVER.REALM5  (ditto)
+%%
+
+-module(diameter_tls_SUITE).
+
+-export([suite/0,
+         all/0,
+         groups/0,
+         init_per_group/2,
+         end_per_group/2,
+         init_per_suite/1,
+         end_per_suite/1]).
+
+%% testcases
+-export([start_ssl/1,
+         start_diameter/1,
+         make_certs/1, make_certs/0,
+         start_services/1,
+         add_transports/1,
+         send1/1,
+         send2/1,
+         send3/1,
+         send4/1,
+         send5/1,
+         remove_transports/1,
+         stop_services/1,
+         stop_diameter/1,
+         stop_ssl/1]).
+
+%% diameter callbacks
+-export([peer_up/3,
+         peer_down/3,
+         pick_peer/4,
+         prepare_request/3,
+         prepare_retransmit/3,
+         handle_answer/4,
+         handle_error/4,
+         handle_request/3]).
+
+-ifdef(DIAMETER_CT).
+-include("diameter_gen_base_rfc3588.hrl").
+-else.
+-include_lib("diameter/include/diameter_gen_base_rfc3588.hrl").
+-endif.
+
+-include_lib("diameter/include/diameter.hrl").
+-include("diameter_ct.hrl").
+
+%% ===========================================================================
+
+-define(util, diameter_util).
+
+-define(ADDR, {127,0,0,1}).
+
+-define(CLIENT,  "CLIENT.REALM0").
+-define(SERVER1, "SERVER.REALM1").
+-define(SERVER2, "SERVER.REALM2").
+-define(SERVER3, "SERVER.REALM3").
+-define(SERVER4, "SERVER.REALM4").
+-define(SERVER5, "SERVER.REALM5").
+
+-define(SERVERS, [?SERVER1, ?SERVER2, ?SERVER3, ?SERVER4, ?SERVER5]).
+
+-define(DICT_COMMON,  ?DIAMETER_DICT_COMMON).
+
+-define(APP_ALIAS, the_app).
+-define(APP_ID, ?DICT_COMMON:id()).
+
+-define(NO_INBAND_SECURITY, 0).
+-define(TLS, 1).
+
+%% Config for diameter:start_service/2.
+-define(SERVICE(Host, Dict),
+        [{'Origin-Host', Host},
+         {'Origin-Realm', realm(Host)},
+         {'Host-IP-Address', [?ADDR]},
+         {'Vendor-Id', 12345},
+         {'Product-Name', "OTP/diameter"},
+         {'Inband-Security-Id', [?NO_INBAND_SECURITY]},
+         {'Auth-Application-Id', [Dict:id()]},
+         {application, [{alias, ?APP_ALIAS},
+                        {dictionary, Dict},
+                        {module, ?MODULE},
+                        {answer_errors, callback}]}]).
+
+%% Config for diameter:add_transport/2. In the listening case, listen
+%% on a free port that we then lookup using the implementation detail
+%% that diameter_tcp registers the port with diameter_reg.
+-define(CONNECT(PortNr, Caps, Opts),
+        {connect, [{transport_module, diameter_tcp},
+                   {transport_config, [{raddr, ?ADDR},
+                                       {rport, PortNr},
+                                       {ip, ?ADDR},
+                                       {port, 0}
+                                       | Opts]},
+                   {capabilities, Caps}]}).
+-define(LISTEN(Caps, Opts),
+        {listen, [{transport_module, diameter_tcp},
+                  {transport_config, [{ip, ?ADDR}, {port, 0} | Opts]},
+                  {capabilities, Caps}]}).
+
+-define(SUCCESS, 2001).
+-define(LOGOUT, ?'DIAMETER_BASE_TERMINATION-CAUSE_DIAMETER_LOGOUT').
+
+%% ===========================================================================
+
+suite() ->
+    [{timetrap, {seconds, 10}}].
+
+all() ->
+    [start_ssl,
+     start_diameter,
+     make_certs,
+     start_services,
+     add_transports]
+        ++ [{group, N} || {N, _, _} <- groups()]
+        ++ [remove_transports, stop_services, stop_diameter, stop_ssl].
+
+groups() ->
+    Ts = tc(),
+    [{all, [], Ts},
+     {p, [parallel], Ts}].
+
+init_per_group(_, Config) ->
+    Config.
+
+end_per_group(_, _) ->
+    ok.
+
+init_per_suite(Config) ->
+    case os:find_executable("openssl") of
+        false ->
+            {skip, no_openssl};
+        _ ->
+            Config
+    end.
+
+end_per_suite(_Config) ->
+    ok.
+
+%% Testcases to run when services are started and connections
+%% established.
+tc() ->
+    [send1,
+     send2,
+     send3,
+     send4,
+     send5].
+
+%% ===========================================================================
+%% testcases
+
+start_ssl(_Config) ->
+    ok = ssl:start().
+
+start_diameter(_Config) ->
+    ok = diameter:start().
+
+make_certs() ->
+    [{timetrap, {seconds, 30}}].
+
+make_certs(Config) ->
+    Dir = proplists:get_value(priv_dir, Config),
+
+    [] = ?util:run([[fun make_cert/2, Dir, B] || B <- ["server1",
+                                                       "server2",
+                                                       "server4",
+                                                       "server5",
+                                                       "client"]]).
+
+start_services(Config) ->
+    Dir = proplists:get_value(priv_dir, Config),
+    Servers = [server(S, sopts(S, Dir)) || S <- ?SERVERS],
+
+    ok = diameter:start_service(?CLIENT, ?SERVICE(?CLIENT, ?DICT_COMMON)),
+
+    {save_config, [Dir | Servers]}.
+
+add_transports(Config) ->
+    {_, [Dir | Servers]} = proplists:get_value(saved_config, Config),
+
+    true = diameter:subscribe(?CLIENT),
+
+    Opts = ssl_options(Dir, "client"),
+    Connections = [connect(?CLIENT, S, copts(N, Opts))
+                   || {S,N} <- lists:zip(Servers, ?SERVERS)],
+
+    ?util:write_priv(Config, "cfg", lists:zip(Servers, Connections)).
+
+
+%% Remove the client transports and expect the corresponding server
+%% transport to go down.
+remove_transports(Config) ->
+    Ts = ?util:read_priv(Config, "cfg"),
+    [] = [T || S <- ?SERVERS, T <- [diameter:subscribe(S)], T /= true],
+    lists:map(fun disconnect/1, Ts).
+
+stop_services(_Config) ->
+    [] = [{H,T} || H <- [?CLIENT | ?SERVERS],
+                   T <- [diameter:stop_service(H)],
+                   T /= ok].
+
+stop_diameter(_Config) ->
+    ok = diameter:stop().
+
+stop_ssl(_Config) ->
+    ok = ssl:stop().
+
+%% Send an STR intended for a specific server and expect success.
+send1(_Config) ->
+    call(?SERVER1).
+send2(_Config) ->
+    call(?SERVER2).
+send3(_Config) ->
+    call(?SERVER3).
+send4(_Config) ->
+    call(?SERVER4).
+send5(_Config) ->
+    call(?SERVER5).
+
+%% ===========================================================================
+%% diameter callbacks
+
+%% peer_up/3
+
+peer_up(_SvcName, _Peer, State) ->
+    State.
+
+%% peer_down/3
+
+peer_down(_SvcName, _Peer, State) ->
+    State.
+
+%% pick_peer/4
+
+pick_peer([Peer], _, ?CLIENT, _State) ->
+    {ok, Peer}.
+
+%% prepare_request/3
+
+prepare_request(#diameter_packet{msg = Req},
+                ?CLIENT,
+                {_Ref, Caps}) ->
+    #diameter_caps{origin_host  = {OH, _},
+                   origin_realm = {OR, _}}
+        = Caps,
+
+    {send, set(Req, [{'Session-Id', diameter:session_id(OH)},
+                     {'Origin-Host',  OH},
+                     {'Origin-Realm', OR}])}.
+
+%% prepare_retransmit/3
+
+prepare_retransmit(_Pkt, false, _Peer) ->
+    discard.
+
+%% handle_answer/4
+
+handle_answer(Pkt, _Req, ?CLIENT, _Peer) ->
+    #diameter_packet{msg = Rec, errors = []} = Pkt,
+    Rec.
+
+%% handle_error/4
+
+handle_error(Reason, _Req, ?CLIENT, _Peer) ->
+    {error, Reason}.
+
+%% handle_request/3
+
+handle_request(#diameter_packet{msg = #diameter_base_STR{'Session-Id' = SId}},
+               OH,
+               {_Ref, #diameter_caps{origin_host = {OH,_},
+                                     origin_realm = {OR, _}}})
+  when OH /= ?CLIENT ->
+    {reply, #diameter_base_STA{'Result-Code' = ?SUCCESS,
+                               'Session-Id' = SId,
+                               'Origin-Host' = OH,
+                               'Origin-Realm' = OR}}.
+
+%% ===========================================================================
+%% support functions
+
+call(Server) ->
+    Realm = realm(Server),
+    Req = ['STR', {'Destination-Realm', Realm},
+                  {'Termination-Cause', ?LOGOUT},
+                  {'Auth-Application-Id', ?APP_ID}],
+    #diameter_base_STA{'Result-Code' = ?SUCCESS,
+                       'Origin-Host' = Server,
+                       'Origin-Realm' = Realm}
+        = call(Req, [{filter, realm}]).
+
+call(Req, Opts) ->
+    diameter:call(?CLIENT, ?APP_ALIAS, Req, Opts).
+
+set([H|T], Vs) ->
+    [H | Vs ++ T].
+
+disconnect({{LRef, _PortNr}, CRef}) ->
+    ok = diameter:remove_transport(?CLIENT, CRef),
+    ok = receive #diameter_event{info = {down, LRef, _, _}} -> ok
+         after 2000 -> false
+         end.
+
+realm(Host) ->
+    tl(lists:dropwhile(fun(C) -> C /= $. end, Host)).
+
+inband_security(Ids) ->
+    [{'Inband-Security-Id', Ids}].
+
+ssl_options(Dir, Base) ->
+    Root = filename:join([Dir, Base]),
+    [{ssl_options, [{certfile, Root ++ "_ca.pem"},
+                    {keyfile,  Root ++ "_key.pem"}]}].
+
+make_cert(Dir, Base) ->
+    make_cert(Dir, Base ++ "_key.pem", Base ++ "_ca.pem").
+
+make_cert(Dir, Keyfile, Certfile) ->
+    [K,C] = Paths = [filename:join([Dir, F]) || F <- [Keyfile, Certfile]],
+
+    KCmd = join(["openssl genrsa -out", K, "2048"]),
+    CCmd = join(["openssl req -new -x509 -key", K, "-out", C, "-days 7",
+                 "-subj /C=SE/ST=./L=Stockholm/CN=www.erlang.org"]),
+
+    %% Hope for the best and only check that files are written.
+    os:cmd(KCmd),
+    os:cmd(CCmd),
+
+    [_,_] = [T || P <- Paths, {ok, T} <- [file:read_file_info(P)]],
+
+    {K,C}.
+
+join(Strs) ->
+    string:join(Strs, " ").
+
+%% server/2
+
+server(Host, {Caps, Opts}) ->
+    ok = diameter:start_service(Host, ?SERVICE(Host, ?DICT_COMMON)),
+    {ok, LRef} = diameter:add_transport(Host, ?LISTEN(Caps, Opts)),
+    {LRef, hd([_] = ?util:lport(tcp, LRef, 20))}.
+
+sopts(?SERVER1, Dir) ->
+    {inband_security([?TLS]),
+     ssl_options(Dir, "server1")};
+sopts(?SERVER2, Dir) ->
+    {inband_security([?NO_INBAND_SECURITY, ?TLS]),
+     ssl_options(Dir, "server2")};
+sopts(?SERVER3, _) ->
+    {[], []};
+sopts(?SERVER4, Dir) ->
+    {[], ssl(ssl_options(Dir, "server4"))};
+sopts(?SERVER5, Dir) ->
+    {[], ssl(ssl_options(Dir, "server5"))}.
+
+ssl([{ssl_options = T, Opts}]) ->
+    [{T, true} | Opts].
+
+%% connect/3
+
+connect(Host, {_LRef, PortNr}, {Caps, Opts}) ->
+    {ok, Ref} = diameter:add_transport(Host, ?CONNECT(PortNr, Caps, Opts)),
+    ok = receive
+             #diameter_event{service = Host,
+                             info = {up, Ref, _, _, #diameter_packet{}}} ->
+                 ok
+         after 2000 ->
+                 false
+         end,
+    Ref.
+
+copts(S, Opts)
+  when S == ?SERVER1;
+       S == ?SERVER2;
+       S == ?SERVER3 ->
+    {inband_security([?NO_INBAND_SECURITY, ?TLS]), Opts};
+copts(S, Opts)
+  when S == ?SERVER4;
+       S == ?SERVER5 ->
+    {[], ssl(Opts)}.
diff --git a/lib/diameter/src/app/depend.sed b/lib/diameter/test/diameter_tls_SUITE_data/Makefile.ca
index 9df0133960..3f2645add0 100644
--- a/lib/diameter/src/app/depend.sed
+++ b/lib/diameter/test/diameter_tls_SUITE_data/Makefile.ca
@@ -1,7 +1,7 @@
-#
+# -*- makefile -*-
 # %CopyrightBegin%
 #
-# Copyright Ericsson AB 2010-2011. All Rights Reserved.
+# Copyright Ericsson AB 2011. All Rights Reserved.
 #
 # The contents of this file are subject to the Erlang Public License,
 # Version 1.1, (the "License"); you may not use this file except in
@@ -15,17 +15,29 @@
 # under the License.
 #
 # %CopyrightEnd%
-#
 
 #
-# Extract include dependencies from .erl files. The output is massaged
-# further in Makefile.
+# Certificates are now generated from the suite itself but the
+# makefile itself is still useful.
 #
 
-/^-include/!d
-/"diameter/!d
+KEYS  = $(HOSTS:%=%_key.pem)
+CERTS = $(HOSTS:%=%_ca.pem)
+
+all: $(CERTS)
+
+%_ca.pem: %_key.pem
+	openssl req -new -x509 -key $< -out $@ -days 1095 \
+	            -subj '/C=SE/ST=./L=Stockholm/CN=www.erlang.org'
+
+%_key.pem:
+	openssl genrsa -out $@ 2048
+
+clean:
+	rm -f $(CERTS)
+
+realclean: clean
+	rm -f $(KEYS)
 
-s@^-include_lib("[^/]*@$(DIAMETER_TOP)@
-s@^-include("@@
-s@".*@@
-s@^@$(EBIN)/.$(EMULATOR): @
+.PRECIOUS: $(KEYS)
+.PHONY: all clean realclean
diff --git a/lib/diameter/test/diameter_traffic_SUITE.erl b/lib/diameter/test/diameter_traffic_SUITE.erl
index 8c85323222..6704f24532 100644
--- a/lib/diameter/test/diameter_traffic_SUITE.erl
+++ b/lib/diameter/test/diameter_traffic_SUITE.erl
@@ -26,15 +26,16 @@
 -export([suite/0,
          all/0,
          groups/0,
-         init_per_suite/1,
-         end_per_suite/1,
          init_per_group/2,
          end_per_group/2,
          init_per_testcase/2,
          end_per_testcase/2]).
 
 %% testcases
--export([result_codes/1,
+-export([start/1,
+         start_services/1,
+         add_transports/1,
+         result_codes/1,
          send_ok/1,
          send_arbitrary/1,
          send_unknown/1,
@@ -73,7 +74,8 @@
          send_multiple_filters_3/1,
          send_anything/1,
          remove_transports/1,
-         stop_services/1]).
+         stop_services/1,
+         stop/1]).
 
 %% diameter callbacks
 -export([peer_up/3,
@@ -96,6 +98,8 @@
 
 %% ===========================================================================
 
+-define(util, diameter_util).
+
 -define(ADDR, {127,0,0,1}).
 
 -define(CLIENT, "CLIENT").
@@ -123,19 +127,6 @@
                         {module, ?MODULE},
                         {answer_errors, callback}]}]).
 
-%% Config for diameter:add_transport/2. In the listening case, listen
-%% on a free port that we then lookup using the implementation detail
-%% that diameter_tcp registers the port with diameter_reg.
--define(CONNECT(PortNr),
-        {connect, [{transport_module, diameter_tcp},
-                   {transport_config, [{raddr, ?ADDR},
-                                       {rport, PortNr},
-                                       {ip, ?ADDR},
-                                       {port, 0}]}]}).
--define(LISTEN,
-        {listen, [{transport_module, diameter_tcp},
-                  {transport_config, [{ip, ?ADDR}, {port, 0}]}]}).
-
 -define(SUCCESS,
         ?'DIAMETER_BASE_RESULT-CODE_DIAMETER_SUCCESS').
 -define(COMMAND_UNSUPPORTED,
@@ -177,30 +168,18 @@ suite() ->
     [{timetrap, {seconds, 10}}].
 
 all() ->
-    [result_codes | [{group, N} || {N, _, _} <- groups()]]
-        ++ [remove_transports, stop_services].
+    [start, start_services, add_transports, result_codes
+     | [{group, N} || {N, _, _} <- groups()]]
+        ++ [remove_transports, stop_services, stop].
 
 groups() ->
     Ts = tc(),
-    [{E, [], Ts} || E <- ?ENCODINGS]
-        ++ [{?P(E), [parallel], Ts} || E <- ?ENCODINGS].
+    [{grp(E,P), P, Ts} || E <- ?ENCODINGS, P <- [[], [parallel]]].
 
-init_per_suite(Config) ->
-    ok = diameter:start(),
-    ok = diameter:start_service(?SERVER, ?SERVICE(?SERVER)),
-    ok = diameter:start_service(?CLIENT, ?SERVICE(?CLIENT)),
-    {ok, LRef} = diameter:add_transport(?SERVER, ?LISTEN),
-    true = diameter:subscribe(?CLIENT),
-    {ok, CRef} = diameter:add_transport(?CLIENT, ?CONNECT(portnr())),
-    {up, CRef, _Peer, _Config, #diameter_packet{}}
-        = receive #diameter_event{service = ?CLIENT, info = I} -> I
-          after 2000 -> false
-          end,
-    true = diameter:unsubscribe(?CLIENT),
-    [{transports, {LRef, CRef}} | Config].
-
-end_per_suite(_Config) ->
-    ok = diameter:stop().
+grp(E, []) ->
+    E;
+grp(E, [parallel]) ->
+    ?P(E).
 
 init_per_group(Name, Config) ->
     E = case ?L(Name) of
@@ -261,20 +240,31 @@ tc() ->
      send_multiple_filters_3,
      send_anything].
 
-portnr() ->
-    portnr(20).
-
-portnr(N)
-  when 0 < N ->
-    case diameter_reg:match({diameter_tcp, listener, '_'}) of
-        [{T, _Pid}] ->
-            {_, _, {_LRef, {_Addr, LSock}}} = T,
-            {ok, PortNr} = inet:port(LSock),
-            PortNr;
-        [] ->
-            receive after 50 -> ok end,
-            portnr(N-1)
-    end.
+%% ===========================================================================
+%% start/stop testcases
+
+start(_Config) ->
+    ok = diameter:start().
+
+start_services(_Config) ->
+    ok = diameter:start_service(?SERVER, ?SERVICE(?SERVER)),
+    ok = diameter:start_service(?CLIENT, ?SERVICE(?CLIENT)).
+
+add_transports(Config) ->
+    LRef = ?util:listen(?SERVER, tcp),
+    CRef = ?util:connect(?CLIENT, tcp, LRef),
+    ?util:write_priv(Config, "transport", {LRef, CRef}).
+
+remove_transports(Config) ->
+    {LRef, CRef} = ?util:read_priv(Config, "transport"),
+    ?util:disconnect(?CLIENT, CRef, ?SERVER, LRef).
+
+stop_services(_Config) ->
+    ok = diameter:stop_service(?CLIENT),
+    ok = diameter:stop_service(?SERVER).
+
+stop(_Config) ->
+    ok = diameter:stop().
 
 %% ===========================================================================
 
@@ -532,21 +522,6 @@ send_anything(Config) ->
     #diameter_base_STA{'Result-Code' = ?SUCCESS}
         = call(Config, anything).
     
-%% Remove the client transport and expect the server transport to
-%% go down.
-remove_transports(Config) ->
-    {LRef, CRef} = proplists:get_value(transports, Config),
-    true = diameter:subscribe(?SERVER),
-    ok = diameter:remove_transport(?CLIENT, CRef),
-    {down, LRef, _, _}
-        = receive #diameter_event{service = ?SERVER, info = I} -> I
-          after 2000 -> false
-          end.
-
-stop_services(_Config) ->
-    {ok, ok} = {diameter:stop_service(?CLIENT),
-                diameter:stop_service(?SERVER)}.
-
 %% ===========================================================================
 
 call(Config, Req) ->
diff --git a/lib/diameter/test/diameter_transport_SUITE.erl b/lib/diameter/test/diameter_transport_SUITE.erl
index d545859fe8..a9520ef5bd 100644
--- a/lib/diameter/test/diameter_transport_SUITE.erl
+++ b/lib/diameter/test/diameter_transport_SUITE.erl
@@ -33,10 +33,12 @@
          end_per_suite/1]).
 
 %% testcases
--export([tcp_accept/1,
+-export([start/1,
+         tcp_accept/1,
          tcp_connect/1,
          sctp_accept/1,
-         sctp_connect/1]).
+         sctp_connect/1,
+         stop/1]).
 
 -export([accept/1,
          connect/1,
@@ -67,16 +69,6 @@
                                       = #diameter_caps{host_ip_address
                                                        = Addrs}}).
 
-%% The term diameter_tcp/sctp registers after opening a listening
-%% socket. This is an implementation detail that should probably be
-%% replaced by some documented way of getting at the port number of
-%% the listening socket, which is what we're after since we specify
-%% port 0 to get something unused.
--define(TCP_LISTENER(Ref, Addr, LSock),
-        {diameter_tcp, listener, {Ref, {Addr, LSock}}}).
--define(SCTP_LISTENER(Ref, Addr, LSock),
-        {diameter_sctp, listener, {Ref, {[Addr], LSock}}}).
-
 %% The term we register after open a listening port with gen_tcp.
 -define(TEST_LISTENER(Ref, PortNr),
         {?MODULE, listen, Ref, PortNr}).
@@ -101,7 +93,7 @@ suite() ->
     [{timetrap, {minutes, 2}}].
 
 all() ->
-    [{group, all} | tc()].
+    [start | tc()] ++ [{group, all}, stop].
 
 groups() ->
     [{all, [parallel], tc()}].
@@ -119,10 +111,17 @@ end_per_group(_, _) ->
     ok.
 
 init_per_suite(Config) ->
-    ok = diameter:start(),
     [{sctp, have_sctp()} | Config].
 
 end_per_suite(_Config) ->
+    ok.
+
+%% ===========================================================================
+
+start(_Config) ->
+    ok = diameter:start().
+
+stop(_Config) ->
     ok = diameter:stop().
 
 %% ===========================================================================
@@ -180,7 +179,9 @@ have_sctp() ->
     try gen_sctp:open() of
         {ok, Sock} ->
             gen_sctp:close(Sock),
-            true
+            true;
+        {error, eprotonosupport} ->  %% fail on any other reason
+            false
     catch
         error: badarg ->
             false
@@ -216,7 +217,7 @@ init(accept, {Prot, Ref}) ->
 
 init(gen_connect, {Prot, Ref}) ->
     %% Lookup the peer's listening socket.
-    {ok, PortNr} = inet:port(lsock(Prot, Ref)),
+    [PortNr] = ?util:lport(Prot, Ref, 20),
 
     %% Connect, send a message and receive it back.
     {ok, Sock} = gen_connect(Prot, PortNr, Ref),
@@ -253,22 +254,16 @@ init(connect, {Prot, Ref}) ->
     MRef = erlang:monitor(process, TPid),
     ?RECV({'DOWN', MRef, process, _, _}).
 
-lsock(sctp, Ref) ->
-    [{?SCTP_LISTENER(_ , _, LSock), _}]
-        = match(?SCTP_LISTENER(Ref, ?ADDR, '_')),
-    LSock;
-lsock(tcp, Ref) ->
-    [{?TCP_LISTENER(_ , _, LSock), _}]
-        = match(?TCP_LISTENER(Ref, ?ADDR, '_')),
-    LSock.
-
 match(Pat) ->
-    case diameter_reg:match(Pat) of
-        [] ->
+    match(Pat, 20).
+
+match(Pat, T) ->
+    L = diameter_reg:match(Pat),
+    if [] /= L orelse 1 == T ->
+            L;
+       true ->
             ?WAIT(50),
-            match(Pat);
-        L ->
-            L
+            match(Pat, T-1)
     end.
 
 bin(sctp, #diameter_packet{bin = Bin}) ->
@@ -332,7 +327,7 @@ start_accept(Prot, Ref) ->
 
     %% Configure the same port number for transports on the same
     %% reference.
-    PortNr = portnr(Prot, Ref),
+    [PortNr | _] = ?util:lport(Prot, Ref) ++ [0],
     {Mod, Opts} = tmod(Prot),
 
     try
@@ -362,23 +357,6 @@ tmod(sctp) ->
 tmod(tcp) ->
     {diameter_tcp, []}.
 
-portnr(sctp, Ref) ->
-    case diameter_reg:match(?SCTP_LISTENER(Ref, ?ADDR, '_')) of
-        [{?SCTP_LISTENER(_, _, LSock), _}] ->
-            {ok, N} = inet:port(LSock),
-            N;
-        [] ->
-            0
-    end;
-portnr(tcp, Ref) ->
-    case diameter_reg:match(?TCP_LISTENER(Ref, ?ADDR, '_')) of
-        [{?TCP_LISTENER(_, _, LSock), _}] ->
-            {ok, N} = inet:port(LSock),
-            N;
-        [] ->
-            0
-    end.
-
 %% ===========================================================================
 
 %% gen_connect/3
diff --git a/lib/diameter/test/diameter_util.erl b/lib/diameter/test/diameter_util.erl
index 99f4fa1977..3fe8ea5363 100644
--- a/lib/diameter/test/diameter_util.erl
+++ b/lib/diameter/test/diameter_util.erl
@@ -23,15 +23,28 @@
 %% Utility functions.
 %%
 
+%% generic
 -export([consult/2,
          run/1,
          fold/3,
          foldl/3,
-         scramble/1,
-         ps/0]).
+         scramble/1]).
+
+%% diameter-specific
+-export([lport/2,
+         lport/3,
+         listen/2,
+         connect/3,
+         disconnect/4]).
+
+%% common_test-specific
+-export([write_priv/3,
+         read_priv/2,
+         map_priv/3]).
 
 -define(L, atom_to_list).
 
+%% ---------------------------------------------------------------------------
 %% consult/2
 %%
 %% Extract info from the app/appup file (presumably) of the named
@@ -56,6 +69,7 @@ consult(Path) ->
 %% Name/Path in the return value distinguish the errors and allow for
 %% a useful badmatch.
 
+%% ---------------------------------------------------------------------------
 %% run/1
 %%
 %% Evaluate functions in parallel and return a list of those that
@@ -71,6 +85,7 @@ cons(true, _, _, Acc) ->
 cons(false, F, RC, Acc) ->
     [{F, RC} | Acc].
 
+%% ---------------------------------------------------------------------------
 %% fold/3
 %%
 %% Parallel fold. Results are folded in the order received.
@@ -116,6 +131,7 @@ down(MRef) ->
 down() ->
     receive {'DOWN', MRef, process, _, Reason} -> {MRef, Reason} end.
 
+%% ---------------------------------------------------------------------------
 %% foldl/3
 %%
 %% Parallel fold. Results are folded in order of the function list.
@@ -131,6 +147,7 @@ recvl([{MRef, F} | L], Ref, Fun, Acc) ->
     R = down(MRef),
     recvl(L, Ref, Fun, acc(R, Ref, F, Fun, Acc)).
 
+%% ---------------------------------------------------------------------------
 %% scramble/1
 %%
 %% Sort a list into random order.
@@ -150,12 +167,10 @@ s(Acc, L) ->
     {H, [T|Rest]} = lists:split(random:uniform(length(L)) - 1, L),
     s([T|Acc], H ++ Rest).
 
-%% ps/0
-
-ps() ->
-    [{P, process_info(P)} || P <- erlang:processes()].
-
+%% ---------------------------------------------------------------------------
 %% eval/1
+%%
+%% Evaluate a function in one of a number of forms.
 
 eval({M,[F|A]})
   when is_atom(F) ->
@@ -175,3 +190,127 @@ eval(L)
 eval(F)
   when is_function(F,0) ->
     F().
+
+%% ---------------------------------------------------------------------------
+%% write_priv/3
+%%
+%% Write an arbitrary term to a named file.
+
+write_priv(Config, Name, Term) ->
+    write(path(Config, Name), Term).
+
+write(Path, Term) ->
+    ok = file:write_file(Path, term_to_binary(Term)).
+
+%% read_priv/2
+%%
+%% Read a term from a file.
+
+read_priv(Config, Name) ->
+    read(path(Config, Name)).
+
+read(Path) ->
+    {ok, Bin} = file:read_file(Path),
+    binary_to_term(Bin).
+    
+%% map_priv/3
+%%
+%% Modify a term in a file and return both old and new values.
+
+map_priv(Config, Name, Fun1) ->
+    map(path(Config, Name), Fun1).
+
+map(Path, Fun1) ->
+    T0 = read(Path),
+    T1 = Fun1(T0),
+    write(Path, T1),
+    {T0, T1}.
+
+path(Config, Name)
+  when is_atom(Name) ->
+    path(Config, ?L(Name));
+path(Config, Name) ->
+    Dir = proplists:get_value(priv_dir, Config),
+    filename:join([Dir, Name]).
+
+%% ---------------------------------------------------------------------------
+%% lport/2-3
+%%
+%% Lookup the port number of a tcp/sctp listening transport.
+
+lport(M, Ref) ->
+    lport(M, Ref, 1).
+
+lport(M, Ref, Tries) ->
+    lp(tmod(M), Ref, Tries).
+
+lp(M, Ref, T) ->
+    L = [N || {listen, N, _} <- M:ports(Ref)],
+    if [] /= L orelse T =< 1 ->
+            L;
+       true ->
+            receive after 50 -> ok end,
+            lp(M, Ref, T-1)
+    end.
+
+%% ---------------------------------------------------------------------------
+%% listen/2
+%%
+%% Add a listening transport on the loopback address and a free port.
+
+listen(SvcName, Prot) ->
+    add_transport(SvcName, {listen, opts(Prot, listen)}).
+
+%% ---------------------------------------------------------------------------
+%% connect/3
+%%
+%% Add a connecting transport on and connect to a listening transport
+%% with the specified reference.
+
+connect(Client, Prot, LRef) ->
+    [PortNr] = lport(Prot, LRef, 20),
+    Ref = add_transport(Client, {connect, opts(Prot, PortNr)}),
+    true = diameter:subscribe(Client),
+    ok = receive
+             {diameter_event, Client, {up, Ref, _, _, _}} -> ok
+         after 2000 ->
+                 {Client, Prot, PortNr, process_info(self(), messages)}
+         end,
+    Ref.
+
+%% ---------------------------------------------------------------------------
+%% disconnect/4
+%%
+%% Remove the client transport and expect the server transport to go
+%% down.
+
+disconnect(Client, Ref, Server, LRef) ->
+    true = diameter:subscribe(Server),
+    ok = diameter:remove_transport(Client, Ref),
+    ok = receive
+             {diameter_event, Server, {down, LRef, _, _}} -> ok
+         after 2000 ->
+                 {Client, Ref, Server, LRef, process_info(self(), messages)}
+         end.
+
+%% ---------------------------------------------------------------------------
+
+-define(ADDR, {127,0,0,1}).
+
+add_transport(SvcName, T) ->
+    {ok, Ref} = diameter:add_transport(SvcName, T),
+    Ref.
+
+tmod(tcp) ->
+    diameter_tcp;
+tmod(sctp) ->
+    diameter_sctp.
+
+opts(Prot, T) ->
+    [{transport_module, tmod(Prot)},
+     {transport_config, [{ip, ?ADDR}, {port, 0} | opts(T)]}].
+
+opts(listen) ->
+    [];
+opts(PortNr) ->
+    [{raddr, ?ADDR}, {rport, PortNr}].
diff --git a/lib/diameter/test/modules.mk b/lib/diameter/test/modules.mk
index c6f709dc36..75fdd0bd1d 100644
--- a/lib/diameter/test/modules.mk
+++ b/lib/diameter/test/modules.mk
@@ -34,7 +34,9 @@ MODULES = \
 	diameter_watchdog_SUITE \
 	diameter_transport_SUITE \
 	diameter_traffic_SUITE \
-	diameter_relay_SUITE
+	diameter_relay_SUITE \
+	diameter_tls_SUITE \
+	diameter_failover_SUITE
 
-INTERNAL_HRL_FILES = \
+HRL_FILES = \
 	diameter_ct.hrl