Merge tag 'OTP-19.0' into sverker/19/binary_to_atom-utf8-crash/ERL-474/OTP-14590

48 files changed, 7081 insertions, 4915 deletions

diff --git a/lib/ssh/src/Makefile b/lib/ssh/src/Makefile
index 93d0b54f57..69d5a47f83 100644
--- a/lib/ssh/src/Makefile
+++ b/lib/ssh/src/Makefile
@@ -1,18 +1,19 @@
 #
 # %CopyrightBegin%
 #
-# Copyright Ericsson AB 2004-2013. All Rights Reserved.
+# Copyright Ericsson AB 2004-2016. All Rights Reserved.
 #
-# The contents of this file are subject to the Erlang Public License,
-# Version 1.1, (the "License"); you may not use this file except in
-# compliance with the License. You should have received a copy of the
-# Erlang Public License along with this software. If not, it can be
-# retrieved online at http://www.erlang.org/.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
 #
-# Software distributed under the License is distributed on an "AS IS"
-# basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-# the License for the specific language governing rights and limitations
-# under the License.
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 #
 # %CopyrightEnd%
 #
@@ -53,7 +54,7 @@ MODULES= \
 	ssh_connection_sup \
 	ssh_connection \
 	ssh_connection_handler \
-	ssh_connection_manager \
+	ssh_dbg \
 	ssh_shell \
 	ssh_system_sup \
 	ssh_subsystem_sup \
@@ -66,16 +67,16 @@ MODULES= \
 	ssh_cli \
 	ssh_file \
 	ssh_io \
-	ssh_math \
+	ssh_info \
+	ssh_message \
 	ssh_no_io \
 	ssh_sftp \
 	ssh_sftpd \
 	ssh_sftpd_file\
 	ssh_transport \
-	ssh_userreg \
 	ssh_xfer
 
-PUBLIC_HRL_FILES= ssh.hrl ssh_userauth.hrl ssh_xfer.hrl
+HRL_FILES =
 
 ERL_FILES= \
 	$(MODULES:%=%.erl) \
@@ -95,7 +96,7 @@ APP_TARGET= $(EBIN)/$(APP_FILE)
 APPUP_SRC= $(APPUP_FILE).src
 APPUP_TARGET= $(EBIN)/$(APPUP_FILE)
 
-INTERNAL_HRL_FILES = ssh_auth.hrl ssh_connect.hrl ssh_transport.hrl
+INTERNAL_HRL_FILES = ssh_auth.hrl ssh_connect.hrl ssh_transport.hrl ssh.hrl ssh_userauth.hrl ssh_xfer.hrl
 
 # ----------------------------------------------------
 # FLAGS
@@ -116,7 +117,7 @@ $(TARGET_FILES): $(BEHAVIOUR_TARGET_FILES)
 debug opt: $(TARGET_FILES) $(APP_TARGET) $(APPUP_TARGET)
 
 clean:
-	rm -f $(TARGET_FILES) $(APP_TARGET) $(APPUP_TARGET)
+	rm -f $(TARGET_FILES) $(APP_TARGET) $(APPUP_TARGET) $(BEHAVIOUR_TARGET_FILES)
 	rm -f errs core *~
 
 $(APP_TARGET):	$(APP_SRC) ../vsn.mk
@@ -140,7 +141,82 @@ release_spec: opt
 	$(INSTALL_DATA) $(BEHAVIOUR_TARGET_FILES) $(TARGET_FILES) $(APP_TARGET) \
 	$(APPUP_TARGET) "$(RELSYSDIR)/ebin"
 	$(INSTALL_DIR) "$(RELSYSDIR)/include"
-	$(INSTALL_DATA) $(PUBLIC_HRL_FILES) "$(RELSYSDIR)/include"
+
 
 release_docs_spec:
 
+
+deps:
+	erlc -M $(ERL_FILES) \
+	| sed 's@$(ERL_TOP)/lib@../..@g' \
+	| sed 's/\.$(EMULATOR)/\.$$\(EMULATOR\)/' \
+	| sed 's@^ssh_@$$(EBIN)/ssh_@'
+
+ssh.$(EMULATOR): ssh.erl ssh.hrl ssh_connect.hrl \
+  ../../public_key/include/public_key.hrl \
+  ../../public_key/include/OTP-PUB-KEY.hrl \
+  ../../public_key/include/PKCS-FRAME.hrl \
+  ../../kernel/include/file.hrl
+$(EBIN)/ssh_sup.$(EMULATOR): ssh_sup.erl
+sshc_sup.$(EMULATOR): sshc_sup.erl
+sshd_sup.$(EMULATOR): sshd_sup.erl ssh.hrl
+$(EBIN)/ssh_connection_sup.$(EMULATOR): ssh_connection_sup.erl
+$(EBIN)/ssh_connection.$(EMULATOR): ssh_connection.erl ssh.hrl ssh_connect.hrl \
+  ssh_transport.hrl
+$(EBIN)/ssh_connection_handler.$(EMULATOR): ssh_connection_handler.erl ssh.hrl \
+  ssh_transport.hrl ssh_auth.hrl ssh_connect.hrl
+$(EBIN)/ssh_shell.$(EMULATOR): ssh_shell.erl ssh_connect.hrl
+$(EBIN)/ssh_system_sup.$(EMULATOR): ssh_system_sup.erl ssh.hrl
+$(EBIN)/ssh_subsystem_sup.$(EMULATOR): ssh_subsystem_sup.erl
+$(EBIN)/ssh_channel_sup.$(EMULATOR): ssh_channel_sup.erl
+$(EBIN)/ssh_acceptor_sup.$(EMULATOR): ssh_acceptor_sup.erl ssh.hrl
+$(EBIN)/ssh_acceptor.$(EMULATOR): ssh_acceptor.erl ssh.hrl
+$(EBIN)/ssh_app.$(EMULATOR): ssh_app.erl
+$(EBIN)/ssh_auth.$(EMULATOR): ssh_auth.erl \
+  ../../public_key/include/public_key.hrl \
+  ../../public_key/include/OTP-PUB-KEY.hrl \
+  ../../public_key/include/PKCS-FRAME.hrl \
+  ssh.hrl ssh_auth.hrl ssh_transport.hrl
+$(EBIN)/ssh_bits.$(EMULATOR): ssh_bits.erl ssh.hrl
+$(EBIN)/ssh_cli.$(EMULATOR): ssh_cli.erl ssh.hrl ssh_connect.hrl
+$(EBIN)/ssh_file.$(EMULATOR): ssh_file.erl \
+  ../../public_key/include/public_key.hrl \
+  ../../public_key/include/OTP-PUB-KEY.hrl \
+  ../../public_key/include/PKCS-FRAME.hrl \
+  ../../kernel/include/file.hrl ssh.hrl
+$(EBIN)/ssh_io.$(EMULATOR): ssh_io.erl ssh.hrl
+$(EBIN)/ssh_info.$(EMULATOR): ssh_info.erl
+$(EBIN)/ssh_message.$(EMULATOR): ssh_message.erl \
+  ../../public_key/include/public_key.hrl \
+  ../../public_key/include/OTP-PUB-KEY.hrl \
+  ../../public_key/include/PKCS-FRAME.hrl \
+  ssh.hrl ssh_connect.hrl ssh_auth.hrl ssh_transport.hrl
+$(EBIN)/ssh_no_io.$(EMULATOR): ssh_no_io.erl ssh_transport.hrl
+$(EBIN)/ssh_sftp.$(EMULATOR): ssh_sftp.erl \
+  ../../kernel/include/file.hrl ssh.hrl \
+  ssh_xfer.hrl
+$(EBIN)/ssh_sftpd.$(EMULATOR): ssh_sftpd.erl \
+  ../../kernel/include/file.hrl ssh.hrl \
+  ssh_xfer.hrl
+$(EBIN)/ssh_sftpd_file.$(EMULATOR): ssh_sftpd_file.erl
+$(EBIN)/ssh_transport.$(EMULATOR): ssh_transport.erl \
+  ../../public_key/include/public_key.hrl \
+  ../../public_key/include/OTP-PUB-KEY.hrl \
+  ../../public_key/include/PKCS-FRAME.hrl \
+  ../../kernel/include/inet.hrl \
+  ssh_transport.hrl ssh.hrl
+$(EBIN)/ssh_xfer.$(EMULATOR): ssh_xfer.erl ssh.hrl ssh_xfer.hrl
+$(EBIN)/ssh_sftpd_file_api.$(EMULATOR): ssh_sftpd_file_api.erl
+$(EBIN)/ssh_channel.$(EMULATOR): ssh_channel.erl ssh_connect.hrl
+$(EBIN)/ssh_daemon_channel.$(EMULATOR): ssh_daemon_channel.erl
+$(EBIN)/ssh_client_key_api.$(EMULATOR): ssh_client_key_api.erl \
+  ../../public_key/include/public_key.hrl \
+  ../../public_key/include/OTP-PUB-KEY.hrl \
+  ../../public_key/include/PKCS-FRAME.hrl \
+  ssh.hrl
+$(EBIN)/ssh_server_key_api.$(EMULATOR): ssh_server_key_api.erl \
+  ../../public_key/include/public_key.hrl \
+  ../../public_key/include/OTP-PUB-KEY.hrl \
+  ../../public_key/include/PKCS-FRAME.hrl \
+  ssh.hrl
+
diff --git a/lib/ssh/src/ssh.app.src b/lib/ssh/src/ssh.app.src
index 49707f3378..3245ba5197 100644
--- a/lib/ssh/src/ssh.app.src
+++ b/lib/ssh/src/ssh.app.src
@@ -8,6 +8,7 @@
 	     ssh_acceptor,
 	     ssh_acceptor_sup,
 	     ssh_auth,
+	     ssh_message,
 	     ssh_bits,
 	     ssh_cli,
              ssh_client_key_api,
@@ -15,15 +16,15 @@
 	     ssh_channel_sup,
 	     ssh_connection,
 	     ssh_connection_handler,
-	     ssh_connection_manager,
 	     ssh_connection_sup,
 	     ssh_daemon_channel,
+	     ssh_dbg,
 	     ssh_shell,
 	     sshc_sup,
 	     sshd_sup,
 	     ssh_file,
 	     ssh_io,
-	     ssh_math,
+	     ssh_info,
 	     ssh_no_io,
              ssh_server_key_api,
 	     ssh_sftp,
@@ -34,11 +35,17 @@
 	     ssh_sup,
 	     ssh_system_sup,
 	     ssh_transport,
-	     ssh_userreg,
 	     ssh_xfer]},
   {registered, []},
   {applications, [kernel, stdlib, crypto, public_key]},
   {env, []},
-  {mod, {ssh_app, []}}]}.
+  {mod, {ssh_app, []}},
+  {runtime_dependencies, [
+			  "crypto-3.3",
+			  "erts-6.0",
+			  "kernel-3.0",
+			  "public_key-1.1",
+			  "stdlib-3.0"
+			 ]}]}.
 
 
diff --git a/lib/ssh/src/ssh.appup.src b/lib/ssh/src/ssh.appup.src
index 32f7cc470b..e38cecf226 100644
--- a/lib/ssh/src/ssh.appup.src
+++ b/lib/ssh/src/ssh.appup.src
@@ -1,31 +1,28 @@
-%%
+%% -*- erlang -*-
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2004-2013. All Rights Reserved.
+%% Copyright Ericsson AB 2004-2015. All Rights Reserved.
+%%
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%%     http://www.apache.org/licenses/LICENSE-2.0
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
 
 {"%VSN%",	
  [
-  {<<"2.1\\.*">>, [{restart_application, ssh}]},
-  {<<"2.0\\.*">>, [{restart_application, ssh}]},
-  {<<"1\\.*">>, [{restart_application, ssh}]}
+  {<<".*">>, [{restart_application, ssh}]}
  ],
  [
-  {<<"2.1\\.*">>,[{restart_application, ssh}]},
-  {<<"2.0\\.*">>, [{restart_application, ssh}]},
-  {<<"1\\.*">>, [{restart_application, ssh}]}
+  {<<".*">>, [{restart_application, ssh}]}
  ]
 }.
diff --git a/lib/ssh/src/ssh.erl b/lib/ssh/src/ssh.erl
index 7d5478c3f6..0570853a9b 100644
--- a/lib/ssh/src/ssh.erl
+++ b/lib/ssh/src/ssh.erl
@@ -1,18 +1,19 @@
-%%
+%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2004-2013. All Rights Reserved.
+%% Copyright Ericsson AB 2004-2016. All Rights Reserved.
+%%
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%%     http://www.apache.org/licenses/LICENSE-2.0
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
@@ -24,17 +25,28 @@
 -include("ssh.hrl").
 -include("ssh_connect.hrl").
 -include_lib("public_key/include/public_key.hrl").
+-include_lib("kernel/include/file.hrl").
 
--export([start/0, start/1, stop/0, connect/3, connect/4, close/1, connection_info/2,
+-export([start/0, start/1, stop/0,
+	 connect/2, connect/3, connect/4,
+	 close/1, connection_info/2,
 	 channel_info/3,
 	 daemon/1, daemon/2, daemon/3,
-	 stop_listener/1, stop_listener/2, stop_daemon/1, stop_daemon/2,
-	 shell/1, shell/2, shell/3]).
+	 daemon_info/1,
+	 default_algorithms/0,
+	 stop_listener/1, stop_listener/2,  stop_listener/3,
+	 stop_daemon/1, stop_daemon/2, stop_daemon/3,
+	 shell/1, shell/2, shell/3
+	]).
+
+%%% Type exports
+-export_type([connection_ref/0,
+	      channel_id/0
+	     ]).
 
 %%--------------------------------------------------------------------
-%% Function: start([, Type]) -> ok
-%%
-%%  Type =  permanent | transient | temporary
+-spec start() -> ok | {error, term()}.
+-spec start(permanent | transient | temporary) -> ok | {error, term()}.
 %%
 %% Description: Starts the ssh application. Default type
 %% is temporary. see application(3)
@@ -52,7 +64,7 @@ start(Type) ->
     application:start(ssh, Type).
 
 %%--------------------------------------------------------------------
-%% Function: stop() -> ok
+-spec stop() -> ok | {error, term()}.
 %%
 %% Description: Stops the ssh application.
 %%--------------------------------------------------------------------
@@ -60,134 +72,121 @@ stop() ->
     application:stop(ssh).
 
 %%--------------------------------------------------------------------
-%% Function: connect(Host, Port, Options) -> 
-%%           connect(Host, Port, Options, Timeout -> ConnectionRef | {error, Reason}
-%% 
-%%	Host - string()
-%%	Port - integer()
-%%	Options - [{Option, Value}]
-%%      Timeout - infinity | integer().
+-spec connect(port(), proplists:proplist()) -> {ok, pid()} |  {error, term()}.
+
+-spec connect(port(),   proplists:proplist(), timeout()) -> {ok, pid()} |  {error, term()}
+           ; (string(), integer(), proplists:proplist()) -> {ok, pid()} |  {error, term()}.
+
+-spec connect(string(), integer(), proplists:proplist(), timeout()) -> {ok, pid()} |  {error, term()}.
 %%
 %% Description: Starts an ssh connection.
 %%--------------------------------------------------------------------
-connect(Host, Port, Options) ->
+connect(Socket, Options) ->
+    connect(Socket, Options, infinity).
+
+connect(Socket, Options, Timeout) when is_port(Socket) ->
+    case handle_options(Options) of
+	{error, Error} ->
+	    {error, Error};
+	{_SocketOptions, SshOptions} ->
+	    case valid_socket_to_use(Socket, Options) of
+		ok -> 
+		    {ok, {Host,_Port}} = inet:sockname(Socket),
+		    Opts =  [{user_pid,self()}, {host,fmt_host(Host)} | SshOptions],
+		    ssh_connection_handler:start_connection(client, Socket, Opts, Timeout);
+		{error,SockError} ->
+		    {error,SockError}
+	    end
+    end;
+
+connect(Host, Port, Options) when is_integer(Port), Port>0 ->
     connect(Host, Port, Options, infinity).
+
 connect(Host, Port, Options, Timeout) ->
     case handle_options(Options) of
 	{error, _Reason} = Error ->
 	    Error;
 	{SocketOptions, SshOptions} ->
-	    DisableIpv6 =  proplists:get_value(ipv6_disabled, SshOptions, false),
-	    Inet = inetopt(DisableIpv6),
-	    do_connect(Host, Port, [Inet | SocketOptions], 
-		       [{user_pid, self()}, {host, Host} | fix_idle_time(SshOptions)], Timeout, DisableIpv6)
+	    {_, Transport, _} = TransportOpts =
+		proplists:get_value(transport, Options, {tcp, gen_tcp, tcp_closed}),
+	    ConnectionTimeout = proplists:get_value(connect_timeout, Options, infinity),
+	    try Transport:connect(Host, Port,  [ {active, false} | SocketOptions], ConnectionTimeout) of
+		{ok, Socket} ->
+		    Opts =  [{user_pid,self()}, {host,Host} | SshOptions],
+		    ssh_connection_handler:start_connection(client, Socket, Opts, Timeout);
+		{error, Reason} ->
+		    {error, Reason}
+	    catch
+		exit:{function_clause, _} ->
+		    {error, {options, {transport, TransportOpts}}};
+		exit:badarg ->
+		    {error, {options, {socket_options, SocketOptions}}}
+	    end
     end.
 
-do_connect(Host, Port, SocketOptions, SshOptions, Timeout, DisableIpv6) ->
-    try sshc_sup:start_child([[{address, Host}, {port, Port}, 
-			       {role, client},
-			       {channel_pid, self()},
-			       {socket_opts, SocketOptions}, 
-			       {ssh_opts, SshOptions}]]) of 
- 	{ok, ConnectionSup} ->
-	    {ok, Manager} = 
-		ssh_connection_sup:connection_manager(ConnectionSup),
-	    msg_loop(Manager, DisableIpv6, Host, Port, SocketOptions, SshOptions, Timeout)
-    catch 
-	exit:{noproc, _} ->
- 	    {error, ssh_not_started}
-    end.
-msg_loop(Manager, DisableIpv6, Host, Port, SocketOptions, SshOptions, Timeout) ->
-    receive 
-	{Manager, is_connected} ->
-	    {ok, Manager};
-	%% When the connection fails 
-	%% ssh_connection_sup:connection_manager
-	%% might return undefined as the connection manager
-	%% could allready have terminated, so we will not
-	%% match the Manager in this case
-	{_, not_connected, {error, econnrefused}} when DisableIpv6 == false ->
-	    do_connect(Host, Port, proplists:delete(inet6, SocketOptions), 
-		       SshOptions, Timeout, true);
-	{_, not_connected, {error, Reason}} ->
-	    {error, Reason};
-	{_, not_connected, Other} ->
-	    {error, Other};
-	{From, user_password} ->
-	    Pass = io:get_password(),
-	    From ! Pass,
-	    msg_loop(Manager, DisableIpv6, Host, Port, SocketOptions, SshOptions, Timeout);
-	{From, question} ->
-	    Answer = io:get_line(""),
-	    From ! Answer,
-	    msg_loop(Manager, DisableIpv6, Host, Port, SocketOptions, SshOptions, Timeout)
-    after Timeout  ->
-	    ssh_connection_manager:stop(Manager),
-	    {error, timeout}
-    end.
 %%--------------------------------------------------------------------
-%% Function: close(ConnectionRef) -> ok
+-spec close(pid()) -> ok.
 %%
 %% Description: Closes an ssh connection.
 %%--------------------------------------------------------------------	
 close(ConnectionRef) ->
-    ssh_connection_manager:stop(ConnectionRef).
+    ssh_connection_handler:stop(ConnectionRef).
 
 %%--------------------------------------------------------------------
-%% Function: connection_info(ConnectionRef) -> [{Option, Value}]
+-spec connection_info(pid(), [atom()]) -> [{atom(), term()}].
 %%
 %% Description: Retrieves information about a connection. 
 %%--------------------------------------------------------------------	
 connection_info(ConnectionRef, Options) ->
-    ssh_connection_manager:connection_info(ConnectionRef, Options).
+    ssh_connection_handler:connection_info(ConnectionRef, Options).
 
 %%--------------------------------------------------------------------
-%% Function: channel_info(ConnectionRef) -> [{Option, Value}]
+-spec channel_info(pid(), channel_id(), [atom()]) -> [{atom(), term()}].
 %%
 %% Description: Retrieves information about a connection. 
 %%--------------------------------------------------------------------	
 channel_info(ConnectionRef, ChannelId, Options) ->
-    ssh_connection_manager:channel_info(ConnectionRef, ChannelId, Options).
+    ssh_connection_handler:channel_info(ConnectionRef, ChannelId, Options).
 
 %%--------------------------------------------------------------------
-%% Function: daemon(Port) ->
-%%           daemon(Port, Options) ->
-%%           daemon(Address, Port, Options) -> SshSystemRef
-%%
+-spec daemon(integer()) -> {ok, pid()} | {error, term()}.
+-spec daemon(integer()|port(), proplists:proplist()) -> {ok, pid()} | {error, term()}.
+-spec daemon(any | inet:ip_address(), integer(), proplists:proplist()) -> {ok, pid()} | {error, term()}.
+
 %% Description: Starts a server listening for SSH connections 
 %% on the given port.
 %%--------------------------------------------------------------------	
 daemon(Port) ->
     daemon(Port, []).
 
-daemon(Port, Options) ->
-    daemon(any, Port, Options).
+daemon(Port, Options) when is_integer(Port) ->
+    daemon(any, Port, Options);
+
+daemon(Socket, Options0) when is_port(Socket) ->
+    Options = daemon_shell_opt(Options0),
+    start_daemon(Socket, Options).
 
 daemon(HostAddr, Port, Options0) ->
-    Options1 = case proplists:get_value(shell, Options0) of
-		   undefined ->
-		       [{shell, {shell, start, []}}  | Options0];
-		   _ ->
-		       Options0
-	       end,
-    DisableIpv6 =  proplists:get_value(ipv6_disabled, Options0, false),
-    {Host, Inet, Options} = case HostAddr of
-				any ->
-				    {ok, Host0} = inet:gethostname(), 
-				    {Host0, inetopt(DisableIpv6), Options1};
-				{_,_,_,_} ->
-				    {HostAddr, inet, 
-				     [{ip, HostAddr} | Options1]};
-				{_,_,_,_,_,_,_,_} ->
-				    {HostAddr, inet6, 
-				     [{ip, HostAddr} | Options1]}
-			    end,
+    Options1 = daemon_shell_opt(Options0),
+    {Host, Inet, Options} = daemon_host_inet_opt(HostAddr, Options1),
     start_daemon(Host, Port, Options, Inet).
 
 %%--------------------------------------------------------------------
-%% Function: stop_listener(SysRef) -> ok
-%%           stop_listener(Address, Port) -> ok
-%%
+daemon_info(Pid) ->
+    case catch ssh_system_sup:acceptor_supervisor(Pid) of
+	AsupPid when is_pid(AsupPid) ->
+	    [Port] =
+		[Prt || {{ssh_acceptor_sup,any,Prt,default},
+			 _WorkerPid,worker,[ssh_acceptor]} <- supervisor:which_children(AsupPid)],
+	    {ok, [{port,Port}]};
+
+	_ ->
+	    {error,bad_daemon_ref}
+    end.
+
+%%--------------------------------------------------------------------
+-spec stop_listener(pid()) -> ok.
+-spec stop_listener(inet:ip_address(), integer()) -> ok.
 %%
 %% Description: Stops the listener, but leaves 
 %% existing connections started by the listener up and running.
@@ -195,12 +194,13 @@ daemon(HostAddr, Port, Options0) ->
 stop_listener(SysSup) ->
     ssh_system_sup:stop_listener(SysSup).
 stop_listener(Address, Port) ->
-    ssh_system_sup:stop_listener(Address, Port).
+    stop_listener(Address, Port, ?DEFAULT_PROFILE).
+stop_listener(Address, Port, Profile) ->
+    ssh_system_sup:stop_listener(Address, Port, Profile).
 
 %%--------------------------------------------------------------------
-%% Function: stop_daemon(SysRef) -> ok
-%%%          stop_daemon(Address, Port) -> ok
-%%
+-spec stop_daemon(pid()) -> ok.
+-spec stop_daemon(inet:ip_address(), integer()) -> ok.
 %%
 %% Description: Stops the listener and all connections started by 
 %% the listener.
@@ -208,12 +208,14 @@ stop_listener(Address, Port) ->
 stop_daemon(SysSup) ->
     ssh_system_sup:stop_system(SysSup).
 stop_daemon(Address, Port) ->
-    ssh_system_sup:stop_system(Address, Port).
-
+    ssh_system_sup:stop_system(Address, Port, ?DEFAULT_PROFILE).
+stop_daemon(Address, Port, Profile) ->
+    ssh_system_sup:stop_system(Address, Port, Profile).
 %%--------------------------------------------------------------------
-%% Function: shell(Host [,Port,Options]) -> {ok, ConnectionRef} | 
-%%                                                     {error, Reason}
-%%
+-spec shell(port() | string()) ->  _.
+-spec shell(port() | string(), proplists:proplist()) ->  _.
+-spec shell(string(), integer(), proplists:proplist()) ->  _.
+
 %%   Host = string()
 %%   Port = integer()
 %%   Options = [{Option, Value}]
@@ -223,83 +225,281 @@ stop_daemon(Address, Port) ->
 %% and will not return until the remote shell is ended.(e.g. on
 %% exit from the shell)
 %%--------------------------------------------------------------------
+shell(Socket) when is_port(Socket) ->
+    shell(Socket, []);
 shell(Host) ->
     shell(Host, ?SSH_DEFAULT_PORT, []).
+
+shell(Socket, Options) when is_port(Socket) ->
+    start_shell( connect(Socket, Options) );
 shell(Host, Options) ->
     shell(Host, ?SSH_DEFAULT_PORT, Options).
+
 shell(Host, Port, Options) ->
-    case connect(Host, Port, Options) of
-	{ok, ConnectionRef} ->
-	    case ssh_connection:session_channel(ConnectionRef, infinity) of
-		{ok,ChannelId}  ->
-		    Args = [{channel_cb, ssh_shell}, 
-			    {init_args,[ConnectionRef, ChannelId]},
-			    {cm, ConnectionRef}, {channel_id, ChannelId}],
-		    {ok, State} = ssh_channel:init([Args]),
-		    ssh_channel:enter_loop(State);
-		Error ->
-		    Error
-	    end;
+    start_shell( connect(Host, Port, Options) ).
+
+
+start_shell({ok, ConnectionRef}) ->
+    case ssh_connection:session_channel(ConnectionRef, infinity) of
+	{ok,ChannelId}  ->
+	    success = ssh_connection:ptty_alloc(ConnectionRef, ChannelId, []),
+	    Args = [{channel_cb, ssh_shell}, 
+		    {init_args,[ConnectionRef, ChannelId]},
+		    {cm, ConnectionRef}, {channel_id, ChannelId}],
+	    {ok, State} = ssh_channel:init([Args]),
+	    ssh_channel:enter_loop(State);
 	Error ->
 	    Error
-    end.
+    end;
+start_shell(Error) ->
+    Error.
+
+%%--------------------------------------------------------------------
+%%--------------------------------------------------------------------
+default_algorithms() -> 
+    ssh_transport:default_algorithms().
 
 %%--------------------------------------------------------------------
 %%% Internal functions
 %%--------------------------------------------------------------------
-fix_idle_time(SshOptions) ->
-    case proplists:get_value(idle_time, SshOptions) of
-	undefined ->
-	    [{idle_time, infinity}|SshOptions];
-	_ ->
-	    SshOptions
+valid_socket_to_use(Socket, Options) ->
+    case proplists:get_value(transport, Options, {tcp, gen_tcp, tcp_closed}) of
+	{tcp,_,_} ->
+	    %% Is this tcp-socket a valid socket?
+	    case {is_tcp_socket(Socket),
+		  {ok,[{active,false}]} == inet:getopts(Socket, [active])
+		 }
+	    of
+		{true, true} ->
+		    ok;
+		{true, false} ->
+		    {error, not_passive_mode};
+		_ ->
+		    {error, not_tcp_socket}
+	    end;
+	{L4,_,_} ->
+	    {error, {unsupported,L4}}
     end.
+
+is_tcp_socket(Socket) -> {ok,[]} =/= inet:getopts(Socket, [delay_send]).
+
+
+
+daemon_shell_opt(Options) ->
+     case proplists:get_value(shell, Options) of
+	 undefined ->
+	     [{shell, {shell, start, []}}  | Options];
+	 _ ->
+	     Options
+     end.
+
+daemon_host_inet_opt(HostAddr, Options1) ->
+    case HostAddr of
+	any ->
+	    {ok, Host0} = inet:gethostname(), 
+	    {Host0,  proplists:get_value(inet, Options1, inet), Options1};
+	{_,_,_,_} ->
+	    {HostAddr, inet, 
+	     [{ip, HostAddr} | Options1]};
+	{_,_,_,_,_,_,_,_} ->
+	    {HostAddr, inet6, 
+	     [{ip, HostAddr} | Options1]}
+    end.
+
+
+start_daemon(Socket, Options) ->
+    case handle_options(Options) of
+	{error, Error} ->
+	    {error, Error};
+	{SocketOptions, SshOptions} ->
+	    case valid_socket_to_use(Socket, Options) of
+		ok -> 
+		    try 
+			do_start_daemon(Socket, [{role,server}|SshOptions], SocketOptions)
+		    catch
+			throw:bad_fd -> {error,bad_fd};
+			_C:_E -> {error,{cannot_start_daemon,_C,_E}}
+		    end;
+		{error,SockError} ->
+		    {error,SockError}
+	    end
+    end.
+
 start_daemon(Host, Port, Options, Inet) ->
     case handle_options(Options) of
 	{error, _Reason} = Error ->
 	    Error;
 	{SocketOptions, SshOptions}->
-	    do_start_daemon(Host, Port,[{role, server} |SshOptions] , [Inet | SocketOptions])
+	    try 
+		do_start_daemon(Host, Port, [{role,server}|SshOptions] , [Inet|SocketOptions])
+	    catch
+		throw:bad_fd -> {error,bad_fd};
+		_C:_E -> {error,{cannot_start_daemon,_C,_E}}
+	    end
     end.
     
-do_start_daemon(Host, Port, Options, SocketOptions) ->
-    case ssh_system_sup:system_supervisor(Host, Port) of
+do_start_daemon(Socket, SshOptions, SocketOptions) ->
+    {ok, {IP,Port}} = 
+	try {ok,_} = inet:sockname(Socket)
+	catch
+	    _:_ -> throw(bad_socket)
+	end,
+    Host = fmt_host(IP),
+    Profile = proplists:get_value(profile, SshOptions, ?DEFAULT_PROFILE),
+    Opts = [{asocket, Socket},
+	    {asock_owner,self()},
+	    {address, Host},
+	    {port, Port},
+	    {role, server},
+	    {socket_opts, SocketOptions}, 
+	    {ssh_opts, SshOptions}],
+    {_, Callback, _} = proplists:get_value(transport, SshOptions, {tcp, gen_tcp, tcp_closed}),
+    case ssh_system_sup:system_supervisor(Host, Port, Profile) of
+	undefined ->
+	    %% It would proably make more sense to call the
+	    %% address option host but that is a too big change at the
+	    %% monent. The name is a legacy name!
+	    try sshd_sup:start_child(Opts) of
+		{error, {already_started, _}} ->
+		    {error, eaddrinuse};
+		Result = {ok,_} ->
+		    ssh_acceptor:handle_connection(Callback, Host, Port, Opts, Socket),
+		    Result;
+		Result = {error, _} ->
+		    Result
+	    catch
+		exit:{noproc, _} ->
+		    {error, ssh_not_started}
+	    end;
+	Sup  ->
+	    AccPid = ssh_system_sup:acceptor_supervisor(Sup),
+	    case ssh_acceptor_sup:start_child(AccPid, Opts) of
+		{error, {already_started, _}} ->
+		    {error, eaddrinuse};
+		{ok, _} ->
+		    ssh_acceptor:handle_connection(Callback, Host, Port, Opts, Socket),
+		    {ok, Sup};
+		Other ->
+		    Other
+	    end
+    end.
+
+do_start_daemon(Host0, Port0, SshOptions, SocketOptions) ->
+    {Host,Port1} = 
+	try
+	    case proplists:get_value(fd, SocketOptions) of
+		undefined ->
+		    {Host0,Port0};
+		Fd when Port0==0 ->
+		    find_hostport(Fd);
+		_ ->
+		    {Host0,Port0}
+	    end
+	catch
+	    _:_ -> throw(bad_fd)
+	end,
+    Profile = proplists:get_value(profile, SshOptions, ?DEFAULT_PROFILE),
+    {Port, WaitRequestControl, Opts0} =
+	case Port1 of
+	    0 -> %% Allocate the socket here to get the port number...
+		{_, Callback, _} =  
+		    proplists:get_value(transport, SshOptions, {tcp, gen_tcp, tcp_closed}),
+		{ok,LSock} = ssh_acceptor:callback_listen(Callback, 0, SocketOptions),
+		{ok,{_,LPort}} = inet:sockname(LSock),
+		{LPort, 
+		 {LSock,Callback}, 
+		 [{lsocket,LSock},{lsock_owner,self()}]
+		};
+	    _ ->
+		{Port1, false, []}
+	end,
+    Opts = [{address, Host}, 
+	    {port, Port},
+	    {role, server},
+	    {socket_opts, SocketOptions}, 
+	    {ssh_opts, SshOptions} | Opts0],
+    case ssh_system_sup:system_supervisor(Host, Port, Profile) of
 	undefined ->
 	    %% It would proably make more sense to call the
 	    %% address option host but that is a too big change at the
 	    %% monent. The name is a legacy name!
-	    try sshd_sup:start_child([{address, Host}, 
-				      {port, Port}, {role, server},
-				      {socket_opts, SocketOptions}, 
-				      {ssh_opts, Options}]) of
-		{ok, SysSup} ->
-		    {ok, SysSup};
+	    try sshd_sup:start_child(Opts) of
 		{error, {already_started, _}} ->
 		    {error, eaddrinuse};
-		{error, R} ->
-		    {error, R}
+		Result = {ok,_} ->
+		    sync_request_control(WaitRequestControl),
+		    Result;
+		Result = {error, _} ->
+		    Result
 	    catch
 		exit:{noproc, _} ->
 		    {error, ssh_not_started}
 	    end;
 	Sup  ->
-	    case ssh_system_sup:restart_acceptor(Host, Port) of
+	    AccPid = ssh_system_sup:acceptor_supervisor(Sup),
+	    case ssh_acceptor_sup:start_child(AccPid, Opts) of
+		{error, {already_started, _}} ->
+		    {error, eaddrinuse};
 		{ok, _} ->
+		    sync_request_control(WaitRequestControl),
 		    {ok, Sup};
-		_  ->
-		    {error, eaddrinuse}
+		Other ->
+		    Other
 	    end
     end.
 
+sync_request_control(false) ->
+    ok;
+sync_request_control({LSock,Callback}) ->
+    receive
+	{request_control,LSock,ReqPid} ->
+	    ok = Callback:controlling_process(LSock, ReqPid),
+	    ReqPid ! {its_yours,LSock},
+	    ok
+    end.
+
+find_hostport(Fd) ->
+    %% Using internal functions inet:open/8 and inet:close/0.
+    %% Don't try this at home unless you know what you are doing!
+    {ok,S} = inet:open(Fd, {0,0,0,0}, 0, [], tcp, inet, stream, inet_tcp),
+    {ok, HostPort} = inet:sockname(S),
+    ok = inet:close(S),
+    HostPort.
+    
+
 handle_options(Opts) ->
-    try handle_option(proplists:unfold(Opts), [], []) of
-	{_,_} = Options ->
-	    Options
+    try handle_option(algs_compatibility(proplists:unfold(Opts)), [], []) of
+	{Inet, Ssh} ->
+	    {handle_ip(Inet), Ssh}
     catch
 	throw:Error ->
 	    Error
     end.
 
+
+algs_compatibility(Os0) ->
+    %% Take care of old options 'public_key_alg' and 'pref_public_key_algs'
+    case proplists:get_value(public_key_alg, Os0) of
+	undefined -> 
+	    Os0;
+	A when is_atom(A) -> 
+	    %% Skip public_key_alg if pref_public_key_algs is defined:
+	    Os = lists:keydelete(public_key_alg, 1, Os0),
+	    case proplists:get_value(pref_public_key_algs,Os) of
+		undefined when A == 'ssh-rsa' ; A==ssh_rsa ->
+		    [{pref_public_key_algs,['ssh-rsa','ssh-dss']} | Os];
+		undefined when A == 'ssh-dss' ; A==ssh_dsa ->
+		    [{pref_public_key_algs,['ssh-dss','ssh-rsa']} | Os];
+		undefined ->
+		    throw({error, {eoptions, {public_key_alg,A} }});
+		_ -> 
+		    Os
+	    end;
+	V ->
+	    throw({error, {eoptions, {public_key_alg,V} }})
+    end.
+
+
 handle_option([], SocketOptions, SshOptions) ->
     {SocketOptions, SshOptions};
 handle_option([{system_dir, _} = Opt | Rest], SocketOptions, SshOptions) ->
@@ -312,8 +512,6 @@ handle_option([{silently_accept_hosts, _} = Opt | Rest], SocketOptions, SshOptio
     handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
 handle_option([{user_interaction, _} = Opt | Rest], SocketOptions, SshOptions) ->
     handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
-handle_option([{public_key_alg, _} = Opt | Rest], SocketOptions, SshOptions) ->
-    handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
 handle_option([{connect_timeout, _} = Opt | Rest], SocketOptions, SshOptions) ->
     handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
 handle_option([{user, _} = Opt | Rest], SocketOptions, SshOptions) ->
@@ -328,11 +526,13 @@ handle_option([{user_passwords, _} = Opt | Rest], SocketOptions, SshOptions) ->
     handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
 handle_option([{pwdfun, _} = Opt | Rest], SocketOptions, SshOptions) ->
     handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
-handle_option([{key_cb, _} = Opt | Rest], SocketOptions, SshOptions) ->
-    handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
-handle_option([{role, _} = Opt | Rest], SocketOptions, SshOptions) ->
-    handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
-handle_option([{compression, _} = Opt | Rest], SocketOptions, SshOptions) ->
+handle_option([{key_cb, {Module, Options}} | Rest], SocketOptions, SshOptions) ->
+    handle_option(Rest, SocketOptions, [handle_ssh_option({key_cb, Module}),
+                                        handle_ssh_priv_option({key_cb_private, Options}) |
+                                        SshOptions]);
+handle_option([{key_cb, Module} | Rest], SocketOptions, SshOptions) ->
+    handle_option([{key_cb, {Module, []}} | Rest], SocketOptions, SshOptions);
+handle_option([{keyboard_interact_fun, _} = Opt | Rest], SocketOptions, SshOptions) ->
     handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
 %%Backwards compatibility
 handle_option([{allow_user_interaction, Value}  | Rest], SocketOptions, SshOptions) ->
@@ -343,8 +543,12 @@ handle_option([{connectfun, _} = Opt | Rest], SocketOptions, SshOptions) ->
     handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
 handle_option([{disconnectfun, _} = Opt | Rest], SocketOptions, SshOptions) ->
     handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
+handle_option([{unexpectedfun, _} = Opt | Rest], SocketOptions, SshOptions) ->
+    handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
 handle_option([{failfun, _} = Opt | Rest],  SocketOptions, SshOptions) ->
     handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
+handle_option([{ssh_msg_debug_fun, _} = Opt | Rest],  SocketOptions, SshOptions) ->
+    handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
 %%Backwards compatibility should not be underscore between ip and v6 in API
 handle_option([{ip_v6_disabled, Value} | Rest], SocketOptions, SshOptions) ->
     handle_option(Rest, SocketOptions, [handle_ssh_option({ipv6_disabled, Value}) | SshOptions]);
@@ -362,42 +566,141 @@ handle_option([{exec, _} = Opt | Rest], SocketOptions, SshOptions) ->
     handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
 handle_option([{auth_methods, _} = Opt | Rest], SocketOptions, SshOptions) ->
     handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
+handle_option([{auth_method_kb_interactive_data, _} = Opt | Rest], SocketOptions, SshOptions) ->
+    handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
 handle_option([{pref_public_key_algs, _} = Opt | Rest], SocketOptions, SshOptions) ->
     handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
+handle_option([{preferred_algorithms,_} = Opt | Rest], SocketOptions, SshOptions) ->
+    handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
+handle_option([{dh_gex_groups,_} = Opt | Rest], SocketOptions, SshOptions) ->
+    handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
+handle_option([{dh_gex_limits,_} = Opt | Rest], SocketOptions, SshOptions) ->
+    handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
 handle_option([{quiet_mode, _} = Opt|Rest], SocketOptions, SshOptions) ->
     handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
 handle_option([{idle_time, _} = Opt | Rest], SocketOptions, SshOptions) ->
     handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
 handle_option([{rekey_limit, _} = Opt|Rest], SocketOptions, SshOptions) ->
     handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
+handle_option([{max_sessions, _} = Opt|Rest], SocketOptions, SshOptions) ->
+    handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
+handle_option([{max_channels, _} = Opt|Rest], SocketOptions, SshOptions) ->
+    handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
+handle_option([{negotiation_timeout, _} = Opt|Rest], SocketOptions, SshOptions) ->
+    handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
+handle_option([{parallel_login, _} = Opt|Rest], SocketOptions, SshOptions) ->
+    handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
+%% (Is handled by proplists:unfold above:)
+%% handle_option([parallel_login|Rest], SocketOptions, SshOptions) ->
+%%     handle_option(Rest, SocketOptions, [handle_ssh_option({parallel_login,true}) | SshOptions]);
+handle_option([{minimal_remote_max_packet_size, _} = Opt|Rest], SocketOptions, SshOptions) ->
+    handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
+handle_option([{id_string, _ID} = Opt|Rest], SocketOptions, SshOptions) ->
+    handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
+handle_option([{profile, _ID} = Opt|Rest], SocketOptions, SshOptions) ->
+    handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
+handle_option([{max_random_length_padding, _Bool} = Opt|Rest], SocketOptions, SshOptions) ->
+    handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
+handle_option([{tstflg, _} = Opt|Rest], SocketOptions, SshOptions) ->
+    handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
 handle_option([Opt | Rest], SocketOptions, SshOptions) ->
     handle_option(Rest, [handle_inet_option(Opt) | SocketOptions], SshOptions).
 
-handle_ssh_option({system_dir, Value} = Opt) when is_list(Value) ->
+
+handle_ssh_option({tstflg,_F} = Opt) -> Opt;
+handle_ssh_option({minimal_remote_max_packet_size, Value} = Opt) when is_integer(Value), Value >=0 ->
     Opt;
+handle_ssh_option({system_dir, Value} = Opt) when is_list(Value) ->
+    check_dir(Opt);
 handle_ssh_option({user_dir, Value} = Opt) when is_list(Value) ->
-    Opt;
+    check_dir(Opt);
 handle_ssh_option({user_dir_fun, Value} = Opt) when is_function(Value) ->
     Opt;
-handle_ssh_option({silently_accept_hosts, Value} = Opt) when Value == true; Value == false ->
+handle_ssh_option({silently_accept_hosts, Value} = Opt) when is_boolean(Value) ->
     Opt;
-handle_ssh_option({user_interaction, Value} = Opt) when Value == true; Value == false ->
+handle_ssh_option({user_interaction, Value} = Opt) when is_boolean(Value) ->
     Opt;
-handle_ssh_option({public_key_alg, ssh_dsa}) ->
-    {public_key_alg, 'ssh-dss'};
-handle_ssh_option({public_key_alg, ssh_rsa})  ->
-    {public_key_alg, 'ssh-rsa'};
-handle_ssh_option({public_key_alg, Value} = Opt) when Value == 'ssh-rsa'; Value == 'ssh-dss' ->
+handle_ssh_option({preferred_algorithms,[_|_]} = Opt) -> 
+    handle_pref_algs(Opt);
+
+handle_ssh_option({dh_gex_groups,L0}) when is_list(L0) ->
+    {dh_gex_groups,
+     collect_per_size(
+       lists:foldl(
+	 fun({N,G,P}, Acc) when is_integer(N),N>0,
+				is_integer(G),G>0,
+				is_integer(P),P>0 -> 
+		 [{N,{G,P}} | Acc];
+	    ({N,{G,P}}, Acc) when is_integer(N),N>0,
+				  is_integer(G),G>0,
+				  is_integer(P),P>0 ->
+		 [{N,{G,P}} | Acc];
+	    ({N,GPs}, Acc) when is_list(GPs) ->
+		 lists:foldr(fun({Gi,Pi}, Acci) when is_integer(Gi),Gi>0,
+						     is_integer(Pi),Pi>0 -> 
+				     [{N,{Gi,Pi}} | Acci]
+			     end, Acc, GPs)
+	 end, [], L0))};
+
+handle_ssh_option({dh_gex_groups,{Tag,File=[C|_]}}=Opt) when is_integer(C), C>0,
+							      Tag == file ;
+							      Tag == ssh_moduli_file ->
+    {ok,GroupDefs} =
+	case Tag of
+	    file -> 
+		file:consult(File);
+	    ssh_moduli_file ->
+		case file:open(File,[read]) of
+		    {ok,D} ->
+			try
+			    {ok,Moduli} = read_moduli_file(D, 1, []),
+			    file:close(D),
+			    {ok, Moduli}
+			catch
+			    _:_ ->
+				throw({error, {{eoptions, Opt}, "Bad format in file "++File}})
+			end;
+		    {error,enoent} ->
+			throw({error, {{eoptions, Opt}, "File not found:"++File}});
+		    {error,Error} ->
+			throw({error, {{eoptions, Opt}, io_lib:format("Error reading file ~s: ~p",[File,Error])}})
+		end
+	end,
+
+    try
+	handle_ssh_option({dh_gex_groups,GroupDefs})
+    catch
+	_:_ ->
+	    throw({error, {{eoptions, Opt}, "Bad format in file: "++File}})
+    end;	    
+    
+
+handle_ssh_option({dh_gex_limits,{Min,Max}} = Opt) when is_integer(Min), Min>0, 
+							is_integer(Max), Max>=Min ->
+    %% Server
+    Opt;
+handle_ssh_option({dh_gex_limits,{Min,I,Max}} = Opt) when is_integer(Min), Min>0, 
+							  is_integer(I),   I>=Min,
+							  is_integer(Max), Max>=I ->
+    %% Client
     Opt;
 handle_ssh_option({pref_public_key_algs, Value} = Opt) when is_list(Value), length(Value) >= 1 ->
-    case handle_pref_algs(Value, []) of
+    case handle_user_pref_pubkey_algs(Value, []) of
 	{true, NewOpts} ->
-	    NewOpts;
+	    {pref_public_key_algs, NewOpts};
 	_ ->
 	    throw({error, {eoptions, Opt}})
     end;
 handle_ssh_option({connect_timeout, Value} = Opt) when is_integer(Value); Value == infinity ->
     Opt;
+handle_ssh_option({max_sessions, Value} = Opt) when is_integer(Value), Value>0 ->
+    Opt;
+handle_ssh_option({max_channels, Value} = Opt) when is_integer(Value), Value>0 ->
+    Opt;
+handle_ssh_option({negotiation_timeout, Value} = Opt) when is_integer(Value); Value == infinity ->
+    Opt;
+handle_ssh_option({parallel_login, Value} = Opt) when Value==true ; Value==false ->
+    Opt;
 handle_ssh_option({user, Value} = Opt) when is_list(Value) ->
     Opt;
 handle_ssh_option({dsa_pass_phrase, Value} = Opt) when is_list(Value) ->
@@ -408,30 +711,48 @@ handle_ssh_option({password, Value} = Opt) when is_list(Value) ->
     Opt;
 handle_ssh_option({user_passwords, Value} = Opt) when is_list(Value)->
     Opt;
-handle_ssh_option({pwdfun, Value} = Opt) when is_function(Value) ->
+handle_ssh_option({pwdfun, Value} = Opt) when is_function(Value,2) ->
+    Opt;
+handle_ssh_option({pwdfun, Value} = Opt) when is_function(Value,4) ->
     Opt;
 handle_ssh_option({key_cb, Value} = Opt)  when is_atom(Value) ->
     Opt;
+handle_ssh_option({key_cb, {CallbackMod, CallbackOptions}} = Opt) when is_atom(CallbackMod),
+                                                                      is_list(CallbackOptions) ->
+    Opt;
+handle_ssh_option({keyboard_interact_fun, Value} = Opt) when is_function(Value,3) ->
+    Opt;
 handle_ssh_option({compression, Value} = Opt) when is_atom(Value) ->
     Opt;
 handle_ssh_option({exec, {Module, Function, _}} = Opt) when is_atom(Module), 
 							    is_atom(Function) ->
-
+    Opt;
+handle_ssh_option({exec, Function} = Opt) when is_function(Function) ->
     Opt;
 handle_ssh_option({auth_methods, Value} = Opt)  when is_list(Value) ->
     Opt;
+handle_ssh_option({auth_method_kb_interactive_data, {Name,Instruction,Prompt,Echo}} = Opt) when is_list(Name),
+												is_list(Instruction),
+												is_list(Prompt),
+												is_boolean(Echo) ->
+    Opt;
+handle_ssh_option({auth_method_kb_interactive_data, F} = Opt) when is_function(F,3) ->
+    Opt;
 handle_ssh_option({infofun, Value} = Opt)  when is_function(Value) ->
     Opt;
 handle_ssh_option({connectfun, Value} = Opt) when is_function(Value) ->
     Opt;
-handle_ssh_option({disconnectfun , Value} = Opt) when is_function(Value) ->
+handle_ssh_option({disconnectfun, Value} = Opt) when is_function(Value) ->
+    Opt;
+handle_ssh_option({unexpectedfun, Value} = Opt) when is_function(Value,2) ->
     Opt;
 handle_ssh_option({failfun, Value} = Opt) when is_function(Value) ->
     Opt;
-
-handle_ssh_option({ipv6_disabled, Value} = Opt) when Value == true;
-						      Value == false ->
+handle_ssh_option({ssh_msg_debug_fun, Value} = Opt) when is_function(Value,4) ->
     Opt;
+
+handle_ssh_option({ipv6_disabled, Value} = Opt) when is_boolean(Value) ->
+    throw({error, {{ipv6_disabled, Opt}, option_no_longer_valid_use_inet_option_instead}});
 handle_ssh_option({transport, {Protocol, Cb, ClosTag}} = Opt) when is_atom(Protocol),
 								   is_atom(Cb),
 								   is_atom(ClosTag) ->
@@ -440,63 +761,209 @@ handle_ssh_option({subsystems, Value} = Opt) when is_list(Value) ->
     Opt;
 handle_ssh_option({ssh_cli, {Cb, _}}= Opt) when is_atom(Cb) ->
     Opt;
+handle_ssh_option({ssh_cli, no_cli} = Opt) ->
+    Opt;
 handle_ssh_option({shell, {Module, Function, _}} = Opt)  when is_atom(Module),
 							      is_atom(Function) ->
     Opt;
 handle_ssh_option({shell, Value} = Opt) when is_function(Value) ->
     Opt;
-handle_ssh_option({quiet_mode, Value} = Opt) when Value == true; 
-						  Value == false -> 
+handle_ssh_option({quiet_mode, Value} = Opt) when is_boolean(Value) ->
     Opt;
 handle_ssh_option({idle_time, Value} = Opt) when is_integer(Value), Value > 0 ->
     Opt;
 handle_ssh_option({rekey_limit, Value} = Opt) when is_integer(Value) -> 
     Opt;
+handle_ssh_option({id_string, random}) ->
+    {id_string, {random,2,5}}; %% 2 - 5 random characters
+handle_ssh_option({id_string, ID} = Opt) when is_list(ID) ->
+    Opt;
+handle_ssh_option({max_random_length_padding, Value} = Opt) when is_integer(Value),
+								 Value =< 255 ->
+    Opt;
+handle_ssh_option({profile, Value} = Opt) when is_atom(Value) ->
+    Opt;
 handle_ssh_option(Opt) ->
     throw({error, {eoptions, Opt}}).
 
+handle_ssh_priv_option({key_cb_private, Value} = Opt) when is_list(Value) ->
+    Opt.
+
 handle_inet_option({active, _} = Opt) ->
-    throw({error, {{eoptions, Opt}, "Ssh has built in flow control, "
-		   "and activ is handled internaly user is not allowd"
+    throw({error, {{eoptions, Opt}, "SSH has built in flow control, "
+		   "and active is handled internally, user is not allowed"
 		   "to specify this option"}});
-handle_inet_option({inet, _} = Opt) ->
-    throw({error, {{eoptions, Opt},"Is set internaly use ipv6_disabled to"
-		   " enforce iv4 in the server, client will fallback to ipv4 if"
-		   " it can not use ipv6"}});
+
+handle_inet_option({inet, Value}) when (Value == inet) or (Value == inet6) ->
+    Value;
 handle_inet_option({reuseaddr, _} = Opt) ->
-    throw({error, {{eoptions, Opt},"Is set internaly user is not allowd"
+    throw({error, {{eoptions, Opt},"Is set internally, user is not allowed"
 		   "to specify this option"}});
 %% Option verified by inet
 handle_inet_option(Opt) ->
     Opt.
+
+
 %% Check preferred algs
-handle_pref_algs([], Acc) ->
+
+handle_pref_algs({preferred_algorithms,Algs}) ->
+    try alg_duplicates(Algs, [], []) of
+	[] ->
+	    {preferred_algorithms,
+	     [try ssh_transport:supported_algorithms(Key)
+	      of
+		  DefAlgs -> handle_pref_alg(Key,Vals,DefAlgs)
+	      catch
+		  _:_ -> throw({error, {{eoptions, {preferred_algorithms,Key}}, 
+					"Bad preferred_algorithms key"}})
+	      end  || {Key,Vals} <- Algs]
+	    };
+		    
+	Dups ->
+	    throw({error, {{eoptions, {preferred_algorithms,Dups}}, "Duplicates found"}})
+    catch
+	_:_ ->
+	    throw({error, {{eoptions, preferred_algorithms}, "Malformed"}})
+    end.
+
+alg_duplicates([{K,V}|KVs], Ks, Dups0) ->
+    Dups =
+	case lists:member(K,Ks) of
+	    true ->
+		[K|Dups0];
+	    false ->
+		Dups0
+	end,
+    case V--lists:usort(V) of
+	[] ->
+	    alg_duplicates(KVs, [K|Ks], Dups);
+	Ds ->
+	    alg_duplicates(KVs, [K|Ks], Dups++Ds)
+    end;
+alg_duplicates([], _Ks, Dups) ->
+    Dups.
+
+handle_pref_alg(Key,
+		Vs=[{client2server,C2Ss=[_|_]},{server2client,S2Cs=[_|_]}],
+		[{client2server,Sup_C2Ss},{server2client,Sup_S2Cs}]
+	       ) ->
+    chk_alg_vs(Key, C2Ss, Sup_C2Ss),
+    chk_alg_vs(Key, S2Cs, Sup_S2Cs),
+    {Key, Vs};
+
+handle_pref_alg(Key,
+		Vs=[{server2client,[_|_]},{client2server,[_|_]}],
+		Sup=[{client2server,_},{server2client,_}]
+	       ) ->
+    handle_pref_alg(Key, lists:reverse(Vs), Sup);
+
+handle_pref_alg(Key, 
+		Vs=[V|_],
+		Sup=[{client2server,_},{server2client,_}]
+	       ) when is_atom(V) ->
+    handle_pref_alg(Key, [{client2server,Vs},{server2client,Vs}], Sup);
+
+handle_pref_alg(Key, 
+		Vs=[V|_],
+		Sup=[S|_]
+	       ) when is_atom(V), is_atom(S) ->
+    chk_alg_vs(Key, Vs, Sup),
+    {Key, Vs};
+
+handle_pref_alg(Key, Vs, _) ->
+    throw({error, {{eoptions, {preferred_algorithms,[{Key,Vs}]}}, "Badly formed list"}}).
+
+chk_alg_vs(OptKey, Values, SupportedValues) ->
+    case (Values -- SupportedValues) of
+	[] -> Values;
+	Bad -> throw({error, {{eoptions, {OptKey,Bad}}, "Unsupported value(s) found"}})
+    end.
+	    
+handle_ip(Inet) -> %% Default to ipv4
+    case lists:member(inet, Inet) of
+	true ->
+	    Inet;
+	false ->
+	    case lists:member(inet6, Inet) of
+		true -> 
+		    Inet;
+		false ->
+		    [inet | Inet]
+	    end
+    end.
+
+check_dir({_,Dir} = Opt) ->
+    case directory_exist_readable(Dir) of
+	ok ->
+	    Opt;
+	{error,Error} ->
+	    throw({error, {eoptions,{Opt,Error}}})
+    end.
+
+directory_exist_readable(Dir) ->
+    case file:read_file_info(Dir) of
+	{ok, #file_info{type = directory,
+			access = Access}} ->
+	    case Access of
+		read -> ok;
+		read_write -> ok;
+		_ -> {error, eacces}
+	    end;
+
+	{ok, #file_info{}}->
+	    {error, enotdir};
+
+	{error, Error} ->
+	    {error, Error}
+    end.
+		
+		    
+
+collect_per_size(L) ->
+    lists:foldr(
+      fun({Sz,GP}, [{Sz,GPs}|Acc]) -> [{Sz,[GP|GPs]}|Acc];
+	 ({Sz,GP}, Acc) -> [{Sz,[GP]}|Acc]
+      end, [], lists:sort(L)).
+
+read_moduli_file(D, I, Acc) ->
+    case io:get_line(D,"") of
+	{error,Error} ->
+	    {error,Error};
+	eof ->
+	    {ok, Acc};
+	"#" ++ _ -> read_moduli_file(D, I+1, Acc);
+	<<"#",_/binary>> ->  read_moduli_file(D, I+1, Acc);
+	Data ->
+	    Line = if is_binary(Data) -> binary_to_list(Data);
+		      is_list(Data) -> Data
+		   end,
+	    try
+		[_Time,_Type,_Tests,_Tries,Size,G,P] = string:tokens(Line," \r\n"),
+		M = {list_to_integer(Size),
+		     {list_to_integer(G), list_to_integer(P,16)}
+		    },
+		read_moduli_file(D, I+1, [M|Acc])
+	    catch
+		_:_ ->
+		    read_moduli_file(D, I+1, Acc)
+	    end
+    end.
+			   
+handle_user_pref_pubkey_algs([], Acc) ->
     {true, lists:reverse(Acc)};
-handle_pref_algs([H|T], Acc) ->
-    case H of
-	ssh_dsa ->
-	    handle_pref_algs(T, ['ssh-dss'| Acc]);
-	ssh_rsa ->
-	    handle_pref_algs(T, ['ssh-rsa'| Acc]);
-	'ssh-dss' ->
-	    handle_pref_algs(T, ['ssh-dss'| Acc]);
-	'ssh-rsa' ->
-	    handle_pref_algs(T, ['ssh-rsa'| Acc]);
-	_ ->
+handle_user_pref_pubkey_algs([H|T], Acc) ->
+    case lists:member(H, ?SUPPORTED_USER_KEYS) of
+	true ->
+	    handle_user_pref_pubkey_algs(T, [H| Acc]);
+
+	false when H==ssh_dsa -> handle_user_pref_pubkey_algs(T, ['ssh-dss'| Acc]);
+	false when H==ssh_rsa -> handle_user_pref_pubkey_algs(T, ['ssh-rsa'| Acc]);
+
+	false ->
 	    false
     end.
-%% Has IPv6 been disabled?
-inetopt(true) ->
-    inet;
-inetopt(false) ->
-    case gen_tcp:listen(0, [inet6]) of
-	{ok, Dummyport} ->
-	    gen_tcp:close(Dummyport),
-	    inet6;
-	_ ->
-	    inet
-    end.
 
-%%%
-%% Deprecated
-%%%
+fmt_host({A,B,C,D}) -> 
+    lists:concat([A,".",B,".",C,".",D]);
+fmt_host(T={_,_,_,_,_,_,_,_}) -> 
+    lists:flatten(string:join([io_lib:format("~.16B",[A]) || A <- tuple_to_list(T)], ":")).
diff --git a/lib/ssh/src/ssh.hrl b/lib/ssh/src/ssh.hrl
index da5750b6c3..868f3a9181 100644
--- a/lib/ssh/src/ssh.hrl
+++ b/lib/ssh/src/ssh.hrl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2004-2012. All Rights Reserved.
+%% Copyright Ericsson AB 2004-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
@@ -28,18 +29,26 @@
 
 -define(SSH_DEFAULT_PORT, 22).
 -define(SSH_MAX_PACKET_SIZE, (256*1024)).
--define(SSH_LENGHT_INDICATOR_SIZE, 4).
+-define(REKEY_TIMOUT, 3600000).
+-define(REKEY_DATA_TIMOUT, 60000).
+-define(DEFAULT_PROFILE, default).
+
+-define(SUPPORTED_AUTH_METHODS, "publickey,keyboard-interactive,password").
+-define(SUPPORTED_USER_KEYS, ['ssh-rsa','ssh-dss','ecdsa-sha2-nistp256','ecdsa-sha2-nistp384','ecdsa-sha2-nistp521']).
 
 -define(FALSE, 0).
 -define(TRUE,  1).
 %% basic binary constructors
--define(BOOLEAN(X),  X:8/unsigned-big-integer).
--define(BYTE(X),     X:8/unsigned-big-integer).
--define(UINT16(X),   X:16/unsigned-big-integer).
--define(UINT32(X),   X:32/unsigned-big-integer).
--define(UINT64(X),   X:64/unsigned-big-integer).
+-define(BOOLEAN(X),  (X):8/unsigned-big-integer).
+-define(BYTE(X),     (X):8/unsigned-big-integer).
+-define(UINT16(X),   (X):16/unsigned-big-integer).
+-define(UINT32(X),   (X):32/unsigned-big-integer).
+-define(UINT64(X),   (X):64/unsigned-big-integer).
 -define(STRING(X),   ?UINT32((size(X))), (X)/binary).
 
+-define(DEC_BIN(X,Len),   ?UINT32(Len), X:Len/binary ).
+-define(DEC_MPINT(I,Len), ?UINT32(Len), I:Len/big-signed-integer-unit:8 ).
+
 %% building macros
 -define(boolean(X),
 	case X of
@@ -52,6 +61,7 @@
 -define(uint32(X), << ?UINT32(X) >> ).
 -define(uint64(X), << ?UINT64(X) >> ).
 -define(string(X), << ?STRING(list_to_binary(X)) >> ).
+-define(string_utf8(X), << ?STRING(unicode:characters_to_binary(X)) >> ).
 -define(binary(X), << ?STRING(X) >>).
 
 -define(SSH_CIPHER_NONE, 0).
@@ -60,8 +70,6 @@
 
 -record(ssh,
 	{
-	  %%state,        %% what it's waiting for
-
 	  role,         %% client | server
 	  peer,         %% string version of peer address 
 
@@ -119,15 +127,19 @@
 	  recv_sequence = 0,
 	  keyex_key,
 	  keyex_info,
+	  random_length_padding = 255, % From RFC 4253 section 6.
 	  
 	  %% User auth
 	  user,
 	  service,
 	  userauth_quiet_mode,              %  boolean()
-	  userauth_supported_methods , %  
-	  userauth_methods,
+	  userauth_methods,                 %  list( string() )  eg ["keyboard-interactive", "password"]
+	  userauth_supported_methods,       %  string() eg "keyboard-interactive,password"
+	  kb_tries_left = 0,                %  integer(), num tries left for "keyboard-interactive"
 	  userauth_preference,
-	  available_host_keys
+	  available_host_keys,
+	  pwdfun_user_state,
+	  authenticated = false
 	 }).
 
 -record(alg,
diff --git a/lib/ssh/src/ssh_acceptor.erl b/lib/ssh/src/ssh_acceptor.erl
index d023656c32..9f3e60bd62 100644
--- a/lib/ssh/src/ssh_acceptor.erl
+++ b/lib/ssh/src/ssh_acceptor.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2008-2012. All Rights Reserved.
+%% Copyright Ericsson AB 2008-2015. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
@@ -21,11 +22,15 @@
 
 -module(ssh_acceptor).
 
+-include("ssh.hrl").
+
 %% Internal application API
--export([start_link/5]).
+-export([start_link/5,
+	 number_of_connections/1,
+	 callback_listen/3,
+	 handle_connection/5]).
 
 %% spawn export  
-%% TODO: system messages
 -export([acceptor_init/6, acceptor_loop/6]).
 
 -define(SLEEP_TIME, 200).
@@ -43,17 +48,50 @@ start_link(Port, Address, SockOpts, Opts, AcceptTimeout) ->
 acceptor_init(Parent, Port, Address, SockOpts, Opts, AcceptTimeout) ->
     {_, Callback, _} =  
 	proplists:get_value(transport, Opts, {tcp, gen_tcp, tcp_closed}),
-    case (catch do_socket_listen(Callback, Port, SockOpts)) of
-	{ok, ListenSocket} ->
+
+    SockOwner = proplists:get_value(lsock_owner, Opts),
+    LSock = proplists:get_value(lsocket, Opts),
+    UseExistingSocket =
+	case catch inet:sockname(LSock) of
+	    {ok,{_,Port}} -> is_pid(SockOwner);
+	    _ -> false
+	end,
+
+    case UseExistingSocket of
+	true ->
 	    proc_lib:init_ack(Parent, {ok, self()}),
-	    acceptor_loop(Callback, 
-			  Port, Address, Opts, ListenSocket, AcceptTimeout);
-	Error ->
-	    proc_lib:init_ack(Parent, Error),
-	    error
+	    request_ownership(LSock, SockOwner),
+	    acceptor_loop(Callback, Port, Address, Opts, LSock, AcceptTimeout);
+
+	false -> 
+	    case (catch do_socket_listen(Callback, Port, SockOpts)) of
+		{ok, ListenSocket} ->
+		    proc_lib:init_ack(Parent, {ok, self()}),
+		    acceptor_loop(Callback, 
+				  Port, Address, Opts, ListenSocket, AcceptTimeout);
+		Error ->
+		    proc_lib:init_ack(Parent, Error),
+		    error
+	    end
+    end.
+
+request_ownership(LSock, SockOwner) ->
+    SockOwner ! {request_control,LSock,self()},
+    receive
+	{its_yours,LSock} -> ok
     end.
+    
    
-do_socket_listen(Callback, Port, Opts) ->
+do_socket_listen(Callback, Port0, Opts) ->
+    Port =
+	case proplists:get_value(fd, Opts) of
+	    undefined -> Port0;
+	    _ -> 0
+	end,
+    callback_listen(Callback, Port, Opts).
+
+callback_listen(Callback, Port, Opts0) ->
+    Opts = [{active, false}, {reuseaddr,true} | Opts0],
     case Callback:listen(Port, Opts) of
 	{error, nxdomain} ->
 	    Callback:listen(Port, lists:delete(inet6, Opts));
@@ -82,15 +120,36 @@ acceptor_loop(Callback, Port, Address, Opts, ListenSocket, AcceptTimeout) ->
     end.
 
 handle_connection(Callback, Address, Port, Options, Socket) ->
-    SystemSup = ssh_system_sup:system_supervisor(Address, Port),
-    {ok, SubSysSup} = ssh_system_sup:start_subsystem(SystemSup, Options),
-    ConnectionSup = ssh_system_sup:connection_supervisor(SystemSup),
-    {ok, Pid} = 
-	ssh_connection_sup:start_manager_child(ConnectionSup,
-					       [server, Socket, Options]),
-    Callback:controlling_process(Socket, Pid),
-    SshOpts = proplists:get_value(ssh_opts, Options),
-    Pid ! {start_connection, server, [Address, Port, Socket, SshOpts, SubSysSup]}.
+    SSHopts = proplists:get_value(ssh_opts, Options, []),
+    Profile =  proplists:get_value(profile, SSHopts, ?DEFAULT_PROFILE),
+    SystemSup = ssh_system_sup:system_supervisor(Address, Port, Profile),
+
+    MaxSessions = proplists:get_value(max_sessions,SSHopts,infinity),
+    case number_of_connections(SystemSup) < MaxSessions of
+	true ->
+	    {ok, SubSysSup} = ssh_system_sup:start_subsystem(SystemSup, Options),
+	    ConnectionSup = ssh_subsystem_sup:connection_supervisor(SubSysSup),
+	    Timeout = proplists:get_value(negotiation_timeout, SSHopts, 2*60*1000),
+	    ssh_connection_handler:start_connection(server, Socket,
+						    [{supervisors, [{system_sup, SystemSup},
+								    {subsystem_sup, SubSysSup},
+								    {connection_sup, ConnectionSup}]}
+						     | Options], Timeout);
+	false ->
+	    Callback:close(Socket),
+	    IPstr = if is_tuple(Address) -> inet:ntoa(Address);
+		     true -> Address
+		  end,
+	    Str = try io_lib:format('~s:~p',[IPstr,Port])
+		  catch _:_ -> "port "++integer_to_list(Port)
+		  end,
+	    error_logger:info_report("Ssh login attempt to "++Str++" denied due to option "
+				     "max_sessions limits to "++ io_lib:write(MaxSessions) ++
+				     " sessions."
+				     ),
+	    {error,max_sessions}
+    end.
+
 
 handle_error(timeout) ->
     ok;
@@ -117,3 +176,11 @@ handle_error(Reason) ->
     String = lists:flatten(io_lib:format("Accept error: ~p", [Reason])),
     error_logger:error_report(String),
     exit({accept_failed, String}).    
+
+
+number_of_connections(SystemSup) ->
+    length([X || 
+	       {R,X,supervisor,[ssh_subsystem_sup]} <- supervisor:which_children(SystemSup),
+	       is_pid(X),
+	       is_reference(R)
+	  ]).
diff --git a/lib/ssh/src/ssh_acceptor_sup.erl b/lib/ssh/src/ssh_acceptor_sup.erl
index f37e1fe4ff..129f85a3e0 100644
--- a/lib/ssh/src/ssh_acceptor_sup.erl
+++ b/lib/ssh/src/ssh_acceptor_sup.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2008-2010. All Rights Reserved.
+%% Copyright Ericsson AB 2008-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
@@ -26,13 +27,17 @@
 -module(ssh_acceptor_sup).
 -behaviour(supervisor).
 
--export([start_link/1, start_child/2, stop_child/2]).
+-include("ssh.hrl").
+
+-export([start_link/1, start_child/2, stop_child/4]).
 
 %% Supervisor callback
 -export([init/1]).
 
 -define(DEFAULT_TIMEOUT, 50000).
 
+-spec init( [term()] ) -> {ok,{supervisor:sup_flags(),[supervisor:child_spec()]}} | ignore .
+
 %%%=========================================================================
 %%%  API
 %%%=========================================================================
@@ -45,18 +50,19 @@ start_child(AccSup, ServerOpts) ->
 	{error, already_present} ->
 	    Address = proplists:get_value(address, ServerOpts),
 	    Port = proplists:get_value(port, ServerOpts),
-	    Name = id(Address, Port),
-	    supervisor:delete_child(?MODULE, Name),
+	    Profile = proplists:get_value(profile,  
+					  proplists:get_value(ssh_opts, ServerOpts), ?DEFAULT_PROFILE),
+	    stop_child(AccSup, Address, Port, Profile),
 	    supervisor:start_child(AccSup, Spec);
 	Reply ->
 	    Reply
     end.
 
-stop_child(Address, Port) ->
-    Name = id(Address, Port),
-    case supervisor:terminate_child(?MODULE, Name) of
+stop_child(AccSup, Address, Port, Profile) ->
+    Name = id(Address, Port, Profile),
+    case supervisor:terminate_child(AccSup, Name) of
         ok ->
-            supervisor:delete_child(?MODULE, Name);
+            supervisor:delete_child(AccSup, Name);
         Error ->
             Error
     end.
@@ -78,18 +84,21 @@ child_spec(ServerOpts) ->
     Address = proplists:get_value(address, ServerOpts),
     Port = proplists:get_value(port, ServerOpts),
     Timeout = proplists:get_value(timeout, ServerOpts, ?DEFAULT_TIMEOUT),
-    Name = id(Address, Port),
+    Profile = proplists:get_value(profile,  proplists:get_value(ssh_opts, ServerOpts), ?DEFAULT_PROFILE),
+    Name = id(Address, Port, Profile),
     SocketOpts = proplists:get_value(socket_opts, ServerOpts),
-    StartFunc = {ssh_acceptor, start_link, [Port, Address, 
-					    [{active, false},
-					     {reuseaddr, true}] ++ SocketOpts, 
-					    ServerOpts, Timeout]},
-    Restart = permanent, 
-    Shutdown = 3600,
+    StartFunc = {ssh_acceptor, start_link, [Port, Address, SocketOpts, ServerOpts, Timeout]},
+    Restart = transient, 
+    Shutdown = brutal_kill,
     Modules = [ssh_acceptor],
     Type = worker,
     {Name, StartFunc, Restart, Shutdown, Type, Modules}.
 
-id(Address, Port) ->
-    {ssh_acceptor_sup, Address, Port}.
+id(Address, Port, Profile) ->
+    case is_list(Address) of
+	true ->
+	    {ssh_acceptor_sup, any, Port, Profile};
+	false ->
+	    {ssh_acceptor_sup, Address, Port, Profile}
+    end.
 
diff --git a/lib/ssh/src/ssh_app.erl b/lib/ssh/src/ssh_app.erl
index 38659b1a2d..d3680e20da 100644
--- a/lib/ssh/src/ssh_app.erl
+++ b/lib/ssh/src/ssh_app.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2004-2010. All Rights Reserved.
-%%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
-%%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%% Copyright Ericsson AB 2004-2016. All Rights Reserved.
+%%
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
+%%
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
diff --git a/lib/ssh/src/ssh_auth.erl b/lib/ssh/src/ssh_auth.erl
index cb0c7751f0..49eec8072f 100644
--- a/lib/ssh/src/ssh_auth.erl
+++ b/lib/ssh/src/ssh_auth.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2008-2012. All Rights Reserved.
+%% Copyright Ericsson AB 2008-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
@@ -30,8 +31,7 @@
 -export([publickey_msg/1, password_msg/1, keyboard_interactive_msg/1,
 	 service_request_msg/1, init_userauth_request_msg/1,
 	 userauth_request_msg/1, handle_userauth_request/3,
-	 handle_userauth_info_request/3, handle_userauth_info_response/2,
-	 userauth_messages/0
+	 handle_userauth_info_request/3, handle_userauth_info_response/2
 	]).
 
 %%--------------------------------------------------------------------
@@ -41,35 +41,35 @@ publickey_msg([Alg, #ssh{user = User,
 		       session_id = SessionId,
 		       service = Service,
 		       opts = Opts} = Ssh]) ->
-
     Hash = sha, %% Maybe option?!
-    ssh_bits:install_messages(userauth_pk_messages()),
     KeyCb = proplists:get_value(key_cb, Opts, ssh_file),
-
     case KeyCb:user_key(Alg, Opts) of
-	{ok, Key} ->
-	    StrAlgo = algorithm_string(Alg),
-	    PubKeyBlob = encode_public_key(Key),
-	    SigData = build_sig_data(SessionId, 
-				     User, Service, PubKeyBlob, StrAlgo),
-	    Sig = ssh_transport:sign(SigData, Hash, Key),
-	    SigBlob = list_to_binary([?string(StrAlgo), ?binary(Sig)]),
-	    ssh_transport:ssh_packet(
-	      #ssh_msg_userauth_request{user = User,
-					service = Service,
-					method = "publickey",
-					data = [?TRUE,
-						?string(StrAlgo),
-						?binary(PubKeyBlob),
-						?binary(SigBlob)]},
-	      Ssh);
+	{ok, PrivKey} ->
+	    StrAlgo = atom_to_list(Alg),
+            case encode_public_key(StrAlgo, ssh_transport:extract_public_key(PrivKey)) of
+		not_ok ->
+		    not_ok;
+		PubKeyBlob ->
+		    SigData = build_sig_data(SessionId, 
+					     User, Service, PubKeyBlob, StrAlgo),
+		    Sig = ssh_transport:sign(SigData, Hash, PrivKey),
+		    SigBlob = list_to_binary([?string(StrAlgo), ?binary(Sig)]),
+		    ssh_transport:ssh_packet(
+		      #ssh_msg_userauth_request{user = User,
+						service = Service,
+						method = "publickey",
+						data = [?TRUE,
+							?string(StrAlgo),
+							?binary(PubKeyBlob),
+							?binary(SigBlob)]},
+		      Ssh)
+	    end;
      	_Error ->
 	    not_ok
     end.
 
 password_msg([#ssh{opts = Opts, io_cb = IoCb,
 		   user = User, service = Service} = Ssh]) ->
-    ssh_bits:install_messages(userauth_passwd_messages()),
     Password = case proplists:get_value(password, Opts) of
 		   undefined -> 
 		       user_interaction(IoCb, Ssh);
@@ -86,7 +86,7 @@ password_msg([#ssh{opts = Opts, io_cb = IoCb,
 					method = "password",
 					data =
 					    <<?BOOLEAN(?FALSE),
-					      ?STRING(list_to_binary(Password))>>},
+					      ?STRING(unicode:characters_to_binary(Password))>>},
 	      Ssh)
     end.
 
@@ -99,7 +99,6 @@ user_interaction(IoCb, Ssh) ->
 %% See RFC 4256 for info on keyboard-interactive
 keyboard_interactive_msg([#ssh{user = User,
 			       service = Service} = Ssh]) ->
-    ssh_bits:install_messages(userauth_keyboard_interactive_messages()),
     ssh_transport:ssh_packet(
       #ssh_msg_userauth_request{user = User,
 				service = Service,
@@ -119,41 +118,26 @@ init_userauth_request_msg(#ssh{opts = Opts} = Ssh) ->
 					    service = "ssh-connection",
 					    method = "none",
 					    data = <<>>},
-	    case proplists:get_value(pref_public_key_algs, Opts, false) of
-		false ->
-		    FirstAlg = proplists:get_value(public_key_alg, Opts, ?PREFERRED_PK_ALG),
-		    SecondAlg = other_alg(FirstAlg),
-		    AllowUserInt =  proplists:get_value(user_interaction, Opts, true),
-		    Prefs = method_preference(FirstAlg, SecondAlg, AllowUserInt),
-		    ssh_transport:ssh_packet(Msg, Ssh#ssh{user = User,
-							  userauth_preference = Prefs,
-							  userauth_methods = none,
-							  service = "ssh-connection"});
-		Algs ->
-		    FirstAlg = lists:nth(1, Algs),
-		    case length(Algs) =:= 2 of
-			true ->
-			    SecondAlg = other_alg(FirstAlg),
-			    AllowUserInt =  proplists:get_value(user_interaction, Opts, true),
-			    Prefs = method_preference(FirstAlg, SecondAlg, AllowUserInt),
-			    ssh_transport:ssh_packet(Msg, Ssh#ssh{user = User,
-								  userauth_preference = Prefs,
-								  userauth_methods = none,
-								  service = "ssh-connection"});
-			_ ->
-			    AllowUserInt = proplists:get_value(user_interaction, Opts, true),
-			    Prefs = method_preference(FirstAlg, AllowUserInt),
-			    ssh_transport:ssh_packet(Msg, Ssh#ssh{user = User,
-								  userauth_preference = Prefs,
-								  userauth_methods = none,
-								  service = "ssh-connection"})
-		    end
-	    end;
+	    Algs0 = proplists:get_value(pref_public_key_algs, Opts, ?SUPPORTED_USER_KEYS),
+	    %% The following line is not strictly correct. The call returns the
+	    %% supported HOST key types while we are interested in USER keys. However,
+	    %% they "happens" to be the same (for now).  This could change....
+	    %% There is no danger as long as the set of user keys is a subset of the set
+	    %% of host keys.
+	    CryptoSupported = ssh_transport:supported_algorithms(public_key),
+	    Algs = [A || A <- Algs0,
+			 lists:member(A, CryptoSupported)],
+
+	    Prefs = method_preference(Algs),
+	    ssh_transport:ssh_packet(Msg, Ssh#ssh{user = User,
+						  userauth_preference = Prefs,
+						  userauth_methods = none,
+						  service = "ssh-connection"});
 	{error, no_user} ->
 	    ErrStr = "Could not determine the users name",
-	    throw(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_ILLEGAL_USER_NAME,
-				      description = ErrStr,
-				      language = "en"})
+	    ssh_connection_handler:disconnect(
+	      #ssh_msg_disconnect{code = ?SSH_DISCONNECT_ILLEGAL_USER_NAME,
+				  description = ErrStr})
     end.
 
 userauth_request_msg(#ssh{userauth_preference = []} = Ssh) ->    
@@ -175,7 +159,7 @@ userauth_request_msg(#ssh{userauth_methods = Methods,
 		not_ok ->
 		    userauth_request_msg(Ssh);
 		Result ->
-		    Result
+		    {Pref,Result}
 	    end;
 	false ->
 	    userauth_request_msg(Ssh)
@@ -191,24 +175,44 @@ handle_userauth_request(#ssh_msg_service_request{name =
 handle_userauth_request(#ssh_msg_userauth_request{user = User,
 						  service = "ssh-connection",
 						  method = "password",
-						  data = Data}, _, 
-			#ssh{opts = Opts} = Ssh) ->
-    <<_:8, ?UINT32(Sz), BinPwd:Sz/binary>> = Data,
-    Password = binary_to_list(BinPwd),
-    
-    case check_password(User, Password, Opts) of
-	true ->
+						  data = <<?FALSE, ?UINT32(Sz), BinPwd:Sz/binary>>}, _, 
+			#ssh{opts = Opts,
+			     userauth_supported_methods = Methods} = Ssh) ->
+    Password = unicode:characters_to_list(BinPwd),
+    case check_password(User, Password, Opts, Ssh) of
+	{true,Ssh1} ->
 	    {authorized, User,
-	     ssh_transport:ssh_packet(#ssh_msg_userauth_success{}, Ssh)};
-	false  ->
-	    {not_authorized, {User, {passwd, Password}}, 
+	     ssh_transport:ssh_packet(#ssh_msg_userauth_success{}, Ssh1)};
+	{false,Ssh1}  ->
+	    {not_authorized, {User, {error,"Bad user or password"}}, 
 	     ssh_transport:ssh_packet(#ssh_msg_userauth_failure{
-		     authentications = "",
-		     partial_success = false}, Ssh)}
+		     authentications = Methods,
+		     partial_success = false}, Ssh1)}
     end;
 
 handle_userauth_request(#ssh_msg_userauth_request{user = User,
 						  service = "ssh-connection",
+						  method = "password",
+						  data = <<?TRUE,
+							   _/binary
+							   %% ?UINT32(Sz1), OldBinPwd:Sz1/binary,
+							   %% ?UINT32(Sz2), NewBinPwd:Sz2/binary
+							 >>
+						 }, _, 
+			#ssh{userauth_supported_methods = Methods} = Ssh) ->
+    %% Password change without us having sent SSH_MSG_USERAUTH_PASSWD_CHANGEREQ (because we never do)
+    %% RFC 4252 says:
+    %%   SSH_MSG_USERAUTH_FAILURE without partial success - The password
+    %%   has not been changed.  Either password changing was not supported,
+    %%   or the old password was bad. 
+
+    {not_authorized, {User, {error,"Password change not supported"}}, 
+     ssh_transport:ssh_packet(#ssh_msg_userauth_failure{
+				 authentications = Methods,
+				 partial_success = false}, Ssh)};
+
+handle_userauth_request(#ssh_msg_userauth_request{user = User,
+						  service = "ssh-connection",
 						  method = "none"}, _,
 			#ssh{userauth_supported_methods = Methods} = Ssh) ->
     {not_authorized, {User, undefined},
@@ -220,7 +224,9 @@ handle_userauth_request(#ssh_msg_userauth_request{user = User,
 						  service = "ssh-connection",
 						  method = "publickey",
 						  data = Data}, 
-			SessionId, #ssh{opts = Opts} = Ssh) ->
+			SessionId, 
+			#ssh{opts = Opts,
+			     userauth_supported_methods = Methods} = Ssh) ->
     <<?BYTE(HaveSig), ?UINT32(ALen), BAlg:ALen/binary, 
      ?UINT32(KLen), KeyBlob:KLen/binary, SigWLen/binary>> = Data,
     Alg = binary_to_list(BAlg),
@@ -233,13 +239,12 @@ handle_userauth_request(#ssh_msg_userauth_request{user = User,
 		     ssh_transport:ssh_packet(
 		       #ssh_msg_userauth_success{}, Ssh)};
 		false ->
-		    {not_authorized, {User, {error, "Invalid signature"}}, 
+		    {not_authorized, {User, undefined}, 
 		     ssh_transport:ssh_packet(#ssh_msg_userauth_failure{
-			     authentications="publickey,password",
+			     authentications = Methods,
 			     partial_success = false}, Ssh)}
 	    end;
 	?FALSE ->
-	    ssh_bits:install_messages(userauth_pk_messages()),
 	    {not_authorized, {User, undefined},
 	     ssh_transport:ssh_packet(
 	       #ssh_msg_userauth_pk_ok{algorithm_name = Alg,
@@ -248,6 +253,64 @@ handle_userauth_request(#ssh_msg_userauth_request{user = User,
 
 handle_userauth_request(#ssh_msg_userauth_request{user = User,
 						  service = "ssh-connection",
+						  method = "keyboard-interactive",
+						  data = _},
+			_, #ssh{opts = Opts,
+				kb_tries_left = KbTriesLeft,
+				userauth_supported_methods = Methods} = Ssh) ->
+    case KbTriesLeft of
+	N when N<1 ->
+	    {not_authorized, {User, {authmethod, "keyboard-interactive"}}, 
+	     ssh_transport:ssh_packet(
+	       #ssh_msg_userauth_failure{authentications = Methods,
+					 partial_success = false}, Ssh)};
+
+	_ ->
+	    %% RFC4256
+	    %% The data field contains:
+	    %%   - language tag (deprecated). If =/=[] SHOULD use it however. We skip
+	    %%                                it for simplicity.
+	    %%   - submethods. "... the user can give a hint of which actual methods
+	    %%                  he wants to use. ...".  It's a "MAY use" so we skip
+	    %%                  it. It also needs an understanding between the client
+	    %%                  and the server.
+	    %%                  
+	    %% "The server MUST reply with an SSH_MSG_USERAUTH_SUCCESS,
+	    %%  SSH_MSG_USERAUTH_FAILURE, or SSH_MSG_USERAUTH_INFO_REQUEST message."
+	    Default = {"SSH server",
+		       "Enter password for \""++User++"\"",
+		       "password: ",
+		       false},
+
+	    {Name, Instruction, Prompt, Echo} =
+		case proplists:get_value(auth_method_kb_interactive_data, Opts) of
+		    undefined -> 
+			Default;
+		    {_,_,_,_}=V -> 
+			V;
+		    F when is_function(F) ->
+			{_,PeerName} = Ssh#ssh.peer,
+			F(PeerName, User, "ssh-connection")
+		end,
+	    EchoEnc = case Echo of
+			  true -> <<?TRUE>>;
+			  false -> <<?FALSE>>
+		      end,
+	    Msg = #ssh_msg_userauth_info_request{name = unicode:characters_to_list(Name),
+						 instruction = unicode:characters_to_list(Instruction),
+						 language_tag = "",
+						 num_prompts = 1,
+						 data = <<?STRING(unicode:characters_to_binary(Prompt)),
+							  EchoEnc/binary
+							>>
+						},
+	    {not_authorized, {User, undefined}, 
+	     ssh_transport:ssh_packet(Msg, Ssh#ssh{user = User
+						  })}
+    end;
+
+handle_userauth_request(#ssh_msg_userauth_request{user = User,
+						  service = "ssh-connection",
 						  method = Other}, _,
 			#ssh{userauth_supported_methods = Methods} = Ssh) ->
     {not_authorized, {User, {authmethod, Other}}, 
@@ -255,6 +318,8 @@ handle_userauth_request(#ssh_msg_userauth_request{user = User,
        #ssh_msg_userauth_failure{authentications = Methods,
 				 partial_success = false}, Ssh)}.
 
+
+
 handle_userauth_info_request(
   #ssh_msg_userauth_info_request{name = Name,
 				 instruction = Instr,
@@ -262,62 +327,56 @@ handle_userauth_info_request(
 				 data  = Data}, IoCb, 
   #ssh{opts = Opts} = Ssh) ->
     PromptInfos = decode_keyboard_interactive_prompts(NumPrompts,Data),
-    Resps = keyboard_interact_get_responses(IoCb, Opts,
+    Responses = keyboard_interact_get_responses(IoCb, Opts,
 					    Name, Instr, PromptInfos),
-    RespBin = list_to_binary(
-		lists:map(fun(S) -> <<?STRING(list_to_binary(S))>> end,
-			  Resps)),
     {ok, 
      ssh_transport:ssh_packet(
        #ssh_msg_userauth_info_response{num_responses = NumPrompts,
-				       data = RespBin}, Ssh)}.
+				       data = Responses}, Ssh)}.
+
+handle_userauth_info_response(#ssh_msg_userauth_info_response{num_responses = 1,
+							      data = <<?UINT32(Sz), Password:Sz/binary>>},
+			      #ssh{opts = Opts,
+				   kb_tries_left = KbTriesLeft,
+				   user = User,
+				   userauth_supported_methods = Methods} = Ssh) ->
+    case check_password(User, unicode:characters_to_list(Password), Opts, Ssh) of
+	{true,Ssh1} ->
+	    {authorized, User,
+	     ssh_transport:ssh_packet(#ssh_msg_userauth_success{}, Ssh1)};
+	{false,Ssh1} ->
+	    {not_authorized, {User, {error,"Bad user or password"}}, 
+	     ssh_transport:ssh_packet(#ssh_msg_userauth_failure{
+					 authentications = Methods,
+					 partial_success = false}, 
+				      Ssh1#ssh{kb_tries_left = max(KbTriesLeft-1, 0)}
+				     )}
+    end;
 
 handle_userauth_info_response(#ssh_msg_userauth_info_response{},
 			      _Auth) ->
-    throw(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_SERVICE_NOT_AVAILABLE,
-			      description = "Server does not support" 
-			      "keyboard-interactive", 
-			      language = "en"}).
-userauth_messages() ->
-    [ {ssh_msg_userauth_request, ?SSH_MSG_USERAUTH_REQUEST,
-       [string, 
-	string, 
-	string, 
-	'...']},
-
-      {ssh_msg_userauth_failure, ?SSH_MSG_USERAUTH_FAILURE,
-       [string, 
-	boolean]},
-
-      {ssh_msg_userauth_success, ?SSH_MSG_USERAUTH_SUCCESS,
-       []},
-
-      {ssh_msg_userauth_banner, ?SSH_MSG_USERAUTH_BANNER,
-       [string, 
-	string]}].
+    ssh_connection_handler:disconnect(
+      #ssh_msg_disconnect{code = ?SSH_DISCONNECT_SERVICE_NOT_AVAILABLE,
+			  description = "Server does not support keyboard-interactive"
+			 }).
+
+
 %%--------------------------------------------------------------------
 %%% Internal functions
 %%--------------------------------------------------------------------
-method_preference(Alg1, Alg2, true) ->
-    [{"publickey", ?MODULE, publickey_msg, [Alg1]},
-     {"publickey", ?MODULE, publickey_msg,[Alg2]},
-     {"password", ?MODULE, password_msg, []},
-     {"keyboard-interactive", ?MODULE, keyboard_interactive_msg, []}
-    ];
-method_preference(Alg1, Alg2, false) ->
-    [{"publickey", ?MODULE, publickey_msg, [Alg1]},
-     {"publickey", ?MODULE, publickey_msg,[Alg2]},
-     {"password", ?MODULE, password_msg, []}
-    ].
-method_preference(Alg1, true) ->
-    [{"publickey", ?MODULE, publickey_msg, [Alg1]},
-     {"password", ?MODULE, password_msg, []},
-     {"keyboard-interactive", ?MODULE, keyboard_interactive_msg, []}
-    ];
-method_preference(Alg1, false) ->
-    [{"publickey", ?MODULE, publickey_msg, [Alg1]},
-     {"password", ?MODULE, password_msg, []}
-    ].
+method_preference(Algs) ->
+    lists:foldr(fun(A, Acc) ->
+		       [{"publickey", ?MODULE, publickey_msg, [A]} | Acc]
+	       end, 
+	       [{"password", ?MODULE, password_msg, []},
+		{"keyboard-interactive", ?MODULE, keyboard_interactive_msg, []},
+		{"keyboard-interactive", ?MODULE, keyboard_interactive_msg, []},
+		{"keyboard-interactive", ?MODULE, keyboard_interactive_msg, []},
+		{"keyboard-interactive", ?MODULE, keyboard_interactive_msg, []},
+		{"keyboard-interactive", ?MODULE, keyboard_interactive_msg, []},
+		{"keyboard-interactive", ?MODULE, keyboard_interactive_msg, []}
+	       ],
+	       Algs).
 
 user_name(Opts) ->
     Env = case os:type() of
@@ -338,13 +397,34 @@ user_name(Opts) ->
 	    {ok, User}
     end.
 
-check_password(User, Password, Opts) ->
+check_password(User, Password, Opts, Ssh) ->
     case proplists:get_value(pwdfun, Opts) of
 	undefined ->
 	    Static = get_password_option(Opts, User),
-	    Password == Static;
-	Cheker ->
-	    Cheker(User, Password)
+	    {Password == Static, Ssh};
+
+	Checker when is_function(Checker,2) ->
+	    {Checker(User, Password), Ssh};
+
+	Checker when is_function(Checker,4) ->
+	    #ssh{pwdfun_user_state = PrivateState,
+		 peer = {_,PeerAddr={_,_}}
+		} = Ssh,
+	    case Checker(User, Password, PeerAddr, PrivateState) of
+		true ->
+		    {true,Ssh};
+		false ->
+		    {false,Ssh};
+		{true,NewState} ->
+		    {true, Ssh#ssh{pwdfun_user_state=NewState}};
+		{false,NewState} ->
+		    {false, Ssh#ssh{pwdfun_user_state=NewState}};
+		disconnect ->
+		    ssh_connection_handler:disconnect(
+		      #ssh_msg_disconnect{code = ?SSH_DISCONNECT_SERVICE_NOT_AVAILABLE,
+					  description = "Unable to connect using the available authentication methods"
+					 })
+	    end
     end.
 
 get_password_option(Opts, User) ->
@@ -373,7 +453,7 @@ verify_sig(SessionId, User, Service, Alg, KeyBlob, SigWLen, Opts) ->
 build_sig_data(SessionId, User, Service, KeyBlob, Alg) ->
     Sig = [?binary(SessionId),
 	   ?SSH_MSG_USERAUTH_REQUEST,
-	   ?string(User),
+	   ?string_utf8(User),
 	   ?string(Service),
 	   ?binary(<<"publickey">>),
 	   ?TRUE,
@@ -381,49 +461,35 @@ build_sig_data(SessionId, User, Service, KeyBlob, Alg) ->
 	   ?binary(KeyBlob)],
     list_to_binary(Sig).
 
-algorithm_string('ssh-rsa') ->
-    "ssh-rsa";
-algorithm_string('ssh-dss') ->
-     "ssh-dss".
 
-decode_keyboard_interactive_prompts(NumPrompts, Data) ->
-    Types = lists:append(lists:duplicate(NumPrompts, [string, boolean])),
-    pairwise_tuplify(ssh_bits:decode(Data, Types)).
 
-pairwise_tuplify([E1, E2 | Rest]) -> [{E1, E2} | pairwise_tuplify(Rest)];
-pairwise_tuplify([])              -> [].
-    
+decode_keyboard_interactive_prompts(_NumPrompts, Data) ->
+    ssh_message:decode_keyboard_interactive_prompts(Data, []).
 
 keyboard_interact_get_responses(IoCb, Opts, Name, Instr, PromptInfos) ->
     NumPrompts = length(PromptInfos),
-    case proplists:get_value(keyboard_interact_fun, Opts) of
-	undefined when NumPrompts == 1 ->
-	    %% Special case/fallback for just one prompt
-	    %% (assumed to be the password prompt)
-	    case proplists:get_value(password, Opts) of
-		undefined -> keyboard_interact(IoCb, Name, Instr, PromptInfos, Opts);
-		PW        -> [PW]
-	    end;
-	undefined ->
-	    keyboard_interact(IoCb, Name, Instr, PromptInfos, Opts);
-	KbdInteractFun ->
-	    Prompts = lists:map(fun({Prompt, _Echo}) -> Prompt end,
-				PromptInfos),
-	    case KbdInteractFun(Name, Instr, Prompts) of
-		Rs when length(Rs) == NumPrompts ->
-		    Rs;
-		Rs ->
-		    erlang:error({mismatching_number_of_responses,
-				  {got,Rs},
-				  {expected,NumPrompts}})
-	    end
-    end.
+    keyboard_interact_get_responses(proplists:get_value(user_interaction, Opts, true),
+				    proplists:get_value(keyboard_interact_fun, Opts),
+				    proplists:get_value(password, Opts, undefined), IoCb, Name,
+				    Instr, PromptInfos, Opts, NumPrompts).
+
+keyboard_interact_get_responses(_, undefined, Password, _, _, _, _, _,
+				1) when Password =/= undefined ->
+    [Password]; %% Password auth implemented with keyboard-interaction and passwd is known
+keyboard_interact_get_responses(_, _, _, _, _, _, _, _, 0)  ->
+    [];
+keyboard_interact_get_responses(false, undefined, undefined, _, _, _, [Prompt|_], Opts, _) ->
+    ssh_no_io:read_line(Prompt, Opts); %% Throws error as keyboard interaction is not allowed
+keyboard_interact_get_responses(true, undefined, _,IoCb, Name, Instr, PromptInfos, Opts, _) ->
+    keyboard_interact(IoCb, Name, Instr, PromptInfos, Opts);
+keyboard_interact_get_responses(true, Fun, _Pwd, _IoCb, Name, Instr, PromptInfos, _Opts, NumPrompts) ->
+    keyboard_interact_fun(Fun, Name, Instr, PromptInfos, NumPrompts).
 
 keyboard_interact(IoCb, Name, Instr, Prompts, Opts) ->
-    if Name /= "" -> IoCb:format("~s", [Name]);
+    if Name /= "" -> IoCb:format("~s~n", [Name]);
        true       -> ok
     end,
-    if Instr /= "" -> IoCb:format("~s", [Instr]);
+    if Instr /= "" -> IoCb:format("~s~n", [Instr]);
        true        -> ok
     end,
     lists:map(fun({Prompt, true})  -> IoCb:read_line(Prompt, Opts);
@@ -431,54 +497,33 @@ keyboard_interact(IoCb, Name, Instr, Prompts, Opts) ->
 	      end,
 	      Prompts).
 
-userauth_passwd_messages() ->
-    [ 
-      {ssh_msg_userauth_passwd_changereq, ?SSH_MSG_USERAUTH_PASSWD_CHANGEREQ,
-       [string, 
-	string]}
-     ].
-
-userauth_keyboard_interactive_messages() ->
-    [ {ssh_msg_userauth_info_request, ?SSH_MSG_USERAUTH_INFO_REQUEST,
-       [string, 
-	string,
-	string,
-	uint32,
-	'...']},
-
-      {ssh_msg_userauth_info_response, ?SSH_MSG_USERAUTH_INFO_RESPONSE,
-       [uint32, 
-	'...']}
-     ].
-
-userauth_pk_messages() ->
-    [ {ssh_msg_userauth_pk_ok, ?SSH_MSG_USERAUTH_PK_OK,
-       [string, % algorithm name
-	binary]} % key blob
-     ].
-
-other_alg('ssh-rsa') ->
-    'ssh-dss';
-other_alg('ssh-dss') ->
-    'ssh-rsa'.
-decode_public_key_v2(K_S, "ssh-rsa") ->
-    case ssh_bits:decode(K_S,[string,mpint,mpint]) of
-	["ssh-rsa", E, N] ->
-	    {ok, #'RSAPublicKey'{publicExponent = E, modulus = N}};
-	_ ->
-	    {error, bad_format}
-    end;
-decode_public_key_v2(K_S, "ssh-dss") ->
-     case ssh_bits:decode(K_S,[string,mpint,mpint,mpint,mpint]) of
-	 ["ssh-dss",P,Q,G,Y] ->
-	     {ok, {Y, #'Dss-Parms'{p = P, q = Q, g = G}}};
-	 _ ->
-	     {error, bad_format}
-     end;
-decode_public_key_v2(_, _) ->
-    {error, bad_format}.
-
-encode_public_key(#'RSAPrivateKey'{publicExponent = E, modulus = N}) ->
-    ssh_bits:encode(["ssh-rsa",E,N], [string,mpint,mpint]);
-encode_public_key(#'DSAPrivateKey'{p = P, q = Q, g = G, y = Y}) ->
-    ssh_bits:encode(["ssh-dss",P,Q,G,Y], [string,mpint,mpint,mpint,mpint]).
+keyboard_interact_fun(KbdInteractFun, Name, Instr,  PromptInfos, NumPrompts) ->
+    Prompts = lists:map(fun({Prompt, _Echo}) -> Prompt end,
+			PromptInfos),
+    case KbdInteractFun(Name, Instr, Prompts) of
+	Rs when length(Rs) == NumPrompts ->
+	    Rs;
+	Rs ->
+	    throw({mismatching_number_of_responses,
+		   {got,Rs},
+		   {expected, NumPrompts},
+		   #ssh_msg_disconnect{code = ?SSH_DISCONNECT_SERVICE_NOT_AVAILABLE,
+				       description = "User interaction failed",
+				       language = "en"}})
+    end.
+
+decode_public_key_v2(Bin, _Type) ->
+    try 
+	public_key:ssh_decode(Bin, ssh2_pubkey)
+    of
+	Key -> {ok, Key}
+    catch
+	_:_ -> {error, bad_format}
+    end.
+
+encode_public_key(_Alg, Key) ->
+    try
+	public_key:ssh_encode(Key, ssh2_pubkey)
+    catch
+	_:_ -> not_ok
+    end.
diff --git a/lib/ssh/src/ssh_auth.hrl b/lib/ssh/src/ssh_auth.hrl
index 6cd8e6bf14..56314ca6d9 100644
--- a/lib/ssh/src/ssh_auth.hrl
+++ b/lib/ssh/src/ssh_auth.hrl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2008-2012. All Rights Reserved.
+%% Copyright Ericsson AB 2008-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
@@ -21,9 +22,6 @@
 
 %%% Description: Ssh User Authentication Protocol
 
--define(SUPPORTED_AUTH_METHODS, "publickey,keyboard-interactive,password").
-
--define(PREFERRED_PK_ALG, 'ssh-rsa').
 
 -define(SSH_MSG_USERAUTH_REQUEST,  50).
 -define(SSH_MSG_USERAUTH_FAILURE,  51).
diff --git a/lib/ssh/src/ssh_bits.erl b/lib/ssh/src/ssh_bits.erl
index fc6efc817f..8bedaaf0c5 100644
--- a/lib/ssh/src/ssh_bits.erl
+++ b/lib/ssh/src/ssh_bits.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2005-2013. All Rights Reserved.
+%% Copyright Ericsson AB 2005-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
@@ -25,62 +26,30 @@
 
 -include("ssh.hrl").
 
--export([encode/1, encode/2]).
--export([decode/1, decode/2, decode/3]).
--export([mpint/1,  bignum/1, string/1, name_list/1]).
--export([b64_encode/1, b64_decode/1]).
--export([install_messages/1, uninstall_messages/1]).
-
-%% integer utils
--export([isize/1]).
+-export([mpint/1, name_list/1]).
 -export([random/1]).
--export([xor_bits/2, fill_bits/2]).
--export([i2bin/2, bin2i/1]).
-
--import(lists, [foreach/2, reverse/1]).
-
--define(name_list(X), 
-	(fun(B) -> ?binary(B) end)(list_to_binary(name_concat(X)))).
-
 
-name_concat([Name]) when is_atom(Name) -> atom_to_list(Name);
-name_concat([Name]) when is_list(Name) -> Name;
-name_concat([Name|Ns]) -> 
-    if is_atom(Name) ->
-	    [atom_to_list(Name),"," | name_concat(Ns)];
-       is_list(Name) ->
-	    [Name,"," | name_concat(Ns)]
-    end;
-name_concat([]) -> [].
-
-
-name_list(Ns) ->
-    ?name_list(Ns).
+%%%----------------------------------------------------------------
+name_list([Name]) -> to_bin(Name);
+name_list([Name|Ns]) -> <<(to_bin(Name))/binary, ",", (name_list(Ns))/binary>>;
+name_list([]) -> <<>>.
+
+to_bin(A) when is_atom(A) -> list_to_binary(atom_to_list(A));
+to_bin(S) when is_list(S) -> list_to_binary(S);
+to_bin(B) when is_binary(B) -> B.
+
+%%%----------------------------------------------------------------
+%%% Multi Precision Integer encoding
+mpint(-1) -> <<0,0,0,1,16#ff>>;
+mpint(0) -> <<0,0,0,0>>;
+mpint(X) when X < 0 -> mpint_neg(X,0,[]);
+mpint(X) -> mpint_pos(X,0,[]).
     
-
-string(Str) ->
-    ?string(Str).
-
-
-%% MP representaion  (SSH2)
-mpint(X) when X < 0 ->
-    if X == -1 ->
-	    <<0,0,0,1,16#ff>>;	    
-       true ->
-	    mpint_neg(X,0,[])
-    end;
-mpint(X) ->
-    if X == 0 ->
-	    <<0,0,0,0>>;
-       true ->
-	    mpint_pos(X,0,[])
-    end.
-
 mpint_neg(-1,I,Ds=[MSB|_]) ->
     if MSB band 16#80 =/= 16#80 ->
 	    <<?UINT32((I+1)), (list_to_binary([255|Ds]))/binary>>;
        true ->
-	    (<<?UINT32(I), (list_to_binary(Ds))/binary>>)
+	    <<?UINT32(I), (list_to_binary(Ds))/binary>>
     end;
 mpint_neg(X,I,Ds)  ->
     mpint_neg(X bsr 8,I+1,[(X band 255)|Ds]).
@@ -89,322 +58,17 @@ mpint_pos(0,I,Ds=[MSB|_]) ->
     if MSB band 16#80 == 16#80 ->
 	    <<?UINT32((I+1)), (list_to_binary([0|Ds]))/binary>>;
        true ->
-	    (<<?UINT32(I), (list_to_binary(Ds))/binary>>)
+	    <<?UINT32(I), (list_to_binary(Ds))/binary>>
     end;
 mpint_pos(X,I,Ds) ->
     mpint_pos(X bsr 8,I+1,[(X band 255)|Ds]).
 
 
-%% BIGNUM representation SSH1
-bignum(X) ->
-    XSz = isize(X),
-    Pad = (8 - (XSz rem 8)) rem 8,
-    <<?UINT16(XSz),0:Pad/unsigned-integer,X:XSz/big-unsigned-integer>>.
-
-
-install_messages(Codes) ->
-    foreach(fun({Name, Code, Ts}) ->
-		    put({msg_name,Code}, {Name,Ts}),
-		    put({msg_code,Name}, {Code,Ts})
-	    end, Codes).
-
-uninstall_messages(Codes) ->
-    foreach(fun({Name, Code, _Ts}) ->
-		    erase({msg_name,Code}),
-		    erase({msg_code,Name})
-	    end, Codes).
-
-%%
-%% Encode a record, the type spec is expected to be 
-%% in process dictionary under the key {msg_code, RecodeName}
-%%
-encode(Record) ->
-    case get({msg_code, element(1, Record)}) of
-	undefined -> 
-	    {error, unimplemented};
-	{Code, Ts} ->
-	    Data = enc(tl(tuple_to_list(Record)), Ts),
-	    list_to_binary([Code, Data])
-    end.
-
-encode(List, Types) ->
-    list_to_binary(enc(List, Types)).
-
-%%
-%% Encode record element
-%%
-enc(Xs, Ts) ->
-    enc(Xs, Ts, 0).
-
-enc(Xs, [Type|Ts], Offset) ->
-    case Type of
-	boolean ->
-	    X=hd(Xs), 
-	    [?boolean(X) | enc(tl(Xs), Ts, Offset+1)];
-	byte ->
-	    X=hd(Xs),
-	    [?byte(X) | enc(tl(Xs), Ts,Offset+1)];
-	uint16 ->  
-	    X=hd(Xs),
-	    [?uint16(X) | enc(tl(Xs), Ts,Offset+2)];
-	uint32 ->
-	    X=hd(Xs),
-	    [?uint32(X) | enc(tl(Xs), Ts,Offset+4)];
-	uint64 ->
-	    X=hd(Xs),
-	    [?uint64(X) | enc(tl(Xs), Ts,Offset+8)];
-	mpint ->
-	    Y=mpint(hd(Xs)),
-	    [Y | enc(tl(Xs), Ts,Offset+size(Y))];
-	bignum ->  
-	    Y=bignum(hd(Xs)),
-	    [Y | enc(tl(Xs),Ts,Offset+size(Y))];
-	string ->
-	    X0=hd(Xs),
-	    Y=?string(X0),
-	    [Y | enc(tl(Xs),Ts,Offset+size(Y))];
-	binary ->
-	    X0=hd(Xs),
-	    Y=?binary(X0),
-	    [Y | enc(tl(Xs), Ts,Offset+size(Y))];
-	name_list -> 
-	    X0=hd(Xs),
-	    Y=?name_list(X0),
-	    [Y | enc(tl(Xs), Ts, Offset+size(Y))];
-	cookie -> 
-	    [random(16) | enc(tl(Xs), Ts, Offset+16)];
-	{pad,N} ->
-	    K = (N - (Offset rem N)) rem N,
-	    [fill_bits(K,0) | enc(Xs, Ts, Offset+K)];
-	'...' when Ts==[] ->
-	    X=hd(Xs),
-	    if is_binary(X) -> 
-		    [X];
-	       is_list(X) ->
-		    [list_to_binary(X)];
-	       X==undefined ->
-		    []
-	    end
-    end;
-enc([], [],_) ->
-    [].
-
-
-
-%%
-%% Decode a SSH record the type is encoded as the first byte
-%% and the type spec MUST be installed in {msg_name, ID}
-%%
-
-decode(Binary = <<?BYTE(ID), _/binary>>) ->
-    case get({msg_name, ID}) of
-	undefined -> 
-	    {unknown, Binary};
-	{Name, Ts} ->
-	    {_, Elems} = decode(Binary,1,Ts),
-	    list_to_tuple([Name | Elems])
-    end.
-
-%%
-%% Decode a binary form offset 0
-%%
-
-decode(Binary, Types) when is_binary(Binary) andalso is_list(Types) ->
-    {_,Elems} = decode(Binary, 0, Types),
-    Elems.
-
-
-%%
-%% Decode a binary from byte offset Offset
-%% return {UpdatedOffset, DecodedElements}
-%%
-decode(Binary, Offset, Types) ->
-    decode(Binary, Offset, Types, []).
-
-decode(Binary, Offset, [Type|Ts], Acc) ->
-    case Type of
-	boolean ->
-	    <<_:Offset/binary, ?BOOLEAN(X0), _/binary>> = Binary,
-	    X = if X0 == 0 -> false; true -> true end,
-	    decode(Binary, Offset+1, Ts, [X | Acc]);
-
-	byte ->
-	    <<_:Offset/binary, ?BYTE(X), _/binary>> = Binary,
-	    decode(Binary, Offset+1, Ts, [X | Acc]);
-
-	uint16 ->
-	    <<_:Offset/binary, ?UINT16(X), _/binary>> = Binary,
-	    decode(Binary, Offset+2, Ts, [X | Acc]);
-
-	uint32 ->
-	    <<_:Offset/binary, ?UINT32(X), _/binary>> = Binary,
-	    decode(Binary, Offset+4, Ts, [X | Acc]);
-
-	uint64 ->
-	    <<_:Offset/binary, ?UINT64(X), _/binary>> = Binary,
-	    decode(Binary, Offset+8, Ts, [X | Acc]);
-
-	mpint ->
-	    <<_:Offset/binary, ?UINT32(L), X0:L/binary,_/binary>> = Binary,
-	    Sz = L*8,
-	    <<X:Sz/big-signed-integer>> = X0,
-	    decode(Binary, Offset+4+L, Ts, [X | Acc]);
-
-	bignum ->
-	    <<_:Offset/binary, ?UINT16(Bits),_/binary>> = Binary,
-	    L = (Bits+7) div 8,
-	    Pad = (8 - (Bits rem 8)) rem 8,
-	    <<_:Offset/binary, _:16, _:Pad, X:Bits/big-unsigned-integer,
-	     _/binary>> = Binary,
-	    decode(Binary, Offset+2+L, Ts, [X | Acc]);
-
-	string ->
-	    Size = size(Binary),
-	    if Size < Offset + 4  ->
-		    %% empty string at end
-		    {Size, reverse(["" | Acc])};
-	       true ->
-		    <<_:Offset/binary,?UINT32(L), X:L/binary,_/binary>> =
-			Binary,
-		    decode(Binary, Offset+4+L, Ts, [binary_to_list(X) | 
-						    Acc])
-	    end;
-
-	binary ->
-	    <<_:Offset/binary,?UINT32(L), X:L/binary,_/binary>> = Binary,
-	    decode(Binary, Offset+4+L, Ts, [X | Acc]);
-
-	name_list ->
-	    <<_:Offset/binary,?UINT32(L), X:L/binary,_/binary>> = Binary,
-	    List = string:tokens(binary_to_list(X), ","),
-	    decode(Binary, Offset+4+L, Ts, [List | Acc]);
-
-	cookie ->
-	    <<_:Offset/binary, X:16/binary, _/binary>> = Binary,
-	    decode(Binary, Offset+16, Ts, [X | Acc]);
-
-	{pad,N} -> %% pad offset to a multiple of N
-	    K = (N - (Offset rem N)) rem N,
-	    decode(Binary, Offset+K, Ts, Acc);
-	    
-	
-	'...' when Ts==[] ->
-	    <<_:Offset/binary, X/binary>> = Binary,
-	    {Offset+size(X), reverse([X | Acc])}
-    end;
-decode(_Binary, Offset, [], Acc) ->
-    {Offset, reverse(Acc)}.
-
-
-
-%% HACK WARNING :-)
--define(VERSION_MAGIC, 131).
--define(SMALL_INTEGER_EXT, $a).
--define(INTEGER_EXT,       $b).
--define(SMALL_BIG_EXT,     $n).
--define(LARGE_BIG_EXT,     $o).
-
-isize(N) when N > 0 ->
-    case term_to_binary(N) of
-	<<?VERSION_MAGIC, ?SMALL_INTEGER_EXT, X>> ->
-	    isize_byte(X);
-	<<?VERSION_MAGIC, ?INTEGER_EXT, X3,X2,X1,X0>> ->
-	    isize_bytes([X3,X2,X1,X0]);
-	<<?VERSION_MAGIC, ?SMALL_BIG_EXT, S:8/big-unsigned-integer, 0,
-	 Ds:S/binary>> ->
-	    K = S - 1,
-	    <<_:K/binary, Top>> = Ds,
-	    isize_byte(Top)+K*8;
-	<<?VERSION_MAGIC, ?LARGE_BIG_EXT, S:32/big-unsigned-integer, 0,
-	 Ds:S/binary>> ->
-	    K = S - 1,
-	    <<_:K/binary, Top>> = Ds,
-	    isize_byte(Top)+K*8
-    end;
-isize(0) -> 0.
-
-%% big endian byte list
-isize_bytes([0|L]) ->
-    isize_bytes(L);
-isize_bytes([Top|L]) ->
-    isize_byte(Top) + length(L)*8.
-
-%% Well could be improved
-isize_byte(X) ->
-    if X >= 2#10000000 -> 8;
-       X >= 2#1000000 -> 7;
-       X >= 2#100000 -> 6;
-       X >= 2#10000 -> 5;
-       X >= 2#1000 -> 4;
-       X >= 2#100 -> 3;
-       X >= 2#10 -> 2;
-       X >= 2#1 -> 1;
-       true -> 0
-    end.
-
-%% Convert integer into binary 
-%% When XLen is the wanted size in octets of the output
-i2bin(X, XLen) ->
-    XSz = isize(X),
-    Sz = XLen*8,
-    if Sz < XSz -> 
-	    exit(integer_to_large);
-       true ->
-	    (<<X:Sz/big-unsigned-integer>>)
-    end.
-
-%% Convert a binary into an integer
-%%
-bin2i(X) ->
-    Sz = size(X)*8,
-    <<Y:Sz/big-unsigned-integer>> = X,
-    Y.
-
-%%
-%% Create a binary with constant bytes 
-%%
-fill_bits(N,C) ->
-    list_to_binary(fill(N,C)).
-
-fill(0,_C) -> [];
-fill(1,C) -> [C];
-fill(N,C) ->
-    Cs = fill(N div 2, C),
-    Cs1 = [Cs,Cs],
-    if N band 1 == 0 ->
-	    Cs1;
-       true ->
-	    [C,Cs,Cs]
-    end.
-
-%% xor 2 binaries
-xor_bits(XBits, YBits) ->
-    XSz = size(XBits)*8,
-    YSz = size(YBits)*8,
-    Sz = if XSz < YSz -> XSz; true -> YSz end, %% min
-    <<X:Sz, _/binary>> = XBits,
-    <<Y:Sz, _/binary>> = YBits,
-    <<(X bxor Y):Sz>>.
-
-
+%%%----------------------------------------------------------------
 %% random/1
 %%   Generate N random bytes
 %%
-random(N) ->
-    crypto:strong_rand_bytes(N).
-
-%%
-%% Base 64 encode/decode
-%%
-
-b64_encode(Bs) when is_list(Bs) -> 
-    base64:encode(Bs);    
-b64_encode(Bin) when is_binary(Bin) ->
-    base64:encode(Bin).
+random(N) -> crypto:strong_rand_bytes(N).
 
-b64_decode(Bin) when is_binary(Bin) -> 
-    base64:mime_decode(Bin);
-b64_decode(Cs) when is_list(Cs) -> 
-    base64:mime_decode(Cs).
 
 
diff --git a/lib/ssh/src/ssh_channel.erl b/lib/ssh/src/ssh_channel.erl
index 062ed764ca..a8e6ebde16 100644
--- a/lib/ssh/src/ssh_channel.erl
+++ b/lib/ssh/src/ssh_channel.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2008-2013. All Rights Reserved.
+%% Copyright Ericsson AB 2008-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
@@ -67,7 +68,8 @@
 %% Internal application API
 -export([cache_create/0, cache_lookup/2, cache_update/2, 
 	 cache_delete/1, cache_delete/2,  cache_foldl/3,
-	 cache_find/2]).
+	 cache_info/2,  cache_find/2,
+	 get_print_info/1]).
 
 -record(state, {
 	  cm,
@@ -190,6 +192,14 @@ init([Options]) ->
 %%                                      {stop, Reason, State}
 %% Description: Handling call messages
 %%--------------------------------------------------------------------
+handle_call(get_print_info, _From, State) ->
+    Reply =
+	{{State#state.cm,
+	  State#state.channel_id},
+	 io_lib:format('CB=~p',[State#state.channel_cb])
+	},
+    {reply, Reply, State};
+
 handle_call(Request, From, #state{channel_cb = Module, 
 				  channel_state = ChannelState} = State) ->
    try Module:handle_call(Request, From, ChannelState) of
@@ -284,7 +294,7 @@ handle_info(Msg, #state{cm = ConnectionManager, channel_cb = Module,
 terminate(Reason, #state{cm = ConnectionManager, 
  			 channel_id = ChannelId,
  			 close_sent = false} = State) ->
-    ssh_connection:close(ConnectionManager, ChannelId),
+    catch ssh_connection:close(ConnectionManager, ChannelId),
     terminate(Reason, State#state{close_sent = true});
 terminate(_, #state{channel_cb = Cb, channel_state = ChannelState}) ->
     catch Cb:terminate(Cb, ChannelState),
@@ -325,6 +335,9 @@ cache_delete(Cache) ->
 cache_foldl(Fun, Acc, Cache) ->
     ets:foldl(Fun, Acc, Cache).
     
+cache_info(num_entries, Cache) ->
+    proplists:get_value(size, ets:info(Cache)).
+
 cache_find(ChannelPid, Cache) ->
    case ets:match_object(Cache, #channel{user = ChannelPid}) of
        [] ->
@@ -333,6 +346,9 @@ cache_find(ChannelPid, Cache) ->
 	   Channel
    end.
 
+get_print_info(Pid) ->
+    call(Pid, get_print_info, 1000).
+
 %%--------------------------------------------------------------------
 %%% Internal functions
 %%--------------------------------------------------------------------
diff --git a/lib/ssh/src/ssh_channel_sup.erl b/lib/ssh/src/ssh_channel_sup.erl
index 0093bce9c2..6b01dc334d 100644
--- a/lib/ssh/src/ssh_channel_sup.erl
+++ b/lib/ssh/src/ssh_channel_sup.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2008-2010. All Rights Reserved.
+%% Copyright Ericsson AB 2008-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
@@ -31,7 +32,7 @@
 -export([init/1]).
 
 %%%=========================================================================
-%%%  API
+%%%  Internal API
 %%%=========================================================================
 start_link(Args) ->
     supervisor:start_link(?MODULE, [Args]).
@@ -42,6 +43,8 @@ start_child(Sup, ChildSpec) ->
 %%%=========================================================================
 %%%  Supervisor callback
 %%%=========================================================================
+-spec init( [term()] ) -> {ok,{supervisor:sup_flags(),[supervisor:child_spec()]}} | ignore .
+
 init(_Args) ->
     RestartStrategy = one_for_one,
     MaxR = 10,
diff --git a/lib/ssh/src/ssh_cli.erl b/lib/ssh/src/ssh_cli.erl
index 69b1ab186f..74cd2e081a 100644
--- a/lib/ssh/src/ssh_cli.erl
+++ b/lib/ssh/src/ssh_cli.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2005-2013. All Rights Reserved.
+%% Copyright Ericsson AB 2005-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
@@ -32,9 +33,6 @@
 %% ssh_channel callbacks
 -export([init/1, handle_ssh_msg/2, handle_msg/2, terminate/2]).
 
-%% backwards compatibility
--export([listen/1, listen/2, listen/3, listen/4, stop/1]).
-
 %% state
 -record(state, {
 	  cm,
@@ -49,6 +47,21 @@
 %%====================================================================
 %% ssh_channel callbacks
 %%====================================================================
+-spec init(Args :: term()) ->
+    {ok, State :: term()} | {ok, State :: term(), timeout() | hibernate} |
+    {stop, Reason :: term()} | ignore.
+
+-spec terminate(Reason :: (normal | shutdown | {shutdown, term()} |
+                               term()),
+                    State :: term()) ->
+    term().
+
+-spec handle_msg(Msg ::term(), State :: term()) ->
+    {ok, State::term()} | {stop, ChannelId::integer(), State::term()}. 
+-spec handle_ssh_msg({ssh_cm, ConnectionRef::term(), SshMsg::term()},
+			 State::term()) -> {ok, State::term()} |
+					   {stop, ChannelId::integer(),
+					    State::term()}.
 
 %%--------------------------------------------------------------------
 %% Function: init(Args) -> {ok, State} 
@@ -65,13 +78,14 @@ init([Shell]) ->
 %%                        
 %% Description: Handles channel messages received on the ssh-connection.
 %%--------------------------------------------------------------------
-handle_ssh_msg({ssh_cm, _ConnectionManager, 
+handle_ssh_msg({ssh_cm, _ConnectionHandler,
 		{data, _ChannelId, _Type, Data}}, 
 	       #state{group = Group} = State) ->
-    Group ! {self(), {data, binary_to_list(Data)}},
+    List = binary_to_list(Data),
+    to_group(List, Group),
     {ok, State};
 
-handle_ssh_msg({ssh_cm, ConnectionManager, 
+handle_ssh_msg({ssh_cm, ConnectionHandler,
 		{pty, ChannelId, WantReply, 
 		 {TermName, Width, Height, PixWidth, PixHeight, Modes}}}, 
 	       State0) ->
@@ -84,53 +98,53 @@ handle_ssh_msg({ssh_cm, ConnectionManager,
                   modes = Modes},
              buf = empty_buf()},
     set_echo(State),
-    ssh_connection:reply_request(ConnectionManager, WantReply, 
+    ssh_connection:reply_request(ConnectionHandler, WantReply,
 				 success, ChannelId),
     {ok, State};
 
-handle_ssh_msg({ssh_cm, ConnectionManager, 
+handle_ssh_msg({ssh_cm, ConnectionHandler,
 	    {env, ChannelId, WantReply, _Var, _Value}}, State) ->
-    ssh_connection:reply_request(ConnectionManager, 
+    ssh_connection:reply_request(ConnectionHandler,
 				 WantReply, failure, ChannelId),
     {ok, State};
 
-handle_ssh_msg({ssh_cm, ConnectionManager,
+handle_ssh_msg({ssh_cm, ConnectionHandler,
 	    {window_change, ChannelId, Width, Height, PixWidth, PixHeight}},
 	   #state{buf = Buf, pty = Pty0} = State) ->
     Pty = Pty0#ssh_pty{width = Width, height = Height,
 		       pixel_width = PixWidth,
 		       pixel_height = PixHeight},
-    {Chars, NewBuf} = io_request({window_change, Pty0}, Buf, Pty),
-    write_chars(ConnectionManager, ChannelId, Chars),
+    {Chars, NewBuf} = io_request({window_change, Pty0}, Buf, Pty, undefined),
+    write_chars(ConnectionHandler, ChannelId, Chars),
     {ok, State#state{pty = Pty, buf = NewBuf}};
 
-handle_ssh_msg({ssh_cm, ConnectionManager, 
+handle_ssh_msg({ssh_cm, ConnectionHandler,
 	    {shell, ChannelId, WantReply}}, State) ->
-    NewState = start_shell(ConnectionManager, State),
-    ssh_connection:reply_request(ConnectionManager, WantReply, 
+    NewState = start_shell(ConnectionHandler, State),
+    ssh_connection:reply_request(ConnectionHandler, WantReply,
 				 success, ChannelId),
     {ok, NewState#state{channel = ChannelId,
-			cm = ConnectionManager}};
+			cm = ConnectionHandler}};
 
-handle_ssh_msg({ssh_cm, ConnectionManager, 
+handle_ssh_msg({ssh_cm, ConnectionHandler,
 		{exec, ChannelId, WantReply, Cmd}}, #state{exec=undefined} = State) ->
     {Reply, Status} = exec(Cmd),
-    write_chars(ConnectionManager, 
+    write_chars(ConnectionHandler,
 		ChannelId, io_lib:format("~p\n", [Reply])),
-    ssh_connection:reply_request(ConnectionManager, WantReply, 
+    ssh_connection:reply_request(ConnectionHandler, WantReply,
 				 success, ChannelId),
-    ssh_connection:exit_status(ConnectionManager, ChannelId, Status),
-    ssh_connection:send_eof(ConnectionManager, ChannelId),
-    {stop, ChannelId, State#state{channel = ChannelId, cm = ConnectionManager}};
-handle_ssh_msg({ssh_cm, ConnectionManager,
+    ssh_connection:exit_status(ConnectionHandler, ChannelId, Status),
+    ssh_connection:send_eof(ConnectionHandler, ChannelId),
+    {stop, ChannelId, State#state{channel = ChannelId, cm = ConnectionHandler}};
+handle_ssh_msg({ssh_cm, ConnectionHandler,
 		{exec, ChannelId, WantReply, Cmd}}, State) ->
-    NewState = start_shell(ConnectionManager, Cmd, State),
-    ssh_connection:reply_request(ConnectionManager, WantReply,
+    NewState = start_shell(ConnectionHandler, Cmd, State),
+    ssh_connection:reply_request(ConnectionHandler, WantReply,
 				 success, ChannelId),
     {ok, NewState#state{channel = ChannelId,
-			cm = ConnectionManager}};
+			cm = ConnectionHandler}};
 
-handle_ssh_msg({ssh_cm, _ConnectionManager, {eof, _ChannelId}}, State) ->
+handle_ssh_msg({ssh_cm, _ConnectionHandler, {eof, _ChannelId}}, State) ->
     {ok, State};
 
 handle_ssh_msg({ssh_cm, _, {signal, _, _}}, State) ->
@@ -158,16 +172,40 @@ handle_ssh_msg({ssh_cm, _, {exit_status, ChannelId, Status}}, State) ->
 %%                        
 %% Description: Handles other channel messages.
 %%--------------------------------------------------------------------
-handle_msg({ssh_channel_up, ChannelId, ConnectionManager},
+handle_msg({ssh_channel_up, ChannelId, ConnectionHandler},
 	   #state{channel = ChannelId,
-		  cm = ConnectionManager} = State) ->
+		  cm = ConnectionHandler} = State) ->
     {ok,  State};
 
+handle_msg({Group, set_unicode_state, _Arg}, State) ->
+    Group ! {self(), set_unicode_state, false},
+    {ok, State};
+
+handle_msg({Group, get_unicode_state}, State) ->
+    Group ! {self(), get_unicode_state, false},
+    {ok, State};
+
+handle_msg({Group, tty_geometry}, #state{group = Group,
+					 pty = Pty
+					} = State) ->
+    case Pty of
+	#ssh_pty{width=Width,height=Height} ->
+	    Group ! {self(),tty_geometry,{Width,Height}};
+	_ ->
+	    %% This is a dirty fix of the problem with the otp ssh:shell
+	    %% client. That client will not allocate a tty, but someone
+	    %% asks for the tty_geometry just before every erlang prompt.
+	    %% If that question is not answered, there is a 2 sec timeout
+	    %% Until the prompt is seen by the user at the client side ...
+	    Group ! {self(),tty_geometry,{0,0}}
+    end,
+    {ok,State};
+    
 handle_msg({Group, Req}, #state{group = Group, buf = Buf, pty = Pty,
-				 cm = ConnectionManager,
+				 cm = ConnectionHandler,
 				 channel = ChannelId} = State) ->
-    {Chars, NewBuf} = io_request(Req, Buf, Pty),
-    write_chars(ConnectionManager, ChannelId, Chars),
+    {Chars, NewBuf} = io_request(Req, Buf, Pty, Group),
+    write_chars(ConnectionHandler, ChannelId, Chars),
     {ok, State#state{buf = NewBuf}};
 
 handle_msg({'EXIT', Group, _Reason}, #state{group = Group,
@@ -188,6 +226,22 @@ terminate(_Reason, _State) ->
 %%% Internal functions
 %%--------------------------------------------------------------------
 
+to_group([], _Group) ->
+    ok;
+to_group([$\^C | Tail], Group) ->
+    exit(Group, interrupt),
+    to_group(Tail, Group);
+to_group(Data, Group) ->
+    Func = fun(C) -> C /= $\^C end,
+    Tail = case lists:splitwith(Func, Data) of
+        {[], Right} ->
+            Right;
+        {Left, Right} ->
+            Group ! {self(), {data, Left}},
+            Right
+    end,
+    to_group(Tail, Group).
+
 exec(Cmd) ->
     case eval(parse(scan(Cmd))) of
 	{error, _} ->
@@ -225,40 +279,49 @@ eval(Error) ->
 %%% displaying device...
 %%% We are *not* really unicode aware yet, we just filter away characters 
 %%% beyond the latin1 range. We however handle the unicode binaries...
-io_request({window_change, OldTty}, Buf, Tty) ->
+io_request({window_change, OldTty}, Buf, Tty, _Group) ->
     window_change(Tty, OldTty, Buf);
-io_request({put_chars, Cs}, Buf, Tty) ->
+io_request({put_chars, Cs}, Buf, Tty, _Group) ->
     put_chars(bin_to_list(Cs), Buf, Tty);
-io_request({put_chars, unicode, Cs}, Buf, Tty) ->
+io_request({put_chars, unicode, Cs}, Buf, Tty, _Group) ->
     put_chars(unicode:characters_to_list(Cs,unicode), Buf, Tty);
-io_request({insert_chars, Cs}, Buf, Tty) ->
+io_request({insert_chars, Cs}, Buf, Tty, _Group) ->
     insert_chars(bin_to_list(Cs), Buf, Tty);
-io_request({insert_chars, unicode, Cs}, Buf, Tty) ->
+io_request({insert_chars, unicode, Cs}, Buf, Tty, _Group) ->
     insert_chars(unicode:characters_to_list(Cs,unicode), Buf, Tty);
-io_request({move_rel, N}, Buf, Tty) ->
+io_request({move_rel, N}, Buf, Tty, _Group) ->
     move_rel(N, Buf, Tty);
-io_request({delete_chars,N}, Buf, Tty) ->
+io_request({delete_chars,N}, Buf, Tty, _Group) ->
     delete_chars(N, Buf, Tty);
-io_request(beep, Buf, _Tty) ->
+io_request(beep, Buf, _Tty, _Group) ->
     {[7], Buf};
 
 %% New in R12
-io_request({get_geometry,columns},Buf,Tty) ->
+io_request({get_geometry,columns},Buf,Tty, _Group) ->
     {ok, Tty#ssh_pty.width, Buf};
-io_request({get_geometry,rows},Buf,Tty) ->
+io_request({get_geometry,rows},Buf,Tty, _Group) ->
     {ok, Tty#ssh_pty.height, Buf};
-io_request({requests,Rs}, Buf, Tty) ->
-    io_requests(Rs, Buf, Tty, []);
-io_request(tty_geometry, Buf, Tty) ->
-    io_requests([{move_rel, 0}, {put_chars, unicode, [10]}], Buf, Tty, []);
+io_request({requests,Rs}, Buf, Tty, Group) ->
+    io_requests(Rs, Buf, Tty, [], Group);
+io_request(tty_geometry, Buf, Tty, Group) ->
+    io_requests([{move_rel, 0}, {put_chars, unicode, [10]}],
+                Buf, Tty, [], Group);
      %{[], Buf};
-io_request(_R, Buf, _Tty) ->
+
+%% New in 18
+io_request({put_chars_sync, Class, Cs, Reply}, Buf, Tty, Group) ->
+    %% We handle these asynchronous for now, if we need output guarantees
+    %% we have to handle these synchronously
+    Group ! {reply, Reply},
+    io_request({put_chars, Class, Cs}, Buf, Tty, Group);
+
+io_request(_R, Buf, _Tty, _Group) ->
     {[], Buf}.
 
-io_requests([R|Rs], Buf, Tty, Acc) ->
-    {Chars, NewBuf} = io_request(R, Buf, Tty),
-    io_requests(Rs, NewBuf, Tty, [Acc|Chars]);
-io_requests([], Buf, _Tty, Acc) ->
+io_requests([R|Rs], Buf, Tty, Acc, Group) ->
+    {Chars, NewBuf} = io_request(R, Buf, Tty, Group),
+    io_requests(Rs, NewBuf, Tty, [Acc|Chars], Group);
+io_requests([], Buf, _Tty, Acc, _Group) ->
     {Acc, Buf}.
 
 %%% return commands for cursor navigation, assume everything is ansi
@@ -320,7 +383,7 @@ delete_chars(N, {Buf, BufTail, Col}, Tty) when N > 0 ->
      {Buf, NewBufTail, Col}};
 delete_chars(N, {Buf, BufTail, Col}, Tty) -> % N < 0
     NewBuf = nthtail(-N, Buf),
-    NewCol = Col + N,
+    NewCol = case Col + N of V when V >= 0 -> V; _ -> 0 end,
     M1 = move_cursor(Col, NewCol, Tty),
     M2 = move_cursor(NewCol + length(BufTail) - N, NewCol, Tty),
     {[M1, BufTail, lists:duplicate(-N, $ ) | M2],
@@ -382,12 +445,12 @@ move_cursor(From, To, #ssh_pty{width=Width, term=Type}) ->
 %% %%% write out characters
 %% %%% make sure that there is data to send
 %% %%% before calling ssh_connection:send
-write_chars(ConnectionManager, ChannelId, Chars) ->
+write_chars(ConnectionHandler, ChannelId, Chars) ->
     case erlang:iolist_size(Chars) of
 	0 ->
 	    ok;
        _ ->
-	    ssh_connection:send(ConnectionManager, ChannelId, 
+	    ssh_connection:send(ConnectionHandler, ChannelId,
 				?SSH_EXTENDED_DATA_DEFAULT, Chars)
     end.
 
@@ -417,18 +480,20 @@ bin_to_list(L) when is_list(L) ->
 bin_to_list(I) when is_integer(I) ->
     I.
 
-start_shell(ConnectionManager, State) ->
+start_shell(ConnectionHandler, State) ->
     Shell = State#state.shell,
+    ConnectionInfo = ssh_connection_handler:connection_info(ConnectionHandler,
+						  [peer, user]),
     ShellFun = case is_function(Shell) of
 		   true ->
-		       {ok, User} = 
-			   ssh_userreg:lookup_user(ConnectionManager),
+		       User = 
+			   proplists:get_value(user, ConnectionInfo),
 		       case erlang:fun_info(Shell, arity) of
 			   {arity, 1} ->
 			       fun() -> Shell(User) end;
 			   {arity, 2} ->
-			       {ok, PeerAddr} = 
-				   ssh_connection_manager:peer_addr(ConnectionManager),
+			       {_, PeerAddr} =
+				   proplists:get_value(peer, ConnectionInfo),
 			       fun() -> Shell(User, PeerAddr) end;
 			   _ ->
 			       Shell
@@ -440,12 +505,15 @@ start_shell(ConnectionManager, State) ->
     Group = group:start(self(), ShellFun, [{echo, Echo}]),
     State#state{group = Group, buf = empty_buf()}.
 
-start_shell(_ConnectionManager, Cmd, #state{exec={M, F, A}} = State) ->
+start_shell(_ConnectionHandler, Cmd, #state{exec={M, F, A}} = State) ->
     Group = group:start(self(), {M, F, A++[Cmd]}, [{echo, false}]),
     State#state{group = Group, buf = empty_buf()};
-start_shell(ConnectionManager, Cmd, #state{exec=Shell} = State) when is_function(Shell) ->
-    {ok, User} = 
-	ssh_userreg:lookup_user(ConnectionManager),
+start_shell(ConnectionHandler, Cmd, #state{exec=Shell} = State) when is_function(Shell) ->
+
+    ConnectionInfo = ssh_connection_handler:connection_info(ConnectionHandler,
+						 [peer, user]),
+    User = 
+	proplists:get_value(user, ConnectionInfo),
     ShellFun = 
 	case erlang:fun_info(Shell, arity) of
 	    {arity, 1} ->
@@ -453,8 +521,8 @@ start_shell(ConnectionManager, Cmd, #state{exec=Shell} = State) when is_function
 	    {arity, 2} ->
 		fun() -> Shell(Cmd, User) end;
 	    {arity, 3} ->
-		{ok, PeerAddr} = 
-		    ssh_connection_manager:peer_addr(ConnectionManager),
+		{_, PeerAddr} =
+		    proplists:get_value(peer, ConnectionInfo),
 		fun() -> Shell(Cmd, User, PeerAddr) end;
 	    _ ->
 		Shell
@@ -488,31 +556,3 @@ not_zero(0, B) ->
 not_zero(A, _) -> 
     A.
 
-%%% Backwards compatibility
-	    
-%%--------------------------------------------------------------------
-%% Function: listen(...) -> {ok,Pid} | ignore | {error,Error}
-%% Description: Starts a listening server
-%% Note that the pid returned is NOT the pid of this gen_server;
-%% this server is started when an SSH connection is made on the
-%% listening port
-%%--------------------------------------------------------------------
-listen(Shell) ->
-    listen(Shell, 22).
-
-listen(Shell, Port) ->
-    listen(Shell, Port, []).
-
-listen(Shell, Port, Opts) ->
-    listen(Shell, any, Port, Opts).
-
-listen(Shell, HostAddr, Port, Opts) ->
-    ssh:daemon(HostAddr, Port, [{shell, Shell} | Opts]).
-    
-
-%%--------------------------------------------------------------------
-%% Function: stop(Pid) -> ok
-%% Description: Stops the listener
-%%--------------------------------------------------------------------
-stop(Pid) ->
-    ssh:stop_listener(Pid).
diff --git a/lib/ssh/src/ssh_client_key.erl b/lib/ssh/src/ssh_client_key.erl
index 2c48884dc2..5296ac2a02 100644
--- a/lib/ssh/src/ssh_client_key.erl
+++ b/lib/ssh/src/ssh_client_key.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2011-2012. All Rights Reserved.
+%% Copyright Ericsson AB 2011-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
diff --git a/lib/ssh/src/ssh_client_key_api.erl b/lib/ssh/src/ssh_client_key_api.erl
index a17c7cbc77..6e994ff292 100644
--- a/lib/ssh/src/ssh_client_key_api.erl
+++ b/lib/ssh/src/ssh_client_key_api.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2011-2013. All Rights Reserved.
+%% Copyright Ericsson AB 2011-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
@@ -22,14 +23,26 @@
 -include_lib("public_key/include/public_key.hrl").
 -include("ssh.hrl").
 
--callback is_host_key(PublicKey :: #'RSAPublicKey'{}| {integer(),  #'Dss-Parms'{}}| term() , Host :: string(),
-		      Algorithm :: 'ssh-rsa'| 'ssh-dss'| atom(), ConnectOptions :: proplists:proplist()) ->
+-export_type([algorithm/0]).
+
+-type algorithm()  :: 'ssh-rsa'
+		    | 'ssh-dss'
+		    | 'ecdsa-sha2-nistp256'
+		    | 'ecdsa-sha2-nistp384'
+		    | 'ecdsa-sha2-nistp521'
+		    .
+
+-callback is_host_key(PublicKey      :: public_key:public_key(),
+		      Host           :: string(),
+		      Algorithm      :: algorithm(),
+		      ConnectOptions :: proplists:proplist()) ->
     boolean().
 
--callback user_key(Algorithm ::  'ssh-rsa'| 'ssh-dss'| atom(), ConnectOptions :: proplists:proplist()) ->
-    {ok,  PrivateKey :: #'RSAPrivateKey'{}| #'DSAPrivateKey'{} |  term()} | {error, string()}.
+-callback user_key(Algorithm      :: algorithm(),
+		   ConnectOptions :: proplists:proplist()) ->
+    {ok,  PrivateKey::public_key:private_key()} | {error, term()}.
 
 
--callback add_host_key(Host :: string(), PublicKey ::  #'RSAPublicKey'{}| {integer(),  #'Dss-Parms'{}}| term(),
-		       Options :: list()) ->
+-callback add_host_key(Host :: string(), PublicKey :: public_key:public_key(),
+		       Options :: proplists:proplist()) ->
     ok | {error, Error::term()}.
diff --git a/lib/ssh/src/ssh_connect.hrl b/lib/ssh/src/ssh_connect.hrl
index 932b0642f1..4fb6bc39f3 100644
--- a/lib/ssh/src/ssh_connect.hrl
+++ b/lib/ssh/src/ssh_connect.hrl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2005-2012. All Rights Reserved.
+%% Copyright Ericsson AB 2005-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
@@ -21,9 +22,15 @@
 
 %%% Description : SSH connection protocol 
 
--define(DEFAULT_PACKET_SIZE, 32768).
--define(DEFAULT_WINDOW_SIZE, 2*?DEFAULT_PACKET_SIZE).
+-type role()               :: client | server .
+-type connection_ref()     :: pid().
+-type channel_id()         :: pos_integer().
+
+-define(DEFAULT_PACKET_SIZE, 65536).
+-define(DEFAULT_WINDOW_SIZE, 10*?DEFAULT_PACKET_SIZE).
+
 -define(DEFAULT_TIMEOUT, 5000).
+-define(MAX_PROTO_VERSION, 255).      % Max length of the hello string
 
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 %%
@@ -162,6 +169,10 @@
 	  recipient_channel
 	 }).
 
+-define(TERMINAL_WIDTH, 80).
+-define(TERMINAL_HEIGHT, 24).
+-define(DEFAULT_TERMINAL, "vt100").
+
 -define(TTY_OP_END,0).  %% Indicates end of options.
 -define(VINTR,1).       %% Interrupt character; 255 if none. Similarly for the
 			%% other characters. Not all of these characters are
@@ -232,7 +243,7 @@
 
 -record(channel,
 	{
-	  type,          %% "session", "x11", "forwarded-tcpip", "direct-tcpip"
+	  type,          %% "session"
 	  sys,           %% "none", "shell", "exec" "subsystem"
 	  user,          %% "user" process id (default to cm user)
 	  flow_control, 
@@ -240,6 +251,9 @@
 	  local_id,           %% local channel id
 
 	  recv_window_size,
+	  recv_window_pending = 0, %% Sum of window size updates that has not
+	                           %% yet been sent. This limits the number
+	                           %% of sent update msgs.
 	  recv_packet_size,
 	  recv_close = false,
 
@@ -260,6 +274,7 @@
 	  port,
 	  options,
 	  exec,
+	  system_supervisor,
 	  sub_system_supervisor,
 	  connection_supervisor
 	 }).
diff --git a/lib/ssh/src/ssh_connection.erl b/lib/ssh/src/ssh_connection.erl
index 9424cdd423..d0f2d54c06 100644
--- a/lib/ssh/src/ssh_connection.erl
+++ b/lib/ssh/src/ssh_connection.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2008-2012. All Rights Reserved.
+%% Copyright Ericsson AB 2008-2015. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
@@ -29,319 +30,257 @@
 -include("ssh_connect.hrl").
 -include("ssh_transport.hrl").
 
+%% API
 -export([session_channel/2, session_channel/4,
 	 exec/4, shell/2, subsystem/4, send/3, send/4, send/5, 
-	 send_eof/2, adjust_window/3, open_pty/3, open_pty/7,
-	 open_pty/9, setenv/5, window_change/4, window_change/6,
-	 direct_tcpip/6, direct_tcpip/8, tcpip_forward/3,
-	 cancel_tcpip_forward/3, signal/3, exit_status/3, encode_ip/1, close/2,
-	 reply_request/4]).
+	 send_eof/2, adjust_window/3, setenv/5, close/2, reply_request/4,
+	 ptty_alloc/3, ptty_alloc/4]).
+
+%% Potential API currently unsupported and not tested
+-export([window_change/4, window_change/6,
+	 signal/3, exit_status/3]).
 
--export([channel_data/6, handle_msg/4, channel_eof_msg/1,
+%% Internal application API
+-export([channel_data/5, handle_msg/3, channel_eof_msg/1,
 	 channel_close_msg/1, channel_success_msg/1, channel_failure_msg/1, 
+	 channel_status_msg/1,
 	 channel_adjust_window_msg/2, channel_data_msg/3,
 	 channel_open_msg/5, channel_open_confirmation_msg/4,
 	 channel_open_failure_msg/4, channel_request_msg/4,
-	 global_request_msg/3, request_failure_msg/0, 
+	 request_failure_msg/0, 
 	 request_success_msg/1, bind/4, unbind/3, unbind_channel/2, 
-	 bound_channel/3, messages/0]).
+	 bound_channel/3, encode_ip/1]).
 
 %%--------------------------------------------------------------------
-%%% Internal application API
+%%% API
 %%--------------------------------------------------------------------
 
 %%--------------------------------------------------------------------
-%% Function: session_channel(ConnectionManager 
-%%                           [, InitialWindowSize, MaxPacketSize], 
-%%                           Timeout) -> {ok, }
-%%   ConnectionManager = pid() 
-%%   InitialWindowSize = integer()
-%%   MaxPacketSize = integer() 
-%%
+-spec session_channel(pid(), timeout()) -> {ok, channel_id()} | {error, timeout | closed}.
+-spec session_channel(pid(), integer(), integer(), timeout()) -> {ok, channel_id()} | {error, timeout | closed}.
+
 %% Description: Opens a channel for a ssh session. A session is a
 %% remote execution of a program. The program may be a shell, an
 %% application, a system command, or some built-in subsystem.
 %% --------------------------------------------------------------------
-session_channel(ConnectionManager, Timeout) ->
-    session_channel(ConnectionManager, 
+
+session_channel(ConnectionHandler, Timeout) ->
+    session_channel(ConnectionHandler,
  		    ?DEFAULT_WINDOW_SIZE, ?DEFAULT_PACKET_SIZE,
  		    Timeout).
-session_channel(ConnectionManager, InitialWindowSize, 
+
+session_channel(ConnectionHandler, InitialWindowSize,
  		MaxPacketSize, Timeout) ->
-    ssh_connection_manager:open_channel(ConnectionManager, "session", <<>>,
+    case ssh_connection_handler:open_channel(ConnectionHandler, "session", <<>>,
 					InitialWindowSize,
- 					MaxPacketSize, Timeout).
+					MaxPacketSize, Timeout) of
+	{open, Channel} ->
+	    {ok, Channel};
+	Error ->
+	    Error
+    end.
+
 %%--------------------------------------------------------------------
-%% Function: exec(ConnectionManager, ChannelId, Command, Timeout) -> 
-%%
-%%   ConnectionManager = pid() 
-%%   ChannelId = integer()
-%%   Cmd = string()
-%%   Timeout = integer() 
-%%
+-spec exec(pid(), channel_id(), string(), timeout()) -> 
+		  success | failure | {error, timeout | closed}.
+
 %% Description: Will request that the server start the
 %% execution of the given command. 
 %%--------------------------------------------------------------------
-exec(ConnectionManager, ChannelId, Command, TimeOut) ->
-    ssh_connection_manager:request(ConnectionManager, self(), ChannelId, "exec", 
- 				   true, [?string(Command)], TimeOut).
+exec(ConnectionHandler, ChannelId, Command, TimeOut) ->
+    ssh_connection_handler:request(ConnectionHandler, self(), ChannelId, "exec",
+				   true, [?string(Command)], TimeOut).
+
 %%--------------------------------------------------------------------
-%% Function: shell(ConnectionManager, ChannelId) -> 
-%%
-%%   ConnectionManager = pid() 
-%%   ChannelId = integer()
-%%
+-spec shell(pid(), channel_id()) -> _.
+
 %% Description: Will request that the user's default shell (typically
 %% defined in /etc/passwd in UNIX systems) be started at the other
 %% end.
 %%--------------------------------------------------------------------
-shell(ConnectionManager, ChannelId) ->
-    ssh_connection_manager:request(ConnectionManager, self(), ChannelId, 
+shell(ConnectionHandler, ChannelId) ->
+    ssh_connection_handler:request(ConnectionHandler, self(), ChannelId,
  				   "shell", false, <<>>, 0).
 %%--------------------------------------------------------------------
-%% Function: subsystem(ConnectionManager, ChannelId, SubSystem, TimeOut) -> 
-%%
-%% ConnectionManager = pid() 
-%% ChannelId = integer()
-%% SubSystem = string()
-%% TimeOut = integer() 
-%%
+-spec subsystem(pid(), channel_id(), string(), timeout()) -> 
+		       success | failure | {error, timeout | closed}.
 %%
 %% Description: Executes a predefined subsystem.
 %%--------------------------------------------------------------------
-subsystem(ConnectionManager, ChannelId, SubSystem, TimeOut) ->
-     ssh_connection_manager:request(ConnectionManager, self(),
+subsystem(ConnectionHandler, ChannelId, SubSystem, TimeOut) ->
+     ssh_connection_handler:request(ConnectionHandler, self(),
 				    ChannelId, "subsystem", 
 				    true, [?string(SubSystem)], TimeOut).
 %%--------------------------------------------------------------------
-%% Function: send(ConnectionManager, ChannelId, Type, Data, [TimeOut]) ->
+-spec send(pid(), channel_id(), iodata()) ->
+		  ok | {error, closed}.
+-spec send(pid(), channel_id(), integer()| iodata(), timeout() | iodata()) ->
+		  ok | {error, timeout} | {error, closed}.
+-spec send(pid(), channel_id(), integer(), iodata(), timeout()) ->
+		  ok | {error, timeout} | {error, closed}.
 %%
 %%
 %% Description: Sends channel data.
 %%--------------------------------------------------------------------
-send(ConnectionManager, ChannelId, Data) ->
-    send(ConnectionManager, ChannelId, 0, Data, infinity).
-send(ConnectionManager, ChannelId, Data, TimeOut) when is_integer(TimeOut) ->
-    send(ConnectionManager, ChannelId, 0, Data, TimeOut);
-send(ConnectionManager, ChannelId, Data, infinity) ->
-    send(ConnectionManager, ChannelId, 0, Data, infinity);
-send(ConnectionManager, ChannelId, Type, Data) ->
-    send(ConnectionManager, ChannelId, Type, Data, infinity).
-send(ConnectionManager, ChannelId, Type, Data, TimeOut) ->
-    ssh_connection_manager:send(ConnectionManager, ChannelId, 
+send(ConnectionHandler, ChannelId, Data) ->
+    send(ConnectionHandler, ChannelId, 0, Data, infinity).
+send(ConnectionHandler, ChannelId, Data, TimeOut) when is_integer(TimeOut) ->
+    send(ConnectionHandler, ChannelId, 0, Data, TimeOut);
+send(ConnectionHandler, ChannelId, Data, infinity) ->
+    send(ConnectionHandler, ChannelId, 0, Data, infinity);
+send(ConnectionHandler, ChannelId, Type, Data) ->
+    send(ConnectionHandler, ChannelId, Type, Data, infinity).
+send(ConnectionHandler, ChannelId, Type, Data, TimeOut) ->
+    ssh_connection_handler:send(ConnectionHandler, ChannelId,
 				Type, Data, TimeOut).
 %%--------------------------------------------------------------------
-%% Function: send_eof(ConnectionManager, ChannelId) ->
+-spec send_eof(pid(), channel_id()) -> ok | {error, closed}.
 %%
 %%
 %% Description: Sends eof on the channel <ChannelId>.
 %%--------------------------------------------------------------------
-send_eof(ConnectionManager, Channel) ->
-    ssh_connection_manager:send_eof(ConnectionManager, Channel).
+send_eof(ConnectionHandler, Channel) ->
+    ssh_connection_handler:send_eof(ConnectionHandler, Channel).
 
 %%--------------------------------------------------------------------
-%% Function: adjust_window(ConnectionManager, Channel, Bytes) -> 
+-spec adjust_window(pid(), channel_id(), integer()) -> ok |  {error, closed}.
 %%
 %%
 %% Description: Adjusts the ssh flowcontrol window.
 %%--------------------------------------------------------------------
-adjust_window(ConnectionManager, Channel, Bytes) ->
-    ssh_connection_manager:adjust_window(ConnectionManager, Channel, Bytes).
+adjust_window(ConnectionHandler, Channel, Bytes) ->
+    ssh_connection_handler:adjust_window(ConnectionHandler, Channel, Bytes).
 
 %%--------------------------------------------------------------------
-%% Function: setenv(ConnectionManager, ChannelId, Var, Value, TimeOut) ->
+-spec setenv(pid(), channel_id(), string(), string(), timeout()) ->  
+		    success | failure | {error, timeout | closed}.
 %%
 %%
 %% Description: Environment variables may be passed to the shell/command to be
 %% started later.
 %%--------------------------------------------------------------------
-setenv(ConnectionManager, ChannelId, Var, Value, TimeOut) ->
-    ssh_connection_manager:request(ConnectionManager, ChannelId, 
+setenv(ConnectionHandler, ChannelId, Var, Value, TimeOut) ->
+    ssh_connection_handler:request(ConnectionHandler, ChannelId,
 	    "env", true, [?string(Var), ?string(Value)], TimeOut).
 
 
 %%--------------------------------------------------------------------
-%% Function: close(ConnectionManager, ChannelId) ->
+-spec close(pid(), channel_id()) -> ok.
 %%
 %%
 %% Description: Sends a close message on the channel <ChannelId>.
 %%--------------------------------------------------------------------
-close(ConnectionManager, ChannelId) ->
-    ssh_connection_manager:close(ConnectionManager, ChannelId).
-
+close(ConnectionHandler, ChannelId) ->
+    ssh_connection_handler:close(ConnectionHandler, ChannelId).
 
 %%--------------------------------------------------------------------
-%% Function: reply_request(ConnectionManager, WantReply, Status, CannelId) ->_
+-spec reply_request(pid(), boolean(), success | failure, channel_id()) -> ok.
 %%
 %%
 %% Description: Send status replies to requests that want such replies.
 %%--------------------------------------------------------------------
-reply_request(ConnectionManager, true, Status, ChannelId) ->
-    ssh_connection_manager:reply_request(ConnectionManager, Status, ChannelId),
-    ok;
+reply_request(ConnectionHandler, true, Status, ChannelId) ->
+    ssh_connection_handler:reply_request(ConnectionHandler, Status, ChannelId);
 reply_request(_,false, _, _) ->
     ok.
 
-
 %%--------------------------------------------------------------------
-%% Function: window_change(ConnectionManager, Channel, Width, Height) ->
+-spec ptty_alloc(pid(), channel_id(), proplists:proplist()) -> 
+			success | failiure | {error, closed}.
+-spec ptty_alloc(pid(), channel_id(), proplists:proplist(), timeout()) -> 
+			success | failiure | {error, timeout} | {error, closed}.
+
 %%
 %%
-%% Description: Not yet officialy supported.
+%% Description: Sends a ssh connection protocol pty_req.
+%%--------------------------------------------------------------------
+ptty_alloc(ConnectionHandler, Channel, Options) ->
+    ptty_alloc(ConnectionHandler, Channel, Options, infinity).
+ptty_alloc(ConnectionHandler, Channel, Options0, TimeOut) ->
+    Options = backwards_compatible(Options0, []),
+    {Width, PixWidth} = pty_default_dimensions(width, Options),
+    {Height, PixHeight} = pty_default_dimensions(height, Options),
+    pty_req(ConnectionHandler, Channel,
+	    proplists:get_value(term, Options, os:getenv("TERM", ?DEFAULT_TERMINAL)),
+	    proplists:get_value(width, Options, Width),
+	    proplists:get_value(height, Options, Height),
+	    proplists:get_value(pixel_widh, Options, PixWidth),
+	    proplists:get_value(pixel_height, Options, PixHeight),
+	    proplists:get_value(pty_opts, Options, []), TimeOut
+	   ).
+%%--------------------------------------------------------------------
+%% Not yet officialy supported! The following functions are part of the
+%% initial contributed ssh application. They are untested. Do we want them?
+%% Should they be documented and tested?
 %%--------------------------------------------------------------------
-window_change(ConnectionManager, Channel, Width, Height) ->
-    window_change(ConnectionManager, Channel, Width, Height, 0, 0).
-window_change(ConnectionManager, Channel, Width, Height, 
+window_change(ConnectionHandler, Channel, Width, Height) ->
+    window_change(ConnectionHandler, Channel, Width, Height, 0, 0).
+window_change(ConnectionHandler, Channel, Width, Height,
 	      PixWidth, PixHeight) ->
-    ssh_connection_manager:request(ConnectionManager, Channel, 
+    ssh_connection_handler:request(ConnectionHandler, Channel,
 				   "window-change", false, 
 				   [?uint32(Width), ?uint32(Height),
 				    ?uint32(PixWidth), ?uint32(PixHeight)], 0).
-%%--------------------------------------------------------------------
-%% Function: signal(ConnectionManager, Channel, Sig) ->
-%%
-%%
-%% Description:  Not yet officialy supported.
-%%--------------------------------------------------------------------
-signal(ConnectionManager, Channel, Sig) ->
-    ssh_connection_manager:request(ConnectionManager, Channel, 
+
+signal(ConnectionHandler, Channel, Sig) ->
+    ssh_connection_handler:request(ConnectionHandler, Channel,
 				   "signal", false, [?string(Sig)], 0).
 
-%%--------------------------------------------------------------------
-%% Function: signal(ConnectionManager, Channel, Status) ->
-%%
-%%
-%% Description:  Not yet officialy supported.
-%%--------------------------------------------------------------------
-exit_status(ConnectionManager, Channel, Status) ->
-    ssh_connection_manager:request(ConnectionManager, Channel, 
-				   "exit-status", false, [?uint32(Status)], 0).
 
+exit_status(ConnectionHandler, Channel, Status) ->
+    ssh_connection_handler:request(ConnectionHandler, Channel,
+				   "exit-status", false, [?uint32(Status)], 0).
 
 %%--------------------------------------------------------------------
-%% Function: open_pty(ConnectionManager, Channel, TimeOut) ->
-%%
-%%
-%% Description:  Not yet officialy supported.
+%%% Internal API
 %%--------------------------------------------------------------------
-open_pty(ConnectionManager, Channel, TimeOut) ->
-    open_pty(ConnectionManager, Channel, 
-	     os:getenv("TERM"), 80, 24, [], TimeOut).
-
-open_pty(ConnectionManager, Channel, Term, Width, Height, PtyOpts, TimeOut) ->
-    open_pty(ConnectionManager, Channel, Term, Width, 
-	     Height, 0, 0, PtyOpts, TimeOut).
-
-open_pty(ConnectionManager, Channel, Term, Width, Height, 
-	 PixWidth, PixHeight, PtyOpts, TimeOut) ->
-    ssh_connection_manager:request(ConnectionManager, 
-				   Channel, "pty-req", true, 
-				   [?string(Term),
-				    ?uint32(Width), ?uint32(Height),
-				    ?uint32(PixWidth),?uint32(PixHeight),
-				    encode_pty_opts(PtyOpts)], TimeOut).
-
+l2b(L) when is_integer(hd(L)) ->
+    try list_to_binary(L)
+    of
+	B -> B
+    catch
+	_:_ -> 
+	    unicode:characters_to_binary(L)
+    end;
+l2b([H|T]) -> 
+    << (l2b(H))/binary, (l2b(T))/binary >>;
+l2b(B) when is_binary(B) ->
+    B;
+l2b([]) ->
+    <<>>.
 
-%%--------------------------------------------------------------------
-%% Function: direct_tcpip(ConnectionManager, RemoteHost,  
-%%                        RemotePort, OrigIP, OrigPort, Timeout) ->
-%%
-%%
-%% Description: Not yet officialy supported.
-%%--------------------------------------------------------------------
-direct_tcpip(ConnectionManager, RemoteHost, 
-	     RemotePort, OrigIP, OrigPort, Timeout) ->
-    direct_tcpip(ConnectionManager, RemoteHost, RemotePort, OrigIP, OrigPort,
-		 ?DEFAULT_WINDOW_SIZE, ?DEFAULT_PACKET_SIZE, Timeout).
-
-direct_tcpip(ConnectionManager, RemoteIP, RemotePort, OrigIP, OrigPort,
-	     InitialWindowSize, MaxPacketSize, Timeout) ->
-    case {encode_ip(RemoteIP), encode_ip(OrigIP)} of
-	{false, _} -> 
-	    {error, einval};
-	{_, false} -> 
-	    {error, einval};
-	{RIP, OIP} ->
-	    ssh_connection_manager:open_channel(ConnectionManager,
-						"direct-tcpip",
-						[?string(RIP), 
-						 ?uint32(RemotePort),
-						 ?string(OIP),
-						 ?uint32(OrigPort)],
-						InitialWindowSize, 
-						MaxPacketSize,
-						Timeout)
-    end.
-%%--------------------------------------------------------------------
-%% Function: tcpip_forward(ConnectionManager, BindIP, BindPort) ->
-%%
-%%
-%% Description: Not yet officialy supported.
-%%--------------------------------------------------------------------
-tcpip_forward(ConnectionManager, BindIP, BindPort) ->
-    case encode_ip(BindIP) of
-	false -> 
-	    {error, einval};
-	IPStr ->
-	    ssh_connection_manager:global_request(ConnectionManager, 
-						  "tcpip-forward", true,
-						  [?string(IPStr),
-						   ?uint32(BindPort)])
-    end.
-%%--------------------------------------------------------------------
-%% Function: cancel_tcpip_forward(ConnectionManager, BindIP, Port) ->
-%%
-%%
-%% Description: Not yet officialy supported.
-%%--------------------------------------------------------------------
-cancel_tcpip_forward(ConnectionManager, BindIP, Port) ->
-    case encode_ip(BindIP) of
-	false -> 
-	    {error, einval};
-	IPStr ->
-	    ssh_connection_manager:global_request(ConnectionManager, 
-						  "cancel-tcpip-forward", true,
-						  [?string(IPStr),
-						   ?uint32(Port)])
-    end.
+    
 
-%%--------------------------------------------------------------------
-%%% Internal API
-%%--------------------------------------------------------------------
-channel_data(ChannelId, DataType, Data, Connection, ConnectionPid, From) 
+channel_data(ChannelId, DataType, Data, Connection, From)
   when is_list(Data)->
-    channel_data(ChannelId, DataType, 
-		 list_to_binary(Data), Connection, ConnectionPid, From);
+    channel_data(ChannelId, DataType, l2b(Data), Connection, From);
 
 channel_data(ChannelId, DataType, Data, 
-	     #connection{channel_cache = Cache} = Connection, ConnectionPid,
+	     #connection{channel_cache = Cache} = Connection,
 	     From) ->
-    
     case ssh_channel:cache_lookup(Cache, ChannelId) of
 	#channel{remote_id = Id, sent_close = false} = Channel0 ->
-	    {SendList, Channel} = update_send_window(Channel0#channel{flow_control = From}, DataType,
-						     Data, Connection),
+	    {SendList, Channel} =
+		update_send_window(Channel0#channel{flow_control = From}, DataType,
+				   Data, Connection),
 	    Replies = 
 		lists:map(fun({SendDataType, SendData}) -> 
-				  {connection_reply, ConnectionPid,
+				  {connection_reply,
 				   channel_data_msg(Id,
 						    SendDataType,
 						    SendData)}
 			  end, SendList),
-	    FlowCtrlMsgs = flow_control(Replies, 
-					Channel,
-					Cache),
+	    FlowCtrlMsgs = flow_control(Replies, Channel, Cache),
 	    {{replies, Replies ++ FlowCtrlMsgs}, Connection};
 	_ ->
-	    gen_server:reply(From, {error, closed}),
-	    {noreply, Connection}
+	    {{replies,[{channel_request_reply,From,{error,closed}}]}, Connection}
     end.
 
 handle_msg(#ssh_msg_channel_open_confirmation{recipient_channel = ChannelId, 
 					      sender_channel = RemoteId,
 					      initial_window_size = WindowSz,
 					      maximum_packet_size = PacketSz}, 
-	   #connection{channel_cache = Cache} = Connection0, _, _) ->
+	   #connection{channel_cache = Cache} = Connection0, _) ->
     
     #channel{remote_id = undefined} = Channel =
 	ssh_channel:cache_lookup(Cache, ChannelId), 
@@ -357,7 +296,7 @@ handle_msg(#ssh_msg_channel_open_failure{recipient_channel = ChannelId,
 					 reason = Reason,
 					 description = Descr,
 					 lang = Lang},  
-	   #connection{channel_cache = Cache} = Connection0, _, _) ->
+	   #connection{channel_cache = Cache} = Connection0, _) ->
     Channel = ssh_channel:cache_lookup(Cache, ChannelId), 
     ssh_channel:cache_delete(Cache, ChannelId),
     {Reply, Connection} = 
@@ -365,51 +304,59 @@ handle_msg(#ssh_msg_channel_open_failure{recipient_channel = ChannelId,
     {{replies, [Reply]}, Connection};
 
 handle_msg(#ssh_msg_channel_success{recipient_channel = ChannelId},
-	   #connection{channel_cache = Cache} = Connection0, _, _) ->
+	   #connection{channel_cache = Cache} = Connection0, _) ->
     Channel = ssh_channel:cache_lookup(Cache, ChannelId), 
-    {Reply, Connection} = reply_msg(Channel, Connection0, success),
-    {{replies, [Reply]}, Connection};
+    case reply_msg(Channel, Connection0, success) of
+	{[], Connection} ->
+	    {noreply, Connection};
+	{Reply, Connection} ->
+	    {{replies, [Reply]}, Connection}
+    end;
 
 handle_msg(#ssh_msg_channel_failure{recipient_channel = ChannelId},
-	   #connection{channel_cache = Cache} = Connection0, _, _) ->
+	   #connection{channel_cache = Cache} = Connection0, _) ->
     Channel = ssh_channel:cache_lookup(Cache, ChannelId), 
-    {Reply, Connection} = reply_msg(Channel, Connection0, failure),
-    {{replies, [Reply]}, Connection};
+    case reply_msg(Channel, Connection0, failure) of
+	{[], Connection} ->
+	    {noreply, Connection};
+	{Reply, Connection} ->
+	    {{replies, [Reply]}, Connection}
+    end;
+
 
 handle_msg(#ssh_msg_channel_eof{recipient_channel = ChannelId}, 
-	    #connection{channel_cache = Cache} = Connection0, _, _) ->
+	    #connection{channel_cache = Cache} = Connection0, _) ->
     Channel = ssh_channel:cache_lookup(Cache, ChannelId), 
     {Reply, Connection} = reply_msg(Channel, Connection0, {eof, ChannelId}),
     {{replies, [Reply]}, Connection};
    
 handle_msg(#ssh_msg_channel_close{recipient_channel = ChannelId},   
-	   #connection{channel_cache = Cache} = Connection0, 
-	   ConnectionPid, _) ->
+	   #connection{channel_cache = Cache} = Connection0, _) ->
 
 	case ssh_channel:cache_lookup(Cache, ChannelId) of
-		#channel{sent_close = Closed, remote_id = RemoteId, flow_control = FlowControl} = Channel ->
+		#channel{sent_close = Closed, remote_id = RemoteId,
+			 flow_control = FlowControl} = Channel ->
 		ssh_channel:cache_delete(Cache, ChannelId),
 		{CloseMsg, Connection} = 
 		    reply_msg(Channel, Connection0, {closed, ChannelId}),
-
-			ConnReplyMsgs =
-		case Closed of
-					true -> [];
-		    false ->
-			RemoteCloseMsg = channel_close_msg(RemoteId),
-						[{connection_reply, ConnectionPid, RemoteCloseMsg}]
-				end,
-
-			%% if there was a send() in progress, make it fail
-			SendReplyMsgs =
-				case FlowControl of
-					undefined -> [];
-					From ->
-						[{flow_control, From, {error, closed}}]
-				end,
-
-			Replies = ConnReplyMsgs ++ [CloseMsg] ++ SendReplyMsgs,
-			{{replies, Replies}, Connection};
+		ConnReplyMsgs =
+		    case Closed of
+			true -> [];
+			false ->
+			    RemoteCloseMsg = channel_close_msg(RemoteId),
+			    [{connection_reply, RemoteCloseMsg}]
+		    end,
+
+		%% if there was a send() in progress, make it fail
+		SendReplyMsgs =
+		    case FlowControl of
+			undefined -> [];
+			From ->
+			    [{flow_control, From, {error, closed}}]
+		    end,
+
+		Replies = ConnReplyMsgs ++ [CloseMsg] ++ SendReplyMsgs,
+		{{replies, Replies}, Connection};
 
 	    undefined ->
 		{{replies, []}, Connection0}
@@ -417,21 +364,24 @@ handle_msg(#ssh_msg_channel_close{recipient_channel = ChannelId},
 
 handle_msg(#ssh_msg_channel_data{recipient_channel = ChannelId,
 				 data = Data}, 
-	   #connection{channel_cache = Cache} = Connection0, _, _) ->
+	   #connection{channel_cache = Cache} = Connection0, _) ->
     
-    #channel{recv_window_size = Size} = Channel =
-	ssh_channel:cache_lookup(Cache, ChannelId), 
-    WantedSize = Size - size(Data),
-    ssh_channel:cache_update(Cache, Channel#channel{
-				      recv_window_size = WantedSize}),
-    {Replies, Connection} = 
-	channel_data_reply(Cache, Channel, Connection0, 0, Data),
-    {{replies, Replies}, Connection};
+    case ssh_channel:cache_lookup(Cache, ChannelId) of
+	#channel{recv_window_size = Size} = Channel ->
+	    WantedSize = Size - size(Data),
+	    ssh_channel:cache_update(Cache, Channel#channel{
+					      recv_window_size = WantedSize}),
+	    {Replies, Connection} =
+		channel_data_reply(Cache, Channel, Connection0, 0, Data),
+	    {{replies, Replies}, Connection};
+	undefined ->
+	    {noreply, Connection0}
+    end;
 
 handle_msg(#ssh_msg_channel_extended_data{recipient_channel = ChannelId,
 					  data_type_code = DataType,
 					  data = Data}, 
-	   #connection{channel_cache = Cache} = Connection0, _, _) ->
+	   #connection{channel_cache = Cache} = Connection0, _) ->
     
     #channel{recv_window_size = Size} = Channel =
 	ssh_channel:cache_lookup(Cache, ChannelId), 
@@ -444,9 +394,7 @@ handle_msg(#ssh_msg_channel_extended_data{recipient_channel = ChannelId,
 
 handle_msg(#ssh_msg_channel_window_adjust{recipient_channel = ChannelId,
 					  bytes_to_add = Add}, 
-	   #connection{channel_cache = Cache} = Connection, 
-	   ConnectionPid, _) ->
-    
+	   #connection{channel_cache = Cache} = Connection, _) ->
     #channel{send_window_size = Size, remote_id = RemoteId} = 
 	Channel0 = ssh_channel:cache_lookup(Cache, ChannelId), 
     
@@ -455,8 +403,7 @@ handle_msg(#ssh_msg_channel_window_adjust{recipient_channel = ChannelId,
 			   0, undefined, Connection),
     
     Replies = lists:map(fun({Type, Data}) -> 
-				{connection_reply, ConnectionPid,
-				 channel_data_msg(RemoteId, Type, Data)}
+				{connection_reply, channel_data_msg(RemoteId, Type, Data)}
 			end, SendList),
     FlowCtrlMsgs = flow_control(Channel, Cache),
     {{replies, Replies ++ FlowCtrlMsgs}, Connection};
@@ -464,96 +411,56 @@ handle_msg(#ssh_msg_channel_window_adjust{recipient_channel = ChannelId,
 handle_msg(#ssh_msg_channel_open{channel_type = "session" = Type,
 				 sender_channel = RemoteId,
 				 initial_window_size = WindowSz,
-				 maximum_packet_size = PacketSz}, Connection0, 
-	   ConnectionPid, server) ->
-   
-    try setup_session(Connection0, ConnectionPid, RemoteId,
-		     Type, WindowSz, PacketSz) of
-	Result ->
-	    Result
-    catch _:_ ->
+				 maximum_packet_size = PacketSz}, 
+	   #connection{options = SSHopts} = Connection0,
+	   server) ->
+    MinAcceptedPackSz = proplists:get_value(minimal_remote_max_packet_size, SSHopts, 0),
+    
+    if 
+	MinAcceptedPackSz =< PacketSz ->
+	    try setup_session(Connection0, RemoteId,
+			      Type, WindowSz, PacketSz) of
+		Result ->
+		    Result
+	    catch _:_ ->
+		    FailMsg = channel_open_failure_msg(RemoteId, 
+						       ?SSH_OPEN_CONNECT_FAILED,
+						       "Connection refused", "en"),
+		    {{replies, [{connection_reply, FailMsg}]},
+		     Connection0}
+	    end;
+
+	MinAcceptedPackSz > PacketSz ->
 	    FailMsg = channel_open_failure_msg(RemoteId, 
-					       ?SSH_OPEN_CONNECT_FAILED,
-					       "Connection refused", "en"),
-	    {{replies, [{connection_reply, ConnectionPid, FailMsg}]}, 
-	     Connection0}
+					       ?SSH_OPEN_ADMINISTRATIVELY_PROHIBITED,
+					       lists:concat(["Maximum packet size below ",MinAcceptedPackSz,
+							      " not supported"]), "en"),
+	    {{replies, [{connection_reply, FailMsg}]}, Connection0}
     end;
 
 handle_msg(#ssh_msg_channel_open{channel_type = "session",
 				 sender_channel = RemoteId}, 
-	   Connection, ConnectionPid, client) ->
+	   Connection,
+	   client) ->
     %% Client implementations SHOULD reject any session channel open
     %% requests to make it more difficult for a corrupt server to attack the
     %% client. See See RFC 4254 6.1.
     FailMsg = channel_open_failure_msg(RemoteId, 
 				       ?SSH_OPEN_CONNECT_FAILED,
 				       "Connection refused", "en"),
-    {{replies, [{connection_reply, ConnectionPid, FailMsg}]}, 
+    {{replies, [{connection_reply, FailMsg}]},
      Connection};
 
-handle_msg(#ssh_msg_channel_open{channel_type = "forwarded-tcpip" = Type,
-				 sender_channel = RemoteId,
-				 initial_window_size = RWindowSz,
-				 maximum_packet_size = RPacketSz,
-				 data = Data}, 
-	   #connection{channel_cache = Cache} = Connection0, 
-	   ConnectionPid, server) ->
-    <<?UINT32(ALen), Address:ALen/binary, ?UINT32(Port),
-     ?UINT32(OLen), Orig:OLen/binary, ?UINT32(OrigPort)>> = Data,
-    
-    case bound_channel(Address, Port, Connection0) of
-	undefined ->
-	    FailMsg = channel_open_failure_msg(RemoteId, 
-					       ?SSH_OPEN_CONNECT_FAILED,
-					       "Connection refused", "en"),
-	    {{replies, 
-	      [{connection_reply, ConnectionPid, FailMsg}]}, Connection0};
-	ChannelPid ->
-	    {ChannelId, Connection1} = new_channel_id(Connection0),
-	    LWindowSz = ?DEFAULT_WINDOW_SIZE,
-	    LPacketSz = ?DEFAULT_PACKET_SIZE,
-	    Channel = #channel{type = Type,
-			       sys = "none",
-			       user = ChannelPid,
-			       local_id = ChannelId,
-			       recv_window_size = LWindowSz,
-			       recv_packet_size = LPacketSz,
-			       send_window_size = RWindowSz,
-			       send_packet_size = RPacketSz},
-	    ssh_channel:cache_update(Cache, Channel),
-	    OpenConfMsg = channel_open_confirmation_msg(RemoteId, ChannelId,
-							LWindowSz, LPacketSz),
-	    {OpenMsg, Connection} = 
-		reply_msg(Channel, Connection1, 
-			  {open,  Channel, {forwarded_tcpip,
-					    decode_ip(Address), Port,
-					    decode_ip(Orig), OrigPort}}),
-	    {{replies, [{connection_reply, ConnectionPid, OpenConfMsg},
-			OpenMsg]}, Connection}
-    end;
-
-handle_msg(#ssh_msg_channel_open{channel_type = "forwarded-tcpip",
-				 sender_channel = RemoteId}, 
-	   Connection, ConnectionPid, client) ->
-    %% Client implementations SHOULD reject direct TCP/IP open requests for
-    %% security reasons. See RFC 4254 7.2.
-    FailMsg = channel_open_failure_msg(RemoteId, 
-				       ?SSH_OPEN_CONNECT_FAILED,
-				       "Connection refused", "en"),
-    {{replies, [{connection_reply, ConnectionPid, FailMsg}]}, Connection};
-
-
-handle_msg(#ssh_msg_channel_open{sender_channel = RemoteId}, Connection, 
-	   ConnectionPid, _) ->
+handle_msg(#ssh_msg_channel_open{sender_channel = RemoteId}, Connection, _) ->
     FailMsg = channel_open_failure_msg(RemoteId, 
 				       ?SSH_OPEN_ADMINISTRATIVELY_PROHIBITED,
 				       "Not allowed", "en"),
-    {{replies, [{connection_reply, ConnectionPid, FailMsg}]}, Connection};
+    {{replies, [{connection_reply, FailMsg}]}, Connection};
 
 handle_msg(#ssh_msg_channel_request{recipient_channel = ChannelId,
 				    request_type = "exit-status",
 				    data = Data},
-	   #connection{channel_cache = Cache} = Connection, _, _) ->
+	   #connection{channel_cache = Cache} = Connection, _) ->
     <<?UINT32(Status)>> = Data,
     Channel = ssh_channel:cache_lookup(Cache, ChannelId), 
     {Reply, Connection} = 
@@ -564,8 +471,7 @@ handle_msg(#ssh_msg_channel_request{recipient_channel = ChannelId,
 				    request_type = "exit-signal",
 				    want_reply = false,
 				    data = Data},  
-	   #connection{channel_cache = Cache} = Connection0, 
-	   ConnectionPid, _) ->
+	   #connection{channel_cache = Cache} = Connection0, _) ->
     <<?UINT32(SigLen), SigName:SigLen/binary,
      ?BOOLEAN(_Core), 
      ?UINT32(ErrLen), Err:ErrLen/binary,
@@ -578,14 +484,14 @@ handle_msg(#ssh_msg_channel_request{recipient_channel = ChannelId,
 				      binary_to_list(Err),
 				      binary_to_list(Lang)}),
     CloseMsg = channel_close_msg(RemoteId),
-    {{replies, [{connection_reply, ConnectionPid, CloseMsg}, Reply]},
+    {{replies, [{connection_reply, CloseMsg}, Reply]},
      Connection};
 
 handle_msg(#ssh_msg_channel_request{recipient_channel = ChannelId,
 				    request_type = "xon-xoff",
 				    want_reply = false,
 				    data = Data},
-	   #connection{channel_cache = Cache} = Connection, _, _) ->
+	   #connection{channel_cache = Cache} = Connection, _) ->
     <<?BOOLEAN(CDo)>> = Data,
     Channel = ssh_channel:cache_lookup(Cache, ChannelId), 
     {Reply, Connection} = 
@@ -596,7 +502,7 @@ handle_msg(#ssh_msg_channel_request{recipient_channel = ChannelId,
 				    request_type = "window-change",
 				    want_reply = false,
 				    data = Data}, 
-	   #connection{channel_cache = Cache} = Connection0, _, _) ->
+	   #connection{channel_cache = Cache} = Connection0, _) ->
     <<?UINT32(Width),?UINT32(Height),
      ?UINT32(PixWidth), ?UINT32(PixHeight)>> = Data,
     Channel = ssh_channel:cache_lookup(Cache, ChannelId), 
@@ -609,7 +515,7 @@ handle_msg(#ssh_msg_channel_request{recipient_channel = ChannelId,
 handle_msg(#ssh_msg_channel_request{recipient_channel = ChannelId,
 				    request_type = "signal",
 				    data = Data}, 
-	   #connection{channel_cache = Cache} = Connection0, _, _) ->
+	   #connection{channel_cache = Cache} = Connection0, _) ->
     <<?UINT32(SigLen), SigName:SigLen/binary>> = Data,
     
     Channel = ssh_channel:cache_lookup(Cache, ChannelId), 
@@ -622,8 +528,7 @@ handle_msg(#ssh_msg_channel_request{recipient_channel = ChannelId,
 				    request_type = "subsystem",
 				    want_reply = WantReply,
 				    data = Data},
-	   #connection{channel_cache = Cache} = Connection, 
-	   ConnectionPid, server) ->
+	   #connection{channel_cache = Cache} = Connection, server) ->
     <<?UINT32(SsLen), SsName:SsLen/binary>> = Data,
     
     #channel{remote_id = RemoteId} = Channel0 = 
@@ -631,22 +536,23 @@ handle_msg(#ssh_msg_channel_request{recipient_channel = ChannelId,
     
     ReplyMsg =  {subsystem, ChannelId, WantReply, binary_to_list(SsName)},
     
-    try start_subsytem(SsName, Connection, Channel0, ReplyMsg) of
-	{ok, Pid} -> 
-	    erlang:monitor(process, Pid),
-	    Channel = Channel0#channel{user = Pid},
-	    ssh_channel:cache_update(Cache, Channel),
-	    Reply = {connection_reply, ConnectionPid, 
-		     channel_success_msg(RemoteId)}, 
-	    {{replies, [Reply]}, Connection}
-    catch _:_ ->
-	    Reply = {connection_reply, ConnectionPid, 
-		     channel_failure_msg(RemoteId)}, 
-	    {{replies, [Reply]}, Connection}
+    try
+	{ok, Pid} = start_subsystem(SsName, Connection, Channel0, ReplyMsg),
+	erlang:monitor(process, Pid),
+	Channel = Channel0#channel{user = Pid},
+	ssh_channel:cache_update(Cache, Channel),
+	Reply = {connection_reply,
+		 channel_success_msg(RemoteId)},
+	{{replies, [Reply]}, Connection}
+    catch
+	_:_ ->
+	    ErrorReply = {connection_reply,
+			  channel_failure_msg(RemoteId)},
+	    {{replies, [ErrorReply]}, Connection}
     end;	
 
 handle_msg(#ssh_msg_channel_request{request_type = "subsystem"},
-	   Connection, _, client) ->
+	   Connection, client) ->
     %% The client SHOULD ignore subsystem requests. See RFC 4254 6.5.
     {{replies, []}, Connection};
 
@@ -654,8 +560,7 @@ handle_msg(#ssh_msg_channel_request{recipient_channel = ChannelId,
 				    request_type = "pty-req",
 				    want_reply = WantReply,
 				    data = Data},
-	   #connection{channel_cache = Cache} = Connection, 
-	   ConnectionPid, server) ->
+	   #connection{channel_cache = Cache} = Connection, server) ->
     <<?UINT32(TermLen), BTermName:TermLen/binary,
      ?UINT32(Width),?UINT32(Height),
      ?UINT32(PixWidth), ?UINT32(PixHeight),
@@ -667,27 +572,26 @@ handle_msg(#ssh_msg_channel_request{recipient_channel = ChannelId,
     
     Channel = ssh_channel:cache_lookup(Cache, ChannelId), 
     
-    handle_cli_msg(Connection, ConnectionPid, Channel, 
+    handle_cli_msg(Connection, Channel,
 		   {pty, ChannelId, WantReply, PtyRequest});
 
 handle_msg(#ssh_msg_channel_request{request_type = "pty-req"},
-	   Connection, _, client) ->
+	   Connection, client) ->
     %% The client SHOULD ignore pty requests. See RFC 4254 6.2.
     {{replies, []}, Connection};
 
 handle_msg(#ssh_msg_channel_request{recipient_channel = ChannelId,
 				    request_type = "shell",
 				    want_reply = WantReply},
-	   #connection{channel_cache = Cache} = Connection, 
-	   ConnectionPid, server) ->
+	   #connection{channel_cache = Cache} = Connection, server) ->
       
     Channel = ssh_channel:cache_lookup(Cache, ChannelId), 
     
-    handle_cli_msg(Connection, ConnectionPid, Channel, 
+    handle_cli_msg(Connection, Channel,
 		   {shell, ChannelId, WantReply});
  
 handle_msg(#ssh_msg_channel_request{request_type = "shell"},
-	   Connection, _, client) ->
+	   Connection, client) ->
     %% The client SHOULD ignore shell requests. See RFC 4254 6.5.
     {{replies, []}, Connection};
 
@@ -695,17 +599,16 @@ handle_msg(#ssh_msg_channel_request{recipient_channel = ChannelId,
 				    request_type = "exec",
 				    want_reply = WantReply,
 				    data = Data},
-	   #connection{channel_cache = Cache} = Connection, 
-	   ConnectionPid, server) ->
+	   #connection{channel_cache = Cache} = Connection, server) ->
     <<?UINT32(Len), Command:Len/binary>> = Data,
      
     Channel = ssh_channel:cache_lookup(Cache, ChannelId), 
     
-    handle_cli_msg(Connection, ConnectionPid, Channel, 
+    handle_cli_msg(Connection, Channel,
 		   {exec, ChannelId, WantReply, binary_to_list(Command)});
 	
 handle_msg(#ssh_msg_channel_request{request_type = "exec"},
-	   Connection, _, client) ->
+	   Connection, client) ->
     %% The client SHOULD ignore exec requests. See RFC 4254 6.5.
     {{replies, []}, Connection};
 
@@ -713,31 +616,30 @@ handle_msg(#ssh_msg_channel_request{recipient_channel = ChannelId,
   				    request_type = "env",
   				    want_reply = WantReply,
   				    data = Data}, 
-  	   #connection{channel_cache = Cache} = Connection, 
-  	   ConnectionPid, server) ->
+	   #connection{channel_cache = Cache} = Connection, server) ->
     
     <<?UINT32(VarLen), 
      Var:VarLen/binary, ?UINT32(ValueLen), Value:ValueLen/binary>> = Data,
     
     Channel = ssh_channel:cache_lookup(Cache, ChannelId), 
     
-    handle_cli_msg(Connection, ConnectionPid, Channel,
+    handle_cli_msg(Connection, Channel,
  		   {env, ChannelId, WantReply, Var, Value});
 
 handle_msg(#ssh_msg_channel_request{request_type = "env"},
-	   Connection, _, client) ->
+	   Connection, client) ->
     %% The client SHOULD ignore env requests. 
     {{replies, []}, Connection};
 
 handle_msg(#ssh_msg_channel_request{recipient_channel = ChannelId,
 				    request_type = _Other,
-				    want_reply = WantReply},  #connection{channel_cache = Cache} = Connection,
-	   ConnectionPid, _) ->
+				    want_reply = WantReply},
+	   #connection{channel_cache = Cache} = Connection, _) ->
     if WantReply == true ->
 		case ssh_channel:cache_lookup(Cache, ChannelId) of
 		    #channel{remote_id = RemoteId}  -> 
 			FailMsg = channel_failure_msg(RemoteId),
-			{{replies, [{connection_reply, ConnectionPid, FailMsg}]}, 
+			{{replies, [{connection_reply, FailMsg}]},
 			 Connection};
 		    undefined -> %% Chanel has been closed
 			{noreply, Connection}
@@ -748,61 +650,73 @@ handle_msg(#ssh_msg_channel_request{recipient_channel = ChannelId,
 
 handle_msg(#ssh_msg_global_request{name = _Type,
 				   want_reply = WantReply,
-				   data = _Data}, Connection,
-	   ConnectionPid, _) ->
+				   data = _Data}, Connection, _) ->
     if WantReply == true ->
 	    FailMsg = request_failure_msg(),
-	    {{replies, [{connection_reply, ConnectionPid, FailMsg}]}, 
+	    {{replies, [{connection_reply, FailMsg}]},
 	     Connection};
        true ->
 	    {noreply, Connection}  
     end;
 
-%%% This transport message will also be handled at the connection level
+handle_msg(#ssh_msg_request_failure{},
+	   #connection{requests = [{_, From} | Rest]} = Connection, _) ->
+    {{replies, [{channel_request_reply, From, {failure, <<>>}}]},
+     Connection#connection{requests = Rest}};
+handle_msg(#ssh_msg_request_success{data = Data},
+	   #connection{requests = [{_, From} | Rest]} = Connection, _) ->
+    {{replies, [{channel_request_reply, From, {success, Data}}]},
+     Connection#connection{requests = Rest}};
+
 handle_msg(#ssh_msg_disconnect{code = Code,
 			       description = Description,
 			       language = _Lang },
-	   #connection{channel_cache = Cache} = Connection0, _, _) ->
+	   #connection{channel_cache = Cache} = Connection0, _) ->
     {Connection, Replies} = 
 	ssh_channel:cache_foldl(fun(Channel, {Connection1, Acc}) ->
 					{Reply, Connection2} =  
 					    reply_msg(Channel,
-						      Connection1, {closed, Channel#channel.local_id}),
+						      Connection1,
+						      {closed, Channel#channel.local_id}),
 					{Connection2, [Reply | Acc]}
 				end, {Connection0, []}, Cache),
     
     ssh_channel:cache_delete(Cache),
     {disconnect, {Code, Description}, {{replies, Replies}, Connection}}.
 
-handle_cli_msg(#connection{channel_cache = Cache} = Connection0,
-	       ConnectionPid, 
+handle_cli_msg(#connection{channel_cache = Cache} = Connection,
 	       #channel{user = undefined, 
+			remote_id = RemoteId,
 			local_id = ChannelId} = Channel0, Reply0) -> 
     
-    case (catch start_cli(Connection0, ChannelId)) of
+    case (catch start_cli(Connection, ChannelId)) of
 	{ok, Pid} ->
 	    erlang:monitor(process, Pid),
 	    Channel = Channel0#channel{user = Pid},
 	    ssh_channel:cache_update(Cache, Channel),
-	    {Reply, Connection} = reply_msg(Channel, Connection0, Reply0),
-	    {{replies, [Reply]}, Connection};
-	_ ->
-	    Reply = {connection_reply, ConnectionPid, 
-		     request_failure_msg()}, 
-	    {{replies, [Reply]}, Connection0}
+	    {Reply, Connection1} = reply_msg(Channel, Connection, Reply0),
+ 	    {{replies, [Reply]}, Connection1};
+	_Other ->
+	    Reply = {connection_reply,
+		     channel_failure_msg(RemoteId)},
+	    {{replies, [Reply]}, Connection}
     end;
 
-handle_cli_msg(Connection0, _, Channel, Reply0) -> 
+handle_cli_msg(Connection0, Channel, Reply0) ->
     {Reply, Connection} =  reply_msg(Channel, Connection0, Reply0),
     {{replies, [Reply]}, Connection}.
 
-
 channel_eof_msg(ChannelId) ->
     #ssh_msg_channel_eof{recipient_channel = ChannelId}.
 
 channel_close_msg(ChannelId) ->
     #ssh_msg_channel_close {recipient_channel = ChannelId}.
 
+channel_status_msg({success, ChannelId}) ->
+    channel_success_msg(ChannelId);
+channel_status_msg({failure, ChannelId}) ->
+    channel_failure_msg(ChannelId).
+
 channel_success_msg(ChannelId) ->
     #ssh_msg_channel_success{recipient_channel = ChannelId}.
 
@@ -847,10 +761,6 @@ channel_request_msg(ChannelId, Type, WantReply, Data) ->
 			     want_reply = WantReply,
 			     data = Data}.
 
-global_request_msg(Type, WantReply, Data) ->
-    #ssh_msg_global_request{name = Type,
-			    want_reply = WantReply,
-			    data = Data}.
 request_failure_msg() ->
     #ssh_msg_request_failure{}.
 
@@ -880,70 +790,6 @@ bound_channel(IP, Port, Connection) ->
 	_ -> undefined
     end.
 
-messages() ->
-    [ {ssh_msg_global_request, ?SSH_MSG_GLOBAL_REQUEST,
-       [string, 
-	boolean,
-	'...']},
-      
-      {ssh_msg_request_success, ?SSH_MSG_REQUEST_SUCCESS,
-       ['...']},
-      
-      {ssh_msg_request_failure, ?SSH_MSG_REQUEST_FAILURE,
-       []},
-      
-      {ssh_msg_channel_open, ?SSH_MSG_CHANNEL_OPEN,
-       [string,
-	uint32,
-	uint32,
-	uint32,
-	'...']},
-
-      {ssh_msg_channel_open_confirmation, ?SSH_MSG_CHANNEL_OPEN_CONFIRMATION,
-       [uint32,
-	uint32,
-	uint32,
-	uint32,
-	'...']},
-
-      {ssh_msg_channel_open_failure, ?SSH_MSG_CHANNEL_OPEN_FAILURE,
-       [uint32,
-	uint32,
-	string,
-	string]},
-
-      {ssh_msg_channel_window_adjust, ?SSH_MSG_CHANNEL_WINDOW_ADJUST,
-       [uint32,
-	uint32]},
-
-      {ssh_msg_channel_data, ?SSH_MSG_CHANNEL_DATA,
-       [uint32,
-	binary]},
-
-      {ssh_msg_channel_extended_data, ?SSH_MSG_CHANNEL_EXTENDED_DATA,
-       [uint32,
-	uint32,
-	binary]},
-
-      {ssh_msg_channel_eof, ?SSH_MSG_CHANNEL_EOF,
-       [uint32]},
-
-      {ssh_msg_channel_close, ?SSH_MSG_CHANNEL_CLOSE,
-       [uint32]},
-
-      {ssh_msg_channel_request, ?SSH_MSG_CHANNEL_REQUEST,
-       [uint32,
-	string,
-	boolean,
-	'...']},
-
-      {ssh_msg_channel_success, ?SSH_MSG_CHANNEL_SUCCESS,
-       [uint32]},
-
-      {ssh_msg_channel_failure, ?SSH_MSG_CHANNEL_FAILURE,
-       [uint32]}
-     ].
-
 encode_ip(Addr) when is_tuple(Addr) ->
     case catch inet_parse:ntoa(Addr) of
 	{'EXIT',_} -> false;
@@ -960,19 +806,33 @@ encode_ip(Addr) when is_list(Addr) ->
 	    end
     end.
 
-start_channel(Cb, Id, Args, SubSysSup) ->
-    start_channel(Cb, Id, Args, SubSysSup, undefined).
+start_channel(Cb, Id, Args, SubSysSup, Opts) ->
+    start_channel(Cb, Id, Args, SubSysSup, undefined, Opts).
 
-start_channel(Cb, Id, Args, SubSysSup, Exec) ->
+start_channel(Cb, Id, Args, SubSysSup, Exec, Opts) ->
     ChildSpec = child_spec(Cb, Id, Args, Exec),
-    ChannelSup =ssh_subsystem_sup:channel_supervisor(SubSysSup),
+    ChannelSup = ssh_subsystem_sup:channel_supervisor(SubSysSup),
+    assert_limit_num_channels_not_exceeded(ChannelSup, Opts),
     ssh_channel_sup:start_child(ChannelSup, ChildSpec).
     
+assert_limit_num_channels_not_exceeded(ChannelSup, Opts) ->
+    MaxNumChannels = proplists:get_value(max_channels, Opts, infinity),
+    NumChannels = length([x || {_,_,worker,[ssh_channel]} <- 
+				   supervisor:which_children(ChannelSup)]),
+    if 
+	%% Note that NumChannels is BEFORE starting a new one
+	NumChannels < MaxNumChannels ->
+	    ok;
+	true ->
+	    throw(max_num_channels_exceeded)
+    end.
+
 %%--------------------------------------------------------------------
 %%% Internal functions
 %%--------------------------------------------------------------------
-setup_session(#connection{channel_cache = Cache} = Connection0, 
-	      ConnectionPid, RemoteId,
+setup_session(#connection{channel_cache = Cache
+			 } = Connection0, 
+	      RemoteId,
 	      Type, WindowSize, PacketSize) ->
     {ChannelId, Connection} = new_channel_id(Connection0),
 
@@ -983,6 +843,7 @@ setup_session(#connection{channel_cache = Cache} = Connection0,
 		       recv_packet_size = ?DEFAULT_PACKET_SIZE,
 		       send_window_size = WindowSize,
 		       send_packet_size = PacketSize,
+		       send_buf = queue:new(),
 		       remote_id = RemoteId
 		      },
     ssh_channel:cache_update(Cache, Channel),
@@ -990,7 +851,7 @@ setup_session(#connection{channel_cache = Cache} = Connection0,
 						?DEFAULT_WINDOW_SIZE, 
 						?DEFAULT_PACKET_SIZE),
 
-    {{replies, [{connection_reply, ConnectionPid, OpenConfMsg}]}, Connection}.
+    {{replies, [{connection_reply, OpenConfMsg}]}, Connection}.
 
 
 check_subsystem("sftp"= SsName, Options) ->
@@ -1019,35 +880,23 @@ child_spec(Callback, Id, Args, Exec) ->
     Type = worker,
     {Name, StartFunc, Restart, Shutdown, Type, [ssh_channel]}.
 
-%% Backwards compatibility
-start_cli(#connection{address = Address, port = Port, cli_spec = {Fun, [Shell]},
-		      options = Options}, 
-	  _ChannelId) when is_function(Fun) ->
-    case Fun(Shell, Address, Port, Options) of
-	NewFun when is_function(NewFun) ->
-	    {ok, NewFun()};
-	Pid when is_pid(Pid) ->
-	    {ok, Pid}
-    end;
-
-start_cli(#connection{cli_spec = {CbModule, Args}, exec = Exec,
+start_cli(#connection{cli_spec = no_cli}, _) ->
+    {error, cli_disabled};
+start_cli(#connection{options = Options,
+		      cli_spec = {CbModule, Args},
+		      exec = Exec,
 		      sub_system_supervisor = SubSysSup}, ChannelId) ->
-    start_channel(CbModule, ChannelId, Args, SubSysSup, Exec).
+    start_channel(CbModule, ChannelId, Args, SubSysSup, Exec, Options).
 
-start_subsytem(BinName, #connection{address = Address, port = Port, 
-				    options = Options, 
+start_subsystem(BinName, #connection{options = Options,
 				    sub_system_supervisor = SubSysSup},
-	       #channel{local_id = ChannelId, remote_id = RemoteChannelId},
-	       ReplyMsg) ->
+	       #channel{local_id = ChannelId}, _ReplyMsg) ->
     Name = binary_to_list(BinName),
     case check_subsystem(Name, Options) of
 	{Callback, Opts} when is_atom(Callback), Callback =/= none ->
-	    start_channel(Callback, ChannelId, Opts, SubSysSup);
+	    start_channel(Callback, ChannelId, Opts, SubSysSup, Options);
 	{Other, _} when Other =/= none ->
-	    handle_backwards_compatibility(Other, self(), 
-					   ChannelId, RemoteChannelId,
-					   Options, Address, Port, 
-					   {ssh_cm, self(), ReplyMsg})
+	    {error, legacy_option_not_supported}
     end.
 
 channel_data_reply(_, #channel{local_id = ChannelId} = Channel, 
@@ -1070,80 +919,118 @@ reply_msg(Channel, Connection, failure = Reply) ->
     request_reply_or_data(Channel, Connection, Reply);
 reply_msg(Channel, Connection, {closed, _} = Reply) ->
     request_reply_or_data(Channel, Connection, Reply);
+reply_msg(undefined, Connection, _Reply) ->
+    {noreply, Connection};
 reply_msg(#channel{user = ChannelPid}, Connection, Reply) ->
     {{channel_data, ChannelPid, Reply}, Connection}.
 
+
 request_reply_or_data(#channel{local_id = ChannelId, user = ChannelPid}, 
 		      #connection{requests = Requests} = 
 		      Connection, Reply) -> 
     case lists:keysearch(ChannelId, 1, Requests) of
 	{value, {ChannelId, From}} ->
-	    {{channel_requst_reply, From, Reply}, 
+	    {{channel_request_reply, From, Reply}, 
 	     Connection#connection{requests = 
-				   lists:keydelete(ChannelId, 1, Requests)}};
+				       lists:keydelete(ChannelId, 1, Requests)}};
+	false when (Reply == success) or (Reply == failure) ->
+	    {[], Connection};
 	false ->
 	    {{channel_data, ChannelPid, Reply}, Connection}
     end.
+
 update_send_window(Channel, _, undefined,
 		   #connection{channel_cache = Cache}) ->
-    do_update_send_window(Channel,  Channel#channel.send_buf, Cache);
+    do_update_send_window(Channel, Cache);
 
-update_send_window(Channel, DataType, Data,
+update_send_window(#channel{send_buf = SendBuffer} = Channel, DataType, Data,
 		   #connection{channel_cache = Cache}) ->
-    do_update_send_window(Channel, Channel#channel.send_buf ++ [{DataType, Data}], Cache).
-
-do_update_send_window(Channel0, Buf0, Cache) ->
-    {Buf1, NewSz, Buf2} = get_window(Buf0, 
-				     Channel0#channel.send_packet_size,
-				     Channel0#channel.send_window_size),
+    do_update_send_window(Channel#channel{send_buf = queue:in({DataType, Data}, SendBuffer)},
+			  Cache).
 
-    Channel = Channel0#channel{send_window_size = NewSz, send_buf = Buf2},
+do_update_send_window(Channel0, Cache) ->
+    {SendMsgs, Channel} = get_window(Channel0, []),
     ssh_channel:cache_update(Cache, Channel), 
-    {Buf1, Channel}.
-
-get_window(Bs, PSz, WSz) ->
-    get_window(Bs, PSz, WSz, []).
-
-get_window(Bs, _PSz, 0, Acc) ->
-    {lists:reverse(Acc), 0, Bs};
-get_window([B0 = {DataType, Bin} | Bs], PSz, WSz, Acc) ->
-    BSz = size(Bin),
-    if BSz =< WSz ->  %% will fit into window
-	    if BSz =< PSz ->  %% will fit into a packet
-		    get_window(Bs, PSz, WSz-BSz, [B0|Acc]);
-	       true -> %% split into packet size
-		    <<Bin1:PSz/binary, Bin2/binary>> = Bin,
-		    get_window([setelement(2, B0, Bin2) | Bs],
-			       PSz, WSz-PSz, 
-			       [{DataType, Bin1}|Acc])
+    {SendMsgs, Channel}.
+
+get_window(#channel{send_window_size = 0
+		   } = Channel, Acc) ->
+    {lists:reverse(Acc), Channel};
+get_window(#channel{send_packet_size = 0
+		   } = Channel, Acc) ->
+    {lists:reverse(Acc), Channel};
+get_window(#channel{send_buf = Buffer, 
+		    send_packet_size = PacketSize,
+		    send_window_size = WindowSize0
+		   } = Channel, Acc0) ->
+    case queue:out(Buffer) of
+	{{value, {_, Data} = Msg}, NewBuffer} ->
+	    case handle_send_window(Msg, size(Data), PacketSize, WindowSize0, Acc0) of		
+		{WindowSize, Acc, {_, <<>>}} ->
+		    {lists:reverse(Acc), Channel#channel{send_window_size = WindowSize,
+							 send_buf = NewBuffer}};
+		{WindowSize, Acc, Rest} ->
+		    get_window(Channel#channel{send_window_size = WindowSize,
+					       send_buf = queue:in_r(Rest, NewBuffer)}, Acc)
 	    end;
-       WSz =< PSz ->  %% use rest of window
-	    <<Bin1:WSz/binary, Bin2/binary>> = Bin,
-	    get_window([setelement(2, B0, Bin2) | Bs],
-		       PSz, WSz-WSz, 
-		       [{DataType, Bin1}|Acc]);
-       true -> %% use packet size
-	    <<Bin1:PSz/binary, Bin2/binary>> = Bin,
-	    get_window([setelement(2, B0, Bin2) | Bs],
-		       PSz, WSz-PSz, 
-		       [{DataType, Bin1}|Acc])
+	{empty, NewBuffer} ->
+	    {[], Channel#channel{send_buf = NewBuffer}}
+    end.
+
+handle_send_window(Msg = {Type, Data}, Size, PacketSize, WindowSize, Acc) when Size =< WindowSize ->
+    case Size =< PacketSize of
+	true ->
+	    {WindowSize - Size, [Msg | Acc], {Type, <<>>}};
+	false ->
+	    <<Msg1:PacketSize/binary, Msg2/binary>> = Data,
+	    {WindowSize - PacketSize, [{Type, Msg1} | Acc], {Type, Msg2}}
     end;
-get_window([], _PSz, WSz, Acc) ->
-    {lists:reverse(Acc), WSz, []}.
+handle_send_window({Type, Data}, _, PacketSize, WindowSize, Acc) when WindowSize =< PacketSize ->
+    <<Msg1:WindowSize/binary, Msg2/binary>> = Data,
+    {WindowSize - WindowSize, [{Type, Msg1} | Acc], {Type, Msg2}};
+handle_send_window({Type, Data}, _, PacketSize, WindowSize, Acc) ->
+    <<Msg1:PacketSize/binary, Msg2/binary>> = Data,
+    {WindowSize - PacketSize, [{Type, Msg1} | Acc], {Type, Msg2}}.
 
 flow_control(Channel, Cache) ->
     flow_control([window_adjusted], Channel, Cache).
-				    
+
 flow_control([], Channel, Cache) ->
     ssh_channel:cache_update(Cache, Channel),
     [];
-
 flow_control([_|_], #channel{flow_control = From,
-							 send_buf = []} = Channel, Cache) when From =/= undefined ->
-	[{flow_control, Cache, Channel, From, ok}];
+			     send_buf = Buffer} = Channel, Cache) when From =/= undefined ->
+    case queue:is_empty(Buffer) of
+	true ->
+	    ssh_channel:cache_update(Cache, Channel#channel{flow_control = undefined}),
+	    [{flow_control, Cache, Channel, From, ok}];
+	false ->
+	    []
+    end;
 flow_control(_,_,_) ->
-	[].
+    [].
 
+pty_req(ConnectionHandler, Channel, Term, Width, Height,
+	 PixWidth, PixHeight, PtyOpts, TimeOut) ->
+    ssh_connection_handler:request(ConnectionHandler,
+				   Channel, "pty-req", true,
+				   [?string(Term),
+				    ?uint32(Width), ?uint32(Height),
+				    ?uint32(PixWidth),?uint32(PixHeight),
+				    encode_pty_opts(PtyOpts)], TimeOut).
+
+pty_default_dimensions(Dimension, Options) ->
+    case proplists:get_value(Dimension, Options, 0) of
+	N when is_integer(N), N > 0 ->
+	    {N, 0};
+	_ ->
+	    case proplists:get_value(list_to_atom("pixel_" ++ atom_to_list(Dimension)), Options, 0) of
+		N when is_integer(N), N > 0 ->
+		    {0, N};
+		_ ->
+		    {?TERMINAL_WIDTH, 0}
+	    end
+    end.
 
 encode_pty_opts(Opts) ->
     Bin = list_to_binary(encode_pty_opts2(Opts)),
@@ -1335,49 +1222,12 @@ decode_pty_opts2(<<Code, ?UINT32(Value), Tail/binary>>) ->
 	 end,    
     [{Op, Value} | decode_pty_opts2(Tail)].
 
-decode_ip(Addr) when is_binary(Addr) ->
-    case inet_parse:address(binary_to_list(Addr)) of
-	{error,_} -> Addr;
-	{ok,A}    -> A
-    end.
 
-%% This is really awful and that is why it is beeing phased out. 
-handle_backwards_compatibility({_,_,_,_,_,_} = ChildSpec, _, _, _, _,
-			       Address, Port, _) ->
-    SystemSup = ssh_system_sup:system_supervisor(Address, Port),
-    ChannelSup = ssh_system_sup:channel_supervisor(SystemSup),
-    ssh_channel_sup:start_child(ChannelSup, ChildSpec);
-
-handle_backwards_compatibility(Module, ConnectionManager, ChannelId,
-			       RemoteChannelId, Opts,
-			       _, _, Msg) when is_atom(Module) ->
-    {ok, SubSystemPid} = gen_server:start_link(Module, [Opts], []),
-    SubSystemPid !
-	{ssh_cm, ConnectionManager, 
-	 {open, ChannelId, RemoteChannelId, {session}}},
-    SubSystemPid ! Msg,
-    {ok, SubSystemPid}; 
-
-handle_backwards_compatibility(Fun, ConnectionManager, ChannelId, 
-			       RemoteChannelId, 
-			       _, _, _, Msg) when is_function(Fun) ->
-    SubSystemPid = Fun(),
-    SubSystemPid ! 
-	{ssh_cm, ConnectionManager, 
-	 {open, ChannelId, RemoteChannelId, {session}}},
-    SubSystemPid ! Msg,
-    {ok, SubSystemPid};
-
-handle_backwards_compatibility(ChildSpec, 
-			       ConnectionManager, 
-			       ChannelId, RemoteChannelId, _, 
-			       Address, Port, Msg) ->
-    SystemSup = ssh_system_sup:system_supervisor(Address, Port),
-    ChannelSup = ssh_system_sup:channel_supervisor(SystemSup),
-    {ok, SubSystemPid} 
-	= ssh_channel_sup:start_child(ChannelSup, ChildSpec),
-    SubSystemPid ! 
-	{ssh_cm, ConnectionManager, 
-	 {open, ChannelId, RemoteChannelId, {session}}},
-    SubSystemPid ! Msg,
-    {ok, SubSystemPid}.
+backwards_compatible([], Acc) ->
+    Acc;
+backwards_compatible([{hight, Value} | Rest], Acc) ->
+    backwards_compatible(Rest, [{height, Value} | Acc]);
+backwards_compatible([{pixel_hight, Value} | Rest], Acc) ->
+    backwards_compatible(Rest, [{height, Value} | Acc]);
+backwards_compatible([Value| Rest], Acc) ->
+    backwards_compatible(Rest, [ Value | Acc]).
diff --git a/lib/ssh/src/ssh_connection_controler.erl b/lib/ssh/src/ssh_connection_controler.erl
deleted file mode 100644
index ca3e62dc83..0000000000
--- a/lib/ssh/src/ssh_connection_controler.erl
+++ /dev/null
@@ -1,137 +0,0 @@
-%%
-%% %CopyrightBegin%
-%%
-%% Copyright Ericsson AB 2009-2010. All Rights Reserved.
-%%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
-%%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
-%%
-%% %CopyrightEnd%
-%%
-%%--------------------------------------------------------------------
-%% File    : ssh_connection_controler.erl
-%% Description : 
-%%
-%%--------------------------------------------------------------------
-
--module(ssh_connection_controler).
-
--behaviour(gen_server).
-
-%%-----------------------------------------------------------------
-%% External exports
-%%-----------------------------------------------------------------
--export([start_link/1, start_handler_child/2, start_manager_child/2,
-	 connection_manager/1]).
-
-%%-----------------------------------------------------------------
-%% Internal exports
-%%-----------------------------------------------------------------
--export([init/1, handle_call/3, handle_cast/2, handle_info/2,
-	 code_change/3, terminate/2, stop/1]).
-
--record(state, {role, manager, handler, timeout}).
-
-%%-----------------------------------------------------------------
-%% External interface functions
-%%-----------------------------------------------------------------
-%%-----------------------------------------------------------------
-%% Func: start/0
-%%-----------------------------------------------------------------
-start_link(Args) ->
-    gen_server:start_link(?MODULE, [Args], []).
-
-%% Will be called from the manager child process
-start_handler_child(ServerRef, Args) ->
-    gen_server:call(ServerRef, {handler, self(), Args}, infinity).
-
-%% Will be called from the acceptor process
-start_manager_child(ServerRef, Args) ->
-    gen_server:call(ServerRef, {manager, Args}, infinity).
-
-connection_manager(ServerRef) ->
-    {ok, gen_server:call(ServerRef, manager, infinity)}.
-
-%%-----------------------------------------------------------------
-%% Internal interface functions
-%%-----------------------------------------------------------------
-%%-----------------------------------------------------------------
-%% Func: stop/1
-%%-----------------------------------------------------------------
-stop(Pid) ->
-    gen_server:cast(Pid, stop).
-
-%%-----------------------------------------------------------------
-%% Server functions
-%%-----------------------------------------------------------------
-%%-----------------------------------------------------------------
-%% Func: init/1
-%%-----------------------------------------------------------------
-init([Opts]) ->
-    process_flag(trap_exit, true),
-    case proplists:get_value(role, Opts) of
-	client ->		
-	    {ok, Manager} = ssh_connection_manager:start_link([client, Opts]),
-	    {ok, #state{role = client, manager = Manager}};
-	_server ->
-	    %% Children started by acceptor process
-	    {ok, #state{role = server}}
-    end.
-
-
-%%-----------------------------------------------------------------
-%% Func: terminate/2
-%%-----------------------------------------------------------------
-terminate(_Reason, #state{}) ->
-    ok.
-
-%%-----------------------------------------------------------------
-%% Func: handle_call/3
-%%-----------------------------------------------------------------
-handle_call({handler, Pid, [Role, Socket, Opts]}, _From, State) ->
-    {ok, Handler} = ssh_connection_handler:start_link(Role, Pid, Socket, Opts),
-    {reply, {ok, Handler}, State#state{handler = Handler}};
-handle_call({manager, [server = Role, Socket, Opts, SubSysSup]}, _From, State) ->
-    {ok, Manager} = ssh_connection_manager:start_link([Role, Socket, Opts, SubSysSup]),
-    {reply, {ok, Manager}, State#state{manager = Manager}};
-handle_call({manager, [client = Role | Opts]}, _From, State) ->
-    {ok, Manager} = ssh_connection_manager:start_link([Role, Opts]),
-    {reply, {ok, Manager}, State#state{manager = Manager}};
-handle_call(manager, _From, State) ->
-    {reply, State#state.manager, State};
-handle_call(stop, _From, State) ->
-    {stop, normal, ok, State};
-handle_call(_, _, State) ->
-    {noreply, State, State#state.timeout}.
-
-%%-----------------------------------------------------------------
-%% Func: handle_cast/2
-%%-----------------------------------------------------------------
-handle_cast(stop, State) ->
-    {stop, normal, State};
-handle_cast(_, State) ->
-    {noreply, State, State#state.timeout}.
-
-%%-----------------------------------------------------------------
-%% Func: handle_info/2
-%%-----------------------------------------------------------------
-%% handle_info(ssh_connected, State) ->
-%%     {stop, normal, State};
-%% Servant termination.
-handle_info({'EXIT', _Pid, Reason}, State) ->
-    {stop, Reason, State}.
-
-%%-----------------------------------------------------------------
-%% Func: code_change/3
-%%-----------------------------------------------------------------
-code_change(_OldVsn, State, _Extra) ->
-    {ok, State}.
-
diff --git a/lib/ssh/src/ssh_connection_handler.erl b/lib/ssh/src/ssh_connection_handler.erl
index 1c4477aeb3..e952a333ff 100644
--- a/lib/ssh/src/ssh_connection_handler.erl
+++ b/lib/ssh/src/ssh_connection_handler.erl
@@ -1,832 +1,1484 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2008-2013. All Rights Reserved.
+%% Copyright Ericsson AB 2008-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
 %%
 %%----------------------------------------------------------------------
-%% Purpose: Handles the setup of an ssh connection, e.i. both the
-%% setup SSH Transport Layer Protocol (RFC 4253) and Authentication
-%% Protocol (RFC 4252). Details of the different protocols are
-%% implemented in ssh_transport.erl, ssh_auth.erl
+%% Purpose: Handles an ssh connection, e.i. both the
+%% setup SSH Transport Layer Protocol (RFC 4253), Authentication
+%% Protocol (RFC 4252) and SSH connection Protocol (RFC 4255)
+%% Details of the different protocols are
+%% implemented in ssh_transport.erl, ssh_auth.erl and ssh_connection.erl
 %% ----------------------------------------------------------------------
 
 -module(ssh_connection_handler).
 
--behaviour(gen_fsm).
+-behaviour(gen_statem).
 
 -include("ssh.hrl").
 -include("ssh_transport.hrl").
 -include("ssh_auth.hrl").
 -include("ssh_connect.hrl").
 
--export([start_link/4, send/2, renegotiate/1, send_event/2,
-	 connection_info/3,
-	 peer_address/1,
-	 renegotiate_data/1]).
-
-%% gen_fsm callbacks
--export([hello/2, kexinit/2, key_exchange/2, new_keys/2,
-	 userauth/2, connected/2]).
-
--export([init/1, handle_event/3,
-	 handle_sync_event/4, handle_info/3, terminate/3, code_change/4]).
-
-%% spawn export
--export([ssh_info_handler/3]).
-
--record(state, {
-	  transport_protocol,      % ex: tcp
-	  transport_cb,
-	  transport_close_tag,
-	  ssh_params,              %  #ssh{} - from ssh.hrl
-	  socket,                  %  socket()
-	  decoded_data_buffer,     %  binary()
-	  encoded_data_buffer,     %  binary()
-	  undecoded_packet_length, %  integer()
-	  key_exchange_init_msg,   %  #ssh_msg_kexinit{}
-	  renegotiate = false,     %  boolean() 
-	  manager,                  % pid()
-	  connection_queue,
-	  address,
-	  port,
-	  opts
-	 }). 
-
--define(DBG_MESSAGE, true).
+%%====================================================================
+%%% Exports
+%%====================================================================
+
+%%% Start and stop
+-export([start_link/3,
+	 stop/1
+	]).
+
+%%% Internal application API
+-export([start_connection/4,
+	 open_channel/6,
+	 request/6, request/7,
+	 reply_request/3, 
+	 send/5,
+	 send_eof/2,
+	 info/1, info/2,
+	 connection_info/2,
+	 channel_info/3,
+	 adjust_window/3, close/2,
+	 disconnect/1, disconnect/2,
+	 get_print_info/1
+	]).
+
+%%% Behaviour callbacks
+-export([handle_event/4, terminate/3, format_status/2, code_change/4]).
+
+%%% Exports not intended to be used :). They are used for spawning and tests
+-export([init_connection_handler/3,	   % proc_lib:spawn needs this
+	 init_ssh_record/3,		   % Export of this internal function
+					   % intended for low-level protocol test suites
+	 renegotiate/1, renegotiate_data/1 % Export intended for test cases
+	]).
+
+%%====================================================================
+%% Start / stop
+%%====================================================================
+%%--------------------------------------------------------------------
+-spec start_link(role(),
+		 inet:socket(),
+		 proplists:proplist()
+		) -> {ok, pid()}.
+%% . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
+start_link(Role, Socket, Options) ->
+    {ok, proc_lib:spawn_link(?MODULE, init_connection_handler, [Role, Socket, Options])}.
+
+
+%%--------------------------------------------------------------------
+-spec stop(connection_ref()
+	  ) -> ok | {error, term()}.
+%% . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
+stop(ConnectionHandler)->
+    case call(ConnectionHandler, stop) of
+       {error, closed} ->
+	    ok;
+	Other ->
+	    Other
+    end.
 
 %%====================================================================
 %% Internal application API
 %%====================================================================
+
+-define(DefaultTransport,  {tcp, gen_tcp, tcp_closed} ).
+
 %%--------------------------------------------------------------------
-%% Function: start_link() -> ok,Pid} | ignore | {error,Error}
-%% Description:Creates a gen_fsm process which calls Module:init/1 to
-%% initialize. To ensure a synchronized start-up procedure, this function
-%% does not return until Module:init/1 has returned.  
+-spec start_connection(role(),
+		       inet:socket(),
+		       proplists:proplist(),
+		       timeout()
+		      ) -> {ok, connection_ref()} | {error, term()}.
+%% . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
+start_connection(client = Role, Socket, Options, Timeout) ->
+    try
+	{ok, Pid} = sshc_sup:start_child([Role, Socket, Options]),
+	ok = socket_control(Socket, Pid, Options),
+	handshake(Pid, erlang:monitor(process,Pid), Timeout)
+    catch
+	exit:{noproc, _} ->
+	    {error, ssh_not_started};
+	_:Error ->
+	    {error, Error}
+    end;
+
+start_connection(server = Role, Socket, Options, Timeout) ->
+    SSH_Opts = proplists:get_value(ssh_opts, Options, []),
+    try
+	case proplists:get_value(parallel_login, SSH_Opts, false) of
+	    true ->
+		HandshakerPid =
+		    spawn_link(fun() ->
+				       receive
+					   {do_handshake, Pid} ->
+					       handshake(Pid, erlang:monitor(process,Pid), Timeout)
+				       end
+			       end),
+		ChildPid = start_the_connection_child(HandshakerPid, Role, Socket, Options),
+		HandshakerPid ! {do_handshake, ChildPid};
+	    false ->
+		ChildPid = start_the_connection_child(self(), Role, Socket, Options),
+		handshake(ChildPid, erlang:monitor(process,ChildPid), Timeout)
+	end
+    catch
+	exit:{noproc, _} ->
+	    {error, ssh_not_started};
+	_:Error ->
+	    {error, Error}
+    end.
+
+%%--------------------------------------------------------------------
+%%% Some other module has decided to disconnect.
+-spec disconnect(#ssh_msg_disconnect{}) -> no_return().
+-spec disconnect(#ssh_msg_disconnect{}, iodata()) -> no_return().
+%% . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
+disconnect(Msg = #ssh_msg_disconnect{}) ->
+    throw({keep_state_and_data, 
+	   [{next_event, internal, {disconnect, Msg, Msg#ssh_msg_disconnect.description}}]}).
+
+disconnect(Msg = #ssh_msg_disconnect{}, ExtraInfo) ->
+    throw({keep_state_and_data,
+	   [{next_event, internal, {disconnect, Msg, {Msg#ssh_msg_disconnect.description,ExtraInfo}}}]}).
+
+
+%%--------------------------------------------------------------------
+-spec open_channel(connection_ref(), 
+		   string(),
+		   iodata(),
+		   pos_integer(),
+		   pos_integer(),
+		   timeout()
+		  ) -> {open, channel_id()} | {error, term()}.
+		   
+%% . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
+open_channel(ConnectionHandler, 
+	     ChannelType, ChannelSpecificData, InitialWindowSize, MaxPacketSize, 
+	     Timeout) ->
+    call(ConnectionHandler,
+	 {open, 
+	  self(), 
+	  ChannelType, InitialWindowSize, MaxPacketSize, ChannelSpecificData,
+	  Timeout}).
+
+%%--------------------------------------------------------------------
+-spec request(connection_ref(),
+	      pid(),
+	      channel_id(),
+	      string(),
+	      boolean(),
+	      iodata(),
+	      timeout()
+	     ) -> success | failure | ok | {error,timeout}.
+
+-spec request(connection_ref(),
+	      channel_id(),
+	      string(),
+	      boolean(),
+	      iodata(),
+	      timeout()
+	     ) -> success | failure | ok | {error,timeout}.
+%% . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
+request(ConnectionHandler, ChannelPid, ChannelId, Type, true, Data, Timeout) ->
+    call(ConnectionHandler, {request, ChannelPid, ChannelId, Type, Data, Timeout});
+request(ConnectionHandler, ChannelPid, ChannelId, Type, false, Data, _) ->
+    cast(ConnectionHandler, {request, ChannelPid, ChannelId, Type, Data}).
+
+request(ConnectionHandler, ChannelId, Type, true, Data, Timeout) ->
+    call(ConnectionHandler, {request, ChannelId, Type, Data, Timeout});
+request(ConnectionHandler, ChannelId, Type, false, Data, _) ->
+    cast(ConnectionHandler, {request, ChannelId, Type, Data}).
+
 %%--------------------------------------------------------------------
-start_link(Role, Manager, Socket, Options) ->
-    gen_fsm:start_link(?MODULE, [Role, Manager, Socket, Options], []).
+-spec reply_request(connection_ref(),
+		    success | failure,
+		    channel_id()
+		   ) -> ok.
+			   
+%% . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
+reply_request(ConnectionHandler, Status, ChannelId) ->
+    cast(ConnectionHandler, {reply_request, Status, ChannelId}).
 
-send(ConnectionHandler, Data) ->
-    send_all_state_event(ConnectionHandler, {send, Data}).
+%%--------------------------------------------------------------------
+-spec send(connection_ref(),
+	   channel_id(),
+	   non_neg_integer(),
+	   iodata(),
+	   timeout()
+	  ) -> ok | {error, timeout|closed}.
+%% . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
+send(ConnectionHandler, ChannelId, Type, Data, Timeout) ->
+    call(ConnectionHandler, {data, ChannelId, Type, Data, Timeout}).
 
+%%--------------------------------------------------------------------
+-spec send_eof(connection_ref(),
+	       channel_id()
+	      ) -> ok | {error,closed}.
+%% . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
+send_eof(ConnectionHandler, ChannelId) ->
+    call(ConnectionHandler, {eof, ChannelId}).
+
+%%--------------------------------------------------------------------
+-spec info(connection_ref()
+	  ) -> {ok, [#channel{}]} .
+
+-spec info(connection_ref(),
+	   pid() | all
+	  ) -> {ok, [#channel{}]} .
+%% . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
+info(ConnectionHandler) ->
+    info(ConnectionHandler, all).
+
+info(ConnectionHandler, ChannelProcess) ->
+    call(ConnectionHandler, {info, ChannelProcess}).
+
+%%--------------------------------------------------------------------
+-type local_sock_info() :: {inet:ip_address(), non_neg_integer()} | string().
+-type peer_sock_info()  :: {inet:ip_address(), non_neg_integer()} | string().
+-type state_info() :: iolist().
+
+-spec get_print_info(connection_ref()
+		    ) -> {{local_sock_info(), peer_sock_info()},
+			  state_info()
+			 }.
+%% . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
+get_print_info(ConnectionHandler) ->
+    call(ConnectionHandler, get_print_info, 1000).
+
+%%--------------------------------------------------------------------
+-spec connection_info(connection_ref(),
+		      [atom()]
+		     ) -> proplists:proplist().
+%% . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
+connection_info(ConnectionHandler, Options) ->
+    call(ConnectionHandler, {connection_info, Options}).
+
+%%--------------------------------------------------------------------
+-spec channel_info(connection_ref(),
+		   channel_id(),
+		   [atom()]
+		  ) -> proplists:proplist().
+%% . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
+channel_info(ConnectionHandler, ChannelId, Options) ->
+    call(ConnectionHandler, {channel_info, ChannelId, Options}).
+
+%%--------------------------------------------------------------------
+-spec adjust_window(connection_ref(),
+		    channel_id(),
+		    integer()
+		   ) -> ok.
+%% . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
+adjust_window(ConnectionHandler, Channel, Bytes) ->
+    cast(ConnectionHandler, {adjust_window, Channel, Bytes}).
+
+%%--------------------------------------------------------------------
+-spec close(connection_ref(),
+	    channel_id()
+	   ) -> ok.
+%% . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
+close(ConnectionHandler, ChannelId) ->
+    case call(ConnectionHandler, {close, ChannelId}) of
+	ok ->
+	    ok;
+	{error, closed} ->
+	    ok
+    end.
+
+%%====================================================================
+%% Test support
+%%====================================================================
+%%--------------------------------------------------------------------
+-spec renegotiate(connection_ref()
+		 ) -> ok.
+%% . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
 renegotiate(ConnectionHandler) ->
-    send_all_state_event(ConnectionHandler, renegotiate).
- 
+    cast(ConnectionHandler, renegotiate).
+
+%%--------------------------------------------------------------------
+-spec renegotiate_data(connection_ref()
+		      ) -> ok.
+%% . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
 renegotiate_data(ConnectionHandler) ->
-    send_all_state_event(ConnectionHandler, data_size).
-connection_info(ConnectionHandler, From, Options) ->
-     send_all_state_event(ConnectionHandler, {info, From, Options}).
+    cast(ConnectionHandler, data_size).
 
-%% Replaced with option to connection_info/3. For now keep 
-%% for backwards compatibility
-peer_address(ConnectionHandler) ->
-    sync_send_all_state_event(ConnectionHandler, peer_address).
 
 %%====================================================================
-%% gen_fsm callbacks
+%% Internal process state
+%%====================================================================
+-record(data, {
+	  starter                               :: pid(),
+	  auth_user                             :: string()
+						 | undefined,
+	  connection_state                      :: #connection{},
+	  latest_channel_id         = 0         :: non_neg_integer(),
+	  idle_timer_ref                        :: undefined 
+						 | infinity
+						 | reference(),
+	  idle_timer_value          = infinity  :: infinity
+						 | pos_integer(),
+	  transport_protocol                    :: atom(),	% ex: tcp
+	  transport_cb                          :: atom(),	% ex: gen_tcp
+	  transport_close_tag                   :: atom(),	% ex: tcp_closed
+	  ssh_params                            :: #ssh{}
+						 | undefined,
+	  socket                                :: inet:socket(),
+	  decrypted_data_buffer     = <<>>      :: binary(),
+	  encrypted_data_buffer     = <<>>      :: binary(),
+	  undecrypted_packet_length             :: undefined | non_neg_integer(),
+	  key_exchange_init_msg                 :: #ssh_msg_kexinit{}
+						 | undefined,
+	  last_size_rekey           = 0         :: non_neg_integer(),
+	  event_queue               = []        :: list(),
+	  opts                                  :: proplists:proplist(),
+	  inet_initial_recbuf_size              :: pos_integer()
+						 | undefined
+	 }).
+
+%%====================================================================
+%% Intitialisation
 %%====================================================================
 %%--------------------------------------------------------------------
-%% Function: init(Args) -> {ok, StateName, State} |
-%%                         {ok, StateName, State, Timeout} |
-%%                         ignore                              |
-%%                         {stop, StopReason}                   
-%% Description:Whenever a gen_fsm is started using gen_fsm:start/[3,4] or
-%% gen_fsm:start_link/3,4, this function is called by the new process to 
-%% initialize. 
-%%--------------------------------------------------------------------
-init([Role, Manager, Socket, SshOpts]) ->
+-spec init_connection_handler(role(),
+			      inet:socket(),
+			      proplists:proplist()
+			     ) -> no_return().
+%% . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
+init_connection_handler(Role, Socket, Opts) ->
     process_flag(trap_exit, true),
-    {NumVsn, StrVsn} = ssh_transport:versions(Role, SshOpts),
-    ssh_bits:install_messages(ssh_transport:transport_messages(NumVsn)),
-    {Protocol, Callback, CloseTag} = 
-	proplists:get_value(transport, SshOpts, {tcp, gen_tcp, tcp_closed}),
-    try init_ssh(Role, NumVsn, StrVsn, SshOpts, Socket) of
-	Ssh ->
-	    {ok, hello, #state{ssh_params =
-				   Ssh#ssh{send_sequence = 0, recv_sequence = 0},
-			       socket = Socket,
-			       decoded_data_buffer = <<>>,
-			       encoded_data_buffer = <<>>,
-			       transport_protocol = Protocol,
-			       transport_cb = Callback,
-			       transport_close_tag = CloseTag,
-			       manager = Manager,
-			       opts = SshOpts
-			      }}
+    S0 = init_process_state(Role, Socket, Opts),
+    try
+	{Protocol, Callback, CloseTag} =
+	    proplists:get_value(transport, Opts, ?DefaultTransport),
+	S0#data{ssh_params = init_ssh_record(Role, Socket, Opts),
+		 transport_protocol = Protocol,
+		 transport_cb = Callback,
+		 transport_close_tag = CloseTag
+		}
+    of
+	S ->
+	    gen_statem:enter_loop(?MODULE,
+				  [], %%[{debug,[trace,log,statistics,debug]} || Role==server],
+				  handle_event_function,
+				  {hello,Role},
+				  S)
     catch
-	exit:Reason ->
-	    {stop, {shutdown, Reason}}
+	_:Error ->
+	    gen_statem:enter_loop(?MODULE,
+				  [],
+				  handle_event_function,
+				  {init_error,Error},
+				  S0)
     end.
-%%--------------------------------------------------------------------
-%% Function: 
-%% state_name(Event, State) -> {next_state, NextStateName, NextState}|
-%%                             {next_state, NextStateName, 
-%%                                NextState, Timeout} |
-%%                             {stop, Reason, NewState}
-%% Description:There should be one instance of this function for each possible
-%% state name. Whenever a gen_fsm receives an event sent using
-%% gen_fsm:send_event/2, the instance of this function with the same name as
-%% the current state name StateName is called to handle the event. It is also 
-%% called if a timeout occurs. 
-%%--------------------------------------------------------------------
-hello(socket_control, #state{socket = Socket, ssh_params = Ssh} = State) ->
-    VsnMsg = ssh_transport:hello_version_msg(string_version(Ssh)),
-    send_msg(VsnMsg, State),
-    inet:setopts(Socket, [{packet, line}]),
-    {next_state, hello, next_packet(State)};
 
-hello({info_line, _Line}, State) ->
-    {next_state, hello, next_packet(State)};
 
-hello({version_exchange, Version}, #state{ssh_params = Ssh0,
-					  socket = Socket} = State) ->
-    {NumVsn, StrVsn} = ssh_transport:handle_hello_version(Version),
-    case handle_version(NumVsn, StrVsn, Ssh0) of
-	{ok, Ssh1} ->
-	    inet:setopts(Socket, [{packet,0}, {mode,binary}]),
-	    {KeyInitMsg, SshPacket, Ssh} = ssh_transport:key_exchange_init_msg(Ssh1),
-	    send_msg(SshPacket, State),
-	    {next_state, kexinit, next_packet(State#state{ssh_params = Ssh,
-							  key_exchange_init_msg = 
-							  KeyInitMsg})};
-	not_supported ->
-	   DisconnectMsg =
-		#ssh_msg_disconnect{code = 
-				    ?SSH_DISCONNECT_PROTOCOL_VERSION_NOT_SUPPORTED,
-				    description = "Protocol version " ++  StrVsn 
-				    ++ " not supported",
-				    language = "en"},
-	    handle_disconnect(DisconnectMsg, State)
+init_process_state(Role, Socket, Opts) ->
+    D = #data{connection_state =
+		   C = #connection{channel_cache = ssh_channel:cache_create(),
+				   channel_id_seed = 0,
+				   port_bindings = [],
+				   requests = [],
+				   options = Opts},
+	       starter = proplists:get_value(user_pid, Opts),
+	       socket = Socket,
+	       opts = Opts
+	      },
+    case Role of
+	client ->
+	    %% Start the renegotiation timers
+	    timer:apply_after(?REKEY_TIMOUT,      gen_statem, cast, [self(), renegotiate]),
+	    timer:apply_after(?REKEY_DATA_TIMOUT, gen_statem, cast, [self(), data_size]),
+	    cache_init_idle_timer(D);
+	server ->
+	    D#data{connection_state = init_connection(Role, C, Opts)}
     end.
 
-kexinit({#ssh_msg_kexinit{} = Kex, Payload},
-	#state{ssh_params = #ssh{role = Role} = Ssh0,
-					 key_exchange_init_msg = OwnKex} = 
-	State) ->
-    Ssh1 = ssh_transport:key_init(opposite_role(Role), Ssh0, Payload), 
-    try ssh_transport:handle_kexinit_msg(Kex, OwnKex, Ssh1) of
-	{ok, NextKexMsg, Ssh} when Role == client ->
-	    send_msg(NextKexMsg, State),
-	    {next_state, key_exchange, 
-	     next_packet(State#state{ssh_params = Ssh})};
-	{ok, Ssh} when Role == server ->
-	    {next_state, key_exchange, 
-	     next_packet(State#state{ssh_params = Ssh})}
-    catch
-	#ssh_msg_disconnect{} = DisconnectMsg ->
-	    handle_disconnect(DisconnectMsg, State);
-	_:Error ->
-	    Desc = log_error(Error),
-	    handle_disconnect(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
-						  description = Desc,
-						  language = "en"}, State)
+
+init_connection(server, C = #connection{}, Opts) ->
+    Sups = proplists:get_value(supervisors, Opts),
+    SystemSup = proplists:get_value(system_sup, Sups),
+    SubSystemSup = proplists:get_value(subsystem_sup, Sups),
+    ConnectionSup = proplists:get_value(connection_sup, Sups),
+    Shell = proplists:get_value(shell, Opts),
+    Exec = proplists:get_value(exec, Opts),
+    CliSpec = proplists:get_value(ssh_cli, Opts, {ssh_cli, [Shell]}),
+    C#connection{cli_spec = CliSpec,
+		 exec = Exec,
+		 system_supervisor = SystemSup,
+		 sub_system_supervisor = SubSystemSup,
+		 connection_supervisor = ConnectionSup
+		}.
+
+
+init_ssh_record(Role, Socket, Opts) ->
+    {ok, PeerAddr} = inet:peername(Socket),
+    KeyCb = proplists:get_value(key_cb, Opts, ssh_file),
+    AuthMethods = proplists:get_value(auth_methods, Opts, ?SUPPORTED_AUTH_METHODS),
+    S0 = #ssh{role = Role,
+	      key_cb = KeyCb,
+	      opts = Opts,
+	      userauth_supported_methods = AuthMethods,
+	      available_host_keys = supported_host_keys(Role, KeyCb, Opts),
+	      random_length_padding = proplists:get_value(max_random_length_padding,
+							  Opts,
+							  (#ssh{})#ssh.random_length_padding)
+	   },
+
+    {Vsn, Version} = ssh_transport:versions(Role, Opts),
+    case Role of
+	client ->
+	    PeerName =  proplists:get_value(host, Opts),
+	    S0#ssh{c_vsn = Vsn,
+		   c_version = Version,
+		   io_cb = case proplists:get_value(user_interaction, Opts, true) of
+			       true ->  ssh_io;
+			       false -> ssh_no_io
+			   end,
+		   userauth_quiet_mode = proplists:get_value(quiet_mode, Opts, false),
+		   peer = {PeerName, PeerAddr}
+		  };
+
+	server ->
+	    S0#ssh{s_vsn = Vsn,
+		   s_version = Version,
+		   io_cb = proplists:get_value(io_cb, Opts, ssh_io),
+		   userauth_methods = string:tokens(AuthMethods, ","),
+		   kb_tries_left = 3,
+		   peer = {undefined, PeerAddr}
+		  }
     end.
-    
-key_exchange(#ssh_msg_kexdh_init{} = Msg, 
-	     #state{ssh_params = #ssh{role = server} =Ssh0} = State) ->
-    try ssh_transport:handle_kexdh_init(Msg, Ssh0) of
-	{ok, KexdhReply, Ssh1} ->
-	    send_msg(KexdhReply, State),
-	    {ok, NewKeys, Ssh} = ssh_transport:new_keys_message(Ssh1),
-	    send_msg(NewKeys, State),
-	    {next_state, new_keys, next_packet(State#state{ssh_params = Ssh})}
-    catch
-	#ssh_msg_disconnect{} = DisconnectMsg ->
-	    handle_disconnect(DisconnectMsg, State);
-	_:Error ->
-	    Desc = log_error(Error),
-	    handle_disconnect(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
-						  description = Desc,
-						  language = "en"}, State)
-    end;
 
-key_exchange({#ssh_msg_kexinit{} = Kex, Payload},
-	#state{ssh_params = #ssh{role = Role} = Ssh0,
-					 key_exchange_init_msg = OwnKex} =
-	State) ->
-    Ssh1 = ssh_transport:key_init(opposite_role(Role), Ssh0, Payload),
-    try ssh_transport:handle_kexinit_msg(Kex, OwnKex, Ssh1) of
-	{ok, NextKexMsg, Ssh} when Role == client ->
-	    send_msg(NextKexMsg, State),
-	    {next_state, key_exchange,
-	     next_packet(State#state{ssh_params = Ssh})};
-	{ok, Ssh} when Role == server ->
-	    {next_state, key_exchange,
-	     next_packet(State#state{ssh_params = Ssh})}
-    catch
-	#ssh_msg_disconnect{} = DisconnectMsg ->
-	    handle_disconnect(DisconnectMsg, State);
-	_:Error ->
-	    Desc = log_error(Error),
-	    handle_disconnect(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
-						  description = Desc,
-						  language = "en"}, State)
+
+
+%%====================================================================
+%% gen_statem callbacks
+%%====================================================================
+%%--------------------------------------------------------------------
+-type event_content() ::  any().
+
+-type renegotiate_flag() :: init | renegotiate.
+
+-type state_name() :: 
+	{init_error,any()}
+      | {hello, role()}
+      | {kexinit, role(), renegotiate_flag()}
+      | {key_exchange, role(), renegotiate_flag()}
+      | {key_exchange_dh_gex_init, server, renegotiate_flag()}
+      | {key_exchange_dh_gex_reply, client, renegotiate_flag()}
+      | {new_keys, role()}
+      | {service_request, role()}
+      | {userauth, role()}
+      | {userauth_keyboard_interactive, role()}
+      | {connected, role()}
+	.
+
+-type handle_event_result() :: gen_statem:handle_event_result().
+
+-spec handle_event(gen_statem:event_type(),
+		   event_content(),
+		   state_name(),
+		   #data{}
+		  ) -> handle_event_result().
+		   
+%% . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
+
+%%% ######## Error in the initialisation ####
+
+handle_event(_, _Event, {init_error,Error}, _) ->
+    case Error of
+	{badmatch,{error,enotconn}} ->
+	    %% Handles the abnormal sequence:
+	    %%    SYN->
+	    %%            <-SYNACK
+	    %%    ACK->
+	    %%    RST->
+	    {stop, {shutdown,"TCP connenction to server was prematurely closed by the client"}};
+
+	OtherError ->
+	    {stop, {shutdown,{init,OtherError}}}
     end;
-  
-key_exchange(#ssh_msg_kexdh_reply{} = Msg, 
-	     #state{ssh_params = #ssh{role = client} = Ssh0} = State) -> 
-    try ssh_transport:handle_kexdh_reply(Msg, Ssh0) of
-	{ok, NewKeys, Ssh} -> 
-	    send_msg(NewKeys, State),
-	    {next_state, new_keys, next_packet(State#state{ssh_params = Ssh})}
-    catch
-	#ssh_msg_disconnect{} = DisconnectMsg ->
-	    handle_disconnect(DisconnectMsg, State);
-	{ErrorToDisplay, #ssh_msg_disconnect{} = DisconnectMsg} ->
-	    handle_disconnect(DisconnectMsg, State, ErrorToDisplay);
-	_:Error ->
-	    Desc = log_error(Error),
-	    handle_disconnect(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
-							  description = Desc,
-							  language = "en"}, State)
+
+
+%%% ######## {hello, client|server} ####
+%% The very first event that is sent when the we are set as controlling process of Socket
+handle_event(_, socket_control, {hello,_}, D) ->
+    VsnMsg = ssh_transport:hello_version_msg(string_version(D#data.ssh_params)),
+    ok = send_bytes(VsnMsg, D),
+    case inet:getopts(Socket=D#data.socket, [recbuf]) of
+	{ok, [{recbuf,Size}]} ->
+	    %% Set the socket to the hello text line handling mode:
+	    inet:setopts(Socket, [{packet, line},
+				  {active, once},
+				  % Expecting the version string which might
+				  % be max ?MAX_PROTO_VERSION bytes:
+				  {recbuf, ?MAX_PROTO_VERSION},
+				  {nodelay,true}]),
+	    {keep_state, D#data{inet_initial_recbuf_size=Size}};
+
+	Other ->
+	    {stop, {shutdown,{unexpected_getopts_return, Other}}}
     end;
 
-key_exchange(#ssh_msg_kex_dh_gex_group{} = Msg, 
-	     #state{ssh_params = #ssh{role = server} = Ssh0} = State) ->
-    try ssh_transport:handle_kex_dh_gex_group(Msg, Ssh0) of 
-	{ok, NextKexMsg, Ssh1} ->
-	    send_msg(NextKexMsg, State),
-	    {ok, NewKeys, Ssh} = ssh_transport:new_keys_message(Ssh1),
-	    send_msg(NewKeys, State),
-	    {next_state, new_keys, next_packet(State#state{ssh_params = Ssh})}
-    catch
-	#ssh_msg_disconnect{} = DisconnectMsg ->
-	    handle_disconnect(DisconnectMsg, State);
-	_:Error ->
-	    Desc = log_error(Error),
-	    handle_disconnect(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
-						  description = Desc,
-						  language = "en"}, State)
+handle_event(_, {info_line,_Line}, {hello,Role}, D) ->
+    case Role of
+	client ->
+	    %% The server may send info lines to the client before the version_exchange
+	    inet:setopts(D#data.socket, [{active, once}]),
+	    keep_state_and_data;
+	server ->
+	    %% But the client may NOT send them to the server. Openssh answers with cleartext,
+	    %% and so do we
+	    ok = send_bytes("Protocol mismatch.", D),
+	    {stop, {shutdown,"Protocol mismatch in version exchange. Client sent info lines."}}
     end;
 
-key_exchange(#ssh_msg_kex_dh_gex_request{} = Msg, 
-	     #state{ssh_params = #ssh{role = client} = Ssh0} = State) ->
-    try ssh_transport:handle_kex_dh_gex_request(Msg, Ssh0) of 
-	{ok, NextKexMsg, Ssh} ->
-	    send_msg(NextKexMsg, State),
-	    {next_state, new_keys, next_packet(State#state{ssh_params = Ssh})}
-    catch
-	#ssh_msg_disconnect{} = DisconnectMsg ->
-	    handle_disconnect(DisconnectMsg, State);
-	_:Error ->
-	    Desc = log_error(Error),
-	    handle_disconnect(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
-						  description = Desc,
-						  language = "en"}, State)
+handle_event(_, {version_exchange,Version}, {hello,Role}, D) ->
+    {NumVsn, StrVsn} = ssh_transport:handle_hello_version(Version),
+    case handle_version(NumVsn, StrVsn, D#data.ssh_params) of
+	{ok, Ssh1} ->
+	    %% Since the hello part is finnished correctly, we set the
+	    %% socket to the packet handling mode (including recbuf size):
+	    inet:setopts(D#data.socket, [{packet,0},
+					 {mode,binary},
+					 {active, once},
+					 {recbuf, D#data.inet_initial_recbuf_size}]),
+	    {KeyInitMsg, SshPacket, Ssh} = ssh_transport:key_exchange_init_msg(Ssh1),
+	    ok = send_bytes(SshPacket, D),
+	    {next_state, {kexinit,Role,init}, D#data{ssh_params = Ssh,
+						     key_exchange_init_msg = KeyInitMsg}};
+	not_supported ->
+	    disconnect(
+	      #ssh_msg_disconnect{code = ?SSH_DISCONNECT_PROTOCOL_VERSION_NOT_SUPPORTED,
+				  description = ["Protocol version ",StrVsn," not supported"]},
+	      {next_state, {hello,Role}, D})
     end;
-key_exchange(#ssh_msg_kex_dh_gex_reply{} = Msg, 
-	     #state{ssh_params = #ssh{role = client} = Ssh0} = State) ->
-    try ssh_transport:handle_kex_dh_gex_reply(Msg, Ssh0) of 
-	{ok, NewKeys, Ssh} ->
-	    send_msg(NewKeys, State),
-	    {next_state, new_keys, next_packet(State#state{ssh_params = Ssh})}
-    catch
-	#ssh_msg_disconnect{} = DisconnectMsg ->
-	    handle_disconnect(DisconnectMsg, State);
-	_:Error ->
-	    Desc = log_error(Error),
-	    handle_disconnect(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
-						  description = Desc,
-						  language = "en"}, State)
-    end.
 
-new_keys(#ssh_msg_newkeys{} = Msg, #state{ssh_params = Ssh0} = State0) ->
-    try ssh_transport:handle_new_keys(Msg, Ssh0) of
-	{ok, Ssh} ->
-	    {NextStateName, State} = 
-		after_new_keys(State0#state{ssh_params = Ssh}),
-	    {next_state, NextStateName, next_packet(State)}
-    catch
-	#ssh_msg_disconnect{} = DisconnectMsg ->
-	    handle_disconnect(DisconnectMsg, State0);
-	_:Error ->
-	    Desc = log_error(Error),
-	    handle_disconnect(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
-						  description = Desc,
-						  language = "en"}, State0)
-    end.
+		  
+%%% ######## {kexinit, client|server, init|renegotiate} ####
+
+handle_event(_, {#ssh_msg_kexinit{}=Kex, Payload}, {kexinit,Role,ReNeg},
+	     D = #data{key_exchange_init_msg = OwnKex}) ->
+    Ssh1 = ssh_transport:key_init(peer_role(Role), D#data.ssh_params, Payload),
+    Ssh = case ssh_transport:handle_kexinit_msg(Kex, OwnKex, Ssh1) of
+	      {ok, NextKexMsg, Ssh2} when Role==client ->
+		  ok = send_bytes(NextKexMsg, D),
+		  Ssh2;
+	      {ok, Ssh2} when Role==server ->
+		  Ssh2
+	  end,
+    {next_state, {key_exchange,Role,ReNeg}, D#data{ssh_params=Ssh}};
+
+
+%%% ######## {key_exchange, client|server, init|renegotiate} ####
+
+%%%---- diffie-hellman
+handle_event(_, #ssh_msg_kexdh_init{} = Msg, {key_exchange,server,ReNeg}, D) ->
+    {ok, KexdhReply, Ssh1} = ssh_transport:handle_kexdh_init(Msg, D#data.ssh_params),
+    ok = send_bytes(KexdhReply, D),
+    {ok, NewKeys, Ssh} = ssh_transport:new_keys_message(Ssh1),
+    ok = send_bytes(NewKeys, D),
+    {next_state, {new_keys,server,ReNeg}, D#data{ssh_params=Ssh}};
+
+handle_event(_, #ssh_msg_kexdh_reply{} = Msg, {key_exchange,client,ReNeg}, D) ->
+    {ok, NewKeys, Ssh} = ssh_transport:handle_kexdh_reply(Msg, D#data.ssh_params),
+    ok = send_bytes(NewKeys, D),
+    {next_state, {new_keys,client,ReNeg}, D#data{ssh_params=Ssh}};
+
+%%%---- diffie-hellman group exchange
+handle_event(_, #ssh_msg_kex_dh_gex_request{} = Msg, {key_exchange,server,ReNeg}, D) ->
+    {ok, GexGroup, Ssh} = ssh_transport:handle_kex_dh_gex_request(Msg, D#data.ssh_params),
+    ok = send_bytes(GexGroup, D),
+    {next_state, {key_exchange_dh_gex_init,server,ReNeg}, D#data{ssh_params=Ssh}};
+
+handle_event(_, #ssh_msg_kex_dh_gex_request_old{} = Msg, {key_exchange,server,ReNeg}, D) ->
+    {ok, GexGroup, Ssh} = ssh_transport:handle_kex_dh_gex_request(Msg, D#data.ssh_params),
+    ok = send_bytes(GexGroup, D),
+    {next_state, {key_exchange_dh_gex_init,server,ReNeg}, D#data{ssh_params=Ssh}};
+
+handle_event(_, #ssh_msg_kex_dh_gex_group{} = Msg, {key_exchange,client,ReNeg}, D) ->
+    {ok, KexGexInit, Ssh} = ssh_transport:handle_kex_dh_gex_group(Msg, D#data.ssh_params),
+    ok = send_bytes(KexGexInit, D),
+    {next_state, {key_exchange_dh_gex_reply,client,ReNeg}, D#data{ssh_params=Ssh}};
+
+%%%---- elliptic curve diffie-hellman
+handle_event(_, #ssh_msg_kex_ecdh_init{} = Msg, {key_exchange,server,ReNeg}, D) ->
+    {ok, KexEcdhReply, Ssh1} = ssh_transport:handle_kex_ecdh_init(Msg, D#data.ssh_params),
+    ok = send_bytes(KexEcdhReply, D),
+    {ok, NewKeys, Ssh} = ssh_transport:new_keys_message(Ssh1),
+    ok = send_bytes(NewKeys, D),
+    {next_state, {new_keys,server,ReNeg}, D#data{ssh_params=Ssh}};
+
+handle_event(_, #ssh_msg_kex_ecdh_reply{} = Msg, {key_exchange,client,ReNeg}, D) ->
+    {ok, NewKeys, Ssh} = ssh_transport:handle_kex_ecdh_reply(Msg, D#data.ssh_params),
+    ok = send_bytes(NewKeys, D),
+    {next_state, {new_keys,client,ReNeg}, D#data{ssh_params=Ssh}};
+
+
+%%% ######## {key_exchange_dh_gex_init, server, init|renegotiate} ####
+
+handle_event(_, #ssh_msg_kex_dh_gex_init{} = Msg, {key_exchange_dh_gex_init,server,ReNeg}, D) ->
+    {ok, KexGexReply, Ssh1} =  ssh_transport:handle_kex_dh_gex_init(Msg, D#data.ssh_params),
+    ok = send_bytes(KexGexReply, D),
+    {ok, NewKeys, Ssh} = ssh_transport:new_keys_message(Ssh1),
+    ok = send_bytes(NewKeys, D),
+    {next_state, {new_keys,server,ReNeg}, D#data{ssh_params=Ssh}};
+
+
+%%% ######## {key_exchange_dh_gex_reply, client, init|renegotiate} ####
+
+handle_event(_, #ssh_msg_kex_dh_gex_reply{} = Msg, {key_exchange_dh_gex_reply,client,ReNeg}, D) ->
+    {ok, NewKeys, Ssh1} = ssh_transport:handle_kex_dh_gex_reply(Msg, D#data.ssh_params),
+    ok = send_bytes(NewKeys, D),
+    {next_state, {new_keys,client,ReNeg}, D#data{ssh_params=Ssh1}};
+
+
+%%% ######## {new_keys, client|server} ####
+
+%% First key exchange round:
+handle_event(_, #ssh_msg_newkeys{} = Msg, {new_keys,Role,init}, D) ->
+    {ok, Ssh1} = ssh_transport:handle_new_keys(Msg, D#data.ssh_params),
+    Ssh = case Role of
+	      client ->
+		  {MsgReq, Ssh2} = ssh_auth:service_request_msg(Ssh1),
+		  ok = send_bytes(MsgReq, D),
+		  Ssh2;
+	      server ->
+		  Ssh1
+	  end,
+    {next_state, {service_request,Role}, D#data{ssh_params=Ssh}};
+
+%% Subsequent key exchange rounds (renegotiation):
+handle_event(_, #ssh_msg_newkeys{}, {new_keys,Role,renegotiate}, D) ->
+    {next_state, {connected,Role}, D};
+
+%%% ######## {service_request, client|server}
+
+handle_event(_, Msg = #ssh_msg_service_request{name=ServiceName}, StateName = {service_request,server}, D) ->
+    case ServiceName of
+	"ssh-userauth" ->
+	    Ssh0 = #ssh{session_id=SessionId} = D#data.ssh_params,
+	    {ok, {Reply, Ssh}} = ssh_auth:handle_userauth_request(Msg, SessionId, Ssh0),
+	    ok = send_bytes(Reply, D),
+	    {next_state, {userauth,server}, D#data{ssh_params = Ssh}};
 
-userauth(#ssh_msg_service_request{name = "ssh-userauth"} = Msg, 
-	 #state{ssh_params = #ssh{role = server, 
-				  session_id = SessionId} = Ssh0} = State) ->
-    ssh_bits:install_messages(ssh_auth:userauth_messages()),
-    try ssh_auth:handle_userauth_request(Msg, SessionId, Ssh0) of
-	{ok, {Reply, Ssh}} ->
-	    send_msg(Reply, State),
-	    {next_state, userauth, next_packet(State#state{ssh_params = Ssh})}
-    catch 	
-	#ssh_msg_disconnect{} = DisconnectMsg ->
-	    handle_disconnect(DisconnectMsg, State);
-	_:Error ->
-	    Desc = log_error(Error),
-	    handle_disconnect(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_SERVICE_NOT_AVAILABLE,
-						  description = Desc,
-						  language = "en"}, State)
+	_ ->
+	    disconnect(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_SERVICE_NOT_AVAILABLE,
+					   description = "Unknown service"},
+		       StateName, D)
     end;
 
-userauth(#ssh_msg_service_accept{name = "ssh-userauth"},  
-	 #state{ssh_params = #ssh{role = client,
-				  service = "ssh-userauth"} = Ssh0} = 
-	 State) ->
+handle_event(_, #ssh_msg_service_accept{name = "ssh-userauth"}, {service_request,client},
+	     #data{ssh_params = #ssh{service="ssh-userauth"} = Ssh0} = State) ->
     {Msg, Ssh} = ssh_auth:init_userauth_request_msg(Ssh0),
-    send_msg(Msg, State),
-    {next_state, userauth, next_packet(State#state{ssh_params = Ssh})};
-
-userauth(#ssh_msg_userauth_request{service = "ssh-connection",
-                                  method = "none"} = Msg, 
-        #state{ssh_params = #ssh{session_id = SessionId, role = server, 
-                                 service = "ssh-connection"} = Ssh0
-              } = State) -> 
-    try ssh_auth:handle_userauth_request(Msg, SessionId, Ssh0) of
-       {not_authorized, {_User, _Reason}, {Reply, Ssh}} ->
-           send_msg(Reply, State),
-           {next_state, userauth, next_packet(State#state{ssh_params = Ssh})}
-    catch 
-	#ssh_msg_disconnect{} = DisconnectMsg ->
-	    handle_disconnect(DisconnectMsg, State);
-	_:Error ->
-	    Desc = log_error(Error),
-	    handle_disconnect(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_SERVICE_NOT_AVAILABLE,
-						  description = Desc,
-						  language = "en"}, State)
+    ok = send_bytes(Msg, State),
+    {next_state, {userauth,client}, State#data{auth_user = Ssh#ssh.user, ssh_params = Ssh}};
+
+
+%%% ######## {userauth, client|server} ####
+
+%%---- userauth request to server
+handle_event(_, 
+	     Msg = #ssh_msg_userauth_request{service = ServiceName, method = Method},
+	     StateName = {userauth,server},
+	     D = #data{ssh_params=Ssh0}) ->
+
+    case {ServiceName, Ssh0#ssh.service, Method} of
+	{"ssh-connection", "ssh-connection", "none"} ->
+	    %% Probably the very first userauth_request but we deny unauthorized login
+	    {not_authorized, _, {Reply,Ssh}} =
+		ssh_auth:handle_userauth_request(Msg, Ssh0#ssh.session_id, Ssh0),
+	    ok = send_bytes(Reply, D),
+	    {keep_state, D#data{ssh_params = Ssh}};
+	
+	{"ssh-connection", "ssh-connection", Method} ->
+	    %% Userauth request with a method like "password" or so
+	    case lists:member(Method, Ssh0#ssh.userauth_methods) of
+		true ->
+		    %% Yepp! we support this method
+		    case ssh_auth:handle_userauth_request(Msg, Ssh0#ssh.session_id, Ssh0) of
+			{authorized, User, {Reply, Ssh}} ->
+			    ok = send_bytes(Reply, D),
+			    D#data.starter ! ssh_connected,
+			    connected_fun(User, Method, D),
+			    {next_state, {connected,server},
+			     D#data{auth_user = User, 
+				    ssh_params = Ssh#ssh{authenticated = true}}};
+			{not_authorized, {User, Reason}, {Reply, Ssh}} when Method == "keyboard-interactive" ->
+			    retry_fun(User, Reason, D),
+			    ok = send_bytes(Reply, D),
+			    {next_state, {userauth_keyboard_interactive,server}, D#data{ssh_params = Ssh}};
+			{not_authorized, {User, Reason}, {Reply, Ssh}} ->
+			    retry_fun(User, Reason, D),
+			    ok = send_bytes(Reply, D),
+			    {keep_state, D#data{ssh_params = Ssh}}
+		    end;
+		false ->
+		    %% No we do not support this method (=/= none)
+		    %% At least one non-erlang client does like this. Retry as the next event
+		    {keep_state_and_data,
+		     [{next_event, internal, Msg#ssh_msg_userauth_request{method="none"}}]
+		    }
+	    end;
+
+	%% {"ssh-connection", Expected, Method} when Expected =/= ServiceName -> Do what?
+	%% {ServiceName,      Expected, Method} when Expected =/= ServiceName -> Do what?
+
+	{ServiceName, _, _} when ServiceName =/= "ssh-connection" ->
+	    disconnect(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_SERVICE_NOT_AVAILABLE,
+					   description = "Unknown service"},
+		       StateName, D)
     end;
 
-userauth(#ssh_msg_userauth_request{service = "ssh-connection",
-				   method = Method} = Msg, 
-	 #state{ssh_params = #ssh{session_id = SessionId, role = server, 
-				  service = "ssh-connection",
-				  peer = {_, Address}} = Ssh0,
-		opts = Opts, manager = Pid} = State) -> 
-    try ssh_auth:handle_userauth_request(Msg, SessionId, Ssh0) of
-	{authorized, User, {Reply, Ssh}} ->
-	    send_msg(Reply, State),
-	    ssh_userreg:register_user(User, Pid),
-	    Pid ! ssh_connected,
-	    connected_fun(User, Address, Method, Opts),
-	    {next_state, connected, 
-	     next_packet(State#state{ssh_params = Ssh})};
-	{not_authorized, {User, Reason}, {Reply, Ssh}} ->
-	    retry_fun(User, Reason, Opts),
-	    send_msg(Reply, State),
-	    {next_state, userauth, next_packet(State#state{ssh_params = Ssh})} 
-    catch 	
-	#ssh_msg_disconnect{} = DisconnectMsg ->
-	    handle_disconnect(DisconnectMsg, State);
-	_:Error ->
-	    Desc = log_error(Error),
-	    handle_disconnect(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_SERVICE_NOT_AVAILABLE,
-						  description = Desc,
-						  language = "en"}, State)
-    end;
+%%---- userauth success to client
+handle_event(_, #ssh_msg_userauth_success{}, {userauth,client}, D=#data{ssh_params = Ssh}) ->
+    D#data.starter ! ssh_connected,
+    {next_state, {connected,client}, D#data{ssh_params=Ssh#ssh{authenticated = true}}};
 
-userauth(#ssh_msg_userauth_info_request{} = Msg, 
-	 #state{ssh_params = #ssh{role = client, 
-				  io_cb = IoCb} = Ssh0} = State) ->
-    try ssh_auth:handle_userauth_info_request(Msg, IoCb, Ssh0) of
-	{ok, {Reply, Ssh}} ->
-	    send_msg(Reply, State),
-	    {next_state, userauth, next_packet(State#state{ssh_params = Ssh})}
-    catch 	
-	#ssh_msg_disconnect{} = DisconnectMsg ->
-	    handle_disconnect(DisconnectMsg, State);
-	_:Error ->
-	    Desc = log_error(Error),
-	    handle_disconnect(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_SERVICE_NOT_AVAILABLE,
-						  description = Desc,
-						  language = "en"}, State)
-    end;
 
-userauth(#ssh_msg_userauth_info_response{} = Msg, 
-	 #state{ssh_params = #ssh{role = server} = Ssh0} = State) ->
-    try ssh_auth:handle_userauth_info_response(Msg, Ssh0) of
-	{ok, {Reply, Ssh}} ->
-	    send_msg(Reply, State),
-	    {next_state, userauth, next_packet(State#state{ssh_params = Ssh})}
-    catch 	
-	#ssh_msg_disconnect{} = DisconnectMsg ->
-	    handle_disconnect(DisconnectMsg, State);
-	_:Error ->
-	    Desc = log_error(Error),
-	    handle_disconnect(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_SERVICE_NOT_AVAILABLE,
-						  description = Desc,
-						  language = "en"}, State)
-    end;
-			
-userauth(#ssh_msg_userauth_success{}, #state{ssh_params = #ssh{role = client},
-					     manager = Pid} = State) ->
-    Pid ! ssh_connected,
-    {next_state, connected, next_packet(State)};
-
-userauth(#ssh_msg_userauth_failure{},  
-	 #state{ssh_params = #ssh{role = client,
-				  userauth_methods = []}} 
-	 = State) ->
-    Msg = #ssh_msg_disconnect{code = 
-			      ?SSH_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE,
+%%---- userauth failure response to client
+handle_event(_, #ssh_msg_userauth_failure{}, {userauth,client}=StateName,
+	     D = #data{ssh_params = #ssh{userauth_methods = []}}) ->
+    Msg = #ssh_msg_disconnect{code = ?SSH_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE,
 			      description = "Unable to connect using the available"
-			      " authentication methods",
-			      language = "en"},
-    handle_disconnect(Msg, State); 
-
-%% Server tells us which authentication methods that are allowed
-userauth(#ssh_msg_userauth_failure{authentications = Methodes},  
-	 #state{ssh_params = #ssh{role = client,
-				  userauth_methods = none} = Ssh0} = State) ->
-    AuthMethods = string:tokens(Methodes, ","),
-    Ssh1 = Ssh0#ssh{userauth_methods = AuthMethods},
+			                    " authentication methods"},
+    disconnect(Msg, StateName, D);
+
+handle_event(_, #ssh_msg_userauth_failure{authentications = Methods}, StateName={userauth,client},
+	     D = #data{ssh_params = Ssh0}) ->
+    %% The prefered authentication method failed try next method
+    Ssh1 = case Ssh0#ssh.userauth_methods of
+	       none ->
+		   %% Server tells us which authentication methods that are allowed
+		   Ssh0#ssh{userauth_methods = string:tokens(Methods, ",")};
+	       _ ->
+		   %% We already know...
+		   Ssh0
+	   end,
     case ssh_auth:userauth_request_msg(Ssh1) of
 	{disconnect, DisconnectMsg, {Msg, Ssh}} ->
-	    send_msg(Msg, State),
-	    handle_disconnect(DisconnectMsg, State#state{ssh_params = Ssh}); 
-	{Msg, Ssh} ->
-	    send_msg(Msg, State),
-	    {next_state, userauth, next_packet(State#state{ssh_params = Ssh})}
+	    send_bytes(Msg, D),
+	    disconnect(DisconnectMsg, StateName, D#data{ssh_params = Ssh});
+	{"keyboard-interactive", {Msg, Ssh}} ->
+	    send_bytes(Msg, D),
+	    {next_state, {userauth_keyboard_interactive,client}, D#data{ssh_params = Ssh}};
+	{_Method, {Msg, Ssh}} ->
+	    send_bytes(Msg, D),
+	    {keep_state, D#data{ssh_params = Ssh}}
     end;
-%% The prefered authentication method failed try next method 
-userauth(#ssh_msg_userauth_failure{},  
-	 #state{ssh_params = #ssh{role = client} = Ssh0} = State) ->
-    case ssh_auth:userauth_request_msg(Ssh0) of
-	{disconnect,  DisconnectMsg,{Msg, Ssh}} ->
-	    send_msg(Msg, State),
-	    handle_disconnect(DisconnectMsg, State#state{ssh_params = Ssh}); 
-	{Msg, Ssh} ->	  
-	    send_msg(Msg, State),
-	    {next_state, userauth, next_packet(State#state{ssh_params = Ssh})}
+
+%%---- banner to client
+handle_event(_, #ssh_msg_userauth_banner{message = Msg}, {userauth,client}, D) ->
+    case D#data.ssh_params#ssh.userauth_quiet_mode of
+	false -> io:format("~s", [Msg]);
+	true -> ok
+    end,
+    keep_state_and_data;
+
+
+%%% ######## {userauth_keyboard_interactive, client|server}
+
+handle_event(_, #ssh_msg_userauth_info_request{} = Msg, {userauth_keyboard_interactive, client},
+	     #data{ssh_params = Ssh0} = D) ->
+    {ok, {Reply, Ssh}} = ssh_auth:handle_userauth_info_request(Msg, Ssh0#ssh.io_cb, Ssh0),
+    send_bytes(Reply, D),
+    {next_state, {userauth_keyboard_interactive_info_response,client}, D#data{ssh_params = Ssh}};
+
+handle_event(_, #ssh_msg_userauth_info_response{} = Msg, {userauth_keyboard_interactive, server}, D) ->
+    case ssh_auth:handle_userauth_info_response(Msg, D#data.ssh_params) of
+	{authorized, User, {Reply, Ssh}} ->
+	    send_bytes(Reply, D),
+	    D#data.starter ! ssh_connected,
+	    connected_fun(User, "keyboard-interactive", D),
+	    {next_state, {connected,server}, D#data{auth_user = User,
+						    ssh_params = Ssh#ssh{authenticated = true}}};
+	{not_authorized, {User, Reason}, {Reply, Ssh}} ->
+	    retry_fun(User, Reason, D),
+	    send_bytes(Reply, D),
+	    {next_state, {userauth,server}, D#data{ssh_params = Ssh}}
     end;
 
-userauth(#ssh_msg_userauth_banner{}, 
-	 #state{ssh_params = #ssh{userauth_quiet_mode = true, 
-				  role = client}} = State) ->
-    {next_state, userauth, next_packet(State)};
-userauth(#ssh_msg_userauth_banner{message = Msg}, 
-	 #state{ssh_params = 
-		#ssh{userauth_quiet_mode = false, role = client}} = State) ->
-    io:format("~s", [Msg]),
-    {next_state, userauth, next_packet(State)}.
-
-connected({#ssh_msg_kexinit{}, _Payload} = Event, State) ->
-    kexinit(Event, State#state{renegotiate = true});
-connected({#ssh_msg_kexdh_init{}, _Payload} = Event, State) ->
-    key_exchange(Event, State#state{renegotiate = true}).
+handle_event(_, Msg = #ssh_msg_userauth_failure{}, {userauth_keyboard_interactive, client},
+	     #data{ssh_params = Ssh0} = D0) ->
+    Prefs = [{Method,M,F,A} || {Method,M,F,A} <- Ssh0#ssh.userauth_preference,
+			       Method =/= "keyboard-interactive"],
+    D = D0#data{ssh_params = Ssh0#ssh{userauth_preference=Prefs}},
+    {next_state, {userauth,client}, D, [{next_event, internal, Msg}]};
 
-%%--------------------------------------------------------------------
-%% Function: 
-%% handle_event(Event, StateName, State) -> {next_state, NextStateName, 
-%%						  NextState} |
-%%                                          {next_state, NextStateName, 
-%%					          NextState, Timeout} |
-%%                                          {stop, Reason, NewState}
-%% Description: Whenever a gen_fsm receives an event sent using
-%% gen_fsm:send_all_state_event/2, this function is called to handle
-%% the event.
-%%--------------------------------------------------------------------
-handle_event({send, Data}, StateName, #state{ssh_params = Ssh0} = State) ->
-    {Packet, Ssh} = ssh_transport:pack(Data, Ssh0),
-    send_msg(Packet, State),
-    {next_state, StateName, next_packet(State#state{ssh_params = Ssh})};
-
-handle_event(#ssh_msg_disconnect{} = Msg, _StateName, 
-	     #state{manager = Pid} = State) ->
-    (catch ssh_connection_manager:event(Pid, Msg)),
-    {stop, normal, State};
-
-handle_event(#ssh_msg_ignore{}, StateName, State) ->
-    {next_state, StateName, next_packet(State)};
-
-handle_event(#ssh_msg_debug{always_display = true, message = DbgMsg}, 
-	     StateName, State) ->
-    io:format("DEBUG: ~p\n", [DbgMsg]),
-    {next_state, StateName, next_packet(State)};
-
-handle_event(#ssh_msg_debug{}, StateName, State) ->
-    {next_state, StateName, next_packet(State)};
-
-handle_event(#ssh_msg_unimplemented{}, StateName, State) ->
-    {next_state, StateName, next_packet(State)};
-
-handle_event(renegotiate, connected, #state{ssh_params = Ssh0} 
-	     = State) ->
-    {KeyInitMsg, SshPacket, Ssh} = ssh_transport:key_exchange_init_msg(Ssh0),
-    send_msg(SshPacket, State),
-    {next_state, connected, 
-     next_packet(State#state{ssh_params = Ssh,
-			     key_exchange_init_msg = KeyInitMsg,
-			     renegotiate = true})};
-
-handle_event(renegotiate, StateName, State) ->
-    %% Allready in keyexcahange so ignore
-    {next_state, StateName, State};
-
-handle_event({info, From, Options}, StateName,  #state{ssh_params = Ssh} = State) ->
-    spawn(?MODULE, ssh_info_handler, [Options, Ssh, From]), 
-    {next_state, StateName, State};
-handle_event(data_size, connected, #state{ssh_params = Ssh0} = State) ->
-    {ok, [{send_oct,Sent}]} = inet:getstat(State#state.socket, [send_oct]),
-    MaxSent = proplists:get_value(rekey_limit, State#state.opts, 1024000000),
+handle_event(_, Msg=#ssh_msg_userauth_failure{}, {userauth_keyboard_interactive_info_response, client}, D) ->
+    {next_state, {userauth,client}, D, [{next_event, internal, Msg}]};
+
+handle_event(_, Msg=#ssh_msg_userauth_success{}, {userauth_keyboard_interactive_info_response, client}, D) ->
+    {next_state, {userauth,client}, D, [{next_event, internal, Msg}]};
+
+handle_event(_, Msg=#ssh_msg_userauth_info_request{}, {userauth_keyboard_interactive_info_response, client}, D) ->
+    {next_state, {userauth_keyboard_interactive,client}, D, [{next_event, internal, Msg}]};
+
+
+%%% ######## {connected, client|server} ####
+
+handle_event(_, {#ssh_msg_kexinit{},_} = Event, {connected,Role}, D0) ->
+    {KeyInitMsg, SshPacket, Ssh} = ssh_transport:key_exchange_init_msg(D0#data.ssh_params),
+    D = D0#data{ssh_params = Ssh,
+		key_exchange_init_msg = KeyInitMsg},
+    send_bytes(SshPacket, D),
+    {next_state, {kexinit,Role,renegotiate}, D, [{next_event, internal, Event}]};
+
+handle_event(_, #ssh_msg_disconnect{description=Desc} = Msg, StateName, D0) ->
+    {disconnect, _, {{replies,Replies}, _}} =
+	ssh_connection:handle_msg(Msg, D0#data.connection_state, role(StateName)),
+    {Actions,D} = send_replies(Replies, D0),
+    disconnect_fun(Desc, D),
+    {stop_and_reply, {shutdown,Desc}, Actions, D};
+
+handle_event(_, #ssh_msg_ignore{}, _, _) ->
+    keep_state_and_data;
+
+handle_event(_, #ssh_msg_unimplemented{}, _, _) ->
+    keep_state_and_data;
+
+handle_event(_, #ssh_msg_debug{} = Msg, _, D) ->
+    debug_fun(Msg, D),
+    keep_state_and_data;
+
+handle_event(internal, Msg=#ssh_msg_global_request{},            StateName, D) ->
+    handle_connection_msg(Msg, StateName, D);
+
+handle_event(internal, Msg=#ssh_msg_request_success{},           StateName, D) ->
+    handle_connection_msg(Msg, StateName, D);
+
+handle_event(internal, Msg=#ssh_msg_request_failure{},           StateName, D) ->
+    handle_connection_msg(Msg, StateName, D);
+
+handle_event(internal, Msg=#ssh_msg_channel_open{},              StateName, D) ->
+    handle_connection_msg(Msg, StateName, D);
+
+handle_event(internal, Msg=#ssh_msg_channel_open_confirmation{}, StateName, D) ->
+    handle_connection_msg(Msg, StateName, D);
+
+handle_event(internal, Msg=#ssh_msg_channel_open_failure{},      StateName, D) ->
+    handle_connection_msg(Msg, StateName, D);
+
+handle_event(internal, Msg=#ssh_msg_channel_window_adjust{},     StateName, D) ->
+    handle_connection_msg(Msg, StateName, D);
+
+handle_event(internal, Msg=#ssh_msg_channel_data{},              StateName, D) ->
+    handle_connection_msg(Msg, StateName, D);
+
+handle_event(internal, Msg=#ssh_msg_channel_extended_data{},     StateName, D) ->
+    handle_connection_msg(Msg, StateName, D);
+
+handle_event(internal, Msg=#ssh_msg_channel_eof{},               StateName, D) ->
+    handle_connection_msg(Msg, StateName, D);
+
+handle_event(internal, Msg=#ssh_msg_channel_close{},             StateName, D) ->
+    handle_connection_msg(Msg, StateName, D);
+
+handle_event(internal, Msg=#ssh_msg_channel_request{},           StateName, D) ->
+    handle_connection_msg(Msg, StateName, D);
+
+handle_event(internal, Msg=#ssh_msg_channel_success{},           StateName, D) ->
+    handle_connection_msg(Msg, StateName, D);
+
+handle_event(internal, Msg=#ssh_msg_channel_failure{},           StateName, D) ->
+    handle_connection_msg(Msg, StateName, D);
+
+
+handle_event(cast, renegotiate, {connected,Role}, D) ->
+    {KeyInitMsg, SshPacket, Ssh} = ssh_transport:key_exchange_init_msg(D#data.ssh_params),
+    send_bytes(SshPacket, D),
+    timer:apply_after(?REKEY_TIMOUT, gen_statem, cast, [self(), renegotiate]),
+    {next_state, {kexinit,Role,renegotiate}, D#data{ssh_params = Ssh,
+						    key_exchange_init_msg = KeyInitMsg}};
+
+handle_event(cast, renegotiate, _, _) ->
+    %% Already in key-exchange so safe to ignore
+    timer:apply_after(?REKEY_TIMOUT, gen_statem, cast, [self(), renegotiate]), % FIXME: not here in original
+    keep_state_and_data;
+
+
+%% Rekey due to sent data limit reached?
+handle_event(cast, data_size, {connected,Role}, D) ->
+    {ok, [{send_oct,Sent0}]} = inet:getstat(D#data.socket, [send_oct]),
+    Sent = Sent0 - D#data.last_size_rekey,
+    MaxSent = proplists:get_value(rekey_limit, D#data.opts, 1024000000),
+    timer:apply_after(?REKEY_DATA_TIMOUT, gen_statem, cast, [self(), data_size]),
     case Sent >= MaxSent of
 	true ->
-	    {KeyInitMsg, SshPacket, Ssh} = ssh_transport:key_exchange_init_msg(Ssh0),
-	    send_msg(SshPacket, State),
-	    {next_state, connected, 
-	     next_packet(State#state{ssh_params = Ssh,
-				     key_exchange_init_msg = KeyInitMsg,
-				     renegotiate = true})};
+	    {KeyInitMsg, SshPacket, Ssh} =
+		ssh_transport:key_exchange_init_msg(D#data.ssh_params),
+	    send_bytes(SshPacket, D),
+	    {next_state, {kexinit,Role,renegotiate}, D#data{ssh_params = Ssh,
+							    key_exchange_init_msg = KeyInitMsg,
+							    last_size_rekey = Sent0}};
 	_ ->
-	    {next_state, connected, next_packet(State)}
+	    keep_state_and_data
+    end;
+
+handle_event(cast, data_size, _, _) ->
+    %% Already in key-exchange so safe to ignore
+    timer:apply_after(?REKEY_DATA_TIMOUT, gen_statem, cast, [self(), data_size]),  % FIXME: not here in original
+    keep_state_and_data;
+
+
+
+handle_event(cast, _, StateName, _) when StateName /= {connected,server},
+					 StateName /= {connected,client} ->
+    {keep_state_and_data, [postpone]};
+
+
+handle_event(cast, {adjust_window,ChannelId,Bytes}, {connected,_}, D) ->
+    case ssh_channel:cache_lookup(cache(D), ChannelId) of
+	#channel{recv_window_size = WinSize,
+		 recv_window_pending = Pending,
+		 recv_packet_size = PktSize} = Channel
+	  when (WinSize-Bytes) >= 2*PktSize ->
+	    %% The peer can send at least two more *full* packet, no hurry.
+	    ssh_channel:cache_update(cache(D),
+				     Channel#channel{recv_window_pending = Pending + Bytes}),
+	    keep_state_and_data;
+
+	#channel{recv_window_size = WinSize,
+		 recv_window_pending = Pending,
+		 remote_id = Id} = Channel ->
+	    %% Now we have to update the window - we can't receive so many more pkts
+	    ssh_channel:cache_update(cache(D),
+				     Channel#channel{recv_window_size =
+							 WinSize + Bytes + Pending,
+						     recv_window_pending = 0}),
+	    Msg = ssh_connection:channel_adjust_window_msg(Id, Bytes + Pending),
+	    {keep_state, send_msg(Msg,D)};
+
+	undefined ->
+	    keep_state_and_data
     end;
-handle_event(data_size, StateName, State) ->
-    {next_state, StateName, State};
-handle_event({unknown, Data}, StateName, State) ->
+
+handle_event(cast, {reply_request,success,ChannelId}, {connected,_}, D) ->
+    case ssh_channel:cache_lookup(cache(D), ChannelId) of
+	#channel{remote_id = RemoteId} ->
+	    Msg = ssh_connection:channel_success_msg(RemoteId),
+	    {keep_state, send_msg(Msg,D)};
+
+	undefined ->
+	    keep_state_and_data
+    end;
+
+handle_event(cast, {request,ChannelPid, ChannelId, Type, Data}, {connected,_}, D) ->
+    {keep_state,  handle_request(ChannelPid, ChannelId, Type, Data, false, none, D)};
+
+handle_event(cast, {request,ChannelId,Type,Data}, {connected,_}, D) ->
+    {keep_state,  handle_request(ChannelId, Type, Data, false, none, D)};
+
+handle_event(cast, {unknown,Data}, {connected,_}, D) ->
     Msg = #ssh_msg_unimplemented{sequence = Data},
-    send_msg(Msg, State),
-    {next_state, StateName, next_packet(State)}.
-%%--------------------------------------------------------------------
-%% Function: 
-%% handle_sync_event(Event, From, StateName, 
-%%                   State) -> {next_state, NextStateName, NextState} |
-%%                             {next_state, NextStateName, NextState, 
-%%                              Timeout} |
-%%                             {reply, Reply, NextStateName, NextState}|
-%%                             {reply, Reply, NextStateName, NextState, 
-%%                              Timeout} |
-%%                             {stop, Reason, NewState} |
-%%                             {stop, Reason, Reply, NewState}
-%% Description: Whenever a gen_fsm receives an event sent using
-%% gen_fsm:sync_send_all_state_event/2,3, this function is called to handle
-%% the event.
-%%--------------------------------------------------------------------
+    {keep_state, send_msg(Msg,D)};
+
+%%% Previously handle_sync_event began here
+handle_event({call,From}, get_print_info, StateName, D) ->
+    Reply =
+	try
+	    {inet:sockname(D#data.socket),
+	     inet:peername(D#data.socket)
+	    }
+	of
+	    {{ok,Local}, {ok,Remote}} -> 
+		{{Local,Remote},io_lib:format("statename=~p",[StateName])};
+	    _ ->
+		{{"-",0},"-"}
+	catch
+	    _:_ ->
+		{{"?",0},"?"}
+	end,
+    {keep_state_and_data, [{reply,From,Reply}]};
+
+handle_event({call,From}, {connection_info, Options}, _, D) ->
+    Info = ssh_info(Options, D, []),
+    {keep_state_and_data, [{reply,From,Info}]};
+
+handle_event({call,From}, {channel_info,ChannelId,Options}, _, D) ->
+    case ssh_channel:cache_lookup(cache(D), ChannelId) of
+	#channel{} = Channel ->
+	    Info = ssh_channel_info(Options, Channel, []),
+	    {keep_state_and_data, [{reply,From,Info}]};
+	undefined ->
+	    {keep_state_and_data, [{reply,From,[]}]}
+    end;
 
-%% Replaced with option to connection_info/3. For now keep 
-%% for backwards compatibility
-handle_sync_event(peer_address, _From, StateName, 
-		  #state{ssh_params = #ssh{peer = {_, Address}}} = State) ->
-    {reply, {ok, Address}, StateName, State}.
 
-%%--------------------------------------------------------------------
-%% Function: 
-%% handle_info(Info,StateName,State)-> {next_state, NextStateName, NextState}|
-%%                                     {next_state, NextStateName, NextState, 
-%%                                       Timeout} |
-%%                                     {stop, Reason, NewState}
-%% Description: This function is called by a gen_fsm when it receives any
-%% other message than a synchronous or asynchronous event
-%% (or a system message).
-%%--------------------------------------------------------------------
-handle_info({Protocol, Socket, "SSH-" ++ _ = Version}, hello, 
-	    #state{socket = Socket,
-		   transport_protocol = Protocol} = State ) -> 
-    event({version_exchange, Version}, hello, State);
-
-handle_info({Protocol, Socket, Info}, hello, 
-	    #state{socket = Socket,
-		   transport_protocol = Protocol} = State) -> 
-    event({info_line, Info}, hello, State);
-
-handle_info({Protocol, Socket, Data}, Statename, 
-	    #state{socket = Socket,
-		   transport_protocol = Protocol,
-		   ssh_params = #ssh{decrypt_block_size = BlockSize,
-				     recv_mac_size = MacSize} = Ssh0,
-		   decoded_data_buffer = <<>>,
-		   encoded_data_buffer = EncData0} = State0) ->
-
-    %% Implementations SHOULD decrypt the length after receiving the
-    %% first 8 (or cipher block size, whichever is larger) bytes of a
-    %% packet. (RFC 4253: Section 6 - Binary Packet Protocol)
-    case size(EncData0) + size(Data) >= erlang:max(8, BlockSize) of
+handle_event({call,From}, {info, all}, _, D) ->
+    Result = ssh_channel:cache_foldl(fun(Channel, Acc) ->
+					     [Channel | Acc]
+				     end,
+				     [], cache(D)),
+    {keep_state_and_data, [{reply, From, {ok,Result}}]};
+    
+handle_event({call,From}, {info, ChannelPid}, _, D) ->
+    Result = ssh_channel:cache_foldl(
+	       fun(Channel, Acc) when Channel#channel.user == ChannelPid ->
+		       [Channel | Acc];
+		  (_, Acc) ->
+		       Acc
+	       end, [], cache(D)),
+    {keep_state_and_data, [{reply, From, {ok,Result}}]};
+
+handle_event({call,From}, stop, StateName, D0) ->
+    {disconnect, _Reason, {{replies, Replies}, Connection}} =
+	ssh_connection:handle_msg(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_BY_APPLICATION,
+						      description = "User closed down connection"},
+				  D0#data.connection_state,
+				  role(StateName)),
+    {Repls,D} = send_replies(Replies, D0),
+    {stop_and_reply, normal, [{reply,From,ok}|Repls], D#data{connection_state=Connection}};
+
+handle_event({call,_}, _, StateName, _) when StateName /= {connected,server},
+					     StateName /= {connected,client}  ->
+    {keep_state_and_data, [postpone]};
+
+handle_event({call,From}, {request, ChannelPid, ChannelId, Type, Data, Timeout}, {connected,_}, D0) ->
+    D = handle_request(ChannelPid, ChannelId, Type, Data, true, From, D0),
+    %% Note reply to channel will happen later when reply is recived from peer on the socket
+    start_channel_request_timer(ChannelId, From, Timeout),
+    {keep_state, cache_request_idle_timer_check(D)};
+
+handle_event({call,From}, {request, ChannelId, Type, Data, Timeout}, {connected,_}, D0) ->
+    D = handle_request(ChannelId, Type, Data, true, From, D0),
+    %% Note reply to channel will happen later when reply is recived from peer on the socket
+    start_channel_request_timer(ChannelId, From, Timeout),
+    {keep_state, cache_request_idle_timer_check(D)};
+
+handle_event({call,From}, {data, ChannelId, Type, Data, Timeout}, {connected,_}, D0) ->
+    {{replies, Replies}, Connection} =
+	ssh_connection:channel_data(ChannelId, Type, Data, D0#data.connection_state, From),
+    {Repls,D} = send_replies(Replies, D0#data{connection_state = Connection}),
+    start_channel_request_timer(ChannelId, From, Timeout), % FIXME: No message exchange so why?
+    {keep_state, D, Repls};
+
+handle_event({call,From}, {eof, ChannelId}, {connected,_}, D0) ->
+    case ssh_channel:cache_lookup(cache(D0), ChannelId) of
+	#channel{remote_id = Id, sent_close = false} ->
+	    D = send_msg(ssh_connection:channel_eof_msg(Id), D0),
+	    {keep_state, D, [{reply,From,ok}]};
+	_ ->
+	    {keep_state, D0, [{reply,From,{error,closed}}]}
+    end;
+
+handle_event({call,From},
+	     {open, ChannelPid, Type, InitialWindowSize, MaxPacketSize, Data, Timeout},
+	     {connected,_},
+	     D0) ->
+    erlang:monitor(process, ChannelPid),
+    {ChannelId, D1} = new_channel_id(D0),
+    D2 = send_msg(ssh_connection:channel_open_msg(Type, ChannelId,
+						  InitialWindowSize,
+						  MaxPacketSize, Data),
+		  D1),
+    ssh_channel:cache_update(cache(D2), 
+			     #channel{type = Type,
+				      sys = "none",
+				      user = ChannelPid,
+				      local_id = ChannelId,
+				      recv_window_size = InitialWindowSize,
+				      recv_packet_size = MaxPacketSize,
+				      send_buf = queue:new()
+				     }),
+    D = add_request(true, ChannelId, From, D2),
+    start_channel_request_timer(ChannelId, From, Timeout),
+    {keep_state, cache_cancel_idle_timer(D)};
+
+handle_event({call,From}, {send_window, ChannelId}, {connected,_}, D) ->
+    Reply = case ssh_channel:cache_lookup(cache(D), ChannelId) of
+		#channel{send_window_size = WinSize,
+			 send_packet_size = Packsize} ->
+		    {ok, {WinSize, Packsize}};
+		undefined ->
+		    {error, einval}
+	    end,
+    {keep_state_and_data, [{reply,From,Reply}]};
+
+handle_event({call,From}, {recv_window, ChannelId}, {connected,_}, D) ->
+    Reply = case ssh_channel:cache_lookup(cache(D), ChannelId) of
+		#channel{recv_window_size = WinSize,
+			 recv_packet_size = Packsize} ->
+		    {ok, {WinSize, Packsize}};
+		undefined ->
+		    {error, einval}
+	    end,
+    {keep_state_and_data, [{reply,From,Reply}]};
+
+handle_event({call,From}, {close, ChannelId}, {connected,_}, D0) ->
+    case ssh_channel:cache_lookup(cache(D0), ChannelId) of
+	#channel{remote_id = Id} = Channel ->
+	    D1 = send_msg(ssh_connection:channel_close_msg(Id), D0),
+	    ssh_channel:cache_update(cache(D1), Channel#channel{sent_close = true}),
+	    {keep_state, cache_request_idle_timer_check(D1), [{reply,From,ok}]};
+	undefined ->
+	    {keep_state_and_data, [{reply,From,ok}]}
+    end;
+
+
+%%===== Reception of encrypted bytes, decryption and framing
+handle_event(info, {Proto, Sock, Info}, {hello,_}, #data{socket = Sock,
+							 transport_protocol = Proto}) ->
+    case Info of
+	"SSH-" ++ _ ->  
+	    {keep_state_and_data, [{next_event, internal, {version_exchange,Info}}]};
+	_ ->
+	    {keep_state_and_data, [{next_event, internal, {info_line,Info}}]}
+    end;
+
+handle_event(info, {Proto, Sock, NewData}, StateName, D0 = #data{socket = Sock,
+								 transport_protocol = Proto}) ->
+    try ssh_transport:handle_packet_part(
+	  D0#data.decrypted_data_buffer,
+	  <<(D0#data.encrypted_data_buffer)/binary, NewData/binary>>,
+	  D0#data.undecrypted_packet_length,
+	  D0#data.ssh_params)
+    of
+	{packet_decrypted, DecryptedBytes, EncryptedDataRest, Ssh1} ->
+	    D = D0#data{ssh_params =
+			    Ssh1#ssh{recv_sequence = ssh_transport:next_seqnum(Ssh1#ssh.recv_sequence)},
+			decrypted_data_buffer = <<>>,
+			undecrypted_packet_length = undefined,
+			encrypted_data_buffer = EncryptedDataRest},
+	    try
+		ssh_message:decode(set_kex_overload_prefix(DecryptedBytes,D))
+	    of
+		Msg = #ssh_msg_kexinit{} ->
+		    {keep_state, D, [{next_event, internal, {Msg,DecryptedBytes}},
+				     {next_event, internal, prepare_next_packet}
+				    ]};
+		Msg ->
+		    {keep_state, D, [{next_event, internal, Msg},
+				     {next_event, internal, prepare_next_packet}
+				    ]}
+	    catch
+		_C:_E  ->
+		    disconnect(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_PROTOCOL_ERROR,
+						   description = "Encountered unexpected input"},
+			       StateName, D)
+	    end;
+
+	{get_more, DecryptedBytes, EncryptedDataRest, RemainingSshPacketLen, Ssh1} ->
+	    %% Here we know that there are not enough bytes in
+	    %% EncryptedDataRest to use. We must wait for more.
+	    inet:setopts(Sock, [{active, once}]),
+	    {keep_state, D0#data{encrypted_data_buffer = EncryptedDataRest,
+				 decrypted_data_buffer = DecryptedBytes,
+				 undecrypted_packet_length = RemainingSshPacketLen,
+				 ssh_params = Ssh1}};
+
+	{bad_mac, Ssh1} ->
+	    disconnect(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_PROTOCOL_ERROR,
+					   description = "Bad mac"},
+		       StateName, D0#data{ssh_params=Ssh1});
+
+	{error, {exceeds_max_size,PacketLen}} ->
+	    disconnect(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_PROTOCOL_ERROR,
+					   description = "Bad packet length "
+					   ++ integer_to_list(PacketLen)},
+		       StateName, D0)
+    catch
+	_C:_E ->
+	    disconnect(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_PROTOCOL_ERROR,
+					   description = "Bad packet"},
+		       StateName, D0)
+    end;
+
+
+%%%==== 
+handle_event(internal, prepare_next_packet, _, D) ->
+    Enough =  erlang:max(8, D#data.ssh_params#ssh.decrypt_block_size),
+    case size(D#data.encrypted_data_buffer) of
+	Sz when Sz >= Enough ->
+	    self() ! {D#data.transport_protocol, D#data.socket, <<>>};
+	_ ->
+	    inet:setopts(D#data.socket, [{active, once}])
+    end,
+    keep_state_and_data;
+
+handle_event(info, {CloseTag,Socket}, StateName,
+	     D = #data{socket = Socket,
+		       transport_close_tag = CloseTag}) ->
+    disconnect(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_BY_APPLICATION,
+				   description = "Connection closed"},
+	       StateName, D);
+
+handle_event(info, {timeout, {_, From} = Request}, _,
+	     #data{connection_state = #connection{requests = Requests} = C0} = D) ->
+    case lists:member(Request, Requests) of
 	true ->
-	    {Ssh, SshPacketLen, DecData, EncData} = 
-
-		ssh_transport:decrypt_first_block(<<EncData0/binary, 
-						   Data/binary>>, Ssh0),
-	     case SshPacketLen > ?SSH_MAX_PACKET_SIZE of
- 		true ->
-  		    DisconnectMsg = 
-  			#ssh_msg_disconnect{code = 
-					    ?SSH_DISCONNECT_PROTOCOL_ERROR,
-  					    description = "Bad packet length " 
-					    ++ integer_to_list(SshPacketLen),
-  					    language = "en"},
-  		    handle_disconnect(DisconnectMsg, State0);
-  		false ->
-		    RemainingSshPacketLen = 
-			(SshPacketLen + ?SSH_LENGHT_INDICATOR_SIZE) - 
-			BlockSize + MacSize,
-		    State = State0#state{ssh_params = Ssh},
-		    handle_ssh_packet_data(RemainingSshPacketLen, 
-					   DecData, EncData, Statename,
-					   State)
-	     end;
-	false  ->
-	    {next_state, Statename, 
-	     next_packet(State0#state{encoded_data_buffer = 
-				      <<EncData0/binary, Data/binary>>})}
+	    %% A channel request is not answered in time. Answer {error,timeout}
+	    %% to the caller
+	    C = C0#connection{requests = lists:delete(Request, Requests)},
+	    {keep_state, D#data{connection_state=C}, [{reply,From,{error,timeout}}]};
+	false ->
+	    %% The request is answered - just ignore the timeout
+	    keep_state_and_data
     end;
 
-handle_info({Protocol, Socket, Data}, Statename, 
-	    #state{socket = Socket,
-		   transport_protocol = Protocol,
-		   decoded_data_buffer = DecData, 
-		   encoded_data_buffer = EncData,
-		   undecoded_packet_length = Len} = 
-	    State) when is_integer(Len) ->
-    handle_ssh_packet_data(Len, DecData, <<EncData/binary, Data/binary>>, 
-			   Statename, State);
-
-handle_info({CloseTag, _Socket}, _StateName, 
-	    #state{transport_close_tag = CloseTag,
-		   ssh_params = #ssh{role = _Role, opts = _Opts}} = State) ->
-    DisconnectMsg =
-	#ssh_msg_disconnect{code = ?SSH_DISCONNECT_CONNECTION_LOST,
-			    description = "Connection Lost",
-			    language = "en"},
-    {stop, {shutdown, DisconnectMsg}, State};
+%%% Handle that ssh channels user process goes down
+handle_event(info, {'DOWN', _Ref, process, ChannelPid, _Reason}, _, D0) ->
+    {{replies, Replies}, D1} = handle_channel_down(ChannelPid, D0),
+    {Repls, D} = send_replies(Replies, D1),
+    {keep_state, D, Repls};
 
 %%% So that terminate will be run when supervisor is shutdown
-handle_info({'EXIT', _Sup, Reason}, _StateName, State) ->
-    {stop, Reason, State};
-
-handle_info(UnexpectedMessage, StateName, #state{ssh_params = SshParams} = State) ->
-    Msg = lists:flatten(io_lib:format(
-           "Unexpected message '~p' received in state '~p'\n"
-           "Role: ~p\n"
-           "Peer: ~p\n"
-           "Local Address: ~p\n", [UnexpectedMessage, StateName,
-               SshParams#ssh.role, SshParams#ssh.peer,
-               proplists:get_value(address, SshParams#ssh.opts)])),
-    error_logger:info_report(Msg),
-    {next_state, StateName, State}.
+handle_event(info, {'EXIT', _Sup, Reason}, _, _) ->
+    {stop, {shutdown, Reason}};
+
+handle_event(info, check_cache, _, D) ->
+    {keep_state, cache_check_set_idle_timer(D)};
+
+handle_event(info, UnexpectedMessage, StateName, D = #data{ssh_params = Ssh}) ->
+    case unexpected_fun(UnexpectedMessage, D) of
+	report ->
+	    Msg = lists:flatten(
+		    io_lib:format(
+		      "Unexpected message '~p' received in state '~p'\n"
+		      "Role: ~p\n"
+		      "Peer: ~p\n"
+		      "Local Address: ~p\n", [UnexpectedMessage,
+					      StateName,
+					      Ssh#ssh.role, 
+					      Ssh#ssh.peer,
+					      proplists:get_value(address, Ssh#ssh.opts)])),
+	    error_logger:info_report(Msg),
+	    keep_state_and_data;
+
+	skip ->
+	    keep_state_and_data;
+
+	Other ->
+	    Msg = lists:flatten(
+		    io_lib:format("Call to fun in 'unexpectedfun' failed:~n"
+				  "Return: ~p\n"
+				  "Message: ~p\n"
+				  "Role: ~p\n"
+				  "Peer: ~p\n"
+				  "Local Address: ~p\n", [Other,
+							  UnexpectedMessage,
+							  Ssh#ssh.role,
+							  element(2,Ssh#ssh.peer),
+							  proplists:get_value(address, Ssh#ssh.opts)]
+				 )),
+	    error_logger:error_report(Msg),
+	    keep_state_and_data
+    end;
+
+handle_event(internal, {disconnect,Msg,_Reason}, StateName, D) ->
+    disconnect(Msg, StateName, D);
+
+handle_event(Type, Ev, StateName, D) ->
+    Descr =
+	case catch atom_to_list(element(1,Ev)) of
+	    "ssh_msg_" ++_ when Type==internal ->
+		"Message in wrong state";
+	    _ ->
+		"Internal error"
+	end,
+    disconnect(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_PROTOCOL_ERROR,
+				   description = Descr},
+	       StateName, D).
+
 
 %%--------------------------------------------------------------------
-%% Function: terminate(Reason, StateName, State) -> void()
-%% Description:This function is called by a gen_fsm when it is about
-%% to terminate. It should be the opposite of Module:init/1 and do any
-%% necessary cleaning up. When it returns, the gen_fsm terminates with
-%% Reason. The return value is ignored.
-%%--------------------------------------------------------------------
-terminate(normal, _, #state{transport_cb = Transport,
-			    socket = Socket,
-			    manager = Pid}) ->
-    (catch ssh_userreg:delete_user(Pid)),
-    (catch Transport:close(Socket)),
-    ok;
+-spec terminate(any(),
+		state_name(),
+		#data{}
+	       ) -> finalize_termination_result() .
+			
+%% . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
+
+terminate(normal, StateName, State) ->
+    finalize_termination(StateName, State);
+
+terminate({shutdown,{init,Reason}}, StateName, State) ->
+    error_logger:info_report(io_lib:format("Erlang ssh in connection handler init: ~p~n",[Reason])),
+    finalize_termination(StateName, State);
+
+terminate(shutdown, StateName, State0) ->
+    %% Terminated by supervisor
+    State = send_msg(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_BY_APPLICATION,
+					 description = "Application shutdown"},
+		     State0),
+timer:sleep(400),  %% FIXME!!! gen_tcp:shutdown instead
+    finalize_termination(StateName, State);
+
+%% terminate({shutdown,Msg}, StateName, State0) when is_record(Msg,ssh_msg_disconnect)->
+%%     State = send_msg(Msg, State0),
+%% timer:sleep(400),  %% FIXME!!! gen_tcp:shutdown instead
+%%     finalize_termination(StateName, Msg, State);
 
-%% Terminated as manager terminated
-terminate(shutdown, StateName, #state{ssh_params = Ssh0} = State) ->
-    DisconnectMsg = 
-	#ssh_msg_disconnect{code = ?SSH_DISCONNECT_BY_APPLICATION,
-			    description = "Application shutdown",
-			    language = "en"},
-    {SshPacket, Ssh} = ssh_transport:ssh_packet(DisconnectMsg, Ssh0),
-    send_msg(SshPacket, State),
-    terminate(normal, StateName, State#state{ssh_params = Ssh});
-
-terminate({shutdown, #ssh_msg_disconnect{} = Msg}, StateName, #state{ssh_params = Ssh0, manager = Pid} = State) ->
-    {SshPacket, Ssh} = ssh_transport:ssh_packet(Msg, Ssh0),
-    send_msg(SshPacket, State),
-    ssh_connection_manager:event(Pid, Msg),
-    terminate(normal, StateName, State#state{ssh_params = Ssh});
-terminate({shutdown, {#ssh_msg_disconnect{} = Msg, ErrorMsg}}, StateName, #state{ssh_params = Ssh0, manager = Pid} = State) ->
-    {SshPacket, Ssh} = ssh_transport:ssh_packet(Msg, Ssh0),
-    send_msg(SshPacket, State),
-    ssh_connection_manager:event(Pid, Msg, ErrorMsg),
-    terminate(normal, StateName, State#state{ssh_params = Ssh});
-terminate(Reason, StateName, #state{ssh_params = Ssh0, manager = Pid} = State) ->
+terminate({shutdown,_R}, StateName, State) ->
+    finalize_termination(StateName, State);
+
+terminate(Reason, StateName, State0) ->
+    %% Others, e.g  undef, {badmatch,_}
     log_error(Reason),
-    DisconnectMsg = 
-	#ssh_msg_disconnect{code = ?SSH_DISCONNECT_BY_APPLICATION,
-			    description = "Internal error",
-			    language = "en"},
-    {SshPacket, Ssh} = ssh_transport:ssh_packet(DisconnectMsg, Ssh0),
-    ssh_connection_manager:event(Pid, DisconnectMsg),
-    send_msg(SshPacket, State),
-    terminate(normal, StateName, State#state{ssh_params = Ssh}).
+    State = send_msg(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_BY_APPLICATION,
+					   description = "Internal error"},
+		     State0),
+    finalize_termination(StateName, State).
 
 %%--------------------------------------------------------------------
-%% Function:
-%% code_change(OldVsn, StateName, State, Extra) -> {ok, StateName, NewState}
-%% Description: Convert process state when code is changed
+
+%% . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
+
+format_status(normal, [_, _StateName, D]) ->
+    [{data, [{"State", D}]}];
+format_status(terminate, [_, _StateName, D]) ->
+    DataPropList0 = fmt_stat_rec(record_info(fields, data), D,
+				 [decrypted_data_buffer,
+				  encrypted_data_buffer,
+				  key_exchange_init_msg,
+				  user_passwords,
+				  opts,
+				  inet_initial_recbuf_size]),
+    SshPropList = fmt_stat_rec(record_info(fields, ssh), D#data.ssh_params,
+			       [c_keyinit,
+				s_keyinit,
+				send_mac_key,
+				send_mac_size,
+				recv_mac_key,
+				recv_mac_size,
+				encrypt_keys,
+				encrypt_ctx,
+				decrypt_keys,
+				decrypt_ctx,
+				compress_ctx,
+				decompress_ctx,
+				shared_secret,
+				exchanged_hash,
+				session_id,
+				keyex_key,
+				keyex_info,
+				available_host_keys]),
+    DataPropList = lists:keyreplace(ssh_params, 1, DataPropList0,
+				    {ssh_params,SshPropList}),
+    [{data, [{"State", DataPropList}]}].
+
+
+fmt_stat_rec(FieldNames, Rec, Exclude) ->
+    Values = tl(tuple_to_list(Rec)),
+    [P || {K,_} = P <- lists:zip(FieldNames, Values),
+	  not lists:member(K, Exclude)].
+
 %%--------------------------------------------------------------------
+-spec code_change(term() | {down,term()},
+		  state_name(),
+		  #data{},
+		  term()
+		 ) -> {gen_statem:callback_mode(), state_name(), #data{}}.
+
+%% . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
+
 code_change(_OldVsn, StateName, State, _Extra) ->
-    {ok, StateName, State}.
+    {handle_event_function, StateName, State}.
+
+
+%%====================================================================
+%% Internal functions
+%%====================================================================
 
 %%--------------------------------------------------------------------
-%%% Internal functions
+%% Starting
+
+start_the_connection_child(UserPid, Role, Socket, Options) ->
+    Sups = proplists:get_value(supervisors, Options),
+    ConnectionSup = proplists:get_value(connection_sup, Sups),
+    Opts = [{supervisors, Sups}, {user_pid, UserPid} | proplists:get_value(ssh_opts, Options, [])],
+    {ok, Pid} = ssh_connection_sup:start_child(ConnectionSup, [Role, Socket, Opts]),
+    ok = socket_control(Socket, Pid, Options),
+    Pid.
+
 %%--------------------------------------------------------------------
-init_ssh(client = Role, Vsn, Version, Options, Socket) ->
-    IOCb = case proplists:get_value(user_interaction, Options, true) of
-	       true -> 
-		   ssh_io;
-	       false -> 
-		   ssh_no_io
-	   end,
+%% Stopping
+-type finalize_termination_result() :: ok .
+
+finalize_termination(_StateName, #data{transport_cb = Transport,
+				       connection_state = Connection,
+				       socket = Socket}) ->
+    case Connection of
+	#connection{system_supervisor = SysSup,
+		    sub_system_supervisor = SubSysSup} when is_pid(SubSysSup) ->
+	    ssh_system_sup:stop_subsystem(SysSup, SubSysSup);
+	_ ->
+	    do_nothing
+    end,
+    (catch Transport:close(Socket)),
+    ok.
 
-    AuthMethods = proplists:get_value(auth_methods, Options, 
-				      ?SUPPORTED_AUTH_METHODS),
-    {ok, PeerAddr} = inet:peername(Socket),
-    
-    PeerName =  proplists:get_value(host, Options),
-    KeyCb =  proplists:get_value(key_cb, Options, ssh_file),
-
-    #ssh{role = Role,
-	 c_vsn = Vsn,
-	 c_version = Version,
-	 key_cb = KeyCb,
-	 io_cb = IOCb,
-	 userauth_quiet_mode = proplists:get_value(quiet_mode, Options, false),
-	 opts = Options,
-	 userauth_supported_methods = AuthMethods,
-	 peer = {PeerName, PeerAddr},
-	 available_host_keys = supported_host_keys(Role, KeyCb, Options)
-	};
-
-init_ssh(server = Role, Vsn, Version, Options, Socket) ->
-
-    AuthMethods = proplists:get_value(auth_methods, Options, 
-				      ?SUPPORTED_AUTH_METHODS),
-    {ok, PeerAddr} = inet:peername(Socket),
-    KeyCb =  proplists:get_value(key_cb, Options, ssh_file),
-
-    #ssh{role = Role,
-	 s_vsn = Vsn,
-	 s_version = Version,
-	 key_cb = KeyCb,
-	 io_cb = proplists:get_value(io_cb, Options, ssh_io),
-	 opts = Options,
-	 userauth_supported_methods = AuthMethods,
-	 peer = {undefined, PeerAddr},
-	 available_host_keys = supported_host_keys(Role, KeyCb, Options)
-	 }.
+%%--------------------------------------------------------------------
+%% "Invert" the Role
+peer_role(client) -> server;
+peer_role(server) -> client.
+
+%%--------------------------------------------------------------------
+%% StateName to Role
+role({_,Role}) -> Role;
+role({_,Role,_}) -> Role.
+
+%%--------------------------------------------------------------------
+%% Check the StateName to see if we are in the renegotiation phase
+renegotiation({_,_,ReNeg}) -> ReNeg == renegotiation;
+renegotiation(_) -> false.
 
+%%--------------------------------------------------------------------
 supported_host_keys(client, _, Options) ->
     try
-	case extract_algs(proplists:get_value(pref_public_key_algs, Options, false), []) of
-	    false ->
-		["ssh-rsa", "ssh-dss"];
-	    Algs ->
-		Algs
+	case proplists:get_value(public_key,
+				 proplists:get_value(preferred_algorithms,Options,[])
+				) of
+	    undefined ->
+		ssh_transport:default_algorithms(public_key);
+	    L ->
+		L -- (L--ssh_transport:default_algorithms(public_key))
 	end
+    of
+	[] ->
+	    {stop, {shutdown, "No public key algs"}};
+	Algs ->
+	    [atom_to_list(A) || A<-Algs]
     catch
 	exit:Reason ->
 	    {stop, {shutdown, Reason}}
     end;
 supported_host_keys(server, KeyCb, Options) ->
-    lists:foldl(fun(Type, Acc) ->
-			case available_host_key(KeyCb, Type, Options) of
-			    {error, _} ->
-				Acc;
-			    Alg ->
-				[Alg | Acc]
-			end
-		end, [],
-		%% Prefered alg last so no need to reverse
-		["ssh-dss", "ssh-rsa"]).
-extract_algs(false, _) ->
-    false;
-extract_algs([],[]) ->
-    false;
-extract_algs([], NewList) ->
-    lists:reverse(NewList);
-extract_algs([H|T], NewList) ->
-    case H of
-	'ssh-dss' ->
-	    extract_algs(T, ["ssh-dss"|NewList]);
-	'ssh-rsa' ->
-	    extract_algs(T, ["ssh-rsa"|NewList])
-    end.
-available_host_key(KeyCb, "ssh-dss"= Alg, Opts) ->
-    case KeyCb:host_key('ssh-dss', Opts) of
-	{ok, _} ->
-	    Alg;
-	Other ->
-	    Other
-    end;
-available_host_key(KeyCb, "ssh-rsa" = Alg, Opts) ->
-    case KeyCb:host_key('ssh-rsa', Opts) of
-	{ok, _} ->
-	    Alg;
-	Other ->
-	    Other
-    end.
+    [atom_to_list(A) || A <- proplists:get_value(public_key,
+						 proplists:get_value(preferred_algorithms,Options,[]),
+						 ssh_transport:default_algorithms(public_key)
+						),
+			available_host_key(KeyCb, A, Options)
+    ].
+
+%% Alg :: atom()
+available_host_key(KeyCb, Alg, Opts) ->
+    element(1, catch KeyCb:host_key(Alg, Opts)) == ok.
+
+
+send_msg(Msg, State=#data{ssh_params=Ssh0}) when is_tuple(Msg) ->
+    {Bytes, Ssh} = ssh_transport:ssh_packet(Msg, Ssh0),
+    send_bytes(Bytes, State),
+    State#data{ssh_params=Ssh}.
 
-send_msg(Msg, #state{socket = Socket, transport_cb = Transport}) ->
-    Transport:send(Socket, Msg).
+send_bytes(Bytes, #data{socket = Socket, transport_cb = Transport}) ->
+    Transport:send(Socket, Bytes).
 
-handle_version({2, 0} = NumVsn, StrVsn, Ssh0) -> 
+handle_version({2, 0} = NumVsn, StrVsn, Ssh0) ->
     Ssh = counterpart_versions(NumVsn, StrVsn, Ssh0),
     {ok, Ssh};
 handle_version(_,_,_) ->
@@ -837,215 +1489,403 @@ string_version(#ssh{role = client, c_version = Vsn}) ->
 string_version(#ssh{role = server, s_version = Vsn}) ->
     Vsn.
 
-send_event(FsmPid, Event) ->
-    gen_fsm:send_event(FsmPid, Event).
-
-send_all_state_event(FsmPid, Event) ->
-    gen_fsm:send_all_state_event(FsmPid, Event).
-
-sync_send_all_state_event(FsmPid, Event) ->
-    gen_fsm:sync_send_all_state_event(FsmPid, Event).
-
-%% simulate send_all_state_event(self(), Event) 
-event(#ssh_msg_disconnect{} = Event, StateName, State) ->
-    handle_event(Event, StateName, State);
-event(#ssh_msg_ignore{} = Event, StateName, State) ->
-    handle_event(Event, StateName, State);
-event(#ssh_msg_debug{} = Event, StateName, State) ->
-    handle_event(Event, StateName, State);
-event(#ssh_msg_unimplemented{} = Event, StateName, State) ->
-    handle_event(Event, StateName, State);
-%% simulate send_event(self(), Event)
-event(Event, StateName, State) ->
-    ?MODULE:StateName(Event, State).
-
-generate_event(<<?BYTE(Byte), _/binary>> = Msg, StateName,
-	       #state{manager = Pid} = State0, EncData) 
-  when  Byte == ?SSH_MSG_GLOBAL_REQUEST;
-	Byte == ?SSH_MSG_REQUEST_SUCCESS;
-	Byte == ?SSH_MSG_REQUEST_FAILURE;
-	Byte == ?SSH_MSG_CHANNEL_OPEN;
-	Byte == ?SSH_MSG_CHANNEL_OPEN_CONFIRMATION;
-	Byte == ?SSH_MSG_CHANNEL_OPEN_FAILURE;
-	Byte == ?SSH_MSG_CHANNEL_WINDOW_ADJUST;
-	Byte == ?SSH_MSG_CHANNEL_DATA;
-	Byte == ?SSH_MSG_CHANNEL_EXTENDED_DATA;
-	Byte == ?SSH_MSG_CHANNEL_EOF;
-	Byte == ?SSH_MSG_CHANNEL_CLOSE;
-	Byte == ?SSH_MSG_CHANNEL_REQUEST;
-	Byte == ?SSH_MSG_CHANNEL_SUCCESS;
-	Byte == ?SSH_MSG_CHANNEL_FAILURE ->
-
-    try 
-	ssh_connection_manager:event(Pid, Msg),
-	State = generate_event_new_state(State0, EncData),
-	next_packet(State),
-	{next_state, StateName, State}
+
+cast(FsmPid, Event) ->
+    gen_statem:cast(FsmPid, Event).
+
+call(FsmPid, Event) ->
+    call(FsmPid, Event, infinity).
+
+call(FsmPid, Event, Timeout) ->
+    try gen_statem:call(FsmPid, Event, Timeout) of
+	{closed, _R} ->
+	    {error, closed};
+	{killed, _R} ->
+	    {error, closed};
+	Result ->
+	    Result
     catch
-	exit:{noproc, Reason} ->
-	    {stop, {shutdown, Reason}, State0}
-    end;
-generate_event(Msg, StateName, State0, EncData) ->
-    Event = ssh_bits:decode(Msg),
-    State = generate_event_new_state(State0, EncData),
-    case Event of
-	#ssh_msg_kexinit{} ->
-	    %% We need payload for verification later.
-	    event({Event, Msg}, StateName, State);
-	_ ->
-	    event(Event, StateName, State)
+	exit:{noproc, _R} ->
+	    {error, closed};
+	exit:{normal, _R} ->
+	    {error, closed};
+	exit:{{shutdown, _R},_} ->
+	    {error, closed}
     end.
 
-generate_event_new_state(#state{ssh_params = 
-				#ssh{recv_sequence = SeqNum0} 
-				= Ssh} = State, EncData) ->
-    SeqNum = ssh_transport:next_seqnum(SeqNum0),
-    State#state{ssh_params = Ssh#ssh{recv_sequence = SeqNum},
-		decoded_data_buffer = <<>>,
-		encoded_data_buffer = EncData, 
-		undecoded_packet_length = undefined}.
-
-
-next_packet(#state{decoded_data_buffer = <<>>,
-		   encoded_data_buffer = Buff,
-		   ssh_params = #ssh{decrypt_block_size = BlockSize},
-		   socket = Socket,
-		   transport_protocol = Protocol} = State) when Buff =/= <<>> ->
-    case  size(Buff) >= erlang:max(8, BlockSize) of
-	true ->
-	    %% Enough data from the next packet has been received to
-	    %% decode the length indicator, fake a socket-recive
-	    %% message so that the data will be processed
-	    self() ! {Protocol, Socket, <<>>};
-	false ->
-	    inet:setopts(Socket, [{active, once}])
-    end,
-    State;
 
-next_packet(#state{socket = Socket} = State) ->
-    inet:setopts(Socket, [{active, once}]),
-    State.
-
-after_new_keys(#state{renegotiate = true} = State) ->
-    {connected, State#state{renegotiate = false}};
-after_new_keys(#state{renegotiate = false, 
-		      ssh_params = #ssh{role = client} = Ssh0} = State) ->
-    ssh_bits:install_messages(ssh_auth:userauth_messages()),
-    {Msg, Ssh} = ssh_auth:service_request_msg(Ssh0),
-    send_msg(Msg, State),
-    {userauth, State#state{ssh_params = Ssh}};
-after_new_keys(#state{renegotiate = false,  
-		      ssh_params = #ssh{role = server}} = State) ->
-    {userauth, State}.
-
-handle_ssh_packet_data(RemainingSshPacketLen, DecData, EncData, StateName, 
-		       State) ->
-    EncSize =  size(EncData), 
-    case RemainingSshPacketLen > EncSize of
-	true ->
-	    {next_state, StateName, 
-	     next_packet(State#state{decoded_data_buffer = DecData,
-				     encoded_data_buffer = EncData,
-				     undecoded_packet_length = 
-				     RemainingSshPacketLen})};
-	false ->
-	    handle_ssh_packet(RemainingSshPacketLen, StateName,
-			      State#state{decoded_data_buffer = DecData,
-					  encoded_data_buffer = EncData})
+handle_connection_msg(Msg, StateName, D0 = #data{starter = User,
+						 connection_state = Connection0,
+						 event_queue = Qev0}) ->
+    Renegotiation = renegotiation(StateName),
+    Role = role(StateName),
+    try ssh_connection:handle_msg(Msg, Connection0, Role) of
+	{{replies, Replies}, Connection} ->
+	    {Repls, D} = 
+		case StateName of
+		    {connected,_} ->
+			send_replies(Replies, D0#data{connection_state=Connection});
+		    _ ->
+			{ConnReplies, NonConnReplies} = lists:splitwith(fun not_connected_filter/1, Replies),
+			send_replies(NonConnReplies, D0#data{event_queue = Qev0 ++ ConnReplies})
+		end,
+	    {keep_state, D, Repls};
+
+	{noreply, Connection} ->
+	    {keep_state, D0#data{connection_state = Connection}};
+
+	{disconnect, Reason0, {{replies, Replies}, Connection}} ->
+	   {Repls, D} = send_replies(Replies, D0#data{connection_state = Connection}),
+	   case {Reason0,Role} of
+	       {{_, Reason}, client} when ((StateName =/= {connected,client}) and (not Renegotiation)) ->
+		   User ! {self(), not_connected, Reason};
+	       _ ->
+		   ok
+	   end,
+	   {stop_and_reply, {shutdown,normal}, Repls, D#data{connection_state = Connection}}
+
+    catch
+	_:Error ->
+	    {disconnect, _Reason, {{replies, Replies}, Connection}} =
+		ssh_connection:handle_msg(
+		  #ssh_msg_disconnect{code = ?SSH_DISCONNECT_BY_APPLICATION,
+				      description = "Internal error"},
+		  Connection0, Role),
+	    {Repls, D} = send_replies(Replies, D0#data{connection_state = Connection}),
+	    {stop_and_reply, {shutdown,Error}, Repls, D#data{connection_state = Connection}}
+    end.
+
+
+set_kex_overload_prefix(Msg = <<?BYTE(Op),_/binary>>, #data{ssh_params=SshParams})
+  when Op == 30;
+       Op == 31
+       ->
+    case catch atom_to_list(kex(SshParams)) of
+	"ecdh-sha2-" ++ _ ->
+	    <<"ecdh",Msg/binary>>;
+	"diffie-hellman-group-exchange-" ++ _ ->
+	    <<"dh_gex",Msg/binary>>;
+	"diffie-hellman-group" ++ _ ->
+	    <<"dh",Msg/binary>>;
+	_ ->
+	    Msg
+    end;
+set_kex_overload_prefix(Msg, _) ->
+    Msg.
+
+kex(#ssh{algorithms=#alg{kex=Kex}}) -> Kex;
+kex(_) -> undefined.
+
+cache(#data{connection_state=C}) -> C#connection.channel_cache.
     
-    end.    
-
-handle_ssh_packet(Length, StateName, #state{decoded_data_buffer = DecData0,
-					    encoded_data_buffer = EncData0,
-					    ssh_params = Ssh0,
-					    transport_protocol = _Protocol,
-					    socket = _Socket} = State0) ->
-    {Ssh1, DecData, EncData, Mac} = 
-	ssh_transport:unpack(EncData0, Length, Ssh0),
-    SshPacket = <<DecData0/binary, DecData/binary>>,
-    case ssh_transport:is_valid_mac(Mac, SshPacket, Ssh1) of
-	true ->
-	    PacketData = ssh_transport:msg_data(SshPacket),
-	    {Ssh1, Msg} = ssh_transport:decompress(Ssh1, PacketData),
-	    generate_event(Msg, StateName, 
-			   State0#state{ssh_params = Ssh1,
-					%% Important to be set for
-					%% next_packet
-					decoded_data_buffer = <<>>}, EncData);
-	false ->
-	    DisconnectMsg = 
-		#ssh_msg_disconnect{code = ?SSH_DISCONNECT_PROTOCOL_ERROR,
-				    description = "Bad mac",
-				    language = "en"},
-	    handle_disconnect(DisconnectMsg, State0)
+
+%%%----------------------------------------------------------------
+handle_request(ChannelPid, ChannelId, Type, Data, WantReply, From, D) ->
+    case ssh_channel:cache_lookup(cache(D), ChannelId) of
+	#channel{remote_id = Id} = Channel ->
+	    update_sys(cache(D), Channel, Type, ChannelPid),
+	    send_msg(ssh_connection:channel_request_msg(Id, Type, WantReply, Data),
+		     add_request(WantReply, ChannelId, From, D));
+	undefined ->
+	    D
     end.
 
-handle_disconnect(#ssh_msg_disconnect{} = Msg, State) ->
-    {stop, {shutdown, Msg}, State}.
-handle_disconnect(#ssh_msg_disconnect{} = Msg, State, ErrorMsg) ->
-    {stop, {shutdown, {Msg, ErrorMsg}}, State}.
+handle_request(ChannelId, Type, Data, WantReply, From, D) ->
+    case ssh_channel:cache_lookup(cache(D), ChannelId) of
+	#channel{remote_id = Id} ->
+	    send_msg(ssh_connection:channel_request_msg(Id, Type, WantReply, Data),
+		     add_request(WantReply, ChannelId, From, D));
+	undefined ->
+	    D
+    end.
+
+%%%----------------------------------------------------------------
+handle_channel_down(ChannelPid, D) ->
+    ssh_channel:cache_foldl(
+	       fun(Channel, Acc) when Channel#channel.user == ChannelPid ->
+		       ssh_channel:cache_delete(cache(D),
+						Channel#channel.local_id),
+		       Acc;
+		  (_,Acc) ->
+		       Acc
+	       end, [], cache(D)),
+    {{replies, []}, cache_check_set_idle_timer(D)}.
+
 
+update_sys(Cache, Channel, Type, ChannelPid) ->
+    ssh_channel:cache_update(Cache,
+			     Channel#channel{sys = Type, user = ChannelPid}).
+
+add_request(false, _ChannelId, _From, State) ->
+    State;
+add_request(true, ChannelId, From, #data{connection_state =
+					     #connection{requests = Requests0} =
+					     Connection} = State) ->
+    Requests = [{ChannelId, From} | Requests0],
+    State#data{connection_state = Connection#connection{requests = Requests}}.
+
+new_channel_id(#data{connection_state = #connection{channel_id_seed = Id} =
+			 Connection}
+	       = State) ->
+    {Id, State#data{connection_state =
+			Connection#connection{channel_id_seed = Id + 1}}}.
+
+%%%----------------------------------------------------------------
+%% %%% This server/client has decided to disconnect via the state machine:
+disconnect(Msg=#ssh_msg_disconnect{description=Description}, _StateName, State0) ->
+    State = send_msg(Msg, State0),
+    disconnect_fun(Description, State),
+timer:sleep(400),
+    {stop, {shutdown,Description}, State}.
+
+%%%----------------------------------------------------------------
 counterpart_versions(NumVsn, StrVsn, #ssh{role = server} = Ssh) ->
     Ssh#ssh{c_vsn = NumVsn , c_version = StrVsn};
 counterpart_versions(NumVsn, StrVsn, #ssh{role = client} = Ssh) ->
     Ssh#ssh{s_vsn = NumVsn , s_version = StrVsn}.
 
-opposite_role(client) ->
-    server;
-opposite_role(server) ->
-    client.
-connected_fun(User, PeerAddr, Method, Opts) ->
-    case proplists:get_value(connectfun, Opts) of
+ssh_info([], _State, Acc) ->
+    Acc;
+ssh_info([client_version | Rest], #data{ssh_params = #ssh{c_vsn = IntVsn,
+							   c_version = StringVsn}} = State, Acc) ->
+    ssh_info(Rest, State, [{client_version, {IntVsn, StringVsn}} | Acc]);
+
+ssh_info([server_version | Rest], #data{ssh_params =#ssh{s_vsn = IntVsn,
+							  s_version = StringVsn}} = State, Acc) ->
+    ssh_info(Rest, State, [{server_version, {IntVsn, StringVsn}} | Acc]);
+ssh_info([peer | Rest], #data{ssh_params = #ssh{peer = Peer}} = State, Acc) ->
+    ssh_info(Rest, State, [{peer, Peer} | Acc]);
+ssh_info([sockname | Rest], #data{socket = Socket} = State, Acc) ->
+    {ok, SockName} = inet:sockname(Socket),
+   ssh_info(Rest, State, [{sockname, SockName}|Acc]);
+ssh_info([user | Rest], #data{auth_user = User} = State, Acc) ->
+    ssh_info(Rest, State, [{user, User}|Acc]);
+ssh_info([ _ | Rest], State, Acc) ->
+    ssh_info(Rest, State, Acc).
+
+
+ssh_channel_info([], _, Acc) ->
+    Acc;
+
+ssh_channel_info([recv_window | Rest], #channel{recv_window_size = WinSize,
+						   recv_packet_size = Packsize
+						  } = Channel, Acc) ->
+    ssh_channel_info(Rest, Channel, [{recv_window, {{win_size, WinSize},
+						      {packet_size, Packsize}}} | Acc]);
+ssh_channel_info([send_window | Rest], #channel{send_window_size = WinSize,
+						send_packet_size = Packsize
+					       } = Channel, Acc) ->
+    ssh_channel_info(Rest, Channel, [{send_window, {{win_size, WinSize},
+						      {packet_size, Packsize}}} | Acc]);
+ssh_channel_info([ _ | Rest], Channel, Acc) ->
+    ssh_channel_info(Rest, Channel, Acc).
+
+
+log_error(Reason) ->
+    Report = io_lib:format("Erlang ssh connection handler failed with reason:~n"
+			   "    ~p~n"
+			   "Stacktrace:~n"
+			   "    ~p~n",
+			   [Reason, erlang:get_stacktrace()]),
+    error_logger:error_report(Report).
+
+
+%%%----------------------------------------------------------------
+not_connected_filter({connection_reply, _Data}) -> true;
+not_connected_filter(_) -> false.
+
+%%%----------------------------------------------------------------
+send_replies(Repls, State) ->
+    lists:foldl(fun get_repl/2,
+		{[],State},
+		Repls).
+
+get_repl({connection_reply,Msg}, {CallRepls,S}) ->
+    {CallRepls, send_msg(Msg,S)};
+get_repl({channel_data,undefined,_Data}, Acc) ->
+    Acc;
+get_repl({channel_data,Pid,Data}, Acc) ->
+    Pid ! {ssh_cm, self(), Data},
+    Acc;
+get_repl({channel_request_reply,From,Data}, {CallRepls,S}) ->
+    {[{reply,From,Data}|CallRepls], S};
+get_repl({flow_control,Cache,Channel,From,Msg}, {CallRepls,S}) ->
+    ssh_channel:cache_update(Cache, Channel#channel{flow_control = undefined}),
+    {[{reply,From,Msg}|CallRepls], S};
+get_repl({flow_control,From,Msg}, {CallRepls,S}) ->
+    {[{reply,From,Msg}|CallRepls], S};
+get_repl(noreply, Acc) ->
+    Acc;
+get_repl(X, Acc) ->
+    exit({get_repl,X,Acc}).
+
+%%%----------------------------------------------------------------
+disconnect_fun({disconnect,Msg}, D) ->
+    disconnect_fun(Msg, D);
+disconnect_fun(Reason,  #data{opts=Opts}) ->
+    case proplists:get_value(disconnectfun, Opts) of
 	undefined ->
 	    ok;
 	Fun ->
-	    catch Fun(User, PeerAddr, Method)
+	    catch Fun(Reason)
+     end.
+
+unexpected_fun(UnexpectedMessage, #data{opts = Opts,
+					ssh_params = #ssh{peer = {_,Peer} }
+				       } ) ->
+    case proplists:get_value(unexpectedfun, Opts) of
+	undefined ->
+	    report;
+	Fun ->
+	    catch Fun(UnexpectedMessage, Peer)
     end.
 
-retry_fun(_, undefined, _) ->
-    ok;
 
-retry_fun(User, {error, Reason}, Opts) ->
-    case proplists:get_value(failfun, Opts) of
+debug_fun(#ssh_msg_debug{always_display = Display,
+			 message = DbgMsg,
+			 language = Lang},
+	  #data{opts = Opts}) ->
+    case proplists:get_value(ssh_msg_debug_fun, Opts) of
 	undefined ->
 	    ok;
 	Fun ->
-	    catch Fun(User, Reason)
-    end;
+	    catch Fun(self(), Display, DbgMsg, Lang)
+    end.
+
 
-retry_fun(User, Reason, Opts) ->
-    case proplists:get_value(infofun, Opts) of
+connected_fun(User, Method, #data{ssh_params = #ssh{peer = {_,Peer}},
+				  opts = Opts}) ->
+    case proplists:get_value(connectfun, Opts) of
 	undefined ->
 	    ok;
 	Fun ->
-	    catch Fun(User, Reason)
+	    catch Fun(User, Peer, Method)
+    end.
+
+retry_fun(_, undefined, _) ->
+    ok;
+retry_fun(User, Reason, #data{ssh_params = #ssh{opts = Opts,
+						peer = {_,Peer}
+					       }}) ->
+    {Tag,Info} =
+	case Reason of
+	    {error, Error} ->
+		{failfun, Error};
+	    _ ->
+		{infofun, Reason}
+	end,
+    Fun = proplists:get_value(Tag, Opts, fun(_,_)-> ok end),
+    try erlang:fun_info(Fun, arity)
+    of
+	{arity, 2} -> %% Backwards compatible
+	    catch Fun(User, Info);
+	{arity, 3} ->
+	    catch Fun(User, Peer, Info);
+	_ ->
+	    ok
+    catch
+	_:_ ->
+	    ok
     end.
 
-ssh_info_handler(Options, Ssh, From) ->
-    Info = ssh_info(Options, Ssh, []),
-    ssh_connection_manager:send_msg({channel_requst_reply, From, Info}).
+%%%----------------------------------------------------------------
+%%% Cache idle timer that closes the connection if there are no
+%%% channels open for a while.
+
+cache_init_idle_timer(D) ->
+    case proplists:get_value(idle_time, D#data.opts, infinity) of
+	infinity ->
+	    D#data{idle_timer_value = infinity,
+		   idle_timer_ref = infinity	% A flag used later...
+		  };
+	IdleTime ->
+	    %% We dont want to set the timeout on first connect
+	    D#data{idle_timer_value = IdleTime}
+    end.
 
-ssh_info([], _, Acc) ->
-    Acc;
 
-ssh_info([client_version | Rest], #ssh{c_vsn = IntVsn,
-				       c_version = StringVsn} = SshParams, Acc) ->
-    ssh_info(Rest, SshParams, [{client_version, {IntVsn, StringVsn}} | Acc]);
+cache_check_set_idle_timer(D = #data{idle_timer_ref = undefined,
+				     idle_timer_value = IdleTime}) ->
+    %% No timer set - shall we set one?
+    case ssh_channel:cache_info(num_entries, cache(D)) of
+	0 when IdleTime == infinity ->
+	    %% No. Meaningless to set a timer that fires in an infinite time...
+	    D;
+	0 ->
+	    %% Yes, we'll set one since the cache is empty and it should not
+	    %% be that for a specified time
+	    D#data{idle_timer_ref =
+		       erlang:send_after(IdleTime, self(), {'EXIT',[],"Timeout"})};
+	_ ->
+	    %% No - there are entries in the cache
+	    D
+    end;
+cache_check_set_idle_timer(D) ->
+    %% There is already a timer set or the timeout time is infinite
+    D.
+    
+
+cache_cancel_idle_timer(D) ->
+    case D#data.idle_timer_ref of
+	infinity -> 
+	    %% The timer is not activated
+	    D;
+	undefined ->
+	    %% The timer is already cancelled
+	    D;
+	TimerRef -> 
+	    %% The timer is active
+	    erlang:cancel_timer(TimerRef),
+	    D#data{idle_timer_ref = undefined}
+    end.
+
 
-ssh_info([server_version | Rest], #ssh{s_vsn = IntVsn,
-				       s_version = StringVsn} = SshParams, Acc) ->
-    ssh_info(Rest, SshParams, [{server_version, {IntVsn, StringVsn}} | Acc]);
+cache_request_idle_timer_check(D = #data{idle_timer_value = infinity}) ->
+    D;
+cache_request_idle_timer_check(D = #data{idle_timer_value = IdleTime}) ->
+    erlang:send_after(IdleTime, self(), check_cache),
+    D.
 
-ssh_info([peer | Rest], #ssh{peer = Peer} = SshParams, Acc) ->
-    ssh_info(Rest, SshParams, [{peer, Peer} | Acc]);
+%%%----------------------------------------------------------------
+start_channel_request_timer(_,_, infinity) ->
+    ok;
+start_channel_request_timer(Channel, From, Time) ->
+    erlang:send_after(Time, self(), {timeout, {Channel, From}}).
+
+%%%----------------------------------------------------------------
+%%% Connection start and initalization helpers
+
+socket_control(Socket, Pid, Options) ->
+    {_, TransportCallback, _} =		   % For example {_,gen_tcp,_}
+	proplists:get_value(transport, Options, ?DefaultTransport),
+    case TransportCallback:controlling_process(Socket, Pid) of
+	ok ->
+	    gen_statem:cast(Pid, socket_control);
+	{error, Reason}	->
+	    {error, Reason}
+    end.
 
-ssh_info([ _ | Rest], SshParams, Acc) ->
-    ssh_info(Rest, SshParams, Acc).
+handshake(Pid, Ref, Timeout) ->
+    receive
+	ssh_connected ->
+	    erlang:demonitor(Ref),
+	    {ok, Pid};
+	{Pid, not_connected, Reason} ->
+	    {error, Reason};
+	{Pid, user_password} ->
+	    Pass = io:get_password(),
+	    Pid ! Pass,
+	    handshake(Pid, Ref, Timeout);
+	{Pid, question} ->
+	    Answer = io:get_line(""),
+	    Pid ! Answer,
+	    handshake(Pid, Ref, Timeout);
+	{'DOWN', _, process, Pid, {shutdown, Reason}} ->
+	    {error, Reason};
+	{'DOWN', _, process, Pid, Reason} ->
+	    {error, Reason}
+    after Timeout ->
+	    stop(Pid),
+	    {error, timeout}
+    end.
 
-log_error(Reason) ->
-    Report = io_lib:format("Erlang ssh connection handler failed with reason: "
-			   "~p ~n, Stacktace: ~p ~n"
-			   "please report this to [email protected] \n",
-			   [Reason,  erlang:get_stacktrace()]),
-    error_logger:error_report(Report),
-    "Internal error".
diff --git a/lib/ssh/src/ssh_connection_manager.erl b/lib/ssh/src/ssh_connection_manager.erl
deleted file mode 100644
index 99a0b6a7c8..0000000000
--- a/lib/ssh/src/ssh_connection_manager.erl
+++ /dev/null
@@ -1,916 +0,0 @@
-%%
-%% %CopyrightBegin%
-%% 
-%% Copyright Ericsson AB 2008-2013. All Rights Reserved.
-%% 
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
-%% 
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
-%% 
-%% %CopyrightEnd%
-%%
-%%
-%%----------------------------------------------------------------------
-%% Purpose: Handles multiplexing to ssh channels and global connection
-%% requests e.i. the SSH Connection Protocol (RFC 4254), that provides
-%% interactive login sessions, remote execution of commands, forwarded
-%% TCP/IP connections, and forwarded X11 connections. Details of the
-%% protocol is implemented in ssh_connection.erl
-%% ----------------------------------------------------------------------
--module(ssh_connection_manager).
-
--behaviour(gen_server).
-
--include("ssh.hrl").
--include("ssh_connect.hrl").
--include("ssh_transport.hrl").
-
--export([start_link/1]).
-
--export([info/1, info/2, 
-	 renegotiate/1, connection_info/2, channel_info/3,
-	 peer_addr/1, send_window/3, recv_window/3, adjust_window/3,
-	 close/2, stop/1, send/5,
-	 send_eof/2]).
-
--export([open_channel/6, reply_request/3, request/6, request/7, global_request/4, event/2, event/3, cast/2]).
-
-%% Internal application API and spawn
--export([send_msg/1, ssh_channel_info_handler/3]).
-
-%% gen_server callbacks
--export([init/1, handle_call/3, handle_cast/2, handle_info/2,
-	 terminate/2, code_change/3]).
-
--define(DBG_MESSAGE, true).
-
--record(state,
-	{
-	  role,
-	  client,
-	  starter,
-	  connection,       % pid()
-	  connection_state, % #connection{} 
-	  latest_channel_id = 0, 
-	  opts,
-	  channel_args,
-	  idle_timer_ref, % timerref
-	  connected 
-	 }).
-
-%%====================================================================
-%% Internal application API
-%%====================================================================
-
-start_link(Opts) ->
-    gen_server:start_link(?MODULE, Opts, []).
-
-open_channel(ConnectionManager,	ChannelType, ChannelSpecificData,
-	     InitialWindowSize, MaxPacketSize, Timeout) ->
-    case (catch call(ConnectionManager, {open, self(), ChannelType,
-					 InitialWindowSize, 
-					 MaxPacketSize, ChannelSpecificData},
-	      Timeout)) of
-	{open, Channel} -> 
-	    {ok, Channel}; 
-	Error -> 
-	    %% TODO: Best way?
-	    Error
-    end.
-
-request(ConnectionManager, ChannelPid, ChannelId, Type, true, Data, Timeout) ->
-    call(ConnectionManager, {request, ChannelPid, ChannelId, Type, Data}, Timeout);
-request(ConnectionManager, ChannelPid, ChannelId, Type, false, Data, _) ->
-    cast(ConnectionManager, {request, ChannelPid, ChannelId, Type, Data}).
-
-request(ConnectionManager, ChannelId, Type, true, Data, Timeout) ->
-    call(ConnectionManager, {request, ChannelId, Type, Data}, Timeout);
-request(ConnectionManager, ChannelId, Type, false, Data, _) ->
-    cast(ConnectionManager, {request, ChannelId, Type, Data}).
-
-reply_request(ConnectionManager, Status, ChannelId) ->
-    cast(ConnectionManager, {reply_request, Status, ChannelId}).
-
-global_request(ConnectionManager, Type, true = Reply, Data) ->
-    case call(ConnectionManager, 
-	      {global_request, self(), Type, Reply, Data}) of
-	{ssh_cm, ConnectionManager, {success, _}} ->
-	    ok;
-	{ssh_cm, ConnectionManager, {failure, _}} ->
-	    error
-    end;
-
-global_request(ConnectionManager, Type, false = Reply, Data) ->
-    cast(ConnectionManager, {global_request, self(), Type, Reply, Data}).
-
-event(ConnectionManager, BinMsg, ErrorMsg) ->
-    call(ConnectionManager, {ssh_msg, self(), BinMsg, ErrorMsg}).
-event(ConnectionManager, BinMsg) -> 
-    call(ConnectionManager, {ssh_msg, self(), BinMsg}).
-info(ConnectionManager) ->
-    info(ConnectionManager, {info, all}).
-
-info(ConnectionManager, ChannelProcess) ->
-    call(ConnectionManager, {info, ChannelProcess}).
-
-%% TODO: Do we really want this function? Should not 
-%% renegotiation be triggered by configurable timer
-%% or amount of data sent counter! 
-renegotiate(ConnectionManager) ->
-    cast(ConnectionManager, renegotiate).
-renegotiate_data(ConnectionManager) ->
-    cast(ConnectionManager, renegotiate_data).
-connection_info(ConnectionManager, Options) ->
-    call(ConnectionManager, {connection_info, Options}).
-
-channel_info(ConnectionManager, ChannelId, Options) ->
-    call(ConnectionManager, {channel_info, ChannelId, Options}).
-
-%% Replaced by option peer to connection_info/2 keep for now
-%% for Backwards compatibility!
-peer_addr(ConnectionManager) ->
-    call(ConnectionManager, {peer_addr, self()}).
-
-%% Backwards compatibility!
-send_window(ConnectionManager, Channel, TimeOut) ->
-    call(ConnectionManager, {send_window, Channel}, TimeOut).
-%% Backwards compatibility!
-recv_window(ConnectionManager, Channel, TimeOut) ->
-    call(ConnectionManager, {recv_window, Channel}, TimeOut).
-
-adjust_window(ConnectionManager, Channel, Bytes) ->
-    cast(ConnectionManager, {adjust_window, Channel, Bytes}).
-
-close(ConnectionManager, ChannelId) ->
-    case call(ConnectionManager, {close, ChannelId}) of
-	ok ->
-	    ok;
-	{error, channel_closed} ->
-	    ok
-    end.	
-
-stop(ConnectionManager) ->
-    case call(ConnectionManager, stop) of
-	ok ->
-	    ok;
-	{error, channel_closed} ->
-	    ok
-    end.
-			
-send(ConnectionManager, ChannelId, Type, Data, Timeout) ->
-    call(ConnectionManager, {data, ChannelId, Type, Data}, Timeout).
-
-send_eof(ConnectionManager, ChannelId) ->
-    call(ConnectionManager, {eof, ChannelId}).
-
-%%====================================================================
-%% gen_server callbacks
-%%====================================================================
-
-%%--------------------------------------------------------------------
-%% Function: init(Args) -> {ok, State} |
-%%                         {ok, State, Timeout} |
-%%                         ignore               |
-%%                         {stop, Reason}
-%% Description: Initiates the server
-%%--------------------------------------------------------------------
-init([server, _Socket, Opts]) ->
-    process_flag(trap_exit, true),
-    ssh_bits:install_messages(ssh_connection:messages()),
-    Cache = ssh_channel:cache_create(),
-    {ok, #state{role = server, 
-		connection_state = #connection{channel_cache = Cache,
-					       channel_id_seed = 0,
-					       port_bindings = [],
-					       requests = []},
-		opts = Opts,
-		connected = false}};
-
-init([client, Opts]) ->  
-    process_flag(trap_exit, true),
-    {links, [Parent]} = process_info(self(), links),
-    ssh_bits:install_messages(ssh_connection:messages()),
-    Cache = ssh_channel:cache_create(),
-    Address =  proplists:get_value(address, Opts),
-    Port = proplists:get_value(port, Opts),
-    SocketOpts = proplists:get_value(socket_opts, Opts),
-    Options = proplists:get_value(ssh_opts, Opts),
-    ChannelPid = proplists:get_value(channel_pid, Opts),
-    self() ! 
-	{start_connection, client, [Parent, Address, Port, SocketOpts, Options]},
-    TimerRef = get_idle_time(Options),
-	
-    {ok, #state{role = client, 
-		client = ChannelPid,
-		connection_state = #connection{channel_cache = Cache,
-					       channel_id_seed = 0,
-					       port_bindings = [],
-					       connection_supervisor = Parent,
-					       requests = []},
-		opts = Opts,
-		idle_timer_ref = TimerRef,
-		connected = false}}.
-
-%%--------------------------------------------------------------------
-%% Function: %% handle_call(Request, From, State) -> {reply, Reply, State} |
-%%                                      {reply, Reply, State, Timeout} |
-%%                                      {noreply, State} |
-%%                                      {noreply, State, Timeout} |
-%%                                      {stop, Reason, Reply, State} |
-%%                                      {stop, Reason, State}
-%% Description: Handling call messages
-%%--------------------------------------------------------------------
-handle_call({request, ChannelPid, ChannelId, Type, Data}, From, State0) ->
-    {{replies, Replies}, State} = handle_request(ChannelPid, 
-						 ChannelId, Type, Data, 
-						 true, From, State0),
-    %% Sends message to the connection handler process, reply to
-    %% channel is sent later when reply arrives from the connection
-    %% handler. 
-    lists:foreach(fun send_msg/1, Replies),
-    SshOpts = proplists:get_value(ssh_opts, State0#state.opts),
-    case proplists:get_value(idle_time, SshOpts) of
-	infinity ->
-	    ok;
-	_IdleTime ->
-	    erlang:send_after(5000, self(), {check_cache, [], []})
-    end,
-    {noreply, State};
-
-handle_call({request, ChannelId, Type, Data}, From, State0) ->
-    {{replies, Replies}, State} = handle_request(ChannelId, Type, Data, 
-						 true, From, State0),
-    %% Sends message to the connection handler process, reply to
-    %% channel is sent later when reply arrives from the connection
-    %% handler.
-    lists:foreach(fun send_msg/1, Replies),
-    {noreply, State};
-
-%% Message from ssh_connection_handler
-handle_call({ssh_msg, Pid, Msg}, From, 
-	    #state{connection_state = Connection0,
-		   role = Role, opts = Opts, connected = IsConnected,
-		   client = ClientPid}
-	    = State) ->
-    
-    %% To avoid that not all data sent by the other side is processes before
-    %% possible crash in ssh_connection_handler takes down the connection.
-    gen_server:reply(From, ok),
-    ConnectionMsg = decode_ssh_msg(Msg),
-    try ssh_connection:handle_msg(ConnectionMsg, Connection0, Pid, Role) of
-	{{replies, Replies}, Connection} ->
-	    lists:foreach(fun send_msg/1, Replies),
-	    {noreply, State#state{connection_state = Connection}};
-	{noreply, Connection} ->
-	    {noreply, State#state{connection_state = Connection}};
-	{disconnect, {_, Reason}, {{replies, Replies}, Connection}} 
-	when Role == client andalso (not IsConnected) ->
-	    lists:foreach(fun send_msg/1, Replies),
-	    ClientPid ! {self(), not_connected, Reason},
-	    {stop, {shutdown, normal}, State#state{connection = Connection}};
-	{disconnect, Reason, {{replies, Replies}, Connection}} ->
-	    lists:foreach(fun send_msg/1, Replies),
-	    SSHOpts = proplists:get_value(ssh_opts, Opts),
-	    disconnect_fun(Reason, SSHOpts),
-	    {stop, {shutdown, normal}, State#state{connection_state = Connection}}
-	catch
-	    _:Error ->
-		{disconnect, Reason, {{replies, Replies}, Connection}} =
-		    ssh_connection:handle_msg(
-		      #ssh_msg_disconnect{code = ?SSH_DISCONNECT_BY_APPLICATION,
-					  description = "Internal error",
-					  language = "en"}, Connection0, undefined,
-		      Role),
-		lists:foreach(fun send_msg/1, Replies),
-		SSHOpts = proplists:get_value(ssh_opts, Opts),
-		disconnect_fun(Reason, SSHOpts),
-		{stop, {shutdown, Error}, State#state{connection_state = Connection}}
-	end;
-handle_call({ssh_msg, Pid, Msg, ErrorMsg}, From,
-	    #state{connection_state = Connection0,
-		   role = Role, opts = Opts, connected = IsConnected,
-		   client = ClientPid}
-	    = State) ->
-
-    %% To avoid that not all data sent by the other side is processes before
-    %% possible crash in ssh_connection_handler takes down the connection.
-    gen_server:reply(From, ok),
-    ConnectionMsg = decode_ssh_msg(Msg),
-    try ssh_connection:handle_msg(ConnectionMsg, Connection0, Pid, Role) of
-	{{replies, Replies}, Connection} ->
-	    lists:foreach(fun send_msg/1, Replies),
-	    {noreply, State#state{connection_state = Connection}};
-	{noreply, Connection} ->
-	    {noreply, State#state{connection_state = Connection}};
-	{disconnect, {_, Reason}, {{replies, Replies}, Connection}}
-	when Role == client andalso (not IsConnected) ->
-	    lists:foreach(fun send_msg/1, Replies),
-	    ClientPid ! {self(), not_connected, {Reason, ErrorMsg}},
-	    {stop, {shutdown, normal}, State#state{connection = Connection}};
-	{disconnect, Reason, {{replies, Replies}, Connection}} ->
-	    lists:foreach(fun send_msg/1, Replies),
-	    SSHOpts = proplists:get_value(ssh_opts, Opts),
-	    disconnect_fun(Reason, SSHOpts),
-	    {stop, {shutdown, normal}, State#state{connection_state = Connection}}
-	catch
-	    _:Error ->
-		{disconnect, Reason, {{replies, Replies}, Connection}} =
-		    ssh_connection:handle_msg(
-		      #ssh_msg_disconnect{code = ?SSH_DISCONNECT_BY_APPLICATION,
-					  description = "Internal error",
-					  language = "en"}, Connection0, undefined,
-		      Role),
-		lists:foreach(fun send_msg/1, Replies),
-		SSHOpts = proplists:get_value(ssh_opts, Opts),
-		disconnect_fun(Reason, SSHOpts),
-		{stop, {shutdown, Error}, State#state{connection_state = Connection}}
-	end;
-handle_call({global_request, Pid, _, _, _} = Request, From, 
-	    #state{connection_state = 
-		   #connection{channel_cache = Cache}} = State0) ->
-    State1 = handle_global_request(Request, State0),
-    Channel = ssh_channel:cache_find(Pid, Cache),
-    State = add_request(true, Channel#channel.local_id, From, State1),
-    {noreply, State};
-
-handle_call({data, ChannelId, Type, Data}, From, 
-	    #state{connection_state = #connection{channel_cache = _Cache} 
-		   = Connection0, 
-		   connection = ConnectionPid} = State) ->
-    channel_data(ChannelId, Type, Data, Connection0, ConnectionPid, From,
-		 State);
-
-handle_call({eof, ChannelId}, _From,
-			#state{connection = Pid, connection_state =
-					   #connection{channel_cache = Cache}} = State) ->
-	case ssh_channel:cache_lookup(Cache, ChannelId) of
-		#channel{remote_id = Id, sent_close = false} ->
-			send_msg({connection_reply, Pid,
-					  ssh_connection:channel_eof_msg(Id)}),
-			{reply, ok, State};
-		_ ->
-			{reply, {error,closed}, State}
-	end;
-
-handle_call({connection_info, Options}, From, 
-	    #state{connection = Connection} = State) ->
-    ssh_connection_handler:connection_info(Connection, From, Options),
-    %% Reply will be sent by the connection handler by calling
-    %% ssh_connection_handler:send_msg/1.
-    {noreply, State};
-
-handle_call({channel_info, ChannelId, Options}, From, 
-	    #state{connection_state = #connection{channel_cache = Cache}} = State) ->
- 
-    case ssh_channel:cache_lookup(Cache, ChannelId) of			 
-       #channel{} = Channel ->
-	    spawn(?MODULE, ssh_channel_info_handler, [Options, Channel, From]),
-	    {noreply, State};
-	undefined -> 
-	    {reply, []}
-    end;
-   
-handle_call({info, ChannelPid}, _From, 
-	    #state{connection_state = 
-		   #connection{channel_cache = Cache}} = State) ->
-    Result = ssh_channel:cache_foldl(
-	       fun(Channel, Acc) when ChannelPid == all; 
-		  Channel#channel.user == ChannelPid ->
-		       [Channel | Acc];
-		  (_, Acc) ->
-		       Acc
-	       end, [], Cache),
-    {reply, {ok, Result}, State};
-
-handle_call({open, ChannelPid, Type, InitialWindowSize, MaxPacketSize, Data}, 
-	    From, #state{connection = Pid,
-			 connection_state = 
-			     #connection{channel_cache = Cache}} = State0) ->
-    erlang:monitor(process, ChannelPid),
-    {ChannelId, State1}  = new_channel_id(State0),
-    Msg = ssh_connection:channel_open_msg(Type, ChannelId, 
-					  InitialWindowSize, 
-					  MaxPacketSize, Data),
-    send_msg({connection_reply, Pid, Msg}),
-    Channel = #channel{type = Type,
-		       sys = "none",
-		       user = ChannelPid,
-		       local_id = ChannelId,
-		       recv_window_size = InitialWindowSize,
-		       recv_packet_size = MaxPacketSize},
-    ssh_channel:cache_update(Cache, Channel),
-    State = add_request(true, ChannelId, From, State1),
-    {noreply, remove_timer_ref(State)};
-
-handle_call({send_window, ChannelId}, _From, 
-	    #state{connection_state = 
-		   #connection{channel_cache = Cache}} = State) ->
-     Reply = case ssh_channel:cache_lookup(Cache, ChannelId) of
-		#channel{send_window_size = WinSize,
-			 send_packet_size = Packsize} ->
-		    {ok, {WinSize, Packsize}};
-		undefined -> 
-		    {error, einval}
-	    end,
-    {reply, Reply, State};
-
-handle_call({recv_window, ChannelId}, _From, 
-	    #state{connection_state = #connection{channel_cache = Cache}} 
-	     = State) ->
-  
-    Reply = case ssh_channel:cache_lookup(Cache, ChannelId) of
-		#channel{recv_window_size = WinSize,
-			 recv_packet_size = Packsize} ->
-		    {ok, {WinSize, Packsize}};
-		undefined -> 
-		    {error, einval}
-	    end,
-    {reply, Reply, State};
-
-%% Replaced by option peer to connection_info/2 keep for now
-%% for Backwards compatibility!
-handle_call({peer_addr, _ChannelId}, _From, 
-	    #state{connection = Pid} = State) ->
-    Reply = ssh_connection_handler:peer_address(Pid),
-    {reply, Reply, State};
-
-handle_call(opts, _, #state{opts = Opts} = State) ->
-    {reply, Opts, State};
-
-handle_call({close, ChannelId}, _,
-	    #state{connection = Pid, connection_state = 
-		   #connection{channel_cache = Cache}} = State) ->
-    case ssh_channel:cache_lookup(Cache, ChannelId) of			 
-	#channel{remote_id = Id} = Channel ->
-	    send_msg({connection_reply, Pid, 
-		      ssh_connection:channel_close_msg(Id)}),
-	    ssh_channel:cache_update(Cache, Channel#channel{sent_close = true}),
-	    SshOpts = proplists:get_value(ssh_opts, State#state.opts),
-	    case proplists:get_value(idle_time, SshOpts) of
-		infinity ->
-		    ok;
-		_IdleTime ->
-		    erlang:send_after(5000, self(), {check_cache, [], []})
-	    end,
-	    {reply, ok, State};
-	undefined -> 
-	    {reply, ok, State}
-    end;
-
-handle_call(stop, _, #state{connection_state = Connection0,
-			    role = Role,
-			    opts = Opts} = State) ->
-    {disconnect, Reason, {{replies, Replies}, Connection}} =
-	ssh_connection:handle_msg(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_BY_APPLICATION,
-						      description = "User closed down connection",
-						      language = "en"}, Connection0, undefined, 
-				  Role),
-    lists:foreach(fun send_msg/1, Replies),
-    SSHOpts = proplists:get_value(ssh_opts, Opts),
-    disconnect_fun(Reason, SSHOpts),
-    {stop, normal, ok, State#state{connection_state = Connection}};
-
-%% API violation make it the violaters problem
-%% by ignoring it. The violating process will get
-%% a timeout or hang. 
-handle_call(_, _, State) ->
-    {noreply, State}.
-
-%%--------------------------------------------------------------------
-%% Function: handle_cast(Msg, State) -> {noreply, State} |
-%%                                      {noreply, State, Timeout} |
-%%                                      {stop, Reason, State}
-%% Description: Handling cast messages
-%%--------------------------------------------------------------------
-handle_cast({request, ChannelPid, ChannelId, Type, Data}, State0) ->
-    {{replies, Replies}, State} = handle_request(ChannelPid, ChannelId, 
-						 Type, Data, 
-						 false, none, State0),
-    lists:foreach(fun send_msg/1, Replies),
-    {noreply, State};
-
-handle_cast({request, ChannelId, Type, Data}, State0) ->
-    {{replies, Replies}, State} = handle_request(ChannelId, Type, Data, 
-						 false, none, State0),
-    lists:foreach(fun send_msg/1, Replies),
-    {noreply, State};
-
-handle_cast({reply_request, Status, ChannelId}, #state{connection_state =
-        #connection{channel_cache = Cache}} = State0) ->
-    State = case ssh_channel:cache_lookup(Cache, ChannelId) of
-        #channel{remote_id = RemoteId} ->
-            cm_message({Status, RemoteId}, State0);
-        undefined ->
-            State0
-    end,
-    {noreply, State};
-
-handle_cast({global_request, _, _, _, _} = Request, State0) ->
-    State = handle_global_request(Request, State0),
-    {noreply, State};
-
-handle_cast(renegotiate, #state{connection = Pid} = State) ->
-    ssh_connection_handler:renegotiate(Pid),
-    {noreply, State};
-handle_cast(renegotiate_data, #state{connection = Pid} = State) ->
-    ssh_connection_handler:renegotiate_data(Pid),
-    {noreply, State};
-handle_cast({adjust_window, ChannelId, Bytes}, 
-	    #state{connection = Pid, connection_state =
-		   #connection{channel_cache = Cache}} = State) ->
-    case ssh_channel:cache_lookup(Cache, ChannelId) of
-	#channel{recv_window_size = WinSize, remote_id = Id} = Channel ->
-	    ssh_channel:cache_update(Cache, Channel#channel{recv_window_size = 
-					       WinSize + Bytes}),
-	    Msg = ssh_connection:channel_adjust_window_msg(Id, Bytes),
-	    send_msg({connection_reply, Pid, Msg});
-	undefined -> 
-	    ignore
-    end,
-    {noreply, State};
-
-handle_cast({success, ChannelId},  #state{connection = Pid} = State) ->
-    Msg = ssh_connection:channel_success_msg(ChannelId),
-    send_msg({connection_reply, Pid, Msg}),
-    {noreply, State};
-
-handle_cast({failure, ChannelId},  #state{connection = Pid} = State) ->
-    Msg = ssh_connection:channel_failure_msg(ChannelId),
-    send_msg({connection_reply, Pid, Msg}),
-    {noreply, State}.
-
-%%--------------------------------------------------------------------
-%% Function: handle_info(Info, State) -> {noreply, State} |
-%%                                       {noreply, State, Timeout} |
-%%                                       {stop, Reason, State}
-%% Description: Handling all non call/cast messages
-%%--------------------------------------------------------------------
-handle_info({start_connection, server, 
-	     [Address, Port, Socket, Options, SubSysSup]},
-	    #state{connection_state = CState} = State) ->
-    {ok, Connection} = ssh_transport:accept(Address, Port, Socket, Options),
-    Shell = proplists:get_value(shell, Options),
-    Exec = proplists:get_value(exec, Options),
-    CliSpec = proplists:get_value(ssh_cli, Options, {ssh_cli, [Shell]}),
-    ssh_connection_handler:send_event(Connection, socket_control),
-    erlang:send_after(60000, self(), rekey_data),
-    {noreply, State#state{connection = Connection,
-			  connection_state = 
-			  CState#connection{address = Address,
-					    port = Port,
-					    cli_spec = CliSpec,
-					    options = Options,
-					    exec = Exec,
-					    sub_system_supervisor = SubSysSup
-					   }}};
-	    
-handle_info({start_connection, client, 
-	     [Parent, Address, Port, SocketOpts, Options]},
-	    #state{client = Pid} = State) ->
-    case (catch ssh_transport:connect(Parent, Address, 
-				      Port, SocketOpts, Options)) of
-	{ok, Connection} ->
-	    erlang:send_after(60000, self(), rekey_data),
-	    erlang:send_after(3600000, self(), rekey),
-	    {noreply, State#state{connection = Connection}};
-	Reason ->
-	    Pid ! {self(), not_connected, Reason},
-	    {stop, {shutdown, normal}, State}
-    end;
-handle_info({check_cache, _ , _}, 
-	    #state{connection_state = 
-		       #connection{channel_cache = Cache}} = State) ->
-    {noreply, check_cache(State, Cache)};
-handle_info({ssh_cm, _Sender, Msg}, State0) ->
-    %% Backwards compatibility!  
-    State = cm_message(Msg, State0),
-    {noreply, State};
-
-%% Nop backwards compatibility
-handle_info({same_user, _}, State) ->
-    {noreply, State};
-
-handle_info(ssh_connected, #state{role = client, client = Pid} 
-	    = State) ->
-    Pid ! {self(), is_connected},
-    {noreply, State#state{connected = true, opts = handle_password(State#state.opts)}};
-
-handle_info(ssh_connected, #state{role = server} = State) ->
-    {noreply, State#state{connected = true}};
-
-%%% Handle that ssh channels user process goes down
-handle_info({'DOWN', _Ref, process, ChannelPid, _Reason}, State) ->
-    handle_down(handle_channel_down(ChannelPid, State));
-
-%%% So that terminate will be run when supervisor is shutdown
-handle_info({'EXIT', _Sup, Reason}, State) ->
-    {stop, Reason, State};
-handle_info(rekey, State) ->
-    renegotiate(self()),
-    erlang:send_after(3600000, self(), rekey),
-    {noreply, State};
-handle_info(rekey_data, State) ->
-    renegotiate_data(self()),
-    erlang:send_after(60000, self(), rekey_data),
-    {noreply, State}.
-handle_password(Opts) ->
-    handle_rsa_password(handle_dsa_password(handle_normal_password(Opts))).
-handle_normal_password(Opts) ->
-    case proplists:get_value(ssh_opts, Opts, false) of
-	false ->
-	    Opts;
-	SshOpts ->
-	    case proplists:get_value(password, SshOpts, false) of
-		false ->
-		    Opts;
-		_Password ->
-		    NewOpts = [{password, undefined}|lists:keydelete(password, 1, SshOpts)],
-		    [{ssh_opts, NewOpts}|lists:keydelete(ssh_opts, 1, Opts)]
-	    end
-    end.
-handle_dsa_password(Opts) ->
-    case proplists:get_value(ssh_opts, Opts, false) of
-	false ->
-	    Opts;
-	SshOpts ->
-	    case proplists:get_value(dsa_pass_phrase, SshOpts, false) of
-		false ->
-		    Opts;
-		_Password ->
-		    NewOpts = [{dsa_pass_phrase, undefined}|lists:keydelete(dsa_pass_phrase, 1, SshOpts)],
-		    [{ssh_opts, NewOpts}|lists:keydelete(ssh_opts, 1, Opts)]
-	    end
-    end.
-handle_rsa_password(Opts) ->
-    case proplists:get_value(ssh_opts, Opts, false) of
-	false ->
-	    Opts;
-	SshOpts ->
-	    case proplists:get_value(rsa_pass_phrase, SshOpts, false) of
-		false ->
-		    Opts;
-		_Password ->
-		    NewOpts = [{rsa_pass_phrase, undefined}|lists:keydelete(rsa_pass_phrase, 1, SshOpts)],
-		    [{ssh_opts, NewOpts}|lists:keydelete(ssh_opts, 1, Opts)]
-	    end
-    end.
-%%--------------------------------------------------------------------
-%% Function: terminate(Reason, State) -> void()
-%% Description: This function is called by a gen_server when it is about to
-%% terminate. It should be the opposite of Module:init/1 and do any necessary
-%% cleaning up. When it returns, the gen_server terminates with Reason.
-%% The return value is ignored.
-%%--------------------------------------------------------------------
-terminate(_Reason, #state{role = client,
-			  connection_state =
-			      #connection{connection_supervisor = Supervisor}}) ->
-    sshc_sup:stop_child(Supervisor);
-	
-terminate(_Reason, #state{role = server,
-			 connection_state =
-			     #connection{sub_system_supervisor = SubSysSup},
-			 opts = Opts}) ->
-    Address =  proplists:get_value(address, Opts),
-    Port = proplists:get_value(port, Opts),
-    SystemSup = ssh_system_sup:system_supervisor(Address, Port),
-    ssh_system_sup:stop_subsystem(SystemSup, SubSysSup).
-
-%%--------------------------------------------------------------------
-%% Func: code_change(OldVsn, State, Extra) -> {ok, NewState}
-%% Description: Convert process state when code is changed
-%%--------------------------------------------------------------------
-code_change(_OldVsn, State, _Extra) ->
-    {ok, State}.
-
-%%--------------------------------------------------------------------
-%%% Internal functions
-%%--------------------------------------------------------------------
-get_idle_time(SshOptions) ->
-    case proplists:get_value(idle_time, SshOptions) of
-	infinity ->
-	    infinity;
-       _IdleTime -> %% We dont want to set the timeout on first connect
-	    undefined
-    end.
-check_cache(State, Cache) ->
-    %% Check the number of entries in Cache
-    case proplists:get_value(size, ets:info(Cache)) of
-	0 ->
-	    Opts = proplists:get_value(ssh_opts, State#state.opts),
-	    case proplists:get_value(idle_time, Opts) of
-		infinity ->
-		    State;
-		undefined ->
-		    State;
-		Time ->
-		    case State#state.idle_timer_ref of
-			undefined ->
-			    TimerRef = erlang:send_after(Time, self(), {'EXIT', [], "Timeout"}),
-			    State#state{idle_timer_ref=TimerRef};
-			_ ->
-			    State
-		    end
-	    end;
-	_ ->
-	    State
-    end.
-remove_timer_ref(State) ->
-    case State#state.idle_timer_ref of
-	infinity -> %% If the timer is not activated
-	    State;
-	undefined -> %% If we already has cancelled the timer
-	    State;
-	TimerRef -> %% Timer is active
-	    erlang:cancel_timer(TimerRef),
-	    State#state{idle_timer_ref = undefined}
-    end.
-channel_data(Id, Type, Data, Connection0, ConnectionPid, From, State) ->
-    case ssh_connection:channel_data(Id, Type, Data, Connection0,
-				     ConnectionPid, From) of
-	{{replies, Replies}, Connection} ->
-	    lists:foreach(fun send_msg/1, Replies),
-	    {noreply, State#state{connection_state = Connection}};
-	{noreply, Connection} ->
-	    {noreply, State#state{connection_state = Connection}}
-    end.
-
-call(Pid, Msg) ->
-    call(Pid, Msg, infinity).
-call(Pid, Msg, Timeout) ->
-    try gen_server:call(Pid, Msg, Timeout) of
-	Result ->
-	    Result
-    catch
-	exit:{timeout, _} ->
-	    {error, timeout};
-	exit:{normal, _} ->
-	    {error, channel_closed};
-	exit:{{shutdown, _}, _} ->
-	    {error, channel_closed};
-	exit:{noproc,_} ->
-	    {error, channel_closed}
-    end.
-
-cast(Pid, Msg) ->
-    gen_server:cast(Pid, Msg).
-
-decode_ssh_msg(BinMsg) when is_binary(BinMsg)->
-    ssh_bits:decode(BinMsg);
-decode_ssh_msg(Msg) ->
-    Msg.
-
-
-send_msg(Msg) ->
-    catch do_send_msg(Msg).
-do_send_msg({channel_data, Pid, Data}) ->
-    Pid ! {ssh_cm, self(), Data};
-do_send_msg({channel_requst_reply, From, Data}) ->
-    gen_server:reply(From, Data);
-do_send_msg({connection_reply, Pid, Data}) ->
-    Msg = ssh_bits:encode(Data),
-    ssh_connection_handler:send(Pid, Msg);
-do_send_msg({flow_control, Cache, Channel, From, Msg}) ->
-    ssh_channel:cache_update(Cache, Channel#channel{flow_control = undefined}),
-    gen_server:reply(From, Msg);
-do_send_msg({flow_control, From, Msg}) ->
-    gen_server:reply(From, Msg).
-
-handle_request(ChannelPid, ChannelId, Type, Data, WantReply, From, 
-	       #state{connection = Pid,
-		      connection_state = 
-		      #connection{channel_cache = Cache}} = State0) ->
-    case ssh_channel:cache_lookup(Cache, ChannelId) of
-	#channel{remote_id = Id} = Channel ->
-	    update_sys(Cache, Channel, Type, ChannelPid),
-	    Msg = ssh_connection:channel_request_msg(Id, Type, 
-						     WantReply, Data),
-	    Replies = [{connection_reply, Pid, Msg}],
-	    State = add_request(WantReply, ChannelId, From, State0),
-	    {{replies, Replies}, State};
-	undefined ->
-	    {{replies, []}, State0}
-    end.
-
-handle_request(ChannelId, Type, Data, WantReply, From, 
-	       #state{connection = Pid,
-		      connection_state = 
-		      #connection{channel_cache = Cache}} = State0) ->
-    case ssh_channel:cache_lookup(Cache, ChannelId) of
-	#channel{remote_id = Id}  ->
-	    Msg = ssh_connection:channel_request_msg(Id, Type, 
-						     WantReply, Data),
-	    Replies = [{connection_reply, Pid, Msg}],
-	    State = add_request(WantReply, ChannelId, From, State0),
-	    {{replies, Replies}, State};
-	undefined ->
-	    {{replies, []}, State0}
-    end.
-
-handle_down({{replies, Replies}, State}) ->
-    lists:foreach(fun send_msg/1, Replies),
-    {noreply, State}.
-
-handle_channel_down(ChannelPid, #state{connection_state = 
-					   #connection{channel_cache = Cache}} =
-			State) ->
-    ssh_channel:cache_foldl(
-	       fun(Channel, Acc) when Channel#channel.user == ChannelPid ->
-		       ssh_channel:cache_delete(Cache,
-						Channel#channel.local_id),
-		       Acc;
-		  (_,Acc) ->
-		       Acc
-	       end, [], Cache),
-    {{replies, []}, check_cache(State, Cache)}.
-
-update_sys(Cache, Channel, Type, ChannelPid) ->
-    ssh_channel:cache_update(Cache, 
-			     Channel#channel{sys = Type, user = ChannelPid}).
-
-add_request(false, _ChannelId, _From, State) ->
-    State;
-add_request(true, ChannelId, From, #state{connection_state = 
-					#connection{requests = Requests0} = 
-					Connection} = State) ->
-    Requests = [{ChannelId, From} | Requests0],
-    State#state{connection_state = Connection#connection{requests = Requests}}.
- 
-new_channel_id(#state{connection_state = #connection{channel_id_seed = Id} =
-		      Connection}
-	       = State) ->
-    {Id, State#state{connection_state = 
-		     Connection#connection{channel_id_seed = Id + 1}}}.
-   
-handle_global_request({global_request, ChannelPid, 
-		       "tcpip-forward" = Type, WantReply, 
-		       <<?UINT32(IPLen), 
-			IP:IPLen/binary, ?UINT32(Port)>> = Data}, 
-		      #state{connection = ConnectionPid, 
-			     connection_state = 
-			     #connection{channel_cache = Cache}
-			     = Connection0} = State) ->
-    ssh_channel:cache_update(Cache, #channel{user = ChannelPid,
-					     type = "forwarded-tcpip",
- 					     sys = none}),
-    Connection = ssh_connection:bind(IP, Port, ChannelPid, Connection0),
-    Msg = ssh_connection:global_request_msg(Type, WantReply, Data),
-    send_msg({connection_reply, ConnectionPid, Msg}),
-    State#state{connection_state = Connection};
-
-handle_global_request({global_request, _Pid, "cancel-tcpip-forward" = Type, 
-		       WantReply, <<?UINT32(IPLen), 
-				   IP:IPLen/binary, ?UINT32(Port)>> = Data}, 
-		      #state{connection = Pid,
-			     connection_state = Connection0} = State) ->
-    Connection = ssh_connection:unbind(IP, Port, Connection0),
-    Msg = ssh_connection:global_request_msg(Type, WantReply, Data),
-    send_msg({connection_reply, Pid, Msg}),
-    State#state{connection_state = Connection};
-
-handle_global_request({global_request, _Pid, "cancel-tcpip-forward" = Type, 
-		       WantReply,  Data}, #state{connection = Pid} = State) ->
-    Msg = ssh_connection:global_request_msg(Type, WantReply, Data),
-    send_msg({connection_reply, Pid, Msg}),
-    State.
-
-cm_message(Msg, State) ->
-    {noreply, NewState} =  handle_cast(Msg, State),
-    NewState.
-
-disconnect_fun(Reason, Opts) ->
-    case proplists:get_value(disconnectfun, Opts) of
- 	undefined ->
- 	    ok;
- 	Fun ->
- 	    catch Fun(Reason)
-     end.
-
-ssh_channel_info_handler(Options, Channel, From) ->
-    Info = ssh_channel_info(Options, Channel, []),
-    send_msg({channel_requst_reply, From, Info}).
-
-ssh_channel_info([], _, Acc) ->
-    Acc;
-
-ssh_channel_info([recv_window | Rest], #channel{recv_window_size = WinSize,
-						   recv_packet_size = Packsize
-						  } = Channel, Acc) ->
-    ssh_channel_info(Rest, Channel, [{recv_window, {{win_size, WinSize}, 
-						      {packet_size, Packsize}}} | Acc]);
-ssh_channel_info([send_window | Rest], #channel{send_window_size = WinSize,
-						send_packet_size = Packsize
-					       } = Channel, Acc) ->
-    ssh_channel_info(Rest, Channel, [{send_window, {{win_size, WinSize}, 
-						      {packet_size, Packsize}}} | Acc]);
-ssh_channel_info([ _ | Rest], Channel, Acc) ->
-    ssh_channel_info(Rest, Channel, Acc).
-
-
-
diff --git a/lib/ssh/src/ssh_connection_sup.erl b/lib/ssh/src/ssh_connection_sup.erl
index b620056310..0f54053f52 100644
--- a/lib/ssh/src/ssh_connection_sup.erl
+++ b/lib/ssh/src/ssh_connection_sup.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %% 
-%% Copyright Ericsson AB 2008-2012. All Rights Reserved.
+%% Copyright Ericsson AB 2008-2016. All Rights Reserved.
 %% 
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
-%% 
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
+%%
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %% 
 %% %CopyrightEnd%
 %%
@@ -25,8 +26,9 @@
 
 -behaviour(supervisor).
 
--export([start_link/1, start_handler_child/2, start_manager_child/2,
-	 connection_manager/1]).
+%% API
+-export([start_link/1]).
+-export([start_child/2]).
 
 %% Supervisor callback
 -export([init/1]).
@@ -37,83 +39,25 @@
 start_link(Args) ->
     supervisor:start_link(?MODULE, [Args]).
 
-%% Will be called from the manager child process
-start_handler_child(Sup, Args) ->
-    [Spec] = child_specs(handler, Args),
-    supervisor:start_child(Sup, Spec).
-
-%% Will be called from the acceptor process
-start_manager_child(Sup, Args) ->
-    [Spec] = child_specs(manager, Args),    
-    supervisor:start_child(Sup, Spec).
-
-connection_manager(SupPid) -> 
-    try supervisor:which_children(SupPid) of
-	Children ->
-	    {ok, ssh_connection_manager(Children)}
-    catch exit:{noproc,_} ->
-	    {ok, undefined}
-    end.
+start_child(Sup, Args) ->
+    supervisor:start_child(Sup, Args).
 
 %%%=========================================================================
 %%%  Supervisor callback
 %%%=========================================================================
-init([Args]) ->  
-    RestartStrategy = one_for_all,
+-spec init( [term()] ) -> {ok,{supervisor:sup_flags(),[supervisor:child_spec()]}} | ignore .
+
+init(_) ->
+    RestartStrategy = simple_one_for_one,
     MaxR = 0,
     MaxT = 3600,
-    Children = child_specs(Args),
-    {ok, {{RestartStrategy, MaxR, MaxT}, Children}}.
-
-%%%=========================================================================
-%%%  Internal functions
-%%%=========================================================================
-child_specs(Opts) ->
-    case proplists:get_value(role, Opts) of
-	client ->		
-	    child_specs(manager, [client | Opts]);
-	server ->
-	    %% Children started by acceptor process
-	    []
-    end.
- 
-% The manager process starts the handler process
-child_specs(manager, Opts) ->
-    [manager_spec(Opts)];
-child_specs(handler, Opts) ->
-    [handler_spec(Opts)].
-
-manager_spec([server = Role, Socket, Opts]) ->
-    Name = make_ref(), 
-    StartFunc = {ssh_connection_manager, start_link, [[Role, Socket, Opts]]},
-    Restart = temporary,
-    Shutdown = 3600,
-    Modules = [ssh_connection_manager],
-    Type = worker,
-    {Name, StartFunc, Restart, Shutdown, Type, Modules};
-
-manager_spec([client = Role | Opts]) ->
-    Name = make_ref(), 
-    StartFunc = {ssh_connection_manager, start_link, [[Role, Opts]]},
-    Restart = temporary,
-    Shutdown = 3600,
-    Modules = [ssh_connection_manager],
-    Type = worker,
-    {Name, StartFunc, Restart, Shutdown, Type, Modules}.
 
-handler_spec([Role, Socket, Opts]) ->
-    Name = make_ref(), 
-    StartFunc = {ssh_connection_handler, 
-		 start_link, [Role, self(), Socket, Opts]},
-    Restart = temporary,
-    Shutdown = 3600,
+    Name = undefined, % As simple_one_for_one is used.
+    StartFunc = {ssh_connection_handler, start_link, []},
+    Restart = temporary, % E.g. should not be restarted
+    Shutdown = 4000,
     Modules = [ssh_connection_handler],
     Type = worker,
-    {Name, StartFunc, Restart, Shutdown, Type, Modules}.
 
-ssh_connection_manager([]) ->
-    undefined;
-ssh_connection_manager([{_, Child, _, [ssh_connection_manager]} | _]) ->
-    Child;
-ssh_connection_manager([_ | Rest]) ->
-    ssh_connection_manager(Rest).
+    ChildSpec = {Name, StartFunc, Restart, Shutdown, Type, Modules},
+    {ok, {{RestartStrategy, MaxR, MaxT}, [ChildSpec]}}.
diff --git a/lib/ssh/src/ssh_daemon_channel.erl b/lib/ssh/src/ssh_daemon_channel.erl
index ab3efbcaff..6ca93eff44 100644
--- a/lib/ssh/src/ssh_daemon_channel.erl
+++ b/lib/ssh/src/ssh_daemon_channel.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2013. All Rights Reserved.
+%% Copyright Ericsson AB 2013-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
diff --git a/lib/ssh/src/ssh_dbg.erl b/lib/ssh/src/ssh_dbg.erl
new file mode 100644
index 0000000000..480795cfc7
--- /dev/null
+++ b/lib/ssh/src/ssh_dbg.erl
@@ -0,0 +1,166 @@
+%%
+%% %CopyrightBegin%
+%%
+%% Copyright Ericsson AB 2004-2016. All Rights Reserved.
+%%
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
+%%
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
+%%
+%% %CopyrightEnd%
+%%
+
+%%
+
+-module(ssh_dbg).
+
+-export([messages/0,
+	 messages/1,
+	 stop/0
+	]).
+
+-include("ssh.hrl").
+-include("ssh_transport.hrl").
+-include("ssh_connect.hrl").
+-include("ssh_auth.hrl").
+
+-record(data, {
+	  writer,
+	  acc = []}).
+%%%================================================================
+messages() -> messages(fun(String,_D) -> io:format(String) end).
+%% messages() -> messages(fun(String,Acc) -> [String|Acc] end)
+
+messages(Write) when is_function(Write,2) ->
+    catch dbg:start(),
+    setup_tracer(Write),
+    dbg:p(new,c),
+    dbg_ssh_messages().
+
+dbg_ssh_messages() ->
+    dbg:tp(ssh_message,encode,1, x),
+    dbg:tp(ssh_message,decode,1, x),
+    dbg:tpl(ssh_transport,select_algorithm,3, x).
+
+%%%----------------------------------------------------------------
+stop() ->
+    dbg:stop().
+
+%%%================================================================
+msg_formater({trace,Pid,call,{ssh_message,encode,[Msg]}}, D) ->
+    fmt("~nSEND ~p ~s~n", [Pid,wr_record(shrink_bin(Msg))], D);
+msg_formater({trace,_Pid,return_from,{ssh_message,encode,1},_Res}, D) -> 
+    D;
+	
+msg_formater({trace,_Pid,call,{ssh_message,decode,_}}, D) ->
+    D;
+msg_formater({trace,Pid,return_from,{ssh_message,decode,1},Msg}, D) -> 
+    fmt("~nRECV ~p ~s~n", [Pid,wr_record(shrink_bin(Msg))], D);
+	
+msg_formater({trace,_Pid,call,{ssh_transport,select_algorithm,_}}, D) ->
+    D;
+msg_formater({trace,Pid,return_from,{ssh_transport,select_algorithm,3},{ok,Alg}}, D) ->
+    fmt("~nALGORITHMS ~p~n~s~n", [Pid, wr_record(Alg)], D);
+
+msg_formater({trace,Pid,send,ErlangMsg,Dest}, D) ->
+    fmt("~nERL MSG ~p SEND TO ~p~n ~p~n", [Pid,Dest, shrink_bin(ErlangMsg)], D);
+
+msg_formater({trace,Pid,'receive',ErlangMsg}, D) ->
+    fmt("~nERL MSG ~p RECIEVE~n ~p~n", [Pid,shrink_bin(ErlangMsg)], D);
+
+msg_formater(M, D) ->
+    fmt("~nDBG ~n~p~n", [shrink_bin(M)], D).
+
+%% msg_formater(_, D) -> 
+%%     D.
+
+
+fmt(Fmt, Args,  D=#data{writer=Write,acc=Acc}) ->
+    D#data{acc = Write(io_lib:format(Fmt, Args), Acc)}.
+
+%%%----------------------------------------------------------------
+setup_tracer(Write) ->
+    Handler = fun msg_formater/2,
+    InitialData = #data{writer = Write},
+    {ok,_} = dbg:tracer(process, {Handler, InitialData}),
+    ok.
+
+%%%----------------------------------------------------------------
+shrink_bin(B) when is_binary(B), size(B)>100 -> {'*** SHRINKED BIN',size(B),element(1,split_binary(B,20)),'***'};
+shrink_bin(L) when is_list(L) -> lists:map(fun shrink_bin/1, L);
+shrink_bin(T) when is_tuple(T) -> list_to_tuple(shrink_bin(tuple_to_list(T)));
+shrink_bin(X) -> X.
+
+%%%----------------------------------------------------------------
+-define(wr_record(N,BlackList), wr_record(R=#N{}) -> wr_record(R, record_info(fields,N), BlackList)).
+
+-define(wr_record(N), ?wr_record(N, [])).
+
+
+?wr_record(alg);
+
+?wr_record(ssh_msg_disconnect);
+?wr_record(ssh_msg_ignore);
+?wr_record(ssh_msg_unimplemented);
+?wr_record(ssh_msg_debug);
+?wr_record(ssh_msg_service_request);
+?wr_record(ssh_msg_service_accept);
+?wr_record(ssh_msg_kexinit);
+?wr_record(ssh_msg_kexdh_init);
+?wr_record(ssh_msg_kexdh_reply);
+?wr_record(ssh_msg_newkeys);
+?wr_record(ssh_msg_kex_dh_gex_request);
+?wr_record(ssh_msg_kex_dh_gex_request_old);
+?wr_record(ssh_msg_kex_dh_gex_group);
+?wr_record(ssh_msg_kex_dh_gex_init);
+?wr_record(ssh_msg_kex_dh_gex_reply);
+?wr_record(ssh_msg_kex_ecdh_init);
+?wr_record(ssh_msg_kex_ecdh_reply);
+
+?wr_record(ssh_msg_userauth_request);
+?wr_record(ssh_msg_userauth_failure);
+?wr_record(ssh_msg_userauth_success);
+?wr_record(ssh_msg_userauth_banner);
+?wr_record(ssh_msg_userauth_passwd_changereq);
+?wr_record(ssh_msg_userauth_pk_ok);
+?wr_record(ssh_msg_userauth_info_request);
+?wr_record(ssh_msg_userauth_info_response);
+
+?wr_record(ssh_msg_global_request);
+?wr_record(ssh_msg_request_success);
+?wr_record(ssh_msg_request_failure);
+?wr_record(ssh_msg_channel_open);
+?wr_record(ssh_msg_channel_open_confirmation);
+?wr_record(ssh_msg_channel_open_failure);
+?wr_record(ssh_msg_channel_window_adjust);
+?wr_record(ssh_msg_channel_data);
+?wr_record(ssh_msg_channel_extended_data);
+?wr_record(ssh_msg_channel_eof);
+?wr_record(ssh_msg_channel_close);
+?wr_record(ssh_msg_channel_request);
+?wr_record(ssh_msg_channel_success);
+?wr_record(ssh_msg_channel_failure);
+
+wr_record(R) -> io_lib:format('~p~n',[R]).
+
+
+wr_record(T, Fs, BL) when is_tuple(T) ->
+    wr_record(tuple_to_list(T), Fs, BL);
+wr_record([Name|Values], Fields, BlackL) ->
+    W = case Fields of
+	    [] -> 0;
+	    _ -> lists:max([length(atom_to_list(F)) || F<-Fields])
+	end,
+    [io_lib:format("~p:~n",[string:to_upper(atom_to_list(Name))])
+     | [io_lib:format("  ~*p: ~p~n",[W,Tag,Value]) || {Tag,Value} <- lists:zip(Fields,Values),
+						      not lists:member(Tag,BlackL)
+       ]
+    ].
diff --git a/lib/ssh/src/ssh_file.erl b/lib/ssh/src/ssh_file.erl
index f115a32710..216f65f33a 100644
--- a/lib/ssh/src/ssh_file.erl
+++ b/lib/ssh/src/ssh_file.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2005-2012. All Rights Reserved.
+%% Copyright Ericsson AB 2005-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
@@ -42,7 +43,28 @@
 -define(PERM_644, 8#644).
 
 
-%% API
+%%% API
+
+%%% client
+-spec add_host_key(string(),
+		   public_key:public_key(),
+		   proplists:proplist()) -> ok | {error,term()}.
+
+-spec is_host_key(public_key:public_key(),
+		  string(),
+		  ssh_client_key_api:algorithm(),
+		  proplists:proplist()) -> boolean().
+
+-spec user_key(ssh_client_key_api:algorithm(),
+	       proplists:proplist()) -> {ok, public_key:private_key()} | {error,term()}.
+
+%%% server
+-spec host_key(ssh_server_key_api:algorithm(),
+	       proplists:proplist()) ->  {ok, public_key:private_key()} | {error,term()}.
+
+-spec is_auth_key(public_key:public_key(),
+		  string(), proplists:proplist()) -> boolean().
+
 
 %% Used by server
 host_key(Algorithm, Opts) ->
@@ -51,8 +73,20 @@ host_key(Algorithm, Opts) ->
     %% so probably we could hardcod Password = ignore, but
     %% we keep it as an undocumented option for now.
     Password = proplists:get_value(identity_pass_phrase(Algorithm), Opts, ignore),
-    decode(File, Password).
-
+    case decode(File, Password) of
+	{ok,Key} ->
+	    case {Key,Algorithm} of
+		{#'RSAPrivateKey'{}, 'ssh-rsa'} -> {ok,Key};
+		{#'DSAPrivateKey'{}, 'ssh-dss'} -> {ok,Key};
+		{#'ECPrivateKey'{parameters = {namedCurve, ?'secp256r1'}}, 'ecdsa-sha2-nistp256'} -> {ok,Key};
+		{#'ECPrivateKey'{parameters = {namedCurve, ?'secp384r1'}}, 'ecdsa-sha2-nistp384'} -> {ok,Key};
+		{#'ECPrivateKey'{parameters = {namedCurve, ?'secp521r1'}}, 'ecdsa-sha2-nistp521'} -> {ok,Key};
+		_ -> 
+		    {error,bad_keytype_in_file}
+	    end;
+	Other ->
+	    Other
+    end.
 
 is_auth_key(Key, User,Opts) ->
     case lookup_user_key(Key, User, Opts) of
@@ -65,7 +99,7 @@ is_auth_key(Key, User,Opts) ->
 
 %% Used by client
 is_host_key(Key, PeerName, Algorithm, Opts) ->
-    case lookup_host_key(PeerName, Algorithm, Opts) of
+    case lookup_host_key(Key, PeerName, Algorithm, Opts) of
 	{ok, Key} ->
 	    true;
 	_ ->
@@ -80,16 +114,15 @@ user_key(Algorithm, Opts) ->
 
 %% Internal functions %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 
-file_base_name('ssh-rsa') ->
-    "ssh_host_rsa_key";
-file_base_name('ssh-dss') ->
-    "ssh_host_dsa_key";
-file_base_name(_) ->
-    "ssh_host_key".
+file_base_name('ssh-rsa'            ) -> "ssh_host_rsa_key";
+file_base_name('ssh-dss'            ) -> "ssh_host_dsa_key";
+file_base_name('ecdsa-sha2-nistp256') -> "ssh_host_ecdsa_key";
+file_base_name('ecdsa-sha2-nistp384') -> "ssh_host_ecdsa_key";
+file_base_name('ecdsa-sha2-nistp521') -> "ssh_host_ecdsa_key";
+file_base_name(_                    ) -> "ssh_host_key".
 
 decode(File, Password) ->
-    try 
-	{ok, decode_ssh_file(read_ssh_file(File), Password)}
+    try {ok, decode_ssh_file(read_ssh_file(File), Password)}
     catch 
 	throw:Reason ->
 	    {error, Reason};
@@ -121,9 +154,9 @@ decode_ssh_file(Pem, Password) ->
 %% return {ok, Key(s)} or {error, not_found}
 %%
 
-lookup_host_key(Host, Alg, Opts) ->
+lookup_host_key(KeyToMatch, Host, Alg, Opts) ->
     Host1 = replace_localhost(Host),
-    do_lookup_host_key(Host1, Alg, Opts).
+    do_lookup_host_key(KeyToMatch, Host1, Alg, Opts).
 	    
 
 add_host_key(Host, Key, Opts) ->
@@ -204,40 +237,43 @@ replace_localhost("localhost") ->
 replace_localhost(Host) ->
     Host.
 
-do_lookup_host_key(Host, Alg, Opts) ->
+do_lookup_host_key(KeyToMatch, Host, Alg, Opts) ->
     case file:open(file_name(user, "known_hosts", Opts), [read, binary]) of
 	{ok, Fd} ->
-	    Res = lookup_host_key_fd(Fd, Host, Alg),
+	    Res = lookup_host_key_fd(Fd, KeyToMatch, Host, Alg),
 	    file:close(Fd),
-	    {ok, Res};
-	{error, enoent} -> {error, not_found};
-	Error -> Error
+	    Res;
+	{error, enoent} ->
+	    {error, not_found};
+	Error ->
+	    Error
     end.
 
-identity_key_filename('ssh-dss') ->
-    "id_dsa";
-identity_key_filename('ssh-rsa') ->
-    "id_rsa".
-
-identity_pass_phrase("ssh-dss") ->
-    dsa_pass_phrase;
-identity_pass_phrase('ssh-dss') ->
-    dsa_pass_phrase;
-identity_pass_phrase('ssh-rsa') ->
-    rsa_pass_phrase;
-identity_pass_phrase("ssh-rsa") ->
-    rsa_pass_phrase.
-
-lookup_host_key_fd(Fd, Host, KeyType) ->
+identity_key_filename('ssh-dss'            ) -> "id_dsa";
+identity_key_filename('ssh-rsa'            ) -> "id_rsa";
+identity_key_filename('ecdsa-sha2-nistp256') -> "id_ecdsa";
+identity_key_filename('ecdsa-sha2-nistp384') -> "id_ecdsa";
+identity_key_filename('ecdsa-sha2-nistp521') -> "id_ecdsa".
+
+identity_pass_phrase("ssh-dss"       ) -> dsa_pass_phrase;
+identity_pass_phrase("ssh-rsa"       ) -> rsa_pass_phrase;
+identity_pass_phrase("ecdsa-sha2-"++_) -> ecdsa_pass_phrase;
+identity_pass_phrase(P) when is_atom(P) -> 
+    identity_pass_phrase(atom_to_list(P)).
+    
+lookup_host_key_fd(Fd, KeyToMatch, Host, KeyType) ->
     case io:get_line(Fd, '') of
 	eof ->
 	    {error, not_found};
+	{error,Error} ->
+	    %% Rare... For example NFS errors
+	    {error,Error};
 	Line ->
 	    case ssh_decode_line(Line, known_hosts) of
 		[{Key, Attributes}] ->
-		    handle_host(Fd, Host, proplists:get_value(hostnames, Attributes), Key, KeyType);
+		    handle_host(Fd, KeyToMatch, Host, proplists:get_value(hostnames, Attributes), Key, KeyType);
 		[] ->
-		    lookup_host_key_fd(Fd, Host, KeyType)
+		    lookup_host_key_fd(Fd, KeyToMatch, Host, KeyType)
 	    end
     end.
 
@@ -248,13 +284,13 @@ ssh_decode_line(Line, Type) ->
 	    []
     end.
 
-handle_host(Fd, Host, HostList, Key, KeyType) ->
+handle_host(Fd, KeyToMatch, Host, HostList, Key, KeyType) ->
     Host1 = host_name(Host),
-    case lists:member(Host1, HostList) and key_match(Key, KeyType) of
-	true ->
-	    Key;
-	false ->
-	    lookup_host_key_fd(Fd, Host, KeyType)
+    case lists:member(Host1, HostList) andalso key_match(Key, KeyType) of
+	true when KeyToMatch == Key ->
+	    {ok,Key};
+	_ ->
+	    lookup_host_key_fd(Fd, KeyToMatch, Host, KeyType)
     end.
 
 host_name(Atom) when is_atom(Atom) ->
@@ -266,6 +302,13 @@ key_match(#'RSAPublicKey'{}, 'ssh-rsa') ->
     true;
 key_match({_, #'Dss-Parms'{}}, 'ssh-dss') ->
     true;
+key_match({#'ECPoint'{},{namedCurve,Curve}}, Alg) ->
+    case atom_to_list(Alg) of
+	"ecdsa-sha2-"++IdS ->
+	    Curve == public_key:ssh_curvename2oid(list_to_binary(IdS));
+	_ ->
+	    false
+    end;
 key_match(_, _) ->
     false.
 
@@ -292,6 +335,9 @@ lookup_user_key_fd(Fd, Key) ->
     case io:get_line(Fd, '') of
 	eof ->
 	    {error, not_found};
+	{error,Error} ->
+	    %% Rare... For example NFS errors
+	    {error,Error};
 	Line ->
 	    case ssh_decode_line(Line, auth_keys) of
 		[{AuthKey, _}] ->
@@ -311,9 +357,26 @@ is_auth_key(Key, Key) ->
 is_auth_key(_,_) -> 
     false.
 
-default_user_dir()->
-    {ok,[[Home|_]]} = init:get_argument(home),
+
+default_user_dir() ->
+    try
+	default_user_dir(os:getenv("HOME"))
+    catch
+	_:_ ->
+	    default_user_dir(init:get_argument(home))
+    end.
+
+default_user_dir({ok,[[Home|_]]}) ->
+    default_user_dir(Home);
+default_user_dir(Home) when is_list(Home) ->
     UserDir = filename:join(Home, ".ssh"),
     ok = filelib:ensure_dir(filename:join(UserDir, "dummy")),
-    ok = file:change_mode(UserDir, ?PERM_700),
+    {ok,Info} = file:read_file_info(UserDir),
+    #file_info{mode=Mode} = Info,
+    case (Mode band 8#777) of
+	?PERM_700 ->
+	    ok;
+	_Other ->
+	    ok = file:change_mode(UserDir, ?PERM_700)
+    end,
     UserDir.
diff --git a/lib/ssh/src/ssh_info.erl b/lib/ssh/src/ssh_info.erl
new file mode 100644
index 0000000000..0c24c09887
--- /dev/null
+++ b/lib/ssh/src/ssh_info.erl
@@ -0,0 +1,336 @@
+%%
+%% %CopyrightBegin%
+%%
+%% Copyright Ericsson AB 2008-2015. All Rights Reserved.
+%%
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
+%%
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
+%%
+%% %CopyrightEnd%
+%%
+
+%%
+%%----------------------------------------------------------------------
+%% Purpose: Print some info of a running ssh aplication.
+%%----------------------------------------------------------------------
+
+-module(ssh_info).
+
+-export([print/0,
+	 print/1,
+	 string/0,
+	 collect_pids/0
+	]).
+
+-include("ssh_connect.hrl").
+
+print() ->
+    io:format("~s", [string()]).
+
+print(File) when is_list(File) ->
+    {ok,D} = file:open(File, [write]),
+    print(D),
+    file:close(D);
+print(D) ->
+    io:format(D, "~s", [string()]).
+
+string() ->
+    try supervisor:which_children(ssh_sup)
+    of
+	_ ->
+	    [io_lib:nl(),
+	     print_general(),
+	     io_lib:nl(),
+	     underline("Client part", $=),
+	     print_clients(),
+	     io_lib:nl(),
+	     underline("Server part", $=),
+	     print_servers(),
+	     io_lib:nl(),
+	     underline("Supervisors", $=),
+	     walk_sups(ssh_sup),
+	     io_lib:nl()]
+    catch
+	_:_ ->
+	    io_lib:format("Ssh not found~n",[])
+    end.
+
+
+%%%================================================================
+-define(INDENT, "    ").
+
+print_general() ->
+    {_Name, Slogan, Ver} = lists:keyfind(ssh,1,application:which_applications()),
+    [underline(io_lib:format("~s  ~s", [Slogan, Ver]), $=),
+     io_lib:format('This printout is generated ~s. ~n',[datetime()])
+    ].
+
+print_clients() ->
+    try
+	lists:map(fun print_client/1,
+		  supervisor:which_children(sshc_sup))
+    catch
+	C:E ->
+	    io_lib:format('***print_clients FAILED: ~p:~p~n',[C,E])
+    end.
+
+print_client({undefined,Pid,supervisor,[ssh_connection_handler]}) ->
+    {{Local,Remote},_Str} = ssh_connection_handler:get_print_info(Pid),
+    [io_lib:format(?INDENT"Local: ~s  Remote: ~s  ConnectionRef = ~p~n",
+		   [fmt_host_port(Local), fmt_host_port(Remote), Pid]),
+     case channels(Pid) of
+	 {ok,Channels=[_|_]} ->
+	     [print_ch(ChPid) || #channel{user=ChPid} <- Channels];
+	_ ->
+	    io_lib:format(?INDENT?INDENT?INDENT"No channels~n",[])
+     end];
+
+print_client(Other) ->
+    io_lib:format("    [[Other 1: ~p]]~n",[Other]).
+
+
+%%%================================================================
+print_servers() ->
+    try
+	lists:map(fun print_server/1,
+		  supervisor:which_children(sshd_sup))
+    catch
+	C:E ->
+	    io_lib:format('***print_servers FAILED: ~p:~p~n',[C,E])
+    end.
+
+
+print_server({{server,ssh_system_sup,LocalHost,LocalPort,Profile},Pid,supervisor,[ssh_system_sup]}) when is_pid(Pid) ->
+    Children = supervisor:which_children(Pid),
+    [io_lib:format(?INDENT"Listen: ~s (~p children) Profile ~p",[fmt_host_port({LocalHost,LocalPort}),
+								 ssh_acceptor:number_of_connections(Pid),
+								 Profile]),
+     case [AccPid 
+	   || {{ssh_acceptor_sup,_LocalHost,_LocalPort,_Profile}, AccPid, supervisor, [ssh_acceptor_sup]} 
+		  <- Children] of
+	 AcceptorPids = [_|_] ->
+	     [io_lib:format("  [Acceptor Pid", []),
+	      [io_lib:format(" ~p",[AccPid]) || AccPid <- AcceptorPids],
+	      io_lib:format("]~n", [])
+	     ];
+	 [] ->
+	     io_lib:nl()
+     end,
+     lists:map(fun print_system_sup/1,
+	       supervisor:which_children(Pid))
+    ].
+
+
+print_system_sup({Ref,Pid,supervisor,[ssh_subsystem_sup]}) when is_reference(Ref),
+								is_pid(Pid) ->
+    lists:map(fun print_channels/1,
+		  supervisor:which_children(Pid));
+
+print_system_sup({{ssh_acceptor_sup,_LocalHost,_LocalPort,_Profile}, Pid, supervisor, [ssh_acceptor_sup]}) when is_pid(Pid) ->
+    [].
+
+
+
+print_channels({{server,ssh_channel_sup,_,_},Pid,supervisor,[ssh_channel_sup]}) when is_pid(Pid) ->
+    Children =  supervisor:which_children(Pid),
+    ChannelPids = [P || {R,P,worker,[ssh_channel]} <- Children,
+			is_pid(P),
+			is_reference(R)],
+    case ChannelPids of
+	[] -> io_lib:format(?INDENT?INDENT"No channels~n",[]);
+	[Ch1Pid|_] ->
+	    {{ConnManager,_}, _Str} = ssh_channel:get_print_info(Ch1Pid),
+	    {{_,Remote},_} = ssh_connection_handler:get_print_info(ConnManager),
+	    [io_lib:format(?INDENT?INDENT"Remote: ~s ConnectionRef = ~p~n",[fmt_host_port(Remote),ConnManager]),
+	     lists:map(fun print_ch/1, ChannelPids)
+	    ]
+    end;
+print_channels({{server,ssh_connection_sup,_,_},Pid,supervisor,[ssh_connection_sup]}) when is_pid(Pid) ->
+    []. % The supervisor of the connections socket owning process
+
+print_ch(Pid) ->
+    try
+	{{ConnManager,ChannelID}, Str} = ssh_channel:get_print_info(Pid),
+	{_LocalRemote,StrM} = ssh_connection_handler:get_print_info(ConnManager),
+	io_lib:format(?INDENT?INDENT?INDENT"ch ~p ~p: ~s ~s~n",[ChannelID, Pid, StrM, Str])
+    catch
+	C:E ->
+	    io_lib:format('****print_ch FAILED for ChanPid ~p: ~p:~p~n',[Pid, C, E])
+    end.
+
+
+%%%================================================================
+-define(inc(N), (N+4)).
+
+walk_sups(StartPid) ->
+    io_lib:format("Start at ~p, ~s.~n",[StartPid,dead_or_alive(StartPid)]),
+    walk_sups(children(StartPid), _Indent=?inc(0)).
+
+walk_sups([H={_,Pid,_,_}|T], Indent) ->
+    [indent(Indent),
+     io_lib:format('~200p  ~p is ~s~n',[H,Pid,dead_or_alive(Pid)]),
+     case H of
+	 {_,_,supervisor,[ssh_connection_handler]} -> "";
+	 {_,Pid,supervisor,_} -> walk_sups(children(Pid), ?inc(Indent));
+	 _ -> ""
+     end,
+     walk_sups(T, Indent)
+    ];
+walk_sups([], _) ->
+    "".
+
+dead_or_alive(Name) when is_atom(Name) ->
+    case whereis(Name) of
+	undefined ->
+	    "**UNDEFINED**";
+	Pid ->
+	    dead_or_alive(Pid)
+    end;
+dead_or_alive(Pid) when is_pid(Pid) ->
+    case process_info(Pid) of
+	undefined -> "**DEAD**";
+	_ -> "alive"
+    end.
+
+indent(I) -> io_lib:format('~*c',[I,$ ]).
+
+
+children(Pid) ->
+    Parent = self(),
+    Helper = spawn(fun() ->
+			   Parent ! {self(),supervisor:which_children(Pid)}
+		   end),
+    receive
+	{Helper,L} when is_list(L) ->
+	    L
+    after
+	2000 ->
+	    catch exit(Helper, kill),
+	    []
+    end.
+
+is_connection_handler(Pid) ->
+    try
+	{ssh_connection_handler,init,_} =
+	    proplists:get_value(
+	      '$initial_call',
+	      proplists:get_value(
+		dictionary,
+		process_info(Pid, [dictionary])))
+    of
+	_ -> true
+
+    catch
+	_:_ ->
+	    false
+    end.
+
+channels(Pid) ->
+    case is_connection_handler(Pid) of
+	true ->
+	    ssh_connection_handler:info(Pid,all);
+	false ->
+	    false
+    end.
+
+%%%================================================================
+underline(Str, LineChar) ->
+    io_lib:format('~s~n~*c~n',[Str, lists:flatlength(Str), LineChar]).
+
+
+datetime() ->
+    {{YYYY,MM,DD}, {H,M,S}} = calendar:now_to_universal_time(erlang:timestamp()),
+    lists:flatten(io_lib:format('~4w-~2..0w-~2..0w ~2..0w:~2..0w:~2..0w UTC',[YYYY,MM,DD, H,M,S])).
+
+
+fmt_host_port({{A,B,C,D},Port}) -> io_lib:format('~p.~p.~p.~p:~p',[A,B,C,D,Port]);
+fmt_host_port({Host,Port}) -> io_lib:format('~s:~p',[Host,Port]).
+
+%%%################################################################
+collect_pids() -> collect_pids(ssh_sup).
+
+collect_pids(P) ->
+    Collector = pcollect_pids(P, spawn(fun init_collector/0)),
+    Collector ! {get_values,self()},
+    receive
+	{values,Values} ->
+	    Values
+    end.
+
+%%%----------------
+pcollect_pids(undefined, Collector) ->
+    Collector;
+
+pcollect_pids(A, Collector) when is_atom(A) ->
+    pcollect_pids(whereis(A), Collector);
+
+pcollect_pids(Pid, Collector) when is_pid(Pid) ->
+    Collector ! {expect,Pid},
+    spawn(fun() ->
+		  lists:foreach(
+		    fun(P2) ->
+			    pcollect_pids(P2,Collector)
+		    end, children(Pid)),
+		  Collector ! {value,Pid,Pid}
+	  end),
+    Collector;
+
+pcollect_pids({Ref,Pid,supervisor,_}, Collector) when is_pid(Pid),
+						      is_reference(Ref) ->
+    pcollect_pids(Pid, Collector);
+
+pcollect_pids({sshc_sup,Pid,supervisor,_}, Collector) when is_pid(Pid) ->
+    pcollect_pids(Pid, Collector);
+
+pcollect_pids({sshd_sup,Pid,supervisor,_}, Collector) when is_pid(Pid) ->
+    pcollect_pids(Pid, Collector);
+
+pcollect_pids({{ssh_acceptor_sup,_,_,_},Pid,supervisor,_}, Collector) when is_pid(Pid) ->
+    pcollect_pids(Pid, Collector);
+
+pcollect_pids({{server,_,_,_},Pid,supervisor,_}, Collector) when is_pid(Pid) ->
+    pcollect_pids(Pid, Collector);
+
+pcollect_pids({{server,_,_,_,_},Pid,supervisor,_}, Collector) when is_pid(Pid) ->
+    pcollect_pids(Pid, Collector);
+
+pcollect_pids({undefined,Pid,supervisor,[ssh_connection_handler]}, Collector) ->
+    Collector ! {value,Pid,Pid},
+    case channels(Pid) of
+	{ok,L} ->
+	    [Collector!{value,P,P} || #channel{user=P} <- L];
+	_ ->
+	    ok
+    end,
+    Collector;
+
+pcollect_pids({_,Pid,_,_}, Collector) when is_pid(Pid) ->
+    Collector ! {value,Pid,Pid},
+    Collector;
+
+pcollect_pids(_, Collector) ->
+    Collector.
+
+%%%----------------
+init_collector() ->
+    loop_collector([],[]).
+
+loop_collector(Expects, Values) ->
+    receive
+	{expect, Ref} ->
+	    loop_collector([Ref|Expects], Values);
+	{value, Ref, Val} ->
+	    loop_collector(Expects--[Ref], [Val|Values]);
+	{get_values, From} when Expects==[] ->
+%%				Values=/=[] ->
+	    From ! {values,Values}
+    end.
diff --git a/lib/ssh/src/ssh_io.erl b/lib/ssh/src/ssh_io.erl
index 01fc713569..026d0f6151 100644
--- a/lib/ssh/src/ssh_io.erl
+++ b/lib/ssh/src/ssh_io.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2005-2012. All Rights Reserved.
+%% Copyright Ericsson AB 2005-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
@@ -24,7 +25,6 @@
 -module(ssh_io).
 
 -export([yes_no/2, read_password/2, read_line/2, format/2]).
--import(lists, [reverse/1]).
 -include("ssh.hrl").
 
 read_line(Prompt, Ssh) ->
@@ -74,14 +74,18 @@ read_password(Prompt, Ssh) ->
 listify(A) when is_atom(A) ->
     atom_to_list(A);
 listify(L) when is_list(L) ->
-    L.
+    L;
+listify(B) when is_binary(B)  ->
+    binary_to_list(B).
 
 format(Fmt, Args) ->
     io:format(Fmt, Args).
 
 
 trim(Line) when is_list(Line) ->
-    reverse(trim1(reverse(trim1(Line))));
+    lists:reverse(trim1(lists:reverse(trim1(Line))));
+trim(Line) when is_binary(Line) ->
+    trim(unicode:characters_to_list(Line));
 trim(Other) -> Other.
 
 trim1([$\s|Cs]) -> trim(Cs);
diff --git a/lib/ssh/src/ssh_math.erl b/lib/ssh/src/ssh_math.erl
deleted file mode 100644
index 569c1cb58d..0000000000
--- a/lib/ssh/src/ssh_math.erl
+++ /dev/null
@@ -1,41 +0,0 @@
-%%
-%% %CopyrightBegin%
-%%
-%% Copyright Ericsson AB 2005-2013. All Rights Reserved.
-%%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
-%%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
-%%
-%% %CopyrightEnd%
-%%
-
-%%
-
-%%% Description: SSH math utilities
-
--module(ssh_math).
-
--export([ipow/3]).
-	 
-%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-%%
-%% INTEGER utils
-%%
-%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-
-%% calculate A^B mod M
-ipow(A, B, M) when M > 0, B >= 0 ->
-    crypto:bytes_to_integer(crypto:mod_pow(A, B, M)).
-
-
-
-
-
diff --git a/lib/ssh/src/ssh_message.erl b/lib/ssh/src/ssh_message.erl
new file mode 100644
index 0000000000..562f040477
--- /dev/null
+++ b/lib/ssh/src/ssh_message.erl
@@ -0,0 +1,579 @@
+%%
+%% %CopyrightBegin%
+%%
+%% Copyright Ericsson AB 2013-2016. All Rights Reserved.
+%%
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
+%%
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
+%%
+%% %CopyrightEnd%
+%%
+
+%%
+
+%%------------------------------------------------------------------
+-module(ssh_message).
+
+-include_lib("public_key/include/public_key.hrl").
+
+-include("ssh.hrl").
+-include("ssh_connect.hrl").
+-include("ssh_auth.hrl").
+-include("ssh_transport.hrl").
+
+-export([encode/1, decode/1, decode_keyboard_interactive_prompts/2]).
+
+-define('2bin'(X), (if is_binary(X) -> X;
+		       is_list(X) -> list_to_binary(X);
+		       X==undefined -> <<>>
+		    end) ).
+
+-define('E...'(X),    ?'2bin'(X)/binary ).
+-define(Eboolean(X),  ?BOOLEAN(case X of
+				   true -> ?TRUE;
+				   false -> ?FALSE
+			       end) ).
+-define(Ebyte(X),        ?BYTE(X) ).
+-define(Euint32(X),      ?UINT32(X) ).
+-define(Estring(X),      ?STRING(?'2bin'(X)) ).
+-define(Estring_utf8(X), ?string_utf8(X)/binary ).
+-define(Ename_list(X),   ?STRING(ssh_bits:name_list(X)) ).
+-define(Empint(X),       (ssh_bits:mpint(X))/binary ).
+-define(Ebinary(X),      ?STRING(X) ).
+
+ucl(B) ->
+    try unicode:characters_to_list(B) of
+	L when is_list(L) -> L;
+	{error,_Matched,Rest} -> throw({error,{bad_unicode,Rest}})
+    catch
+	_:_ -> throw({error,bad_unicode})
+    end.
+
+-define(unicode_list(B), ucl(B)).
+
+encode(#ssh_msg_global_request{
+	  name = Name,
+	  want_reply = Bool,
+	  data = Data}) ->
+    <<?Ebyte(?SSH_MSG_GLOBAL_REQUEST), ?Estring(Name), ?Eboolean(Bool), ?'E...'(Data)>>;
+
+encode(#ssh_msg_request_success{data = Data}) ->
+    <<?Ebyte(?SSH_MSG_REQUEST_SUCCESS), Data/binary>>;
+
+encode(#ssh_msg_request_failure{}) ->
+    <<?Ebyte(?SSH_MSG_REQUEST_FAILURE)>>;
+
+encode(#ssh_msg_channel_open{
+	  channel_type = Type,
+	  sender_channel = Sender,
+	  initial_window_size = Window,
+	  maximum_packet_size = Max,
+	  data = Data
+	 }) ->
+    <<?Ebyte(?SSH_MSG_CHANNEL_OPEN), ?Estring(Type), ?Euint32(Sender), ?Euint32(Window), ?Euint32(Max), ?'E...'(Data)>>;
+
+encode(#ssh_msg_channel_open_confirmation{
+	  recipient_channel = Recipient,
+	  sender_channel = Sender,
+	  initial_window_size = InitWindowSize,
+	  maximum_packet_size = MaxPacketSize,
+	  data = Data
+	 }) ->
+    <<?Ebyte(?SSH_MSG_CHANNEL_OPEN_CONFIRMATION),
+      ?Euint32(Recipient), ?Euint32(Sender), ?Euint32(InitWindowSize), ?Euint32(MaxPacketSize),
+      ?'E...'(Data)>>;
+
+encode(#ssh_msg_channel_open_failure{
+	  recipient_channel = Recipient,
+	  reason = Reason,
+	  description = Desc,
+	  lang = Lang
+	 }) ->
+    <<?Ebyte(?SSH_MSG_CHANNEL_OPEN_FAILURE), ?Euint32(Recipient),?Euint32(Reason), ?Estring(Desc), ?Estring(Lang)>>;
+
+encode(#ssh_msg_channel_window_adjust{
+	  recipient_channel = Recipient,
+	  bytes_to_add = Bytes
+	 }) ->
+    <<?Ebyte(?SSH_MSG_CHANNEL_WINDOW_ADJUST), ?Euint32(Recipient), ?Euint32(Bytes)>>;
+
+encode(#ssh_msg_channel_data{
+	  recipient_channel = Recipient,
+	  data = Data
+	 }) ->
+   <<?Ebyte(?SSH_MSG_CHANNEL_DATA), ?Euint32(Recipient), ?Ebinary(Data)>>;
+
+encode(#ssh_msg_channel_extended_data{
+	  recipient_channel = Recipient,
+	  data_type_code = DataType,
+	  data = Data
+	 }) ->
+    <<?Ebyte(?SSH_MSG_CHANNEL_EXTENDED_DATA), ?Euint32(Recipient), ?Euint32(DataType), ?Ebinary(Data)>>;
+
+encode(#ssh_msg_channel_eof{recipient_channel = Recipient
+			   }) ->
+    <<?Ebyte(?SSH_MSG_CHANNEL_EOF), ?Euint32(Recipient)>>;
+
+encode(#ssh_msg_channel_close{
+	   recipient_channel = Recipient
+	  }) ->
+    <<?Ebyte(?SSH_MSG_CHANNEL_CLOSE), ?Euint32(Recipient)>>;
+
+encode(#ssh_msg_channel_request{
+	  recipient_channel = Recipient,
+	  request_type = Type,
+	  want_reply = Bool,
+	  data  = Data
+	 }) ->
+    <<?Ebyte(?SSH_MSG_CHANNEL_REQUEST), ?Euint32(Recipient), ?Estring(Type), ?Eboolean(Bool), ?'E...'(Data)>>;
+
+encode(#ssh_msg_channel_success{
+	  recipient_channel = Recipient
+	 }) ->
+    <<?Ebyte(?SSH_MSG_CHANNEL_SUCCESS), ?Euint32(Recipient)>>;
+
+encode(#ssh_msg_channel_failure{
+	  recipient_channel = Recipient
+	 }) ->
+    <<?Ebyte(?SSH_MSG_CHANNEL_FAILURE), ?Euint32(Recipient)>>;
+
+encode(#ssh_msg_userauth_request{
+	  user = User,
+	  service = Service,
+	  method = Method,
+	  data = Data
+	 }) ->
+    <<?Ebyte(?SSH_MSG_USERAUTH_REQUEST), ?Estring_utf8(User), ?Estring(Service), ?Estring(Method), ?'E...'(Data)>>;
+
+encode(#ssh_msg_userauth_failure{
+	  authentications = Auths,
+	  partial_success = Bool
+	 }) ->
+    <<?Ebyte(?SSH_MSG_USERAUTH_FAILURE), ?Estring(Auths), ?Eboolean(Bool)>>;
+
+encode(#ssh_msg_userauth_success{}) ->
+    <<?Ebyte(?SSH_MSG_USERAUTH_SUCCESS)>>;
+
+encode(#ssh_msg_userauth_banner{
+       message = Banner,
+       language = Lang
+      }) ->
+    <<?Ebyte(?SSH_MSG_USERAUTH_BANNER), ?Estring_utf8(Banner), ?Estring(Lang)>>;
+
+encode(#ssh_msg_userauth_pk_ok{
+	  algorithm_name = Alg,
+	  key_blob = KeyBlob
+	 }) ->
+    <<?Ebyte(?SSH_MSG_USERAUTH_PK_OK), ?Estring(Alg), ?Ebinary(KeyBlob)>>;
+
+encode(#ssh_msg_userauth_passwd_changereq{prompt = Prompt,
+					  languge = Lang
+					 })->
+    <<?Ebyte(?SSH_MSG_USERAUTH_PASSWD_CHANGEREQ), ?Estring_utf8(Prompt), ?Estring(Lang)>>;
+
+encode(#ssh_msg_userauth_info_request{
+	  name = Name,
+	  instruction = Inst,
+	  language_tag = Lang,
+	  num_prompts = NumPromtps,
+	  data = Data}) ->
+    <<?Ebyte(?SSH_MSG_USERAUTH_INFO_REQUEST), ?Estring_utf8(Name), ?Estring_utf8(Inst), ?Estring(Lang),
+      ?Euint32(NumPromtps), ?'E...'(Data)>>;
+
+encode(#ssh_msg_userauth_info_response{
+	  num_responses = Num,
+	  data = Data}) ->
+    lists:foldl(fun %%("", Acc) -> Acc;  % commented out since it seem wrong
+		    (Response, Acc) -> <<Acc/binary, ?Estring_utf8(Response)>>
+		end,
+		<<?Ebyte(?SSH_MSG_USERAUTH_INFO_RESPONSE), ?Euint32(Num)>>,
+		Data);
+
+encode(#ssh_msg_disconnect{
+	  code = Code,
+	  description = Desc,
+	  language = Lang
+	 }) ->
+    <<?Ebyte(?SSH_MSG_DISCONNECT), ?Euint32(Code), ?Estring_utf8(Desc), ?Estring(Lang)>>;
+
+encode(#ssh_msg_service_request{
+	  name = Service
+	 }) ->
+    <<?Ebyte(?SSH_MSG_SERVICE_REQUEST), ?Estring_utf8(Service)>>;
+
+encode(#ssh_msg_service_accept{
+	  name = Service
+	 }) ->
+    <<?Ebyte(?SSH_MSG_SERVICE_ACCEPT), ?Estring_utf8(Service)>>;
+
+encode(#ssh_msg_newkeys{}) ->
+    <<?Ebyte(?SSH_MSG_NEWKEYS)>>;
+
+encode(#ssh_msg_kexinit{
+	  cookie = Cookie,
+	  kex_algorithms = KeyAlgs,
+	  server_host_key_algorithms = HostKeyAlgs,
+	  encryption_algorithms_client_to_server = EncAlgC2S,
+	  encryption_algorithms_server_to_client = EncAlgS2C,
+	  mac_algorithms_client_to_server = MacAlgC2S,
+	  mac_algorithms_server_to_client = MacAlgS2C,
+	  compression_algorithms_client_to_server = CompAlgS2C,
+	  compression_algorithms_server_to_client = CompAlgC2S,
+	  languages_client_to_server = LangC2S,
+	  languages_server_to_client = LangS2C,
+	  first_kex_packet_follows = Bool,
+	  reserved = Reserved
+	 }) ->
+    <<?Ebyte(?SSH_MSG_KEXINIT), Cookie/binary,
+      ?Ename_list(KeyAlgs), ?Ename_list(HostKeyAlgs), ?Ename_list(EncAlgC2S), ?Ename_list(EncAlgS2C), ?Ename_list(MacAlgC2S),
+      ?Ename_list(MacAlgS2C), ?Ename_list(CompAlgS2C), ?Ename_list(CompAlgC2S), ?Ename_list(LangC2S), ?Ename_list(LangS2C),
+      ?Eboolean(Bool), ?Euint32(Reserved)>>;
+
+encode(#ssh_msg_kexdh_init{e = E}) ->
+    <<?Ebyte(?SSH_MSG_KEXDH_INIT), ?Empint(E)>>;
+
+encode(#ssh_msg_kexdh_reply{
+	  public_host_key = Key,
+	  f = F,
+	  h_sig = Signature
+	 }) ->
+    EncKey = public_key:ssh_encode(Key, ssh2_pubkey),
+    EncSign = encode_signature(Key, Signature),
+    <<?Ebyte(?SSH_MSG_KEXDH_REPLY), ?Ebinary(EncKey), ?Empint(F), ?Ebinary(EncSign)>>;
+
+encode(#ssh_msg_kex_dh_gex_request{
+	  min = Min,
+	  n = N,
+	  max = Max
+	 }) ->
+    <<?Ebyte(?SSH_MSG_KEX_DH_GEX_REQUEST), ?Euint32(Min), ?Euint32(N), ?Euint32(Max)>>;
+
+encode(#ssh_msg_kex_dh_gex_request_old{n = N}) ->
+    <<?Ebyte(?SSH_MSG_KEX_DH_GEX_REQUEST_OLD), ?Euint32(N)>>;
+
+encode(#ssh_msg_kex_dh_gex_group{p = Prime, g = Generator}) ->
+    <<?Ebyte(?SSH_MSG_KEX_DH_GEX_GROUP), ?Empint(Prime), ?Empint(Generator)>>;
+
+encode(#ssh_msg_kex_dh_gex_init{e = Public}) ->
+    <<?Ebyte(?SSH_MSG_KEX_DH_GEX_INIT), ?Empint(Public)>>;
+
+encode(#ssh_msg_kex_dh_gex_reply{
+	  %% Will be private key encode_host_key extracts only the public part!
+	  public_host_key = Key,
+	  f = F,
+	  h_sig = Signature
+	 }) ->
+    EncKey = public_key:ssh_encode(Key, ssh2_pubkey),
+    EncSign = encode_signature(Key, Signature),
+    <<?Ebyte(?SSH_MSG_KEX_DH_GEX_REPLY), ?Ebinary(EncKey), ?Empint(F), ?Ebinary(EncSign)>>;
+
+encode(#ssh_msg_kex_ecdh_init{q_c = Q_c}) ->
+    <<?Ebyte(?SSH_MSG_KEX_ECDH_INIT), ?Empint(Q_c)>>;
+
+encode(#ssh_msg_kex_ecdh_reply{public_host_key = Key, q_s = Q_s, h_sig = Sign}) ->
+    EncKey = public_key:ssh_encode(Key, ssh2_pubkey),
+    EncSign = encode_signature(Key, Sign),
+    <<?Ebyte(?SSH_MSG_KEX_ECDH_REPLY), ?Ebinary(EncKey), ?Empint(Q_s), ?Ebinary(EncSign)>>;
+
+encode(#ssh_msg_ignore{data = Data}) ->
+    <<?Ebyte(?SSH_MSG_IGNORE), ?Estring_utf8(Data)>>;
+
+encode(#ssh_msg_unimplemented{sequence = Seq}) ->
+    <<?Ebyte(?SSH_MSG_UNIMPLEMENTED), ?Euint32(Seq)>>;
+
+encode(#ssh_msg_debug{always_display = Bool,
+		      message = Msg,
+		      language = Lang}) ->
+    <<?Ebyte(?SSH_MSG_DEBUG), ?Eboolean(Bool), ?Estring_utf8(Msg), ?Estring(Lang)>>.
+
+
+%% Connection Messages
+decode(<<?BYTE(?SSH_MSG_GLOBAL_REQUEST), ?DEC_BIN(Name,__0), ?BYTE(Bool), Data/binary>>) ->
+    #ssh_msg_global_request{
+       name = Name,
+       want_reply = erl_boolean(Bool),
+       data = Data
+      };
+decode(<<?BYTE(?SSH_MSG_REQUEST_SUCCESS), Data/binary>>) ->
+    #ssh_msg_request_success{data = Data};
+decode(<<?BYTE(?SSH_MSG_REQUEST_FAILURE)>>) ->
+    #ssh_msg_request_failure{};
+decode(<<?BYTE(?SSH_MSG_CHANNEL_OPEN),
+	 ?DEC_BIN(Type,__0), ?UINT32(Sender), ?UINT32(Window), ?UINT32(Max),
+	 Data/binary>>) ->
+    #ssh_msg_channel_open{
+       channel_type = binary_to_list(Type),
+       sender_channel = Sender,
+       initial_window_size = Window,
+       maximum_packet_size = Max,
+       data = Data
+      };
+decode(<<?BYTE(?SSH_MSG_CHANNEL_OPEN_CONFIRMATION), ?UINT32(Recipient), ?UINT32(Sender),
+	 ?UINT32(InitWindowSize), ?UINT32(MaxPacketSize),
+	 Data/binary>>) ->
+    #ssh_msg_channel_open_confirmation{
+       recipient_channel = Recipient,
+       sender_channel = Sender,
+       initial_window_size = InitWindowSize,
+       maximum_packet_size = MaxPacketSize,
+       data = Data
+      };
+decode(<<?BYTE(?SSH_MSG_CHANNEL_OPEN_FAILURE),  ?UINT32(Recipient), ?UINT32(Reason),
+	 ?DEC_BIN(Desc,__0), ?DEC_BIN(Lang,__1) >> ) ->
+    #ssh_msg_channel_open_failure{
+       recipient_channel = Recipient,
+       reason = Reason,
+       description = ?unicode_list(Desc),
+       lang = Lang
+      };
+decode(<<?BYTE(?SSH_MSG_CHANNEL_WINDOW_ADJUST), ?UINT32(Recipient), ?UINT32(Bytes)>>) ->
+    #ssh_msg_channel_window_adjust{
+       recipient_channel = Recipient,
+       bytes_to_add = Bytes
+    };
+
+decode(<<?BYTE(?SSH_MSG_CHANNEL_DATA), ?UINT32(Recipient), ?DEC_BIN(Data,__0)>>) ->
+    #ssh_msg_channel_data{
+       recipient_channel = Recipient,
+       data = Data
+    };
+decode(<<?BYTE(?SSH_MSG_CHANNEL_EXTENDED_DATA), ?UINT32(Recipient), 
+	 ?UINT32(DataType), ?DEC_BIN(Data,__0)>>) ->
+    #ssh_msg_channel_extended_data{
+       recipient_channel = Recipient,
+       data_type_code = DataType,
+       data = Data
+      };
+decode(<<?BYTE(?SSH_MSG_CHANNEL_EOF), ?UINT32(Recipient)>>) ->
+    #ssh_msg_channel_eof{
+       recipient_channel = Recipient
+      };
+decode(<<?BYTE(?SSH_MSG_CHANNEL_CLOSE),  ?UINT32(Recipient)>>) ->
+    #ssh_msg_channel_close{
+       recipient_channel = Recipient
+      };
+decode(<<?BYTE(?SSH_MSG_CHANNEL_REQUEST), ?UINT32(Recipient),
+	 ?DEC_BIN(RequestType,__0), ?BYTE(Bool), Data/binary>>) ->
+    #ssh_msg_channel_request{
+       recipient_channel = Recipient,
+       request_type = ?unicode_list(RequestType),
+       want_reply = erl_boolean(Bool),
+       data  = Data
+      };
+decode(<<?BYTE(?SSH_MSG_CHANNEL_SUCCESS),  ?UINT32(Recipient)>>) ->
+    #ssh_msg_channel_success{
+       recipient_channel = Recipient
+      };
+decode(<<?BYTE(?SSH_MSG_CHANNEL_FAILURE),  ?UINT32(Recipient)>>) ->
+    #ssh_msg_channel_failure{
+       recipient_channel = Recipient
+      };
+
+%%% Auth Messages
+decode(<<?BYTE(?SSH_MSG_USERAUTH_REQUEST),
+	 ?DEC_BIN(User,__0), ?DEC_BIN(Service,__1), ?DEC_BIN(Method,__2),
+	 Data/binary>>) ->
+    #ssh_msg_userauth_request{
+       user =    ?unicode_list(User),
+       service = ?unicode_list(Service),
+       method =  ?unicode_list(Method),
+       data = Data
+      };
+
+decode(<<?BYTE(?SSH_MSG_USERAUTH_FAILURE),
+	 ?DEC_BIN(Auths,__0),
+	 ?BYTE(Bool)>>) ->
+    #ssh_msg_userauth_failure {
+       authentications = ?unicode_list(Auths),
+       partial_success = erl_boolean(Bool)
+      };
+
+decode(<<?BYTE(?SSH_MSG_USERAUTH_SUCCESS)>>) ->
+    #ssh_msg_userauth_success{};
+
+decode(<<?BYTE(?SSH_MSG_USERAUTH_BANNER), ?DEC_BIN(Banner,__0), ?DEC_BIN(Lang,__1) >>) ->
+    #ssh_msg_userauth_banner{
+       message = Banner,
+       language = Lang
+      };
+
+decode(<<?BYTE(?SSH_MSG_USERAUTH_INFO_REQUEST),
+	 ?DEC_BIN(Name,__0), ?DEC_BIN(Inst,__1), ?DEC_BIN(Lang,__2),
+	 ?UINT32(NumPromtps), Data/binary>>) ->
+    #ssh_msg_userauth_info_request{
+       name = Name,
+       instruction = Inst,
+       language_tag = Lang,
+       num_prompts = NumPromtps,
+       data = Data};
+
+%%% Unhandled message, also masked by same 1:st byte value as ?SSH_MSG_USERAUTH_INFO_REQUEST:
+decode(<<?BYTE(?SSH_MSG_USERAUTH_PASSWD_CHANGEREQ), ?DEC_BIN(Prompt,__0), ?DEC_BIN(Lang,__1) >>) ->
+    #ssh_msg_userauth_passwd_changereq{
+       prompt = Prompt,
+       languge = Lang
+      };
+
+%%% Unhandled message, also masked by same 1:st byte value as ?SSH_MSG_USERAUTH_INFO_REQUEST:
+decode(<<?BYTE(?SSH_MSG_USERAUTH_PK_OK), ?DEC_BIN(Alg,__0), KeyBlob/binary>>) ->
+    #ssh_msg_userauth_pk_ok{
+       algorithm_name = Alg,
+       key_blob = KeyBlob
+      };
+
+decode(<<?BYTE(?SSH_MSG_USERAUTH_INFO_RESPONSE), ?UINT32(Num), Data/binary>>) ->
+    #ssh_msg_userauth_info_response{
+       num_responses = Num,
+       data = Data};
+
+%%% Keyexchange messages
+decode(<<?BYTE(?SSH_MSG_KEXINIT), Cookie:128, Data/binary>>) ->
+    decode_kex_init(Data, [Cookie, ssh_msg_kexinit], 10);
+
+decode(<<"dh",?BYTE(?SSH_MSG_KEXDH_INIT), ?DEC_MPINT(E,__0)>>) ->
+    #ssh_msg_kexdh_init{e = E
+		       };
+
+decode(<<"dh", ?BYTE(?SSH_MSG_KEXDH_REPLY), ?DEC_BIN(Key,__0), ?DEC_MPINT(F,__1), ?DEC_BIN(Hashsign,__2)>>) ->
+    #ssh_msg_kexdh_reply{
+       public_host_key = public_key:ssh_decode(Key, ssh2_pubkey),
+       f = F,
+       h_sig = decode_signature(Hashsign)
+      };
+
+decode(<<?BYTE(?SSH_MSG_KEX_DH_GEX_REQUEST), ?UINT32(Min), ?UINT32(N), ?UINT32(Max)>>) ->
+    #ssh_msg_kex_dh_gex_request{
+       min = Min,
+       n = N,
+       max = Max
+      };
+
+decode(<<"dh_gex",?BYTE(?SSH_MSG_KEX_DH_GEX_REQUEST_OLD), ?UINT32(N)>>) ->
+    #ssh_msg_kex_dh_gex_request_old{
+       n = N
+      };
+
+decode(<<"dh_gex",?BYTE(?SSH_MSG_KEX_DH_GEX_GROUP), ?DEC_MPINT(Prime,__0), ?DEC_MPINT(Generator,__1) >>) ->
+    #ssh_msg_kex_dh_gex_group{
+       p = Prime,
+       g = Generator
+      };
+
+decode(<<?BYTE(?SSH_MSG_KEX_DH_GEX_INIT), ?DEC_MPINT(E,__0)>>) ->
+    #ssh_msg_kex_dh_gex_init{
+       e = E
+      };
+
+decode(<<?BYTE(?SSH_MSG_KEX_DH_GEX_REPLY), ?DEC_BIN(Key,__0), ?DEC_MPINT(F,__1), ?DEC_BIN(Hashsign,__2)>>) ->
+    #ssh_msg_kex_dh_gex_reply{
+       public_host_key = public_key:ssh_decode(Key, ssh2_pubkey),
+       f = F,
+       h_sig = decode_signature(Hashsign)
+      };
+
+decode(<<"ecdh",?BYTE(?SSH_MSG_KEX_ECDH_INIT), ?DEC_MPINT(Q_c,__0)>>) ->
+    #ssh_msg_kex_ecdh_init{
+       q_c = Q_c
+      };
+
+decode(<<"ecdh",?BYTE(?SSH_MSG_KEX_ECDH_REPLY),
+	 ?DEC_BIN(Key,__1), ?DEC_MPINT(Q_s,__2), ?DEC_BIN(Sig,__3)>>) ->
+    #ssh_msg_kex_ecdh_reply{
+       public_host_key = public_key:ssh_decode(Key, ssh2_pubkey),
+       q_s = Q_s,
+       h_sig = decode_signature(Sig)
+      };
+
+decode(<<?SSH_MSG_SERVICE_REQUEST, ?DEC_BIN(Service,__0)>>) ->
+    #ssh_msg_service_request{
+       name = ?unicode_list(Service)
+      };
+
+decode(<<?SSH_MSG_SERVICE_ACCEPT, ?DEC_BIN(Service,__0)>>) ->
+    #ssh_msg_service_accept{
+       name = ?unicode_list(Service)
+      };
+
+decode(<<?BYTE(?SSH_MSG_DISCONNECT), ?UINT32(Code), ?DEC_BIN(Desc,__0), ?DEC_BIN(Lang,__1)>>) ->
+    #ssh_msg_disconnect{
+       code = Code,
+       description = ?unicode_list(Desc),
+       language = Lang
+      };
+
+%% Accept bad disconnects from ancient openssh clients that doesn't send language tag.  Use english as a work-around.
+decode(<<?BYTE(?SSH_MSG_DISCONNECT), ?UINT32(Code), ?DEC_BIN(Desc,__0)>>) ->
+    #ssh_msg_disconnect{
+       code = Code,
+       description = ?unicode_list(Desc),
+       language = <<"en">>
+      };
+
+decode(<<?SSH_MSG_NEWKEYS>>) ->
+    #ssh_msg_newkeys{};
+
+decode(<<?BYTE(?SSH_MSG_IGNORE), ?DEC_BIN(Data,__0)>>) ->
+    #ssh_msg_ignore{data = Data};
+
+decode(<<?BYTE(?SSH_MSG_UNIMPLEMENTED), ?UINT32(Seq)>>) ->
+    #ssh_msg_unimplemented{sequence = Seq};
+
+decode(<<?BYTE(?SSH_MSG_DEBUG), ?BYTE(Bool), ?DEC_BIN(Msg,__0), ?DEC_BIN(Lang,__1)>>) ->
+    #ssh_msg_debug{always_display = erl_boolean(Bool),
+		   message = Msg,
+		   language = Lang}.
+
+%%%================================================================
+%%%
+%%% Helper functions
+%%%
+
+decode_keyboard_interactive_prompts(<<>>, Acc) ->
+    lists:reverse(Acc);
+decode_keyboard_interactive_prompts(<<?DEC_BIN(Prompt,__0), ?BYTE(Bool), Bin/binary>>,
+				    Acc) ->
+    decode_keyboard_interactive_prompts(Bin, [{Prompt, erl_boolean(Bool)} | Acc]).
+
+erl_boolean(0) ->
+    false;
+erl_boolean(1) ->
+    true.
+
+decode_kex_init(<<?BYTE(Bool), ?UINT32(X)>>, Acc, 0) ->
+    list_to_tuple(lists:reverse([X, erl_boolean(Bool) | Acc]));
+decode_kex_init(<<?BYTE(Bool)>>, Acc, 0) ->
+    %% The mandatory trailing UINT32 is missing. Assume the value it anyhow must have
+    %% See rfc 4253 7.1
+    X = 0,
+    list_to_tuple(lists:reverse([X, erl_boolean(Bool) | Acc]));
+decode_kex_init(<<?DEC_BIN(Data,__0), Rest/binary>>, Acc, N) ->
+    Names = string:tokens(?unicode_list(Data), ","),
+    decode_kex_init(Rest, [Names | Acc], N -1).
+
+
+%%%================================================================
+%%%
+%%% Signature decode/encode
+%%%
+
+decode_signature(<<?DEC_BIN(_Alg,__0), ?UINT32(_), Signature/binary>>) ->
+    Signature.
+
+
+encode_signature(#'RSAPublicKey'{}, Signature) ->
+    <<?Ebinary(<<"ssh-rsa">>), ?Ebinary(Signature)>>;
+encode_signature({_, #'Dss-Parms'{}}, Signature) ->
+    <<?Ebinary(<<"ssh-dss">>), ?Ebinary(Signature)>>;
+encode_signature({#'ECPoint'{}, {namedCurve,OID}}, Signature) ->
+    CurveName = public_key:oid2ssh_curvename(OID),
+    <<?Ebinary(<<"ecdsa-sha2-",CurveName/binary>>), ?Ebinary(Signature)>>.
+
diff --git a/lib/ssh/src/ssh_no_io.erl b/lib/ssh/src/ssh_no_io.erl
index 2c8dd92ee2..1da257ed99 100644
--- a/lib/ssh/src/ssh_no_io.erl
+++ b/lib/ssh/src/ssh_no_io.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2005-2010. All Rights Reserved.
+%% Copyright Ericsson AB 2005-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
@@ -22,18 +23,43 @@
 %%% Description: ssh_io replacement that throws on everything
 
 -module(ssh_no_io).
+-include("ssh_transport.hrl").
+
+-export([yes_no/2, read_password/2, read_line/2, format/2]).
+
+
+-spec yes_no(any(), any()) -> no_return().
+
+yes_no(_, _) ->
+    ssh_connection_handler:disconnect(
+      #ssh_msg_disconnect{code = ?SSH_DISCONNECT_SERVICE_NOT_AVAILABLE,
+			  description = "User interaction is not allowed"},
+      {no_io_allowed, yes_no}).
+
+
+-spec read_password(any(), any()) -> no_return().
+
+read_password(_, _) ->
+    ssh_connection_handler:disconnect(
+      #ssh_msg_disconnect{code = ?SSH_DISCONNECT_SERVICE_NOT_AVAILABLE,
+			  description = "User interaction is not allowed"},
+      {no_io_allowed, read_password}).
+
 
--export([yes_no/1, read_password/1, read_line/1, format/2]).
+-spec read_line(any(), any()) -> no_return().
 
-yes_no(_Prompt) ->
-    throw({no_io_allowed, yes_no}).
+read_line(_, _) ->
+    ssh_connection_handler:disconnect(
+      #ssh_msg_disconnect{code = ?SSH_DISCONNECT_SERVICE_NOT_AVAILABLE,
+			  description =  "User interaction is not allowed"},
+    {no_io_allowed, read_line}).
 
-read_password(_Prompt) ->
-    throw({no_io_allowed, read_password}).
 
-read_line(_Prompt) ->
-    throw({no_io_allowed, read_line}).
+-spec format(any(), any()) -> no_return().
 
-format(_Fmt, _Args) ->
-    throw({no_io_allowed, format}).
+format(_, _) ->
+    ssh_connection_handler:disconnect(
+      #ssh_msg_disconnect{code = ?SSH_DISCONNECT_SERVICE_NOT_AVAILABLE,
+			  description =   "User interaction is not allowed"},
+      {no_io_allowed, format}).
     
diff --git a/lib/ssh/src/ssh_server_key.erl b/lib/ssh/src/ssh_server_key.erl
index 8140114990..2ce0c7e3fe 100644
--- a/lib/ssh/src/ssh_server_key.erl
+++ b/lib/ssh/src/ssh_server_key.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2011-2012. All Rights Reserved.
+%% Copyright Ericsson AB 2011-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
diff --git a/lib/ssh/src/ssh_server_key_api.erl b/lib/ssh/src/ssh_server_key_api.erl
index 4fd660ecb5..3f1b886fa7 100644
--- a/lib/ssh/src/ssh_server_key_api.erl
+++ b/lib/ssh/src/ssh_server_key_api.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2011-2012. All Rights Reserved.
+%% Copyright Ericsson AB 2011-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
@@ -22,9 +23,16 @@
 -include_lib("public_key/include/public_key.hrl").
 -include("ssh.hrl").
 
--callback host_key(Algorithm :: 'ssh-rsa'| 'ssh-dss'| atom(), DaemonOptions :: proplists:proplist()) ->
-    {ok, PrivateKey :: #'RSAPrivateKey'{}| #'DSAPrivateKey'{} |  term()} | {error, string()}.
+-export_type([algorithm/0]).
+
+-type algorithm()  :: ssh_client_key_api:algorithm().
+
+
+-callback host_key(Algorithm :: algorithm(),
+		   DaemonOptions :: proplists:proplist()) ->
+    {ok, PrivateKey :: public_key:private_key()} | {error, term()}.
 
--callback is_auth_key(PublicKey :: #'RSAPublicKey'{}| {integer(),  #'Dss-Parms'{}}| term(),
-		      User :: string(), DaemonOptions :: proplists:proplist()) ->
+-callback is_auth_key(PublicKey :: public_key:public_key(),
+		      User :: string(),
+		      DaemonOptions :: proplists:proplist()) ->
     boolean().
diff --git a/lib/ssh/src/ssh_sftp.erl b/lib/ssh/src/ssh_sftp.erl
index 10167a9223..afc2fb88ff 100644
--- a/lib/ssh/src/ssh_sftp.erl
+++ b/lib/ssh/src/ssh_sftp.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2005-2013. All Rights Reserved.
+%% Copyright Ericsson AB 2005-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
@@ -33,8 +34,8 @@
 
 -export([start_channel/1, start_channel/2, start_channel/3, stop_channel/1]).
 
--export([open/3, opendir/2, close/2, readdir/2, pread/4, read/3,
-         open/4, opendir/3, close/3, readdir/3, pread/5, read/4,
+-export([open/3, open_tar/3, opendir/2, close/2, readdir/2, pread/4, read/3,
+         open/4, open_tar/4, opendir/3, close/3, readdir/3, pread/5, read/4,
 	 apread/4, aread/3, pwrite/4, write/3, apwrite/4, awrite/3,
 	 pwrite/5, write/4, 
 	 position/3, real_path/2, read_file_info/2, get_file_info/2,
@@ -57,7 +58,8 @@
 	  rep_buf = <<>>,
 	  req_id,
 	  req_list = [],  %% {ReqId, Fun}
-	  inf   %% list of fileinf
+	  inf,   %% list of fileinf,
+	  opts
 	 }).
 
 -record(fileinf,
@@ -68,6 +70,18 @@
 	  mode
 	 }).
 
+-record(bufinf,
+	{
+	  mode,			 % read | write  (=from or to buffer by user)
+	  crypto_state,
+	  crypto_fun,            % For encode or decode depending on the mode field
+	  size = 0,		 % # bytes "before" the current buffer for the postion call
+
+	  chunksize,		 % The size of the chunks to be sent or received
+	  enc_text_buf = <<>>,	 % Encrypted text
+	  plain_text_buf = <<>>	 % Decrypted text
+	}).
+	  
 -define(FILEOP_TIMEOUT, infinity).
 
 -define(NEXT_REQID(S),
@@ -81,14 +95,38 @@
 %%====================================================================
 start_channel(Cm) when is_pid(Cm) ->
     start_channel(Cm, []);
+start_channel(Socket) when is_port(Socket) ->
+    start_channel(Socket, []);
 start_channel(Host) when is_list(Host) ->
     start_channel(Host, []).					 
+
+start_channel(Socket, Options) when is_port(Socket) ->
+    Timeout =
+	%% A mixture of ssh:connect and ssh_sftp:start_channel:
+	case proplists:get_value(connect_timeout, Options, undefined) of
+	    undefined ->
+		proplists:get_value(timeout, Options, infinity);
+	    TO ->
+		TO
+	end,
+    case ssh:connect(Socket, Options, Timeout) of
+	{ok,Cm} -> 
+	    case start_channel(Cm, Options) of
+		{ok, Pid} ->
+		    {ok, Pid, Cm};
+		Error ->
+		    Error
+	    end;
+	Error ->
+	    Error
+    end;
 start_channel(Cm, Opts) when is_pid(Cm) ->
     Timeout = proplists:get_value(timeout, Opts, infinity),
-    case ssh_xfer:attach(Cm, []) of
+    {_, ChanOpts, SftpOpts} = handle_options(Opts, [], [], []),
+    case ssh_xfer:attach(Cm, [], ChanOpts) of
 	{ok, ChannelId, Cm} -> 
 	    case ssh_channel:start(Cm, ChannelId, 
-				   ?MODULE, [Cm, ChannelId, Timeout]) of
+				   ?MODULE, [Cm, ChannelId, SftpOpts]) of
 		{ok, Pid} ->
 		    case wait_for_version_negotiation(Pid, Timeout) of
 			ok ->
@@ -97,7 +135,7 @@ start_channel(Cm, Opts) when is_pid(Cm) ->
 			    TimeOut
 		    end;
 		{error, Reason} ->
-		    {error, Reason};
+		    {error, format_channel_start_error(Reason)};
 		ignore ->
 		    {error, ignore}
 	    end;
@@ -108,11 +146,12 @@ start_channel(Cm, Opts) when is_pid(Cm) ->
 start_channel(Host, Opts) ->
     start_channel(Host, 22, Opts).
 start_channel(Host, Port, Opts) ->
-    Timeout = proplists:get_value(timeout, Opts, infinity),
-    case ssh_xfer:connect(Host, Port, proplists:delete(timeout, Opts)) of
+    {SshOpts, ChanOpts, SftpOpts} = handle_options(Opts, [], [], []),
+    Timeout = proplists:get_value(timeout, SftpOpts, infinity),
+    case ssh_xfer:connect(Host, Port, SshOpts, ChanOpts, Timeout) of
 	{ok, ChannelId, Cm} ->
 	    case ssh_channel:start(Cm, ChannelId, ?MODULE, [Cm, 
-							    ChannelId, Timeout]) of
+							    ChannelId, SftpOpts]) of
 		{ok, Pid} ->
 		    case wait_for_version_negotiation(Pid, Timeout) of
 			ok ->
@@ -121,7 +160,7 @@ start_channel(Host, Port, Opts) ->
 			    TimeOut
 		    end;
 		{error, Reason} ->
-		    {error, Reason};
+		    {error, format_channel_start_error(Reason)};
 		ignore ->
 		    {error, ignore}
 	    end;
@@ -159,6 +198,77 @@ open(Pid, File, Mode) ->
 open(Pid, File, Mode, FileOpTimeout) ->
     call(Pid, {open, false, File, Mode}, FileOpTimeout).
 
+open_tar(Pid, File, Mode) ->
+    open_tar(Pid, File, Mode, ?FILEOP_TIMEOUT).
+open_tar(Pid, File, Mode, FileOpTimeout) ->
+    case {lists:member(write,Mode),
+	  lists:member(read,Mode),
+	  Mode -- [read,write]} of
+	{true,false,[]} ->
+	    {ok,Handle} = open(Pid, File, [write], FileOpTimeout),
+	    erl_tar:init(Pid, write,
+			 fun(write, {_,Data}) ->
+				 write_to_remote_tar(Pid, Handle, to_bin(Data), FileOpTimeout);
+			    (position, {_,Pos}) -> 
+				 position(Pid, Handle, Pos, FileOpTimeout);
+			    (close, _) -> 
+				 close(Pid, Handle, FileOpTimeout)
+			 end);
+	{true,false,[{crypto,{CryptoInitFun,CryptoEncryptFun,CryptoEndFun}}]} ->
+	    {ok,SftpHandle} = open(Pid, File, [write], FileOpTimeout),
+	    BI = #bufinf{mode = write,
+			 crypto_fun = CryptoEncryptFun},
+	    {ok,BufHandle} = open_buf(Pid, CryptoInitFun, BI, FileOpTimeout),
+	    erl_tar:init(Pid, write,
+			 fun(write, {_,Data}) ->
+				 write_buf(Pid, SftpHandle, BufHandle,  to_bin(Data), FileOpTimeout);
+			    (position, {_,Pos}) ->
+				 position_buf(Pid, SftpHandle, BufHandle, Pos, FileOpTimeout);
+			    (close, _) ->
+				 {ok,#bufinf{
+					plain_text_buf = PlainBuf0,
+					enc_text_buf = EncBuf0,
+					crypto_state = CState0
+				       }}  = call(Pid, {get_bufinf,BufHandle}, FileOpTimeout),
+				 {ok,EncTextTail} = CryptoEndFun(PlainBuf0, CState0),
+				 EncTextBuf = <<EncBuf0/binary, EncTextTail/binary>>,
+				 case write(Pid, SftpHandle, EncTextBuf, FileOpTimeout) of
+				     ok ->
+					 call(Pid, {erase_bufinf,BufHandle}, FileOpTimeout),
+					 close(Pid, SftpHandle, FileOpTimeout);
+				     Other ->
+					 Other
+				 end
+			 end);
+	{false,true,[]} ->
+	    {ok,Handle} = open(Pid, File, [read,binary], FileOpTimeout),
+	    erl_tar:init(Pid, read,
+			 fun(read2, {_,Len}) ->
+				 read_repeat(Pid, Handle, Len, FileOpTimeout);
+			    (position, {_,Pos}) -> 
+				 position(Pid, Handle, Pos, FileOpTimeout);
+			    (close, _) -> 
+				 close(Pid, Handle, FileOpTimeout)
+			 end);
+	{false,true,[{crypto,{CryptoInitFun,CryptoDecryptFun}}]} ->
+	    {ok,SftpHandle} = open(Pid, File, [read,binary], FileOpTimeout),
+	    BI = #bufinf{mode = read,
+			 crypto_fun = CryptoDecryptFun},
+	    {ok,BufHandle} = open_buf(Pid, CryptoInitFun, BI, FileOpTimeout),
+	    erl_tar:init(Pid, read,
+			 fun(read2, {_,Len}) ->
+				 read_buf(Pid, SftpHandle, BufHandle, Len, FileOpTimeout);
+			    (position, {_,Pos}) -> 
+				 position_buf(Pid, SftpHandle, BufHandle, Pos, FileOpTimeout);
+			    (close, _) -> 
+				 call(Pid, {erase_bufinf,BufHandle}, FileOpTimeout),
+				 close(Pid, SftpHandle, FileOpTimeout)
+                         end);
+	_ ->
+	    {error,{illegal_mode,Mode}}
+    end.
+
+
 opendir(Pid, Path) ->
     opendir(Pid, Path, ?FILEOP_TIMEOUT).
 opendir(Pid, Path, FileOpTimeout) ->
@@ -392,7 +502,8 @@ write_file_loop(Pid, Handle, Pos, Bin, Remain, PacketSz, FileOpTimeout) ->
 %%                        
 %% Description: 
 %%--------------------------------------------------------------------
-init([Cm, ChannelId, Timeout]) ->
+init([Cm, ChannelId, Options]) ->
+    Timeout = proplists:get_value(timeout, Options, infinity),
     erlang:monitor(process, Cm),
     case ssh_connection:subsystem(Cm, ChannelId, "sftp", Timeout) of
 	success ->
@@ -401,11 +512,12 @@ init([Cm, ChannelId, Timeout]) ->
 	    {ok, #state{xf = Xf,
 			req_id = 0, 
 			rep_buf = <<>>,
-			inf = new_inf()}};
+			inf = new_inf(),
+			opts = Options}};
 	failure ->
-	    {stop, "server failed to start sftp subsystem"};
+	    {stop, {shutdown, "server failed to start sftp subsystem"}};
 	Error ->
-	    {stop, Error}
+	    {stop, {shutdown, Error}}
     end.
     
 %%--------------------------------------------------------------------
@@ -420,12 +532,12 @@ init([Cm, ChannelId, Timeout]) ->
 %%--------------------------------------------------------------------
 handle_call({{timeout, infinity}, wait_for_version_negotiation}, From,
 	    #state{xf = #ssh_xfer{vsn = undefined} = Xf} = State) ->
-    {noreply, State#state{xf = Xf#ssh_xfer{vsn = From}}}; 
+    {noreply, State#state{xf = Xf#ssh_xfer{vsn = {wait, From, undefined}}}};
 
 handle_call({{timeout, Timeout}, wait_for_version_negotiation}, From,
 	    #state{xf = #ssh_xfer{vsn = undefined} = Xf} = State) ->
-    timer:send_after(Timeout, {timeout, undefined, From}),
-    {noreply, State#state{xf = Xf#ssh_xfer{vsn = From}}}; 
+    TRef = erlang:send_after(Timeout, self(), {timeout, undefined, From}),
+    {noreply, State#state{xf = Xf#ssh_xfer{vsn = {wait, From, TRef}}}};
 
 handle_call({_, wait_for_version_negotiation}, _, State) ->
     {reply, ok, State};
@@ -442,6 +554,15 @@ handle_cast(_,State) ->
 code_change(_OldVsn, State, _Extra) ->
     {ok, State}.
 
+do_handle_call({get_bufinf,BufHandle}, _From, S=#state{inf=I0}) ->
+    {reply, dict:find(BufHandle,I0), S};
+
+do_handle_call({put_bufinf,BufHandle,B}, _From, S=#state{inf=I0}) ->
+    {reply, ok, S#state{inf=dict:store(BufHandle,B,I0)}};
+
+do_handle_call({erase_bufinf,BufHandle}, _From, S=#state{inf=I0}) ->
+    {reply, ok, S#state{inf=dict:erase(BufHandle,I0)}};
+
 do_handle_call({open, Async,FileName,Mode}, From, #state{xf = XF} = State) ->
     {Access,Flags,Attrs} = open_mode(XF#ssh_xfer.vsn, Mode),
     ReqID = State#state.req_id,
@@ -513,8 +634,7 @@ do_handle_call({pread,Async,Handle,At,Length}, From, State) ->
 			    fun({ok,Data}, State2) ->
 				    case get_mode(Handle, State2) of
 					binary -> {{ok,Data}, State2};
-					text ->
-					    {{ok,binary_to_list(Data)}, State2}
+					text -> {{ok,binary_to_list(Data)}, State2}
 				    end;
 			       (Rep, State2) -> 
 				    {Rep, State2}
@@ -535,8 +655,7 @@ do_handle_call({read,Async,Handle,Length}, From, State) ->
 			    fun({ok,Data}, State2) ->
 				    case get_mode(Handle, State2) of
 					binary -> {{ok,Data}, State2};
-					text ->
-					    {{ok,binary_to_list(Data)}, State2}
+					text -> {{ok,binary_to_list(Data)}, State2}
 				    end;
 			       (Rep, State2) -> {Rep, State2}
 			    end);
@@ -547,12 +666,7 @@ do_handle_call({read,Async,Handle,Length}, From, State) ->
 do_handle_call({pwrite,Async,Handle,At,Data0}, From, State) ->
     case lseek_position(Handle, At, State) of
 	{ok,Offset} ->
-	    Data = if 
-		       is_binary(Data0) -> 
-			   Data0;
-		       is_list(Data0) -> 
-			   list_to_binary(Data0)
-		   end,
+	    Data = to_bin(Data0),
 	    ReqID = State#state.req_id,
 	    Size = size(Data),
 	    ssh_xfer:write(?XF(State),ReqID,Handle,Offset,Data),
@@ -565,12 +679,7 @@ do_handle_call({pwrite,Async,Handle,At,Data0}, From, State) ->
 do_handle_call({write,Async,Handle,Data0}, From, State) ->
     case lseek_position(Handle, cur, State) of
 	{ok,Offset} ->
-	    Data = if 
-		       is_binary(Data0) ->
-			   Data0;
-		       is_list(Data0) ->
-			   list_to_binary(Data0)
-		   end,
+	    Data = to_bin(Data0),
 	    ReqID = State#state.req_id,
 	    Size = size(Data),
 	    ssh_xfer:write(?XF(State),ReqID,Handle,Offset,Data),
@@ -708,8 +817,9 @@ handle_ssh_msg({ssh_cm, _, {exit_status, ChannelId, Status}}, State0) ->
 %%                        
 %% Description: Handles channel messages
 %%--------------------------------------------------------------------
-handle_msg({ssh_channel_up, _, _}, #state{xf = Xf} = State) ->
-    ssh_xfer:protocol_version_request(Xf),
+handle_msg({ssh_channel_up, _, _}, #state{opts = Options, xf = Xf} = State) ->
+    Version = proplists:get_value(sftp_vsn, Options, ?SSH_SFTP_PROTOCOL_VERSION),
+    ssh_xfer:protocol_version_request(Xf, Version),
     {ok, State};
 
 %% Version negotiation timed out
@@ -755,6 +865,19 @@ terminate(_Reason, State) ->
 %%====================================================================
 %% Internal functions
 %%====================================================================
+handle_options([], Sftp, Chan, Ssh) ->
+    {Ssh, Chan, Sftp};
+handle_options([{timeout, _} = Opt | Rest], Sftp, Chan, Ssh) ->
+    handle_options(Rest, [Opt|Sftp], Chan, Ssh);
+handle_options([{sftp_vsn, _} = Opt| Rest], Sftp, Chan, Ssh) ->
+    handle_options(Rest, [Opt|Sftp], Chan, Ssh);
+handle_options([{window_size, _} = Opt| Rest], Sftp, Chan, Ssh) ->
+    handle_options(Rest, Sftp, [Opt|Chan], Ssh);
+handle_options([{packet_size, _} = Opt| Rest], Sftp, Chan, Ssh) ->
+    handle_options(Rest, Sftp, [Opt|Chan], Ssh);
+handle_options([Opt|Rest], Sftp, Chan, Ssh) ->
+    handle_options(Rest, Sftp, Chan, [Opt|Ssh]).
+
 call(Pid, Msg, TimeOut) ->
     ssh_channel:call(Pid, {{timeout, TimeOut}, Msg}, infinity).
 
@@ -769,7 +892,12 @@ do_handle_reply(#state{xf = Xf} = State,
     case Xf#ssh_xfer.vsn of
 	undefined ->
 	    ok;
-	From ->
+	{wait, From, TRef} ->
+	    if is_reference(TRef) ->
+		    erlang:cancel_timer(TRef);
+	       true ->
+		    ok
+	    end,
 	    ssh_channel:reply(From, ok)
     end,    
     State#state{xf = Xf#ssh_xfer{vsn = Version, ext = Ext}, rep_buf = Rest};
@@ -1112,5 +1240,212 @@ lseek_pos({eof, Offset}, _CurOffset, CurSize)
     end;
 lseek_pos(_, _, _) ->
     {error, einval}. 
- 
 
+%%%================================================================
+%%%
+to_bin(Data) when is_list(Data) -> list_to_binary(Data);
+to_bin(Data) when is_binary(Data) -> Data.
+
+
+read_repeat(Pid, Handle, Len, FileOpTimeout) ->
+    {ok,{_WindowSz,PacketSz}} = recv_window(Pid, FileOpTimeout),
+    read_rpt(Pid, Handle, Len, PacketSz, FileOpTimeout, <<>>).
+
+read_rpt(Pid, Handle, WantedLen, PacketSz, FileOpTimeout, Acc) when WantedLen > 0 ->
+    case read(Pid, Handle, min(WantedLen,PacketSz), FileOpTimeout) of
+	{ok, Data}  ->
+	    read_rpt(Pid, Handle, WantedLen-size(Data), PacketSz, FileOpTimeout, <<Acc/binary, Data/binary>>);
+	eof ->
+	    {ok, Acc};
+	Error ->
+	    Error
+    end;
+read_rpt(_Pid, _Handle, WantedLen, _PacketSz, _FileOpTimeout, Acc) when WantedLen >= 0 ->
+    {ok,Acc}.
+
+
+write_to_remote_tar(_Pid, _SftpHandle, <<>>, _FileOpTimeout) ->
+    ok;
+write_to_remote_tar(Pid, SftpHandle, Bin, FileOpTimeout) ->
+    {ok,{_Window,Packet}} = send_window(Pid, FileOpTimeout),
+    write_file_loop(Pid, SftpHandle, 0, Bin, size(Bin), Packet, FileOpTimeout).
+
+position_buf(Pid, SftpHandle, BufHandle, Pos, FileOpTimeout) ->
+    {ok,#bufinf{mode = Mode,
+		plain_text_buf = Buf0,
+		size = Size}} = call(Pid, {get_bufinf,BufHandle}, FileOpTimeout),
+    case Pos of
+	{cur,0} when Mode==write ->
+	    {ok,Size+size(Buf0)};
+	
+	{cur,0} when Mode==read ->
+	    {ok,Size};
+	
+	_ when Mode==read, is_integer(Pos) ->
+	    Skip = Pos-Size,
+	    if 
+		Skip < 0 ->
+		    {error, cannot_rewind};
+		Skip == 0 ->
+		    %% Optimization
+		    {ok,Pos};
+		Skip > 0 ->
+		    case read_buf(Pid, SftpHandle, BufHandle, Skip, FileOpTimeout) of
+			%% A bit innefficient to fetch the bufinf again, but there are lots of
+			%% other more important optimizations waiting....
+			{ok,_} ->
+			    {ok,Pos};
+			 Other ->
+			    Other
+		    end
+	    end;
+
+	_ ->
+	    {error,{not_yet_implemented,{pos,Pos}}}
+      end.
+
+read_buf(Pid, SftpHandle, BufHandle, WantedLen, FileOpTimeout) ->
+    {ok,{_Window,Packet}} = send_window(Pid, FileOpTimeout),
+    {ok,B0}  = call(Pid, {get_bufinf,BufHandle}, FileOpTimeout),
+    case do_the_read_buf(Pid, SftpHandle, WantedLen, Packet, FileOpTimeout, B0) of
+	{ok,ResultBin,B} ->
+	    call(Pid, {put_bufinf,BufHandle,B}, FileOpTimeout),
+	    {ok,ResultBin};
+	{error,Error} ->
+	    {error,Error};
+	{eof,B} ->
+	    call(Pid, {put_bufinf,BufHandle,B}, FileOpTimeout),
+	    eof
+      end.
+
+do_the_read_buf(_Pid, _SftpHandle, WantedLen, _Packet, _FileOpTimeout, 
+		B=#bufinf{plain_text_buf=PlainBuf0,
+			  size = Size})
+    when size(PlainBuf0) >= WantedLen ->
+    %% We already have the wanted number of bytes decoded and ready!
+    <<ResultBin:WantedLen/binary, PlainBuf/binary>> = PlainBuf0,
+    {ok,ResultBin,B#bufinf{plain_text_buf=PlainBuf,
+			   size = Size + WantedLen}};
+
+do_the_read_buf(Pid, SftpHandle, WantedLen, Packet, FileOpTimeout, 
+		B0=#bufinf{plain_text_buf = PlainBuf0,
+			   enc_text_buf = EncBuf0,
+			   chunksize = undefined
+			  })
+  when size(EncBuf0) > 0 ->
+    %% We have (at least) one decodable byte waiting for decodeing.
+    {ok,DecodedBin,B} = apply_crypto(EncBuf0, B0),
+    do_the_read_buf(Pid, SftpHandle, WantedLen, Packet, FileOpTimeout, 
+		    B#bufinf{plain_text_buf = <<PlainBuf0/binary, DecodedBin/binary>>,
+			     enc_text_buf = <<>>
+			    });
+    
+do_the_read_buf(Pid, SftpHandle, WantedLen, Packet, FileOpTimeout, 
+		B0=#bufinf{plain_text_buf = PlainBuf0,
+			   enc_text_buf = EncBuf0,
+			   chunksize = ChunkSize0
+			  })
+  when size(EncBuf0) >= ChunkSize0 ->
+    %% We have (at least) one chunk of decodable bytes waiting for decodeing.
+    <<ToDecode:ChunkSize0/binary, EncBuf/binary>> = EncBuf0,
+    {ok,DecodedBin,B} = apply_crypto(ToDecode, B0),
+    do_the_read_buf(Pid, SftpHandle, WantedLen, Packet, FileOpTimeout, 
+		    B#bufinf{plain_text_buf = <<PlainBuf0/binary, DecodedBin/binary>>,
+			     enc_text_buf = EncBuf
+			    });
+    
+do_the_read_buf(Pid, SftpHandle, WantedLen, Packet, FileOpTimeout, B=#bufinf{enc_text_buf = EncBuf0}) ->
+    %% We must read more bytes and append to the buffer of encoded bytes.
+    case read(Pid, SftpHandle, Packet, FileOpTimeout) of
+	{ok,EncryptedBin} ->
+	    do_the_read_buf(Pid, SftpHandle, WantedLen, Packet, FileOpTimeout,
+			    B#bufinf{enc_text_buf = <<EncBuf0/binary, EncryptedBin/binary>>});
+	eof ->
+	    {eof,B};
+	Other ->
+	    Other
+    end.
+
+
+write_buf(Pid, SftpHandle, BufHandle, PlainBin, FileOpTimeout) ->
+    {ok,{_Window,Packet}} = send_window(Pid, FileOpTimeout),
+    {ok,B0=#bufinf{plain_text_buf=PTB}}  = call(Pid, {get_bufinf,BufHandle}, FileOpTimeout),
+    case do_the_write_buf(Pid, SftpHandle, Packet, FileOpTimeout, 
+			  B0#bufinf{plain_text_buf = <<PTB/binary,PlainBin/binary>>}) of
+	{ok, B} ->
+	    call(Pid, {put_bufinf,BufHandle,B}, FileOpTimeout),
+	    ok;
+	{error,Error} ->
+	    {error,Error}
+    end.
+
+do_the_write_buf(Pid, SftpHandle, Packet, FileOpTimeout, 
+		 B=#bufinf{enc_text_buf = EncBuf0,
+			   size = Size})
+  when size(EncBuf0) >= Packet ->
+    <<BinToWrite:Packet/binary, EncBuf/binary>> = EncBuf0,
+    case write(Pid, SftpHandle, BinToWrite, FileOpTimeout) of
+	ok ->
+	    do_the_write_buf(Pid, SftpHandle, Packet, FileOpTimeout,
+			     B#bufinf{enc_text_buf = EncBuf,
+				      size = Size + Packet});
+	Other ->
+	    Other
+    end;
+
+do_the_write_buf(Pid, SftpHandle, Packet, FileOpTimeout,
+		 B0=#bufinf{plain_text_buf = PlainBuf0,
+			    enc_text_buf = EncBuf0,
+			    chunksize = undefined})
+  when size(PlainBuf0) > 0 ->
+     {ok,EncodedBin,B} = apply_crypto(PlainBuf0, B0),
+     do_the_write_buf(Pid, SftpHandle, Packet, FileOpTimeout,
+		     B#bufinf{plain_text_buf = <<>>,
+			      enc_text_buf = <<EncBuf0/binary, EncodedBin/binary>>});
+
+do_the_write_buf(Pid, SftpHandle, Packet, FileOpTimeout,
+		 B0=#bufinf{plain_text_buf = PlainBuf0,
+			    enc_text_buf = EncBuf0,
+			    chunksize = ChunkSize0
+			   })
+  when size(PlainBuf0) >= ChunkSize0 ->
+    <<ToEncode:ChunkSize0/binary, PlainBuf/binary>> = PlainBuf0,
+    {ok,EncodedBin,B} = apply_crypto(ToEncode, B0),
+    do_the_write_buf(Pid, SftpHandle, Packet, FileOpTimeout,
+		     B#bufinf{plain_text_buf = PlainBuf,
+			      enc_text_buf = <<EncBuf0/binary, EncodedBin/binary>>});
+
+do_the_write_buf(_Pid, _SftpHandle, _Packet, _FileOpTimeout, B) ->
+    {ok,B}.
+
+apply_crypto(In, B=#bufinf{crypto_state = CState0,
+			   crypto_fun = F}) ->
+    case F(In,CState0) of
+	{ok,EncodedBin,CState} -> 
+	    {ok, EncodedBin, B#bufinf{crypto_state=CState}};
+	{ok,EncodedBin,CState,ChunkSize} -> 
+	    {ok, EncodedBin, B#bufinf{crypto_state=CState,
+				      chunksize=ChunkSize}}
+    end.
+
+open_buf(Pid, CryptoInitFun, BufInfo0, FileOpTimeout) ->
+    case CryptoInitFun() of
+	{ok,CryptoState} ->
+	    open_buf1(Pid, BufInfo0, FileOpTimeout, CryptoState, undefined);
+	{ok,CryptoState,ChunkSize} ->
+	    open_buf1(Pid, BufInfo0, FileOpTimeout, CryptoState, ChunkSize);
+	Other ->
+	    Other
+    end.
+
+open_buf1(Pid, BufInfo0, FileOpTimeout, CryptoState, ChunkSize) ->
+    BufInfo = BufInfo0#bufinf{crypto_state = CryptoState,
+			      chunksize = ChunkSize},
+    BufHandle = make_ref(),
+    call(Pid, {put_bufinf,BufHandle,BufInfo}, FileOpTimeout),
+    {ok,BufHandle}.
+
+format_channel_start_error({shutdown, Reason}) ->
+    Reason;
+format_channel_start_error(Reason) ->
+    Reason.
diff --git a/lib/ssh/src/ssh_sftpd.erl b/lib/ssh/src/ssh_sftpd.erl
index 3d469d3c6e..dca018f20f 100644
--- a/lib/ssh/src/ssh_sftpd.erl
+++ b/lib/ssh/src/ssh_sftpd.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2005-2013. All Rights Reserved.
+%% Copyright Ericsson AB 2005-2015. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
@@ -29,6 +30,7 @@
 
 -include("ssh.hrl").
 -include("ssh_xfer.hrl").
+-include("ssh_connect.hrl"). %% For ?DEFAULT_PACKET_SIZE and ?DEFAULT_WINDOW_SIZE
 
 %%--------------------------------------------------------------------
 %% External exports
@@ -46,6 +48,7 @@
 	  file_handler,			% atom() - callback module 
 	  file_state,                   % state for the file callback module
 	  max_files,                    % integer >= 0 max no files sent during READDIR
+	  options,			% from the subsystem declaration
 	  handles			% list of open handles
 	  %% handle is either {<int>, directory, {Path, unread|eof}} or
 	  %% {<int>, file, {Path, IoDevice}}
@@ -54,6 +57,22 @@
 %%====================================================================
 %% API
 %%====================================================================
+-spec init(Args :: term()) ->
+    {ok, State :: term()} | {ok, State :: term(), timeout() | hibernate} |
+    {stop, Reason :: term()} | ignore.
+
+-spec terminate(Reason :: (normal | shutdown | {shutdown, term()} |
+                               term()),
+                    State :: term()) ->
+    term().
+
+-spec handle_msg(Msg ::term(), State :: term()) ->
+    {ok, State::term()} | {stop, ChannelId::integer(), State::term()}. 
+-spec handle_ssh_msg({ssh_cm, ConnectionRef::term(), SshMsg::term()},
+			 State::term()) -> {ok, State::term()} |
+					   {stop, ChannelId::integer(),
+					    State::term()}.
+
 subsystem_spec(Options) ->
     {"sftp", {?MODULE, Options}}.
 
@@ -76,7 +95,7 @@ listen(Addr, Port, Options) ->
 %% Description: Stops the listener
 %%--------------------------------------------------------------------
 stop(Pid) ->
-    ssh_cli:stop(Pid).
+    ssh:stop_listener(Pid).
 
 
 %%% DEPRECATED END %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
@@ -120,6 +139,7 @@ init(Options) ->
     MaxLength = proplists:get_value(max_files, Options, 0),
     Vsn = proplists:get_value(sftpd_vsn, Options, 5),
     {ok,  State#state{cwd = CWD, root = Root, max_files = MaxLength,
+		      options = Options,
 		      handles = [], pending = <<>>,
 		      xf = #ssh_xfer{vsn = Vsn, ext = []}}}.
 
@@ -163,7 +183,9 @@ handle_ssh_msg({ssh_cm, _, {exit_status, ChannelId, Status}}, State) ->
 %% Description: Handles other messages
 %%--------------------------------------------------------------------
 handle_msg({ssh_channel_up, ChannelId,  ConnectionManager}, 
-	   #state{xf =Xf} = State) ->
+	   #state{xf = Xf,
+		 options = Options} = State) ->
+    maybe_increase_recv_window(ConnectionManager,  ChannelId, Options),
     {ok,  State#state{xf = Xf#ssh_xfer{cm = ConnectionManager,
 				       channel = ChannelId}}}.
 
@@ -214,8 +236,7 @@ handle_op(?SSH_FXP_INIT, Version, B, State) when is_binary(B) ->
 handle_op(?SSH_FXP_REALPATH, ReqId,
 	  <<?UINT32(Rlen), RPath:Rlen/binary>>,
 	  State0) ->
-    RelPath0 = binary_to_list(RPath),
-    RelPath = relate_file_name(RelPath0, State0, _Canonicalize=false),
+    RelPath = relate_file_name(RPath, State0, _Canonicalize=false),
     {Res, State} = resolve_symlinks(RelPath, State0),
     case Res of
 	{ok, AbsPath} ->
@@ -231,7 +252,7 @@ handle_op(?SSH_FXP_OPENDIR, ReqId,
 	 <<?UINT32(RLen), RPath:RLen/binary>>,
 	  State0 = #state{xf = #ssh_xfer{vsn = Vsn}, 
 			  file_handler = FileMod, file_state = FS0}) ->
-    RelPath = binary_to_list(RPath),
+    RelPath = unicode:characters_to_list(RPath),
     AbsPath = relate_file_name(RelPath, State0),
     
     XF = State0#state.xf,
@@ -312,9 +333,8 @@ handle_op(?SSH_FXP_WRITE, ReqId,
 				    ?SSH_FX_INVALID_HANDLE),
 	    State
     end;
-handle_op(?SSH_FXP_READLINK, ReqId, <<?UINT32(PLen), BPath:PLen/binary>>, 
+handle_op(?SSH_FXP_READLINK, ReqId, <<?UINT32(PLen), RelPath:PLen/binary>>, 
 	  State = #state{file_handler = FileMod, file_state = FS0}) ->
-    RelPath = binary_to_list(BPath),
     AbsPath = relate_file_name(RelPath, State),
     {Res, FS1} = FileMod:read_link(AbsPath, FS0),
     case Res of
@@ -524,10 +544,10 @@ close_our_file({_,Fd}, FileMod, FS0) ->
 %%% stat: do the stat
 stat(Vsn, ReqId, Data, State, F) when Vsn =< 3->
     <<?UINT32(BLen), BPath:BLen/binary>> = Data,
-    stat(ReqId, binary_to_list(BPath), State, F);
+    stat(ReqId, unicode:characters_to_list(BPath), State, F);
 stat(Vsn, ReqId, Data, State, F) when Vsn >= 4->
     <<?UINT32(BLen), BPath:BLen/binary, ?UINT32(_Flags)>> = Data,
-    stat(ReqId, binary_to_list(BPath), State, F).
+    stat(ReqId, unicode:characters_to_list(BPath), State, F).
 
 fstat(Vsn, ReqId, Data, State) when Vsn =< 3->
     <<?UINT32(HLen), Handle:HLen/binary>> = Data,
@@ -561,72 +581,86 @@ stat(ReqId, RelPath, State0=#state{file_handler=FileMod,
 	    send_status({error, E}, ReqId, State1)
     end.
 
-decode_4_open_flag(create_new) ->
-    [write];
-decode_4_open_flag(create_truncate) ->
-    [write];
-decode_4_open_flag(truncate_existing) ->
-    [write];
-decode_4_open_flag(open_existing) ->
-    [read].
-
-decode_4_flags([OpenFlag | Flags]) ->
-    decode_4_flags(Flags, decode_4_open_flag(OpenFlag)).
-
-decode_4_flags([], Flags) ->
-    Flags;
-decode_4_flags([append_data|R], _Flags) ->
-    decode_4_flags(R, [append]);
-decode_4_flags([append_data_atomic|R], _Flags) ->
-    decode_4_flags(R, [append]);
-decode_4_flags([_|R], Flags) ->
-    decode_4_flags(R, Flags).
-
-decode_4_access_flag(read_data) ->
-    [read];
-decode_4_access_flag(list_directory) ->
-    [read];
-decode_4_access_flag(write_data) ->
-    [write];
-decode_4_access_flag(add_file) ->
-    [write];
-decode_4_access_flag(add_subdirectory) ->
-    [read];
-decode_4_access_flag(append_data) ->
-    [append];
-decode_4_access_flag(write_attributes) ->
-    [write];
-decode_4_access_flag(_) ->
-    [read].
-
-decode_4_acess([_ | _] = Flags) ->
+sftp_to_erlang_flag(read, Vsn) when Vsn == 3;
+				    Vsn == 4 ->
+    read;
+sftp_to_erlang_flag(write, Vsn) when Vsn == 3;
+				     Vsn == 4 ->
+    write;
+sftp_to_erlang_flag(append, Vsn) when Vsn == 3;
+				      Vsn == 4 ->
+    append;
+sftp_to_erlang_flag(creat, Vsn) when Vsn == 3;
+				     Vsn == 4 ->
+    write;
+sftp_to_erlang_flag(trunc, Vsn) when Vsn == 3;
+				     Vsn == 4 ->
+    write;
+sftp_to_erlang_flag(excl, Vsn) when Vsn == 3;
+				    Vsn == 4 ->
+    read;
+sftp_to_erlang_flag(create_new, Vsn)  when Vsn > 4 ->
+    write;
+sftp_to_erlang_flag(create_truncate, Vsn) when Vsn > 4 ->
+    write;
+sftp_to_erlang_flag(open_existing, Vsn)  when Vsn > 4 ->
+    read;
+sftp_to_erlang_flag(open_or_create, Vsn) when Vsn > 4 ->
+    write;
+sftp_to_erlang_flag(truncate_existing, Vsn) when Vsn > 4 ->
+    write;
+sftp_to_erlang_flag(append_data, Vsn)  when Vsn > 4 ->
+    append;
+sftp_to_erlang_flag(append_data_atomic, Vsn) when Vsn > 4  ->
+    append;
+sftp_to_erlang_flag(_, _) ->
+    read.
+
+sftp_to_erlang_flags(Flags, Vsn) ->
+    lists:map(fun(Flag) -> 
+		      sftp_to_erlang_flag(Flag, Vsn) 
+	      end, Flags).
+
+sftp_to_erlang_access_flag(read_data, _) ->
+    read;
+sftp_to_erlang_access_flag(list_directory, _) ->
+    read;
+sftp_to_erlang_access_flag(write_data, _) ->
+    write;
+sftp_to_erlang_access_flag(append_data, _) ->
+    append;
+sftp_to_erlang_access_flag(add_subdirectory, _) ->
+    read;
+sftp_to_erlang_access_flag(add_file, _) ->
+    write;
+sftp_to_erlang_access_flag(write_attributes, _) ->
+    write;
+sftp_to_erlang_access_flag(_, _) ->
+    read.
+sftp_to_erlang_access_flags(Flags, Vsn) ->
     lists:map(fun(Flag) -> 
-		      [decode_4_access_flag(Flag)]
-	      end, Flags);
-decode_4_acess([]) ->
-    [].
+		      sftp_to_erlang_access_flag(Flag, Vsn)
+	      end, Flags).
 
 open(Vsn, ReqId, Data, State) when Vsn =< 3 ->
     <<?UINT32(BLen), BPath:BLen/binary, ?UINT32(PFlags),
      _Attrs/binary>> = Data,
-    Path = binary_to_list(BPath),
-    Flags = ssh_xfer:decode_open_flags(Vsn, PFlags),
+    Path = unicode:characters_to_list(BPath),
+    FlagBits = ssh_xfer:decode_open_flags(Vsn, PFlags),
+    Flags = lists:usort(sftp_to_erlang_flags(FlagBits, Vsn)),
     do_open(ReqId, State, Path, Flags);
 open(Vsn, ReqId, Data, State) when Vsn >= 4 ->
     <<?UINT32(BLen), BPath:BLen/binary, ?UINT32(Access),
      ?UINT32(PFlags), _Attrs/binary>> = Data,
-    Path = binary_to_list(BPath),
+    Path = unicode:characters_to_list(BPath),
     FlagBits = ssh_xfer:decode_open_flags(Vsn, PFlags),
     AcessBits = ssh_xfer:decode_ace_mask(Access),
-    %% TODO: This is to make sure the Access flags are not ignored
-    %% but this should be thought through better. This solution should
-    %% be considered a hack in order to buy some time. At least
-    %% it works better than when the Access flags where totally ignored.
-    %% A better solution may need some code refactoring that we do
-    %% not have time for right now.
-    AcessFlags = decode_4_acess(AcessBits),
-    Flags = lists:append(lists:umerge(
-			   [[decode_4_flags(FlagBits)] | AcessFlags])),
+    %% TODO: There are still flags that are not
+    %% fully handled as SSH_FXF_ACCESS_TEXT_MODE and
+    %% a lot a ACE flags, the later we may not need 
+    %% to understand as they are NFS flags
+    AcessFlags = sftp_to_erlang_access_flags(AcessBits, Vsn),
+    Flags = lists:usort(sftp_to_erlang_flags(FlagBits, Vsn) ++ AcessFlags),
     do_open(ReqId, State, Path, Flags).
 
 do_open(ReqId, State0, Path, Flags) ->
@@ -675,7 +709,7 @@ resolve_symlinks_2(["." | RestPath], State0, LinkCnt, AccPath) ->
 resolve_symlinks_2([".." | RestPath], State0, LinkCnt, AccPath) ->
     %% Remove the last path component
     AccPathComps0 = filename:split(AccPath),
-    Path =  case lists:reverse(tl(lists:reverse(AccPathComps0))) of
+    Path =  case lists:droplast(AccPathComps0) of
 		[] ->
 		    "";
 		AccPathComps ->
@@ -712,7 +746,7 @@ relate_file_name(File, State) ->
     relate_file_name(File, State, _Canonicalize=true).
 
 relate_file_name(File, State, Canonicalize) when is_binary(File) ->
-    relate_file_name(binary_to_list(File), State, Canonicalize);
+    relate_file_name(unicode:characters_to_list(File), State, Canonicalize);
 relate_file_name(File, #state{cwd = CWD, root = ""}, Canonicalize) ->
     relate_filename_to_path(File, CWD, Canonicalize);
 relate_file_name(File, #state{root = Root}, Canonicalize) ->
@@ -921,3 +955,18 @@ rename(Path, Path2, ReqId, State0) ->
     {Status, FS1} = FileMod:rename(Path, Path2, FS0),
     State1 = State0#state{file_state = FS1},
     send_status(Status, ReqId, State1).
+
+
+maybe_increase_recv_window(ConnectionManager, ChannelId, Options) ->
+    WantedRecvWindowSize = 
+	proplists:get_value(recv_window_size, Options, 1000000),
+    NumPkts = WantedRecvWindowSize div ?DEFAULT_PACKET_SIZE,
+    Increment = NumPkts*?DEFAULT_PACKET_SIZE - ?DEFAULT_WINDOW_SIZE,
+
+    if
+	Increment > 0 ->
+	    ssh_connection:adjust_window(ConnectionManager, ChannelId, 
+					 Increment);
+	Increment =< 0 ->
+	    do_nothing
+    end.
diff --git a/lib/ssh/src/ssh_sftpd_file.erl b/lib/ssh/src/ssh_sftpd_file.erl
index 91ba228e38..311cdc1a3d 100644
--- a/lib/ssh/src/ssh_sftpd_file.erl
+++ b/lib/ssh/src/ssh_sftpd_file.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2006-2010. All Rights Reserved.
+%% Copyright Ericsson AB 2006-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
diff --git a/lib/ssh/src/ssh_sftpd_file_api.erl b/lib/ssh/src/ssh_sftpd_file_api.erl
index 83d90907f5..78f452df67 100644
--- a/lib/ssh/src/ssh_sftpd_file_api.erl
+++ b/lib/ssh/src/ssh_sftpd_file_api.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2007-2012. All Rights Reserved.
-%%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
-%%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%% Copyright Ericsson AB 2007-2016. All Rights Reserved.
+%%
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
+%%
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
diff --git a/lib/ssh/src/ssh_shell.erl b/lib/ssh/src/ssh_shell.erl
index 8031450617..17224b6ef4 100644
--- a/lib/ssh/src/ssh_shell.erl
+++ b/lib/ssh/src/ssh_shell.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2009-2013. All Rights Reserved.
+%% Copyright Ericsson AB 2009-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
@@ -44,6 +45,21 @@
 %%====================================================================
 %% ssh_channel callbacks
 %%====================================================================
+-spec init(Args :: term()) ->
+    {ok, State :: term()} | {ok, State :: term(), timeout() | hibernate} |
+    {stop, Reason :: term()} | ignore.
+
+-spec terminate(Reason :: (normal | shutdown | {shutdown, term()} |
+                               term()),
+                    State :: term()) ->
+    term().
+
+-spec handle_msg(Msg ::term(), State :: term()) ->
+    {ok, State::term()} | {stop, ChannelId::integer(), State::term()}. 
+-spec handle_ssh_msg({ssh_cm, ConnectionRef::term(), SshMsg::term()},
+			 State::term()) -> {ok, State::term()} |
+					   {stop, ChannelId::integer(),
+					    State::term()}.
 
 %%--------------------------------------------------------------------
 %% Function: init(Args) -> {ok, State} 
diff --git a/lib/ssh/src/ssh_subsystem_sup.erl b/lib/ssh/src/ssh_subsystem_sup.erl
index cd6defd535..637f5f398f 100644
--- a/lib/ssh/src/ssh_subsystem_sup.erl
+++ b/lib/ssh/src/ssh_subsystem_sup.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2008-2012. All Rights Reserved.
+%% Copyright Ericsson AB 2008-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
@@ -25,7 +26,9 @@
 
 -behaviour(supervisor).
 
--export([start_link/1, connection_supervisor/1, channel_supervisor/1
+-export([start_link/1,
+	 connection_supervisor/1,
+	 channel_supervisor/1
 	]).
 
 %% Supervisor callback
@@ -48,6 +51,8 @@ channel_supervisor(SupPid) ->
 %%%=========================================================================
 %%%  Supervisor callback
 %%%=========================================================================
+-spec init( [term()] ) -> {ok,{supervisor:sup_flags(),[supervisor:child_spec()]}} | ignore .
+
 init([Opts]) ->
     RestartStrategy = one_for_all,
     MaxR = 0,
@@ -61,9 +66,9 @@ init([Opts]) ->
 child_specs(Opts) ->
     case proplists:get_value(role, Opts) of
 	client ->		
-	    [ssh_connectinon_child_spec(Opts)];
+	    [];
 	server ->
-	    [ssh_connectinon_child_spec(Opts), ssh_channel_child_spec(Opts)]
+	    [ssh_channel_child_spec(Opts), ssh_connectinon_child_spec(Opts)]
     end.
   
 ssh_connectinon_child_spec(Opts) ->
@@ -72,9 +77,9 @@ ssh_connectinon_child_spec(Opts) ->
     Role = proplists:get_value(role, Opts),
     Name = id(Role, ssh_connection_sup, Address, Port),
     StartFunc = {ssh_connection_sup, start_link, [Opts]},
-    Restart = transient, 
+    Restart = temporary,
     Shutdown = 5000,
-    Modules = [ssh_connection_sup],
+     Modules = [ssh_connection_sup],
     Type = supervisor,
     {Name, StartFunc, Restart, Shutdown, Type, Modules}.
 
@@ -84,7 +89,7 @@ ssh_channel_child_spec(Opts) ->
     Role = proplists:get_value(role, Opts),
     Name = id(Role, ssh_channel_sup, Address, Port),
     StartFunc = {ssh_channel_sup, start_link, [Opts]},
-    Restart = transient, 
+    Restart = temporary,
     Shutdown = infinity,
     Modules = [ssh_channel_sup],
     Type = supervisor,
diff --git a/lib/ssh/src/ssh_sup.erl b/lib/ssh/src/ssh_sup.erl
index f307d1f833..8b57387589 100644
--- a/lib/ssh/src/ssh_sup.erl
+++ b/lib/ssh/src/ssh_sup.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2008-2010. All Rights Reserved.
+%% Copyright Ericsson AB 2008-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
@@ -30,6 +31,8 @@
 %%%=========================================================================
 %%%  Supervisor callback
 %%%=========================================================================
+-spec init( [term()] ) -> {ok,{supervisor:sup_flags(),[supervisor:child_spec()]}} | ignore .
+
 init([]) ->
     SupFlags = {one_for_one, 10, 3600},
     Children = children(), 
@@ -51,8 +54,7 @@ children() ->
     Clients = [Service || Service <- Services, is_client(Service)],
     Servers =  [Service || Service <- Services, is_server(Service)],
 
-    [server_child_spec(Servers), client_child_spec(Clients),
-     ssh_userauth_reg_spec()].
+    [server_child_spec(Servers), client_child_spec(Clients)].
 
 server_child_spec(Servers) ->
     Name = sshd_sup,
@@ -72,16 +74,6 @@ client_child_spec(Clients) ->
     Type = supervisor,
     {Name, StartFunc, Restart, Shutdown, Type, Modules}.
 
-ssh_userauth_reg_spec() ->
-    Name = ssh_userreg,
-    StartFunc = {ssh_userreg, start_link, []},
-    Restart = transient, 
-    Shutdown = 5000,
-    Modules = [ssh_userreg],
-    Type = worker,
-    {Name, StartFunc, Restart, Shutdown, Type, Modules}.
-
-
 is_server({sftpd, _}) ->
     true;
 is_server({shelld, _}) ->
diff --git a/lib/ssh/src/ssh_system_sup.erl b/lib/ssh/src/ssh_system_sup.erl
index 36daf3b1ac..e97ac7b01a 100644
--- a/lib/ssh/src/ssh_system_sup.erl
+++ b/lib/ssh/src/ssh_system_sup.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2008-2012. All Rights Reserved.
+%% Copyright Ericsson AB 2008-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
@@ -28,42 +29,47 @@
 
 -behaviour(supervisor).
 
+-include("ssh.hrl").
+
 -export([start_link/1, stop_listener/1,
-	 stop_listener/2, stop_system/1,
-	 stop_system/2, system_supervisor/2,
+	 stop_listener/3, stop_system/1,
+	 stop_system/3, system_supervisor/3,
 	 subsystem_supervisor/1, channel_supervisor/1, 
 	 connection_supervisor/1, 
-	 acceptor_supervisor/1, start_subsystem/2, restart_subsystem/2,
-	 restart_acceptor/2, stop_subsystem/2]).
+	 acceptor_supervisor/1, start_subsystem/2, restart_subsystem/3,
+	 restart_acceptor/3, stop_subsystem/2]).
 
 %% Supervisor callback
 -export([init/1]).
 
 %%%=========================================================================
-%%%  API
+%%% Internal  API
 %%%=========================================================================
 start_link(ServerOpts) ->
     Address = proplists:get_value(address, ServerOpts),
     Port = proplists:get_value(port, ServerOpts),
-    Name = make_name(Address, Port),
+    Profile = proplists:get_value(profile,  proplists:get_value(ssh_opts, ServerOpts), ?DEFAULT_PROFILE),
+    Name = make_name(Address, Port, Profile),
     supervisor:start_link({local, Name}, ?MODULE, [ServerOpts]).
 
 stop_listener(SysSup) ->
     stop_acceptor(SysSup). 
 
-stop_listener(Address, Port) ->
-    Name = make_name(Address, Port),
+stop_listener(Address, Port, Profile) ->
+    Name = make_name(Address, Port, Profile),
     stop_acceptor(whereis(Name)). 
-
+ 
 stop_system(SysSup) ->
     Name = sshd_sup:system_name(SysSup),
-    sshd_sup:stop_child(Name).
-    
-stop_system(Address, Port) -> 
-    sshd_sup:stop_child(Address, Port).
+    spawn(fun() -> sshd_sup:stop_child(Name) end),
+    ok.
 
-system_supervisor(Address, Port) ->
-    Name = make_name(Address, Port),
+stop_system(Address, Port, Profile) -> 
+    spawn(fun() -> sshd_sup:stop_child(Address, Port, Profile) end),
+    ok.
+
+system_supervisor(Address, Port, Profile) ->
+    Name = make_name(Address, Port, Profile),
     whereis(Name).
 
 subsystem_supervisor(SystemSup) ->
@@ -101,9 +107,9 @@ stop_subsystem(SystemSup, SubSys) ->
     end.
 
 
-restart_subsystem(Address, Port) ->
-    SysSupName = make_name(Address, Port),
-    SubSysName = id(ssh_subsystem_sup, Address, Port),
+restart_subsystem(Address, Port, Profile) ->
+    SysSupName = make_name(Address, Port, Profile),
+    SubSysName = id(ssh_subsystem_sup, Address, Port, Profile),
     case supervisor:terminate_child(SysSupName, SubSysName) of
 	ok ->
 	    supervisor:restart_child(SysSupName, SubSysName);
@@ -111,19 +117,24 @@ restart_subsystem(Address, Port) ->
 	    Error
     end.
 
-restart_acceptor(Address, Port) ->
-    SysSupName = make_name(Address, Port),
-    AcceptorName = id(ssh_acceptor_sup, Address, Port),
+restart_acceptor(Address, Port, Profile) ->
+    SysSupName = make_name(Address, Port, Profile),
+    AcceptorName = id(ssh_acceptor_sup, Address, Port, Profile),
     supervisor:restart_child(SysSupName, AcceptorName).
 
 %%%=========================================================================
 %%%  Supervisor callback
 %%%=========================================================================
+-spec init( [term()] ) -> {ok,{supervisor:sup_flags(),[supervisor:child_spec()]}} | ignore .
+
 init([ServerOpts]) ->
     RestartStrategy = one_for_one,
-    MaxR = 10,
+    MaxR = 0,
     MaxT = 3600,
-    Children = child_specs(ServerOpts),
+    Children = case proplists:get_value(asocket,ServerOpts) of
+		   undefined -> child_specs(ServerOpts);
+		   _ -> []
+	       end,
     {ok, {{RestartStrategy, MaxR, MaxT}, Children}}.
 
 %%%=========================================================================
@@ -135,9 +146,10 @@ child_specs(ServerOpts) ->
 ssh_acceptor_child_spec(ServerOpts) ->
     Address = proplists:get_value(address, ServerOpts),
     Port = proplists:get_value(port, ServerOpts),
-    Name = id(ssh_acceptor_sup, Address, Port),
+    Profile = proplists:get_value(profile,  proplists:get_value(ssh_opts, ServerOpts), ?DEFAULT_PROFILE),
+    Name = id(ssh_acceptor_sup, Address, Port, Profile),
     StartFunc = {ssh_acceptor_sup, start_link, [ServerOpts]},
-    Restart = permanent, 
+    Restart = transient, 
     Shutdown = infinity,
     Modules = [ssh_acceptor_sup],
     Type = supervisor,
@@ -146,19 +158,30 @@ ssh_acceptor_child_spec(ServerOpts) ->
 ssh_subsystem_child_spec(ServerOpts) ->
     Name = make_ref(),
     StartFunc = {ssh_subsystem_sup, start_link, [ServerOpts]},
-    Restart = transient, 
+    Restart = temporary,
     Shutdown = infinity,
     Modules = [ssh_subsystem_sup],
     Type = supervisor,
     {Name, StartFunc, Restart, Shutdown, Type, Modules}.
 
 
-id(Sup, Address, Port) ->
-    {Sup, Address, Port}.
-
-make_name(Address, Port) ->
-    list_to_atom(lists:flatten(io_lib:format("ssh_system_~p_~p_sup", 
-					     [Address, Port]))).
+id(Sup, Address, Port, Profile) ->
+    case is_list(Address) of	
+	true ->
+	    {Sup, any, Port, Profile};
+	false ->
+	    {Sup, Address, Port, Profile}
+	end.
+
+make_name(Address, Port, Profile) ->
+    case is_list(Address) of
+	true  ->
+	    list_to_atom(lists:flatten(io_lib:format("ssh_system_~p_~p_~p_sup", 
+						     [any, Port, Profile])));
+	false  ->
+	    list_to_atom(lists:flatten(io_lib:format("ssh_system_~p_~p_~p_sup", 
+						     [Address, Port, Profile])))
+    end.
 
 ssh_subsystem_sup([{_, Child, _, [ssh_subsystem_sup]} | _]) ->
     Child;
@@ -171,8 +194,12 @@ ssh_acceptor_sup([_ | Rest]) ->
     ssh_acceptor_sup(Rest).
 
 stop_acceptor(Sup) ->
-    [Name] =
-	[SupName || {SupName, _, _, [ssh_acceptor_sup]} <- 
+    [{Name, AcceptorSup}] =
+	[{SupName, ASup} || {SupName, ASup, _, [ssh_acceptor_sup]} <- 
 			  supervisor:which_children(Sup)],
-    supervisor:terminate_child(Sup, Name).
-
+    case supervisor:terminate_child(AcceptorSup, Name) of
+        ok ->
+            supervisor:delete_child(AcceptorSup, Name);
+        Error ->
+            Error
+    end.
diff --git a/lib/ssh/src/ssh_transport.erl b/lib/ssh/src/ssh_transport.erl
index beaffdc025..7cb3b75ac0 100644
--- a/lib/ssh/src/ssh_transport.erl
+++ b/lib/ssh/src/ssh_transport.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2004-2013. All Rights Reserved.
+%% Copyright Ericsson AB 2004-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
@@ -29,27 +30,148 @@
 -include("ssh_transport.hrl").
 -include("ssh.hrl").
 
--export([connect/5, accept/4]). 
 -export([versions/2, hello_version_msg/1]).
--export([next_seqnum/1, decrypt_first_block/2, decrypt_blocks/3,
-	 is_valid_mac/3, transport_messages/1, kexdh_messages/0,
-	 kex_dh_gex_messages/0, handle_hello_version/1,
-	 key_exchange_init_msg/1, key_init/3, new_keys_message/1,
+-export([next_seqnum/1, 
+	 supported_algorithms/0, supported_algorithms/1,
+	 default_algorithms/0, default_algorithms/1,
+	 handle_packet_part/4,
+	 handle_hello_version/1,
+	 key_exchange_init_msg/1,
+	 key_init/3, new_keys_message/1,
 	 handle_kexinit_msg/3, handle_kexdh_init/2,
-	 handle_kex_dh_gex_group/2, handle_kex_dh_gex_reply/2,
+	 handle_kex_dh_gex_group/2, handle_kex_dh_gex_init/2, handle_kex_dh_gex_reply/2,
 	 handle_new_keys/2, handle_kex_dh_gex_request/2,
 	 handle_kexdh_reply/2, 
-	 unpack/3, decompress/2, ssh_packet/2, pack/2, msg_data/1,
+	 handle_kex_ecdh_init/2,
+	 handle_kex_ecdh_reply/2,
+	 extract_public_key/1,
+	 ssh_packet/2, pack/2,
 	 sign/3, verify/4]).
 
+%%% For test suites
+-export([pack/3]).
+-export([decompress/2,  decrypt_blocks/3, is_valid_mac/3 ]). % FIXME: remove
+
+-define(Estring(X), ?STRING((if is_binary(X) -> X;
+				is_list(X) -> list_to_binary(X);
+				X==undefined -> <<>>
+			     end))).
+-define(Empint(X),     (ssh_bits:mpint(X))/binary ).
+-define(Ebinary(X),    ?STRING(X) ).
+-define(Euint32(X),   ?UINT32(X) ).
+
+%%%----------------------------------------------------------------------------
+%%%
+%%% There is a difference between supported and default algorithms. The
+%%% SUPPORTED algorithms can be handled (maybe untested...). The DEFAULT ones
+%%% are announced in ssh_msg_kexinit and in ssh:default_algorithms/0 to the
+%%% user.
+%%%
+%%% A supported algorithm can be requested in the option 'preferred_algorithms',
+%%% but may give unexpected results before being promoted to default.
+%%%
+%%% This makes it possible to add experimental algorithms (in supported_algorithms)
+%%% and test them without letting the default users know about them.
+%%%
+
+default_algorithms() -> [{K,default_algorithms(K)} || K <- algo_classes()].
+
+algo_classes() -> [kex, public_key, cipher, mac, compression].
+
+
+default_algorithms(cipher) ->
+    supported_algorithms(cipher, same(['AEAD_AES_128_GCM',
+				       'AEAD_AES_256_GCM']));
+default_algorithms(mac) ->
+    supported_algorithms(mac, same(['AEAD_AES_128_GCM',
+				    'AEAD_AES_256_GCM']));
+default_algorithms(Alg) ->
+    supported_algorithms(Alg, []).
+
+
+supported_algorithms() -> [{K,supported_algorithms(K)} || K <- algo_classes()].
+
+supported_algorithms(kex) ->
+    select_crypto_supported(
+      [
+       {'ecdh-sha2-nistp256',                   [{public_keys,ecdh}, {ec_curve,secp256r1}, {hashs,sha256}]},
+       {'ecdh-sha2-nistp384',                   [{public_keys,ecdh}, {ec_curve,secp384r1}, {hashs,sha384}]},
+       {'diffie-hellman-group14-sha1',          [{public_keys,dh},   {hashs,sha}]},
+       {'diffie-hellman-group-exchange-sha256', [{public_keys,dh},   {hashs,sha256}]},
+       {'diffie-hellman-group-exchange-sha1',   [{public_keys,dh},   {hashs,sha}]},
+       {'ecdh-sha2-nistp521',                   [{public_keys,ecdh}, {ec_curve,secp521r1}, {hashs,sha512}]},
+       {'diffie-hellman-group1-sha1',           [{public_keys,dh},   {hashs,sha}]}
+      ]);
+supported_algorithms(public_key) ->
+    select_crypto_supported(
+      [{'ecdsa-sha2-nistp256',  [{public_keys,ecdsa}, {hashs,sha256}, {ec_curve,secp256r1}]},
+       {'ecdsa-sha2-nistp384',  [{public_keys,ecdsa}, {hashs,sha384}, {ec_curve,secp384r1}]},
+       {'ecdsa-sha2-nistp521',  [{public_keys,ecdsa}, {hashs,sha512}, {ec_curve,secp521r1}]},
+       {'ssh-rsa',              [{public_keys,rsa},   {hashs,sha}                         ]},
+       {'ssh-dss',              [{public_keys,dss},   {hashs,sha}                         ]}
+      ]);
+ 
+supported_algorithms(cipher) ->
+    same(
+      select_crypto_supported(
+	[{'aes256-ctr',       [{ciphers,{aes_ctr,256}}]},
+	 {'aes192-ctr',       [{ciphers,{aes_ctr,192}}]},
+	 {'aes128-ctr',       [{ciphers,{aes_ctr,128}}]},
+	 {'aes128-cbc',       [{ciphers,aes_cbc128}]},
+	 {'[email protected]', [{ciphers,{aes_gcm,128}}]},
+	 {'[email protected]', [{ciphers,{aes_gcm,256}}]},
+	 {'AEAD_AES_128_GCM', [{ciphers,{aes_gcm,128}}]},
+	 {'AEAD_AES_256_GCM', [{ciphers,{aes_gcm,256}}]},
+	 {'3des-cbc',         [{ciphers,des3_cbc}]}
+	]
+       ));
+supported_algorithms(mac) ->
+    same(
+      select_crypto_supported(
+	[{'hmac-sha2-256',    [{hashs,sha256}]},
+	 {'hmac-sha2-512',    [{hashs,sha512}]},
+	 {'hmac-sha1',        [{hashs,sha}]},
+	 {'AEAD_AES_128_GCM', [{ciphers,{aes_gcm,128}}]},
+	 {'AEAD_AES_256_GCM', [{ciphers,{aes_gcm,256}}]}
+	]
+       ));
+supported_algorithms(compression) ->
+    same(['none',
+ 	  '[email protected]',
+	  'zlib'
+	 ]).
+
+%%%----------------------------------------------------------------------------
 versions(client, Options)->
     Vsn = proplists:get_value(vsn, Options, ?DEFAULT_CLIENT_VERSION),
-    Version = format_version(Vsn),
-    {Vsn, Version};
+    {Vsn, format_version(Vsn, software_version(Options))};
 versions(server, Options) ->
     Vsn = proplists:get_value(vsn, Options, ?DEFAULT_SERVER_VERSION),
-    Version = format_version(Vsn),
-    {Vsn, Version}.
+    {Vsn, format_version(Vsn, software_version(Options))}.
+
+software_version(Options) -> 
+    case proplists:get_value(id_string, Options) of
+	undefined ->
+	    "Erlang"++ssh_vsn();
+	{random,Nlo,Nup} ->
+	    random_id(Nlo,Nup);
+	ID ->
+	    ID
+    end.
+
+ssh_vsn() ->
+    try {ok,L} = application:get_all_key(ssh),
+	 proplists:get_value(vsn,L,"")
+    of 
+	"" -> "";
+	VSN when is_list(VSN) -> "/" ++ VSN;
+	_ -> ""
+    catch
+	_:_ -> ""
+    end.
+    
+random_id(Nlo, Nup) ->
+    [crypto:rand_uniform($a,$z+1) || _<- lists:duplicate(crypto:rand_uniform(Nlo,Nup+1),x)  ].
 
 hello_version_msg(Data) ->
     [Data,"\r\n"].
@@ -57,12 +179,6 @@ hello_version_msg(Data) ->
 next_seqnum(SeqNum) ->
     (SeqNum + 1) band 16#ffffffff.
 
-decrypt_first_block(Bin, #ssh{decrypt_block_size = BlockSize} = Ssh0) -> 
-    <<EncBlock:BlockSize/binary, EncData/binary>> = Bin,
-    {Ssh, <<?UINT32(PacketLen), _/binary>> = DecData} =
-	decrypt(Ssh0, EncBlock),
-    {Ssh, PacketLen, DecData, EncData}.
-    
 decrypt_blocks(Bin, Length, Ssh0) ->
     <<EncBlocks:Length/binary, EncData/binary>> = Bin,
     {Ssh, DecData} = decrypt(Ssh0, EncBlocks),
@@ -74,128 +190,29 @@ is_valid_mac(Mac, Data, #ssh{recv_mac = Algorithm,
 			     recv_mac_key = Key, recv_sequence = SeqNum}) ->
     Mac == mac(Algorithm, Key, SeqNum, Data).
 
-transport_messages(_) ->
-    [{ssh_msg_disconnect, ?SSH_MSG_DISCONNECT, 
-      [uint32, string, string]},
-     
-     {ssh_msg_ignore, ?SSH_MSG_IGNORE,
-      [string]},
-     
-     {ssh_msg_unimplemented, ?SSH_MSG_UNIMPLEMENTED,
-      [uint32]},
-     
-     {ssh_msg_debug, ?SSH_MSG_DEBUG,
-      [boolean, string, string]},
-     
-     {ssh_msg_service_request, ?SSH_MSG_SERVICE_REQUEST,
-      [string]},
-
-     {ssh_msg_service_accept, ?SSH_MSG_SERVICE_ACCEPT,
-      [string]},
-     
-     {ssh_msg_kexinit, ?SSH_MSG_KEXINIT,
-      [cookie,
-       name_list, name_list, 
-       name_list, name_list, 
-       name_list, name_list,
-       name_list, name_list,
-       name_list, name_list,
-       boolean, 
-       uint32]},
-     
-     {ssh_msg_newkeys, ?SSH_MSG_NEWKEYS,
-      []}
-    ].
-
-kexdh_messages() ->
-    [{ssh_msg_kexdh_init, ?SSH_MSG_KEXDH_INIT,
-      [mpint]},
-     
-     {ssh_msg_kexdh_reply, ?SSH_MSG_KEXDH_REPLY,
-      [binary, mpint, binary]}
-    ].
-
-kex_dh_gex_messages() ->
-    [{ssh_msg_kex_dh_gex_request, ?SSH_MSG_KEX_DH_GEX_REQUEST,
-      [uint32, uint32, uint32]},
-     
-     {ssh_msg_kex_dh_gex_request_old, ?SSH_MSG_KEX_DH_GEX_REQUEST_OLD,
-       [uint32]},
-     
-     {ssh_msg_kex_dh_gex_group, ?SSH_MSG_KEX_DH_GEX_GROUP,
-      [mpint, mpint]},
-     
-     {ssh_msg_kex_dh_gex_init, ?SSH_MSG_KEX_DH_GEX_INIT,
-       [mpint]},
-     
-     {ssh_msg_kex_dh_gex_reply, ?SSH_MSG_KEX_DH_GEX_REPLY,
-      [binary, mpint, binary]}
-    ].
-
 yes_no(Ssh, Prompt)  ->
     (Ssh#ssh.io_cb):yes_no(Prompt, Ssh).
 
-connect(ConnectionSup, Address, Port, SocketOpts, Opts) ->    
-    Timeout = proplists:get_value(connect_timeout, Opts, infinity),
-    {_, Callback, _} =  
-	proplists:get_value(transport, Opts, {tcp, gen_tcp, tcp_closed}),
-    case do_connect(Callback, Address, Port, SocketOpts, Timeout) of
- 	{ok, Socket} ->
-	    {ok, Pid} = 
-		ssh_connection_sup:start_handler_child(ConnectionSup,
-						       [client, Socket,
-							[{address, Address},
-							 {port, Port} |
-							 Opts]]), 
-	    Callback:controlling_process(Socket, Pid),
-	    ssh_connection_handler:send_event(Pid, socket_control),
-	    {ok, Pid};
-	{error, Reason} ->
-	    {error, Reason} 
-    end.
-
-do_connect(Callback, Address, Port, SocketOpts, Timeout) ->
-    Opts = [{active, false} | SocketOpts],
-    case Callback:connect(Address, Port, Opts, Timeout) of
-	{error, nxdomain} -> 
-	    Callback:connect(Address, Port, lists:delete(inet6, Opts), Timeout);
-	{error, eafnosupport}  ->
-	    Callback:connect(Address, Port, lists:delete(inet6, Opts), Timeout);
-	{error, enetunreach}  ->
-	    Callback:connect(Address, Port, lists:delete(inet6, Opts), Timeout);
-	Other ->
-	    Other
-    end.
-
-accept(Address, Port, Socket, Options) ->
-    {_, Callback, _} =  
-	proplists:get_value(transport, Options, {tcp, gen_tcp, tcp_closed}),
-    ConnectionSup =
-	ssh_system_sup:connection_supervisor(
-	  ssh_system_sup:system_supervisor(Address, Port)),
-    {ok, Pid} = 
-	ssh_connection_sup:start_handler_child(ConnectionSup,
-					       [server, Socket,
-						[{address, Address},
-						 {port, Port} | Options]]),
-    Callback:controlling_process(Socket, Pid),
-    {ok, Pid}.
-
-format_version({Major,Minor}) ->
+format_version({Major,Minor}, SoftwareVersion) ->
     "SSH-" ++ integer_to_list(Major) ++ "." ++ 
-	integer_to_list(Minor) ++ "-Erlang".
+	integer_to_list(Minor) ++ "-" ++ SoftwareVersion.
 
 handle_hello_version(Version) ->
-    StrVersion = trim_tail(Version),
-    case string:tokens(Version, "-") of
-	[_, "2.0" | _] ->
-	    {{2,0}, StrVersion}; 
-	[_, "1.99" | _] ->
-	    {{2,0}, StrVersion}; 
-	[_, "1.3" | _] ->
-	    {{1,3}, StrVersion}; 
-	[_, "1.5" | _] ->
-	    {{1,5}, StrVersion}
+    try
+	StrVersion = trim_tail(Version),
+	case string:tokens(Version, "-") of
+	    [_, "2.0" | _] ->
+		{{2,0}, StrVersion};
+	    [_, "1.99" | _] ->
+		{{2,0}, StrVersion};
+	    [_, "1.3" | _] ->
+		{{1,3}, StrVersion};
+	    [_, "1.5" | _] ->
+		{{1,5}, StrVersion}
+	end
+    catch
+	error:_ ->
+	    {undefined, "unknown version"}
     end.
 
 key_exchange_init_msg(Ssh0) ->
@@ -205,197 +222,460 @@ key_exchange_init_msg(Ssh0) ->
 
 kex_init(#ssh{role = Role, opts = Opts, available_host_keys = HostKeyAlgs}) ->
     Random = ssh_bits:random(16),
-    Compression = case proplists:get_value(compression, Opts, none) of
-		      zlib -> ["zlib", "none"];
-		      none -> ["none", "zlib"]
-		  end,
-    kexinit_messsage(Role, Random, Compression, HostKeyAlgs).
+    PrefAlgs =
+	case proplists:get_value(preferred_algorithms,Opts) of
+	    undefined -> 
+		default_algorithms();
+	    Algs0 ->
+		Algs0
+	end,
+    kexinit_message(Role, Random, PrefAlgs, HostKeyAlgs).
 
 key_init(client, Ssh, Value) ->
     Ssh#ssh{c_keyinit = Value};
 key_init(server, Ssh, Value) ->
     Ssh#ssh{s_keyinit = Value}.
 
-kexinit_messsage(client, Random, Compression, HostKeyAlgs) ->
-    #ssh_msg_kexinit{ 
-		  cookie = Random,
-		  kex_algorithms = ["diffie-hellman-group1-sha1"],
-		  server_host_key_algorithms = HostKeyAlgs,
-		  encryption_algorithms_client_to_server = ["aes128-cbc","3des-cbc"],
-		  encryption_algorithms_server_to_client = ["aes128-cbc","3des-cbc"],
-		  mac_algorithms_client_to_server = ["hmac-sha1"],
-		  mac_algorithms_server_to_client = ["hmac-sha1"],
-		  compression_algorithms_client_to_server = Compression,
-		  compression_algorithms_server_to_client = Compression,
-		  languages_client_to_server = [],
-		  languages_server_to_client = []
-		 };
 
-kexinit_messsage(server, Random, Compression, HostKeyAlgs) ->
+kexinit_message(_Role, Random, Algs, HostKeyAlgs) ->
     #ssh_msg_kexinit{
 		  cookie = Random,
-		  kex_algorithms = ["diffie-hellman-group1-sha1"],
+		  kex_algorithms = to_strings( get_algs(kex,Algs) ),
 		  server_host_key_algorithms = HostKeyAlgs,
-		  encryption_algorithms_client_to_server = ["aes128-cbc","3des-cbc"],
-		  encryption_algorithms_server_to_client = ["aes128-cbc","3des-cbc"],
-		  mac_algorithms_client_to_server = ["hmac-sha1"],
-		  mac_algorithms_server_to_client = ["hmac-sha1"],
-		  compression_algorithms_client_to_server = Compression,
-		  compression_algorithms_server_to_client = Compression,
+		  encryption_algorithms_client_to_server = c2s(cipher,Algs),
+		  encryption_algorithms_server_to_client = s2c(cipher,Algs),
+		  mac_algorithms_client_to_server = c2s(mac,Algs),
+		  mac_algorithms_server_to_client = s2c(mac,Algs),
+		  compression_algorithms_client_to_server = c2s(compression,Algs),
+		  compression_algorithms_server_to_client = s2c(compression,Algs),
 		  languages_client_to_server = [],
 		  languages_server_to_client = []
 		 }.
 
+c2s(Key, Algs) -> x2y(client2server, Key, Algs).
+s2c(Key, Algs) -> x2y(server2client, Key, Algs).
+
+x2y(DirectionKey, Key, Algs) -> to_strings(proplists:get_value(DirectionKey, get_algs(Key,Algs))).
+
+get_algs(Key, Algs) -> proplists:get_value(Key, Algs, default_algorithms(Key)).
+
+to_strings(L) -> lists:map(fun erlang:atom_to_list/1, L).
+
 new_keys_message(Ssh0) ->
     {SshPacket, Ssh} = 
 	ssh_packet(#ssh_msg_newkeys{}, Ssh0),
     {ok, SshPacket, Ssh}.
-    
+
+
 handle_kexinit_msg(#ssh_msg_kexinit{} = CounterPart, #ssh_msg_kexinit{} = Own,
 			    #ssh{role = client} = Ssh0) ->
     {ok, Algoritms} = select_algorithm(client, Own, CounterPart),  
     case verify_algorithm(Algoritms) of
 	true ->
-	    install_messages(Algoritms#alg.kex),
 	    key_exchange_first_msg(Algoritms#alg.kex, 
 				   Ssh0#ssh{algorithms = Algoritms});
 	_  ->
 	    %% TODO: Correct code?
-	    throw(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_PROTOCOL_ERROR,
-				      description = "Selection of key exchange"
-				      " algorithm failed", 
-				      language = "en"})
+    ssh_connection_handler:disconnect(
+      #ssh_msg_disconnect{code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
+			  description = "Selection of key exchange algorithm failed"
+			 })
     end;
 
 handle_kexinit_msg(#ssh_msg_kexinit{} = CounterPart, #ssh_msg_kexinit{} = Own,
 			    #ssh{role = server} = Ssh) ->
     {ok, Algoritms} = select_algorithm(server, CounterPart, Own),
-    install_messages(Algoritms#alg.kex),
-    {ok, Ssh#ssh{algorithms = Algoritms}}.
+    case  verify_algorithm(Algoritms) of
+	true ->
+	    {ok, Ssh#ssh{algorithms = Algoritms}};
+	_ ->
+    ssh_connection_handler:disconnect(
+      #ssh_msg_disconnect{code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
+			  description = "Selection of key exchange algorithm failed"
+			 })
+    end.
 
 
 %% TODO: diffie-hellman-group14-sha1 should also be supported.
 %% Maybe check more things ...
-verify_algorithm(#alg{kex = 'diffie-hellman-group1-sha1'}) ->
-    true;
-verify_algorithm(#alg{kex = 'diffie-hellman-group-exchange-sha1'}) ->
-    true;
-verify_algorithm(_) ->
-    false.
-
-install_messages('diffie-hellman-group1-sha1') ->
-    ssh_bits:install_messages(kexdh_messages());
-install_messages('diffie-hellman-group-exchange-sha1') ->
-    ssh_bits:install_messages(kex_dh_gex_messages()).
 
-key_exchange_first_msg('diffie-hellman-group1-sha1', Ssh0) ->
-    {G, P} = dh_group1(),
-    {Private, Public} = dh_gen_key(G, P, 1024),
+verify_algorithm(#alg{kex = undefined}) -> false;
+verify_algorithm(#alg{hkey = undefined}) -> false;
+verify_algorithm(#alg{send_mac = undefined}) -> false;
+verify_algorithm(#alg{recv_mac = undefined}) -> false;
+verify_algorithm(#alg{encrypt = undefined}) -> false;
+verify_algorithm(#alg{decrypt = undefined}) -> false;
+verify_algorithm(#alg{compress = undefined}) -> false;
+verify_algorithm(#alg{decompress = undefined}) -> false;
+verify_algorithm(#alg{kex = Kex}) -> lists:member(Kex, supported_algorithms(kex)).
+
+%%%----------------------------------------------------------------
+%%%
+%%% Key exchange initialization
+%%%
+key_exchange_first_msg(Kex, Ssh0) when Kex == 'diffie-hellman-group1-sha1' ;
+				       Kex == 'diffie-hellman-group14-sha1' ->
+    {G, P} = dh_group(Kex),
+    {Public, Private} = generate_key(dh, [P,G]),
     {SshPacket, Ssh1} = ssh_packet(#ssh_msg_kexdh_init{e = Public}, Ssh0),
     {ok, SshPacket, 
      Ssh1#ssh{keyex_key = {{Private, Public}, {G, P}}}};
 
-key_exchange_first_msg('diffie-hellman-group-exchange-sha1', Ssh0) ->
-    Min = ?DEFAULT_DH_GROUP_MIN,
-    NBits = ?DEFAULT_DH_GROUP_NBITS,
-    Max = ?DEFAULT_DH_GROUP_MAX,
+key_exchange_first_msg(Kex, Ssh0=#ssh{opts=Opts}) when Kex == 'diffie-hellman-group-exchange-sha1' ;
+						       Kex == 'diffie-hellman-group-exchange-sha256' ->
+    {Min,NBits,Max} = 
+	proplists:get_value(dh_gex_limits, Opts, {?DEFAULT_DH_GROUP_MIN,
+						  ?DEFAULT_DH_GROUP_NBITS,
+						  ?DEFAULT_DH_GROUP_MAX}),
     {SshPacket, Ssh1} = 
 	ssh_packet(#ssh_msg_kex_dh_gex_request{min = Min, 
-					       n = NBits, max = Max}, 
+					       n = NBits,
+					       max = Max}, 
 		   Ssh0),
     {ok, SshPacket, 
-     Ssh1#ssh{keyex_info = {Min, Max, NBits}}}. 
-
-
-handle_kexdh_init(#ssh_msg_kexdh_init{e = E}, Ssh0) ->
-    {G, P} = dh_group1(),
-    {Private, Public} = dh_gen_key(G, P, 1024),
-    K = ssh_math:ipow(E, Private, P),
-    {Key, K_S} = get_host_key(Ssh0),
-    H = kex_h(Ssh0, K_S, E, Public, K),
-    H_SIG = sign_host_key(Ssh0, Key, H),
-    {SshPacket, Ssh1} = ssh_packet(#ssh_msg_kexdh_reply{public_host_key = K_S,
-							f = Public,
-							h_sig = H_SIG
-						       }, Ssh0),
-
-    {ok, SshPacket, Ssh1#ssh{keyex_key = {{Private, Public}, {G, P}},
-			     shared_secret = K,
-			     exchanged_hash = H,
-			     session_id = sid(Ssh1, H)}}.
-
-handle_kex_dh_gex_group(#ssh_msg_kex_dh_gex_group{p = P, g = G}, Ssh0) ->
-    {Private, Public} = dh_gen_key(G,P,1024),
-    {SshPacket, Ssh1} = 
-	ssh_packet(#ssh_msg_kex_dh_gex_init{e = Public}, Ssh0),
+     Ssh1#ssh{keyex_info = {Min, Max, NBits}}};
+
+key_exchange_first_msg(Kex, Ssh0) when Kex == 'ecdh-sha2-nistp256' ;
+				       Kex == 'ecdh-sha2-nistp384' ;
+				       Kex == 'ecdh-sha2-nistp521' ->
+    Curve = ecdh_curve(Kex),
+    {Public, Private} = generate_key(ecdh, Curve),
+    {SshPacket, Ssh1} = ssh_packet(#ssh_msg_kex_ecdh_init{q_c=Public},  Ssh0),
     {ok, SshPacket, 
-     Ssh1#ssh{keyex_key = {{Private, Public}, {G, P}}}}.
-
-handle_new_keys(#ssh_msg_newkeys{}, Ssh0) ->
-    try install_alg(Ssh0) of
-	#ssh{} = Ssh ->
-	    {ok, Ssh}
-    catch 
-	error:_Error -> %% TODO: Throw earlier ....
-	    throw(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_PROTOCOL_ERROR,
-				      description = "Install alg failed", 
-				      language = "en"})
-    end. 
+     Ssh1#ssh{keyex_key = {{Public,Private},Curve}}}.
+
+%%%----------------------------------------------------------------
+%%%
+%%% diffie-hellman-group1-sha1
+%%% diffie-hellman-group14-sha1
+%%% 
+handle_kexdh_init(#ssh_msg_kexdh_init{e = E}, 
+		  Ssh0 = #ssh{algorithms = #alg{kex=Kex}}) ->
+    %% server
+    {G, P} = dh_group(Kex),
+    if
+	1=<E, E=<(P-1) ->
+	    {Public, Private} = generate_key(dh, [P,G]),
+	    K = compute_key(dh, E, Private, [P,G]),
+	    MyPrivHostKey = get_host_key(Ssh0),
+	    MyPubHostKey = extract_public_key(MyPrivHostKey),
+	    H = kex_h(Ssh0, MyPubHostKey, E, Public, K),
+	    H_SIG = sign_host_key(Ssh0, MyPrivHostKey, H),
+	    {SshPacket, Ssh1} = 
+		ssh_packet(#ssh_msg_kexdh_reply{public_host_key = MyPubHostKey,
+						f = Public,
+						h_sig = H_SIG
+					       }, Ssh0),
+	    {ok, SshPacket, Ssh1#ssh{keyex_key = {{Private, Public}, {G, P}},
+				     shared_secret = K,
+				     exchanged_hash = H,
+				     session_id = sid(Ssh1, H)}};
 
+	true ->
+	    ssh_connection_handler:disconnect(
+	      #ssh_msg_disconnect{
+		 code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
+		 description = "Key exchange failed, 'e' out of bounds"},
+	      {error,bad_e_from_peer}
+	     )
+    end.
 
-%% %% Select algorithms
-handle_kexdh_reply(#ssh_msg_kexdh_reply{public_host_key = HostKey, f = F,
+handle_kexdh_reply(#ssh_msg_kexdh_reply{public_host_key = PeerPubHostKey,
+					f = F,
 					h_sig = H_SIG}, 
-		   #ssh{keyex_key = {{Private, Public}, {_G, P}}} = Ssh0) ->
-    K = ssh_math:ipow(F, Private, P),
-    H = kex_h(Ssh0, HostKey, Public, F, K),
-
-    case verify_host_key(Ssh0, HostKey, H, H_SIG) of
-	ok ->
-	    {SshPacket, Ssh} = ssh_packet(#ssh_msg_newkeys{}, Ssh0),
-	    {ok, SshPacket, Ssh#ssh{shared_secret  = K,
-				    exchanged_hash = H,
-				    session_id = sid(Ssh, H)}};
-	Error ->
-	    Disconnect = #ssh_msg_disconnect{
-	      code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
-	      description = "Key exchange failed",
-	      language = "en"},
-	    throw({Error, Disconnect})
+		   #ssh{keyex_key = {{Private, Public}, {G, P}}} = Ssh0) ->
+    %% client
+    if 
+	1=<F, F=<(P-1)->
+	    K = compute_key(dh, F, Private, [P,G]),
+	    H = kex_h(Ssh0, PeerPubHostKey, Public, F, K),
+
+	    case verify_host_key(Ssh0, PeerPubHostKey, H, H_SIG) of
+		ok ->
+		    {SshPacket, Ssh} = ssh_packet(#ssh_msg_newkeys{}, Ssh0),
+		    {ok, SshPacket, Ssh#ssh{shared_secret  = K,
+					    exchanged_hash = H,
+					    session_id = sid(Ssh, H)}};
+		Error ->
+	    ssh_connection_handler:disconnect(
+	      #ssh_msg_disconnect{
+		 code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
+		 description = "Key exchange failed"},
+	      Error)
+	    end;
+
+	true ->
+	    ssh_connection_handler:disconnect(
+	      #ssh_msg_disconnect{
+		 code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
+		 description = "Key exchange failed, 'f' out of bounds"},
+	      bad_f_from_peer
+	     )
     end.
 
-handle_kex_dh_gex_request(#ssh_msg_kex_dh_gex_request{min = _Min,
-						      n   = _NBits,
-						      max = _Max}, Ssh0) ->
-    {G,P} = dh_group1(), %% TODO real imp this seems to be a hack?!
-    {Private, Public} = dh_gen_key(G, P, 1024),
-    {SshPacket, Ssh} = 
-	ssh_packet(#ssh_msg_kex_dh_gex_group{p = P, g = G}, Ssh0),
+
+%%%----------------------------------------------------------------
+%%%
+%%% diffie-hellman-group-exchange-sha1
+%%% 
+handle_kex_dh_gex_request(#ssh_msg_kex_dh_gex_request{min = Min0,
+						      n   = NBits,
+						      max = Max0}, 
+			  Ssh0=#ssh{opts=Opts}) when Min0=<NBits, NBits=<Max0 ->
+    %% server
+    {Min, Max} = adjust_gex_min_max(Min0, Max0, Opts),
+    case public_key:dh_gex_group(Min, NBits, Max,
+				 proplists:get_value(dh_gex_groups,Opts)) of
+	{ok, {_Sz, {G,P}}} ->
+	    {Public, Private} = generate_key(dh, [P,G]),
+	    {SshPacket, Ssh} = 
+		ssh_packet(#ssh_msg_kex_dh_gex_group{p = P, g = G}, Ssh0),
+	    {ok, SshPacket, 
+	     Ssh#ssh{keyex_key = {{Private, Public}, {G, P}},
+		     keyex_info = {Min, Max, NBits}
+		    }};
+	{error,_} ->
+	    ssh_connection_handler:disconnect(
+	      #ssh_msg_disconnect{
+		 code = ?SSH_DISCONNECT_PROTOCOL_ERROR,
+		 description = "No possible diffie-hellman-group-exchange group found"
+		})
+    end;
+
+handle_kex_dh_gex_request(#ssh_msg_kex_dh_gex_request_old{n = NBits}, 
+			  Ssh0=#ssh{opts=Opts}) ->
+    %% server
+    %%
+    %% This message was in the draft-00 of rfc4419
+    %% (https://tools.ietf.org/html/draft-ietf-secsh-dh-group-exchange-00)
+    %% In later drafts and the rfc is "is used for backward compatibility".
+    %% Unfortunatly the rfc does not specify how to treat the parameter n
+    %% if there is no group of that modulus length :(
+    %% The draft-00 however specifies that n is the "... number of bits
+    %% the subgroup should have at least".
+    %% Further, it says that "Servers and clients SHOULD support groups
+    %% with a modulus length of k bits, where 1024 <= k <= 8192."
+    %%
+    Min0 = NBits,
+    Max0 = 8192,
+    {Min, Max} = adjust_gex_min_max(Min0, Max0, Opts),
+    case public_key:dh_gex_group(Min, NBits, Max,
+				 proplists:get_value(dh_gex_groups,Opts)) of
+	{ok, {_Sz, {G,P}}} ->
+	    {Public, Private} = generate_key(dh, [P,G]),
+	    {SshPacket, Ssh} = 
+		ssh_packet(#ssh_msg_kex_dh_gex_group{p = P, g = G}, Ssh0),
+	    {ok, SshPacket, 
+	     Ssh#ssh{keyex_key = {{Private, Public}, {G, P}},
+		     keyex_info = {-1, -1, NBits} % flag for kex_h hash calc
+		    }};
+	{error,_} ->
+	    ssh_connection_handler:disconnect(
+	      #ssh_msg_disconnect{
+		 code = ?SSH_DISCONNECT_PROTOCOL_ERROR,
+		 description = "No possible diffie-hellman-group-exchange group found"
+		})
+    end;
+
+handle_kex_dh_gex_request(_, _) ->
+    ssh_connection_handler:disconnect(
+	 #ssh_msg_disconnect{
+	    code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
+	    description = "Key exchange failed, bad values in ssh_msg_kex_dh_gex_request"},
+      bad_ssh_msg_kex_dh_gex_request).
+
+
+adjust_gex_min_max(Min0, Max0, Opts) ->
+    case proplists:get_value(dh_gex_limits, Opts) of
+	undefined ->
+	    {Min0, Max0};
+	{Min1, Max1} ->
+	    Min2 = max(Min0, Min1),
+	    Max2 = min(Max0, Max1),
+	    if
+		Min2 =< Max2 ->
+		    {Min2, Max2};
+		Max2 < Min2 ->
+		    ssh_connection_handler:disconnect(
+		      #ssh_msg_disconnect{
+			 code = ?SSH_DISCONNECT_PROTOCOL_ERROR,
+			 description = "No possible diffie-hellman-group-exchange group possible"
+			})
+	    end
+    end.
+		    
+
+handle_kex_dh_gex_group(#ssh_msg_kex_dh_gex_group{p = P, g = G}, Ssh0) ->
+    %% client
+    {Public, Private} = generate_key(dh, [P,G]),
+    {SshPacket, Ssh1} = 
+	ssh_packet(#ssh_msg_kex_dh_gex_init{e = Public}, Ssh0),	% Pub = G^Priv mod P (def)
+
     {ok, SshPacket, 
-     Ssh#ssh{keyex_key = {{Private, Public}, {G, P}}}}.
+     Ssh1#ssh{keyex_key = {{Private, Public}, {G, P}}}}.
 
-handle_kex_dh_gex_reply(#ssh_msg_kex_dh_gex_reply{public_host_key = HostKey, 
+handle_kex_dh_gex_init(#ssh_msg_kex_dh_gex_init{e = E}, 
+		       #ssh{keyex_key = {{Private, Public}, {G, P}},
+			    keyex_info = {Min, Max, NBits}} = 
+			   Ssh0) ->
+    %% server
+    if
+	1=<E, E=<(P-1) ->
+	    K = compute_key(dh, E, Private, [P,G]),
+	    if
+		1<K, K<(P-1) ->
+		    MyPrivHostKey = get_host_key(Ssh0),
+		    MyPubHostKey = extract_public_key(MyPrivHostKey),
+		    H = kex_h(Ssh0, MyPubHostKey, Min, NBits, Max, P, G, E, Public, K),
+		    H_SIG = sign_host_key(Ssh0, MyPrivHostKey, H),
+		    {SshPacket, Ssh} = 
+			ssh_packet(#ssh_msg_kex_dh_gex_reply{public_host_key = MyPubHostKey,
+							     f = Public,
+							     h_sig = H_SIG}, Ssh0),
+		    {ok, SshPacket, Ssh#ssh{shared_secret = K,
+					    exchanged_hash = H,
+					    session_id = sid(Ssh, H)
+					   }};
+		true ->
+	    ssh_connection_handler:disconnect(
+	      #ssh_msg_disconnect{
+		 code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
+		 description = "Key exchange failed, 'K' out of bounds"},
+	      bad_K)
+	    end;
+	true ->
+	    ssh_connection_handler:disconnect(
+	      #ssh_msg_disconnect{
+		 code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
+		 description = "Key exchange failed, 'e' out of bounds"},
+	      bad_e_from_peer)
+    end.
+
+handle_kex_dh_gex_reply(#ssh_msg_kex_dh_gex_reply{public_host_key = PeerPubHostKey, 
 						  f = F,
 						  h_sig = H_SIG},
 			#ssh{keyex_key = {{Private, Public}, {G, P}},
 			     keyex_info = {Min, Max, NBits}} = 
-		 	Ssh0) ->
-    K = ssh_math:ipow(F, Private, P),
-    H = kex_h(Ssh0, HostKey, Min, NBits, Max, P, G, Public, F, K),
-
-    case verify_host_key(Ssh0, HostKey, H, H_SIG) of
-	ok ->
-	    {SshPacket, Ssh} = ssh_packet(#ssh_msg_newkeys{}, Ssh0),
-	    {ok, SshPacket, Ssh#ssh{shared_secret  = K,
-			  exchanged_hash = H,
-			  session_id = sid(Ssh, H)}};
-	_Error ->
-	    Disconnect = #ssh_msg_disconnect{
-	      code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
-	      description = "Key exchange failed",
-	      language = "en"},
-	    throw(Disconnect)
-    end.	       
+			    Ssh0) ->
+    %% client
+    if 
+	1=<F, F=<(P-1)->
+	    K = compute_key(dh, F, Private, [P,G]),
+	    if
+		1<K, K<(P-1) ->
+		    H = kex_h(Ssh0, PeerPubHostKey, Min, NBits, Max, P, G, Public, F, K),
+
+		    case verify_host_key(Ssh0, PeerPubHostKey, H, H_SIG) of
+			ok ->
+			    {SshPacket, Ssh} = ssh_packet(#ssh_msg_newkeys{}, Ssh0),
+			    {ok, SshPacket, Ssh#ssh{shared_secret  = K,
+						    exchanged_hash = H,
+						    session_id = sid(Ssh, H)}};
+			_Error ->
+			    ssh_connection_handler:disconnect(
+			      #ssh_msg_disconnect{
+				 code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
+				 description = "Key exchange failed"
+				})
+		    end;
+
+		true ->
+		    ssh_connection_handler:disconnect(
+		      #ssh_msg_disconnect{
+			 code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
+			 description = "Key exchange failed, 'K' out of bounds"},
+		      bad_K)
+	    end;
+	true ->
+	    ssh_connection_handler:disconnect(
+	      #ssh_msg_disconnect{
+		 code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
+		 description = "Key exchange failed, 'f' out of bounds"},
+	      bad_f_from_peer
+	     )
+    end.
+
+%%%----------------------------------------------------------------
+%%%
+%%% diffie-hellman-ecdh-sha2-*
+%%% 
+handle_kex_ecdh_init(#ssh_msg_kex_ecdh_init{q_c = PeerPublic},
+		     Ssh0 = #ssh{algorithms = #alg{kex=Kex}}) ->
+    %% at server
+    Curve = ecdh_curve(Kex),
+    {MyPublic, MyPrivate} = generate_key(ecdh, Curve),
+    try
+	compute_key(ecdh, PeerPublic, MyPrivate, Curve)
+    of
+	K ->
+	    MyPrivHostKey = get_host_key(Ssh0),
+	    MyPubHostKey = extract_public_key(MyPrivHostKey),
+	    H = kex_h(Ssh0, Curve, MyPubHostKey, PeerPublic, MyPublic, K),
+	    H_SIG = sign_host_key(Ssh0, MyPrivHostKey, H),
+	    {SshPacket, Ssh1} = 
+		ssh_packet(#ssh_msg_kex_ecdh_reply{public_host_key = MyPubHostKey,
+						   q_s = MyPublic,
+						   h_sig = H_SIG},
+			   Ssh0),
+    	    {ok, SshPacket, Ssh1#ssh{keyex_key = {{MyPublic,MyPrivate},Curve},
+				     shared_secret = K,
+				     exchanged_hash = H,
+				     session_id = sid(Ssh1, H)}}
+    catch
+	_:_ ->
+	    ssh_connection_handler:disconnect(
+	      #ssh_msg_disconnect{
+		 code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
+		 description = "Peer ECDH public key is invalid"},
+	      invalid_peer_public_key)
+    end.
+
+handle_kex_ecdh_reply(#ssh_msg_kex_ecdh_reply{public_host_key = PeerPubHostKey,
+					      q_s = PeerPublic,
+					      h_sig = H_SIG},
+		      #ssh{keyex_key = {{MyPublic,MyPrivate}, Curve}} = Ssh0
+		     ) ->
+    %% at client
+    try
+	compute_key(ecdh, PeerPublic, MyPrivate, Curve)
+    of
+	K ->
+	    H = kex_h(Ssh0, Curve, PeerPubHostKey, MyPublic, PeerPublic, K), 
+	    case verify_host_key(Ssh0, PeerPubHostKey, H, H_SIG) of
+		ok ->
+		    {SshPacket, Ssh} = ssh_packet(#ssh_msg_newkeys{}, Ssh0),
+		    {ok, SshPacket, Ssh#ssh{shared_secret  = K,
+					    exchanged_hash = H,
+					    session_id = sid(Ssh, H)}};
+		Error ->
+		    ssh_connection_handler:disconnect(
+		       #ssh_msg_disconnect{
+			  code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
+			  description = "Key exchange failed"},
+		       Error)
+	    end
+    catch
+	_:_ ->
+	    ssh_connection_handler:disconnect(
+	      #ssh_msg_disconnect{
+		 code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
+		 description = "Peer ECDH public key is invalid"},
+	      invalid_peer_public_key)
+    end.
+
+
+%%%----------------------------------------------------------------
+handle_new_keys(#ssh_msg_newkeys{}, Ssh0) ->
+    try install_alg(Ssh0) of
+	#ssh{} = Ssh ->
+	    {ok, Ssh}
+    catch 
+	_C:_Error -> %% TODO: Throw earlier ....
+	    ssh_connection_handler:disconnect(
+	      #ssh_msg_disconnect{code = ?SSH_DISCONNECT_PROTOCOL_ERROR,
+				  description = "Install alg failed"
+				 })
+    end. 
 
 %% select session id
 sid(#ssh{session_id = undefined}, H) -> 
@@ -410,66 +690,50 @@ get_host_key(SSH) ->
     #ssh{key_cb = Mod, opts = Opts, algorithms = ALG} = SSH,
 
     case Mod:host_key(ALG#alg.hkey, Opts) of
-	{ok, #'RSAPrivateKey'{modulus = N, publicExponent = E} = Key} ->
-	    {Key,
-	     ssh_bits:encode(["ssh-rsa",E,N],[string,mpint,mpint])};
-	{ok, #'DSAPrivateKey'{y = Y, p = P, q = Q, g = G} = Key} ->
-	    {Key, ssh_bits:encode(["ssh-dss",P,Q,G,Y],
-				  [string,mpint,mpint,mpint,mpint])};
+	{ok, #'RSAPrivateKey'{} = Key} ->  Key;
+	{ok, #'DSAPrivateKey'{} = Key} ->  Key;
+	{ok, #'ECPrivateKey'{}  = Key} ->  Key;
 	Result ->
 	    exit({error, {Result, unsupported_key_type}})
     end.
 
-sign_host_key(_Ssh, #'RSAPrivateKey'{} = Private, H) ->
-    Hash = sha, %% Option ?!
-    Signature = sign(H, Hash, Private),
-    ssh_bits:encode(["ssh-rsa", Signature],[string, binary]);
-sign_host_key(_Ssh, #'DSAPrivateKey'{} = Private, H) ->
-    Hash = sha, %% Option ?!
-    RawSignature = sign(H, Hash, Private),
-    ssh_bits:encode(["ssh-dss", RawSignature],[string, binary]).
+sign_host_key(_Ssh, PrivateKey, H) ->
+     sign(H, sign_host_key_sha(PrivateKey), PrivateKey).
 
-verify_host_key(SSH, K_S, H, H_SIG) ->
-    ALG = SSH#ssh.algorithms,
-    case ALG#alg.hkey of
-	'ssh-rsa' ->
-	    verify_host_key_rsa(SSH, K_S, H, H_SIG);
-	'ssh-dss' ->
-	    verify_host_key_dss(SSH, K_S, H, H_SIG);
-	_ ->
-	    {error, bad_host_key_algorithm}
-    end.
+sign_host_key_sha(#'ECPrivateKey'{parameters = {namedCurve,OID}}) -> sha(OID);
+sign_host_key_sha(#'RSAPrivateKey'{}) -> sha;
+sign_host_key_sha(#'DSAPrivateKey'{}) -> sha.
 
-verify_host_key_rsa(SSH, K_S, H, H_SIG) ->
-    case ssh_bits:decode(K_S,[string,mpint,mpint]) of
-	["ssh-rsa", E, N] ->
-	    ["ssh-rsa",SIG] = ssh_bits:decode(H_SIG,[string,binary]),
-	    Public = #'RSAPublicKey'{publicExponent = E, modulus = N},
-	    case verify(H, sha, SIG, Public) of
-		false ->
-		    {error, bad_signature};
-		true ->
-		    known_host_key(SSH, Public, 'ssh-rsa')
-	    end;
-	_ ->
-	    {error, bad_format}
-    end.
 
-verify_host_key_dss(SSH, K_S, H, H_SIG) ->
-    case ssh_bits:decode(K_S,[string,mpint,mpint,mpint,mpint]) of
-	["ssh-dss",P,Q,G,Y] ->
-	    ["ssh-dss",SIG] = ssh_bits:decode(H_SIG,[string,binary]),
-	    Public = {Y,  #'Dss-Parms'{p = P, q = Q, g = G}},
-	    case verify(H, sha, SIG, Public) of
-		false ->
-		    {error, bad_signature};
-		true ->
-		    known_host_key(SSH, Public, 'ssh-dss')
-	    end;
-	_ ->
-	    {error, bad_host_key_format}
+extract_public_key(#'RSAPrivateKey'{modulus = N, publicExponent = E}) ->
+    #'RSAPublicKey'{modulus = N, publicExponent = E};
+extract_public_key(#'DSAPrivateKey'{y = Y, p = P, q = Q, g = G}) ->
+    {Y,  #'Dss-Parms'{p=P, q=Q, g=G}};
+extract_public_key(#'ECPrivateKey'{parameters = {namedCurve,OID},
+				   publicKey = Q}) ->
+    {#'ECPoint'{point=Q}, {namedCurve,OID}}.
+
+
+verify_host_key(SSH, PublicKey, Digest, Signature) ->
+    case verify(Digest, host_key_sha(PublicKey), Signature, PublicKey) of
+	false ->
+	    {error, bad_signature};
+	true ->
+	    known_host_key(SSH, PublicKey, public_algo(PublicKey))
     end.
 
+
+host_key_sha(#'RSAPublicKey'{})    -> sha;
+host_key_sha({_, #'Dss-Parms'{}})  -> sha;
+host_key_sha({#'ECPoint'{},{namedCurve,OID}}) -> sha(OID).
+
+public_algo(#'RSAPublicKey'{}) ->   'ssh-rsa';
+public_algo({_, #'Dss-Parms'{}}) -> 'ssh-dss';
+public_algo({#'ECPoint'{},{namedCurve,OID}}) -> 
+    Curve = public_key:oid2ssh_curvename(OID),
+    list_to_atom("ecdsa-sha2-" ++ binary_to_list(Curve)).
+
+
 accepted_host(Ssh, PeerName, Opts) ->
     case proplists:get_value(silently_accept_hosts, Opts, false) of
 	true ->
@@ -501,8 +765,12 @@ known_host_key(#ssh{opts = Opts, key_cb = Mod, peer = Peer} = Ssh,
 %%   The first algorithm in each list MUST be the preferred (guessed)
 %%   algorithm.  Each string MUST contain at least one algorithm name.
 select_algorithm(Role, Client, Server) ->
-    {Encrypt, Decrypt} = select_encrypt_decrypt(Role, Client, Server),
-    {SendMac, RecvMac} = select_send_recv_mac(Role, Client, Server),
+    {Encrypt0, Decrypt0} = select_encrypt_decrypt(Role, Client, Server),
+    {SendMac0, RecvMac0} = select_send_recv_mac(Role, Client, Server),
+
+    {Encrypt, SendMac} = aead_gcm_simultan(Encrypt0, SendMac0),
+    {Decrypt, RecvMac} = aead_gcm_simultan(Decrypt0, RecvMac0),
+
     {Compression, Decompression} = 
 	select_compression_decompression(Role, Client, Server),
 
@@ -533,6 +801,38 @@ select_algorithm(Role, Client, Server) ->
 	       s_lng = S_Lng},
     {ok, Alg}.
 
+
+%%% It is an agreed problem with RFC 5674 that if the selection is
+%%%   Cipher = AEAD_AES_x_GCM and
+%%%      Mac = AEAD_AES_y_GCM (where x =/= y)
+%%% then it is undefined what length should be selected.
+%%%
+%%% If only one of the two lengths (128,256) is available, I claim that
+%%% there is no such ambiguity.
+
+%%% From https://anongit.mindrot.org/openssh.git/plain/PROTOCOL
+%%% (read Nov 20, 2015)
+%%% 1.6 transport: AES-GCM
+%%% 
+%%% OpenSSH supports the AES-GCM algorithm as specified in RFC 5647.
+%%% Because of problems with the specification of the key exchange
+%%% the behaviour of OpenSSH differs from the RFC as follows:
+%%% 
+%%% AES-GCM is only negotiated as the cipher algorithms
+%%% "[email protected]" or "[email protected]" and never as
+%%% an MAC algorithm. Additionally, if AES-GCM is selected as the cipher
+%%% the exchanged MAC algorithms are ignored and there doesn't have to be
+%%% a matching MAC.
+
+aead_gcm_simultan('[email protected]', _) -> {'AEAD_AES_128_GCM', 'AEAD_AES_128_GCM'};
+aead_gcm_simultan('[email protected]', _) -> {'AEAD_AES_256_GCM', 'AEAD_AES_256_GCM'};
+aead_gcm_simultan('AEAD_AES_128_GCM', _) -> {'AEAD_AES_128_GCM', 'AEAD_AES_128_GCM'};
+aead_gcm_simultan('AEAD_AES_256_GCM', _) -> {'AEAD_AES_256_GCM', 'AEAD_AES_256_GCM'};
+aead_gcm_simultan(_, 'AEAD_AES_128_GCM') -> {'AEAD_AES_128_GCM', 'AEAD_AES_128_GCM'};
+aead_gcm_simultan(_, 'AEAD_AES_256_GCM') -> {'AEAD_AES_256_GCM', 'AEAD_AES_256_GCM'};
+aead_gcm_simultan(Cipher, Mac) -> {Cipher,Mac}.
+
+
 select_encrypt_decrypt(client, Client, Server) ->
     Encrypt = 
 	select(Client#ssh_msg_kexinit.encryption_algorithms_client_to_server,
@@ -567,18 +867,18 @@ select_compression_decompression(client, Client, Server) ->
     Compression = 
 	select(Client#ssh_msg_kexinit.compression_algorithms_client_to_server,
 	       Server#ssh_msg_kexinit.compression_algorithms_client_to_server),
-    Decomprssion = 
+    Decompression = 
 	select(Client#ssh_msg_kexinit.compression_algorithms_server_to_client,
 	       Server#ssh_msg_kexinit.compression_algorithms_server_to_client),
-    {Compression, Decomprssion};
+    {Compression, Decompression};
 select_compression_decompression(server, Client, Server) ->
-    Decomprssion = 
+    Decompression = 
 	select(Client#ssh_msg_kexinit.compression_algorithms_client_to_server,
 	       Server#ssh_msg_kexinit.compression_algorithms_client_to_server),
     Compression = 
 	select(Client#ssh_msg_kexinit.compression_algorithms_server_to_client,
 	       Server#ssh_msg_kexinit.compression_algorithms_server_to_client),
-    {Compression, Decomprssion}.
+    {Compression, Decompression}.
 
 install_alg(SSH) ->
     SSH1 = alg_final(SSH),
@@ -620,10 +920,16 @@ alg_final(SSH0) ->
     {ok,SSH6} = decompress_final(SSH5),
     SSH6.
 
-select_all(CL, SL) ->
+select_all(CL, SL) when length(CL) + length(SL) < ?MAX_NUM_ALGORITHMS ->
     A = CL -- SL,  %% algortihms only used by client
     %% algorithms used by client and server (client pref)
-    lists:map(fun(ALG) -> list_to_atom(ALG) end, (CL -- A)).
+    lists:map(fun(ALG) -> list_to_atom(ALG) end, (CL -- A));
+select_all(CL, SL) ->
+    Err = lists:concat(["Received too many algorithms (",length(CL),"+",length(SL)," >= ",?MAX_NUM_ALGORITHMS,")."]),
+    ssh_connection_handler:disconnect(
+      #ssh_msg_disconnect{code = ?SSH_DISCONNECT_PROTOCOL_ERROR,
+			  description = Err}).
+
 
 select([], []) ->
     none;
@@ -635,66 +941,155 @@ select(CL, SL) ->
     C.
 	    
 ssh_packet(#ssh_msg_kexinit{} = Msg, Ssh0) ->
-    BinMsg = ssh_bits:encode(Msg),
+    BinMsg = ssh_message:encode(Msg),
     Ssh = key_init(Ssh0#ssh.role, Ssh0, BinMsg),
     pack(BinMsg, Ssh);
 
 ssh_packet(Msg, Ssh) ->
-    BinMsg = ssh_bits:encode(Msg),
+    BinMsg = ssh_message:encode(Msg),
     pack(BinMsg, Ssh).
 
-pack(Data0, #ssh{encrypt_block_size = BlockSize, 
-		 send_sequence = SeqNum, send_mac = MacAlg,
-		 send_mac_key = MacKey} 
-     = Ssh0) when is_binary(Data0) ->
-    {Ssh1, Data} = compress(Ssh0, Data0),
-    PL = (BlockSize - ((4 + 1 + size(Data)) rem BlockSize)) rem BlockSize,
-    PaddingLen = if PL <  4 -> PL + BlockSize;
-		    true -> PL
-		 end,
-    Padding = ssh_bits:random(PaddingLen),
-    PacketLen = 1 + PaddingLen + size(Data),
-    PacketData = <<?UINT32(PacketLen),?BYTE(PaddingLen), 
-		  Data/binary, Padding/binary>>,
-    {Ssh2, EncPacket} = encrypt(Ssh1, PacketData),
-    MAC = mac(MacAlg, MacKey, SeqNum, PacketData),
-    Packet = [EncPacket, MAC],
-    Ssh = Ssh2#ssh{send_sequence = (SeqNum+1) band 16#ffffffff},
-    {Packet, Ssh}.
-
-unpack(EncodedSoFar, ReminingLenght, #ssh{recv_mac_size = MacSize} = Ssh0) ->
-    SshLength = ReminingLenght - MacSize,
-    {NoMac, Mac, Rest} = case MacSize of
-			     0 ->
-				 <<NoMac0:SshLength/binary, 
-				  Rest0/binary>> = EncodedSoFar,
-				 {NoMac0, <<>>, Rest0};
-			     _ ->
-				 <<NoMac0:SshLength/binary, 
-				  Mac0:MacSize/binary,
-				  Rest0/binary>> = EncodedSoFar,
-				 {NoMac0, Mac0, Rest0}
-			 end,
-    {Ssh1, DecData, <<>>} = 
-	case SshLength of
-	    0 ->
-		{Ssh0, <<>>, <<>>};
-	    _ ->
-		decrypt_blocks(NoMac, SshLength, Ssh0)
+pack(Data, Ssh=#ssh{}) ->
+    pack(Data, Ssh, 0).
+
+%%% Note: pack/3 is only to be called from tests that wants
+%%% to deliberetly send packets with wrong PacketLength!
+%%% Use pack/2 for all other purposes!
+pack(PlainText,
+     #ssh{send_sequence = SeqNum,
+	  send_mac = MacAlg,
+	  send_mac_key = MacKey,
+	  encrypt = CryptoAlg} = Ssh0,  PacketLenDeviationForTests) when is_binary(PlainText) ->
+
+    {Ssh1, CompressedPlainText} = compress(Ssh0, PlainText),
+    {EcryptedPacket, MAC, Ssh3} =
+	case pkt_type(CryptoAlg) of
+	    common ->
+		PaddingLen = padding_length(4+1+size(CompressedPlainText), Ssh0),
+		Padding =  ssh_bits:random(PaddingLen),
+		PlainPacketLen = 1 + PaddingLen + size(CompressedPlainText) + PacketLenDeviationForTests,
+		PlainPacketData = <<?UINT32(PlainPacketLen),?BYTE(PaddingLen), CompressedPlainText/binary, Padding/binary>>,
+		{Ssh2, EcryptedPacket0} = encrypt(Ssh1, PlainPacketData),
+		MAC0 = mac(MacAlg, MacKey, SeqNum, PlainPacketData),
+		{EcryptedPacket0, MAC0, Ssh2};
+	    aead ->
+		PaddingLen = padding_length(1+size(CompressedPlainText), Ssh0),
+		Padding =  ssh_bits:random(PaddingLen),
+		PlainPacketLen = 1 + PaddingLen + size(CompressedPlainText) + PacketLenDeviationForTests,
+		PlainPacketData = <<?BYTE(PaddingLen), CompressedPlainText/binary, Padding/binary>>,
+		{Ssh2, {EcryptedPacket0,MAC0}} = encrypt(Ssh1, {<<?UINT32(PlainPacketLen)>>,PlainPacketData}),
+		{<<?UINT32(PlainPacketLen),EcryptedPacket0/binary>>, MAC0, Ssh2}
 	end,
-    {Ssh1, DecData, Rest, Mac}.
+    FinalPacket = [EcryptedPacket, MAC],
+    Ssh = Ssh3#ssh{send_sequence = (SeqNum+1) band 16#ffffffff},
+    {FinalPacket, Ssh}.
+
+
+padding_length(Size, #ssh{encrypt_block_size = BlockSize,
+			  random_length_padding = RandomLengthPadding}) ->
+    PL = (BlockSize - (Size rem BlockSize)) rem BlockSize,
+    MinPaddingLen = if PL <  4 -> PL + BlockSize;
+		       true -> PL
+		    end,
+    PadBlockSize =  max(BlockSize,4),
+    MaxExtraBlocks = (max(RandomLengthPadding,MinPaddingLen) - MinPaddingLen) div PadBlockSize,
+    ExtraPaddingLen = try crypto:rand_uniform(0,MaxExtraBlocks)*PadBlockSize
+		      catch _:_ -> 0
+		      end,
+    MinPaddingLen + ExtraPaddingLen.
+
+
+
+handle_packet_part(<<>>, Encrypted0, undefined, #ssh{decrypt = CryptoAlg} = Ssh0) ->
+    %% New ssh packet
+    case get_length(pkt_type(CryptoAlg), Encrypted0, Ssh0) of
+	get_more ->
+	    %% too short to get the length
+	    {get_more, <<>>, Encrypted0, undefined, Ssh0};
+
+	{ok, PacketLen, _, _, _} when PacketLen > ?SSH_MAX_PACKET_SIZE ->
+	    %% far too long message than expected
+	    {error, {exceeds_max_size,PacketLen}};
+	
+	{ok, PacketLen, Decrypted, Encrypted1,
+	 #ssh{recv_mac_size = MacSize} = Ssh1} ->
+	    %% enough bytes so we got the length and can calculate how many
+	    %% more bytes to expect for a full packet
+	    TotalNeeded = (4 + PacketLen + MacSize),
+	    handle_packet_part(Decrypted, Encrypted1, TotalNeeded, Ssh1)
+    end;
+
+handle_packet_part(DecryptedPfx, EncryptedBuffer, TotalNeeded, Ssh0) 
+  when (size(DecryptedPfx)+size(EncryptedBuffer)) < TotalNeeded ->
+    %% need more bytes to finalize the packet
+    {get_more, DecryptedPfx, EncryptedBuffer, TotalNeeded, Ssh0};
+
+handle_packet_part(DecryptedPfx, EncryptedBuffer, TotalNeeded, 
+		   #ssh{recv_mac_size = MacSize,
+			decrypt = CryptoAlg} = Ssh0) ->
+    %% enough bytes to decode the packet.
+    DecryptLen = TotalNeeded - size(DecryptedPfx) - MacSize,
+    <<EncryptedSfx:DecryptLen/binary, Mac:MacSize/binary, NextPacketBytes/binary>> = EncryptedBuffer,
+    case pkt_type(CryptoAlg) of
+	common ->
+	    {Ssh1, DecryptedSfx} = decrypt(Ssh0, EncryptedSfx),
+	    DecryptedPacket = <<DecryptedPfx/binary, DecryptedSfx/binary>>,
+	    case is_valid_mac(Mac, DecryptedPacket, Ssh1) of
+		false ->
+		    {bad_mac, Ssh1};
+		true ->
+		    {Ssh, DecompressedPayload} = decompress(Ssh1, payload(DecryptedPacket)),
+		    {packet_decrypted, DecompressedPayload, NextPacketBytes, Ssh}
+	    end;
+	aead ->
+	    PacketLenBin = DecryptedPfx,
+	    case decrypt(Ssh0, {PacketLenBin,EncryptedSfx,Mac}) of
+		{Ssh1, error} ->
+		    {bad_mac, Ssh1};
+		{Ssh1, DecryptedSfx} ->
+                    DecryptedPacket = <<DecryptedPfx/binary, DecryptedSfx/binary>>,
+		    {Ssh, DecompressedPayload} = decompress(Ssh1, payload(DecryptedPacket)),
+		    {packet_decrypted, DecompressedPayload, NextPacketBytes, Ssh}
+	    end
+    end.
+    
+    
+get_length(common, EncryptedBuffer, #ssh{decrypt_block_size = BlockSize} = Ssh0) ->
+    case size(EncryptedBuffer) >= erlang:max(8, BlockSize) of
+	true ->
+	    <<EncBlock:BlockSize/binary, EncryptedRest/binary>> = EncryptedBuffer,
+	    {Ssh, 
+	     <<?UINT32(PacketLen),_/binary>> = Decrypted} = decrypt(Ssh0, EncBlock),
+	    {ok, PacketLen, Decrypted, EncryptedRest, Ssh};
+	false ->
+	    get_more
+    end;
+get_length(aead, EncryptedBuffer, Ssh) ->
+    case size(EncryptedBuffer) >= 4 of
+	true ->
+	    <<?UINT32(PacketLen), EncryptedRest/binary>> = EncryptedBuffer,
+	    {ok, PacketLen, <<?UINT32(PacketLen)>>, EncryptedRest, Ssh};
+	false ->
+	    get_more
+    end.
 
-msg_data(PacketData) ->
-    <<Len:32, PaddingLen:8, _/binary>> = PacketData,
-    DataLen = Len - PaddingLen - 1,
-    <<_:32, _:8, Data:DataLen/binary, 
-     _:PaddingLen/binary>> = PacketData,
-    Data.
+pkt_type('AEAD_AES_128_GCM') -> aead;
+pkt_type('AEAD_AES_256_GCM') -> aead;
+pkt_type(_) -> common.
+
+payload(<<PacketLen:32, PaddingLen:8, PayloadAndPadding/binary>>) ->
+    PayloadLen = PacketLen - PaddingLen - 1,
+    <<Payload:PayloadLen/binary, _/binary>> = PayloadAndPadding,
+    Payload.
 
 sign(SigData, Hash,  #'DSAPrivateKey'{} = Key) ->
     DerSignature = public_key:sign(SigData, Hash, Key),
     #'Dss-Sig-Value'{r = R, s = S} = public_key:der_decode('Dss-Sig-Value', DerSignature),
     <<R:160/big-unsigned-integer, S:160/big-unsigned-integer>>;
+sign(SigData, Hash, Key = #'ECPrivateKey'{}) ->
+    DerEncodedSign =  public_key:sign(SigData, Hash, Key),
+    #'ECDSA-Sig-Value'{r=R, s=S} = public_key:der_decode('ECDSA-Sig-Value', DerEncodedSign),
+    <<?Empint(R),?Empint(S)>>;
 sign(SigData, Hash, Key) ->
     public_key:sign(SigData, Hash, Key).
 
@@ -702,59 +1097,48 @@ verify(PlainText, Hash, Sig, {_,  #'Dss-Parms'{}} = Key) ->
     <<R:160/big-unsigned-integer, S:160/big-unsigned-integer>> = Sig,
     Signature = public_key:der_encode('Dss-Sig-Value', #'Dss-Sig-Value'{r = R, s = S}),
     public_key:verify(PlainText, Hash, Signature, Key);
+verify(PlainText, Hash, Sig, {#'ECPoint'{},_} = Key) ->
+    <<?UINT32(Rlen),R:Rlen/big-signed-integer-unit:8,
+      ?UINT32(Slen),S:Slen/big-signed-integer-unit:8>> = Sig,
+    Sval = #'ECDSA-Sig-Value'{r=R, s=S},
+    DerEncodedSig = public_key:der_encode('ECDSA-Sig-Value',Sval),
+    public_key:verify(PlainText, Hash, DerEncodedSig, Key);
 verify(PlainText, Hash, Sig, Key) ->
     public_key:verify(PlainText, Hash, Sig, Key).
 
-%% public key algorithms
-%%
-%%   ssh-dss              REQUIRED     sign    Raw DSS Key
-%%   ssh-rsa              RECOMMENDED  sign    Raw RSA Key
-%%   x509v3-sign-rsa      OPTIONAL     sign    X.509 certificates (RSA key)
-%%   x509v3-sign-dss      OPTIONAL     sign    X.509 certificates (DSS key)
-%%   spki-sign-rsa        OPTIONAL     sign    SPKI certificates (RSA key)
-%%   spki-sign-dss        OPTIONAL     sign    SPKI certificates (DSS key)
-%%   pgp-sign-rsa         OPTIONAL     sign    OpenPGP certificates (RSA key)
-%%   pgp-sign-dss         OPTIONAL     sign    OpenPGP certificates (DSS key)
-%%
-
-%% key exchange
-%%
-%%     diffie-hellman-group1-sha1       REQUIRED
-%%
-%%
 
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-%% Encryption
-%%
-%% chiphers
 %%
-%%       3des-cbc         REQUIRED          
-%%       three-key 3DES in CBC mode
-%%       blowfish-cbc     OPTIONAL          Blowfish in CBC mode
-%%       twofish256-cbc   OPTIONAL          Twofish in CBC mode,
-%%                                          with 256-bit key
-%%       twofish-cbc      OPTIONAL          alias for "twofish256-cbc" (this
-%%                                          is being retained for
-%%                                          historical reasons)
-%%       twofish192-cbc   OPTIONAL          Twofish with 192-bit key
-%%       twofish128-cbc   OPTIONAL          Twofish with 128-bit key
-%%       aes256-cbc       OPTIONAL          AES in CBC mode,
-%%                                          with 256-bit key
-%%       aes192-cbc       OPTIONAL          AES with 192-bit key
-%%       aes128-cbc       RECOMMENDED       AES with 128-bit key
-%%       serpent256-cbc   OPTIONAL          Serpent in CBC mode, with
-%%                                          256-bit key
-%%       serpent192-cbc   OPTIONAL          Serpent with 192-bit key
-%%       serpent128-cbc   OPTIONAL          Serpent with 128-bit key
-%%       arcfour          OPTIONAL          the ARCFOUR stream cipher
-%%       idea-cbc         OPTIONAL          IDEA in CBC mode
-%%       cast128-cbc      OPTIONAL          CAST-128 in CBC mode
-%%       none             OPTIONAL          no encryption; NOT RECOMMENDED
+%% Encryption
 %%  
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 
 encrypt_init(#ssh{encrypt = none} = Ssh) ->
     {ok, Ssh};
+encrypt_init(#ssh{encrypt = 'AEAD_AES_128_GCM', role = client} = Ssh) ->
+    IV = hash(Ssh, "A", 12*8),
+    <<K:16/binary>> = hash(Ssh, "C", 128),
+    {ok, Ssh#ssh{encrypt_keys = K,
+		 encrypt_block_size = 16,
+		 encrypt_ctx = IV}};
+encrypt_init(#ssh{encrypt = 'AEAD_AES_128_GCM', role = server} = Ssh) ->
+    IV = hash(Ssh, "B", 12*8),
+    <<K:16/binary>> = hash(Ssh, "D", 128),
+    {ok, Ssh#ssh{encrypt_keys = K,
+		 encrypt_block_size = 16,
+		 encrypt_ctx = IV}};
+encrypt_init(#ssh{encrypt = 'AEAD_AES_256_GCM', role = client} = Ssh) ->
+    IV = hash(Ssh, "A", 12*8),
+    <<K:32/binary>> = hash(Ssh, "C", 256),
+    {ok, Ssh#ssh{encrypt_keys = K,
+		 encrypt_block_size = 16,
+		 encrypt_ctx = IV}};
+encrypt_init(#ssh{encrypt = 'AEAD_AES_256_GCM', role = server} = Ssh) ->
+    IV = hash(Ssh, "B", 12*8),
+    <<K:32/binary>> = hash(Ssh, "D", 256),
+    {ok, Ssh#ssh{encrypt_keys = K,
+		 encrypt_block_size = 16,
+		 encrypt_ctx = IV}};
 encrypt_init(#ssh{encrypt = '3des-cbc', role = client} = Ssh) ->
     IV = hash(Ssh, "A", 64),
     <<K1:8/binary, K2:8/binary, K3:8/binary>> = hash(Ssh, "C", 192),
@@ -778,7 +1162,49 @@ encrypt_init(#ssh{encrypt = 'aes128-cbc', role = server} = Ssh) ->
     <<K:16/binary>> = hash(Ssh, "D", 128),
     {ok, Ssh#ssh{encrypt_keys = K,
 		 encrypt_block_size = 16,
-                 encrypt_ctx = IV}}.
+                 encrypt_ctx = IV}};
+encrypt_init(#ssh{encrypt = 'aes128-ctr', role = client} = Ssh) ->
+    IV = hash(Ssh, "A", 128),
+    <<K:16/binary>> = hash(Ssh, "C", 128),
+    State = crypto:stream_init(aes_ctr, K, IV),
+    {ok, Ssh#ssh{encrypt_keys = K,
+		 encrypt_block_size = 16,
+                 encrypt_ctx = State}};
+encrypt_init(#ssh{encrypt = 'aes192-ctr', role = client} = Ssh) ->
+    IV = hash(Ssh, "A", 128),
+    <<K:24/binary>> = hash(Ssh, "C", 192),
+    State = crypto:stream_init(aes_ctr, K, IV),
+    {ok, Ssh#ssh{encrypt_keys = K,
+		 encrypt_block_size = 16,
+                 encrypt_ctx = State}};
+encrypt_init(#ssh{encrypt = 'aes256-ctr', role = client} = Ssh) ->
+    IV = hash(Ssh, "A", 128),
+    <<K:32/binary>> = hash(Ssh, "C", 256),
+    State = crypto:stream_init(aes_ctr, K, IV),
+    {ok, Ssh#ssh{encrypt_keys = K,
+		 encrypt_block_size = 16,
+                 encrypt_ctx = State}};
+encrypt_init(#ssh{encrypt = 'aes128-ctr', role = server} = Ssh) ->
+    IV = hash(Ssh, "B", 128),
+    <<K:16/binary>> = hash(Ssh, "D", 128),
+    State = crypto:stream_init(aes_ctr, K, IV),
+    {ok, Ssh#ssh{encrypt_keys = K,
+		 encrypt_block_size = 16,
+                 encrypt_ctx = State}};
+encrypt_init(#ssh{encrypt = 'aes192-ctr', role = server} = Ssh) ->
+    IV = hash(Ssh, "B", 128),
+    <<K:24/binary>> = hash(Ssh, "D", 192),
+    State = crypto:stream_init(aes_ctr, K, IV),
+    {ok, Ssh#ssh{encrypt_keys = K,
+		 encrypt_block_size = 16,
+                 encrypt_ctx = State}};
+encrypt_init(#ssh{encrypt = 'aes256-ctr', role = server} = Ssh) ->
+    IV = hash(Ssh, "B", 128),
+    <<K:32/binary>> = hash(Ssh, "D", 256),
+    State = crypto:stream_init(aes_ctr, K, IV),
+    {ok, Ssh#ssh{encrypt_keys = K,
+		 encrypt_block_size = 16,
+                 encrypt_ctx = State}}.
 
 encrypt_final(Ssh) ->
     {ok, Ssh#ssh{encrypt = none, 
@@ -789,6 +1215,18 @@ encrypt_final(Ssh) ->
 
 encrypt(#ssh{encrypt = none} = Ssh, Data) ->
     {Ssh, Data};
+encrypt(#ssh{encrypt = 'AEAD_AES_128_GCM',
+            encrypt_keys = K,
+            encrypt_ctx = IV0} = Ssh, Data={_AAD,_Ptext}) ->
+    Enc = {_Ctext,_Ctag} = crypto:block_encrypt(aes_gcm, K, IV0, Data),
+    IV = next_gcm_iv(IV0),
+    {Ssh#ssh{encrypt_ctx = IV}, Enc};
+encrypt(#ssh{encrypt = 'AEAD_AES_256_GCM',
+            encrypt_keys = K,
+            encrypt_ctx = IV0} = Ssh, Data={_AAD,_Ptext}) ->
+    Enc = {_Ctext,_Ctag} = crypto:block_encrypt(aes_gcm, K, IV0, Data),
+    IV = next_gcm_iv(IV0),
+    {Ssh#ssh{encrypt_ctx = IV}, Enc};
 encrypt(#ssh{encrypt = '3des-cbc',
 	     encrypt_keys = {K1,K2,K3},
 	     encrypt_ctx = IV0} = Ssh, Data) ->
@@ -800,7 +1238,19 @@ encrypt(#ssh{encrypt = 'aes128-cbc',
             encrypt_ctx = IV0} = Ssh, Data) ->
     Enc = crypto:block_encrypt(aes_cbc128, K,IV0,Data),
     IV = crypto:next_iv(aes_cbc, Enc),
-    {Ssh#ssh{encrypt_ctx = IV}, Enc}.
+    {Ssh#ssh{encrypt_ctx = IV}, Enc};
+encrypt(#ssh{encrypt = 'aes128-ctr',
+            encrypt_ctx = State0} = Ssh, Data) ->
+    {State, Enc} = crypto:stream_encrypt(State0,Data),
+    {Ssh#ssh{encrypt_ctx = State}, Enc};
+encrypt(#ssh{encrypt = 'aes192-ctr',
+            encrypt_ctx = State0} = Ssh, Data) ->
+    {State, Enc} = crypto:stream_encrypt(State0,Data),
+    {Ssh#ssh{encrypt_ctx = State}, Enc};
+encrypt(#ssh{encrypt = 'aes256-ctr',
+            encrypt_ctx = State0} = Ssh, Data) ->
+    {State, Enc} = crypto:stream_encrypt(State0,Data),
+    {Ssh#ssh{encrypt_ctx = State}, Enc}.
   
 
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
@@ -809,6 +1259,30 @@ encrypt(#ssh{encrypt = 'aes128-cbc',
 
 decrypt_init(#ssh{decrypt = none} = Ssh) ->
     {ok, Ssh};
+decrypt_init(#ssh{decrypt = 'AEAD_AES_128_GCM', role = client} = Ssh) ->
+    IV = hash(Ssh, "B", 12*8),
+    <<K:16/binary>> = hash(Ssh, "D", 128),
+    {ok, Ssh#ssh{decrypt_keys = K,
+		 decrypt_block_size = 16,
+		 decrypt_ctx = IV}};
+decrypt_init(#ssh{decrypt = 'AEAD_AES_128_GCM', role = server} = Ssh) ->
+    IV = hash(Ssh, "A", 12*8),
+    <<K:16/binary>> = hash(Ssh, "C", 128),
+    {ok, Ssh#ssh{decrypt_keys = K,
+		 decrypt_block_size = 16,
+		 decrypt_ctx = IV}};
+decrypt_init(#ssh{decrypt = 'AEAD_AES_256_GCM', role = client} = Ssh) ->
+    IV = hash(Ssh, "B", 12*8),
+    <<K:32/binary>> = hash(Ssh, "D", 256),
+    {ok, Ssh#ssh{decrypt_keys = K,
+		 decrypt_block_size = 16,
+		 decrypt_ctx = IV}};
+decrypt_init(#ssh{decrypt = 'AEAD_AES_256_GCM', role = server} = Ssh) ->
+    IV = hash(Ssh, "A", 12*8),
+    <<K:32/binary>> = hash(Ssh, "C", 256),
+    {ok, Ssh#ssh{decrypt_keys = K,
+		 decrypt_block_size = 16,
+		 decrypt_ctx = IV}};
 decrypt_init(#ssh{decrypt = '3des-cbc', role = client} = Ssh) ->
     {IV, KD} = {hash(Ssh, "B", 64),
 		hash(Ssh, "D", 192)},
@@ -832,7 +1306,49 @@ decrypt_init(#ssh{decrypt = 'aes128-cbc', role = server} = Ssh) ->
 		hash(Ssh, "C", 128)},
     <<K:16/binary>> = KD,
     {ok, Ssh#ssh{decrypt_keys = K, decrypt_ctx = IV,
-		 decrypt_block_size = 16}}.
+		 decrypt_block_size = 16}};
+decrypt_init(#ssh{decrypt = 'aes128-ctr', role = client} = Ssh) ->
+	IV = hash(Ssh, "B", 128),
+    <<K:16/binary>> = hash(Ssh, "D", 128),
+    State = crypto:stream_init(aes_ctr, K, IV),
+    {ok, Ssh#ssh{decrypt_keys = K,
+		 decrypt_block_size = 16,
+                 decrypt_ctx = State}};
+decrypt_init(#ssh{decrypt = 'aes192-ctr', role = client} = Ssh) ->
+	IV = hash(Ssh, "B", 128),
+    <<K:24/binary>> = hash(Ssh, "D", 192),
+    State = crypto:stream_init(aes_ctr, K, IV),
+    {ok, Ssh#ssh{decrypt_keys = K,
+		 decrypt_block_size = 16,
+                 decrypt_ctx = State}};
+decrypt_init(#ssh{decrypt = 'aes256-ctr', role = client} = Ssh) ->
+	IV = hash(Ssh, "B", 128),
+    <<K:32/binary>> = hash(Ssh, "D", 256),
+    State = crypto:stream_init(aes_ctr, K, IV),
+    {ok, Ssh#ssh{decrypt_keys = K,
+		 decrypt_block_size = 16,
+                 decrypt_ctx = State}};
+decrypt_init(#ssh{decrypt = 'aes128-ctr', role = server} = Ssh) ->
+	IV = hash(Ssh, "A", 128),
+    <<K:16/binary>> = hash(Ssh, "C", 128),
+    State = crypto:stream_init(aes_ctr, K, IV),
+    {ok, Ssh#ssh{decrypt_keys = K,
+		 decrypt_block_size = 16,
+                 decrypt_ctx = State}};
+decrypt_init(#ssh{decrypt = 'aes192-ctr', role = server} = Ssh) ->
+	IV = hash(Ssh, "A", 128),
+    <<K:24/binary>> = hash(Ssh, "C", 192),
+    State = crypto:stream_init(aes_ctr, K, IV),
+    {ok, Ssh#ssh{decrypt_keys = K,
+		 decrypt_block_size = 16,
+                 decrypt_ctx = State}};
+decrypt_init(#ssh{decrypt = 'aes256-ctr', role = server} = Ssh) ->
+	IV = hash(Ssh, "A", 128),
+    <<K:32/binary>> = hash(Ssh, "C", 256),
+    State = crypto:stream_init(aes_ctr, K, IV),
+    {ok, Ssh#ssh{decrypt_keys = K,
+		 decrypt_block_size = 16,
+                 decrypt_ctx = State}}.
 
   
 decrypt_final(Ssh) ->
@@ -841,8 +1357,22 @@ decrypt_final(Ssh) ->
 		  decrypt_ctx = undefined,
 		  decrypt_block_size = 8}}.
 
+decrypt(Ssh, <<>>) ->
+    {Ssh, <<>>};
 decrypt(#ssh{decrypt = none} = Ssh, Data) ->
     {Ssh, Data};
+decrypt(#ssh{decrypt = 'AEAD_AES_128_GCM',
+	     decrypt_keys = K,
+	     decrypt_ctx = IV0} = Ssh, Data = {_AAD,_Ctext,_Ctag}) ->
+    Dec = crypto:block_decrypt(aes_gcm, K, IV0, Data), % Dec = PlainText | error 
+    IV = next_gcm_iv(IV0),
+    {Ssh#ssh{decrypt_ctx = IV}, Dec};
+decrypt(#ssh{decrypt = 'AEAD_AES_256_GCM',
+	     decrypt_keys = K,
+	     decrypt_ctx = IV0} = Ssh, Data = {_AAD,_Ctext,_Ctag}) ->
+    Dec = crypto:block_decrypt(aes_gcm, K, IV0, Data), % Dec = PlainText | error 
+    IV = next_gcm_iv(IV0),
+    {Ssh#ssh{decrypt_ctx = IV}, Dec};
 decrypt(#ssh{decrypt = '3des-cbc', decrypt_keys = Keys,
 	     decrypt_ctx = IV0} = Ssh, Data) ->
     {K1, K2, K3} = Keys,
@@ -853,15 +1383,32 @@ decrypt(#ssh{decrypt = 'aes128-cbc', decrypt_keys = Key,
 	     decrypt_ctx = IV0} = Ssh, Data) ->
     Dec = crypto:block_decrypt(aes_cbc128, Key,IV0,Data),
     IV = crypto:next_iv(aes_cbc, Data),
-    {Ssh#ssh{decrypt_ctx = IV}, Dec}.
+    {Ssh#ssh{decrypt_ctx = IV}, Dec};
+decrypt(#ssh{decrypt = 'aes128-ctr',
+            decrypt_ctx = State0} = Ssh, Data) ->
+    {State, Enc} = crypto:stream_decrypt(State0,Data),
+    {Ssh#ssh{decrypt_ctx = State}, Enc};
+decrypt(#ssh{decrypt = 'aes192-ctr',
+            decrypt_ctx = State0} = Ssh, Data) ->
+    {State, Enc} = crypto:stream_decrypt(State0,Data),
+    {Ssh#ssh{decrypt_ctx = State}, Enc};
+decrypt(#ssh{decrypt = 'aes256-ctr',
+            decrypt_ctx = State0} = Ssh, Data) ->
+    {State, Enc} = crypto:stream_decrypt(State0,Data),
+    {Ssh#ssh{decrypt_ctx = State}, Enc}.
+
+
+next_gcm_iv(<<Fixed:32, InvCtr:64>>) -> <<Fixed:32, (InvCtr+1):64>>.
 
 
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 %% Compression
 %%
-%%     none     REQUIRED        no compression
-%%     zlib     OPTIONAL        ZLIB (LZ77) compression
+%%     none             REQUIRED        no compression
+%%     zlib             OPTIONAL        ZLIB (LZ77) compression
+%%     openssh_zlib     OPTIONAL        ZLIB (LZ77) compression
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
 compress_init(SSH) ->
     compress_init(SSH, 1).
 
@@ -870,19 +1417,32 @@ compress_init(#ssh{compress = none} = Ssh, _) ->
 compress_init(#ssh{compress = zlib} = Ssh, Level) ->
     Zlib = zlib:open(),
     ok = zlib:deflateInit(Zlib, Level),
+    {ok, Ssh#ssh{compress_ctx = Zlib}};
+compress_init(#ssh{compress = '[email protected]'} = Ssh, Level) ->
+    Zlib = zlib:open(),
+    ok = zlib:deflateInit(Zlib, Level),
     {ok, Ssh#ssh{compress_ctx = Zlib}}.
 
-
 compress_final(#ssh{compress = none} = Ssh) ->
     {ok, Ssh};
 compress_final(#ssh{compress = zlib, compress_ctx = Context} = Ssh) ->
     zlib:close(Context),
+    {ok, Ssh#ssh{compress = none, compress_ctx = undefined}};
+compress_final(#ssh{compress = '[email protected]', authenticated = false} = Ssh) ->
+    {ok, Ssh};
+compress_final(#ssh{compress = '[email protected]', compress_ctx = Context, authenticated = true} = Ssh) ->
+    zlib:close(Context),
     {ok, Ssh#ssh{compress = none, compress_ctx = undefined}}.
 
 compress(#ssh{compress = none} = Ssh, Data) ->
     {Ssh, Data};
 compress(#ssh{compress = zlib, compress_ctx = Context} = Ssh, Data) ->
     Compressed = zlib:deflate(Context, Data, sync),
+    {Ssh, list_to_binary(Compressed)};
+compress(#ssh{compress = '[email protected]', authenticated = false} = Ssh, Data) ->
+    {Ssh, Data};
+compress(#ssh{compress = '[email protected]', compress_ctx = Context, authenticated = true} = Ssh, Data) ->
+    Compressed = zlib:deflate(Context, Data, sync),
     {Ssh, list_to_binary(Compressed)}.
 
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
@@ -894,64 +1454,83 @@ decompress_init(#ssh{decompress = none} = Ssh) ->
 decompress_init(#ssh{decompress = zlib} = Ssh) ->
     Zlib = zlib:open(),
     ok = zlib:inflateInit(Zlib),
+    {ok, Ssh#ssh{decompress_ctx = Zlib}};
+decompress_init(#ssh{decompress = '[email protected]'} = Ssh) ->
+    Zlib = zlib:open(),
+    ok = zlib:inflateInit(Zlib),
     {ok, Ssh#ssh{decompress_ctx = Zlib}}.
 
 decompress_final(#ssh{decompress = none} = Ssh) ->
     {ok, Ssh};
 decompress_final(#ssh{decompress = zlib, decompress_ctx = Context} = Ssh) ->
     zlib:close(Context),
+    {ok, Ssh#ssh{decompress = none, decompress_ctx = undefined}};
+decompress_final(#ssh{decompress = '[email protected]', authenticated = false} = Ssh) ->
+    {ok, Ssh};
+decompress_final(#ssh{decompress = '[email protected]', decompress_ctx = Context, authenticated = true} = Ssh) ->
+    zlib:close(Context),
     {ok, Ssh#ssh{decompress = none, decompress_ctx = undefined}}.
 
 decompress(#ssh{decompress = none} = Ssh, Data) ->
     {Ssh, Data};
 decompress(#ssh{decompress = zlib, decompress_ctx = Context} = Ssh, Data) ->
     Decompressed = zlib:inflate(Context, Data),
+    {Ssh, list_to_binary(Decompressed)};
+decompress(#ssh{decompress = '[email protected]', authenticated = false} = Ssh, Data) ->
+    {Ssh, Data};
+decompress(#ssh{decompress = '[email protected]', decompress_ctx = Context, authenticated = true} = Ssh, Data) ->
+    Decompressed = zlib:inflate(Context, Data),
     {Ssh, list_to_binary(Decompressed)}.
 
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-%% MAC calculation
 %%
-%%     hmac-sha1    REQUIRED        HMAC-SHA1 (digest length = key
-%%                                  length = 20)
-%%     hmac-sha1-96 RECOMMENDED     first 96 bits of HMAC-SHA1 (digest
-%%                                  length = 12, key length = 20)
-%%     hmac-md5     OPTIONAL        HMAC-MD5 (digest length = key
-%%                                  length = 16)
-%%     hmac-md5-96  OPTIONAL        first 96 bits of HMAC-MD5 (digest
-%%                                  length = 12, key length = 16)
-%%     none         OPTIONAL        no MAC; NOT RECOMMENDED
+%% MAC calculation
 %%
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 
 send_mac_init(SSH) ->
-    case SSH#ssh.role of
-	client ->
-	    KeySize =mac_key_size(SSH#ssh.send_mac),
-	    Key = hash(SSH, "E", KeySize),
-	    {ok, SSH#ssh { send_mac_key = Key }};
-	server ->
-	    KeySize = mac_key_size(SSH#ssh.send_mac),
-	    Key = hash(SSH, "F", KeySize),
-	    {ok, SSH#ssh { send_mac_key = Key }}
+    case pkt_type(SSH#ssh.send_mac) of
+	common ->
+	    case SSH#ssh.role of
+		client ->
+		    KeySize = mac_key_size(SSH#ssh.send_mac),
+		    Key = hash(SSH, "E", KeySize),
+		    {ok, SSH#ssh { send_mac_key = Key }};
+		server ->
+		    KeySize = mac_key_size(SSH#ssh.send_mac),
+		    Key = hash(SSH, "F", KeySize),
+		    {ok, SSH#ssh { send_mac_key = Key }}
+	    end;
+	aead ->
+	    %% Not applicable
+	    {ok, SSH}
     end.
 
 send_mac_final(SSH) ->
-    {ok, SSH#ssh {  send_mac = none, send_mac_key = undefined }}.
+    {ok, SSH#ssh {send_mac = none, 
+		  send_mac_key = undefined }}.
+
 
 recv_mac_init(SSH) ->
-    case SSH#ssh.role of
-	client ->
-	    Key = hash(SSH, "F", mac_key_size(SSH#ssh.recv_mac)),
-	    {ok, SSH#ssh { recv_mac_key = Key }};
-	server ->
-	    Key = hash(SSH, "E", mac_key_size(SSH#ssh.recv_mac)),
-	    {ok, SSH#ssh { recv_mac_key = Key }}
+    case pkt_type(SSH#ssh.recv_mac) of
+	common ->
+	    case SSH#ssh.role of
+		client ->
+		    Key = hash(SSH, "F", mac_key_size(SSH#ssh.recv_mac)),
+		    {ok, SSH#ssh { recv_mac_key = Key }};
+		server ->
+		    Key = hash(SSH, "E", mac_key_size(SSH#ssh.recv_mac)),
+		    {ok, SSH#ssh { recv_mac_key = Key }}
+	    end;
+	aead ->
+	    %% Not applicable
+	    {ok, SSH}
     end.
 
 recv_mac_final(SSH) ->
     {ok, SSH#ssh { recv_mac = none, recv_mac_key = undefined }}.
 
-mac(none, _ , _, _) ->  
+mac(none, _ , _, _) ->
     <<>>;
 mac('hmac-sha1', Key, SeqNum, Data) ->
     crypto:hmac(sha, Key, [<<?UINT32(SeqNum)>>, Data]);
@@ -960,7 +1539,11 @@ mac('hmac-sha1-96', Key, SeqNum, Data) ->
 mac('hmac-md5', Key, SeqNum, Data) ->
     crypto:hmac(md5, Key, [<<?UINT32(SeqNum)>>, Data]);
 mac('hmac-md5-96', Key, SeqNum, Data) ->
-    crypto:hmac(md5, Key, [<<?UINT32(SeqNum)>>, Data], mac_digest_size('hmac-md5-96')).
+    crypto:hmac(md5, Key, [<<?UINT32(SeqNum)>>, Data], mac_digest_size('hmac-md5-96'));
+mac('hmac-sha2-256', Key, SeqNum, Data) ->
+	crypto:hmac(sha256, Key, [<<?UINT32(SeqNum)>>, Data]);
+mac('hmac-sha2-512', Key, SeqNum, Data) ->
+	crypto:hmac(sha512, Key, [<<?UINT32(SeqNum)>>, Data]).
 
 %% return N hash bytes (HASH)
 hash(SSH, Char, Bits) ->
@@ -968,8 +1551,20 @@ hash(SSH, Char, Bits) ->
 	case SSH#ssh.kex of
 	    'diffie-hellman-group1-sha1' ->
 		fun(Data) -> crypto:hash(sha, Data) end;
+	    'diffie-hellman-group14-sha1' ->
+		fun(Data) -> crypto:hash(sha, Data) end;
+
 	    'diffie-hellman-group-exchange-sha1' ->
 		fun(Data) -> crypto:hash(sha, Data) end;
+	    'diffie-hellman-group-exchange-sha256' ->
+		fun(Data) -> crypto:hash(sha256, Data) end;
+
+	    'ecdh-sha2-nistp256' ->
+		fun(Data) -> crypto:hash(sha256,Data) end;
+	    'ecdh-sha2-nistp384' ->
+		fun(Data) -> crypto:hash(sha384,Data) end;
+	    'ecdh-sha2-nistp521' ->
+		fun(Data) -> crypto:hash(sha512,Data) end;
 	    _ ->
 		exit({bad_algorithm,SSH#ssh.kex})
 	end,
@@ -992,45 +1587,66 @@ hash(K, H, Ki, N, HASH) ->
     Kj = HASH([K, H, Ki]),
     hash(K, H, <<Ki/binary, Kj/binary>>, N-128, HASH).
 
-kex_h(SSH, K_S, E, F, K) ->
-    L = ssh_bits:encode([SSH#ssh.c_version, SSH#ssh.s_version,
-			 SSH#ssh.c_keyinit, SSH#ssh.s_keyinit,
-			 K_S, E,F,K],
-			[string,string,binary,binary,binary,
-			 mpint,mpint,mpint]),
-    crypto:hash(sha,L).
- 
-
-kex_h(SSH, K_S, Min, NBits, Max, Prime, Gen, E, F, K) ->
+kex_h(SSH, Key, E, F, K) ->
+    KeyBin = public_key:ssh_encode(Key, ssh2_pubkey),
+    L = <<?Estring(SSH#ssh.c_version), ?Estring(SSH#ssh.s_version),
+	  ?Ebinary(SSH#ssh.c_keyinit), ?Ebinary(SSH#ssh.s_keyinit), ?Ebinary(KeyBin),
+	  ?Empint(E), ?Empint(F), ?Empint(K)>>,
+    crypto:hash(sha((SSH#ssh.algorithms)#alg.kex), L).
+
+kex_h(SSH, Curve, Key, Q_c, Q_s, K) ->
+    KeyBin = public_key:ssh_encode(Key, ssh2_pubkey),
+    L = <<?Estring(SSH#ssh.c_version), ?Estring(SSH#ssh.s_version),
+	  ?Ebinary(SSH#ssh.c_keyinit), ?Ebinary(SSH#ssh.s_keyinit), ?Ebinary(KeyBin),
+	  ?Empint(Q_c), ?Empint(Q_s), ?Empint(K)>>,
+    crypto:hash(sha(Curve), L).
+
+kex_h(SSH, Key, Min, NBits, Max, Prime, Gen, E, F, K) ->
+    KeyBin = public_key:ssh_encode(Key, ssh2_pubkey),
     L = if Min==-1; Max==-1 ->
-		Ts = [string,string,binary,binary,binary,
-		      uint32,
-		      mpint,mpint,mpint,mpint,mpint],
-		ssh_bits:encode([SSH#ssh.c_version,SSH#ssh.s_version,
-				 SSH#ssh.c_keyinit,SSH#ssh.s_keyinit,
-				 K_S, NBits, Prime, Gen, E,F,K],
-				Ts);
+		%% flag from 'ssh_msg_kex_dh_gex_request_old'
+		%% It was like this before that message was supported,
+		%% why?
+		<<?Estring(SSH#ssh.c_version), ?Estring(SSH#ssh.s_version),
+		  ?Ebinary(SSH#ssh.c_keyinit), ?Ebinary(SSH#ssh.s_keyinit), ?Ebinary(KeyBin),
+		  ?Empint(E), ?Empint(F), ?Empint(K)>>;
 	   true ->
-		Ts = [string,string,binary,binary,binary,
-		      uint32,uint32,uint32,
-		      mpint,mpint,mpint,mpint,mpint],
-		ssh_bits:encode([SSH#ssh.c_version,SSH#ssh.s_version,
-				 SSH#ssh.c_keyinit,SSH#ssh.s_keyinit,
-				 K_S, Min, NBits, Max,
-				 Prime, Gen, E,F,K], Ts)
+		<<?Estring(SSH#ssh.c_version), ?Estring(SSH#ssh.s_version),
+		  ?Ebinary(SSH#ssh.c_keyinit), ?Ebinary(SSH#ssh.s_keyinit), ?Ebinary(KeyBin),
+		  ?Euint32(Min), ?Euint32(NBits), ?Euint32(Max),
+		  ?Empint(Prime), ?Empint(Gen), ?Empint(E), ?Empint(F), ?Empint(K)>>
 	end,
-    crypto:hash(sha,L).
+    crypto:hash(sha((SSH#ssh.algorithms)#alg.kex), L).
   
+
+sha(secp256r1) -> sha256;
+sha(secp384r1) -> sha384;
+sha(secp521r1) -> sha512;
+sha('diffie-hellman-group1-sha1') -> sha;
+sha('diffie-hellman-group14-sha1') -> sha;
+sha('diffie-hellman-group-exchange-sha1')   -> sha;
+sha('diffie-hellman-group-exchange-sha256') -> sha256;
+sha(?'secp256r1') -> sha(secp256r1);
+sha(?'secp384r1') -> sha(secp384r1);
+sha(?'secp521r1') -> sha(secp521r1).
+
+
 mac_key_size('hmac-sha1')    -> 20*8;
 mac_key_size('hmac-sha1-96') -> 20*8;
 mac_key_size('hmac-md5')     -> 16*8;
 mac_key_size('hmac-md5-96')  -> 16*8;
+mac_key_size('hmac-sha2-256')-> 32*8;
+mac_key_size('hmac-sha2-512')-> 512;
 mac_key_size(none) -> 0.
 
 mac_digest_size('hmac-sha1')    -> 20;
 mac_digest_size('hmac-sha1-96') -> 12;
 mac_digest_size('hmac-md5')    -> 20;
 mac_digest_size('hmac-md5-96') -> 12;
+mac_digest_size('hmac-sha2-256') -> 32;
+mac_digest_size('hmac-sha2-512') -> 64;
+mac_digest_size('AEAD_AES_128_GCM') -> 16;
+mac_digest_size('AEAD_AES_256_GCM') -> 16;
 mac_digest_size(none) -> 0.
 
 peer_name({Host, _}) ->
@@ -1042,12 +1658,91 @@ peer_name({Host, _}) ->
 %%
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 
-dh_group1() ->
-    {2, 16#FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE65381FFFFFFFFFFFFFFFF}.
+dh_group('diffie-hellman-group1-sha1') ->  ?dh_group1;
+dh_group('diffie-hellman-group14-sha1') -> ?dh_group14.
+
+%%%----------------------------------------------------------------
+generate_key(Algorithm, Args) ->
+    {Public,Private} = crypto:generate_key(Algorithm, Args),
+    {crypto:bytes_to_integer(Public), crypto:bytes_to_integer(Private)}.
+
+      
+compute_key(Algorithm, OthersPublic, MyPrivate, Args) ->
+    Shared = crypto:compute_key(Algorithm, OthersPublic, MyPrivate, Args),
+    crypto:bytes_to_integer(Shared).
+
+
+ecdh_curve('ecdh-sha2-nistp256') -> secp256r1;
+ecdh_curve('ecdh-sha2-nistp384') -> secp384r1;
+ecdh_curve('ecdh-sha2-nistp521') -> secp521r1.
+
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%%
+%% Utils for default_algorithms/1 and supported_algorithms/1
+%%
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+supported_algorithms(Key, [{client2server,BL1},{server2client,BL2}]) ->
+    [{client2server,As1},{server2client,As2}] = supported_algorithms(Key),
+    [{client2server,As1--BL1},{server2client,As2--BL2}];
+supported_algorithms(Key, BlackList) ->
+    supported_algorithms(Key) -- BlackList.
 
-dh_gen_key(G, P, _) ->
-    {Public, Private} = crypto:generate_key(dh, [P, G]),
-    {crypto:bytes_to_integer(Private), crypto:bytes_to_integer(Public)}.
+
+select_crypto_supported(L) ->    
+    Sup = [{ec_curve,crypto_supported_curves()} | crypto:supports()],
+    [Name || {Name,CryptoRequires} <- L,
+	     crypto_supported(CryptoRequires, Sup)].
+
+crypto_supported_curves() ->
+    try crypto:ec_curves()
+    catch _:_ -> []
+    end.
+
+crypto_supported(Conditions, Supported) ->
+    lists:all( fun({Tag,CryptoName}) when is_atom(CryptoName) ->
+		       crypto_name_supported(Tag,CryptoName,Supported);
+		  ({Tag,{Name,Len}}) when is_integer(Len) ->
+		       crypto_name_supported(Tag,Name,Supported) andalso
+			   len_supported(Name,Len)
+	       end, Conditions).
+
+crypto_name_supported(Tag, CryptoName, Supported) ->
+    lists:member(CryptoName, proplists:get_value(Tag,Supported,[])).
+
+len_supported(Name, Len) ->
+    try
+	case Name of
+	    aes_ctr ->
+		{_, <<_/binary>>} = 
+		    %% Test encryption
+		    crypto:stream_encrypt(crypto:stream_init(Name, <<0:Len>>, <<0:128>>), <<"">>);
+	    aes_gcm ->
+		{<<_/binary>>, <<_/binary>>} = 
+		    crypto:block_encrypt(Name, 
+					 _Key = <<0:Len>>,
+					 _IV = <<0:12/unsigned-unit:8>>,
+					 {<<"AAD">>,"PT"})
+	end
+    of
+	_ -> true
+    catch
+	_:_ -> false
+    end.
+	    
+
+same(Algs) ->  [{client2server,Algs}, {server2client,Algs}].
+
+
+%% default_algorithms(kex) -> % Example of how to disable an algorithm
+%%     supported_algorithms(kex, ['ecdh-sha2-nistp521']);
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%%
+%% Other utils
+%%
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 
 trim_tail(Str) ->
     lists:reverse(trim_head(lists:reverse(Str))).
diff --git a/lib/ssh/src/ssh_transport.hrl b/lib/ssh/src/ssh_transport.hrl
index 27d3e32355..f91cb1dd63 100644
--- a/lib/ssh/src/ssh_transport.hrl
+++ b/lib/ssh/src/ssh_transport.hrl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2008-2010. All Rights Reserved.
+%% Copyright Ericsson AB 2008-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
@@ -28,9 +29,12 @@
 
 -define(DEFAULT_CLIENT_VERSION, {2, 0}).
 -define(DEFAULT_SERVER_VERSION, {2, 0}).
--define(DEFAULT_DH_GROUP_MIN, 512).
--define(DEFAULT_DH_GROUP_NBITS, 1024).
--define(DEFAULT_DH_GROUP_MAX,  4096).
+
+-define(MAX_NUM_ALGORITHMS, 200).
+
+-define(DEFAULT_DH_GROUP_MIN,   1024).
+-define(DEFAULT_DH_GROUP_NBITS, 2048).
+-define(DEFAULT_DH_GROUP_MAX,   8192).
 
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 %%
@@ -108,8 +112,9 @@
 %%
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 
-%% diffie-hellman-group1-sha1
--define(SSH_MSG_KEXDH_INIT,  30).
+%% diffie-hellman-group1-sha1 | diffie-hellman-group14-sha1
+
+-define(SSH_MSG_KEXDH_INIT,   30).
 -define(SSH_MSG_KEXDH_REPLY,  31).
 
 -record(ssh_msg_kexdh_init,
@@ -133,7 +138,7 @@
 %%
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 
-%% diffie-hellman-group-exchange-sha1
+%% diffie-hellman-group-exchange-sha1 | diffie-hellman-group-exchange-sha256
 -define(SSH_MSG_KEX_DH_GEX_REQUEST_OLD, 30).
 -define(SSH_MSG_KEX_DH_GEX_REQUEST,     34).
 -define(SSH_MSG_KEX_DH_GEX_GROUP,       31).
@@ -170,7 +175,36 @@
 	  h_sig
 	 }).
 
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%%
+%% KEY ECDH messages
+%%
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+%% ecdh-sha2-nistp256 | ecdh-sha2-nistp384 | ecdh-sha2-nistp521
+
+-define(SSH_MSG_KEX_ECDH_INIT,                30).
+-define(SSH_MSG_KEX_ECDH_REPLY,               31).
+
+-record(ssh_msg_kex_ecdh_init,
+	{
+	  q_c    % string (client's ephemeral public key octet string)
+	}).
+
+-record(ssh_msg_kex_ecdh_reply,
+	{
+	  public_host_key,   % string (server's public host key) (k_s)
+	  q_s,               % string (server's ephemeral public key octet string)
+	  h_sig              % string (the signature on the exchange hash)
+	}).
+
+
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%%
 %% error codes
+%%
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
 -define(SSH_DISCONNECT_HOST_NOT_ALLOWED_TO_CONNECT,   1).
 -define(SSH_DISCONNECT_PROTOCOL_ERROR,   2).
 -define(SSH_DISCONNECT_KEY_EXCHANGE_FAILED,   3).
@@ -188,48 +222,20 @@
 -define(SSH_DISCONNECT_ILLEGAL_USER_NAME,  15).
 
 
-%%%----------------------------------------------------------------------
-%%% #   DH_14_xxx
-%%% Description: Oakley group 14 prime numbers and generator. Used in
-%%%              diffie-hellman-group1-sha1 key exchange method.
-%%%----------------------------------------------------------------------
-%%%----------------------------------------------------------------------
-%%% #   DH_14_P
-%%% Description: Prime for this group
-%%%----------------------------------------------------------------------
-
--define(DH_14_P,
-	<<000,000,000,129,000,255,255,255,255,255,255,255,255,201,015,218,
-	  162,033,104,194,052,196,198,098,139,128,220,028,209,041,002,078,
-	  008,138,103,204,116,002,011,190,166,059,019,155,034,081,074,008,
-	  121,142,052,004,221,239,149,025,179,205,058,067,027,048,043,010,
-	  109,242,095,020,055,079,225,053,109,109,081,194,069,228,133,181,
-	  118,098,094,126,198,244,076,066,233,166,055,237,107,011,255,092,
-	  182,244,006,183,237,238,056,107,251,090,137,159,165,174,159,036,
-	  017,124,075,031,230,073,040,102,081,236,230,083,129,255,255,255,
-	  255,255,255,255,255>>).
-
-%%%----------------------------------------------------------------------
-%%% #   DH_14_G
-%%% Description: Generator for DH_14_P.
-%%%----------------------------------------------------------------------
-
--define(DH_14_G, <<0,0,0,1,2>>).
-
-%%%----------------------------------------------------------------------
-%%% #   DH_14_Q
-%%% Description: Group order (DH_14_P - 1) / 2.
-%%%----------------------------------------------------------------------
-
--define(DH_14_Q,
-	<<000,000,000,128,127,255,255,255,255,255,255,255,228,135,237,081,
-	  016,180,097,026,098,099,049,069,192,110,014,104,148,129,039,004,
-	  069,051,230,058,001,005,223,083,029,137,205,145,040,165,004,060,
-	  199,026,002,110,247,202,140,217,230,157,033,141,152,021,133,054,
-	  249,047,138,027,167,240,154,182,182,168,225,034,242,066,218,187,
-	  049,047,063,099,122,038,033,116,211,027,246,181,133,255,174,091,
-	  122,003,091,246,247,028,053,253,173,068,207,210,215,079,146,008,
-	  190,037,143,243,036,148,051,040,246,115,041,192,255,255,255,255,
-	  255,255,255,255>>).
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%%
+%% groups
+%%
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+%%% rfc 2489, ch 6.2
+%%% Size 1024
+-define(dh_group1,
+	 {2, 16#FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE65381FFFFFFFFFFFFFFFF}).
+
+%%% rfc 3526, ch3
+%%% Size 2048
+-define(dh_group14,
+	 {2, 16#FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AACAA68FFFFFFFFFFFFFFFF}).
 
 -endif. % -ifdef(ssh_transport).
diff --git a/lib/ssh/src/ssh_userauth.hrl b/lib/ssh/src/ssh_userauth.hrl
index 7c38719d92..2cfc1f0f83 100644
--- a/lib/ssh/src/ssh_userauth.hrl
+++ b/lib/ssh/src/ssh_userauth.hrl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2005-2011. All Rights Reserved.
+%% Copyright Ericsson AB 2005-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
diff --git a/lib/ssh/src/ssh_userreg.erl b/lib/ssh/src/ssh_userreg.erl
deleted file mode 100644
index f901461aea..0000000000
--- a/lib/ssh/src/ssh_userreg.erl
+++ /dev/null
@@ -1,141 +0,0 @@
-%%
-%% %CopyrightBegin%
-%%
-%% Copyright Ericsson AB 2008-2011. All Rights Reserved.
-%%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
-%%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
-%%
-%% %CopyrightEnd%
-%%
-
-%%
-%% Description: User register for ssh_cli
-
--module(ssh_userreg).
-
--behaviour(gen_server).
-
-%% API
--export([start_link/0,
-	 register_user/2,
-	 lookup_user/1,
-	 delete_user/1]).
-
-%% gen_server callbacks
--export([init/1,
-	 handle_call/3,
-	 handle_cast/2,
-	 handle_info/2,
-	 terminate/2,
-	 code_change/3]).
-
--record(state, {user_db = []}).
-
-%%====================================================================
-%% API
-%%====================================================================
-%%--------------------------------------------------------------------
-%% Function: start_link() -> {ok,Pid} | ignore | {error,Error}
-%% Description: Starts the server
-%%--------------------------------------------------------------------
-start_link() ->
-    gen_server:start_link({local, ?MODULE}, ?MODULE, [], []).
-
-register_user(User, Cm) ->
-    gen_server:cast(?MODULE, {register, {User, Cm}}).
-
-delete_user(Cm) ->
-    gen_server:cast(?MODULE, {delete, Cm}).
-
-lookup_user(Cm) ->
-    gen_server:call(?MODULE, {get_user, Cm}, infinity).
-
-%%====================================================================
-%% gen_server callbacks
-%%====================================================================
-
-%%--------------------------------------------------------------------
-%% Function: init(Args) -> {ok, State} |
-%%                         {ok, State, Timeout} |
-%%                         ignore               |
-%%                         {stop, Reason}
-%% Description: Initiates the server
-%%--------------------------------------------------------------------
-init([]) ->
-    {ok, #state{}}.
-
-%%--------------------------------------------------------------------
-%% Function: %% handle_call(Request, From, State) -> {reply, Reply, State} |
-%%                                      {reply, Reply, State, Timeout} |
-%%                                      {noreply, State} |
-%%                                      {noreply, State, Timeout} |
-%%                                      {stop, Reason, Reply, State} |
-%%                                      {stop, Reason, State}
-%% Description: Handling call messages
-%%--------------------------------------------------------------------
-handle_call({get_user, Cm}, _From, #state{user_db = Db} = State) ->
-    User = lookup(Cm, Db),
-    {reply, {ok, User}, State}.
-
-%%--------------------------------------------------------------------
-%% Function: handle_cast(Msg, State) -> {noreply, State} |
-%%                                      {noreply, State, Timeout} |
-%%                                      {stop, Reason, State}
-%% Description: Handling cast messages
-%%--------------------------------------------------------------------
-handle_cast({register, UserCm}, State) ->
-    {noreply, insert(UserCm, State)};
-handle_cast({delete, UserCm}, State) ->
-    {noreply, delete(UserCm, State)}.
-
-%%--------------------------------------------------------------------
-%% Function: handle_info(Info, State) -> {noreply, State} |
-%%                                       {noreply, State, Timeout} |
-%%                                       {stop, Reason, State}
-%% Description: Handling all non call/cast messages
-%%--------------------------------------------------------------------
-handle_info(_Info, State) ->
-    {noreply, State}.
-
-%%--------------------------------------------------------------------
-%% Function: terminate(Reason, State) -> void()
-%% Description: This function is called by a gen_server when it is about to
-%% terminate. It should be the opposite of Module:init/1 and do any necessary
-%% cleaning up. When it returns, the gen_server terminates with Reason.
-%% The return value is ignored.
-%%--------------------------------------------------------------------
-terminate(_Reason, _State) ->
-    ok.
-
-%%--------------------------------------------------------------------
-%% Func: code_change(OldVsn, State, Extra) -> {ok, NewState}
-%% Description: Convert process state when code is changed
-%%--------------------------------------------------------------------
-code_change(_OldVsn, State, _Extra) ->
-    {ok, State}.
-
-%%--------------------------------------------------------------------
-%%% Internal functions
-%%--------------------------------------------------------------------
-insert({User, Cm}, #state{user_db = Db} = State) ->
-    State#state{user_db = [{User, Cm} | Db]}.
-
-delete(Cm, #state{user_db = Db} = State) ->
-    State#state{user_db = lists:keydelete(Cm, 2, Db)}.
-
-lookup(_, []) ->
-    undefined;
-lookup(Cm, [{User, Cm} | _Rest]) ->
-    User;
-lookup(Cm, [_ | Rest]) ->
-    lookup(Cm, Rest).
-
diff --git a/lib/ssh/src/ssh_xfer.erl b/lib/ssh/src/ssh_xfer.erl
index b299868d41..e1680c120e 100644
--- a/lib/ssh/src/ssh_xfer.erl
+++ b/lib/ssh/src/ssh_xfer.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2005-2013. All Rights Reserved.
+%% Copyright Ericsson AB 2005-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
@@ -23,12 +24,12 @@
 
 -module(ssh_xfer).
 
--export([attach/2, connect/3]).
+-export([attach/2, attach/3, connect/3, connect/4, connect/5]).
 -export([open/6, opendir/3, readdir/3, close/3, read/5, write/5,
 	 rename/5, remove/3, mkdir/4, rmdir/3, realpath/3, extended/4,
 	 stat/4, fstat/4, lstat/4, setstat/4,
 	 readlink/3, fsetstat/4, symlink/4,
-	 protocol_version_request/1,
+	 protocol_version_request/2,
 	 xf_reply/2,
 	 xf_send_reply/3, xf_send_names/3, xf_send_name/4,
 	 xf_send_status/3, xf_send_status/4, xf_send_status/5,
@@ -46,33 +47,49 @@
 -define(is_set(F, Bits),
 	((F) band (Bits)) == (F)).
 
--define(XFER_PACKET_SIZE, 32768).
--define(XFER_WINDOW_SIZE, 4*?XFER_PACKET_SIZE).
+-define(XFER_PACKET_SIZE, 65536).
+-define(XFER_WINDOW_SIZE, 20*?XFER_PACKET_SIZE).
 
 attach(CM, Opts) ->
-    open_xfer(CM, Opts).
+    open_xfer(CM, Opts, []).
+
+attach(CM, Opts, ChanOpts) ->
+    open_xfer(CM, Opts, ChanOpts).
+
 
 connect(Host, Port, Opts) ->
     case ssh:connect(Host, Port, Opts) of
-	{ok, CM} -> open_xfer(CM, Opts);
+	{ok, CM} -> open_xfer(CM, Opts, []);
+	Error -> Error
+    end.
+
+connect(Host, Port, Opts, Timeout) ->
+    connect(Host, Port, Opts, [], Timeout).
+
+connect(Host, Port, Opts, ChanOpts, Timeout) ->
+    case ssh:connect(Host, Port, Opts, Timeout) of
+	{ok, CM} -> open_xfer(CM, [{timeout, Timeout}|Opts], ChanOpts);
+	{error, Timeout} -> {error, timeout};
 	Error -> Error
     end.
 
-open_xfer(CM, Opts) ->
+
+open_xfer(CM, Opts, ChanOpts) ->
     TMO = proplists:get_value(timeout, Opts, infinity),
-    case ssh_connection:session_channel(CM, ?XFER_WINDOW_SIZE, ?XFER_PACKET_SIZE, TMO) of
+    WindowSize = proplists:get_value(window_size, ChanOpts,  ?XFER_WINDOW_SIZE),
+    PacketSize = proplists:get_value(packet_size, ChanOpts,  ?XFER_PACKET_SIZE),
+    case ssh_connection:session_channel(CM, WindowSize, PacketSize, TMO) of
 	{ok, ChannelId} ->
 	    {ok, ChannelId, CM};
 	Error -> 
 	    Error
     end.
 
-protocol_version_request(XF) ->
-    xf_request(XF, ?SSH_FXP_INIT, <<?UINT32(?SSH_SFTP_PROTOCOL_VERSION)>>).
+protocol_version_request(XF, Version) ->
+    xf_request(XF, ?SSH_FXP_INIT, <<?UINT32(Version)>>).
 
 open(XF, ReqID, FileName, Access, Flags, Attrs) -> 
     Vsn = XF#ssh_xfer.vsn,
-    FileName1 = unicode:characters_to_binary(FileName),
     MBits = if Vsn >= 5 -> 
 		    M = encode_ace_mask(Access),
 		    ?uint32(M);
@@ -82,7 +99,7 @@ open(XF, ReqID, FileName, Access, Flags, Attrs) ->
     F = encode_open_flags(Flags),
     xf_request(XF,?SSH_FXP_OPEN, 
 	       [?uint32(ReqID),
-		?binary(FileName1),
+		?string_utf8(FileName),
 		MBits,
 		?uint32(F),
 		encode_ATTR(Vsn,Attrs)]).    
@@ -90,7 +107,7 @@ open(XF, ReqID, FileName, Access, Flags, Attrs) ->
 opendir(XF, ReqID, DirName) ->
     xf_request(XF, ?SSH_FXP_OPENDIR, 
 	       [?uint32(ReqID),
-		?string(DirName)]).
+		?string_utf8(DirName)]).
 
 
 close(XF, ReqID, Handle) ->
@@ -127,13 +144,11 @@ write(XF,ReqID, Handle, Offset, Data) ->
 remove(XF, ReqID, File) ->
     xf_request(XF, ?SSH_FXP_REMOVE, 
 	       [?uint32(ReqID),
-		?string(File)]).
+		?string_utf8(File)]).
 
 %% Rename a file/directory
-rename(XF, ReqID, Old, New, Flags) ->
+rename(XF, ReqID, OldPath, NewPath, Flags) ->
     Vsn = XF#ssh_xfer.vsn,
-    OldPath = unicode:characters_to_binary(Old),
-    NewPath = unicode:characters_to_binary(New),
     FlagBits
 	= if Vsn >= 5 ->
 		  F0 = encode_rename_flags(Flags),
@@ -143,30 +158,27 @@ rename(XF, ReqID, Old, New, Flags) ->
 	  end,
     xf_request(XF, ?SSH_FXP_RENAME, 
 	       [?uint32(ReqID),
-		?binary(OldPath),
-		?binary(NewPath),
+		?string_utf8(OldPath),
+		?string_utf8(NewPath),
 		FlagBits]).
 
 
 
 %% Create directory
 mkdir(XF, ReqID, Path, Attrs) ->
-    Path1 = unicode:characters_to_binary(Path),
     xf_request(XF, ?SSH_FXP_MKDIR, 
 	       [?uint32(ReqID),
-		?binary(Path1),
+		?string_utf8(Path),
 		encode_ATTR(XF#ssh_xfer.vsn, Attrs)]).
 
 %% Remove a directory
 rmdir(XF, ReqID, Dir) ->
-    Dir1 = unicode:characters_to_binary(Dir),
     xf_request(XF, ?SSH_FXP_RMDIR,
 	       [?uint32(ReqID),
-		?binary(Dir1)]).
+		?string_utf8(Dir)]).
 
 %% Stat file
 stat(XF, ReqID, Path, Flags) ->
-    Path1 = unicode:characters_to_binary(Path),
     Vsn = XF#ssh_xfer.vsn,
     AttrFlags = if Vsn >= 5 ->
 			F = encode_attr_flags(Vsn, Flags),
@@ -176,13 +188,12 @@ stat(XF, ReqID, Path, Flags) ->
 		end,
     xf_request(XF, ?SSH_FXP_STAT, 
 	       [?uint32(ReqID),
-		?binary(Path1),
+		?string_utf8(Path),
 		AttrFlags]).
 
 
 %% Stat file - follow symbolic links
 lstat(XF, ReqID, Path, Flags) ->
-    Path1 = unicode:characters_to_binary(Path),
     Vsn = XF#ssh_xfer.vsn,
     AttrFlags = if Vsn >= 5 ->
 			F = encode_attr_flags(Vsn, Flags),
@@ -192,7 +203,7 @@ lstat(XF, ReqID, Path, Flags) ->
 		end,
     xf_request(XF, ?SSH_FXP_LSTAT, 
 	     [?uint32(ReqID),
-	      ?binary(Path1),
+	      ?string_utf8(Path),
 	      AttrFlags]).
 
 %% Stat open file
@@ -211,10 +222,9 @@ fstat(XF, ReqID, Handle, Flags) ->
 
 %% Modify file attributes
 setstat(XF, ReqID, Path, Attrs) ->
-    Path1 = unicode:characters_to_binary(Path),
     xf_request(XF, ?SSH_FXP_SETSTAT, 
 	       [?uint32(ReqID),
-		?binary(Path1),
+		?string_utf8(Path),
 		encode_ATTR(XF#ssh_xfer.vsn, Attrs)]).
 
 
@@ -227,10 +237,9 @@ fsetstat(XF, ReqID, Handle, Attrs) ->
     
 %% Read a symbolic link
 readlink(XF, ReqID, Path) ->
-    Path1 = unicode:characters_to_binary(Path),
     xf_request(XF, ?SSH_FXP_READLINK, 
 	       [?uint32(ReqID),
-		?binary(Path1)]).
+		?string_utf8(Path)]).
 
 
 %% Create a symbolic link    
@@ -244,10 +253,9 @@ symlink(XF, ReqID, LinkPath, TargetPath) ->
 
 %% Convert a path into a 'canonical' form
 realpath(XF, ReqID, Path) ->
-    Path1 = unicode:characters_to_binary(Path),
     xf_request(XF, ?SSH_FXP_REALPATH,     
 	       [?uint32(ReqID),
-		?binary(Path1)]).
+		?string_utf8(Path)]).
 
 extended(XF, ReqID, Request, Data) ->
     xf_request(XF, ?SSH_FXP_EXTENDED,
@@ -267,7 +275,7 @@ xf_request(XF, Op, Arg) ->
 		   list_to_binary(Arg)
 	   end,
     Size = 1+size(Data),
-    ssh_connection:send(CM, Channel, <<?UINT32(Size), Op, Data/binary>>).
+    ssh_connection:send(CM, Channel, [<<?UINT32(Size), Op, Data/binary>>]).
 
 xf_send_reply(#ssh_xfer{cm = CM, channel = Channel}, Op, Arg) ->    
     Data = if 
@@ -277,7 +285,7 @@ xf_send_reply(#ssh_xfer{cm = CM, channel = Channel}, Op, Arg) ->
 		   list_to_binary(Arg)
 	   end,
     Size = 1 + size(Data),
-    ssh_connection:send(CM, Channel, <<?UINT32(Size), Op, Data/binary>>).
+    ssh_connection:send(CM, Channel, [<<?UINT32(Size), Op, Data/binary>>]).
 
 xf_send_name(XF, ReqId, Name, Attr) ->
     xf_send_names(XF, ReqId, [{Name, Attr}]).
@@ -296,7 +304,10 @@ xf_send_names(#ssh_xfer{cm = CM, channel = Channel, vsn = Vsn},
     Count = length(NamesAndAttrs),
     {Data, Len} = encode_names(Vsn, NamesAndAttrs),
     Size = 1 + 4 + 4 + Len,
-    ToSend = [<<?UINT32(Size), ?SSH_FXP_NAME, ?UINT32(ReqId), ?UINT32(Count)>>,
+    ToSend = [<<?UINT32(Size), 
+		?SSH_FXP_NAME, 
+		?UINT32(ReqId),
+		?UINT32(Count)>>,
 	      Data],
     ssh_connection:send(CM, Channel, ToSend).
 
@@ -818,25 +829,27 @@ decode_names(_Vsn, 0, _Data) ->
 decode_names(Vsn, I, <<?UINT32(Len), FileName:Len/binary, 
 		      ?UINT32(LLen), _LongName:LLen/binary,
 		      Tail/binary>>) when Vsn =< 3 ->
-    Name = binary_to_list(FileName),
+    Name = unicode:characters_to_list(FileName),
     {A, Tail2} = decode_ATTR(Vsn, Tail),
     [{Name, A} | decode_names(Vsn, I-1, Tail2)];
 decode_names(Vsn, I, <<?UINT32(Len), FileName:Len/binary, 
 		      Tail/binary>>) when Vsn >= 4 ->
-    Name = binary_to_list(FileName),
+    Name = unicode:characters_to_list(FileName),
     {A, Tail2} = decode_ATTR(Vsn, Tail),
     [{Name, A} | decode_names(Vsn, I-1, Tail2)].
 
 encode_names(Vsn, NamesAndAttrs) ->
     lists:mapfoldl(fun(N, L) -> encode_name(Vsn, N, L) end, 0, NamesAndAttrs).
 
-encode_name(Vsn, {Name,Attr}, Len) when Vsn =< 3 ->
+encode_name(Vsn, {NameUC,Attr}, Len) when Vsn =< 3 ->
+    Name = binary_to_list(unicode:characters_to_binary(NameUC)),
     NLen = length(Name),
     EncAttr = encode_ATTR(Vsn, Attr),
     ALen = size(EncAttr),
     NewLen = Len + NLen*2 + 4 + 4 + ALen,
     {[<<?UINT32(NLen)>>, Name, <<?UINT32(NLen)>>, Name, EncAttr], NewLen};
-encode_name(Vsn, {Name,Attr}, Len) when Vsn >= 4 ->
+encode_name(Vsn, {NameUC,Attr}, Len) when Vsn >= 4 ->
+    Name = binary_to_list(unicode:characters_to_binary(NameUC)),
     NLen = length(Name),
     EncAttr = encode_ATTR(Vsn, Attr),
     ALen = size(EncAttr),
@@ -851,9 +864,9 @@ encode_acl_items([ACE|As]) ->
     Type = encode_ace_type(ACE#ssh_xfer_ace.type),
     Flag = encode_ace_flag(ACE#ssh_xfer_ace.flag), 
     Mask = encode_ace_mask(ACE#ssh_xfer_ace.mask), 
-    Who = list_to_binary(ACE#ssh_xfer_ace.who),
+    Who = ACE#ssh_xfer_ace.who,
     [?uint32(Type), ?uint32(Flag), ?uint32(Mask), 
-     ?binary(Who) | encode_acl_items(As)];
+     ?string_utf8(Who) | encode_acl_items(As)];
 encode_acl_items([]) ->
     [].
 
@@ -872,7 +885,7 @@ decode_acl_items(I, <<?UINT32(Type),
 		     [#ssh_xfer_ace { type = decode_ace_type(Type),
 				      flag = decode_ace_flag(Flag),
 				      mask = decode_ace_mask(Mask),
-				      who = binary_to_list(BWho)} | Acc]).
+				      who = unicode:characters_to_list(BWho)} | Acc]).
 
 encode_extensions(Exts) ->
     Count = length(Exts),
diff --git a/lib/ssh/src/ssh_xfer.hrl b/lib/ssh/src/ssh_xfer.hrl
index 8dc9a40f92..a76e9151db 100644
--- a/lib/ssh/src/ssh_xfer.hrl
+++ b/lib/ssh/src/ssh_xfer.hrl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2005-2013. All Rights Reserved.
+%% Copyright Ericsson AB 2005-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
diff --git a/lib/ssh/src/sshc_sup.erl b/lib/ssh/src/sshc_sup.erl
index 1d2779de23..15858f36e1 100644
--- a/lib/ssh/src/sshc_sup.erl
+++ b/lib/ssh/src/sshc_sup.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2008-2012. All Rights Reserved.
+%% Copyright Ericsson AB 2008-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
@@ -50,6 +51,8 @@ stop_child(Client) ->
 %%%=========================================================================
 %%%  Supervisor callback
 %%%=========================================================================
+-spec init( [term()] ) -> {ok,{supervisor:sup_flags(),[supervisor:child_spec()]}} | ignore .
+
 init(Args) ->
     RestartStrategy = simple_one_for_one,
     MaxR = 0,
@@ -61,9 +64,9 @@ init(Args) ->
 %%%=========================================================================
 child_spec(_) ->
     Name = undefined, % As simple_one_for_one is used.
-    StartFunc = {ssh_connection_sup, start_link, []},
+    StartFunc = {ssh_connection_handler, start_link, []},
     Restart = temporary,
-    Shutdown = infinity,
-    Modules = [ssh_connection_sup],
-    Type = supervisor,
+    Shutdown = 4000,
+    Modules = [ssh_connection_handler],
+    Type = worker,
     {Name, StartFunc, Restart, Shutdown, Type, Modules}.
diff --git a/lib/ssh/src/sshd_sup.erl b/lib/ssh/src/sshd_sup.erl
index 747906b2cf..04d2df30f7 100644
--- a/lib/ssh/src/sshd_sup.erl
+++ b/lib/ssh/src/sshd_sup.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2008-2010. All Rights Reserved.
+%% Copyright Ericsson AB 2008-2016. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
@@ -26,8 +27,10 @@
 
 -behaviour(supervisor).
 
+-include("ssh.hrl").
+
 -export([start_link/1, start_child/1, stop_child/1,
-	 stop_child/2, system_name/1]).
+	 stop_child/3, system_name/1]).
 
 %% Supervisor callback
 -export([init/1]).
@@ -40,13 +43,14 @@ start_link(Servers) ->
 
 start_child(ServerOpts) ->
     Address = proplists:get_value(address, ServerOpts),
-    Port = proplists:get_value(port, ServerOpts),
-    case ssh_system_sup:system_supervisor(Address, Port) of
+    Port = proplists:get_value(port, ServerOpts),    
+    Profile = proplists:get_value(profile,  proplists:get_value(ssh_opts, ServerOpts), ?DEFAULT_PROFILE),
+    case ssh_system_sup:system_supervisor(Address, Port, Profile) of
        undefined ->
 	    Spec =  child_spec(Address, Port, ServerOpts),    
 	    case supervisor:start_child(?MODULE, Spec) of
 		{error, already_present} ->
-		    Name = id(Address, Port),
+		    Name = id(Address, Port, Profile),
 		    supervisor:delete_child(?MODULE, Name),
 		    supervisor:start_child(?MODULE, Spec);
 		Reply ->
@@ -58,15 +62,10 @@ start_child(ServerOpts) ->
     end.
 
 stop_child(Name) ->
-    case supervisor:terminate_child(?MODULE, Name) of
-        ok ->
-            supervisor:delete_child(?MODULE, Name);
-        Error ->
-            Error
-    end.
+    supervisor:terminate_child(?MODULE, Name).
 
-stop_child(Address, Port) ->
-    Name = id(Address, Port),
+stop_child(Address, Port, Profile) ->
+    Name = id(Address, Port, Profile),
     stop_child(Name).
 
 system_name(SysSup) ->
@@ -76,6 +75,8 @@ system_name(SysSup) ->
 %%%=========================================================================
 %%%  Supervisor callback
 %%%=========================================================================
+-spec init( [term()] ) -> {ok,{supervisor:sup_flags(),[supervisor:child_spec()]}} | ignore .
+
 init([Servers]) ->
     RestartStrategy = one_for_one,
     MaxR = 10,
@@ -92,16 +93,22 @@ init([Servers]) ->
 %%%  Internal functions
 %%%=========================================================================
 child_spec(Address, Port, ServerOpts) ->
-    Name = id(Address, Port),
+    Profile = proplists:get_value(profile,  proplists:get_value(ssh_opts, ServerOpts), ?DEFAULT_PROFILE),
+    Name = id(Address, Port,Profile),
     StartFunc = {ssh_system_sup, start_link, [ServerOpts]},
-    Restart = transient, 
+    Restart = temporary, 
     Shutdown = infinity,
     Modules = [ssh_system_sup],
     Type = supervisor,
     {Name, StartFunc, Restart, Shutdown, Type, Modules}.
 
-id(Address, Port) ->
-    {server, ssh_system_sup, Address, Port}.
+id(Address, Port, Profile) ->
+    case is_list(Address) of	
+	true ->
+	    {server, ssh_system_sup, any, Port, Profile};
+	false ->
+	    {server, ssh_system_sup, Address, Port, Profile}
+    end.
 
 system_name([], _ ) ->
     undefined;