Merge branch 'maint'

Conflicts:
	lib/ssl/src/dtls_connection.erl
	lib/ssl/src/ssl_connection.erl
	lib/ssl/src/ssl_handshake.erl
	lib/ssl/src/tls_connection.erl

1 files changed, 257 insertions, 289 deletions

diff --git a/lib/ssl/src/ssl_connection.erl b/lib/ssl/src/ssl_connection.erl
index d83c9cb59f..c25c18e97b 100644
--- a/lib/ssl/src/ssl_connection.erl
+++ b/lib/ssl/src/ssl_connection.erl
@@ -44,10 +44,21 @@
 -export([send/2, recv/3, close/2, shutdown/2,
 	 new_user/2, get_opts/2, set_opts/2, 
 	 peer_certificate/1, renegotiation/1, negotiated_protocol/1, prf/5,
-         get_sslsocket/1, handshake_complete/3,
-	 connection_information/2, handle_common_event/5
+	 connection_information/2
 	]).
 
+%% Alert and close handling
+-export([handle_own_alert/4, handle_alert/3, 
+	 handle_normal_shutdown/3 
+	]).
+
+%% Data handling
+-export([write_application_data/3, read_application_data/2]).
+
+%% Help functions for tls|dtls_connection.erl
+-export([handle_session/7, ssl_config/3,
+	 prepare_connection/2, hibernate_after/3]).
+
 %% General gen_statem state functions with extra callback argument 
 %% to determine if it is an SSL/TLS or DTLS gen_statem machine
 -export([init/4, hello/4, abbreviated/4, certify/4, cipher/4,
@@ -56,21 +67,15 @@
 %% gen_statem callbacks
 -export([terminate/3, format_status/2]).
 
-%%
--export([handle_info/3, handle_call/5, handle_session/7, ssl_config/3,
-	 prepare_connection/2, hibernate_after/3]).
-
-%% Alert and close handling
--export([handle_own_alert/4,handle_alert/3, 
-	 handle_normal_shutdown/3 
-	]).
+%% Erlang Distribution export
+-export([get_sslsocket/1, handshake_complete/3]).
 
-%% Data handling
--export([write_application_data/3, read_application_data/2]).
+%% TODO: do not export, call state function instead
+-export([handle_info/3, handle_call/5,  handle_common_event/5]).
 
 %%====================================================================
-%% Internal application API
-%%====================================================================	     
+%% Setup
+%%====================================================================
 %%--------------------------------------------------------------------
 -spec connect(tls_connection | dtls_connection,
 	      host(), inet:port_number(), 
@@ -166,6 +171,16 @@ socket_control(dtls_connection = Connection, {_, Socket}, Pid, Transport, Listen
 	{error, Reason}	->
 	    {error, Reason}
     end.
+
+start_or_recv_cancel_timer(infinity, _RecvFrom) ->
+    undefined;
+start_or_recv_cancel_timer(Timeout, RecvFrom) ->
+    erlang:send_after(Timeout, self(), {cancel_start_or_recv, RecvFrom}).
+
+%%====================================================================
+%% User events
+%%====================================================================
+
 %%--------------------------------------------------------------------
 -spec send(pid(), iodata()) -> ok | {error, reason()}.
 %%
@@ -281,6 +296,197 @@ handshake_complete(ConnectionPid, Node, DHandle) ->
 prf(ConnectionPid, Secret, Label, Seed, WantedLength) ->
     call(ConnectionPid, {prf, Secret, Label, Seed, WantedLength}).
 
+%%====================================================================
+%% Alert and close handling
+%%====================================================================
+handle_own_alert(Alert, Version, StateName, 
+		 #state{role = Role,
+                        transport_cb = Transport,
+                        socket = Socket,
+                        protocol_cb = Connection,
+                        connection_states = ConnectionStates,
+                        ssl_options = SslOpts} = State) ->
+    try %% Try to tell the other side
+	{BinMsg, _} =
+	Connection:encode_alert(Alert, Version, ConnectionStates),
+	Connection:send(Transport, Socket, BinMsg)
+    catch _:_ ->  %% Can crash if we are in a uninitialized state
+	    ignore
+    end,
+    try %% Try to tell the local user
+	log_alert(SslOpts#ssl_options.log_alert, Role, Connection:protocol_name(), StateName, Alert#alert{role = Role}),
+	handle_normal_shutdown(Alert,StateName, State)
+    catch _:_ ->
+	    ok
+    end,
+    {stop, {shutdown, own_alert}}.
+
+handle_normal_shutdown(Alert, _, #state{socket = Socket,
+					transport_cb = Transport,
+					protocol_cb = Connection,
+					start_or_recv_from = StartFrom,
+					tracker = Tracker,
+					role = Role, renegotiation = {false, first}}) ->
+    alert_user(Transport, Tracker,Socket, StartFrom, Alert, Role, Connection);
+
+handle_normal_shutdown(Alert, StateName, #state{socket = Socket,
+						socket_options = Opts,
+						transport_cb = Transport,
+						protocol_cb = Connection,
+						user_application = {_Mon, Pid},
+						tracker = Tracker,
+						start_or_recv_from = RecvFrom, role = Role}) ->
+    alert_user(Transport, Tracker, Socket, StateName, Opts, Pid, RecvFrom, Alert, Role, Connection).
+
+handle_alert(#alert{level = ?FATAL} = Alert, StateName,
+	     #state{socket = Socket, transport_cb = Transport, 
+		    protocol_cb = Connection,
+		    ssl_options = SslOpts, start_or_recv_from = From, host = Host,
+		    port = Port, session = Session, user_application = {_Mon, Pid},
+		    role = Role, socket_options = Opts, tracker = Tracker}) ->
+    invalidate_session(Role, Host, Port, Session),
+    log_alert(SslOpts#ssl_options.log_alert, Role, Connection:protocol_name(), 
+              StateName, Alert#alert{role = opposite_role(Role)}),
+    alert_user(Transport, Tracker, Socket, StateName, Opts, Pid, From, Alert, Role, Connection),
+    {stop, normal};
+
+handle_alert(#alert{level = ?WARNING, description = ?CLOSE_NOTIFY} = Alert, 
+	     StateName, State) -> 
+    handle_normal_shutdown(Alert, StateName, State),
+    {stop, {shutdown, peer_close}};
+
+handle_alert(#alert{level = ?WARNING, description = ?NO_RENEGOTIATION} = Alert, StateName, 
+	     #state{role = Role, ssl_options = SslOpts, protocol_cb = Connection, renegotiation = {true, internal}} = State) ->
+    log_alert(SslOpts#ssl_options.log_alert, Role, 
+              Connection:protocol_name(), StateName, Alert#alert{role = opposite_role(Role)}),
+    handle_normal_shutdown(Alert, StateName, State),
+    {stop, {shutdown, peer_close}};
+
+handle_alert(#alert{level = ?WARNING, description = ?NO_RENEGOTIATION} = Alert, StateName, 
+	     #state{role = Role,
+                    ssl_options = SslOpts, renegotiation = {true, From},
+		    protocol_cb = Connection} = State0) ->
+    log_alert(SslOpts#ssl_options.log_alert,  Role,
+              Connection:protocol_name(), StateName, Alert#alert{role = opposite_role(Role)}),
+    gen_statem:reply(From, {error, renegotiation_rejected}),
+    {Record, State1} = Connection:next_record(State0),
+    %% Go back to connection!
+    State = Connection:reinit_handshake_data(State1#state{renegotiation = undefined}),
+    Connection:next_event(connection, Record, State);
+
+%% Gracefully log and ignore all other warning alerts
+handle_alert(#alert{level = ?WARNING} = Alert, StateName,
+	     #state{ssl_options = SslOpts, protocol_cb = Connection, role = Role} = State0) ->
+    log_alert(SslOpts#ssl_options.log_alert,  Role,
+              Connection:protocol_name(), StateName, Alert#alert{role = opposite_role(Role)}),
+    {Record, State} = Connection:next_record(State0),
+    Connection:next_event(StateName, Record, State).
+
+%%====================================================================
+%% Data handling
+%%====================================================================
+write_application_data(Data0, {FromPid, _} = From,
+		       #state{socket = Socket,
+			      negotiated_version = Version,
+			      protocol_cb = Connection,
+			      transport_cb = Transport,
+			      connection_states = ConnectionStates0,
+			      socket_options = SockOpts,
+			      ssl_options = #ssl_options{renegotiate_at = RenegotiateAt}} = State) ->
+    Data = encode_packet(Data0, SockOpts),
+    
+    case time_to_renegotiate(Data, ConnectionStates0, RenegotiateAt) of
+	true ->
+	    Connection:renegotiate(State#state{renegotiation = {true, internal}}, 
+			[{next_event, {call, From}, {application_data, Data0}}]);
+	false ->
+	    {Msgs, ConnectionStates} =
+                Connection:encode_data(Data, Version, ConnectionStates0),
+            NewState = State#state{connection_states = ConnectionStates},
+	    case Connection:send(Transport, Socket, Msgs) of
+                ok when FromPid =:= self() ->
+                    hibernate_after(connection, NewState, []);
+                Error when FromPid =:= self() ->
+                    {stop, {shutdown, Error}, NewState};
+                ok ->
+                    hibernate_after(connection, NewState, [{reply, From, ok}]);
+                Result ->
+                    hibernate_after(connection, NewState, [{reply, From, Result}])
+            end
+    end.
+
+read_application_data(Data, #state{user_application = {_Mon, Pid},
+				   socket = Socket,
+				   protocol_cb = Connection,
+				   transport_cb = Transport,
+				   socket_options = SOpts,
+				   bytes_to_read = BytesToRead,
+				   start_or_recv_from = RecvFrom,
+				   timer = Timer,
+				   user_data_buffer = Buffer0,
+				   tracker = Tracker} = State0) ->
+    Buffer1 = if 
+		  Buffer0 =:= <<>> -> Data;
+		  Data =:= <<>> -> Buffer0;
+		  true -> <<Buffer0/binary, Data/binary>>
+	      end,
+    case get_data(SOpts, BytesToRead, Buffer1) of
+	{ok, ClientData, Buffer} -> % Send data
+            case State0 of
+                #state{
+                   ssl_options = #ssl_options{erl_dist = true},
+                  protocol_specific = #{d_handle := DHandle}} ->
+                    State =
+                        State0#state{
+                          user_data_buffer = Buffer,
+                          bytes_to_read = undefined},
+                    try erlang:dist_ctrl_put_data(DHandle, ClientData) of
+                        _
+                          when SOpts#socket_options.active =:= false;
+                               Buffer =:= <<>> ->
+                            %% Passive mode, wait for active once or recv
+                            %% Active and empty, get more data
+                            Connection:next_record_if_active(State);
+                        _ -> %% We have more data
+                            read_application_data(<<>>, State)
+                    catch _:Reason ->
+                            death_row(State, Reason)
+                    end;
+                _ ->
+                    SocketOpt =
+                        deliver_app_data(
+                          Transport, Socket, SOpts,
+                          ClientData, Pid, RecvFrom, Tracker, Connection),
+                    cancel_timer(Timer),
+                    State =
+                        State0#state{
+                          user_data_buffer = Buffer,
+                          start_or_recv_from = undefined,
+                          timer = undefined,
+                          bytes_to_read = undefined,
+                          socket_options = SocketOpt
+                         },
+                    if
+                        SocketOpt#socket_options.active =:= false;
+                        Buffer =:= <<>> ->
+                            %% Passive mode, wait for active once or recv
+                            %% Active and empty, get more data
+                            Connection:next_record_if_active(State);
+                        true -> %% We have more data
+                            read_application_data(<<>>, State)
+                    end
+            end;
+	{more, Buffer} -> % no reply, we need more data
+	    Connection:next_record(State0#state{user_data_buffer = Buffer});
+	{passive, Buffer} ->
+	    Connection:next_record_if_active(State0#state{user_data_buffer = Buffer});
+	{error,_Reason} -> %% Invalid packet in packet mode
+	    deliver_packet_error(Transport, Socket, SOpts, Buffer1, Pid, RecvFrom, Tracker, Connection),
+            stop_normal(State0)
+    end.
+%%====================================================================
+%% Help functions for tls|dtls_connection.erl
+%%====================================================================
 %%--------------------------------------------------------------------
 -spec handle_session(#server_hello{}, ssl_record:ssl_version(),
 		     binary(), ssl_record:connection_states(), _,_, #state{}) ->
@@ -349,7 +555,7 @@ ssl_config(Opts, Role, State) ->
 		ssl_options = Opts}.
 
 %%====================================================================
-%% gen_statem state functions
+%% gen_statem general state functions with connection cb argument
 %%====================================================================	
 %%--------------------------------------------------------------------
 -spec init(gen_statem:event_type(),
@@ -408,7 +614,6 @@ hello(Type, Msg, State, Connection) ->
 %%--------------------------------------------------------------------
 abbreviated({call, From}, Msg, State, Connection) ->
     handle_call(Msg, From, ?FUNCTION_NAME, State, Connection);
-
 abbreviated(internal, #finished{verify_data = Data} = Finished,
 	    #state{role = server,
 		   negotiated_version = Version,
@@ -429,7 +634,6 @@ abbreviated(internal, #finished{verify_data = Data} = Finished,
 	#alert{} = Alert ->
 	    handle_own_alert(Alert, Version, ?FUNCTION_NAME, State0)
     end;
-
 abbreviated(internal, #finished{verify_data = Data} = Finished,
 	    #state{role = client, tls_handshake_history = Handshake0,
 		   session = #session{master_secret = MasterSecret},
@@ -449,7 +653,6 @@ abbreviated(internal, #finished{verify_data = Data} = Finished,
 	#alert{} = Alert ->
 	    handle_own_alert(Alert, Version, ?FUNCTION_NAME, State0)
     end;
-
 %% only allowed to send next_protocol message after change cipher spec
 %% & before finished message and it is not allowed during renegotiation
 abbreviated(internal, #next_protocol{selected_protocol = SelectedProtocol},
@@ -490,7 +693,6 @@ certify(internal, #certificate{asn1_certificates = []},
 	    State, _) ->
     Alert =  ?ALERT_REC(?FATAL,?HANDSHAKE_FAILURE),
     handle_own_alert(Alert, Version, ?FUNCTION_NAME, State);
-
 certify(internal, #certificate{asn1_certificates = []},
 	#state{role = server,
 	       ssl_options = #ssl_options{verify = verify_peer,
@@ -499,7 +701,6 @@ certify(internal, #certificate{asn1_certificates = []},
     {Record, State} = 
 	Connection:next_record(State0#state{client_certificate_requested = false}),
     Connection:next_event(?FUNCTION_NAME, Record, State);
-
 certify(internal, #certificate{},
 	#state{role = server,
 	       negotiated_version = Version,
@@ -507,7 +708,6 @@ certify(internal, #certificate{},
 	    State, _) ->
     Alert =  ?ALERT_REC(?FATAL,?UNEXPECTED_MESSAGE, unrequested_certificate),
     handle_own_alert(Alert, Version, ?FUNCTION_NAME, State);
-
 certify(internal, #certificate{} = Cert,
         #state{negotiated_version = Version,
 	       role = Role,
@@ -524,7 +724,6 @@ certify(internal, #certificate{} = Cert,
 	#alert{} = Alert ->
             handle_own_alert(Alert, Version, ?FUNCTION_NAME, State)
     end;
-
 certify(internal, #server_key_exchange{exchange_keys = Keys},
         #state{role = client, negotiated_version = Version,
 	       key_algorithm = Alg,
@@ -557,7 +756,6 @@ certify(internal, #server_key_exchange{exchange_keys = Keys},
 						Version, ?FUNCTION_NAME, State)
 	    end
     end;
-
 certify(internal, #certificate_request{},
 	#state{role = client, negotiated_version = Version,
                key_algorithm = Alg} = State, _)
@@ -565,8 +763,7 @@ certify(internal, #certificate_request{},
        Alg == psk; Alg == dhe_psk; Alg == ecdhe_psk; Alg == rsa_psk;
        Alg == srp_dss; Alg == srp_rsa; Alg == srp_anon ->
     handle_own_alert(?ALERT_REC(?FATAL, ?HANDSHAKE_FAILURE),
-                     Version, certify, State);
-
+                     Version, ?FUNCTION_NAME, State);
 certify(internal, #certificate_request{} = CertRequest,
 	#state{session = #session{own_certificate = Cert},
 	       role = client,
@@ -580,7 +777,6 @@ certify(internal, #certificate_request{} = CertRequest,
 	    Connection:next_event(?FUNCTION_NAME, Record,
 				  State#state{cert_hashsign_algorithm = NegotiatedHashSign})
     end;
-
 %% PSK and RSA_PSK might bypass the Server-Key-Exchange
 certify(internal, #server_hello_done{},
 	#state{session = #session{master_secret = undefined},
@@ -599,7 +795,6 @@ certify(internal, #server_hello_done{},
 				  State0#state{premaster_secret = PremasterSecret}),
 	    client_certify_and_key_exchange(State, Connection)
     end;
-
 certify(internal, #server_hello_done{},
 	#state{session = #session{master_secret = undefined},
 	       ssl_options = #ssl_options{user_lookup_fun = PSKLookup},
@@ -620,7 +815,6 @@ certify(internal, #server_hello_done{},
 				  State0#state{premaster_secret = RSAPremasterSecret}),
 	    client_certify_and_key_exchange(State, Connection)
     end;
-
 %% Master secret was determined with help of server-key exchange msg
 certify(internal, #server_hello_done{}, 
 	#state{session = #session{master_secret = MasterSecret} = Session,
@@ -636,7 +830,6 @@ certify(internal, #server_hello_done{},
 	#alert{} = Alert ->
 	    handle_own_alert(Alert, Version, ?FUNCTION_NAME, State0)
     end;
-
 %% Master secret is calculated from premaster_secret
 certify(internal, #server_hello_done{},
 	#state{session = Session0,
@@ -654,7 +847,6 @@ certify(internal, #server_hello_done{},
 	#alert{} = Alert ->
 	    handle_own_alert(Alert, Version, ?FUNCTION_NAME, State0)
     end;
-
 certify(internal = Type, #client_key_exchange{} = Msg,
 	#state{role = server,
 	       client_certificate_requested = true,
@@ -662,7 +854,6 @@ certify(internal = Type, #client_key_exchange{} = Msg,
 	Connection) ->
     %% We expect a certificate here
     handle_common_event(Type, Msg, ?FUNCTION_NAME, State, Connection);
-
 certify(internal, #client_key_exchange{exchange_keys = Keys},
 	State = #state{key_algorithm = KeyAlg, negotiated_version = Version}, Connection) ->
     try
@@ -672,7 +863,6 @@ certify(internal, #client_key_exchange{exchange_keys = Keys},
 	#alert{} = Alert ->
 	    handle_own_alert(Alert, Version, ?FUNCTION_NAME, State)
     end;
-
 certify(Type, Msg, State, Connection) ->
     handle_common_event(Type, Msg, ?FUNCTION_NAME, State, Connection).
  
@@ -684,10 +874,8 @@ certify(Type, Msg, State, Connection) ->
 %%--------------------------------------------------------------------
 cipher({call, From}, Msg, State, Connection) ->
     handle_call(Msg, From, ?FUNCTION_NAME, State, Connection);
-
 cipher(info, Msg, State, _) ->
     handle_info(Msg, ?FUNCTION_NAME, State);
-
 cipher(internal, #certificate_verify{signature = Signature, 
 				     hashsign_algorithm = CertHashSign},
        #state{role = server,
@@ -710,14 +898,12 @@ cipher(internal, #certificate_verify{signature = Signature,
 	#alert{} = Alert ->
 	    handle_own_alert(Alert, Version, ?FUNCTION_NAME, State0)
     end;
-
 %% client must send a next protocol message if we are expecting it
 cipher(internal, #finished{},
        #state{role = server, expecting_next_protocol_negotiation = true,
 	      negotiated_protocol = undefined, negotiated_version = Version} = State0,
        _Connection) ->
     handle_own_alert(?ALERT_REC(?FATAL,?UNEXPECTED_MESSAGE), Version, ?FUNCTION_NAME, State0);
-
 cipher(internal, #finished{verify_data = Data} = Finished,
        #state{negotiated_version = Version,
 	      host = Host,
@@ -740,7 +926,6 @@ cipher(internal, #finished{verify_data = Data} = Finished,
         #alert{} = Alert ->
 	    handle_own_alert(Alert, Version, ?FUNCTION_NAME, State)
     end;
-
 %% only allowed to send next_protocol message after change cipher spec
 %% & before finished message and it is not allowed during renegotiation
 cipher(internal, #next_protocol{selected_protocol = SelectedProtocol},
@@ -1075,7 +1260,6 @@ handle_info(
   {'DOWN', MonitorRef, _, _, _}, _,
   #state{user_application={MonitorRef,_Pid}} = State) ->
     stop_normal(State);
-
 %%% So that terminate will be run when supervisor issues shutdown
 handle_info({'EXIT', _Sup, shutdown}, _StateName, State) ->
     {stop, shutdown, State};
@@ -1084,21 +1268,17 @@ handle_info({'EXIT', Socket, normal}, _StateName, #state{socket = Socket} = Stat
     {stop, {shutdown, transport_closed}, State};
 handle_info({'EXIT', Socket, Reason}, _StateName, #state{socket = Socket} = State) ->
     {stop, {shutdown, Reason}, State};
-
 handle_info(allow_renegotiate, StateName, State) ->
     {next_state, StateName, State#state{allow_renegotiate = true}};
-
 handle_info({cancel_start_or_recv, StartFrom}, StateName,
 	    #state{renegotiation = {false, first}} = State) when StateName =/= connection ->
     {stop_and_reply, {shutdown, user_timeout},  
      {reply, StartFrom, {error, timeout}}, State#state{timer = undefined}};
-
 handle_info({cancel_start_or_recv, RecvFrom}, StateName, 
 	    #state{start_or_recv_from = RecvFrom} = State) when RecvFrom =/= undefined ->
     {next_state, StateName, State#state{start_or_recv_from = undefined,
 					bytes_to_read = undefined,
 					timer = undefined}, [{reply, RecvFrom, {error, timeout}}]};
-
 handle_info({cancel_start_or_recv, _RecvFrom}, StateName, State) ->
     {next_state, StateName, State#state{timer = undefined}};
 
@@ -1107,41 +1287,9 @@ handle_info(Msg, StateName, #state{socket = Socket, error_tag = Tag} = State) ->
     error_logger:info_report(Report),
     {next_state, StateName, State}.
 
-
-
-send_dist_data(StateName, State, DHandle, Acc) ->
-    case erlang:dist_ctrl_get_data(DHandle) of
-        none ->
-            erlang:dist_ctrl_get_data_notification(DHandle),
-            hibernate_after(StateName, State, lists:reverse(Acc));
-        Data ->
-            send_dist_data(
-              StateName, State, DHandle,
-              [{next_event, {call, {self(), undefined}}, {application_data, Data}}
-               |Acc])
-    end.
-
-%% Overload mitigation
-eat_msgs(Msg) ->
-    receive Msg -> eat_msgs(Msg)
-    after 0 -> ok
-    end.
-
-%% When running with erl_dist the stop reason 'normal'
-%% would be too silent and prevent cleanup
-stop_normal(State) ->
-    Reason =
-        case State of
-            #state{ssl_options = #ssl_options{erl_dist = true}} ->
-                {shutdown, normal};
-            _ ->
-                normal
-        end,
-    {stop, Reason, State}.
-
-%%--------------------------------------------------------------------
-%% gen_statem callbacks
-%%--------------------------------------------------------------------
+%%====================================================================
+%% general gen_statem callbacks
+%%====================================================================
 terminate(_, _, #state{terminated = true}) ->
     %% Happens when user closes the connection using ssl:close/1
     %% we want to guarantee that Transport:close has been called
@@ -1150,7 +1298,6 @@ terminate(_, _, #state{terminated = true}) ->
     %% returning. In both cases terminate has been run manually
     %% before run by gen_statem which will end up here
     ok;
-
 terminate({shutdown, transport_closed} = Reason, 
 	  _StateName, #state{protocol_cb = Connection,
 			     socket = Socket, transport_cb = Transport} = State) ->
@@ -1177,7 +1324,6 @@ terminate(Reason, connection, #state{negotiated_version = Version,
     {BinAlert, ConnectionStates} = terminate_alert(Reason, Version, ConnectionStates0, Connection),
     Connection:send(Transport, Socket, BinAlert),
     Connection:close(Reason, Socket, Transport, ConnectionStates, Check);
-
 terminate(Reason, _StateName, #state{transport_cb = Transport, protocol_cb = Connection,
 				     socket = Socket 
 				    } = State) ->
@@ -1211,155 +1357,6 @@ format_status(terminate, [_, StateName, State]) ->
 		       }}]}].
 
 %%--------------------------------------------------------------------
-%%% 
-%%--------------------------------------------------------------------
-write_application_data(Data0, {FromPid, _} = From,
-		       #state{socket = Socket,
-			      negotiated_version = Version,
-			      protocol_cb = Connection,
-			      transport_cb = Transport,
-			      connection_states = ConnectionStates0,
-			      socket_options = SockOpts,
-			      ssl_options = #ssl_options{renegotiate_at = RenegotiateAt}} = State) ->
-    Data = encode_packet(Data0, SockOpts),
-    
-    case time_to_renegotiate(Data, ConnectionStates0, RenegotiateAt) of
-	true ->
-	    Connection:renegotiate(State#state{renegotiation = {true, internal}}, 
-			[{next_event, {call, From}, {application_data, Data0}}]);
-	false ->
-	    {Msgs, ConnectionStates} =
-                Connection:encode_data(Data, Version, ConnectionStates0),
-            NewState = State#state{connection_states = ConnectionStates},
-	    case Connection:send(Transport, Socket, Msgs) of
-                ok when FromPid =:= self() ->
-                    hibernate_after(connection, NewState, []);
-                Error when FromPid =:= self() ->
-                    {stop, {shutdown, Error}, NewState};
-                ok ->
-                    hibernate_after(connection, NewState, [{reply, From, ok}]);
-                Result ->
-                    hibernate_after(connection, NewState, [{reply, From, Result}])
-            end
-    end.
-
-read_application_data(Data, #state{user_application = {_Mon, Pid},
-				   socket = Socket,
-				   protocol_cb = Connection,
-				   transport_cb = Transport,
-				   socket_options = SOpts,
-				   bytes_to_read = BytesToRead,
-				   start_or_recv_from = RecvFrom,
-				   timer = Timer,
-				   user_data_buffer = Buffer0,
-				   tracker = Tracker} = State0) ->
-    Buffer1 = if 
-		  Buffer0 =:= <<>> -> Data;
-		  Data =:= <<>> -> Buffer0;
-		  true -> <<Buffer0/binary, Data/binary>>
-	      end,
-    case get_data(SOpts, BytesToRead, Buffer1) of
-	{ok, ClientData, Buffer} -> % Send data
-            case State0 of
-                #state{
-                   ssl_options = #ssl_options{erl_dist = true},
-                  protocol_specific = #{d_handle := DHandle}} ->
-                    State =
-                        State0#state{
-                          user_data_buffer = Buffer,
-                          bytes_to_read = undefined},
-                    try erlang:dist_ctrl_put_data(DHandle, ClientData) of
-                        _
-                          when SOpts#socket_options.active =:= false;
-                               Buffer =:= <<>> ->
-                            %% Passive mode, wait for active once or recv
-                            %% Active and empty, get more data
-                            Connection:next_record_if_active(State);
-                        _ -> %% We have more data
-                            read_application_data(<<>>, State)
-                    catch _:Reason ->
-                            death_row(State, Reason)
-                    end;
-                _ ->
-                    SocketOpt =
-                        deliver_app_data(
-                          Transport, Socket, SOpts,
-                          ClientData, Pid, RecvFrom, Tracker, Connection),
-                    cancel_timer(Timer),
-                    State =
-                        State0#state{
-                          user_data_buffer = Buffer,
-                          start_or_recv_from = undefined,
-                          timer = undefined,
-                          bytes_to_read = undefined,
-                          socket_options = SocketOpt
-                         },
-                    if
-                        SocketOpt#socket_options.active =:= false;
-                        Buffer =:= <<>> ->
-                            %% Passive mode, wait for active once or recv
-                            %% Active and empty, get more data
-                            Connection:next_record_if_active(State);
-                        true -> %% We have more data
-                            read_application_data(<<>>, State)
-                    end
-            end;
-	{more, Buffer} -> % no reply, we need more data
-	    Connection:next_record(State0#state{user_data_buffer = Buffer});
-	{passive, Buffer} ->
-	    Connection:next_record_if_active(State0#state{user_data_buffer = Buffer});
-	{error,_Reason} -> %% Invalid packet in packet mode
-	    deliver_packet_error(Transport, Socket, SOpts, Buffer1, Pid, RecvFrom, Tracker, Connection),
-            stop_normal(State0)
-    end.
-%%--------------------------------------------------------------------
-%%% 
-%%--------------------------------------------------------------------
-handle_alert(#alert{level = ?FATAL} = Alert, StateName,
-	     #state{socket = Socket, transport_cb = Transport, 
-		    protocol_cb = Connection,
-		    ssl_options = SslOpts, start_or_recv_from = From, host = Host,
-		    port = Port, session = Session, user_application = {_Mon, Pid},
-		    role = Role, socket_options = Opts, tracker = Tracker} = State) ->
-    invalidate_session(Role, Host, Port, Session),
-    log_alert(SslOpts#ssl_options.log_alert, Role, Connection:protocol_name(), 
-              StateName, Alert#alert{role = opposite_role(Role)}),
-    alert_user(Transport, Tracker, Socket, StateName, Opts, Pid, From, Alert, Role, Connection),
-    stop_normal(State);
-
-handle_alert(#alert{level = ?WARNING, description = ?CLOSE_NOTIFY} = Alert, 
-	     StateName, State) -> 
-    handle_normal_shutdown(Alert, StateName, State),
-    {stop, {shutdown, peer_close}};
-
-handle_alert(#alert{level = ?WARNING, description = ?NO_RENEGOTIATION} = Alert, StateName, 
-	     #state{role = Role, ssl_options = SslOpts, protocol_cb = Connection, renegotiation = {true, internal}} = State) ->
-    log_alert(SslOpts#ssl_options.log_alert, Role, 
-              Connection:protocol_name(), StateName, Alert#alert{role = opposite_role(Role)}),
-    handle_normal_shutdown(Alert, StateName, State),
-    {stop, {shutdown, peer_close}};
-
-handle_alert(#alert{level = ?WARNING, description = ?NO_RENEGOTIATION} = Alert, StateName, 
-	     #state{role = Role,
-                    ssl_options = SslOpts, renegotiation = {true, From},
-		    protocol_cb = Connection} = State0) ->
-    log_alert(SslOpts#ssl_options.log_alert,  Role,
-              Connection:protocol_name(), StateName, Alert#alert{role = opposite_role(Role)}),
-    gen_statem:reply(From, {error, renegotiation_rejected}),
-    {Record, State1} = Connection:next_record(State0),
-    %% Go back to connection!
-    State = Connection:reinit_handshake_data(State1#state{renegotiation = undefined}),
-    Connection:next_event(connection, Record, State);
-
-%% Gracefully log and ignore all other warning alerts
-handle_alert(#alert{level = ?WARNING} = Alert, StateName,
-	     #state{ssl_options = SslOpts, protocol_cb = Connection, role = Role} = State0) ->
-    log_alert(SslOpts#ssl_options.log_alert,  Role,
-              Connection:protocol_name(), StateName, Alert#alert{role = opposite_role(Role)}),
-    {Record, State} = Connection:next_record(State0),
-    Connection:next_event(StateName, Record, State).
-
-%%--------------------------------------------------------------------
 %%% Internal functions
 %%--------------------------------------------------------------------
 connection_info(#state{sni_hostname = SNIHostname, 
@@ -1476,7 +1473,6 @@ handle_peer_cert_key(client, _,
     ECDHKey = public_key:generate_key(PublicKeyParams),
     PremasterSecret = ssl_handshake:premaster_secret(PublicKey, ECDHKey),
     master_secret(PremasterSecret, State#state{diffie_hellman_keys = ECDHKey});
-
 %% We do currently not support cipher suites that use fixed DH.
 %% If we want to implement that the following clause can be used
 %% to extract DH parameters form cert.
@@ -1496,7 +1492,6 @@ certify_client(#state{client_certificate_requested = true, role = client,
 	       = State, Connection) ->
     Certificate = ssl_handshake:certificate(OwnCert, CertDbHandle, CertDbRef, client),
     Connection:queue_handshake(Certificate, State);
-
 certify_client(#state{client_certificate_requested = false} = State, _) ->
     State.
 
@@ -1549,7 +1544,6 @@ certify_client_key_exchange(#encrypted_premaster_secret{premaster_secret= EncPMS
 			    #state{private_key = Key} = State, Connection) ->
     PremasterSecret = ssl_handshake:premaster_secret(EncPMS, Key),
     calculate_master_secret(PremasterSecret, State, Connection, certify, cipher);
-
 certify_client_key_exchange(#client_diffie_hellman_public{dh_public = ClientPublicDhKey},
 			    #state{diffie_hellman_params = #'DHParameter'{} = Params,
 				   diffie_hellman_keys = {_, ServerDhPrivateKey}} = State,
@@ -1561,14 +1555,12 @@ certify_client_key_exchange(#client_ec_diffie_hellman_public{dh_public = ClientP
 			    #state{diffie_hellman_keys = ECDHKey} = State, Connection) ->
     PremasterSecret = ssl_handshake:premaster_secret(#'ECPoint'{point = ClientPublicEcDhPoint}, ECDHKey),
     calculate_master_secret(PremasterSecret, State, Connection, certify, cipher);
-
 certify_client_key_exchange(#client_psk_identity{} = ClientKey,
 			    #state{ssl_options = 
 				       #ssl_options{user_lookup_fun = PSKLookup}} = State0,
 			    Connection) ->
     PremasterSecret = ssl_handshake:premaster_secret(ClientKey, PSKLookup),
     calculate_master_secret(PremasterSecret, State0, Connection, certify, cipher);
-
 certify_client_key_exchange(#client_dhe_psk_identity{} = ClientKey,
 			    #state{diffie_hellman_params = #'DHParameter'{} = Params,
 				   diffie_hellman_keys = {_, ServerDhPrivateKey},
@@ -1595,7 +1587,6 @@ certify_client_key_exchange(#client_rsa_psk_identity{} = ClientKey,
 			    Connection) ->
     PremasterSecret = ssl_handshake:premaster_secret(ClientKey, Key, PSKLookup),
     calculate_master_secret(PremasterSecret, State0, Connection, certify, cipher);
-
 certify_client_key_exchange(#client_srp_public{} = ClientKey,
 			    #state{srp_params = Params,
 				   srp_keys = Key
@@ -1610,7 +1601,6 @@ certify_server(#state{key_algorithm = Algo} = State, _) when Algo == dh_anon;
 							     Algo == ecdhe_psk; 
 							     Algo == srp_anon  ->
     State;
-
 certify_server(#state{cert_db = CertDbHandle,
 		      cert_db_ref = CertDbRef,
 		      session = #session{own_certificate = OwnCert}} = State, Connection) ->
@@ -1644,7 +1634,6 @@ key_exchange(#state{role = server, key_algorithm = Algo,
 					       PrivateKey}),
     State = Connection:queue_handshake(Msg, State0),
     State#state{diffie_hellman_keys = DHKeys};
-
 key_exchange(#state{role = server, private_key = Key, key_algorithm = Algo} = State, _)
   when Algo == ecdh_ecdsa; Algo == ecdh_rsa ->
     State#state{diffie_hellman_keys = Key};
@@ -1670,7 +1659,6 @@ key_exchange(#state{role = server, key_algorithm = Algo,
 				       PrivateKey}),
     State = Connection:queue_handshake(Msg, State0),
     State#state{diffie_hellman_keys = ECDHKeys};
-
 key_exchange(#state{role = server, key_algorithm = psk,
 		    ssl_options = #ssl_options{psk_identity = undefined}} = State, _) ->
     State;
@@ -1691,7 +1679,6 @@ key_exchange(#state{role = server, key_algorithm = psk,
 				      ServerRandom,
 						       PrivateKey}),
     Connection:queue_handshake(Msg, State0);
-
 key_exchange(#state{role = server, key_algorithm = dhe_psk,
 		    ssl_options = #ssl_options{psk_identity = PskIdentityHint},
 		    hashsign_algorithm = HashSignAlgo,
@@ -1713,7 +1700,6 @@ key_exchange(#state{role = server, key_algorithm = dhe_psk,
 				       PrivateKey}),
     State = Connection:queue_handshake(Msg, State0),
     State#state{diffie_hellman_keys = DHKeys};
-
 key_exchange(#state{role = server, key_algorithm = ecdhe_psk,
 		    ssl_options = #ssl_options{psk_identity = PskIdentityHint},
 		    hashsign_algorithm = HashSignAlgo,
@@ -1735,7 +1721,6 @@ key_exchange(#state{role = server, key_algorithm = ecdhe_psk,
 				       PrivateKey}),
     State = Connection:queue_handshake(Msg, State0),
     State#state{diffie_hellman_keys = ECDHKeys};
-
 key_exchange(#state{role = server, key_algorithm = rsa_psk,
 		    ssl_options = #ssl_options{psk_identity = undefined}} = State, _) ->
     State;
@@ -1756,7 +1741,6 @@ key_exchange(#state{role = server, key_algorithm = rsa_psk,
 				       ServerRandom,
 				       PrivateKey}),
     Connection:queue_handshake(Msg, State0);
-
 key_exchange(#state{role = server, key_algorithm = Algo,
 		    ssl_options = #ssl_options{user_lookup_fun = LookupFun},
 		    hashsign_algorithm = HashSignAlgo,
@@ -1787,7 +1771,6 @@ key_exchange(#state{role = server, key_algorithm = Algo,
     State = Connection:queue_handshake(Msg, State0),
     State#state{srp_params = SrpParams,
 		srp_keys = Keys};
-
 key_exchange(#state{role = client,
 		    key_algorithm = rsa,
 		    public_key_info = PublicKeyInfo,
@@ -1795,7 +1778,6 @@ key_exchange(#state{role = client,
 		    premaster_secret = PremasterSecret} = State0, Connection) ->
     Msg = rsa_key_exchange(ssl:tls_version(Version), PremasterSecret, PublicKeyInfo),
     Connection:queue_handshake(Msg, State0);
-
 key_exchange(#state{role = client,
 		    key_algorithm = Algorithm,
 		    negotiated_version = Version,
@@ -1816,7 +1798,6 @@ key_exchange(#state{role = client,
        Algorithm == ecdh_anon ->
     Msg = ssl_handshake:key_exchange(client, ssl:tls_version(Version), {ecdh, Keys}),
     Connection:queue_handshake(Msg, State0);
-
 key_exchange(#state{role = client,
 		    ssl_options = SslOpts,
 		    key_algorithm = psk,
@@ -1824,7 +1805,6 @@ key_exchange(#state{role = client,
     Msg =  ssl_handshake:key_exchange(client, ssl:tls_version(Version), 
 				      {psk, SslOpts#ssl_options.psk_identity}),
     Connection:queue_handshake(Msg, State0);
-
 key_exchange(#state{role = client,
 		    ssl_options = SslOpts,
 		    key_algorithm = dhe_psk,
@@ -1855,7 +1835,6 @@ key_exchange(#state{role = client,
     Msg = rsa_psk_key_exchange(ssl:tls_version(Version), SslOpts#ssl_options.psk_identity,
 			       PremasterSecret, PublicKeyInfo),
     Connection:queue_handshake(Msg, State0);
-
 key_exchange(#state{role = client,
 		    key_algorithm = Algorithm,
 		    negotiated_version = Version,
@@ -2244,10 +2223,7 @@ set_socket_opts(_,_, _, [{active, _} = Opt| _], SockOpts, _) ->
 set_socket_opts(ConnectionCb, Transport, Socket, [Opt | Opts], SockOpts, Other) ->
     set_socket_opts(ConnectionCb, Transport, Socket, Opts, SockOpts, [Opt | Other]).
 
-start_or_recv_cancel_timer(infinity, _RecvFrom) ->
-    undefined;
-start_or_recv_cancel_timer(Timeout, RecvFrom) ->
-    erlang:send_after(Timeout, self(), {cancel_start_or_recv, RecvFrom}).
+
 
 hibernate_after(connection = StateName, 
 		#state{ssl_options=#ssl_options{hibernate_after = HibernateAfter}} = State,
@@ -2632,45 +2608,6 @@ log_alert(true, Role, ProtocolName, StateName, Alert) ->
 log_alert(false, _, _, _, _) ->
     ok.
 
-handle_own_alert(Alert, Version, StateName, 
-		 #state{role = Role,
-                        transport_cb = Transport,
-                        socket = Socket,
-                        protocol_cb = Connection,
-                        connection_states = ConnectionStates,
-                        ssl_options = SslOpts} = State) ->
-    try %% Try to tell the other side
-	{BinMsg, _} =
-	Connection:encode_alert(Alert, Version, ConnectionStates),
-	Connection:send(Transport, Socket, BinMsg)
-    catch _:_ ->  %% Can crash if we are in a uninitialized state
-	    ignore
-    end,
-    try %% Try to tell the local user
-	log_alert(SslOpts#ssl_options.log_alert, Role, Connection:protocol_name(), StateName, Alert#alert{role = Role}),
-	handle_normal_shutdown(Alert,StateName, State)
-    catch _:_ ->
-	    ok
-    end,
-    {stop, {shutdown, own_alert}}.
-
-handle_normal_shutdown(Alert, _, #state{socket = Socket,
-					transport_cb = Transport,
-					protocol_cb = Connection,
-					start_or_recv_from = StartFrom,
-					tracker = Tracker,
-					role = Role, renegotiation = {false, first}}) ->
-    alert_user(Transport, Tracker,Socket, StartFrom, Alert, Role, Connection);
-
-handle_normal_shutdown(Alert, StateName, #state{socket = Socket,
-						socket_options = Opts,
-						transport_cb = Transport,
-						protocol_cb = Connection,
-						user_application = {_Mon, Pid},
-						tracker = Tracker,
-						start_or_recv_from = RecvFrom, role = Role}) ->
-    alert_user(Transport, Tracker, Socket, StateName, Opts, Pid, RecvFrom, Alert, Role, Connection).
-
 invalidate_session(client, Host, Port, Session) ->
     ssl_manager:invalidate_session(Host, Port, Session);
 invalidate_session(server, _, Port, Session) ->
@@ -2727,3 +2664,34 @@ new_emulated([], EmOpts) ->
     EmOpts;
 new_emulated(NewEmOpts, _) ->
     NewEmOpts.
+%%---------------Erlang distribution --------------------------------------
+
+send_dist_data(StateName, State, DHandle, Acc) ->
+    case erlang:dist_ctrl_get_data(DHandle) of
+        none ->
+            erlang:dist_ctrl_get_data_notification(DHandle),
+            hibernate_after(StateName, State, lists:reverse(Acc));
+        Data ->
+            send_dist_data(
+              StateName, State, DHandle,
+              [{next_event, {call, {self(), undefined}}, {application_data, Data}}
+               |Acc])
+    end.
+
+%% Overload mitigation
+eat_msgs(Msg) ->
+    receive Msg -> eat_msgs(Msg)
+    after 0 -> ok
+    end.
+
+%% When running with erl_dist the stop reason 'normal'
+%% would be too silent and prevent cleanup
+stop_normal(State) ->
+    Reason =
+        case State of
+            #state{ssl_options = #ssl_options{erl_dist = true}} ->
+                {shutdown, normal};
+            _ ->
+                normal
+        end,
+    {stop, Reason, State}.