Merge branch 'major' of super:otp into bmk/inets/inets58_integration

12 files changed, 783 insertions, 45 deletions

diff --git a/lib/ssl/src/Makefile b/lib/ssl/src/Makefile
index 7514ad2aa2..9c40d4ea53 100644
--- a/lib/ssl/src/Makefile
+++ b/lib/ssl/src/Makefile
@@ -1,7 +1,7 @@
 #
 # %CopyrightBegin%
 #
-# Copyright Ericsson AB 1999-2010. All Rights Reserved.
+# Copyright Ericsson AB 1999-2011. All Rights Reserved.
 #
 # The contents of this file are subject to the Erlang Public License,
 # Version 1.1, (the "License"); you may not use this file except in
@@ -43,10 +43,12 @@ MODULES= \
 	ssl_app \
 	ssl_broker \
 	ssl_broker_sup \
+	ssl_dist_sup\
 	ssl_server \
 	ssl_sup \
 	ssl_prim \
 	inet_ssl_dist \
+	inet_tls_dist \
 	ssl_certificate\
 	ssl_certificate_db\
 	ssl_cipher \
@@ -62,6 +64,7 @@ MODULES= \
 	ssl_ssl2 \
 	ssl_ssl3 \
 	ssl_tls1 \
+	ssl_tls_dist_proxy
 
 INTERNAL_HRL_FILES = \
 	 ssl_int.hrl ssl_broker_int.hrl ssl_debug.hrl \
diff --git a/lib/ssl/src/inet_ssl_dist.erl b/lib/ssl/src/inet_ssl_dist.erl
index 6c0fbc0618..42a03a4879 100644
--- a/lib/ssl/src/inet_ssl_dist.erl
+++ b/lib/ssl/src/inet_ssl_dist.erl
@@ -31,9 +31,7 @@
 
 -import(error_logger,[error_msg/2]).
 
--include("net_address.hrl").
-
-
+-include_lib("kernel/include/net_address.hrl").
 
 -define(to_port(Socket, Data, Opts),
 	case ssl_prim:send(Socket, Data, Opts) of
@@ -44,9 +42,8 @@
 	        R
         end).
 
-
--include("dist.hrl").
--include("dist_util.hrl").
+-include_lib("kernel/include/dist.hrl").
+-include_lib("kernel/include/dist_util.hrl").
 
 %% -------------------------------------------------------------
 %% This function should return a valid childspec, so that 
diff --git a/lib/ssl/src/inet_tls_dist.erl b/lib/ssl/src/inet_tls_dist.erl
new file mode 100644
index 0000000000..f42c076460
--- /dev/null
+++ b/lib/ssl/src/inet_tls_dist.erl
@@ -0,0 +1,275 @@
+%%
+%% %CopyrightBegin%
+%%
+%% Copyright Ericsson AB 2011-2011. All Rights Reserved.
+%%
+%% The contents of this file are subject to the Erlang Public License,
+%% Version 1.1, (the "License"); you may not use this file except in
+%% compliance with the License. You should have received a copy of the
+%% Erlang Public License along with this software. If not, it can be
+%% retrieved online at http://www.erlang.org/.
+%%
+%% Software distributed under the License is distributed on an "AS IS"
+%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+%% the License for the specific language governing rights and limitations
+%% under the License.
+%%
+%% %CopyrightEnd%
+%%
+
+%%
+-module(inet_tls_dist).
+
+-export([childspecs/0, listen/1, accept/1, accept_connection/5,
+	 setup/5, close/1, select/1, is_node_name/1]).
+
+-include_lib("kernel/include/net_address.hrl").
+-include_lib("kernel/include/dist.hrl").
+-include_lib("kernel/include/dist_util.hrl").
+
+childspecs() ->
+    {ok, [{ssl_dist_sup,{ssl_dist_sup, start_link, []},
+	   permanent, 2000, worker, [ssl_dist_sup]}]}.
+
+select(Node) ->
+    case split_node(atom_to_list(Node), $@, []) of
+	[_,_Host] -> 
+	    true;
+	_ -> 
+	    false
+    end.
+
+is_node_name(Node) when is_atom(Node) ->
+    select(Node);
+is_node_name(_) ->
+    false.
+
+listen(Name) ->
+    ssl_tls_dist_proxy:listen(Name).
+
+accept(Listen) ->
+    ssl_tls_dist_proxy:accept(Listen).
+
+accept_connection(AcceptPid, Socket, MyNode, Allowed, SetupTime) ->
+    Kernel = self(),
+    spawn_link(fun() -> do_accept(Kernel, AcceptPid, Socket, 
+				  MyNode, Allowed, SetupTime) end).
+
+setup(Node, Type, MyNode, LongOrShortNames,SetupTime) ->
+    Kernel = self(),
+    spawn(fun() -> do_setup(Kernel, Node, Type, MyNode, LongOrShortNames, SetupTime) end).
+		   
+do_setup(Kernel, Node, Type, MyNode, LongOrShortNames, SetupTime) ->
+    [Name, Address] = splitnode(Node, LongOrShortNames),
+    case inet:getaddr(Address, inet) of
+	{ok, Ip} ->
+	    Timer = dist_util:start_timer(SetupTime),
+	    case erl_epmd:port_please(Name, Ip) of
+		{port, TcpPort, Version} ->
+		    ?trace("port_please(~p) -> version ~p~n", 
+			   [Node,Version]),
+		    dist_util:reset_timer(Timer),
+		    case ssl_tls_dist_proxy:connect(Ip, TcpPort) of
+			{ok, Socket} ->
+			    HSData = connect_hs_data(Kernel, Node, MyNode, Socket, 
+						     Timer, Version, Ip, TcpPort, Address,
+						     Type),
+			    dist_util:handshake_we_started(HSData);
+			_ ->
+			    %% Other Node may have closed since 
+			    %% port_please !
+			    ?trace("other node (~p) "
+				   "closed since port_please.~n", 
+				   [Node]),
+			    ?shutdown(Node)
+		    end;
+		_ ->
+		    ?trace("port_please (~p) "
+			   "failed.~n", [Node]),
+		    ?shutdown(Node)
+	    end;
+	_Other ->
+	    ?trace("inet_getaddr(~p) "
+		   "failed (~p).~n", [Node,Other]),
+	    ?shutdown(Node)
+    end.
+
+close(Socket) ->
+    try
+	erlang:error(foo)
+    catch _:_ ->
+	    io:format("close called ~p ~p~n",[Socket, erlang:get_stacktrace()])
+    end,
+    gen_tcp:close(Socket),
+    ok.
+
+do_accept(Kernel, AcceptPid, Socket, MyNode, Allowed, SetupTime) ->
+    process_flag(priority, max),
+    receive
+	{AcceptPid, controller} ->
+	    Timer = dist_util:start_timer(SetupTime),
+	    case check_ip(Socket) of
+		true ->
+		    HSData = accept_hs_data(Kernel, MyNode, Socket, Timer, Allowed),
+		    dist_util:handshake_other_started(HSData);
+		{false,IP} ->
+		    error_logger:error_msg("** Connection attempt from "
+					   "disallowed IP ~w ** ~n", [IP]),
+		    ?shutdown(no_node)
+	    end
+    end.
+%% ------------------------------------------------------------
+%% Do only accept new connection attempts from nodes at our
+%% own LAN, if the check_ip environment parameter is true.
+%% ------------------------------------------------------------
+check_ip(Socket) ->
+    case application:get_env(check_ip) of
+	{ok, true} ->
+	    case get_ifs(Socket) of
+		{ok, IFs, IP} ->
+		    check_ip(IFs, IP);
+		_ ->
+		    ?shutdown(no_node)
+	    end;
+	_ ->
+	    true
+    end.
+
+get_ifs(Socket) ->
+    case ssl_prim:peername(Socket) of
+	{ok, {IP, _}} ->
+	    case ssl_prim:getif(Socket) of
+		{ok, IFs} -> {ok, IFs, IP};
+		Error     -> Error
+	    end;
+	Error ->
+	    Error
+    end.
+
+check_ip([{OwnIP, _, Netmask}|IFs], PeerIP) ->
+    case {mask(Netmask, PeerIP), mask(Netmask, OwnIP)} of
+	{M, M} -> true;
+	_      -> check_ip(IFs, PeerIP)
+    end;
+check_ip([], PeerIP) ->
+    {false, PeerIP}.
+
+mask({M1,M2,M3,M4}, {IP1,IP2,IP3,IP4}) ->
+    {M1 band IP1,
+     M2 band IP2,
+     M3 band IP3,
+     M4 band IP4};
+
+mask({M1,M2,M3,M4, M5, M6, M7, M8}, {IP1,IP2,IP3,IP4, IP5, IP6, IP7, IP8}) ->
+    {M1 band IP1,
+     M2 band IP2,
+     M3 band IP3,
+     M4 band IP4,
+     M5 band IP5,
+     M6 band IP6,
+     M7 band IP7,
+     M8 band IP8}.
+
+
+%% If Node is illegal terminate the connection setup!!
+splitnode(Node, LongOrShortNames) ->
+    case split_node(atom_to_list(Node), $@, []) of
+	[Name|Tail] when Tail =/= [] ->
+	    Host = lists:append(Tail),
+	    check_node(Name, Node, Host, LongOrShortNames);
+	[_] ->
+	    error_logger:error_msg("** Nodename ~p illegal, no '@' character **~n",
+		      [Node]),
+	    ?shutdown(Node);
+	_ ->
+	    error_logger:error_msg("** Nodename ~p illegal **~n", [Node]),
+	    ?shutdown(Node)
+    end.
+
+check_node(Name, Node, Host, LongOrShortNames) ->
+    case split_node(Host, $., []) of
+	[_] when LongOrShortNames == longnames ->
+	    error_logger:error_msg("** System running to use "
+		      "fully qualified "
+		      "hostnames **~n"
+		      "** Hostname ~s is illegal **~n",
+		      [Host]),
+	    ?shutdown(Node);
+	[_, _ | _] when LongOrShortNames == shortnames ->
+	    error_logger:error_msg("** System NOT running to use fully qualified "
+			      "hostnames **~n"
+		      "** Hostname ~s is illegal **~n",
+		      [Host]),
+	    ?shutdown(Node);
+	_ ->
+	    [Name, Host]
+    end.
+
+split_node([Chr|T], Chr, Ack) -> 
+    [lists:reverse(Ack)|split_node(T, Chr, [])];
+split_node([H|T], Chr, Ack) -> 
+    split_node(T, Chr, [H|Ack]);
+split_node([], _, Ack) -> 
+    [lists:reverse(Ack)].
+
+connect_hs_data(Kernel, Node, MyNode, Socket, Timer, Version, Ip, TcpPort, Address, Type) ->
+    common_hs_data(Kernel, MyNode, Socket, Timer, 
+		   #hs_data{other_node = Node,
+			    other_version = Version,
+			    f_address = 
+				fun(_,_) ->
+					#net_address{address = {Ip,TcpPort},
+						     host = Address,
+						     protocol = proxy,
+						     family = inet}
+				end,
+			    request_type = Type
+			   }).
+
+accept_hs_data(Kernel, MyNode, Socket, Timer, Allowed) ->
+    common_hs_data(Kernel, MyNode, Socket, Timer, #hs_data{
+					     allowed = Allowed,
+					     f_address = fun(S, N) -> 
+								 ssl_tls_dist_proxy:get_remote_id(S, N)
+							 end
+					    }).
+
+common_hs_data(Kernel, MyNode, Socket, Timer, HsData) ->
+    HsData#hs_data{
+      kernel_pid = Kernel,
+      this_node = MyNode,
+      socket = Socket,
+      timer = Timer,
+      this_flags = 0,
+      f_send = 
+	  fun(S,D) -> 
+		  gen_tcp:send(S,D) 
+	  end,
+      f_recv = 
+	  fun(S,N,T) -> 
+		  gen_tcp:recv(S,N,T) 
+	  end,
+      f_setopts_pre_nodeup = 
+	  fun(S) ->
+		  inet:setopts(S, [{active, false}, {packet, 4}])
+	  end,
+		   f_setopts_post_nodeup = 
+	  fun(S) -> 
+		  inet:setopts(S, [{deliver, port},{active, true}])
+	  end,
+      f_getll = 
+	  fun(S) -> 
+		  inet:getll(S) 
+	  end,
+      mf_tick = 
+	  fun(S) -> 
+		  gen_tcp:send(S, <<>>)
+	  end,
+      mf_getstat = 
+	  fun(S) ->
+		  {ok, Stats} = inet:getstat(S, [recv_cnt, send_cnt, send_pend]),
+		  R = proplists:get_value(recv_cnt, Stats, 0),
+		  W = proplists:get_value(send_cnt, Stats, 0),
+		  P = proplists:get_value(send_pend, Stats, 0),
+		  {ok, R,W,P}
+	  end}.
diff --git a/lib/ssl/src/ssl.app.src b/lib/ssl/src/ssl.app.src
index b9716786e6..afe19da900 100644
--- a/lib/ssl/src/ssl.app.src
+++ b/lib/ssl/src/ssl.app.src
@@ -8,6 +8,9 @@
 	       ssl_broker,
 	       ssl_broker_sup,
 	       ssl_prim,
+	       inet_tls_dist,
+	       ssl_tls_dist_proxy,
+	       ssl_dist_sup,
 	       inet_ssl_dist,
 	       ssl_tls1,
 	       ssl_ssl3,
diff --git a/lib/ssl/src/ssl.erl b/lib/ssl/src/ssl.erl
index 6074dab3ca..57e0570bee 100644
--- a/lib/ssl/src/ssl.erl
+++ b/lib/ssl/src/ssl.erl
@@ -99,11 +99,11 @@ stop() ->
     application:stop(ssl).
 
 %%--------------------------------------------------------------------
--spec connect(host() | inet:port_number(), [connect_option()]) -> {ok, #sslsocket{}} |
+-spec connect(host() | port(), [connect_option()]) -> {ok, #sslsocket{}} |
 					      {error, reason()}.
--spec connect(host() | inet:port_number(), [connect_option()] | inet:port_number(), timeout() | list()) ->
+-spec connect(host() | port(), [connect_option()] | inet:port_number(), timeout() | list()) ->
 		     {ok, #sslsocket{}} | {error, reason()}.
--spec connect(host() | inet:port_number(), inet:port_number(), list(), timeout()) ->
+-spec connect(host() | port(), inet:port_number(), list(), timeout()) ->
 		     {ok, #sslsocket{}} | {error, reason()}.
 
 %%
@@ -742,7 +742,8 @@ handle_options(Opts0, _Role) ->
       secure_renegotiate = handle_option(secure_renegotiate, Opts, false),
       renegotiate_at = handle_option(renegotiate_at, Opts, ?DEFAULT_RENEGOTIATE_AT),
       debug      = handle_option(debug, Opts, []),
-      hibernate_after = handle_option(hibernate_after, Opts, undefined)
+      hibernate_after = handle_option(hibernate_after, Opts, undefined),
+      erl_dist = handle_option(erl_dist, Opts, false)
      },
 
     CbInfo  = proplists:get_value(cb_info, Opts, {gen_tcp, tcp, tcp_closed, tcp_error}),    
@@ -751,7 +752,7 @@ handle_options(Opts0, _Role) ->
 		  depth, cert, certfile, key, keyfile,
 		  password, cacerts, cacertfile, dh, dhfile, ciphers,
 		  debug, reuse_session, reuse_sessions, ssl_imp,
-		  cb_info, renegotiate_at, secure_renegotiate, hibernate_after],
+		  cb_info, renegotiate_at, secure_renegotiate, hibernate_after, erl_dist],
     
     SockOpts = lists:foldl(fun(Key, PropList) -> 
 				   proplists:delete(Key, PropList)
@@ -862,6 +863,9 @@ validate_option(hibernate_after, undefined) ->
     undefined;
 validate_option(hibernate_after, Value) when is_integer(Value), Value >= 0 ->
     Value;
+validate_option(erl_dist,Value) when Value == true; 
+				     Value == false ->
+    Value;
 validate_option(Opt, Value) ->
     throw({error, {eoptions, {Opt, Value}}}).
     
@@ -1007,7 +1011,7 @@ version() ->
                                 
 %% Only used to remove exit messages from old ssl
 %% First is a nonsense clause to provide some
-%% backward compability for orber that uses this
+%% backward compatibility for orber that uses this
 %% function in a none recommended way, but will
 %% work correctly if a valid pid is returned.
 pid(#sslsocket{fd = new_ssl}) ->
diff --git a/lib/ssl/src/ssl_connection.erl b/lib/ssl/src/ssl_connection.erl
index 5187d0f78f..79ee054200 100644
--- a/lib/ssl/src/ssl_connection.erl
+++ b/lib/ssl/src/ssl_connection.erl
@@ -1033,7 +1033,8 @@ code_change(_OldVsn, StateName, State, _Extra) ->
 %%--------------------------------------------------------------------
 %%% Internal functions
 %%--------------------------------------------------------------------
-start_fsm(Role, Host, Port, Socket, Opts,  User, {CbModule, _,_, _} = CbInfo, 
+start_fsm(Role, Host, Port, Socket, {#ssl_options{erl_dist = false},_} = Opts,
+	  User, {CbModule, _,_, _} = CbInfo, 
 	  Timeout) -> 
     try 
 	{ok, Pid} = ssl_connection_sup:start_child([Role, Host, Port, Socket, 
@@ -1044,9 +1045,26 @@ start_fsm(Role, Host, Port, Socket, Opts,  User, {CbModule, _,_, _} = CbInfo,
     catch
 	error:{badmatch, {error, _} = Error} ->
 	    Error
+    end;
+
+start_fsm(Role, Host, Port, Socket, {#ssl_options{erl_dist = true},_} = Opts,
+	  User, {CbModule, _,_, _} = CbInfo, 
+	  Timeout) -> 
+    try 
+	{ok, Pid} = ssl_connection_sup:start_child_dist([Role, Host, Port, Socket, 
+							 Opts, User, CbInfo]), 
+	{ok, SslSocket} = socket_control(Socket, Pid, CbModule),
+	ok = handshake(SslSocket, Timeout),
+	{ok, SslSocket} 
+    catch
+	error:{badmatch, {error, _} = Error} ->
+	    Error
     end.
 
 ssl_init(SslOpts, Role) ->
+    
+    init_manager_name(SslOpts#ssl_options.erl_dist),
+
     {ok, CertDbRef, CertDbHandle, CacheHandle, OwnCert} = init_certificates(SslOpts, Role),
     PrivateKey =
 	init_private_key(CertDbHandle, SslOpts#ssl_options.key, SslOpts#ssl_options.keyfile,
@@ -1054,6 +1072,10 @@ ssl_init(SslOpts, Role) ->
     DHParams = init_diffie_hellman(CertDbHandle, SslOpts#ssl_options.dh, SslOpts#ssl_options.dhfile, Role),
     {ok, CertDbRef, CertDbHandle, CacheHandle, OwnCert, PrivateKey, DHParams}.
 
+init_manager_name(false) ->
+    put(ssl_manager, ssl_manager);
+init_manager_name(true) ->
+    put(ssl_manager, ssl_manager_dist).
 
 init_certificates(#ssl_options{cacerts = CaCerts,
 			       cacertfile = CACertFile,
@@ -1778,7 +1800,8 @@ format_reply(binary, _, N, Data) when N > 0 ->  % Header mode
 format_reply(binary, _, _, Data) ->  
     Data;
 format_reply(list, Packet, _, Data)
-  when Packet == http; Packet == {http, headers};  Packet == http_bin; Packet == {http_bin, headers} ->
+  when Packet == http; Packet == {http, headers};  Packet == http_bin; Packet == {http_bin, headers}; Packet == httph;
+       Packet == httph_bin->
     Data;
 format_reply(list, _,_, Data) ->
     binary_to_list(Data).
@@ -2090,7 +2113,9 @@ set_socket_opts(Socket, [{packet, Packet}| Opts], SockOpts, Other) when Packet =
 									Packet == tpkt;
 									Packet == line;
 									Packet == http;
-									Packet == http_bin ->
+									Packet == httph;
+									Packet == http_bin;
+									Packet == httph_bin ->
     set_socket_opts(Socket, Opts, 
 		    SockOpts#socket_options{packet = Packet}, Other);
 set_socket_opts(_, [{packet, _} = Opt| _], SockOpts, _) ->
diff --git a/lib/ssl/src/ssl_connection_sup.erl b/lib/ssl/src/ssl_connection_sup.erl
index e9328d5f7c..78cfda5e63 100644
--- a/lib/ssl/src/ssl_connection_sup.erl
+++ b/lib/ssl/src/ssl_connection_sup.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %% 
-%% Copyright Ericsson AB 2007-2009. All Rights Reserved.
+%% Copyright Ericsson AB 2007-2011. All Rights Reserved.
 %% 
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -26,8 +26,8 @@
 -behaviour(supervisor).
 
 %% API
--export([start_link/0]).
--export([start_child/1]).
+-export([start_link/0, start_link_dist/0]).
+-export([start_child/1, start_child_dist/1]).
 
 %% Supervisor callback
 -export([init/1]).
@@ -38,9 +38,15 @@
 start_link() ->
     supervisor:start_link({local, ?MODULE}, ?MODULE, []).
 
+start_link_dist() ->
+    supervisor:start_link({local, ssl_connection_sup_dist}, ?MODULE, []).
+
 start_child(Args) ->
     supervisor:start_child(?MODULE, Args).
     
+start_child_dist(Args) ->
+    supervisor:start_child(ssl_connection_sup_dist, Args).
+    
 %%%=========================================================================
 %%%  Supervisor callback
 %%%=========================================================================
diff --git a/lib/ssl/src/ssl_dist_sup.erl b/lib/ssl/src/ssl_dist_sup.erl
new file mode 100644
index 0000000000..c1912401d7
--- /dev/null
+++ b/lib/ssl/src/ssl_dist_sup.erl
@@ -0,0 +1,84 @@
+%%
+%% %CopyrightBegin%
+%%
+%% Copyright Ericsson AB 2011-2011. All Rights Reserved.
+%%
+%% The contents of this file are subject to the Erlang Public License,
+%% Version 1.1, (the "License"); you may not use this file except in
+%% compliance with the License. You should have received a copy of the
+%% Erlang Public License along with this software. If not, it can be
+%% retrieved online at http://www.erlang.org/.
+%%
+%% Software distributed under the License is distributed on an "AS IS"
+%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+%% the License for the specific language governing rights and limitations
+%% under the License.
+%%
+%% %CopyrightEnd%
+%%
+
+%%
+
+-module(ssl_dist_sup).
+
+-behaviour(supervisor).
+
+%% API
+-export([start_link/0]).
+
+%% Supervisor callback
+-export([init/1]).
+
+%%%=========================================================================
+%%%  API
+%%%=========================================================================
+
+-spec start_link() -> {ok, pid()} | ignore | {error, term()}.
+			
+start_link() ->
+    supervisor:start_link({local, ?MODULE}, ?MODULE, []).
+
+%%%=========================================================================
+%%%  Supervisor callback
+%%%=========================================================================
+-spec init([]) -> {ok,  {SupFlags :: tuple(),  [ChildSpec :: tuple()]}}.
+
+init([]) ->    
+    SessionCertManager = session_and_cert_manager_child_spec(),
+    ConnetionManager = connection_manager_child_spec(),
+    ProxyServer = proxy_server_child_spec(),
+
+    {ok, {{one_for_all, 10, 3600}, [SessionCertManager, ConnetionManager,
+				    ProxyServer]}}.
+
+%%--------------------------------------------------------------------
+%%% Internal functions
+%%--------------------------------------------------------------------
+session_and_cert_manager_child_spec() ->
+    Opts = ssl_sup:manager_opts(),
+    Name = ssl_manager_dist,  
+    StartFunc = {ssl_manager, start_link_dist, [Opts]},
+    Restart = permanent, 
+    Shutdown = 4000,
+    Modules = [ssl_manager],
+    Type = worker,
+    {Name, StartFunc, Restart, Shutdown, Type, Modules}.
+
+connection_manager_child_spec() ->
+    Name = ssl_connection_dist,  
+    StartFunc = {ssl_connection_sup, start_link_dist, []},
+    Restart = permanent, 
+    Shutdown = 4000,
+    Modules = [ssl_connection],
+    Type = supervisor,
+    {Name, StartFunc, Restart, Shutdown, Type, Modules}.
+
+proxy_server_child_spec() ->
+    Name = ssl_tls_dist_proxy,  
+    StartFunc = {ssl_tls_dist_proxy, start_link, []},
+    Restart = permanent, 
+    Shutdown = 4000,
+    Modules = [ssl_tls_dist_proxy],
+    Type = worker,
+    {Name, StartFunc, Restart, Shutdown, Type, Modules}.
+
diff --git a/lib/ssl/src/ssl_internal.hrl b/lib/ssl/src/ssl_internal.hrl
index 6bf1edc452..483e06067c 100644
--- a/lib/ssl/src/ssl_internal.hrl
+++ b/lib/ssl/src/ssl_internal.hrl
@@ -98,10 +98,12 @@
 	  renegotiate_at,
 	  secure_renegotiate,
 	  debug,
-	  hibernate_after % undefined if not hibernating,
+	  hibernate_after,% undefined if not hibernating,
                           % or number of ms of inactivity
 			  % after which ssl_connection will
                           % go into hibernation
+	  %% This option should only be set to true by inet_tls_dist
+	  erl_dist = false 
 	  }).
 
 -record(socket_options,
diff --git a/lib/ssl/src/ssl_manager.erl b/lib/ssl/src/ssl_manager.erl
index 725a085d1f..dcf310c535 100644
--- a/lib/ssl/src/ssl_manager.erl
+++ b/lib/ssl/src/ssl_manager.erl
@@ -27,7 +27,7 @@
 -include("ssl_internal.hrl").
 
 %% Internal application API
--export([start_link/1, 
+-export([start_link/1, start_link_dist/1,
 	 connection_init/2, cache_pem_file/2,
 	 lookup_trusted_cert/4, issuer_candidate/2, client_session_id/4,
 	 server_session_id/4,
@@ -66,10 +66,20 @@
 %%--------------------------------------------------------------------
 -spec start_link(list()) -> {ok, pid()} | ignore | {error, term()}.
 %%
-%% Description: Starts the server
+%% Description: Starts the ssl manager that takes care of sessions
+%% and certificate caching.
 %%--------------------------------------------------------------------
 start_link(Opts) ->
-    gen_server:start_link({local, ?MODULE}, ?MODULE, [Opts], []).
+    gen_server:start_link({local, ?MODULE}, ?MODULE, [?MODULE, Opts], []).
+
+%%--------------------------------------------------------------------
+-spec start_link_dist(list()) -> {ok, pid()} | ignore | {error, term()}.
+%%
+%% Description: Starts a special instance of the ssl manager to
+%% be used by the erlang distribution. Note disables soft upgrade!
+%%--------------------------------------------------------------------
+start_link_dist(Opts) ->
+    gen_server:start_link({local, ssl_manager_dist}, ?MODULE, [ssl_manager_dist, Opts], []).
 
 %%--------------------------------------------------------------------
 -spec connection_init(string()| {der, list()}, client | server) ->
@@ -166,7 +176,8 @@ invalidate_session(Port, Session) ->
 %%
 %% Description: Initiates the server
 %%--------------------------------------------------------------------
-init([Opts]) ->
+init([Name, Opts]) ->
+    put(ssl_manager, Name),
     process_flag(trap_exit, true),
     CacheCb = proplists:get_value(session_cb, Opts, ssl_session_cache),
     SessionLifeTime =  
@@ -376,10 +387,10 @@ code_change(_OldVsn, State, _Extra) ->
 %%% Internal functions
 %%--------------------------------------------------------------------
 call(Msg) ->
-    gen_server:call(?MODULE, {Msg, self()}, infinity).
+    gen_server:call(get(ssl_manager), {Msg, self()}, infinity).
 
 cast(Msg) ->
-    gen_server:cast(?MODULE, Msg).
+    gen_server:cast(get(ssl_manager), Msg).
  
 validate_session(Host, Port, Session, LifeTime) ->
     case ssl_session:valid_session(Session, LifeTime) of
@@ -399,9 +410,10 @@ validate_session(Port, Session, LifeTime) ->
 		    
 start_session_validator(Cache, CacheCb, LifeTime) ->
     spawn_link(?MODULE, init_session_validator, 
-	       [[Cache, CacheCb, LifeTime]]).
+	       [[get(ssl_manager), Cache, CacheCb, LifeTime]]).
 
-init_session_validator([Cache, CacheCb, LifeTime]) ->
+init_session_validator([SslManagerName, Cache, CacheCb, LifeTime]) ->
+    put(ssl_manager, SslManagerName),
     CacheCb:foldl(fun session_validation/2,
 		  LifeTime, Cache).
 
diff --git a/lib/ssl/src/ssl_sup.erl b/lib/ssl/src/ssl_sup.erl
index 316ed8a4e9..a008682b89 100644
--- a/lib/ssl/src/ssl_sup.erl
+++ b/lib/ssl/src/ssl_sup.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 1998-2010. All Rights Reserved.
+%% Copyright Ericsson AB 1998-2011. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -24,7 +24,7 @@
 -behaviour(supervisor).
 
 %% API
--export([start_link/0]).
+-export([start_link/0, manager_opts/0]).
 
 %% Supervisor callback
 -export([init/1]).
@@ -62,6 +62,22 @@ init([]) ->
     {ok, {{one_for_all, 10, 3600}, [Child2, SessionCertManager,
 				    ConnetionManager]}}.
 
+
+manager_opts() ->
+    CbOpts = case application:get_env(ssl, session_cb) of
+		 {ok, Cb} when is_atom(Cb) ->
+		     InitArgs = session_cb_init_args(),
+		     [{session_cb, Cb}, {session_cb_init_args, InitArgs}];
+		 _  ->
+		     []
+	     end,
+    case application:get_env(ssl, session_lifetime) of
+	{ok, Time} when is_integer(Time) ->
+	    [{session_lifetime, Time}| CbOpts];
+	_  ->
+	    CbOpts
+    end.
+    
 %%--------------------------------------------------------------------
 %%% Internal functions
 %%--------------------------------------------------------------------
@@ -86,21 +102,6 @@ connection_manager_child_spec() ->
     {Name, StartFunc, Restart, Shutdown, Type, Modules}.
 
 
-manager_opts() ->
-    CbOpts = case application:get_env(ssl, session_cb) of
-		 {ok, Cb} when is_atom(Cb) ->
-		     InitArgs = session_cb_init_args(),
-		     [{session_cb, Cb}, {session_cb_init_args, InitArgs}];
-		 _  ->
-		     []
-	     end,
-    case application:get_env(ssl, session_lifetime) of
-	{ok, Time} when is_integer(Time) ->
-	    [{session_lifetime, Time}| CbOpts];
-	_  ->
-	    CbOpts
-    end.
-    
 session_cb_init_args() ->
     case application:get_env(ssl, session_cb_init_args) of
 	{ok, Args} when is_list(Args) ->
diff --git a/lib/ssl/src/ssl_tls_dist_proxy.erl b/lib/ssl/src/ssl_tls_dist_proxy.erl
new file mode 100644
index 0000000000..1a998a0f34
--- /dev/null
+++ b/lib/ssl/src/ssl_tls_dist_proxy.erl
@@ -0,0 +1,326 @@
+%%
+%% %CopyrightBegin%
+%%
+%% Copyright Ericsson AB 2011-2011. All Rights Reserved.
+%%
+%% The contents of this file are subject to the Erlang Public License,
+%% Version 1.1, (the "License"); you may not use this file except in
+%% compliance with the License. You should have received a copy of the
+%% Erlang Public License along with this software. If not, it can be
+%% retrieved online at http://www.erlang.org/.
+%%
+%% Software distributed under the License is distributed on an "AS IS"
+%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+%% the License for the specific language governing rights and limitations
+%% under the License.
+%%
+%% %CopyrightEnd%
+%%
+-module(ssl_tls_dist_proxy).
+
+
+-export([listen/1, accept/1, connect/2, get_remote_id/2]).
+-export([init/1, start_link/0, handle_call/3, handle_cast/2, handle_info/2, 
+	 terminate/2, code_change/3, ssl_options/2]).
+
+-include_lib("kernel/include/net_address.hrl").
+
+-record(state, 
+	{listen,
+	 accept_loop
+	}).
+
+-define(PPRE, 4).
+-define(PPOST, 4).
+
+
+%%====================================================================
+%% Internal application API
+%%====================================================================
+
+listen(Name) ->
+    gen_server:call(?MODULE, {listen, Name}, infinity). 
+
+accept(Listen) ->
+    gen_server:call(?MODULE, {accept, Listen}, infinity).
+
+connect(Ip, Port) ->
+    gen_server:call(?MODULE, {connect, Ip, Port}, infinity).
+
+get_remote_id(Socket, Node) ->
+    gen_server:call(?MODULE, {get_remote_id, {Socket,Node}}, infinity).
+
+%%====================================================================
+%% gen_server callbacks
+%%====================================================================
+
+start_link() ->
+    gen_server:start_link({local, ?MODULE}, ?MODULE, [], []).
+
+init([]) ->
+    process_flag(priority, max),
+    {ok, #state{}}.
+
+handle_call({listen, Name}, _From, State) ->
+    case gen_tcp:listen(0, [{active, false}, {packet,?PPRE}]) of
+	{ok, Socket} ->
+	    {ok, World} = gen_tcp:listen(0, [{active, false}, binary, {packet,?PPRE}]),
+	    TcpAddress = get_tcp_address(Socket),
+	    WorldTcpAddress = get_tcp_address(World),
+	    {_,Port} = WorldTcpAddress#net_address.address,
+	    {ok, Creation} = erl_epmd:register_node(Name, Port),
+	    {reply, {ok, {Socket, TcpAddress, Creation}},
+	     State#state{listen={Socket, World}}};
+	Error ->
+	    {reply, Error, State}
+    end;
+
+handle_call({accept, Listen}, {From, _}, State = #state{listen={_, World}}) ->
+    Self = self(),
+    ErtsPid = spawn_link(fun() -> accept_loop(Self, erts, Listen, From) end),
+    WorldPid = spawn_link(fun() -> accept_loop(Self, world, World, Listen) end),
+    {reply, ErtsPid, State#state{accept_loop={ErtsPid, WorldPid}}};
+
+handle_call({connect, Ip, Port}, {From, _}, State) ->
+    Me = self(),
+    Pid = spawn_link(fun() -> setup_proxy(Ip, Port, Me) end),
+    receive 
+	{Pid, go_ahead, LPort} -> 
+	    Res = {ok, Socket} = try_connect(LPort),
+	    ok = gen_tcp:controlling_process(Socket, From),
+	    flush_old_controller(From, Socket),
+	    {reply, Res, State};
+	{Pid, Error} ->
+	    {reply, Error, State}
+    end;
+
+handle_call({get_remote_id, {Socket,_Node}}, _From, State) ->
+    Address = get_tcp_address(Socket),
+    {reply, Address, State};
+
+handle_call(_What, _From, State) ->
+    {reply, ok, State}.
+
+handle_cast(_What, State) ->
+    {noreply, State}.
+
+handle_info(_What, State) ->
+    {noreply, State}.
+
+terminate(_Reason, _St) ->
+    ok.
+
+code_change(_OldVsn, St, _Extra) ->
+    {ok, St}.
+
+%%--------------------------------------------------------------------
+%%% Internal functions
+%%--------------------------------------------------------------------
+get_tcp_address(Socket) ->
+    {ok, Address} = inet:sockname(Socket),
+    {ok, Host} = inet:gethostname(),
+    #net_address{
+		  address = Address,
+		  host = Host,
+		  protocol = proxy,
+		  family = inet
+		}.
+
+accept_loop(Proxy, Type, Listen, Extra) ->
+    process_flag(priority, max),
+    case Type of
+	erts ->
+	    case gen_tcp:accept(Listen) of
+		{ok, Socket} ->
+		    Extra ! {accept,self(),Socket,inet,proxy},
+		    receive 
+			{_Kernel, controller, Pid} ->
+			    ok = gen_tcp:controlling_process(Socket, Pid),
+			    flush_old_controller(Pid, Socket),
+			    Pid ! {self(), controller};
+			{_Kernel, unsupported_protocol} ->
+			    exit(unsupported_protocol)
+		    end;
+		Error ->
+		    exit(Error)
+	    end;
+	world ->
+	    case gen_tcp:accept(Listen) of
+		{ok, Socket} ->
+		    Opts = get_ssl_options(server),
+		    case ssl:ssl_accept(Socket, Opts) of
+			{ok, SslSocket} ->
+			    PairHandler =
+				spawn_link(fun() ->
+						   setup_connection(SslSocket, Extra)
+					   end),
+			    ok = ssl:controlling_process(SslSocket, PairHandler),
+			    flush_old_controller(PairHandler, SslSocket);
+			_ ->
+			    gen_tcp:close(Socket)
+		    end;
+		Error ->
+		    exit(Error)
+	    end
+    end,
+    accept_loop(Proxy, Type, Listen, Extra).
+
+
+try_connect(Port) ->
+    case gen_tcp:connect({127,0,0,1}, Port, [{active, false}, {packet,?PPRE}]) of
+	R = {ok, _S} ->
+	    R;
+	{error, _R} ->
+	    try_connect(Port)
+    end.
+
+setup_proxy(Ip, Port, Parent) ->
+    process_flag(trap_exit, true),
+    Opts = get_ssl_options(client),
+    case ssl:connect(Ip, Port, [{active, true}, binary, {packet,?PPRE}] ++ Opts) of
+	{ok, World} ->
+	    {ok, ErtsL} = gen_tcp:listen(0, [{active, true}, binary, {packet,?PPRE}]),
+	    #net_address{address={_,LPort}} = get_tcp_address(ErtsL),
+	    Parent ! {self(), go_ahead, LPort},
+	    case gen_tcp:accept(ErtsL) of
+		{ok, Erts} ->
+		    %% gen_tcp:close(ErtsL),
+		    loop_conn_setup(World, Erts);
+		Err ->
+		    Parent ! {self(), Err}
+	    end;
+	Err ->
+	    Parent ! {self(), Err}
+    end.
+
+setup_connection(World, ErtsListen) ->
+    process_flag(trap_exit, true),
+    TcpAddress = get_tcp_address(ErtsListen),
+    {_Addr,Port} = TcpAddress#net_address.address,
+    {ok, Erts} = gen_tcp:connect({127,0,0,1}, Port, [{active, true}, binary, {packet,?PPRE}]),
+    ssl:setopts(World, [{active,true}, {packet,?PPRE}]),
+    loop_conn_setup(World, Erts).
+
+loop_conn_setup(World, Erts) ->
+    receive 
+	{ssl, World, Data = <<$a, _/binary>>} ->
+	    gen_tcp:send(Erts, Data),
+	    ssl:setopts(World, [{packet,?PPOST}]),
+	    inet:setopts(Erts, [{packet,?PPOST}]),
+	    loop_conn(World, Erts);
+	{tcp, Erts, Data = <<$a, _/binary>>} ->
+	    ssl:send(World, Data),
+	    ssl:setopts(World, [{packet,?PPOST}]),
+	    inet:setopts(Erts, [{packet,?PPOST}]),
+	    loop_conn(World, Erts);
+	{ssl, World, Data = <<_, _/binary>>} ->
+	    gen_tcp:send(Erts, Data),
+	    loop_conn_setup(World, Erts);
+	{tcp, Erts, Data = <<_, _/binary>>} ->
+	    ssl:send(World, Data),
+	    loop_conn_setup(World, Erts);
+	{ssl, World, Data} ->
+	    gen_tcp:send(Erts, Data),
+	    loop_conn_setup(World, Erts);
+	{tcp, Erts, Data} ->
+	    ssl:send(World, Data),
+	    loop_conn_setup(World, Erts)
+    end.
+
+loop_conn(World, Erts) ->
+    receive 
+	{ssl, World, Data} ->
+	    gen_tcp:send(Erts, Data),
+	    loop_conn(World, Erts);
+	{tcp, Erts, Data} ->
+	    ssl:send(World, Data),
+	    loop_conn(World, Erts);
+	{tcp_closed, Erts} ->
+	    ssl:close(World);
+	{ssl_closed,  World} ->
+	    gen_tcp:close(Erts)
+	end.
+
+get_ssl_options(Type) ->
+    case init:get_argument(ssl_dist_opt) of
+	{ok, Args} ->
+	    [{erl_dist, true} | ssl_options(Type, Args)];
+	_ ->
+	    [{erl_dist, true}]
+    end.
+
+ssl_options(_,[]) ->
+    [];
+ssl_options(server, [["client_" ++ _, _Value]|T]) ->
+     ssl_options(server,T);
+ssl_options(client, [["server_" ++ _, _Value]|T]) ->
+    ssl_options(client,T);
+ssl_options(server, [["server_certfile", Value]|T]) ->
+    [{certfile, Value} | ssl_options(server,T)];
+ssl_options(client, [["client_certfile", Value]|T]) ->
+    [{certfile, Value} | ssl_options(client,T)];
+ssl_options(server, [["server_cacertfile", Value]|T]) ->
+    [{cacertfile, Value} | ssl_options(server,T)];
+ssl_options(client, [["client_cacertfile", Value]|T]) ->
+     [{cacertfile, Value} | ssl_options(client,T)];
+ssl_options(server, [["server_keyfile", Value]|T]) ->
+    [{keyfile, Value} | ssl_options(server,T)];
+ssl_options(client, [["client_keyfile", Value]|T]) ->
+    [{keyfile, Value} | ssl_options(client,T)];
+ssl_options(server, [["server_password", Value]|T]) ->
+    [{password, Value} | ssl_options(server,T)];
+ssl_options(client, [["client_password", Value]|T]) ->
+    [{password, Value} | ssl_options(client,T)];
+ssl_options(server, [["server_verify", Value]|T]) ->
+    [{verify, atomize(Value)} | ssl_options(server,T)];
+ssl_options(client, [["client_verify", Value]|T]) ->
+     [{verify, atomize(Value)} | ssl_options(client,T)];
+ssl_options(server, [["server_reuse_sessions", Value]|T]) ->
+    [{reuse_sessions, atomize(Value)} | ssl_options(server,T)];
+ssl_options(client, [["client_reuse_sessions", Value]|T]) ->
+    [{reuse_sessions, atomize(Value)} | ssl_options(client,T)];
+ssl_options(server, [["server_secure_renegotiation", Value]|T]) ->
+    [{secure_renegotiation, atomize(Value)} | ssl_options(server,T)];
+ssl_options(client, [["client_secure_renegotiation", Value]|T]) ->
+    [{secure_renegotiation, atomize(Value)} | ssl_options(client,T)];
+ssl_options(server, [["server_depth", Value]|T]) ->
+    [{depth, list_to_integer(Value)} | ssl_options(server,T)];
+ssl_options(client, [["client_depth", Value]|T]) ->
+    [{depth, list_to_integer(Value)} | ssl_options(client,T)];
+ssl_options(server, [["server_hibernate_after", Value]|T]) ->
+    [{hibernate_after, list_to_integer(Value)} | ssl_options(server,T)];
+ssl_options(client, [["client_hibernate_after", Value]|T]) ->
+    [{hibernate_after, list_to_integer(Value)} | ssl_options(client,T)];
+ssl_options(server, [["server_ciphers", Value]|T]) ->
+     [{ciphers, Value} | ssl_options(server,T)];
+ssl_options(client, [["client_ciphers", Value]|T]) ->
+    [{ciphers, Value} | ssl_options(client,T)];
+ssl_options(server, [["server_dhfile", Value]|T]) ->
+     [{dhfile, Value} | ssl_options(server,T)];
+ssl_options(server, [["server_fail_if_no_peer_cert", Value]|T]) ->
+    [{fail_if_no_peer_cert, atomize(Value)} | ssl_options(server,T)];
+ssl_options(_,_) ->
+    exit(malformed_ssl_dist_opt).
+
+atomize(List) when is_list(List) ->
+    list_to_atom(List);
+atomize(Atom) when is_atom(Atom) ->
+    Atom.
+
+flush_old_controller(Pid, Socket) ->
+    receive
+	{tcp, Socket, Data} ->
+	    Pid ! {tcp, Socket, Data},
+	    flush_old_controller(Pid, Socket);
+	{tcp_closed, Socket} ->
+	    Pid ! {tcp_closed, Socket},
+	    flush_old_controller(Pid, Socket);
+	{ssl, Socket, Data} ->
+	    Pid ! {ssl, Socket, Data},
+	    flush_old_controller(Pid, Socket);
+	{ssl_closed, Socket} ->
+	    Pid ! {ssl_closed, Socket},
+	    flush_old_controller(Pid, Socket)
+    after 0 ->
+	    ok
+    end.