Merge branch 'ia/ssl/DH-ANON/OTP-8870' into dev

* ia/ssl/DH-ANON/OTP-8870:
  Anonymous cipher suites

11 files changed, 531 insertions, 335 deletions

diff --git a/lib/ssl/doc/src/ssl.xml b/lib/ssl/doc/src/ssl.xml
index 413703deca..511f1e0bb2 100644
--- a/lib/ssl/doc/src/ssl.xml
+++ b/lib/ssl/doc/src/ssl.xml
@@ -114,7 +114,7 @@
     <p><c>ciphersuite() =
       {key_exchange(), cipher(), hash()}</c></p>
     
-    <p><c>key_exchange() =  rsa | dhe_dss | dhe_rsa
+    <p><c>key_exchange() =  rsa | dhe_dss | dhe_rsa | dh_anon
     </c></p>
 
    <p><c>cipher() = rc4_128 | des_cbc | '3des_ede_cbc'
@@ -170,8 +170,13 @@
 
       <tag>{ciphers, ciphers()}</tag>
       <item>The cipher suites that should be supported. The function
-      <c>ciphers_suites/0</c> can be used to find all available
-      ciphers.
+      <c>cipher_suites/0</c> can be used to find all available
+      ciphers. Additionally some anonymous cipher suites ({dh_anon,
+      rc4_128, md5}, {dh_anon, des_cbc, sha}, {dh_anon,
+      '3des_ede_cbc', sha}, {dh_anon, aes_128_cbc, sha}, {dh_anon,
+      aes_256_cbc, sha}) are supported for testing purposes and will
+      only work if explicitly enabled by this option and they are supported/enabled
+      by the peer also.
       </item>
 
       <tag>{ssl_imp, ssl_imp()}</tag>
diff --git a/lib/ssl/src/ssl.erl b/lib/ssl/src/ssl.erl
index ef94750d02..7e5929d708 100644
--- a/lib/ssl/src/ssl.erl
+++ b/lib/ssl/src/ssl.erl
@@ -747,7 +747,7 @@ validate_option(depth, Value) when is_integer(Value),
 validate_option(cert, Value) when Value == undefined;
                                  is_binary(Value) ->
     Value;
-validate_option(certfile, Value) when is_list(Value) ->
+validate_option(certfile, Value) when Value == undefined; is_list(Value) ->
     Value;
 
 validate_option(key, undefined) ->
@@ -890,7 +890,7 @@ cipher_suites(Version, [{_,_,_}| _] = Ciphers0) ->
     Ciphers = [ssl_cipher:suite(C) || C <- Ciphers0],
     cipher_suites(Version, Ciphers);
 cipher_suites(Version, [Cipher0 | _] = Ciphers0) when is_binary(Cipher0) ->
-    Supported = ssl_cipher:suites(Version),
+    Supported = ssl_cipher:suites(Version) ++ ssl_cipher:anonymous_suites(),
     case [Cipher || Cipher <- Ciphers0, lists:member(Cipher, Supported)] of
 	[] ->
 	    Supported;
diff --git a/lib/ssl/src/ssl_cipher.erl b/lib/ssl/src/ssl_cipher.erl
index 8230149304..9824e17fcd 100644
--- a/lib/ssl/src/ssl_cipher.erl
+++ b/lib/ssl/src/ssl_cipher.erl
@@ -34,7 +34,7 @@
 
 -export([security_parameters/2, suite_definition/1,
 	 decipher/5, cipher/4, 
-	 suite/1, suites/1,
+	 suite/1, suites/1, anonymous_suites/0,
 	 openssl_suite/1, openssl_suite_name/1, filter/2]).
 
 -compile(inline).
@@ -191,6 +191,19 @@ suites({3, N}) when N == 1; N == 2 ->
     ssl_tls1:suites().
 
 %%--------------------------------------------------------------------
+-spec anonymous_suites() -> [cipher_suite()].
+%%
+%% Description: Returns a list of the anonymous cipher suites, only supported
+%% if explicitly set by user. Intended only for testing.
+%%--------------------------------------------------------------------
+anonymous_suites() ->
+    [?TLS_DH_anon_WITH_RC4_128_MD5,
+     ?TLS_DH_anon_WITH_DES_CBC_SHA,
+     ?TLS_DH_anon_WITH_3DES_EDE_CBC_SHA,
+     ?TLS_DH_anon_WITH_AES_128_CBC_SHA,
+     ?TLS_DH_anon_WITH_AES_256_CBC_SHA].
+
+%%--------------------------------------------------------------------
 -spec suite_definition(cipher_suite()) -> erl_cipher_suite().
 %%
 %% Description: Return erlang cipher suite definition.
@@ -235,7 +248,20 @@ suite_definition(?TLS_RSA_WITH_AES_256_CBC_SHA) ->
 suite_definition(?TLS_DHE_DSS_WITH_AES_256_CBC_SHA) ->
     {dhe_dss, aes_256_cbc, sha};
 suite_definition(?TLS_DHE_RSA_WITH_AES_256_CBC_SHA) ->
-    {dhe_rsa, aes_256_cbc, sha}.
+    {dhe_rsa, aes_256_cbc, sha};
+
+%%% DH-ANON deprecated by TLS spec and not available
+%%% by default, but good for testing purposes.
+suite_definition(?TLS_DH_anon_WITH_RC4_128_MD5) ->
+    {dh_anon, rc4_128, md5};
+suite_definition(?TLS_DH_anon_WITH_DES_CBC_SHA) ->
+    {dh_anon, des_cbc, sha};
+suite_definition(?TLS_DH_anon_WITH_3DES_EDE_CBC_SHA) ->
+    {dh_anon, '3des_ede_cbc', sha};
+suite_definition(?TLS_DH_anon_WITH_AES_128_CBC_SHA) ->
+    {dh_anon, aes_128_cbc, sha};
+suite_definition(?TLS_DH_anon_WITH_AES_256_CBC_SHA) ->
+    {dh_anon, aes_256_cbc, sha}.
 
 %%--------------------------------------------------------------------
 -spec suite(erl_cipher_suite()) -> cipher_suite().
@@ -266,12 +292,12 @@ suite({dhe_rsa, des_cbc, sha}) ->
     ?TLS_DHE_RSA_WITH_DES_CBC_SHA;
 suite({dhe_rsa, '3des_ede_cbc', sha}) ->
     ?TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA; 
-%% suite({dh_anon, rc4_128, md5}) ->
-%%     ?TLS_DH_anon_WITH_RC4_128_MD5;
-%% suite({dh_anon, des40_cbc, sha}) ->
-%%     ?TLS_DH_anon_WITH_DES_CBC_SHA;
-%% suite({dh_anon, '3des_ede_cbc', sha}) ->
-%%     ?TLS_DH_anon_WITH_3DES_EDE_CBC_SHA;
+suite({dh_anon, rc4_128, md5}) ->
+    ?TLS_DH_anon_WITH_RC4_128_MD5;
+suite({dh_anon, des_cbc, sha}) ->
+    ?TLS_DH_anon_WITH_DES_CBC_SHA;
+suite({dh_anon, '3des_ede_cbc', sha}) ->
+    ?TLS_DH_anon_WITH_3DES_EDE_CBC_SHA;
 
 %%% TSL V1.1 AES suites
 suite({rsa, aes_128_cbc, sha}) ->
@@ -280,16 +306,16 @@ suite({dhe_dss, aes_128_cbc, sha}) ->
     ?TLS_DHE_DSS_WITH_AES_128_CBC_SHA; 
 suite({dhe_rsa, aes_128_cbc, sha}) ->
     ?TLS_DHE_RSA_WITH_AES_128_CBC_SHA;
-%% suite({dh_anon, aes_128_cbc, sha}) ->
-%%     ?TLS_DH_anon_WITH_AES_128_CBC_SHA;
+suite({dh_anon, aes_128_cbc, sha}) ->
+    ?TLS_DH_anon_WITH_AES_128_CBC_SHA;
 suite({rsa, aes_256_cbc, sha}) ->
     ?TLS_RSA_WITH_AES_256_CBC_SHA;
 suite({dhe_dss, aes_256_cbc, sha}) ->
     ?TLS_DHE_DSS_WITH_AES_256_CBC_SHA;
 suite({dhe_rsa, aes_256_cbc, sha}) ->
-    ?TLS_DHE_RSA_WITH_AES_256_CBC_SHA.
-%% suite({dh_anon, aes_256_cbc, sha}) ->
-%%     ?TLS_DH_anon_WITH_AES_256_CBC_SHA.
+    ?TLS_DHE_RSA_WITH_AES_256_CBC_SHA;
+suite({dh_anon, aes_256_cbc, sha}) ->
+    ?TLS_DH_anon_WITH_AES_256_CBC_SHA.
 
 %%--------------------------------------------------------------------
 -spec openssl_suite(openssl_cipher_suite()) -> cipher_suite().
@@ -580,5 +606,3 @@ filter_rsa_suites(Use, KeyUse, CipherSuits, RsaSuites) ->
 	false ->
 	    CipherSuits -- RsaSuites
     end.
-
-
diff --git a/lib/ssl/src/ssl_connection.erl b/lib/ssl/src/ssl_connection.erl
index bd1ba6978a..178c71ecc6 100644
--- a/lib/ssl/src/ssl_connection.erl
+++ b/lib/ssl/src/ssl_connection.erl
@@ -374,7 +374,7 @@ hello(#server_hello{cipher_suite = CipherSuite,
 
     case ssl_handshake:hello(Hello, SslOptions, ConnectionStates0, Renegotiation) of
 	{Version, NewId, ConnectionStates} ->
-	    {KeyAlgorithm, _, _} = 
+	    {KeyAlgorithm, _, _} =
 		ssl_cipher:suite_definition(CipherSuite),
 	    
 	    PremasterSecret = make_premaster_secret(ReqVersion, KeyAlgorithm),
@@ -512,7 +512,7 @@ certify(#certificate{} = Cert,
 certify(#server_key_exchange{} = KeyExchangeMsg, 
         #state{role = client, negotiated_version = Version,
 	       key_algorithm = Alg} = State0) 
-  when Alg == dhe_dss; Alg == dhe_rsa ->
+  when Alg == dhe_dss; Alg == dhe_rsa;  Alg == dh_anon ->
     case handle_server_key(KeyExchangeMsg, State0) of
 	#state{} = State1 ->
 	    {Record, State} = next_record(State1),
@@ -613,25 +613,10 @@ certify_client_key_exchange(#client_diffie_hellman_public{dh_public = ClientPubl
 			    #state{negotiated_version = Version,
 				   diffie_hellman_params = #'DHParameter'{prime = P,
 									  base = G},
-				   diffie_hellman_keys = {_, ServerDhPrivateKey},
-				   role = Role,
-				   session = Session,
-				   connection_states = ConnectionStates0} = State0) ->
-
-    PMpint = crypto:mpint(P),
-    GMpint = crypto:mpint(G),	
-    PremasterSecret = crypto:dh_compute_key(mpint_binary(ClientPublicDhKey),
-					    ServerDhPrivateKey,
-					    [PMpint, GMpint]),
-
-    case ssl_handshake:master_secret(Version, PremasterSecret,
-				     ConnectionStates0, Role) of
-	{MasterSecret, ConnectionStates} ->
-	    State1 = State0#state{session = 
-				      Session#session{master_secret
-						      = MasterSecret},
-				  connection_states = ConnectionStates},
+				   diffie_hellman_keys = {_, ServerDhPrivateKey}} = State0) ->
 
+    case dh_master_secret(crypto:mpint(P), crypto:mpint(G), ClientPublicDhKey, ServerDhPrivateKey, State0) of
+	#state{} = State1 ->
 	    {Record, State} = next_record(State1),
 	    next_state(cipher, Record, State);
 	#alert{} = Alert ->
@@ -1058,6 +1043,8 @@ init_certificates(#ssl_options{cacerts = CaCerts,
 	end,
     init_certificates(Cert, CertDbRef, CacheRef, CertFile, Role).
 
+init_certificates(undefined, CertDbRef, CacheRef, "", _) ->
+    {ok, CertDbRef, CacheRef, undefined};
 
 init_certificates(undefined, CertDbRef, CacheRef, CertFile, client) ->
     try 
@@ -1068,18 +1055,18 @@ init_certificates(undefined, CertDbRef, CacheRef, CertFile, client) ->
     end;
 
 init_certificates(undefined, CertDbRef, CacheRef, CertFile, server) ->
-     try 
+    try
 	[OwnCert] = ssl_certificate:file_to_certificats(CertFile),
 	{ok, CertDbRef, CacheRef, OwnCert}
-     catch
-	 Error:Reason ->
-	     handle_file_error(?LINE, Error, Reason, CertFile, ecertfile,
-			       erlang:get_stacktrace())
-     end;
+    catch
+	Error:Reason ->
+	    handle_file_error(?LINE, Error, Reason, CertFile, ecertfile,
+			      erlang:get_stacktrace())
+    end;
 init_certificates(Cert, CertDbRef, CacheRef, _, _) ->
     {ok, CertDbRef, CacheRef, Cert}.
 
-init_private_key(undefined, "", _Password, client) -> 
+init_private_key(undefined, "", _Password, _Client) ->
     undefined;
 init_private_key(undefined, KeyFile, Password, _)  -> 
     try
@@ -1340,15 +1327,17 @@ server_hello_done(#state{transport_cb = Transport,
     Transport:send(Socket, BinHelloDone),
     State#state{connection_states = NewConnectionStates,
 		tls_handshake_hashes = NewHashes}.
-   
-certify_server(#state{transport_cb = Transport,
-                      socket = Socket,
-                      negotiated_version = Version,
-                      connection_states = ConnectionStates,
-                      tls_handshake_hashes = Hashes,
-                      cert_db_ref = CertDbRef,
-                      own_cert = OwnCert} = State) ->
 
+certify_server(#state{key_algorithm = dh_anon} = State) ->
+    State;
+
+certify_server(#state{transport_cb = Transport,
+		      socket = Socket,
+		      negotiated_version = Version,
+		      connection_states = ConnectionStates,
+		      tls_handshake_hashes = Hashes,
+		      cert_db_ref = CertDbRef,
+		      own_cert = OwnCert} = State) ->
     case ssl_handshake:certificate(OwnCert, CertDbRef, server) of
 	CertMsg = #certificate{} ->
 	    {BinCertMsg, NewConnectionStates, NewHashes} =
@@ -1373,7 +1362,8 @@ key_exchange(#state{role = server, key_algorithm = Algo,
 		    transport_cb = Transport
 		   } = State) 
   when Algo == dhe_dss;
-       Algo == dhe_rsa ->
+       Algo == dhe_rsa;
+       Algo == dh_anon ->
 
     Keys = crypto:dh_generate_key([crypto:mpint(P), crypto:mpint(G)]),
     ConnectionState = 
@@ -1392,11 +1382,6 @@ key_exchange(#state{role = server, key_algorithm = Algo,
 		diffie_hellman_keys = Keys,
                 tls_handshake_hashes = Hashes1};
 
-
-%% key_algorithm = dh_anon is not supported. Should be by default disabled
-%% if support is implemented and then we need a key_exchange clause for it
-%% here. 
-   
 key_exchange(#state{role = client, 
 		    connection_states = ConnectionStates0,
 		    key_algorithm = rsa,
@@ -1419,7 +1404,8 @@ key_exchange(#state{role = client,
 		    socket = Socket, transport_cb = Transport,
 		    tls_handshake_hashes = Hashes0} = State) 
   when Algorithm == dhe_dss;
-       Algorithm == dhe_rsa ->
+       Algorithm == dhe_rsa;
+       Algorithm == dh_anon ->
     Msg =  ssl_handshake:key_exchange(client, {dh, DhPubKey}),
     {BinMsg, ConnectionStates1, Hashes1} =
         encode_handshake(Msg, Version, ConnectionStates0, Hashes0),
@@ -1497,23 +1483,30 @@ save_verify_data(client, #finished{verify_data = Data}, ConnectionStates, abbrev
 save_verify_data(server, #finished{verify_data = Data}, ConnectionStates, abbreviated) ->
     ssl_record:set_server_verify_data(current_write, Data, ConnectionStates).
 
+handle_server_key(#server_key_exchange{params =
+					   #server_dh_params{dh_p = P,
+							     dh_g = G,
+							     dh_y = ServerPublicDhKey},
+				       signed_params = <<>>},
+		  #state{key_algorithm = dh_anon} = State) ->
+    dh_master_secret(P, G, ServerPublicDhKey, undefined, State);
+
 handle_server_key(
   #server_key_exchange{params = 
 		       #server_dh_params{dh_p = P,
 					 dh_g = G,
 					 dh_y = ServerPublicDhKey}, 
 		       signed_params = Signed}, 
-  #state{session = Session, negotiated_version = Version, role = Role,
-	 public_key_info = PubKeyInfo,
+  #state{public_key_info = PubKeyInfo,
 	 key_algorithm = KeyAlgo,
-	 connection_states = ConnectionStates0} = State) ->
+	 connection_states = ConnectionStates} = State) ->
      
     PLen = size(P),
     GLen = size(G),
     YLen = size(ServerPublicDhKey),
 
     ConnectionState = 
-	ssl_record:pending_connection_state(ConnectionStates0, read),
+	ssl_record:pending_connection_state(ConnectionStates, read),
     SecParams = ConnectionState#connection_state.security_parameters,
     #security_parameters{client_random = ClientRandom,
 			 server_random = ServerRandom} = SecParams, 
@@ -1527,29 +1520,11 @@ handle_server_key(
     
     case verify_dh_params(Signed, Hash, PubKeyInfo) of
 	true ->
-	    PMpint = mpint_binary(P),
-	    GMpint = mpint_binary(G),	
-	    Keys = {_, ClientDhPrivateKey} = 
-		crypto:dh_generate_key([PMpint,GMpint]),
-	    PremasterSecret = 
-		crypto:dh_compute_key(mpint_binary(ServerPublicDhKey), 
-				      ClientDhPrivateKey, [PMpint, GMpint]),
-	    case ssl_handshake:master_secret(Version, PremasterSecret, 
-					     ConnectionStates0, Role) of
-		{MasterSecret, ConnectionStates} ->
-		    State#state{diffie_hellman_keys = Keys,
-				 session = 
-				 Session#session{master_secret 
-						 = MasterSecret},
-				 connection_states = ConnectionStates};
-		#alert{} = Alert ->
-		    Alert
-	    end;
+	    dh_master_secret(P, G, ServerPublicDhKey, undefined, State);
 	false ->
 	    ?ALERT_REC(?FATAL,?HANDSHAKE_FAILURE)
     end.
 
-
 verify_dh_params(Signed, Hashes, {?rsaEncryption, PubKey, _PubKeyParams}) ->
     case public_key:decrypt_public(Signed, PubKey, 
 				   [{rsa_pad, rsa_pkcs1_padding}]) of
@@ -1561,6 +1536,30 @@ verify_dh_params(Signed, Hashes, {?rsaEncryption, PubKey, _PubKeyParams}) ->
 verify_dh_params(Signed, Hash, {?'id-dsa', PublicKey, PublicKeyParams}) ->
     public_key:verify(Hash, none, Signed, {PublicKey, PublicKeyParams}). 
 
+dh_master_secret(Prime, Base, PublicDhKey, undefined, State) ->
+    PMpint = mpint_binary(Prime),
+    GMpint = mpint_binary(Base),
+    Keys = {_, PrivateDhKey} =
+	crypto:dh_generate_key([PMpint,GMpint]),
+    dh_master_secret(PMpint, GMpint, PublicDhKey, PrivateDhKey, State#state{diffie_hellman_keys = Keys});
+
+dh_master_secret(PMpint, GMpint, PublicDhKey, PrivateDhKey,
+		 #state{session = Session,
+			negotiated_version = Version, role = Role,
+			connection_states = ConnectionStates0} = State) ->
+    PremasterSecret =
+	crypto:dh_compute_key(mpint_binary(PublicDhKey), PrivateDhKey,
+			      [PMpint, GMpint]),
+    case ssl_handshake:master_secret(Version, PremasterSecret,
+				     ConnectionStates0, Role) of
+	{MasterSecret, ConnectionStates} ->
+	    State#state{
+	      session =
+		  Session#session{master_secret = MasterSecret},
+	      connection_states = ConnectionStates};
+	#alert{} = Alert ->
+	    Alert
+    end.
 
 cipher_role(client, Data, Session, #state{connection_states = ConnectionStates0} = State) -> 
     ConnectionStates = ssl_record:set_server_verify_data(current_both, Data, ConnectionStates0),
diff --git a/lib/ssl/src/ssl_handshake.erl b/lib/ssl/src/ssl_handshake.erl
index 5b1a510034..58c6befbc6 100644
--- a/lib/ssl/src/ssl_handshake.erl
+++ b/lib/ssl/src/ssl_handshake.erl
@@ -36,7 +36,7 @@
 	 client_certificate_verify/6, certificate_verify/6,
 	 certificate_request/2, key_exchange/2, server_key_exchange_hash/2,
 	 finished/4, verify_connection/5, get_tls_handshake/2,
-	 decode_client_key/3, server_hello_done/0, sig_alg/1,
+	 decode_client_key/3, server_hello_done/0,
 	 encode_handshake/3, init_hashes/0, update_hashes/2,
 	 decrypt_premaster_secret/2]).
 
@@ -237,7 +237,7 @@ certificate(OwnCert, CertDbRef, client) ->
 	    {error, _} -> 
 		%% If no suitable certificate is available, the client
 		%% SHOULD send a certificate message containing no
-		%% certificates. (chapter 7.4.6. rfc 4346) 
+		%% certificates. (chapter 7.4.6. RFC 4346)
 		[]	 
 	end,
     #certificate{asn1_certificates = Chain};
@@ -355,15 +355,22 @@ key_exchange(server, {dh, {<<?UINT32(Len), PublicKey:Len/binary>>, _},
     YLen = byte_size(PublicKey),
     ServerDHParams = #server_dh_params{dh_p = PBin, 
 				       dh_g = GBin, dh_y = PublicKey},    
-    Hash = 
-	server_key_exchange_hash(KeyAlgo, <<ClientRandom/binary, 
-					    ServerRandom/binary, 
-					    ?UINT16(PLen), PBin/binary, 
-					    ?UINT16(GLen), GBin/binary,
-					    ?UINT16(YLen), PublicKey/binary>>),
-    Signed = digitally_signed(Hash, PrivateKey),
-    #server_key_exchange{params = ServerDHParams,
-			 signed_params = Signed}.
+
+    case KeyAlgo of
+	dh_anon ->
+	    #server_key_exchange{params = ServerDHParams,
+				 signed_params = <<>>};
+	_ ->
+	    Hash =
+		server_key_exchange_hash(KeyAlgo, <<ClientRandom/binary,
+						    ServerRandom/binary,
+						    ?UINT16(PLen), PBin/binary,
+						    ?UINT16(GLen), GBin/binary,
+						    ?UINT16(YLen), PublicKey/binary>>),
+	    Signed = digitally_signed(Hash, PrivateKey),
+	    #server_key_exchange{params = ServerDHParams,
+				 signed_params = Signed}
+    end.
 
 %%--------------------------------------------------------------------
 -spec master_secret(tls_version(), #session{} | binary(), #connection_states{},
@@ -445,9 +452,8 @@ server_hello_done() ->
 %%     
 %% Description: Encode a handshake packet to binary
 %%--------------------------------------------------------------------
-encode_handshake(Package, Version, KeyAlg) ->
-    SigAlg = sig_alg(KeyAlg),
-    {MsgType, Bin} = enc_hs(Package, Version, SigAlg),
+encode_handshake(Package, Version, _KeyAlg) ->
+    {MsgType, Bin} = enc_hs(Package, Version),
     Len = byte_size(Bin),
     [MsgType, ?uint24(Len), Bin].
 
@@ -526,7 +532,7 @@ decrypt_premaster_secret(Secret, RSAPrivateKey) ->
     end.
 
 %%--------------------------------------------------------------------
--spec server_key_exchange_hash(rsa | dhe_rsa| dhe_dss, binary()) -> binary().
+-spec server_key_exchange_hash(rsa | dhe_rsa| dhe_dss | dh_anon, binary()) -> binary().
 
 %%
 %% Description: Calculate server key exchange hash
@@ -541,21 +547,6 @@ server_key_exchange_hash(dhe_dss, Value) ->
     crypto:sha(Value).
 
 %%--------------------------------------------------------------------
--spec sig_alg(atom()) -> integer().
-
-%%
-%% Description: Translate atom representation to enum representation.
-%%--------------------------------------------------------------------
-sig_alg(dh_anon) ->
-    ?SIGNATURE_ANONYMOUS;
-sig_alg(Alg) when Alg == dhe_rsa; Alg == rsa ->
-    ?SIGNATURE_RSA;
-sig_alg(dhe_dss) ->
-    ?SIGNATURE_DSA;
-sig_alg(_) ->
-    ?NULL.
-
-%%--------------------------------------------------------------------
 %%% Internal functions
 %%--------------------------------------------------------------------
 get_tls_handshake_aux(<<?BYTE(Type), ?UINT24(Length), 
@@ -876,6 +867,13 @@ dec_hs(?CERTIFICATE, <<?UINT24(ACLen), ASN1Certs:ACLen/binary>>) ->
 dec_hs(?SERVER_KEY_EXCHANGE, <<?UINT16(PLen), P:PLen/binary,
 			      ?UINT16(GLen), G:GLen/binary,
 			      ?UINT16(YLen), Y:YLen/binary,
+			       ?UINT16(0)>>) -> %% May happen if key_algorithm is dh_anon
+    #server_key_exchange{params = #server_dh_params{dh_p = P,dh_g = G,
+						    dh_y = Y},
+			 signed_params = <<>>};
+dec_hs(?SERVER_KEY_EXCHANGE, <<?UINT16(PLen), P:PLen/binary,
+			      ?UINT16(GLen), G:GLen/binary,
+			      ?UINT16(YLen), Y:YLen/binary,
 			      ?UINT16(Len), Sig:Len/binary>>) ->
     #server_key_exchange{params = #server_dh_params{dh_p = P,dh_g = G, 
 						    dh_y = Y},
@@ -958,14 +956,14 @@ certs_from_list(ACList) ->
                         <<?UINT24(CertLen), Cert/binary>>
 		    end || Cert <- ACList]).
 
-enc_hs(#hello_request{}, _Version, _) ->
+enc_hs(#hello_request{}, _Version) ->
     {?HELLO_REQUEST, <<>>};
 enc_hs(#client_hello{client_version = {Major, Minor},
 		     random = Random,
 		     session_id = SessionID,
 		     cipher_suites = CipherSuites,
 		     compression_methods = CompMethods, 
-		     renegotiation_info = RenegotiationInfo}, _Version, _) ->
+		     renegotiation_info = RenegotiationInfo}, _Version) ->
     SIDLength = byte_size(SessionID),
     BinCompMethods = list_to_binary(CompMethods),
     CmLength = byte_size(BinCompMethods),
@@ -983,20 +981,20 @@ enc_hs(#server_hello{server_version = {Major, Minor},
 		     session_id = Session_ID,
 		     cipher_suite = Cipher_suite,
 		     compression_method = Comp_method,
-		     renegotiation_info = RenegotiationInfo}, _Version, _) ->
+		     renegotiation_info = RenegotiationInfo}, _Version) ->
     SID_length = byte_size(Session_ID),
     Extensions  = hello_extensions(RenegotiationInfo),
     ExtensionsBin = enc_hello_extensions(Extensions),
     {?SERVER_HELLO, <<?BYTE(Major), ?BYTE(Minor), Random:32/binary,
 		     ?BYTE(SID_length), Session_ID/binary,
                      Cipher_suite/binary, ?BYTE(Comp_method), ExtensionsBin/binary>>};
-enc_hs(#certificate{asn1_certificates = ASN1CertList}, _Version, _) ->
+enc_hs(#certificate{asn1_certificates = ASN1CertList}, _Version) ->
     ASN1Certs = certs_from_list(ASN1CertList),
     ACLen = erlang:iolist_size(ASN1Certs),
     {?CERTIFICATE, <<?UINT24(ACLen), ASN1Certs:ACLen/binary>>};
 enc_hs(#server_key_exchange{params = #server_dh_params{
 			      dh_p = P, dh_g = G, dh_y = Y},
-	signed_params = SignedParams}, _Version, _) ->
+	signed_params = SignedParams}, _Version) ->
     PLen = byte_size(P),
     GLen = byte_size(G),
     YLen = byte_size(Y),
@@ -1008,21 +1006,21 @@ enc_hs(#server_key_exchange{params = #server_dh_params{
     };
 enc_hs(#certificate_request{certificate_types = CertTypes,
 			    certificate_authorities = CertAuths}, 
-       _Version, _) ->
+       _Version) ->
     CertTypesLen = byte_size(CertTypes),
     CertAuthsLen = byte_size(CertAuths),
     {?CERTIFICATE_REQUEST,
        <<?BYTE(CertTypesLen), CertTypes/binary,
 	?UINT16(CertAuthsLen), CertAuths/binary>>
     };
-enc_hs(#server_hello_done{}, _Version, _) ->
+enc_hs(#server_hello_done{}, _Version) ->
     {?SERVER_HELLO_DONE, <<>>};
-enc_hs(#client_key_exchange{exchange_keys = ExchangeKeys}, Version, _) ->
+enc_hs(#client_key_exchange{exchange_keys = ExchangeKeys}, Version) ->
     {?CLIENT_KEY_EXCHANGE, enc_cke(ExchangeKeys, Version)};
-enc_hs(#certificate_verify{signature = BinSig}, _, _) ->
+enc_hs(#certificate_verify{signature = BinSig}, _) ->
     EncSig = enc_bin_sig(BinSig),
     {?CERTIFICATE_VERIFY, EncSig};
-enc_hs(#finished{verify_data = VerifyData}, _Version, _) ->
+enc_hs(#finished{verify_data = VerifyData}, _Version) ->
     {?FINISHED, VerifyData}.
 
 enc_cke(#encrypted_premaster_secret{premaster_secret = PKEPMS},{3, 0}) ->
@@ -1152,7 +1150,7 @@ calc_certificate_verify({3, N}, _, Algorithm, Hashes)
 key_exchange_alg(rsa) ->
     ?KEY_EXCHANGE_RSA;
 key_exchange_alg(Alg) when Alg == dhe_rsa; Alg == dhe_dss;
-			    Alg == dh_dss; Alg == dh_rsa  ->
+			    Alg == dh_dss; Alg == dh_rsa; Alg == dh_anon ->
     ?KEY_EXCHANGE_DIFFIE_HELLMAN;
 key_exchange_alg(_) ->
     ?NULL.
diff --git a/lib/ssl/src/ssl_internal.hrl b/lib/ssl/src/ssl_internal.hrl
index ddb05e70f6..d2dee4d861 100644
--- a/lib/ssl/src/ssl_internal.hrl
+++ b/lib/ssl/src/ssl_internal.hrl
@@ -104,7 +104,7 @@
 -type tls_atom_version()  :: sslv3 | tlsv1.
 -type cache_ref()         :: term(). 
 -type certdb_ref()        :: term(). 
--type key_algo()          :: null | rsa | dhe_rsa | dhe_dss.
+-type key_algo()          :: null | rsa | dhe_rsa | dhe_dss | dh_anon.
 -type enum_algo()          :: integer().
 -type public_key()        :: #'RSAPublicKey'{} | integer().
 -type public_key_params() :: #'Dss-Parms'{} | term().
diff --git a/lib/ssl/test/Makefile b/lib/ssl/test/Makefile
index 9e4aecac45..c0a7f8d257 100644
--- a/lib/ssl/test/Makefile
+++ b/lib/ssl/test/Makefile
@@ -40,6 +40,7 @@ MODULES = \
 	ssl_packet_SUITE \
 	ssl_payload_SUITE \
 	ssl_to_openssl_SUITE \
+	ssl_session_cache_SUITE	\
 	ssl_test_MACHINE \
 	old_ssl_active_SUITE \
 	old_ssl_active_once_SUITE \
diff --git a/lib/ssl/test/ssl_basic_SUITE.erl b/lib/ssl/test/ssl_basic_SUITE.erl
index fade67f3ba..ea84b3c9d1 100644
--- a/lib/ssl/test/ssl_basic_SUITE.erl
+++ b/lib/ssl/test/ssl_basic_SUITE.erl
@@ -34,12 +34,6 @@
 -define(EXPIRE, 10).
 -define(SLEEP, 500).
 
--behaviour(ssl_session_cache_api).
-
-%% For the session cache tests
--export([init/1, terminate/1, lookup/2, update/3, 
-	 delete/2, foldl/3, select_session/2]).
-
 %% Test server callback functions
 %%--------------------------------------------------------------------
 %% Function: init_per_suite(Config) -> Config
@@ -89,13 +83,6 @@ end_per_suite(_Config) ->
 %% variable, but should NOT alter/remove any existing entries.
 %% Description: Initialization before each test case
 %%--------------------------------------------------------------------
-init_per_testcase(session_cache_process_list, Config) ->
-    init_customized_session_cache(list, Config);
-
-init_per_testcase(session_cache_process_mnesia, Config) ->
-    mnesia:start(),
-    init_customized_session_cache(mnesia, Config);
-
 init_per_testcase(reuse_session_expired, Config0) ->
     Config = lists:keydelete(watchdog, 1, Config0),
     Dog = ssl_test_lib:timetrap(?EXPIRE * 1000 * 5),
@@ -142,16 +129,6 @@ init_per_testcase(_TestCase, Config0) ->
     Dog = test_server:timetrap(?TIMEOUT),
    [{watchdog, Dog} | Config].
 
-init_customized_session_cache(Type, Config0) ->
-    Config = lists:keydelete(watchdog, 1, Config0),
-    Dog = test_server:timetrap(?TIMEOUT),
-    ssl:stop(),
-    application:load(ssl),
-    application:set_env(ssl, session_cb, ?MODULE),
-    application:set_env(ssl, session_cb_init_args, [Type]),
-    ssl:start(),
-    [{watchdog, Dog} | Config].
-
 %%--------------------------------------------------------------------
 %% Function: end_per_testcase(TestCase, Config) -> _
 %% Case - atom()
@@ -160,16 +137,6 @@ init_customized_session_cache(Type, Config0) ->
 %%   A list of key/value pairs, holding the test case configuration.
 %% Description: Cleanup after each test case
 %%--------------------------------------------------------------------
-end_per_testcase(session_cache_process_list, Config) ->
-    application:unset_env(ssl, session_cb),
-    end_per_testcase(default_action, Config);
-end_per_testcase(session_cache_process_mnesia, Config) ->
-    application:unset_env(ssl, session_cb),
-    application:unset_env(ssl, session_cb_init_args),
-    mnesia:stop(),
-    ssl:stop(),
-    ssl:start(),
-    end_per_testcase(default_action, Config);
 end_per_testcase(reuse_session_expired, Config) ->
     application:unset_env(ssl, session_lifetime),
     end_per_testcase(default_action, Config);
@@ -216,6 +183,8 @@ all(suite) ->
      ciphers_dsa_signed_certs_ssl3,
      ciphers_dsa_signed_certs_openssl_names,
      ciphers_dsa_signed_certs_openssl_names_ssl3,
+     anonymous_cipher_suites,
+     default_reject_anonymous,
      send_close,
      close_transport_accept, dh_params, server_verify_peer_passive,
      server_verify_peer_active, server_verify_peer_active_once,
@@ -226,7 +195,6 @@ all(suite) ->
      server_verify_client_once_active,
      server_verify_client_once_active_once, client_verify_none_passive,
      client_verify_none_active, client_verify_none_active_once,
-     session_cache_process_list, session_cache_process_mnesia,
      reuse_session, reuse_session_expired,
      server_does_not_want_to_reuse_session, client_renegotiate,
      server_renegotiate, client_renegotiate_reused_session,
@@ -1165,13 +1133,13 @@ ecertfile(Config) when is_list(Config) ->
     Server = 
 	ssl_test_lib:start_server_error([{node, ServerNode}, {port, 0}, 
 					 {from, self()},
-			    {options, ServerBadOpts}]),
+					 {options, ServerBadOpts}]),
 
     Port = ssl_test_lib:inet_port(Server),
 
     Client =
 	ssl_test_lib:start_client_error([{node, ClientNode}, 
-			    {port, Port}, {host, Hostname},
+					 {port, Port}, {host, Hostname},
 					 {from, self()}, 
 					 {options, ClientOpts}]),
     
@@ -1522,6 +1490,14 @@ ciphers_dsa_signed_certs_openssl_names_ssl3(Config) when is_list(Config) ->
     Ciphers = ssl_test_lib:openssl_dsa_suites(),
     run_suites(Ciphers, Version, Config, dsa).
 
+anonymous_cipher_suites(doc)->
+    ["Test the anonymous ciphersuites"];
+anonymous_cipher_suites(suite) ->
+    [];
+anonymous_cipher_suites(Config) when is_list(Config) ->
+    Version = ssl_record:protocol_version(ssl_record:highest_protocol_version([])),
+    Ciphers = ssl_test_lib:anonymous_suites(),
+    run_suites(Ciphers, Version, Config, anonymous).
 
 run_suites(Ciphers, Version, Config, Type) ->
     {ClientOpts, ServerOpts} =
@@ -1531,8 +1507,12 @@ run_suites(Ciphers, Version, Config, Type) ->
 		 ?config(server_opts, Config)};
 	    dsa ->
 		{?config(client_opts, Config),
-		 ?config(server_dsa_opts, Config)}
-	end,
+		 ?config(server_dsa_opts, Config)};
+	    anonymous ->
+		%% No certs in opts!
+		{?config(client_opts, Config),
+		 ?config(server_anon, Config)}
+	    end,
     
     Result =  lists:map(fun(Cipher) -> 
 				cipher(Cipher, Version, Config, ClientOpts, ServerOpts) end,
@@ -1593,6 +1573,32 @@ cipher(CipherSuite, Version, Config, ClientOpts, ServerOpts) ->
     end.
 
 %%--------------------------------------------------------------------
+default_reject_anonymous(doc)->
+    ["Test that by default anonymous cipher suites are rejected "];
+default_reject_anonymous(suite) ->
+    [];
+default_reject_anonymous(Config) when is_list(Config) ->
+    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+    ClientOpts = ?config(client_opts, Config),
+    ServerOpts = ?config(server_opts, Config),
+
+    [Cipher | _] = ssl_test_lib:anonymous_suites(),
+
+    Server = ssl_test_lib:start_server_error([{node, ServerNode}, {port, 0},
+					      {from, self()},
+					      {options, ServerOpts}]),
+    Port = ssl_test_lib:inet_port(Server),
+    Client = ssl_test_lib:start_client_error([{node, ClientNode}, {port, Port},
+					{host, Hostname},
+			   {from, self()},
+			   {options,
+			    [{ciphers,[Cipher]} |
+			     ClientOpts]}]),
+
+    ssl_test_lib:check_result(Server, {error, "insufficient security"},
+			      Client, {error, "insufficient security"}).
+
+%%--------------------------------------------------------------------
 reuse_session(doc) -> 
     ["Test reuse of sessions (short handshake)"];
 
@@ -2952,7 +2958,7 @@ unknown_server_ca_accept_verify_peer(Config) when is_list(Config) ->
 
 %%--------------------------------------------------------------------
 unknown_server_ca_accept_backwardscompatibilty(doc) ->
-    ["Test that the client succeds if the ca is unknown in verify_none mode"];
+    ["Test that old style verify_funs will work"];
 unknown_server_ca_accept_backwardscompatibilty(suite) ->
     [];
 unknown_server_ca_accept_backwardscompatibilty(Config) when is_list(Config) ->
@@ -3047,6 +3053,17 @@ der_input_opts(Opts) ->
 %%--------------------------------------------------------------------
 %%% Internal functions
 %%--------------------------------------------------------------------
+erlang_ssl_receive(Socket, Data) ->
+    receive
+	{ssl, Socket, Data} ->
+	    io:format("Received ~p~n",[Data]),
+	    ok;
+	Other ->
+	    test_server:fail({unexpected_message, Other})
+    after ?SLEEP * 3 ->
+	    test_server:fail({did_not_get, Data})
+    end.
+
 send_recv_result(Socket) ->
     ssl:send(Socket, "Hello world"),
     {ok,"Hello world"} = ssl:recv(Socket, 11),
@@ -3086,162 +3103,3 @@ renegotiate_reuse_session(Socket, Data) ->
     %% Make sure session is registerd
     test_server:sleep(?SLEEP),
     renegotiate(Socket, Data).
- 
-session_cache_process_list(doc) -> 
-    ["Test reuse of sessions (short handshake)"];
-
-session_cache_process_list(suite) -> 
-    [];
-session_cache_process_list(Config) when is_list(Config) -> 
-    session_cache_process(list,Config).
-
-session_cache_process_mnesia(doc) -> 
-    ["Test reuse of sessions (short handshake)"];
-
-session_cache_process_mnesia(suite) -> 
-    [];
-session_cache_process_mnesia(Config) when is_list(Config) -> 
-    session_cache_process(mnesia,Config).
-
-session_cache_process(_Type,Config) when is_list(Config) ->
-    reuse_session(Config).
-
-init([Type]) ->
-    ets:new(ssl_test, [named_table, public, set]),
-    ets:insert(ssl_test, {type, Type}),
-    case Type of
-	list ->
-	    spawn(fun() -> session_loop([]) end);
-	mnesia ->
-	    mnesia:start(),
-	    {atomic,ok} = mnesia:create_table(sess_cache, []),
-	    sess_cache
-    end.
-
-session_cb() ->
-    [{type, Type}] = ets:lookup(ssl_test, type),
-    Type.
-
-terminate(Cache) ->
-    case session_cb() of
-	list ->
-	    Cache ! terminate;
-	mnesia ->
-	    catch {atomic,ok} = 
-		mnesia:delete_table(sess_cache)
-    end.
-
-lookup(Cache, Key) ->        
-    case session_cb() of
-	list ->
-	    Cache ! {self(), lookup, Key},
-	    receive {Cache, Res} -> Res end;
-	mnesia ->
-	    case mnesia:transaction(fun() -> 
-					    mnesia:read(sess_cache, 
-							Key, read) 
-				    end) of
-		{atomic, [{sess_cache, Key, Value}]} -> 
-		    Value;
-		_ -> 
-		    undefined
-	    end
-	end.
-
-update(Cache, Key, Value) ->
-    case session_cb() of
-	list ->
-	    Cache ! {update, Key, Value};
-	mnesia ->
-	    {atomic, ok} = 
-		mnesia:transaction(fun() -> 
-					   mnesia:write(sess_cache, 
-							{sess_cache, Key, Value}, write) 
-				   end)
-    end.
-
-delete(Cache, Key) -> 
-    case session_cb() of
-	list ->
-	    Cache ! {delete, Key};
-	mnesia ->
-	    {atomic, ok} = 
-		mnesia:transaction(fun() -> 
-					   mnesia:delete(sess_cache, Key) 
-				   end)
-    end.
-
-foldl(Fun, Acc, Cache) -> 
-    case session_cb() of
-	list ->
-	    Cache ! {self(),foldl,Fun,Acc},
-	    receive {Cache, Res} -> Res end;
-	mnesia ->
-	    Foldl = fun() ->
-			    mnesia:foldl(Fun, Acc, sess_cache)
-		    end,
-	    {atomic, Res} = mnesia:transaction(Foldl),
-	    Res
-    end.
-    
-select_session(Cache, PartialKey) ->
-    case session_cb() of
-	list ->
-	    Cache ! {self(),select_session, PartialKey},
-	    receive 
-		{Cache, Res} -> 
-		    Res 
-	    end;
-	mnesia ->
-	    Sel = fun() ->
-			  mnesia:select(Cache,
-					[{{sess_cache,{PartialKey,'$1'}, '$2'},
-					  [],['$$']}])
-		  end,
-	    {atomic, Res} = mnesia:transaction(Sel),
-	    Res
-    end.
-
-session_loop(Sess) ->
-    receive 
-	terminate ->
-	    ok;
-	{Pid, lookup, Key} ->
-	    case lists:keysearch(Key,1,Sess) of
-		{value, {Key,Value}} ->
-		    Pid ! {self(), Value};
-		_ -> 
-		    Pid ! {self(), undefined}
-	    end,
-	    session_loop(Sess);
-	{update, Key, Value} ->
-	    NewSess = [{Key,Value}| lists:keydelete(Key,1,Sess)],
-	    session_loop(NewSess);
-	{delete, Key} ->
-	    session_loop(lists:keydelete(Key,1,Sess));
-	{Pid,foldl,Fun,Acc} ->
-	    Res = lists:foldl(Fun, Acc,Sess),
-	    Pid ! {self(), Res},
-	    session_loop(Sess);
-	{Pid,select_session,PKey} ->
-	    Sel = fun({{PKey0, Id},Session}, Acc) when PKey == PKey0 -> 
-			  [[Id, Session]|Acc];
-		     (_,Acc) -> 
-			  Acc
-		  end, 
-	    Sessions = lists:foldl(Sel, [], Sess),
-	    Pid ! {self(), Sessions},
-	    session_loop(Sess)
-    end.
-	    
-
-erlang_ssl_receive(Socket, Data) ->
-    receive
-	{ssl, Socket, Data} ->
-	    io:format("Received ~p~n",[Data]),
-	    ok;
-	Other ->
-	    test_server:fail({unexpected_message, Other})
-    after ?SLEEP * 3 ->
-	    test_server:fail({did_not_get, Data})
-    end.
diff --git a/lib/ssl/test/ssl_session_cache_SUITE.erl b/lib/ssl/test/ssl_session_cache_SUITE.erl
new file mode 100644
index 0000000000..7a441e4599
--- /dev/null
+++ b/lib/ssl/test/ssl_session_cache_SUITE.erl
@@ -0,0 +1,305 @@
+%%
+%% %CopyrightBegin%
+%%
+%% Copyright Ericsson AB 2010-2010. All Rights Reserved.
+%%
+%% The contents of this file are subject to the Erlang Public License,
+%% Version 1.1, (the "License"); you may not use this file except in
+%% compliance with the License. You should have received a copy of the
+%% Erlang Public License along with this software. If not, it can be
+%% retrieved online at http://www.erlang.org/.2
+%%
+%% Software distributed under the License is distributed on an "AS IS"
+%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+%% the License for the specific language governing rights and limitations
+%% under the License.
+%%
+%% %CopyrightEnd%
+%%
+
+%%
+
+-module(ssl_session_cache_SUITE).
+
+%% Note: This directive should only be used in test suites.
+-compile(export_all).
+
+-include("test_server.hrl").
+
+-define(SLEEP, 500).
+-define(TIMEOUT, 60000).
+-behaviour(ssl_session_cache_api).
+
+%% For the session cache tests
+-export([init/1, terminate/1, lookup/2, update/3,
+	 delete/2, foldl/3, select_session/2]).
+
+%% Test server callback functions
+%%--------------------------------------------------------------------
+%% Function: init_per_suite(Config) -> Config
+%% Config - [tuple()]
+%%   A list of key/value pairs, holding the test case configuration.
+%% Description: Initialization before the whole suite
+%%
+%% Note: This function is free to add any key/value pairs to the Config
+%% variable, but should NOT alter/remove any existing entries.
+%%--------------------------------------------------------------------
+init_per_suite(Config0) ->
+    Dog = ssl_test_lib:timetrap(?TIMEOUT *2),
+    crypto:start(),
+    application:start(public_key),
+    ssl:start(),
+
+    %% make rsa certs using oppenssl
+    Result =
+	(catch make_certs:all(?config(data_dir, Config0),
+			      ?config(priv_dir, Config0))),
+    test_server:format("Make certs  ~p~n", [Result]),
+
+    Config1 = ssl_test_lib:make_dsa_cert(Config0),
+    Config = ssl_test_lib:cert_options(Config1),
+    [{watchdog, Dog} | Config].
+
+%%--------------------------------------------------------------------
+%% Function: end_per_suite(Config) -> _
+%% Config - [tuple()]
+%%   A list of key/value pairs, holding the test case configuration.
+%% Description: Cleanup after the whole suite
+%%--------------------------------------------------------------------
+end_per_suite(_Config) ->
+    ssl:stop(),
+    crypto:stop().
+
+%%--------------------------------------------------------------------
+%% Function: init_per_testcase(TestCase, Config) -> Config
+%% Case - atom()
+%%   Name of the test case that is about to be run.
+%% Config - [tuple()]
+%%   A list of key/value pairs, holding the test case configuration.
+%%
+%% Description: Initialization before each test case
+%%
+%% Note: This function is free to add any key/value pairs to the Config
+%% variable, but should NOT alter/remove any existing entries.
+%% Description: Initialization before each test case
+%%--------------------------------------------------------------------
+init_per_testcase(session_cache_process_list, Config) ->
+    init_customized_session_cache(list, Config);
+
+init_per_testcase(session_cache_process_mnesia, Config) ->
+    mnesia:start(),
+    init_customized_session_cache(mnesia, Config);
+
+init_per_testcase(_TestCase, Config0) ->
+    Config = lists:keydelete(watchdog, 1, Config0),
+    Dog = test_server:timetrap(?TIMEOUT),
+   [{watchdog, Dog} | Config].
+
+init_customized_session_cache(Type, Config0) ->
+    Config = lists:keydelete(watchdog, 1, Config0),
+    Dog = test_server:timetrap(?TIMEOUT),
+    ssl:stop(),
+    application:load(ssl),
+    application:set_env(ssl, session_cb, ?MODULE),
+    application:set_env(ssl, session_cb_init_args, [Type]),
+    ssl:start(),
+    [{watchdog, Dog} | Config].
+
+%%--------------------------------------------------------------------
+%% Function: end_per_testcase(TestCase, Config) -> _
+%% Case - atom()
+%%   Name of the test case that is about to be run.
+%% Config - [tuple()]
+%%   A list of key/value pairs, holding the test case configuration.
+%% Description: Cleanup after each test case
+%%--------------------------------------------------------------------
+end_per_testcase(session_cache_process_list, Config) ->
+    application:unset_env(ssl, session_cb),
+    end_per_testcase(default_action, Config);
+end_per_testcase(session_cache_process_mnesia, Config) ->
+    application:unset_env(ssl, session_cb),
+    application:unset_env(ssl, session_cb_init_args),
+    mnesia:stop(),
+    ssl:stop(),
+    ssl:start(),
+    end_per_testcase(default_action, Config);
+end_per_testcase(_TestCase, Config) ->
+    Dog = ?config(watchdog, Config),
+    case Dog of
+	undefined ->
+	    ok;
+	_ ->
+	    test_server:timetrap_cancel(Dog)
+    end.
+
+%%--------------------------------------------------------------------
+%% Function: all(Clause) -> TestCases
+%% Clause - atom() - suite | doc
+%% TestCases - [Case]
+%% Case - atom()
+%%   Name of a test case.
+%% Description: Returns a list of all test cases in this test suite
+%%--------------------------------------------------------------------
+all(doc) ->
+    ["Test session cach API"];
+
+all(suite) ->
+    [
+     session_cache_process_list, session_cache_process_mnesia
+    ].
+
+session_cache_process_list(doc) ->
+    ["Test reuse of sessions (short handshake)"];
+
+session_cache_process_list(suite) ->
+    [];
+session_cache_process_list(Config) when is_list(Config) ->
+    session_cache_process(list,Config).
+%%--------------------------------------------------------------------
+session_cache_process_mnesia(doc) ->
+    ["Test reuse of sessions (short handshake)"];
+
+session_cache_process_mnesia(suite) ->
+    [];
+session_cache_process_mnesia(Config) when is_list(Config) ->
+    session_cache_process(mnesia,Config).
+
+
+%%--------------------------------------------------------------------
+%%% Session cache API callbacks
+%%--------------------------------------------------------------------
+
+init([Type]) ->
+    ets:new(ssl_test, [named_table, public, set]),
+    ets:insert(ssl_test, {type, Type}),
+    case Type of
+	list ->
+	    spawn(fun() -> session_loop([]) end);
+	mnesia ->
+	    mnesia:start(),
+	    {atomic,ok} = mnesia:create_table(sess_cache, []),
+	    sess_cache
+    end.
+
+session_cb() ->
+    [{type, Type}] = ets:lookup(ssl_test, type),
+    Type.
+
+terminate(Cache) ->
+    case session_cb() of
+	list ->
+	    Cache ! terminate;
+	mnesia ->
+	    catch {atomic,ok} =
+		mnesia:delete_table(sess_cache)
+    end.
+
+lookup(Cache, Key) ->
+    case session_cb() of
+	list ->
+	    Cache ! {self(), lookup, Key},
+	    receive {Cache, Res} -> Res end;
+	mnesia ->
+	    case mnesia:transaction(fun() ->
+					    mnesia:read(sess_cache,
+							Key, read)
+				    end) of
+		{atomic, [{sess_cache, Key, Value}]} ->
+		    Value;
+		_ ->
+		    undefined
+	    end
+	end.
+
+update(Cache, Key, Value) ->
+    case session_cb() of
+	list ->
+	    Cache ! {update, Key, Value};
+	mnesia ->
+	    {atomic, ok} =
+		mnesia:transaction(fun() ->
+					   mnesia:write(sess_cache,
+							{sess_cache, Key, Value}, write)
+				   end)
+    end.
+
+delete(Cache, Key) ->
+    case session_cb() of
+	list ->
+	    Cache ! {delete, Key};
+	mnesia ->
+	    {atomic, ok} =
+		mnesia:transaction(fun() ->
+					   mnesia:delete(sess_cache, Key)
+				   end)
+    end.
+
+foldl(Fun, Acc, Cache) ->
+    case session_cb() of
+	list ->
+	    Cache ! {self(),foldl,Fun,Acc},
+	    receive {Cache, Res} -> Res end;
+	mnesia ->
+	    Foldl = fun() ->
+			    mnesia:foldl(Fun, Acc, sess_cache)
+		    end,
+	    {atomic, Res} = mnesia:transaction(Foldl),
+	    Res
+    end.
+
+select_session(Cache, PartialKey) ->
+    case session_cb() of
+	list ->
+	    Cache ! {self(),select_session, PartialKey},
+	    receive
+		{Cache, Res} ->
+		    Res
+	    end;
+	mnesia ->
+	    Sel = fun() ->
+			  mnesia:select(Cache,
+					[{{sess_cache,{PartialKey,'$1'}, '$2'},
+					  [],['$$']}])
+		  end,
+	    {atomic, Res} = mnesia:transaction(Sel),
+	    Res
+    end.
+
+session_loop(Sess) ->
+    receive
+	terminate ->
+	    ok;
+	{Pid, lookup, Key} ->
+	    case lists:keysearch(Key,1,Sess) of
+		{value, {Key,Value}} ->
+		    Pid ! {self(), Value};
+		_ ->
+		    Pid ! {self(), undefined}
+	    end,
+	    session_loop(Sess);
+	{update, Key, Value} ->
+	    NewSess = [{Key,Value}| lists:keydelete(Key,1,Sess)],
+	    session_loop(NewSess);
+	{delete, Key} ->
+	    session_loop(lists:keydelete(Key,1,Sess));
+	{Pid,foldl,Fun,Acc} ->
+	    Res = lists:foldl(Fun, Acc,Sess),
+	    Pid ! {self(), Res},
+	    session_loop(Sess);
+	{Pid,select_session,PKey} ->
+	    Sel = fun({{PKey0, Id},Session}, Acc) when PKey == PKey0 ->
+			  [[Id, Session]|Acc];
+		     (_,Acc) ->
+			  Acc
+		  end,
+	    Sessions = lists:foldl(Sel, [], Sess),
+	    Pid ! {self(), Sessions},
+	    session_loop(Sess)
+    end.
+
+%%--------------------------------------------------------------------
+%%% Internal functions
+%%--------------------------------------------------------------------
+
+session_cache_process(_Type,Config) when is_list(Config) ->
+    ssl_basic_SUITE:reuse_session(Config).
diff --git a/lib/ssl/test/ssl_test_lib.erl b/lib/ssl/test/ssl_test_lib.erl
index ce164f7e4c..e1e8214ed6 100644
--- a/lib/ssl/test/ssl_test_lib.erl
+++ b/lib/ssl/test/ssl_test_lib.erl
@@ -300,6 +300,7 @@ cert_options(Config) ->
 				{ssl_imp, new}]},
      {server_opts, [{ssl_imp, new},{reuseaddr, true}, 
 		    {certfile, ServerCertFile}, {keyfile, ServerKeyFile}]},
+     {server_anon, [{ssl_imp, new},{reuseaddr, true}, {ciphers, anonymous_suites()}]},
      {server_verification_opts, [{ssl_imp, new},{reuseaddr, true}, 
 		    {cacertfile, ServerCaCertFile},
 		    {certfile, ServerCertFile}, {keyfile, ServerKeyFile}]},
@@ -616,6 +617,13 @@ openssl_dsa_suites() ->
 			 end 
 		 end, Ciphers).
 
+anonymous_suites() ->
+    [{dh_anon, rc4_128, md5},
+     {dh_anon, des_cbc, sha},
+     {dh_anon, '3des_ede_cbc', sha},
+     {dh_anon, aes_128_cbc, sha},
+     {dh_anon, aes_256_cbc, sha}].
+
 pem_to_der(File) ->
     {ok, PemBin} = file:read_file(File),
     public_key:pem_decode(PemBin).
@@ -633,7 +641,7 @@ cipher_result(Socket, Result) ->
     receive 
 	{ssl, Socket, "Hello\n"} ->
 	    ssl:send(Socket, " world\n"),
-	    receive 
+	    receive
 		{ssl, Socket, " world\n"} ->
 		    ok
 	    end;       
diff --git a/lib/ssl/test/ssl_to_openssl_SUITE.erl b/lib/ssl/test/ssl_to_openssl_SUITE.erl
index 7f512f2ab9..55a0100b1e 100644
--- a/lib/ssl/test/ssl_to_openssl_SUITE.erl
+++ b/lib/ssl/test/ssl_to_openssl_SUITE.erl
@@ -1116,8 +1116,6 @@ run_suites(Ciphers, Version, Config, Type) ->
 	    test_server:fail(cipher_suite_failed_see_test_case_log) 
     end.
 
-
-
 cipher(CipherSuite, Version, Config, ClientOpts, ServerOpts) ->   
     process_flag(trap_exit, true),
     test_server:format("Testing CipherSuite ~p~n", [CipherSuite]),
@@ -1128,8 +1126,8 @@ cipher(CipherSuite, Version, Config, ClientOpts, ServerOpts) ->
     KeyFile = proplists:get_value(keyfile, ServerOpts),
    
     Cmd = "openssl s_server -accept " ++ integer_to_list(Port)  ++ 
-	" -cert " ++ CertFile ++ " -key " ++ KeyFile ++ "", 
-    
+	" -cert " ++ CertFile ++ " -key " ++ KeyFile ++ "",
+
     test_server:format("openssl cmd: ~p~n", [Cmd]),
     
     OpenSslPort =  open_port({spawn, Cmd}, [stderr_to_stdout]), 
@@ -1140,11 +1138,11 @@ cipher(CipherSuite, Version, Config, ClientOpts, ServerOpts) ->
 
     Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
 					{host, Hostname},
-			   {from, self()}, 
-			   {mfa, {ssl_test_lib, cipher_result, [ConnectionInfo]}},
-			   {options, 
-			    [{ciphers,[CipherSuite]} | 
-			     ClientOpts]}]), 
+					{from, self()},
+					{mfa, {ssl_test_lib, cipher_result, [ConnectionInfo]}},
+					{options,
+					 [{ciphers,[CipherSuite]} |
+			     ClientOpts]}]),
 
     port_command(OpenSslPort, "Hello\n"),