Merge branch 'essen/ssl-active-n' into maint

* essen/ssl-active-n:
  fixup! ssl: Add support for {active,N}
  ssl: Use common fonction to update {active,N}
  ssl: Document {active,N}
  ssl: Add support for {active,N}

Conflicts:
	lib/ssl/src/ssl.erl

7 files changed, 336 insertions, 20 deletions

diff --git a/lib/ssl/doc/src/ssl.xml b/lib/ssl/doc/src/ssl.xml
index 67ec93809f..90a9181ede 100644
--- a/lib/ssl/doc/src/ssl.xml
+++ b/lib/ssl/doc/src/ssl.xml
@@ -89,9 +89,12 @@
     <datatype>
       <name name="active_msgs"/>
       <desc>
-      <p>When an TLS/DTLS socket is in active mode (the default), data from the
+      <p>When a TLS/DTLS socket is in active mode (the default), data from the
       socket is delivered to the owner of the socket in the form of
       messages as described above.</p>
+      <p>The <c>ssl_passive</c> message is sent only when the socket is in
+      <c>{active, N}</c> mode and the counter dropped to 0. It indicates
+      that the socket has transitioned to passive (<c>{active, false}</c>) mode.</p>
       </desc>
     </datatype>
       
@@ -1171,8 +1174,8 @@ fun(srp, Username :: string(), UserState :: term()) ->
 	  marker="#handshake_cancel-1"><c>handshake_cancel/1</c></seealso>.
 	  </p>
 	  
-	  <p> If the option <c>active</c> is set to <c>once</c> or <c>true</c> the
-	  process owning the sslsocket will receive messages of type 
+	  <p> If the option <c>active</c> is set to <c>once</c>, <c>true</c> or an integer value,
+	  the process owning the sslsocket will receive messages of type 
 	  <seealso marker="#type-active_msgs"> active_msgs() </seealso>
 	  </p>
     </desc>
@@ -1219,8 +1222,8 @@ fun(srp, Username :: string(), UserState :: term()) ->
 	  marker="#handshake_cancel-1"><c>handshake_cancel/1</c></seealso>.
 	  </p>
 
-	  <p> If the option <c>active</c> is set to <c>once</c> or <c>true</c> the
-	  process owning the sslsocket will receive messages of type 
+	  <p> If the option <c>active</c> is set to <c>once</c>, <c>true</c> or an integer value,
+	  the process owning the sslsocket will receive messages of type 
 	  <seealso marker="#type-active_msgs"> active_msgs() </seealso>
 	  </p>
       </desc>
@@ -1381,8 +1384,8 @@ fun(srp, Username :: string(), UserState :: term()) ->
         <p>Performs the SSL/TLS/DTLS server-side handshake.</p>
 	<p>Returns a new TLS/DTLS socket if the handshake is successful.</p>
 
-	<p> If the option <c>active</c> is set to <c>once</c> or <c>true</c> the
-	process owning the sslsocket will receive messages of type 
+	<p> If the option <c>active</c> is set to <c>once</c>, <c>true</c> or an integer value,
+	the process owning the sslsocket will receive messages of type 
 	<seealso marker="#type-active_msgs"> active_msgs() </seealso>
 	</p>	
       </desc>
@@ -1426,8 +1429,8 @@ fun(srp, Username :: string(), UserState :: term()) ->
 	  marker="#handshake_cancel-1"><c>handshake_cancel/1</c></seealso>.
 	</p>
 	
-	<p> If the option <c>active</c> is set to <c>once</c> or <c>true</c> the
-	process owning the sslsocket will receive messages of type 
+	<p> If the option <c>active</c> is set to <c>once</c>, <c>true</c> or an integer value,
+	the process owning the sslsocket will receive messages of type 
 	<seealso marker="#type-active_msgs"> active_msgs() </seealso>
 	</p>
 	
diff --git a/lib/ssl/src/dtls_packet_demux.erl b/lib/ssl/src/dtls_packet_demux.erl
index dccc22a448..092366b7c0 100644
--- a/lib/ssl/src/dtls_packet_demux.erl
+++ b/lib/ssl/src/dtls_packet_demux.erl
@@ -297,6 +297,9 @@ do_set_emulated_opts([], Opts) ->
     Opts;
 do_set_emulated_opts([{mode, Value} | Rest], Opts) ->
     do_set_emulated_opts(Rest,  Opts#socket_options{mode = Value}); 
+do_set_emulated_opts([{active, N0} | Rest], Opts=#socket_options{active = Active}) when is_integer(N0) ->
+    N = tls_socket:update_active_n(N0, Active),
+    do_set_emulated_opts(Rest,  Opts#socket_options{active = N});
 do_set_emulated_opts([{active, Value} | Rest], Opts) ->
     do_set_emulated_opts(Rest,  Opts#socket_options{active = Value}).
 
diff --git a/lib/ssl/src/dtls_socket.erl b/lib/ssl/src/dtls_socket.erl
index 2001afd02f..4d07372e31 100644
--- a/lib/ssl/src/dtls_socket.erl
+++ b/lib/ssl/src/dtls_socket.erl
@@ -38,7 +38,9 @@ listen(Port, #config{transport_info = TransportInfo,
     case dtls_listener_sup:start_child([Port, TransportInfo, emulated_socket_options(EmOpts, #socket_options{}), 
 				   Options ++ internal_inet_values(), SslOpts]) of
 	{ok, Pid} ->
-	    {ok, #sslsocket{pid = {dtls, Config#config{dtls_handler = {Pid, Port}}}}};
+        Socket = #sslsocket{pid = {dtls, Config#config{dtls_handler = {Pid, Port}}}},
+        check_active_n(EmOpts, Socket),
+	    {ok, Socket};
 	Err = {error, _} ->
 	    Err
     end.
@@ -81,8 +83,9 @@ socket(Pids, Transport, Socket, ConnectionCb) ->
     #sslsocket{pid = Pids, 
 	       %% "The name "fd" is keept for backwards compatibility
 	       fd = {Transport, Socket, ConnectionCb}}.
-setopts(_, #sslsocket{pid = {dtls, #config{dtls_handler = {ListenPid, _}}}}, Options) ->
-    SplitOpts = tls_socket:split_options(Options),
+setopts(_, Socket = #sslsocket{pid = {dtls, #config{dtls_handler = {ListenPid, _}}}}, Options) ->
+    SplitOpts = {_, EmOpts} = tls_socket:split_options(Options),
+    check_active_n(EmOpts, Socket),
     dtls_packet_demux:set_sock_opts(ListenPid, SplitOpts);
 %%% Following clauses will not be called for emulated options, they are  handled in the connection process
 setopts(gen_udp, Socket, Options) ->
@@ -90,6 +93,32 @@ setopts(gen_udp, Socket, Options) ->
 setopts(Transport, Socket, Options) ->
     Transport:setopts(Socket, Options).
 
+check_active_n(EmulatedOpts, Socket = #sslsocket{pid = {dtls, #config{dtls_handler = {ListenPid, _}}}}) ->
+    %% We check the resulting options to send an ssl_passive message if necessary.
+    case proplists:lookup(active, EmulatedOpts) of
+        %% The provided value is out of bound.
+        {_, N} when is_integer(N), N < -32768 ->
+            throw(einval);
+        {_, N} when is_integer(N), N > 32767 ->
+            throw(einval);
+        {_, N} when is_integer(N) ->
+            {ok, #socket_options{active = Active}, _} = dtls_packet_demux:get_all_opts(ListenPid),
+            case Active of
+                Atom when is_atom(Atom), N =< 0 ->
+                    self() ! {ssl_passive, Socket};
+                %% The result of the addition is out of bound.
+                %% We do not need to check < -32768 because Active can't be below 1.
+                A when is_integer(A), A + N > 32767 ->
+                    throw(einval);
+                A when is_integer(A), A + N =< 0 ->
+                    self() ! {ssl_passive, Socket};
+                _ ->
+                    ok
+            end;
+        _ ->
+            ok
+    end.
+
 getopts(_, #sslsocket{pid = {dtls, #config{dtls_handler = {ListenPid, _}}}}, Options) ->
     SplitOpts = tls_socket:split_options(Options),
     dtls_packet_demux:get_sock_opts(ListenPid, SplitOpts);
@@ -161,9 +190,18 @@ emulated_socket_options(InetValues, #socket_options{
        mode   = proplists:get_value(mode, InetValues, Mode),
        packet = proplists:get_value(packet, InetValues, Packet),
        packet_size = proplists:get_value(packet_size, InetValues, PacketSize),
-       active = proplists:get_value(active, InetValues, Active)
+       active = emulated_active_option(InetValues, Active)
       }.
 
+emulated_active_option([], Active) ->
+    Active;
+emulated_active_option([{active, Active} | _], _) when Active =< 0 ->
+    false;
+emulated_active_option([{active, Active} | _], _) ->
+    Active;
+emulated_active_option([_|Tail], Active) ->
+    emulated_active_option(Tail, Active).
+
 emulated_options([{mode, Value} = Opt |Opts], Inet, Emulated) ->
     validate_inet_option(mode, Value),
     emulated_options(Opts, Inet, [Opt | proplists:delete(mode, Emulated)]);
@@ -185,6 +223,9 @@ validate_inet_option(mode, Value)
   when Value =/= list, Value =/= binary ->
     throw({error, {options, {mode,Value}}});
 validate_inet_option(active, Value)
+  when Value >= -32768, Value =< 32767 ->
+    ok;
+validate_inet_option(active, Value)
   when Value =/= true, Value =/= false, Value =/= once ->
     throw({error, {options, {active,Value}}});
 validate_inet_option(_, _) ->
diff --git a/lib/ssl/src/ssl.erl b/lib/ssl/src/ssl.erl
index 50e74d5eb7..fb6b7ba8e8 100644
--- a/lib/ssl/src/ssl.erl
+++ b/lib/ssl/src/ssl.erl
@@ -92,7 +92,7 @@
 -type tls_client_option()        :: client_option() | common_option() | socket_option() |  transport_option().
 -type tls_server_option()        :: server_option() | common_option() | socket_option() | transport_option().
 -type active_msgs()              :: {ssl, sslsocket(), Data::binary() | list()} | {ssl_closed, sslsocket()} |
-                                    {ssl_error, sslsocket(), Reason::term()}.
+                                    {ssl_error, sslsocket(), Reason::term()} | {ssl_passive, sslsocket()}.
 -type transport_option()         :: {cb_info, {CallbackModule::atom(), DataTag::atom(),
 				       ClosedTag::atom(), ErrTag::atom()}}.
 -type host()                     :: hostname() | ip_address().
diff --git a/lib/ssl/src/ssl_connection.erl b/lib/ssl/src/ssl_connection.erl
index 9e037313bb..24fb091ddf 100644
--- a/lib/ssl/src/ssl_connection.erl
+++ b/lib/ssl/src/ssl_connection.erl
@@ -1381,10 +1381,22 @@ handle_call({get_opts, OptTags}, From, _,
     {keep_state_and_data, [{reply, From, OptsReply}]};
 handle_call({set_opts, Opts0}, From, StateName, 
 	    #state{static_env =  #static_env{socket = Socket,
-                                            transport_cb = Transport},
+                                            transport_cb = Transport,
+                                            tracker = Tracker},
+                   connection_env = 
+                       #connection_env{user_application = {_Mon, Pid}},
                    socket_options = Opts1
                   } = State0, Connection) ->
     {Reply, Opts} = set_socket_opts(Connection, Transport, Socket, Opts0, Opts1, []),
+    case {proplists:lookup(active, Opts0), Opts} of
+        {{_, N}, #socket_options{active=false}} when is_integer(N) ->
+            send_user(
+              Pid,
+              format_passive(
+                Connection:pids(State0), Transport, Socket, Tracker, Connection));
+        _ ->
+            ok
+    end,
     State = State0#state{socket_options = Opts},
     handle_active_option(Opts#socket_options.active, StateName, From, Reply, State);
     
@@ -2455,6 +2467,30 @@ set_socket_opts(ConnectionCb, Transport, Socket, [{active, Active}| Opts], SockO
        Active == false ->
     set_socket_opts(ConnectionCb, Transport, Socket, Opts, 
 		    SockOpts#socket_options{active = Active}, Other);
+set_socket_opts(ConnectionCb, Transport, Socket, [{active, Active1} = Opt| Opts],
+                SockOpts=#socket_options{active = Active0}, Other)
+  when Active1 >= -32768, Active1 =< 32767 ->
+    Active = if
+        is_integer(Active0), Active0 + Active1 < -32768 ->
+            error;
+        is_integer(Active0), Active0 + Active1 =< 0 ->
+            false;
+        is_integer(Active0), Active0 + Active1 > 32767 ->
+            error;
+        Active1 =< 0 ->
+            false;
+        is_integer(Active0) ->
+            Active0 + Active1;
+        true ->
+            Active1
+    end,
+    case Active of
+        error ->
+            {{error, {options, {socket_options, Opt}} }, SockOpts};
+        _ ->
+            set_socket_opts(ConnectionCb, Transport, Socket, Opts,
+                            SockOpts#socket_options{active = Active}, Other)
+    end;
 set_socket_opts(_,_, _, [{active, _} = Opt| _], SockOpts, _) ->
     {{error, {options, {socket_options, Opt}} }, SockOpts};
 set_socket_opts(ConnectionCb, Transport, Socket, [Opt | Opts], SockOpts, Other) ->
@@ -2750,6 +2786,14 @@ deliver_app_data(
     case Active of
         once ->
             SO#socket_options{active=false};
+        1 ->
+            send_user(
+              Pid,
+              format_passive(
+                CPids, Transport, Socket, Tracker, Connection)),
+            SO#socket_options{active=false};
+        N when is_integer(N) ->
+            SO#socket_options{active=N - 1};
 	_ ->
 	    SO
     end.
@@ -2786,6 +2830,9 @@ do_format_reply(list, Packet, _, Data)
 do_format_reply(list, _,_, Data) ->
     binary_to_list(Data).
 
+format_passive(CPids, Transport, Socket, Tracker, Connection) ->
+    {ssl_passive, Connection:socket(CPids, Transport, Socket, Tracker)}.
+
 header(0, <<>>) ->
     <<>>;
 header(_, <<>>) ->
diff --git a/lib/ssl/src/tls_socket.erl b/lib/ssl/src/tls_socket.erl
index a391bc53de..c3c41d3e12 100644
--- a/lib/ssl/src/tls_socket.erl
+++ b/lib/ssl/src/tls_socket.erl
@@ -32,6 +32,7 @@
 	 emulated_socket_options/2, get_emulated_opts/1, 
 	 set_emulated_opts/2, get_all_opts/1, handle_call/3, handle_cast/2,
 	 handle_info/2, code_change/3]).
+-export([update_active_n/2]).
 
 -record(state, {
 	  emulated_opts,
@@ -51,7 +52,9 @@ listen(Transport, Port, #config{transport_info = {Transport, _, _, _},
     case Transport:listen(Port, Options ++ internal_inet_values()) of
 	{ok, ListenSocket} ->
 	    {ok, Tracker} = inherit_tracker(ListenSocket, EmOpts, SslOpts),
-	    {ok, #sslsocket{pid = {ListenSocket, Config#config{emulated = Tracker}}}};
+        Socket = #sslsocket{pid = {ListenSocket, Config#config{emulated = Tracker}}},
+        check_active_n(EmOpts, Socket),
+	    {ok, Socket};
 	Err = {error, _} ->
 	    Err
     end.
@@ -117,14 +120,16 @@ socket(Pids, Transport, Socket, ConnectionCb, Tracker) ->
     #sslsocket{pid = Pids, 
 	       %% "The name "fd" is keept for backwards compatibility
 	       fd = {Transport, Socket, ConnectionCb, Tracker}}.
-setopts(gen_tcp, #sslsocket{pid = {ListenSocket, #config{emulated = Tracker}}}, Options) ->
+setopts(gen_tcp, Socket = #sslsocket{pid = {ListenSocket, #config{emulated = Tracker}}}, Options) ->
     {SockOpts, EmulatedOpts} = split_options(Options),
     ok = set_emulated_opts(Tracker, EmulatedOpts),
+    check_active_n(EmulatedOpts, Socket),
     inet:setopts(ListenSocket, SockOpts);
-setopts(_, #sslsocket{pid = {ListenSocket, #config{transport_info = {Transport,_,_,_},
+setopts(_, Socket = #sslsocket{pid = {ListenSocket, #config{transport_info = {Transport,_,_,_},
 						  emulated = Tracker}}}, Options) ->
     {SockOpts, EmulatedOpts} = split_options(Options),
     ok = set_emulated_opts(Tracker, EmulatedOpts),
+    check_active_n(EmulatedOpts, Socket),
     Transport:setopts(ListenSocket, SockOpts);
 %%% Following clauses will not be called for emulated options, they are  handled in the connection process
 setopts(gen_tcp, Socket, Options) ->
@@ -132,6 +137,31 @@ setopts(gen_tcp, Socket, Options) ->
 setopts(Transport, Socket, Options) ->
     Transport:setopts(Socket, Options).
 
+check_active_n(EmulatedOpts, Socket = #sslsocket{pid = {_, #config{emulated = Tracker}}}) ->
+    %% We check the resulting options to send an ssl_passive message if necessary.
+    case proplists:lookup(active, EmulatedOpts) of
+        %% The provided value is out of bound.
+        {_, N} when is_integer(N), N < -32768 ->
+            throw(einval);
+        {_, N} when is_integer(N), N > 32767 ->
+            throw(einval);
+        {_, N} when is_integer(N) ->
+            case get_emulated_opts(Tracker, [active]) of
+                [{_, false}] ->
+                    self() ! {ssl_passive, Socket},
+                    ok;
+                %% The result of the addition is out of bound.
+                [{_, A}] when is_integer(A), A < -32768 ->
+                    throw(einval);
+                [{_, A}] when is_integer(A), A > 32767 ->
+                    throw(einval);
+                _ ->
+                    ok
+            end;
+        _ ->
+            ok
+    end.
+
 getopts(gen_tcp,  #sslsocket{pid = {ListenSocket, #config{emulated = Tracker}}}, Options) ->
     {SockOptNames, EmulatedOptNames} = split_options(Options),
     EmulatedOpts = get_emulated_opts(Tracker, EmulatedOptNames),
@@ -209,7 +239,7 @@ start_link(Port, SockOpts, SslOpts) ->
 init([Port, Opts, SslOpts]) ->
     process_flag(trap_exit, true),
     true = link(Port),
-    {ok, #state{emulated_opts = Opts, port = Port, ssl_opts = SslOpts}}.
+    {ok, #state{emulated_opts = do_set_emulated_opts(Opts, []), port = Port, ssl_opts = SslOpts}}.
 
 %%--------------------------------------------------------------------
 -spec handle_call(msg(), from(), #state{}) -> {reply, reply(), #state{}}. 
@@ -304,9 +334,24 @@ split_options([Name | Opts], Emu, SocketOptNames, EmuOptNames) ->
 
 do_set_emulated_opts([], Opts) ->
     Opts;
+do_set_emulated_opts([{active, N0} | Rest], Opts) when is_integer(N0) ->
+    N = update_active_n(N0, proplists:get_value(active, Opts, false)),
+    do_set_emulated_opts(Rest, [{active, N} | proplists:delete(active, Opts)]);
 do_set_emulated_opts([{Name,_} = Opt | Rest], Opts) ->
     do_set_emulated_opts(Rest, [Opt | proplists:delete(Name, Opts)]).
 
+update_active_n(New, Current) ->
+    if
+        is_integer(Current), New + Current =< 0 ->
+            false;
+        is_integer(Current) ->
+            New + Current;
+        New =< 0 ->
+            false;
+        true ->
+            New
+    end.
+
 get_socket_opts(_, [], _) ->
     [];
 get_socket_opts(ListenSocket, SockOptNames, Cb) ->
@@ -366,6 +411,9 @@ validate_inet_option(header, Value)
   when not is_integer(Value) ->
     throw({error, {options, {header,Value}}});
 validate_inet_option(active, Value)
+  when Value >= -32768, Value =< 32767 ->
+    ok;
+validate_inet_option(active, Value)
   when Value =/= true, Value =/= false, Value =/= once ->
     throw({error, {options, {active,Value}}});
 validate_inet_option(_, _) ->
diff --git a/lib/ssl/test/ssl_basic_SUITE.erl b/lib/ssl/test/ssl_basic_SUITE.erl
index 0a66dfa0b1..e86d2eaf9e 100644
--- a/lib/ssl/test/ssl_basic_SUITE.erl
+++ b/lib/ssl/test/ssl_basic_SUITE.erl
@@ -164,6 +164,7 @@ api_tests() ->
      accept_pool,
      prf,
      socket_options,
+     active_n,
      cipher_suites,
      handshake_continue,
      handshake_continue_timeout,
@@ -243,6 +244,7 @@ error_handling_tests()->
     [close_transport_accept,
      recv_active,
      recv_active_once,
+     recv_active_n,
      recv_error_handling,
      call_in_error_state,
      close_in_error_state,
@@ -1978,7 +1980,7 @@ recv_active(Config) when is_list(Config) ->
 
 %%--------------------------------------------------------------------
 recv_active_once() ->
-    [{doc,"Test recv on active socket"}].
+    [{doc,"Test recv on active (once) socket"}].
 
 recv_active_once(Config) when is_list(Config) ->
     ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
@@ -2003,6 +2005,178 @@ recv_active_once(Config) when is_list(Config) ->
     ssl_test_lib:close(Client).
 
 %%--------------------------------------------------------------------
+recv_active_n() ->
+    [{doc,"Test recv on active (n) socket"}].
+
+recv_active_n(Config) when is_list(Config) ->
+    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
+    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+    Server =
+	ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+				   {from, self()},
+				   {mfa, {?MODULE, try_recv_active_once, []}},
+				   {options,  [{active, 1} | ServerOpts]}]),
+    Port = ssl_test_lib:inet_port(Server),
+    Client =
+	ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
+				   {host, Hostname},
+				   {from, self()},
+				   {mfa, {?MODULE, try_recv_active_once, []}},
+				   {options, [{active, 1} | ClientOpts]}]),
+
+    ssl_test_lib:check_result(Server, ok, Client, ok),
+
+    ssl_test_lib:close(Server),
+    ssl_test_lib:close(Client).
+
+%%--------------------------------------------------------------------
+%% Test case adapted from gen_tcp_misc_SUITE.
+active_n() ->
+    [{doc,"Test {active,N} option"}].
+
+active_n(Config) when is_list(Config) ->
+    ClientOpts = ssl_test_lib:ssl_options(client_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
+    Port = ssl_test_lib:inet_port(node()),
+    N = 3,
+    LS = ok(ssl:listen(Port, [{active,N}|ServerOpts])),
+    [{active,N}] = ok(ssl:getopts(LS, [active])),
+    active_n_common(LS, N),
+    Self = self(),
+    spawn_link(fun() ->
+        S0 = ok(ssl:transport_accept(LS)),
+        {ok, S} = ssl:handshake(S0),
+        ok = ssl:setopts(S, [{active,N}]),
+        [{active,N}] = ok(ssl:getopts(S, [active])),
+        ssl:controlling_process(S, Self),
+        Self ! {server, S}
+    end),
+    C = ok(ssl:connect("localhost", Port, [{active,N}|ClientOpts])),
+    [{active,N}] = ok(ssl:getopts(C, [active])),
+    S = receive
+        {server, S0} -> S0
+    after
+        1000 ->
+            exit({error, connect})
+    end,
+    active_n_common(C, N),
+    active_n_common(S, N),
+    ok = ssl:setopts(C, [{active,N}]),
+    ok = ssl:setopts(S, [{active,N}]),
+    ReceiveMsg = fun(Socket, Msg) ->
+        receive
+            {ssl,Socket,Msg} ->
+                ok;
+            {ssl,Socket,Begin} ->
+                receive
+                    {ssl,Socket,End} ->
+                        Msg = Begin ++ End,
+                        ok
+                after 1000 ->
+                    exit(timeout)
+                end
+        after 1000 ->
+            exit(timeout)
+        end
+    end,
+    repeat(3, fun(I) ->
+        Msg = "message "++integer_to_list(I),
+        ok = ssl:send(C, Msg),
+        ReceiveMsg(S, Msg),
+        ok = ssl:send(S, Msg),
+        ReceiveMsg(C, Msg)
+    end),
+    receive
+        {ssl_passive,S} ->
+            [{active,false}] = ok(ssl:getopts(S, [active]))
+    after
+        1000 ->
+            exit({error,ssl_passive})
+    end,
+    receive
+        {ssl_passive,C} ->
+            [{active,false}] = ok(ssl:getopts(C, [active]))
+    after
+        1000 ->
+            exit({error,ssl_passive})
+    end,
+    LS2 = ok(ssl:listen(0, [{active,0}])),
+    receive
+        {ssl_passive,LS2} ->
+            [{active,false}] = ok(ssl:getopts(LS2, [active]))
+    after
+        1000 ->
+            exit({error,ssl_passive})
+    end,
+    ok = ssl:close(LS2),
+    ok = ssl:close(C),
+    ok = ssl:close(S),
+    ok = ssl:close(LS),
+    ok.
+
+active_n_common(S, N) ->
+    ok = ssl:setopts(S, [{active,-N}]),
+    receive
+        {ssl_passive, S} -> ok
+    after
+        1000 ->
+            error({error,ssl_passive_failure})
+    end,
+    [{active,false}] = ok(ssl:getopts(S, [active])),
+    ok = ssl:setopts(S, [{active,0}]),
+    receive
+        {ssl_passive, S} -> ok
+    after
+        1000 ->
+            error({error,ssl_passive_failure})
+    end,
+    ok = ssl:setopts(S, [{active,32767}]),
+    {error,{options,_}} = ssl:setopts(S, [{active,1}]),
+    {error,{options,_}} = ssl:setopts(S, [{active,-32769}]),
+    ok = ssl:setopts(S, [{active,-32768}]),
+    receive
+        {ssl_passive, S} -> ok
+    after
+        1000 ->
+            error({error,ssl_passive_failure})
+    end,
+    [{active,false}] = ok(ssl:getopts(S, [active])),
+    ok = ssl:setopts(S, [{active,N}]),
+    ok = ssl:setopts(S, [{active,true}]),
+    [{active,true}] = ok(ssl:getopts(S, [active])),
+    receive
+        _ -> error({error,active_n})
+    after
+        0 ->
+            ok
+    end,
+    ok = ssl:setopts(S, [{active,N}]),
+    ok = ssl:setopts(S, [{active,once}]),
+    [{active,once}] = ok(ssl:getopts(S, [active])),
+    receive
+        _ -> error({error,active_n})
+    after
+        0 ->
+            ok
+    end,
+    {error,{options,_}} = ssl:setopts(S, [{active,32768}]),
+    ok = ssl:setopts(S, [{active,false}]),
+    [{active,false}] = ok(ssl:getopts(S, [active])),
+    ok.
+
+ok({ok,V}) -> V.
+
+repeat(N, Fun) ->
+    repeat(N, N, Fun).
+
+repeat(N, T, Fun) when is_integer(N), N > 0 ->
+    Fun(T-N),
+    repeat(N-1, T, Fun);
+repeat(_, _, _) ->
+    ok.
+
+%%--------------------------------------------------------------------
 dh_params() ->
     [{doc,"Test to specify DH-params file in server."}].