Merge branch 'master' of git-server:otp

Conflicts:
	lib/orber/src/orber.app.src

14 files changed, 609 insertions, 124 deletions

diff --git a/lib/ssl/doc/src/ssl.xml b/lib/ssl/doc/src/ssl.xml
index cdf6870c25..18d98e5efb 100644
--- a/lib/ssl/doc/src/ssl.xml
+++ b/lib/ssl/doc/src/ssl.xml
@@ -67,15 +67,15 @@
 
     <taglist>
 
-      <tag><c>boolean()</c></tag>
-      <item><p><c>= true | false</c></p></item>
+      <tag><c>boolean() =</c></tag>
+      <item><p><c>true | false</c></p></item>
 
-      <tag><c>option()</c></tag>
-      <item><p><c>= socketoption() | ssloption() | transportoption()</c></p>
+      <tag><c>option() =</c></tag>
+      <item><p><c>socketoption() | ssloption() | transportoption()</c></p>
       </item>
 
-      <tag><c>socketoption()</c></tag>
-      <item><p><c>= proplists:property()</c></p>
+      <tag><c>socketoption() =</c></tag>
+      <item><p><c>proplists:property()</c></p>
       <p>The default socket options are
       <c>[{mode,list},{packet, 0},{header, 0},{active, true}]</c>.</p>
       <p>For valid options, see the
@@ -83,32 +83,37 @@
       <seealso marker="kernel:gen_tcp">gen_tcp(3)</seealso> manual pages
       in Kernel.</p></item>
 
-      <tag><marker id="type-ssloption"></marker><c>ssloption()</c></tag>
-      <item><p><c>= {verify, verify_type()}</c></p>
-      <p><c>| {verify_fun, {fun(), term()}}</c></p>
-      <p><c>| {fail_if_no_peer_cert, boolean()} {depth, integer()}</c></p>
-      <p><c>| {cert, public_key:der_encoded()}</c></p>
-      <p><c>| {certfile, path()}</c></p>
-      <p><c>| {key, {'RSAPrivateKey'| 'DSAPrivateKey' | 'ECPrivateKey' 
-      | 'PrivateKeyInfo', public_key:der_encoded()}}</c></p>
-      <p><c>| {keyfile, path()}</c></p>
-      <p><c>| {password, string()}</c></p>
-      <p><c>| {cacerts, [public_key:der_encoded()]}</c></p>
-      <p><c>| {cacertfile, path()}</c></p>
-      <p><c>| {dh, public_key:der_encoded()}</c></p>
-      <p><c>| {dhfile, path()}</c></p>
-      <p><c>| {ciphers, ciphers()}</c></p>
-      <p><c>| {user_lookup_fun, {fun(), term()}}, {psk_identity, string()},
-      {srp_identity, {string(), string()}}</c></p>
-      <p><c>| {reuse_sessions, boolean()}</c></p>
-      <p><c>| {reuse_session, fun()} {next_protocols_advertised, [binary()]}</c></p>
-      <p><c>| {client_preferred_next_protocols, {client | server,
-      [binary()]} | {client | server, [binary()], binary()}}</c></p>
-      <p><c>| {log_alert, boolean()}</c></p>
-      <p><c>| {server_name_indication, hostname() | disable}</c></p></item>
-
-      <tag><c>transportoption()</c></tag>
-      <item><p><c>= {cb_info, {CallbackModule::atom(), DataTag::atom(),
+      <tag><marker id="type-ssloption"></marker><c>ssloption() =</c></tag>
+      <item>
+	<p><c>{verify, verify_type()}</c></p>
+	<p><c>| {verify_fun, {fun(), term()}}</c></p>
+	<p><c>| {fail_if_no_peer_cert, boolean()} {depth, integer()}</c></p>
+	<p><c>| {cert, public_key:der_encoded()}</c></p>
+	<p><c>| {certfile, path()}</c></p>
+	<p><c>| {key, {'RSAPrivateKey'| 'DSAPrivateKey' | 'ECPrivateKey' 
+	| 'PrivateKeyInfo', public_key:der_encoded()}}</c></p>
+	<p><c>| {keyfile, path()}</c></p>
+	<p><c>| {password, string()}</c></p>
+	<p><c>| {cacerts, [public_key:der_encoded()]}</c></p>
+	<p><c>| {cacertfile, path()}</c></p>
+	<p><c>| {dh, public_key:der_encoded()}</c></p>
+	<p><c>| {dhfile, path()}</c></p>
+	<p><c>| {ciphers, ciphers()}</c></p>
+	<p><c>| {user_lookup_fun, {fun(), term()}}, {psk_identity, string()},
+	{srp_identity, {string(), string()}}</c></p>
+	<p><c>| {reuse_sessions, boolean()}</c></p>
+	<p><c>| {reuse_session, fun()} {next_protocols_advertised, [binary()]}</c></p>
+	<p><c>| {client_preferred_next_protocols, {client | server,
+	[binary()]} | {client | server, [binary()], binary()}}</c></p>
+	<p><c>| {log_alert, boolean()}</c></p>
+	<p><c>| {server_name_indication, hostname() | disable}</c></p>
+	<p><c>| {sni_hosts, [{hostname(), ssloptions()}]}</c></p>
+	<p><c>| {sni_fun, SNIfun::fun()}</c></p>
+      </item>
+      
+      <tag><c>transportoption() =</c></tag>
+      <item><p><c>{cb_info, {CallbackModule::atom(), DataTag::atom(),
+
       ClosedTag::atom(), ErrTag:atom()}}</c></p>
       <p>Defaults to <c>{gen_tcp, tcp, tcp_closed, tcp_error}</c>. Can be used
       to customize the transport layer. The callback module must implement a
@@ -118,70 +123,73 @@
       The callback <c>gen_tcp</c> is treated specially and calls <c>inet</c>
       directly.</p>
       <taglist>
-	<tag><c>CallbackModule</c></tag>
-	<item><p><c>= atom()</c></p></item>
-	<tag><c>DataTag</c></tag>
-	<item><p><c>= atom()</c></p>
+	<tag><c>CallbackModule =</c></tag>
+	<item><p><c>atom()</c></p></item>
+	<tag><c>DataTag =</c></tag>
+	<item><p><c>atom()</c></p>
 	<p>Used in socket data message.</p></item>
-	<tag><c>ClosedTag</c></tag>
-	<item><p><c>= atom()</c></p>
+	<tag><c>ClosedTag =</c></tag>
+	<item><p><c>atom()</c></p>
 	<p>Used in socket close message.</p></item>
       </taglist>
       </item>
 
-      <tag><c>verify_type()</c></tag>
-      <item><p><c>= verify_none | verify_peer</c></p></item>
+      <tag><c>verify_type() =</c></tag>
+      <item><p><c>verify_none | verify_peer</c></p></item>
 
-      <tag><c>path()</c></tag>
-      <item><p><c>= string()</c></p>
+      <tag><c>path() =</c></tag>
+      <item><p><c>string()</c></p>
       <p>Represents a file path.</p></item>
 
-      <tag><c>public_key:der_encoded()</c></tag>
-      <item><p><c>= binary()</c></p>
+      <tag><c>public_key:der_encoded() =</c></tag>
+      <item><p><c>binary()</c></p>
       <p>ASN.1 DER-encoded entity as an Erlang binary.</p></item>
 
-      <tag><c>host()</c></tag>
-      <item><p><c>= hostname() | ipaddress()</c></p></item>
+      <tag><c>host() =</c></tag>
+      <item><p><c>hostname() | ipaddress()</c></p></item>
 
-      <tag><c>hostname()</c></tag>
-      <item><p><c>= string()</c></p></item>
+      <tag><c>hostname() =</c></tag>
+      <item><p><c>string()</c></p></item>
 
-      <tag><c>ip_address()</c></tag>
-      <item><p><c>= {N1,N2,N3,N4} % IPv4 | {K1,K2,K3,K4,K5,K6,K7,K8} % IPv6
+      <tag><c>ip_address() =</c></tag>
+      <item><p><c>{N1,N2,N3,N4} % IPv4 | {K1,K2,K3,K4,K5,K6,K7,K8} % IPv6
       </c></p></item>
 
-      <tag><c>sslsocket()</c></tag>
-      <item><p>Opaque to the user.</p></item>
+      <tag><c>sslsocket() =</c></tag>
+      <item><p>opaque()</p></item>
 
-      <tag><c>protocol()</c></tag>
-      <item><p><c>= sslv3 | tlsv1 | 'tlsv1.1' | 'tlsv1.2'</c></p></item>
+      <tag><c>protocol() =</c></tag>
+      <item><p><c>sslv3 | tlsv1 | 'tlsv1.1' | 'tlsv1.2'</c></p></item>
 
-      <tag><c>ciphers()</c></tag>
+      <tag><c>ciphers() =</c></tag>
       <item><p><c>= [ciphersuite()] | string()</c></p>
       <p>According to old API.</p></item>
 
-      <tag><c>ciphersuite()</c></tag>
-      <item><p><c>= {key_exchange(), cipher(), hash()}</c></p></item>
+      <tag><c>ciphersuite() =</c></tag>
+      <item><p><c>{key_exchange(), cipher(), hash()}</c></p></item>
 
-      <tag><c>key_exchange()</c></tag>
-      <item><p><c>= rsa | dhe_dss | dhe_rsa | dh_anon | psk | dhe_psk
+      <tag><c>key_exchange()=</c></tag>
+      <item><p><c>rsa | dhe_dss | dhe_rsa | dh_anon | psk | dhe_psk
       | rsa_psk | srp_anon | srp_dss | srp_rsa | ecdh_anon | ecdh_ecdsa
       | ecdhe_ecdsa | ecdh_rsa | ecdhe_rsa</c></p></item>
 
-      <tag><c>cipher()</c></tag>
-      <item><p><c>= rc4_128 | des_cbc | '3des_ede_cbc'
+      <tag><c>cipher() =</c></tag>
+      <item><p><c>rc4_128 | des_cbc | '3des_ede_cbc'
       | aes_128_cbc | aes_256_cbc | aes_128_gcm | aes_256_gcm</c></p></item>
 
-      <tag><c>hash()</c></tag>
-      <item><p><c>= md5 | sha</c></p></item>
+      <tag><c>hash() =</c></tag>
+      <item><p><c>md5 | sha</c></p></item>
 
-      <tag><c>prf_random()</c></tag>
-      <item><p><c>= client_random | server_random</c></p></item>
+      <tag><c>prf_random() =</c></tag>
+      <item><p><c>client_random | server_random</c></p></item>
 
-      <tag><c>srp_param_type()</c></tag>
-      <item><p><c>= srp_1024 | srp_1536 | srp_2048 | srp_3072
+      <tag><c>srp_param_type() =</c></tag>
+      <item><p><c>srp_1024 | srp_1536 | srp_2048 | srp_3072
       | srp_4096 | srp_6144 | srp_8192</c></p></item>
 
+      <tag><c>SNIfun::fun()</c></tag>
+      <item><p><c>= fun(ServerName :: string()) -> ssloptions()</c></p></item>
+
     </taglist>
   </section>
 
@@ -268,7 +276,7 @@ atom()}} |
 	application. It differentiates between the peer
 	certificate and the CA certificates by using <c>valid_peer</c> or
 	<c>valid</c> as second argument to the verification fun. See the
-	<seealso marker="public_key:cert_records">public_key User's
+	<seealso marker="public_key:public_key_records">public_key User's
 	Guide</seealso> for definition of <c>#'OTPCertificate'{}</c> and
 	<c>#'Extension'{}</c>.</p>
 
@@ -364,10 +372,10 @@ marker="public_key:public_key#pkix_path_validation-3">public_key:pkix_path_valid
 	empty argument list. The following arguments may be specified for the internal cache.</p>
 	<taglist>
 	  <tag><c>{http, timeout()}</c></tag>
-	  <item>
+	  <item><p>
 	    Enables fetching of CRLs specified as http URIs in<seealso 
-	    marker="public_key:cert_records"> X509 cerificate extensions.</seealso>
-	    Requires the OTP inets application.
+	    marker="public_key:public_key_records"> X509 cerificate extensions.</seealso>
+	    Requires the OTP inets application.</p>
 	  </item>	    
 	</taglist>    
       </item>
@@ -624,7 +632,24 @@ fun(srp, Username :: string(), UserState :: term()) ->
       selection. If set to <c>false</c> (the default), use the client
       preference.</p></item>
 
-      
+      <tag><c>{sni_hosts, [{hostname(), ssloptions()}]}</c></tag>
+      <item><p>If the server receives a SNI (Server Name Indication) from the client
+      matching a host listed in the <c>sni_hosts</c> option, the speicific options for
+      that host will override previously specified options.
+
+      The option <c>sni_fun</c>, and <c>sni_hosts</c> are mutually exclusive.</p></item>
+
+      <tag><c>{sni_fun, SNIfun::fun()}</c></tag>
+      <item><p>If the server receives a SNI (Server Name Indication) from the client,
+      the given function will be called to retrive <c>ssloptions()</c> for indicated server.
+      These options will be merged into predefined <c>ssloptions()</c>.
+
+      The function should be defined as:
+        <c>fun(ServerName :: string()) -> ssloptions()</c>
+      and can be specified as a fun or as named <c>fun module:function/1</c>
+
+      The option <c>sni_fun</c>, and <c>sni_hosts</c> are mutually exclusive.</p></item>
+
     </taglist>
   </section>
   
@@ -752,6 +777,45 @@ fun(srp, Username :: string(), UserState :: term()) ->
     </func>
 
     <func>
+      <name>connection_information(SslSocket) ->
+        {ok, Info} |  {error, Reason} </name>
+      <fsummary>Returns all the connection information.
+      </fsummary>
+      <type>
+        <v>Info = [InfoTuple]</v>
+        <v>InfoTuple = {protocol, Protocol} | {cipher_suite, CipherSuite} | {sni_hostname, SNIHostname}</v>
+        <v>CipherSuite = ciphersuite()</v>
+        <v>ProtocolVersion = protocol()</v>
+        <v>SNIHostname = string()</v>
+        <v>Reason = term()</v>
+      </type>
+      <desc><p>Return all the connection information containing negotiated protocol version, cipher suite, and the hostname of SNI extension.
+      Info will be a proplists containing all the connection information on success, otherwise <c>{error, Reason}</c> will be returned.</p> 
+      </desc>
+    </func>
+
+    <func>
+      <name>connection_information(SslSocket, Items) ->
+        {ok, Info} |  {error, Reason} </name>
+      <fsummary>Returns the requested connection information.
+      </fsummary>
+      <type>
+        <v>Items = [Item]</v>
+        <v>Item = protocol | cipher_suite | sni_hostname</v>
+        <v>Info = [InfoTuple]</v>
+        <v>InfoTuple = {protocol, Protocol} | {cipher_suite, CipherSuite} | {sni_hostname, SNIHostname}</v>
+        <v>CipherSuite = ciphersuite()</v>
+        <v>ProtocolVersion = protocol()</v>
+        <v>SNIHostname = string()</v>
+        <v>Reason = term()</v>
+      </type>
+      <desc><p>Returns the connection information you requested. The connection information you can request contains protocol, cipher_suite, and sni_hostname.
+      <c>{ok, Info}</c> will be returned if it executes sucessfully. The Info is a proplists containing the information you requested.
+      Otherwise, <c>{error, Reason}</c> will be returned.</p>
+      </desc>
+    </func>
+
+    <func>
       <name>format_error(Reason) -> string()</name>
       <fsummary>Returns an error string.</fsummary>
       <type>
diff --git a/lib/ssl/doc/src/ssl_crl_cache_api.xml b/lib/ssl/doc/src/ssl_crl_cache_api.xml
index 1d9353a2cc..9230442ae0 100644
--- a/lib/ssl/doc/src/ssl_crl_cache_api.xml
+++ b/lib/ssl/doc/src/ssl_crl_cache_api.xml
@@ -47,11 +47,11 @@
     
     <taglist>
       
-    <tag><c>cache_ref()</c></tag> 
-    <item> = opaque()</item>
-    <tag><c>dist_point()</c></tag>
-    <item> = #'DistributionPoint'{} see <seealso
-    marker="public_key:cert_records"> X509 certificates records</seealso></item>
+    <tag><c>cache_ref() =</c></tag> 
+    <item>opaque()</item>
+    <tag><c>dist_point() =</c></tag>
+    <item><p>#'DistributionPoint'{} see <seealso
+    marker="public_key:public_key_records"> X509 certificates records</seealso></p></item>
     
     </taglist>
     
diff --git a/lib/ssl/doc/src/ssl_session_cache_api.xml b/lib/ssl/doc/src/ssl_session_cache_api.xml
index c89d3874a1..28b5f4ce23 100644
--- a/lib/ssl/doc/src/ssl_session_cache_api.xml
+++ b/lib/ssl/doc/src/ssl_session_cache_api.xml
@@ -40,20 +40,20 @@
     <c>ssl_session_cache_api</c>:</p>
 
     <taglist>
-      <tag><c>cache_ref()</c></tag>
-      <item><p>= <c>opaque()</c></p></item>
+      <tag><c>cache_ref() =</c></tag>
+      <item><p><c>opaque()</c></p></item>
 
-      <tag><c>key()</c></tag>
-      <item><p>= <c>{partialkey(), session_id()}</c></p></item>
+      <tag><c>key() =</c></tag>
+      <item><p><c>{partialkey(), session_id()}</c></p></item>
 
-      <tag><c>partialkey()</c></tag>
-      <item><p>= <c>opaque()</c></p></item>
+      <tag><c>partialkey() =</c></tag>
+      <item><p><c>opaque()</c></p></item>
 
-      <tag><c>session_id()</c></tag>
-      <item><p>= <c>binary()</c></p></item>
+      <tag><c>session_id() =</c></tag>
+      <item><p><c>binary()</c></p></item>
 
-      <tag><c>session()</c></tag>
-      <item><p>= <c>opaque()</c></p></item>
+      <tag><c>session()</c> =</tag>
+      <item><p><c>opaque()</c></p></item>
     </taglist>
 
   </section>
diff --git a/lib/ssl/src/ssl.erl b/lib/ssl/src/ssl.erl
index 6461f64c1c..225a9be66f 100644
--- a/lib/ssl/src/ssl.erl
+++ b/lib/ssl/src/ssl.erl
@@ -38,11 +38,13 @@
 %% SSL/TLS protocol handling
 -export([cipher_suites/0, cipher_suites/1, suite_definition/1,
 	 connection_info/1, versions/0, session_info/1, format_error/1,
-	 renegotiate/1, prf/5, negotiated_protocol/1, negotiated_next_protocol/1]).
+     renegotiate/1, prf/5, negotiated_protocol/1, negotiated_next_protocol/1,
+	 connection_information/1, connection_information/2]).
 %% Misc
--export([random_bytes/1]).
+-export([random_bytes/1, handle_options/2]).
 
 -deprecated({negotiated_next_protocol, 1, next_major_release}).
+-deprecated({connection_info, 1, next_major_release}).
 
 -include("ssl_api.hrl").
 -include("ssl_internal.hrl").
@@ -286,16 +288,42 @@ controlling_process(#sslsocket{pid = {Listen,
 				   is_pid(NewOwner) ->
     Transport:controlling_process(Listen, NewOwner).
 
+
+%%--------------------------------------------------------------------
+-spec connection_information(#sslsocket{}) -> {ok, list()} | {error, reason()}.
+%%
+%% Description: Return SSL information for the connection
+%%--------------------------------------------------------------------
+connection_information(#sslsocket{pid = Pid}) when is_pid(Pid) -> ssl_connection:connection_information(Pid);
+connection_information(#sslsocket{pid = {Listen, _}}) when is_port(Listen) -> {error, enotconn}.
+
+
+%%--------------------------------------------------------------------
+-spec connection_information(#sslsocket{}, [atom]) -> {ok, list()} | {error, reason()}.
+%%
+%% Description: Return SSL information for the connection
+%%--------------------------------------------------------------------
+connection_information(#sslsocket{} = SSLSocket, Items) -> 
+    case connection_information(SSLSocket) of
+        {ok, I} ->
+            {ok, lists:filter(fun({K, _}) -> lists:foldl(fun(K1, Acc) when K1 =:= K -> Acc +  1; (_, Acc) -> Acc end, 0, Items) > 0 end, I)};
+        E ->
+            E
+    end.
+
 %%--------------------------------------------------------------------
 -spec connection_info(#sslsocket{}) -> 	{ok, {tls_record:tls_atom_version(), ssl_cipher:erl_cipher_suite()}} |
 					{error, reason()}.
 %%
 %% Description: Returns ssl protocol and cipher used for the connection
 %%--------------------------------------------------------------------
-connection_info(#sslsocket{pid = Pid}) when is_pid(Pid) ->
-    ssl_connection:info(Pid);
-connection_info(#sslsocket{pid = {Listen, _}}) when is_port(Listen) ->
-    {error, enotconn}.
+connection_info(#sslsocket{} = SSLSocket) ->
+    case connection_information(SSLSocket) of
+        {ok, Result} ->
+            {ok, {proplists:get_value(protocol, Result), proplists:get_value(cipher_suite, Result)}};
+        Error ->
+            Error
+    end.
 
 %%--------------------------------------------------------------------
 -spec peername(#sslsocket{}) -> {ok, {inet:ip_address(), inet:port_number()}} | {error, reason()}.
@@ -671,6 +699,8 @@ handle_options(Opts0) ->
 			  handle_option(client_preferred_next_protocols, Opts, undefined)),
 		    log_alert = handle_option(log_alert, Opts, true),
 		    server_name_indication = handle_option(server_name_indication, Opts, undefined),
+		    sni_hosts = handle_option(sni_hosts, Opts, []),
+		    sni_fun = handle_option(sni_fun, Opts, undefined),
 		    honor_cipher_order = handle_option(honor_cipher_order, Opts, false),
 		    protocol = proplists:get_value(protocol, Opts, tls),
 		    padding_check =  proplists:get_value(padding_check, Opts, true),
@@ -687,7 +717,7 @@ handle_options(Opts0) ->
 		  user_lookup_fun, psk_identity, srp_identity, ciphers,
 		  reuse_session, reuse_sessions, ssl_imp,
 		  cb_info, renegotiate_at, secure_renegotiate, hibernate_after,
-		  erl_dist, alpn_advertised_protocols,
+		  erl_dist, alpn_advertised_protocols, sni_hosts, sni_fun,
 		  alpn_preferred_protocols, next_protocols_advertised,
 		  client_preferred_next_protocols, log_alert,
 		  server_name_indication, honor_cipher_order, padding_check, crl_check, crl_cache,
@@ -704,6 +734,18 @@ handle_options(Opts0) ->
 		 inet_user = SockOpts, transport_info = CbInfo, connection_cb = ConnetionCb
 		}}.
 
+handle_option(sni_fun, Opts, Default) ->
+    OptFun = validate_option(sni_fun,
+                             proplists:get_value(sni_fun, Opts, Default)),
+    OptHosts = proplists:get_value(sni_hosts, Opts, undefined),
+    case {OptFun, OptHosts} of
+        {Default, _} ->
+            Default;
+        {_, undefined} ->
+            OptFun;
+        _ ->
+            throw({error, {conflict_options, [sni_fun, sni_hosts]}})
+    end;
 handle_option(OptionName, Opts, Default) ->
     validate_option(OptionName,
 		    proplists:get_value(OptionName, Opts, Default)).
@@ -881,6 +923,20 @@ validate_option(server_name_indication, disable) ->
     disable;
 validate_option(server_name_indication, undefined) ->
     undefined;
+validate_option(sni_hosts, []) ->
+    [];
+validate_option(sni_hosts, [{Hostname, SSLOptions} | Tail]) when is_list(Hostname) ->
+	RecursiveSNIOptions = proplists:get_value(sni_hosts, SSLOptions, undefined),
+	case RecursiveSNIOptions of
+		undefined ->
+			[{Hostname, validate_options(SSLOptions)} | validate_option(sni_hosts, Tail)];
+		_ ->
+			throw({error, {options, {sni_hosts, RecursiveSNIOptions}}})
+	end;
+validate_option(sni_fun, undefined) ->
+    undefined;
+validate_option(sni_fun, Fun) when is_function(Fun) ->
+    Fun;
 validate_option(honor_cipher_order, Value) when is_boolean(Value) ->
     Value;
 validate_option(padding_check, Value) when is_boolean(Value) ->
@@ -896,6 +952,12 @@ validate_option(crl_cache, {Cb, {_Handle, Options}} = Value) when is_atom(Cb) an
 validate_option(Opt, Value) ->
     throw({error, {options, {Opt, Value}}}).
 
+
+validate_options([]) ->
+	[];
+validate_options([{Opt, Value} | Tail]) ->
+	[{Opt, validate_option(Opt, Value)} | validate_options(Tail)].
+
 validate_npn_ordering(client) ->
     ok;
 validate_npn_ordering(server) ->
diff --git a/lib/ssl/src/ssl_connection.erl b/lib/ssl/src/ssl_connection.erl
index 4a839872a6..64fa7bab0d 100644
--- a/lib/ssl/src/ssl_connection.erl
+++ b/lib/ssl/src/ssl_connection.erl
@@ -41,8 +41,9 @@
 
 %% User Events 
 -export([send/2, recv/3, close/1, shutdown/2,
-	 new_user/2, get_opts/2, set_opts/2, info/1, session_info/1, 
-	 peer_certificate/1, renegotiation/1, negotiated_protocol/1, prf/5
+	 new_user/2, get_opts/2, set_opts/2, session_info/1, 
+	 peer_certificate/1, renegotiation/1, negotiated_protocol/1, prf/5,
+	 connection_information/1
 	]).
 
 -export([handle_session/7]).
@@ -161,6 +162,14 @@ recv(Pid, Length, Timeout) ->
     sync_send_all_state_event(Pid, {recv, Length, Timeout}).
 
 %%--------------------------------------------------------------------
+-spec connection_information(pid()) -> {ok, list()} | {error, reason()}.
+%%
+%% Description: Get the SNI hostname
+%%--------------------------------------------------------------------
+connection_information(Pid) when is_pid(Pid) ->
+    sync_send_all_state_event(Pid, connection_information).
+
+%%--------------------------------------------------------------------
 -spec close(pid()) -> ok | {error, reason()}.  
 %%
 %% Description:  Close an ssl connection
@@ -214,14 +223,6 @@ set_opts(ConnectionPid, Options) ->
     sync_send_all_state_event(ConnectionPid, {set_opts, Options}).
 
 %%--------------------------------------------------------------------
--spec info(pid()) ->  {ok, {atom(), tuple()}} | {error, reason()}. 
-%%
-%% Description:  Returns ssl protocol and cipher used for the connection
-%%--------------------------------------------------------------------
-info(ConnectionPid) ->
-    sync_send_all_state_event(ConnectionPid, info). 
-
-%%--------------------------------------------------------------------
 -spec session_info(pid()) -> {ok, list()} | {error, reason()}. 
 %%
 %% Description:  Returns info about the ssl session
@@ -829,13 +830,6 @@ handle_sync_event({prf, Secret, Label, Seed, WantedLength}, _, StateName,
 		error:Reason -> {error, Reason}
 	    end,
     {reply, Reply, StateName, State, get_timeout(State)};
-handle_sync_event(info, _, StateName, 
-		  #state{negotiated_version = Version,
-			 session = #session{cipher_suite = Suite}} = State) ->
-    
-    AtomVersion = tls_record:protocol_version(Version),
-    {reply, {ok, {AtomVersion, ssl:suite_definition(Suite)}},
-     StateName, State, get_timeout(State)};
 handle_sync_event(session_info, _, StateName, 
 		  #state{session = #session{session_id = Id,
 					    cipher_suite = Suite}} = State) ->
@@ -845,7 +839,10 @@ handle_sync_event(session_info, _, StateName,
 handle_sync_event(peer_certificate, _, StateName, 
 		  #state{session = #session{peer_certificate = Cert}} 
 		  = State) ->
-    {reply, {ok, Cert}, StateName, State, get_timeout(State)}.
+    {reply, {ok, Cert}, StateName, State, get_timeout(State)};
+handle_sync_event(connection_information, _, StateName, #state{sni_hostname = SNIHostname, session = #session{cipher_suite = CipherSuite}, negotiated_version = Version} = State) ->
+    {reply, {ok, [{protocol, tls_record:protocol_version(Version)}, {cipher_suite, ssl:suite_definition(CipherSuite)}, {sni_hostname, SNIHostname}]}, StateName, State, get_timeout(State)}.
+
 
 handle_info({ErrorTag, Socket, econnaborted}, StateName,  
 	    #state{socket = Socket, transport_cb = Transport,
diff --git a/lib/ssl/src/ssl_connection.hrl b/lib/ssl/src/ssl_connection.hrl
index e569d706af..d95b51132a 100644
--- a/lib/ssl/src/ssl_connection.hrl
+++ b/lib/ssl/src/ssl_connection.hrl
@@ -80,7 +80,8 @@
 	  expecting_finished =                  false ::boolean(),
           negotiated_protocol = undefined             :: undefined | binary(),
 	  client_ecc,          % {Curves, PointFmt}
-	  tracker              :: pid() %% Tracker process for listen socket
+	  tracker              :: pid(), %% Tracker process for listen socket
+	  sni_hostname = undefined
 	 }).
 
 -define(DEFAULT_DIFFIE_HELLMAN_PARAMS,
diff --git a/lib/ssl/src/ssl_internal.hrl b/lib/ssl/src/ssl_internal.hrl
index 90f8b8a412..baeae68bc4 100644
--- a/lib/ssl/src/ssl_internal.hrl
+++ b/lib/ssl/src/ssl_internal.hrl
@@ -122,6 +122,8 @@
 	  next_protocol_selector = undefined,  %% fun([binary()]) -> binary())
 	  log_alert             :: boolean(),
 	  server_name_indication = undefined,
+	  sni_hosts  :: [{inet:hostname(), [tuple()]}],
+	  sni_fun :: function() | undefined,
 	  %% Should the server prefer its own cipher order over the one provided by
 	  %% the client?
 	  honor_cipher_order = false :: boolean(),
diff --git a/lib/ssl/src/tls_connection.erl b/lib/ssl/src/tls_connection.erl
index 0577222980..3304ffcddb 100644
--- a/lib/ssl/src/tls_connection.erl
+++ b/lib/ssl/src/tls_connection.erl
@@ -398,6 +398,23 @@ initial_state(Role, Host, Port, Socket, {SSLOptions, SocketOptions, Tracker}, Us
 	   tracker = Tracker
 	  }.
 
+
+update_ssl_options_from_sni(OrigSSLOptions, SNIHostname) ->
+    SSLOption = 
+	case OrigSSLOptions#ssl_options.sni_fun of
+	    undefined ->
+		proplists:get_value(SNIHostname, 
+				    OrigSSLOptions#ssl_options.sni_hosts);
+	    SNIFun ->
+		SNIFun(SNIHostname)
+	end,
+    case SSLOption of
+        undefined ->
+            undefined;
+        _ ->
+            ssl:handle_options(SSLOption, OrigSSLOptions)
+    end.
+
 next_state(Current,_, #alert{} = Alert, #state{negotiated_version = Version} = State) ->
     handle_own_alert(Alert, Version, Current, State);
 
@@ -426,15 +443,17 @@ next_state(Current, Next, #ssl_tls{type = ?HANDSHAKE, fragment = Data},
    		%% This message should not be included in handshake
    		%% message hashes. Already in negotiation so it will be ignored!
    		?MODULE:SName(Packet, State);
-	   ({#client_hello{} = Packet, Raw}, {next_state, connection = SName, State}) ->
+	   ({#client_hello{} = Packet, Raw}, {next_state, connection = SName, HState0}) ->
+		HState = handle_sni_extension(Packet, HState0),
 		Version = Packet#client_hello.client_version,
 		Hs0 = ssl_handshake:init_handshake_history(),
 		Hs1 = ssl_handshake:update_handshake_history(Hs0, Raw),
-		?MODULE:SName(Packet, State#state{tls_handshake_history=Hs1,
-   						  renegotiation = {true, peer}});
-	   ({Packet, Raw}, {next_state, SName, State = #state{tls_handshake_history=Hs0}}) ->
+		?MODULE:SName(Packet, HState#state{tls_handshake_history=Hs1,
+						   renegotiation = {true, peer}});
+	   ({Packet, Raw}, {next_state, SName, HState0 = #state{tls_handshake_history=Hs0}}) ->
+		HState = handle_sni_extension(Packet, HState0),
 		Hs1 = ssl_handshake:update_handshake_history(Hs0, Raw),
-		?MODULE:SName(Packet, State#state{tls_handshake_history=Hs1});
+		?MODULE:SName(Packet, HState#state{tls_handshake_history=Hs1});
    	   (_, StopState) -> StopState
    	end,
     try
@@ -981,3 +1000,32 @@ convert_options_partial_chain(Options, up) ->
     list_to_tuple(Head ++ [{partial_chain, fun(_) -> unknown_ca end}] ++ Tail);
 convert_options_partial_chain(Options, down) ->
     list_to_tuple(proplists:delete(partial_chain, tuple_to_list(Options))).
+
+handle_sni_extension(#client_hello{extensions = HelloExtensions}, State0) ->
+    case HelloExtensions#hello_extensions.sni of
+	undefined ->
+	    State0;
+	#sni{hostname = Hostname} ->
+	    NewOptions = update_ssl_options_from_sni(State0#state.ssl_options, Hostname),
+	    case NewOptions of
+		undefined ->
+		    State0;
+		_ ->
+		    {ok, Ref, CertDbHandle, FileRefHandle, CacheHandle, CRLDbHandle, OwnCert, Key, DHParams} = 
+			ssl_config:init(NewOptions, State0#state.role),
+		    State0#state{
+		      session = State0#state.session#session{own_certificate = OwnCert},
+		      file_ref_db = FileRefHandle,
+		      cert_db_ref = Ref,
+		      cert_db = CertDbHandle,
+		      crl_db = CRLDbHandle,
+		      session_cache = CacheHandle,
+		      private_key = Key,
+		      diffie_hellman_params = DHParams,
+		      ssl_options = NewOptions,
+		      sni_hostname = Hostname
+		     }
+	    end
+    end;
+handle_sni_extension(_, State0) ->
+    State0.
diff --git a/lib/ssl/test/Makefile b/lib/ssl/test/Makefile
index 8c45a788a4..886cc7726b 100644
--- a/lib/ssl/test/Makefile
+++ b/lib/ssl/test/Makefile
@@ -53,6 +53,7 @@ MODULES = \
 	ssl_to_openssl_SUITE \
 	ssl_ECC_SUITE \
 	ssl_upgrade_SUITE\
+	ssl_sni_SUITE \
 	make_certs\
 	erl_make_certs
 
diff --git a/lib/ssl/test/make_certs.erl b/lib/ssl/test/make_certs.erl
index 77631f62d3..4a193d48fe 100644
--- a/lib/ssl/test/make_certs.erl
+++ b/lib/ssl/test/make_certs.erl
@@ -81,7 +81,7 @@ all(DataDir, PrivDir, C = #config{}) ->
     create_rnd(DataDir, PrivDir),			% For all requests
     rootCA(PrivDir, "erlangCA", C),
     intermediateCA(PrivDir, "otpCA", "erlangCA", C),
-    endusers(PrivDir, "otpCA", ["client", "server", "revoked"], C),
+    endusers(PrivDir, "otpCA", ["client", "server", "revoked", "a.server", "b.server"], C),
     endusers(PrivDir, "erlangCA", ["localhost"], C),
     %% Create keycert files 
     SDir = filename:join([PrivDir, "server"]),
diff --git a/lib/ssl/test/ssl_basic_SUITE.erl b/lib/ssl/test/ssl_basic_SUITE.erl
index 50d5fb411f..3495b978b7 100644
--- a/lib/ssl/test/ssl_basic_SUITE.erl
+++ b/lib/ssl/test/ssl_basic_SUITE.erl
@@ -3445,7 +3445,7 @@ renegotiate_immediately(Socket) ->
     end,
     ok = ssl:renegotiate(Socket),  
     {error, renegotiation_rejected} = ssl:renegotiate(Socket),
-    ct:sleep(?RENEGOTIATION_DISABLE_TIME +1),
+    ct:sleep(?RENEGOTIATION_DISABLE_TIME + ?SLEEP),
     ok = ssl:renegotiate(Socket),
     ct:log("Renegotiated again"),
     ssl:send(Socket, "Hello world"),
diff --git a/lib/ssl/test/ssl_sni_SUITE.erl b/lib/ssl/test/ssl_sni_SUITE.erl
new file mode 100644
index 0000000000..46cd644e4d
--- /dev/null
+++ b/lib/ssl/test/ssl_sni_SUITE.erl
@@ -0,0 +1,168 @@
+%%
+%% %CopyrightBegin%
+%%
+%% Copyright Ericsson AB 2008-2015. All Rights Reserved.
+%%
+%% The contents of this file are subject to the Erlang Public License,
+%% Version 1.1, (the "License"); you may not use this file except in
+%% compliance with the License. You should have received a copy of the
+%% Erlang Public License along with this software. If not, it can be
+%% retrieved online at http://www.erlang.org/.
+%%
+%% Software distributed under the License is distributed on an "AS IS"
+%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+%% the License for the specific language governing rights and limitations
+%% under the License.
+%%
+%% %CopyrightEnd%
+%%
+
+%%
+
+-module(ssl_sni_SUITE).
+
+-compile(export_all).
+
+-include_lib("common_test/include/ct.hrl").
+-include_lib("public_key/include/public_key.hrl").
+
+%%--------------------------------------------------------------------
+%% Common Test interface functions -----------------------------------
+%%--------------------------------------------------------------------
+suite() -> [{ct_hooks,[ts_install_cth]}].
+
+all() -> [no_sni_header, sni_match, sni_no_match] ++ [no_sni_header_fun, sni_match_fun, sni_no_match_fun].
+
+init_per_suite(Config0) ->
+    catch crypto:stop(),
+    try crypto:start() of
+        ok ->
+            ssl:start(),
+            Result =
+            (catch make_certs:all(?config(data_dir, Config0),
+                                  ?config(priv_dir, Config0))),
+            ct:log("Make certs  ~p~n", [Result]),
+            ssl_test_lib:cert_options(Config0)
+        catch _:_  ->
+            {skip, "Crypto did not start"}
+    end.
+
+end_per_suite(_) ->
+    ssl:stop(),
+    application:stop(crypto).
+
+%%--------------------------------------------------------------------
+%% Test Cases --------------------------------------------------------
+%%--------------------------------------------------------------------
+no_sni_header(Config) ->
+    run_handshake(Config, undefined, undefined, "server").
+
+no_sni_header_fun(Config) ->
+    run_sni_fun_handshake(Config, undefined, undefined, "server").
+
+sni_match(Config) ->
+    run_handshake(Config, "a.server", "a.server", "a.server").
+
+sni_match_fun(Config) ->
+    run_sni_fun_handshake(Config, "a.server", "a.server", "a.server").
+
+sni_no_match(Config) ->
+    run_handshake(Config, "c.server", undefined, "server").
+
+sni_no_match_fun(Config) ->
+    run_sni_fun_handshake(Config, "c.server", undefined, "server").
+
+
+%%--------------------------------------------------------------------
+%% Internal Functions ------------------------------------------------
+%%--------------------------------------------------------------------
+
+
+ssl_recv(SSLSocket, Expect) ->
+    ssl_recv(SSLSocket, "", Expect).
+
+ssl_recv(SSLSocket, CurrentData, ExpectedData) ->
+    receive
+        {ssl, SSLSocket, Data} ->
+            NeweData = CurrentData ++ Data,
+            case NeweData of
+                ExpectedData ->
+                    ok;
+                _  ->
+                    ssl_recv(SSLSocket, NeweData, ExpectedData)
+            end;
+        Other ->
+            ct:fail({unexpected_message, Other})
+        after 4000 ->
+            ct:fail({timeout, CurrentData, ExpectedData})
+    end.
+
+
+
+send_and_hostname(SSLSocket) ->
+    ssl:send(SSLSocket, "OK"),
+    {ok, [{sni_hostname, Hostname}]} = ssl:connection_information(SSLSocket, [sni_hostname]),
+    Hostname.
+
+rdnPart([[#'AttributeTypeAndValue'{type=Type, value=Value} | _] | _], Type) -> Value;
+rdnPart([_ | Tail], Type) -> rdnPart(Tail, Type);
+rdnPart([], _) -> unknown.
+
+rdn_to_string({utf8String, Binary}) ->
+    erlang:binary_to_list(Binary);
+rdn_to_string({printableString, String}) ->
+    String.
+
+recv_and_certificate(SSLSocket) ->
+    ssl_recv(SSLSocket, "OK"),
+    {ok, PeerCert} = ssl:peercert(SSLSocket),
+    #'OTPCertificate'{tbsCertificate = #'OTPTBSCertificate'{subject = {rdnSequence, Subject}}} = public_key:pkix_decode_cert(PeerCert, otp),
+    ct:log("Subject of certificate received from server: ~p", [Subject]),
+    rdn_to_string(rdnPart(Subject, ?'id-at-commonName')).
+
+run_sni_fun_handshake(Config, SNIHostname, ExpectedSNIHostname, ExpectedCN) ->
+    ct:log("Start running handshake for sni_fun, Config: ~p, SNIHostname: ~p, ExpectedSNIHostname: ~p, ExpectedCN: ~p", [Config, SNIHostname, ExpectedSNIHostname, ExpectedCN]),
+    [{sni_hosts, ServerSNIConf}] = ?config(sni_server_opts, Config),
+    SNIFun = fun(Domain) -> proplists:get_value(Domain, ServerSNIConf, undefined) end,
+    ServerOptions = ?config(server_opts, Config) ++ [{sni_fun, SNIFun}],
+    ClientOptions = 
+    case SNIHostname of
+        undefined ->
+            ?config(client_opts, Config);
+        _ ->
+            [{server_name_indication, SNIHostname}] ++ ?config(client_opts, Config)
+    end,
+    ct:log("Options: ~p", [[ServerOptions, ClientOptions]]),
+    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+                                        {from, self()}, {mfa, {?MODULE, send_and_hostname, []}},
+                                        {options, ServerOptions}]),
+    Port = ssl_test_lib:inet_port(Server),
+    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
+                                        {host, Hostname}, {from, self()},
+                                        {mfa, {?MODULE, recv_and_certificate, []}},
+                                        {options, ClientOptions}]),
+    ssl_test_lib:check_result(Server, ExpectedSNIHostname, Client, ExpectedCN).
+
+
+run_handshake(Config, SNIHostname, ExpectedSNIHostname, ExpectedCN) ->
+    ct:log("Start running handshake, Config: ~p, SNIHostname: ~p, ExpectedSNIHostname: ~p, ExpectedCN: ~p", [Config, SNIHostname, ExpectedSNIHostname, ExpectedCN]),
+    ServerOptions = ?config(sni_server_opts, Config) ++ ?config(server_opts, Config),
+    ClientOptions = 
+    case SNIHostname of
+        undefined ->
+            ?config(client_opts, Config);
+        _ ->
+            [{server_name_indication, SNIHostname}] ++ ?config(client_opts, Config)
+    end,
+    ct:log("Options: ~p", [[ServerOptions, ClientOptions]]),
+    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+                                        {from, self()}, {mfa, {?MODULE, send_and_hostname, []}},
+                                        {options, ServerOptions}]),
+    Port = ssl_test_lib:inet_port(Server),
+    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
+                                        {host, Hostname}, {from, self()},
+                                        {mfa, {?MODULE, recv_and_certificate, []}},
+                                        {options, ClientOptions}]),
+    ssl_test_lib:check_result(Server, ExpectedSNIHostname, Client, ExpectedCN).
diff --git a/lib/ssl/test/ssl_test_lib.erl b/lib/ssl/test/ssl_test_lib.erl
index d19e3b7fdb..8b98e6f16b 100644
--- a/lib/ssl/test/ssl_test_lib.erl
+++ b/lib/ssl/test/ssl_test_lib.erl
@@ -354,6 +354,11 @@ cert_options(Config) ->
     BadKeyFile = filename:join([?config(priv_dir, Config), 
 			      "badkey.pem"]),
     PskSharedSecret = <<1,2,3,4,5,6,7,8,9,10,11,12,13,14,15>>,
+
+    SNIServerACertFile = filename:join([?config(priv_dir, Config), "a.server", "cert.pem"]),
+    SNIServerAKeyFile = filename:join([?config(priv_dir, Config), "a.server", "key.pem"]),
+    SNIServerBCertFile = filename:join([?config(priv_dir, Config), "b.server", "cert.pem"]),
+    SNIServerBKeyFile = filename:join([?config(priv_dir, Config), "b.server", "key.pem"]),
     [{client_opts, [{ssl_imp, new},{reuseaddr, true}]}, 
      {client_verification_opts, [{cacertfile, ClientCaCertFile}, 
 				{certfile, ClientCertFile},  
@@ -414,7 +419,17 @@ cert_options(Config) ->
      {server_bad_cert, [{ssl_imp, new},{cacertfile, ServerCaCertFile},
 			{certfile, BadCertFile}, {keyfile, ServerKeyFile}]},
      {server_bad_key, [{ssl_imp, new},{cacertfile, ServerCaCertFile},
-		       {certfile, ServerCertFile}, {keyfile, BadKeyFile}]}
+		       {certfile, ServerCertFile}, {keyfile, BadKeyFile}]},
+     {sni_server_opts, [{sni_hosts, [
+                                     {"a.server", [
+                                                   {certfile, SNIServerACertFile},
+                                                   {keyfile, SNIServerAKeyFile}
+                                                  ]},
+                                     {"b.server", [
+                                                   {certfile, SNIServerBCertFile},
+                                                   {keyfile, SNIServerBKeyFile}
+                                                  ]}
+                                    ]}]}
      | Config].
 
 
diff --git a/lib/ssl/test/ssl_to_openssl_SUITE.erl b/lib/ssl/test/ssl_to_openssl_SUITE.erl
index 94426a3061..0413415e49 100644
--- a/lib/ssl/test/ssl_to_openssl_SUITE.erl
+++ b/lib/ssl/test/ssl_to_openssl_SUITE.erl
@@ -50,9 +50,9 @@ all() ->
 
 groups() ->
     [{basic, [], basic_tests()},
-     {'tlsv1.2', [], all_versions_tests() ++ alpn_tests() ++ npn_tests()},
-     {'tlsv1.1', [], all_versions_tests() ++ alpn_tests() ++ npn_tests()},
-     {'tlsv1', [], all_versions_tests()++ alpn_tests() ++ npn_tests()},
+     {'tlsv1.2', [], all_versions_tests() ++ alpn_tests() ++ npn_tests() ++ sni_server_tests()},
+     {'tlsv1.1', [], all_versions_tests() ++ alpn_tests() ++ npn_tests() ++ sni_server_tests()},
+     {'tlsv1', [], all_versions_tests()++ alpn_tests() ++ npn_tests() ++ sni_server_tests()},
      {'sslv3', [], all_versions_tests()}].
 
 basic_tests() ->
@@ -101,6 +101,14 @@ npn_tests() ->
      erlang_client_openssl_server_npn_only_client,
      erlang_client_openssl_server_npn_only_server].
 
+sni_server_tests() ->
+    [erlang_server_openssl_client_sni_match,
+     erlang_server_openssl_client_sni_match_fun,
+     erlang_server_openssl_client_sni_no_match,
+     erlang_server_openssl_client_sni_no_match_fun,
+     erlang_server_openssl_client_sni_no_header,
+     erlang_server_openssl_client_sni_no_header_fun].
+
 
 init_per_suite(Config0) ->
     Dog = ct:timetrap(?LONG_TIMEOUT *2),
@@ -222,6 +230,15 @@ special_init(TestCase, Config)
 	    check_openssl_npn_support(Config)
     end;
 
+special_init(TestCase, Config)
+  when TestCase == erlang_server_openssl_client_sni_match;
+       TestCase == erlang_server_openssl_client_sni_no_match;
+       TestCase == erlang_server_openssl_client_sni_no_header;
+       TestCase == erlang_server_openssl_client_sni_match_fun;
+       TestCase == erlang_server_openssl_client_sni_no_match_fun;
+       TestCase == erlang_server_openssl_client_sni_no_header_fun ->
+    check_openssl_sni_support(Config);
+
 special_init(_, Config) ->
     Config.
 
@@ -1181,6 +1198,25 @@ erlang_server_openssl_client_npn_only_client(Config) when is_list(Config) ->
         ssl_test_lib:check_result(Server, ok)
     end),
     ok.
+%--------------------------------------------------------------------------
+erlang_server_openssl_client_sni_no_header(Config) when is_list(Config) ->
+    erlang_server_openssl_client_sni_test(Config, undefined, undefined, "server").
+
+erlang_server_openssl_client_sni_no_header_fun(Config) when is_list(Config) ->
+    erlang_server_openssl_client_sni_test_sni_fun(Config, undefined, undefined, "server").
+
+erlang_server_openssl_client_sni_match(Config) when is_list(Config) ->
+    erlang_server_openssl_client_sni_test(Config, "a.server", "a.server", "a.server").
+
+erlang_server_openssl_client_sni_match_fun(Config) when is_list(Config) ->
+    erlang_server_openssl_client_sni_test_sni_fun(Config, "a.server", "a.server", "a.server").
+
+erlang_server_openssl_client_sni_no_match(Config) when is_list(Config) ->
+    erlang_server_openssl_client_sni_test(Config, "c.server", undefined, "server").
+
+erlang_server_openssl_client_sni_no_match_fun(Config) when is_list(Config) ->
+    erlang_server_openssl_client_sni_test_sni_fun(Config, "c.server", undefined, "server").
+
 
 %%--------------------------------------------------------------------
 %% Internal functions ------------------------------------------------
@@ -1207,6 +1243,89 @@ run_suites(Ciphers, Version, Config, Type) ->
 	    ct:fail(cipher_suite_failed_see_test_case_log)
     end.
 
+client_read_check([], _NewData) -> ok;
+client_read_check([Hd | T], NewData) ->
+    case binary:match(NewData, list_to_binary(Hd)) of
+        nomatch ->
+            nomatch;
+        _ ->
+            client_read_check(T, NewData)
+    end.
+client_read_bulk(Port, DataExpected, DataReceived) ->
+    receive
+        {Port, {data, TheData}} ->
+            Data = list_to_binary(TheData),
+            NewData = <<DataReceived/binary, Data/binary>>,
+            ct:log("New Data: ~p", [NewData]),
+            case client_read_check(DataExpected, NewData) of
+                ok ->
+                    ok;
+                _ ->
+                    client_read_bulk(Port, DataExpected, NewData)
+            end;
+        _ ->
+            ct:fail("unexpected_message")
+    after 4000 ->
+              ct:fail("timeout")
+    end.
+client_read_bulk(Port, DataExpected) ->
+    client_read_bulk(Port, DataExpected, <<"">>).
+
+send_and_hostname(SSLSocket) ->
+    ssl:send(SSLSocket, "OK"),
+    {ok, [{sni_hostname, Hostname}]} = ssl:connection_information(SSLSocket, [sni_hostname]),
+    Hostname.
+
+erlang_server_openssl_client_sni_test(Config, SNIHostname, ExpectedSNIHostname, ExpectedCN) ->
+    ct:log("Start running handshake, Config: ~p, SNIHostname: ~p, ExpectedSNIHostname: ~p, ExpectedCN: ~p", [Config, SNIHostname, ExpectedSNIHostname, ExpectedCN]),
+    ServerOptions = ?config(sni_server_opts, Config) ++ ?config(server_opts, Config),
+    {_, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+                                        {from, self()}, {mfa, {?MODULE, send_and_hostname, []}},
+                                        {options, ServerOptions}]),
+    Port = ssl_test_lib:inet_port(Server),
+    ClientCommand = case SNIHostname of
+                        undefined ->
+                            "openssl s_client -connect " ++ Hostname ++ ":" ++ integer_to_list(Port);
+                        _ ->
+                            "openssl s_client -connect " ++ Hostname ++ ":" ++ integer_to_list(Port) ++ " -servername " ++ SNIHostname
+                    end,
+    ct:log("Options: ~p", [[ServerOptions, ClientCommand]]),
+    ClientPort = open_port({spawn, ClientCommand}, [stderr_to_stdout]),
+    ssl_test_lib:check_result(Server, ExpectedSNIHostname),
+    ExpectedClientOutput = ["OK", "/CN=" ++ ExpectedCN ++ "/"],
+    ok = client_read_bulk(ClientPort, ExpectedClientOutput),
+    ssl_test_lib:close_port(ClientPort),
+    ssl_test_lib:close(Server),
+    ok.
+
+
+erlang_server_openssl_client_sni_test_sni_fun(Config, SNIHostname, ExpectedSNIHostname, ExpectedCN) ->
+    ct:log("Start running handshake for sni_fun, Config: ~p, SNIHostname: ~p, ExpectedSNIHostname: ~p, ExpectedCN: ~p", [Config, SNIHostname, ExpectedSNIHostname, ExpectedCN]),
+    [{sni_hosts, ServerSNIConf}] = ?config(sni_server_opts, Config),
+    SNIFun = fun(Domain) -> proplists:get_value(Domain, ServerSNIConf, undefined) end,
+    ServerOptions = ?config(server_opts, Config) ++ [{sni_fun, SNIFun}],
+    {_, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+                                        {from, self()}, {mfa, {?MODULE, send_and_hostname, []}},
+                                        {options, ServerOptions}]),
+    Port = ssl_test_lib:inet_port(Server),
+    ClientCommand = case SNIHostname of
+                        undefined ->
+                            "openssl s_client -connect " ++ Hostname ++ ":" ++ integer_to_list(Port);
+                        _ ->
+                            "openssl s_client -connect " ++ Hostname ++ ":" ++ integer_to_list(Port) ++ " -servername " ++ SNIHostname
+                    end,
+    ct:log("Options: ~p", [[ServerOptions, ClientCommand]]),
+    ClientPort = open_port({spawn, ClientCommand}, [stderr_to_stdout]),
+    ssl_test_lib:check_result(Server, ExpectedSNIHostname),
+    ExpectedClientOutput = ["OK", "/CN=" ++ ExpectedCN ++ "/"],
+    ok = client_read_bulk(ClientPort, ExpectedClientOutput),
+    ssl_test_lib:close_port(ClientPort),
+    ssl_test_lib:close(Server),
+    ok.
+
+
 cipher(CipherSuite, Version, Config, ClientOpts, ServerOpts) ->
     process_flag(trap_exit, true),
     ct:log("Testing CipherSuite ~p~n", [CipherSuite]),
@@ -1588,6 +1707,14 @@ server_sent_garbage(Socket) ->
 	    
     end.
     
+check_openssl_sni_support(Config) ->
+    HelpText = os:cmd("openssl s_client --help"),
+    case string:str(HelpText, "-servername") of
+        0 ->
+            {skip, "Current openssl doesn't support SNI"};
+        _ ->
+            Config
+    end.
 
 check_openssl_npn_support(Config) ->
     HelpText = os:cmd("openssl s_client --help"),