Merge tag 'OTP-17.5.6' into maint

=== OTP-17.5.6 ===

Changed Applications:
- inets-5.10.9
- ssh-3.2.4
- ssl-6.0.1

Unchanged Applications:
- asn1-3.0.4
- common_test-1.10.1
- compiler-5.0.4
- cosEvent-2.1.15
- cosEventDomain-1.1.14
- cosFileTransfer-1.1.16
- cosNotification-1.1.21
- cosProperty-1.1.17
- cosTime-1.1.14
- cosTransactions-1.2.14
- crypto-3.5
- debugger-4.0.3
- dialyzer-2.7.4
- diameter-1.9.2
- edoc-0.7.16
- eldap-1.1.1
- erl_docgen-0.3.7
- erl_interface-3.7.20
- erts-6.4.1
- et-1.5
- eunit-2.2.9
- gs-1.5.16
- hipe-3.11.3
- ic-4.3.6
- jinterface-1.5.12
- kernel-3.2
- megaco-3.17.3
- mnesia-4.12.5
- observer-2.0.4
- odbc-2.10.22
- orber-3.7.1
- os_mon-2.3.1
- ose-1.0.2
- otp_mibs-1.0.10
- parsetools-2.0.12
- percept-0.8.10
- public_key-0.23
- reltool-0.6.6
- runtime_tools-1.8.16
- sasl-2.4.1
- snmp-5.1.2
- stdlib-2.4
- syntax_tools-1.6.18
- test_server-3.8.1
- tools-2.7.2
- typer-0.9.8
- webtool-0.8.10
- wx-1.3.3
- xmerl-1.3.7

24 files changed, 556 insertions, 181 deletions

diff --git a/lib/inets/doc/src/Makefile b/lib/inets/doc/src/Makefile
index 1a8e1c7ca8..961bfa838d 100644
--- a/lib/inets/doc/src/Makefile
+++ b/lib/inets/doc/src/Makefile
@@ -1,7 +1,7 @@
 #
 # %CopyrightBegin%
 #
-# Copyright Ericsson AB 1997-2012. All Rights Reserved.
+# Copyright Ericsson AB 1997-2015. All Rights Reserved.
 #
 # The contents of this file are subject to the Erlang Public License,
 # Version 1.1, (the "License"); you may not use this file except in
@@ -52,6 +52,7 @@ XML_REF3_FILES = \
 	httpc.xml\
 	httpd.xml \
 	httpd_conf.xml \
+	httpd_custom_api.xml \
 	httpd_socket.xml \
 	httpd_util.xml \
 	mod_alias.xml \
diff --git a/lib/inets/doc/src/httpd.xml b/lib/inets/doc/src/httpd.xml
index e40660ab39..435f99ee23 100644
--- a/lib/inets/doc/src/httpd.xml
+++ b/lib/inets/doc/src/httpd.xml
@@ -204,7 +204,15 @@
     
     <marker id="props_limit"></marker>
     <p><em>Limit properties</em> </p>
-    <taglist>  
+    <taglist>
+
+      <marker id="prop_customize"></marker>
+      <tag>{customize, atom()}</tag>
+      <item> 
+	<p>A callback module to customize the inets HTTP servers behaviour
+	see <seealso marker="http_custom_api"> httpd_custom_api</seealso> </p>
+      </item>
+      
       <marker id="prop_disable_chunked_encoding"></marker>
       <tag>{disable_chunked_transfer_encoding_send, boolean()}</tag>
       <item> 
diff --git a/lib/inets/doc/src/httpd_custom_api.xml b/lib/inets/doc/src/httpd_custom_api.xml
new file mode 100644
index 0000000000..faf1d277df
--- /dev/null
+++ b/lib/inets/doc/src/httpd_custom_api.xml
@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<!DOCTYPE erlref SYSTEM "erlref.dtd">
+
+<erlref>
+  <header>
+    <copyright>
+      <year>2015</year><year>2015</year>
+      <holder>Ericsson AB. All Rights Reserved.</holder>
+    </copyright>
+    <legalnotice>
+      The contents of this file are subject to the Erlang Public License,
+      Version 1.1, (the "License"); you may not use this file except in
+      compliance with the License. You should have received a copy of the
+      Erlang Public License along with this software. If not, it can be
+      retrieved online at http://www.erlang.org/.
+    
+      Software distributed under the License is distributed on an "AS IS"
+      basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+      the License for the specific language governing rights and limitations
+      under the License.
+    
+    </legalnotice>
+
+    <title>httpd_custom_api</title>
+    <file>httpd_custom_api.xml</file>
+  </header>
+  <module>httpd_custom_api</module>
+  <modulesummary>Behaviour with optional callbacks to customize the inets HTTP server.</modulesummary>
+  <description>
+    <p> The module implementing this behaviour shall be supplied to to the servers
+    configuration with the option <seealso marker="httpd:prop_customize"> customize</seealso></p>
+    
+  </description>  
+  <funcs>
+    <func>
+      <name>response_header({HeaderName, HeaderValue}) ->  {true, Header} | false </name>
+      <fsummary>Filter and possible alter HTTP response headers.</fsummary>
+      <type>
+        <v>Header = {HeaderName :: string(), HeaderValue::string()}</v>
+	<d>The header name will be in lower case and should not be altered.</d>
+      </type>
+      <desc>
+        <p> Filter and possible alter HTTP response headers before they are sent to the client.
+	</p>
+      </desc>
+    </func>
+   
+    <func>
+      <name>request_header({HeaderName, HeaderValue}) ->   {true, Header} | false </name>
+      <fsummary>Filter and possible alter HTTP request headers.</fsummary>
+      <type>
+	<v>Header = {HeaderName :: string(), HeaderValue::string()}</v>
+	<d>The header name will be in lower case and should not be altered.</d>
+	</type>
+	<desc>
+	  <p> Filter and possible alter HTTP request headers before they are processed by the server.
+	  </p>
+	</desc>
+    </func>
+  </funcs>
+</erlref>
+
+
diff --git a/lib/inets/doc/src/notes.xml b/lib/inets/doc/src/notes.xml
index bae8e327a3..f563a8c4b0 100644
--- a/lib/inets/doc/src/notes.xml
+++ b/lib/inets/doc/src/notes.xml
@@ -32,7 +32,23 @@
     <file>notes.xml</file>
   </header>
   
-  <section><title>Inets 5.10.8</title>
+  <section><title>Inets 5.10.9</title>
+
+    <section><title>Improvements and New Features</title>
+      <list>
+        <item>
+          <p>
+	    Add behaviour with optional callbacks to customize the
+	    inets HTTP server.</p>
+          <p>
+	    Own Id: OTP-12776</p>
+        </item>
+      </list>
+    </section>
+
+</section>
+
+<section><title>Inets 5.10.8</title>
 
     <section><title>Fixed Bugs and Malfunctions</title>
       <list>
diff --git a/lib/inets/doc/src/ref_man.xml b/lib/inets/doc/src/ref_man.xml
index aaedf330b4..3afb020431 100644
--- a/lib/inets/doc/src/ref_man.xml
+++ b/lib/inets/doc/src/ref_man.xml
@@ -4,7 +4,7 @@
 <application xmlns:xi="http://www.w3.org/2001/XInclude">
   <header>
     <copyright>
-      <year>1997</year><year>2013</year>
+      <year>1997</year><year>2015</year>
       <holder>Ericsson AB. All Rights Reserved.</holder>
     </copyright>
     <legalnotice>
@@ -39,6 +39,7 @@
   <xi:include href="httpc.xml"/>
   <xi:include href="httpd.xml"/>
   <xi:include href="httpd_conf.xml"/>
+  <xi:include href="httpd_custom_api.xml"/>
   <xi:include href="httpd_socket.xml"/>
   <xi:include href="httpd_util.xml"/>
   <xi:include href="mod_alias.xml"/>
diff --git a/lib/inets/src/http_server/Makefile b/lib/inets/src/http_server/Makefile
index 2660d04d16..636d580e28 100644
--- a/lib/inets/src/http_server/Makefile
+++ b/lib/inets/src/http_server/Makefile
@@ -1,7 +1,7 @@
 #
 # %CopyrightBegin%
 #
-# Copyright Ericsson AB 2005-2013. All Rights Reserved.
+# Copyright Ericsson AB 2005-2015. All Rights Reserved.
 #
 # The contents of this file are subject to the Erlang Public License,
 # Version 1.1, (the "License"); you may not use this file except in
@@ -46,6 +46,7 @@ MODULES = \
 	httpd_connection_sup\
 	httpd_cgi \
 	httpd_conf \
+	httpd_custom \
 	httpd_example \
 	httpd_esi \
 	httpd_file\
diff --git a/lib/inets/src/http_server/httpd_custom.erl b/lib/inets/src/http_server/httpd_custom.erl
new file mode 100644
index 0000000000..342469a579
--- /dev/null
+++ b/lib/inets/src/http_server/httpd_custom.erl
@@ -0,0 +1,69 @@
+%%
+%% %CopyrightBegin%
+%% 
+%% Copyright Ericsson AB 2015-2015. All Rights Reserved.
+%% 
+%% The contents of this file are subject to the Erlang Public License,
+%% Version 1.1, (the "License"); you may not use this file except in
+%% compliance with the License. You should have received a copy of the
+%% Erlang Public License along with this software. If not, it can be
+%% retrieved online at http://www.erlang.org/.
+%% 
+%% Software distributed under the License is distributed on an "AS IS"
+%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+%% the License for the specific language governing rights and limitations
+%% under the License.
+%% 
+%% %CopyrightEnd%
+%%
+%%
+-module(httpd_custom).
+
+-export([response_header/1, request_header/1]).
+-export([customize_headers/3]).
+
+-include_lib("inets/src/inets_app/inets_internal.hrl").
+
+response_header(Header) -> 
+    {true, httpify(Header)}.
+request_header(Header) -> 
+    {true, Header}.
+
+customize_headers(?MODULE, Function, Arg) ->
+    ?MODULE:Function(Arg);
+customize_headers(Module, Function, Arg) ->
+    try Module:Function(Arg) of
+	{true, Value} ->
+	    ?MODULE:Function(Value);
+	false ->
+	    false
+    catch
+	_:_ ->
+	    ?MODULE:Function(Arg)
+    end.
+
+httpify({Key0, Value}) ->
+    %% make sure first letter is capital (defacto standard)
+    Words1 = string:tokens(Key0, "-"),
+    Words2 = upify(Words1, []),
+    Key    = new_key(Words2),
+    Key ++ ": " ++ Value ++ ?CRLF .
+
+new_key([]) ->
+    "";
+new_key([W]) ->
+    W;
+new_key([W1,W2]) ->
+    W1 ++ "-" ++ W2;
+new_key([W|R]) ->
+    W ++ "-" ++ new_key(R).
+    
+upify([], Acc) ->
+    lists:reverse(Acc);
+upify([Key|Rest], Acc) ->
+    upify(Rest, [upify2(Key)|Acc]).
+
+upify2([C|Rest]) when (C >= $a) andalso (C =< $z) ->
+    [C-($a-$A)|Rest];
+upify2(Str) ->
+    Str.
diff --git a/lib/inets/src/http_server/httpd_request.erl b/lib/inets/src/http_server/httpd_request.erl
index 3ff07616f9..782120c284 100644
--- a/lib/inets/src/http_server/httpd_request.erl
+++ b/lib/inets/src/http_server/httpd_request.erl
@@ -42,28 +42,28 @@
 %%%=========================================================================
 %%%  Internal application API
 %%%=========================================================================
-parse([Bin, MaxSizes]) ->
-    ?hdrt("parse", [{bin, Bin}, {max_sizes, MaxSizes}]),    
-    parse_method(Bin, [], 0, proplists:get_value(max_method, MaxSizes), MaxSizes, []);
+parse([Bin, Options]) ->
+    ?hdrt("parse", [{bin, Bin}, {max_sizes, Options}]),    
+    parse_method(Bin, [], 0, proplists:get_value(max_method, Options), Options, []);
 parse(Unknown) ->
     ?hdrt("parse", [{unknown, Unknown}]),
     exit({bad_args, Unknown}).
 
 %% Functions that may be returned during the decoding process
 %% if the input data is incompleate. 
-parse_method([Bin, Method, Current, Max, MaxSizes, Result]) ->
-    parse_method(Bin, Method, Current, Max, MaxSizes, Result).
+parse_method([Bin, Method, Current, Max, Options, Result]) ->
+    parse_method(Bin, Method, Current, Max, Options, Result).
 
-parse_uri([Bin, URI, Current, Max, MaxSizes, Result]) ->
-    parse_uri(Bin, URI, Current, Max, MaxSizes, Result).
+parse_uri([Bin, URI, Current, Max, Options, Result]) ->
+    parse_uri(Bin, URI, Current, Max, Options, Result).
 
-parse_version([Bin, Rest, Version, Current, Max, MaxSizes, Result]) ->
-    parse_version(<<Rest/binary, Bin/binary>>, Version, Current, Max, MaxSizes, 
+parse_version([Bin, Rest, Version, Current, Max, Options, Result]) ->
+    parse_version(<<Rest/binary, Bin/binary>>, Version, Current, Max, Options, 
 		  Result).
 
-parse_headers([Bin, Rest, Header, Headers, Current, Max, MaxSizes, Result]) ->
+parse_headers([Bin, Rest, Header, Headers, Current, Max, Options, Result]) ->
     parse_headers(<<Rest/binary, Bin/binary>>, 
-		  Header, Headers, Current, Max, MaxSizes, Result).
+		  Header, Headers, Current, Max, Options, Result).
 
 whole_body([Bin, Body, Length])  ->
     whole_body(<<Body/binary, Bin/binary>>, Length).    
@@ -134,13 +134,13 @@ update_mod_data(ModData, Method, RequestURI, HTTPVersion, Headers)->
 %%%========================================================================
 %%% Internal functions
 %%%========================================================================
-parse_method(<<>>, Method, Current, Max, MaxSizes, Result) ->
-    {?MODULE, parse_method, [Method, Current, Max, MaxSizes, Result]};
-parse_method(<<?SP, Rest/binary>>, Method, _Current, _Max, MaxSizes, Result) ->
-    parse_uri(Rest, [], 0,  proplists:get_value(max_uri, MaxSizes), MaxSizes,
+parse_method(<<>>, Method, Current, Max, Options, Result) ->
+    {?MODULE, parse_method, [Method, Current, Max, Options, Result]};
+parse_method(<<?SP, Rest/binary>>, Method, _Current, _Max, Options, Result) ->
+    parse_uri(Rest, [], 0,  proplists:get_value(max_uri, Options), Options,
 	      [string:strip(lists:reverse(Method)) | Result]);
-parse_method(<<Octet, Rest/binary>>, Method, Current, Max, MaxSizes, Result) when Current =< Max ->
-    parse_method(Rest, [Octet | Method], Current + 1, Max, MaxSizes, Result);
+parse_method(<<Octet, Rest/binary>>, Method, Current, Max, Options, Result) when Current =< Max ->
+    parse_method(Rest, [Octet | Method], Current + 1, Max, Options, Result);
 parse_method(_, _, _, Max, _, _) ->
     %% We do not know the version of the client as it comes after the
     %% method send the lowest version in the response so that the client
@@ -153,30 +153,30 @@ parse_uri(_, _, Current, MaxURI, _, _)
     %% uri send the lowest version in the response so that the client
     %% will be able to handle it.
     {error, {size_error, MaxURI, 414, "URI unreasonably long"},lowest_version()};
-parse_uri(<<>>, URI, Current, Max, MaxSizes, Result) ->
-    {?MODULE, parse_uri, [URI, Current, Max, MaxSizes, Result]};
-parse_uri(<<?SP, Rest/binary>>, URI, _, _, MaxSizes, Result) -> 
-    parse_version(Rest, [], 0, proplists:get_value(max_version, MaxSizes), MaxSizes, 
+parse_uri(<<>>, URI, Current, Max, Options, Result) ->
+    {?MODULE, parse_uri, [URI, Current, Max, Options, Result]};
+parse_uri(<<?SP, Rest/binary>>, URI, _, _, Options, Result) -> 
+    parse_version(Rest, [], 0, proplists:get_value(max_version, Options), Options, 
 		  [string:strip(lists:reverse(URI)) | Result]);
 %% Can happen if it is a simple HTTP/0.9 request e.i "GET /\r\n\r\n"
-parse_uri(<<?CR, _Rest/binary>> = Data, URI, _, _, MaxSizes, Result) ->
-    parse_version(Data, [], 0, proplists:get_value(max_version, MaxSizes), MaxSizes, 
+parse_uri(<<?CR, _Rest/binary>> = Data, URI, _, _, Options, Result) ->
+    parse_version(Data, [], 0, proplists:get_value(max_version, Options), Options, 
 		  [string:strip(lists:reverse(URI)) | Result]);
-parse_uri(<<Octet, Rest/binary>>, URI, Current, Max, MaxSizes, Result) ->
-    parse_uri(Rest, [Octet | URI], Current + 1, Max, MaxSizes, Result).
+parse_uri(<<Octet, Rest/binary>>, URI, Current, Max, Options, Result) ->
+    parse_uri(Rest, [Octet | URI], Current + 1, Max, Options, Result).
 
-parse_version(<<>>, Version, Current, Max, MaxSizes, Result) ->
-    {?MODULE, parse_version, [<<>>, Version, Current, Max, MaxSizes, Result]};
-parse_version(<<?LF, Rest/binary>>, Version, Current, Max, MaxSizes, Result) ->
+parse_version(<<>>, Version, Current, Max, Options, Result) ->
+    {?MODULE, parse_version, [<<>>, Version, Current, Max, Options, Result]};
+parse_version(<<?LF, Rest/binary>>, Version, Current, Max, Options, Result) ->
     %% If ?CR is is missing RFC2616 section-19.3 
-    parse_version(<<?CR, ?LF, Rest/binary>>, Version, Current, Max, MaxSizes, Result);
-parse_version(<<?CR, ?LF, Rest/binary>>, Version, _, _,  MaxSizes, Result) ->
-    parse_headers(Rest, [], [], 0, proplists:get_value(max_header, MaxSizes), MaxSizes, 
+    parse_version(<<?CR, ?LF, Rest/binary>>, Version, Current, Max, Options, Result);
+parse_version(<<?CR, ?LF, Rest/binary>>, Version, _, _,  Options, Result) ->
+    parse_headers(Rest, [], [], 0, proplists:get_value(max_header, Options), Options, 
 		  [string:strip(lists:reverse(Version)) | Result]);
-parse_version(<<?CR>> = Data, Version, Current, Max, MaxSizes, Result) ->
-    {?MODULE, parse_version, [Data, Version, Current, Max, MaxSizes, Result]};
-parse_version(<<Octet, Rest/binary>>, Version, Current, Max, MaxSizes, Result)  when Current =< Max ->
-    parse_version(Rest, [Octet | Version], Current + 1, Max, MaxSizes, Result);
+parse_version(<<?CR>> = Data, Version, Current, Max, Options, Result) ->
+    {?MODULE, parse_version, [Data, Version, Current, Max, Options, Result]};
+parse_version(<<Octet, Rest/binary>>, Version, Current, Max, Options, Result)  when Current =< Max ->
+    parse_version(Rest, [Octet | Version], Current + 1, Max, Options, Result);
 parse_version(_, _, _, Max,_,_) ->
     {error, {size_error, Max, 413, "Version string unreasonably long"}, lowest_version()}.
 
@@ -185,34 +185,42 @@ parse_headers(_, _, _, Current, Max, _, Result)
     HttpVersion = lists:nth(3, lists:reverse(Result)),
     {error, {size_error, Max, 413, "Headers unreasonably long"}, HttpVersion};
 
-parse_headers(<<>>, Header, Headers, Current, Max, MaxSizes, Result) ->
+parse_headers(<<>>, Header, Headers, Current, Max, Options, Result) ->
     {?MODULE, parse_headers, [<<>>, Header, Headers, Current, Max, 
-			      MaxSizes, Result]};
-parse_headers(<<?CR,?LF,?LF,Body/binary>>, [], [], Current, Max, MaxSizes, Result) ->
+			      Options, Result]};
+parse_headers(<<?CR,?LF,?LF,Body/binary>>, [], [], Current, Max, Options, Result) ->
     %% If ?CR is is missing RFC2616 section-19.3 
     parse_headers(<<?CR,?LF,?CR,?LF,Body/binary>>, [], [], Current, Max,  
-		  MaxSizes, Result);
+		  Options, Result);
 
-parse_headers(<<?LF,?LF,Body/binary>>, [], [], Current, Max,  MaxSizes, Result) ->
+parse_headers(<<?LF,?LF,Body/binary>>, [], [], Current, Max,  Options, Result) ->
     %% If ?CR is is missing RFC2616 section-19.3 
     parse_headers(<<?CR,?LF,?CR,?LF,Body/binary>>, [], [], Current, Max, 
-		  MaxSizes, Result);
+		  Options, Result);
 
 parse_headers(<<?CR,?LF,?CR,?LF,Body/binary>>, [], [], _, _,  _, Result) ->
     NewResult = list_to_tuple(lists:reverse([Body, {#http_request_h{}, []} |
 					     Result])),
     {ok, NewResult};
 parse_headers(<<?CR,?LF,?CR,?LF,Body/binary>>, Header, Headers, _, _,
-	      MaxSizes, Result) ->
+	      Options, Result) ->
+    Customize = proplists:get_value(customize, Options),
     case http_request:key_value(lists:reverse(Header)) of
 	undefined -> %% Skip headers with missing :
-	    {ok, list_to_tuple(lists:reverse([Body, {http_request:headers(Headers, #http_request_h{}), Headers} | Result]))};
+	    FinalHeaders = lists:filtermap(fun(H) ->
+						   httpd_custom:customize_headers(Customize, request_header, H)
+					   end,
+					   Headers),
+	    {ok, list_to_tuple(lists:reverse([Body, {http_request:headers(FinalHeaders, #http_request_h{}), FinalHeaders} | Result]))};
 	NewHeader ->
-	    case check_header(NewHeader, MaxSizes) of 
+	    case check_header(NewHeader, Options) of 
 		ok ->
-		    {ok, list_to_tuple(lists:reverse([Body, {http_request:headers([NewHeader | Headers], 
+		    FinalHeaders = lists:filtermap(fun(H) ->
+							   httpd_custom:customize_headers(Customize, request_header, H)
+						   end, [NewHeader | Headers]),
+		    {ok, list_to_tuple(lists:reverse([Body, {http_request:headers(FinalHeaders, 
 										  #http_request_h{}),  
-							     [NewHeader | Headers]} | Result]))};
+							     FinalHeaders} | Result]))};
 		
 		{error, Reason} ->
 		    HttpVersion = lists:nth(3, lists:reverse(Result)),
@@ -221,12 +229,12 @@ parse_headers(<<?CR,?LF,?CR,?LF,Body/binary>>, Header, Headers, _, _,
     end;
 
 parse_headers(<<?CR,?LF,?CR>> = Data, Header, Headers, Current, Max, 
-	      MaxSizes, Result) ->
+	      Options, Result) ->
     {?MODULE, parse_headers, [Data, Header, Headers, Current, Max, 
-			      MaxSizes, Result]};
-parse_headers(<<?LF>>, [], [], Current, Max, MaxSizes, Result) ->
+			      Options, Result]};
+parse_headers(<<?LF>>, [], [], Current, Max, Options, Result) ->
     %% If ?CR is is missing RFC2616 section-19.3 
-    parse_headers(<<?CR,?LF>>, [], [], Current, Max, MaxSizes, Result);
+    parse_headers(<<?CR,?LF>>, [], [], Current, Max, Options, Result);
 
 %% There where no headers, which is unlikely to happen.
 parse_headers(<<?CR,?LF>>, [], [], _, _, _, Result) ->
@@ -235,30 +243,30 @@ parse_headers(<<?CR,?LF>>, [], [], _, _, _, Result) ->
     {ok, NewResult};
 
 parse_headers(<<?LF>>, Header, Headers, Current, Max,  
-	      MaxSizes, Result) ->
+	      Options, Result) ->
     %% If ?CR is is missing RFC2616 section-19.3 
-    parse_headers(<<?CR,?LF>>, Header, Headers, Current, Max, MaxSizes, Result);
+    parse_headers(<<?CR,?LF>>, Header, Headers, Current, Max, Options, Result);
 
 parse_headers(<<?CR,?LF>> = Data, Header, Headers, Current, Max, 
-	      MaxSizes, Result) ->
+	      Options, Result) ->
     {?MODULE, parse_headers, [Data, Header, Headers, Current, Max, 
-			      MaxSizes, Result]};
+			      Options, Result]};
 parse_headers(<<?LF, Octet, Rest/binary>>, Header, Headers, Current, Max,
-	      MaxSizes, Result) ->
+	      Options, Result) ->
     %% If ?CR is is missing RFC2616 section-19.3 
     parse_headers(<<?CR,?LF, Octet, Rest/binary>>, Header, Headers, Current, Max,
-		  MaxSizes, Result); 
+		  Options, Result); 
 parse_headers(<<?CR,?LF, Octet, Rest/binary>>, Header, Headers, _, Max,
-	      MaxSizes, Result) ->
+	      Options, Result) ->
     case http_request:key_value(lists:reverse(Header)) of
 	undefined -> %% Skip headers with missing :
 	    parse_headers(Rest, [Octet], Headers, 
-			  0, Max, MaxSizes, Result);
+			  0, Max, Options, Result);
 	NewHeader ->
-	    case check_header(NewHeader, MaxSizes) of 
+	    case check_header(NewHeader, Options) of 
 		ok ->
 		    parse_headers(Rest, [Octet], [NewHeader | Headers], 
-				  0, Max, MaxSizes, Result);
+				  0, Max, Options, Result);
 		{error, Reason} ->
 		    HttpVersion = lists:nth(3, lists:reverse(Result)),
 		    {error, Reason, HttpVersion}
@@ -266,19 +274,19 @@ parse_headers(<<?CR,?LF, Octet, Rest/binary>>, Header, Headers, _, Max,
     end;
 	
 parse_headers(<<?CR>> = Data, Header, Headers, Current, Max,  
-	      MaxSizes, Result) ->
+	      Options, Result) ->
     {?MODULE, parse_headers, [Data, Header, Headers, Current, Max, 
-			      MaxSizes, Result]};
+			      Options, Result]};
 parse_headers(<<?LF>>, Header, Headers, Current,  Max, 
-	      MaxSizes, Result) ->
+	      Options, Result) ->
     %% If ?CR is is missing RFC2616 section-19.3 
     parse_headers(<<?CR, ?LF>>, Header, Headers, Current, Max,  
-		  MaxSizes, Result);
+		  Options, Result);
 
 parse_headers(<<Octet, Rest/binary>>, Header, Headers, Current,
-	      Max, MaxSizes, Result) ->
+	      Max, Options, Result) ->
     parse_headers(Rest, [Octet | Header], Headers, Current + 1, Max,
-		  MaxSizes, Result).
+		  Options, Result).
 
 whole_body(Body, Length) ->
     case size(Body) of
diff --git a/lib/inets/src/http_server/httpd_request_handler.erl b/lib/inets/src/http_server/httpd_request_handler.erl
index f7a9fe5d49..9947e17b47 100644
--- a/lib/inets/src/http_server/httpd_request_handler.erl
+++ b/lib/inets/src/http_server/httpd_request_handler.erl
@@ -121,13 +121,15 @@ continue_init(Manager, ConfigDB, SocketType, Socket, TimeOut) ->
     MaxURISize    = max_uri_size(ConfigDB), 
     NrOfRequest   = max_keep_alive_request(ConfigDB), 
     MaxContentLen = max_content_length(ConfigDB),
+    Customize = customize(ConfigDB),
 
     {_, Status} = httpd_manager:new_connection(Manager),
     
     MFA = {httpd_request, parse, [[{max_uri, MaxURISize}, {max_header, MaxHeaderSize},
 				   {max_version, ?HTTP_MAX_VERSION_STRING}, 
 				   {max_method, ?HTTP_MAX_METHOD_STRING},
-				   {max_content_length, MaxContentLen}
+				   {max_content_length, MaxContentLen},
+				   {customize, Customize}
 				  ]]}, 
 
     State = #state{mod                    = Mod, 
@@ -550,11 +552,13 @@ handle_next_request(#state{mod = #mod{connection = true} = ModData,
     MaxHeaderSize = max_header_size(ModData#mod.config_db), 
     MaxURISize    = max_uri_size(ModData#mod.config_db), 
     MaxContentLen = max_content_length(ModData#mod.config_db),
+    Customize = customize(ModData#mod.config_db),
 
     MFA = {httpd_request, parse, [[{max_uri, MaxURISize}, {max_header, MaxHeaderSize},
 				   {max_version, ?HTTP_MAX_VERSION_STRING}, 
 				   {max_method, ?HTTP_MAX_METHOD_STRING},
-				   {max_content_length, MaxContentLen}
+				   {max_content_length, MaxContentLen},
+				   {customize, Customize}
 				  ]]}, 
     TmpState = State#state{mod                    = NewModData,
 			   mfa                    = MFA,
@@ -640,3 +644,6 @@ max_keep_alive_request(ConfigDB) ->
 
 max_content_length(ConfigDB) ->    
     httpd_util:lookup(ConfigDB, max_content_length, ?HTTP_MAX_CONTENT_LENGTH).
+
+customize(ConfigDB) ->    
+    httpd_util:lookup(ConfigDB, customize, httpd_custom).
diff --git a/lib/inets/src/http_server/httpd_response.erl b/lib/inets/src/http_server/httpd_response.erl
index 2fa91d47a0..71dc05e46d 100644
--- a/lib/inets/src/http_server/httpd_response.erl
+++ b/lib/inets/src/http_server/httpd_response.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %% 
-%% Copyright Ericsson AB 1997-2013. All Rights Reserved.
+%% Copyright Ericsson AB 1997-2015. All Rights Reserved.
 %% 
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -176,7 +176,7 @@ send_header(#mod{socket_type  = Type,
     StatusLine = [NewVer, " ", io_lib:write(NewStatusCode), " ",
 		  httpd_util:reason_phrase(NewStatusCode), ?CRLF],
     ConnectionHeader = get_connection(Conn, NewVer),
-    Head = list_to_binary([StatusLine, Headers, ConnectionHeader , ?CRLF]),
+    Head = [StatusLine, Headers, ConnectionHeader , ?CRLF],
     httpd_socket:deliver(Type, Sock, Head).
 
 map_status_code("HTTP/1.0", Code) 
@@ -286,45 +286,21 @@ create_header(ConfigDb, KeyValueTupleHeaders) ->
     Date        = httpd_util:rfc1123_date(), 
     ContentType = "text/html", 
     Server      = server(ConfigDb),
-    NewHeaders  = add_default_headers([{"date",         Date},
-				       {"content-type", ContentType}
-				       | if Server=="" -> [];
-					    true -> [{"server",       Server}]
-					 end
-				      ], 
-				       KeyValueTupleHeaders),
-    lists:map(fun fix_header/1, NewHeaders).
-
-
+    Headers0  = add_default_headers([{"date",         Date},
+				     {"content-type", ContentType}
+				     | if Server=="" -> [];
+					  true -> [{"server",       Server}]
+				       end
+				    ], 
+				    KeyValueTupleHeaders),
+    CustomizeCB = httpd_util:lookup(ConfigDb, customize, httpd_custom),
+    lists:filtermap(fun(H) ->
+			    httpd_custom:customize_headers(CustomizeCB, response_header, H)
+		    end,
+		    [Header || Header <- Headers0]).
 server(ConfigDb) ->
     httpd_util:lookup(ConfigDb, server, ?SERVER_SOFTWARE).
 
-fix_header({Key0, Value}) ->
-    %% make sure first letter is capital
-    Words1 = string:tokens(Key0, "-"),
-    Words2 = upify(Words1, []),
-    Key    = new_key(Words2),
-    Key ++ ": " ++ Value ++ ?CRLF .
-
-new_key([]) ->
-    "";
-new_key([W]) ->
-    W;
-new_key([W1,W2]) ->
-    W1 ++ "-" ++ W2;
-new_key([W|R]) ->
-    W ++ "-" ++ new_key(R).
-    
-upify([], Acc) ->
-    lists:reverse(Acc);
-upify([Key|Rest], Acc) ->
-    upify(Rest, [upify2(Key)|Acc]).
-
-upify2([C|Rest]) when (C >= $a) andalso (C =< $z) ->
-    [C-($a-$A)|Rest];
-upify2(Str) ->
-    Str.
-
 add_default_headers([], Headers) ->
     Headers;
 
diff --git a/lib/inets/src/inets_app/inets.app.src b/lib/inets/src/inets_app/inets.app.src
index 9eae962d03..48660bec62 100644
--- a/lib/inets/src/inets_app/inets.app.src
+++ b/lib/inets/src/inets_app/inets.app.src
@@ -1,7 +1,7 @@
 %% This is an -*- erlang -*- file.
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 1997-2014. All Rights Reserved.
+%% Copyright Ericsson AB 1997-2015. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -61,6 +61,7 @@
 	    httpd_cgi,
 	    httpd_connection_sup,
             httpd_conf,
+	    httpd_custom,
 	    httpd_esi,
             httpd_example,
 	    httpd_file,
diff --git a/lib/inets/test/httpc_SUITE.erl b/lib/inets/test/httpc_SUITE.erl
index 21be7862cb..4b1c6931d2 100644
--- a/lib/inets/test/httpc_SUITE.erl
+++ b/lib/inets/test/httpc_SUITE.erl
@@ -1260,7 +1260,9 @@ dummy_server_init(Caller, ip_comm, Inet, _) ->
 						      {max_header, ?HTTP_MAX_HEADER_SIZE},
 						      {max_version,?HTTP_MAX_VERSION_STRING}, 
 						      {max_method, ?HTTP_MAX_METHOD_STRING},
-						      {max_content_length, ?HTTP_MAX_CONTENT_LENGTH}]]},
+						      {max_content_length, ?HTTP_MAX_CONTENT_LENGTH},
+						      {customize, httpd_custom}
+						     ]]},
     [], ListenSocket);
 
 dummy_server_init(Caller, ssl, Inet, SSLOptions) ->
@@ -1276,7 +1278,8 @@ dummy_ssl_server_init(Caller, BaseOpts, Inet) ->
 						   {max_method, ?HTTP_MAX_METHOD_STRING},
 						   {max_version,?HTTP_MAX_VERSION_STRING}, 
 						   {max_method, ?HTTP_MAX_METHOD_STRING},
-						   {max_content_length, ?HTTP_MAX_CONTENT_LENGTH}
+						   {max_content_length, ?HTTP_MAX_CONTENT_LENGTH},
+						   {customize, httpd_custom}
 						  ]]},
 			  [], ListenSocket).
 
@@ -1355,18 +1358,20 @@ handle_request(Module, Function, Args, Socket) ->
 		    stop;
 		<<>> ->
 		    {httpd_request, parse, [[{max_uri,?HTTP_MAX_URI_SIZE},
-						    {max_header, ?HTTP_MAX_HEADER_SIZE},
-						    {max_version,?HTTP_MAX_VERSION_STRING}, 
-						    {max_method, ?HTTP_MAX_METHOD_STRING},
-						    {max_content_length, ?HTTP_MAX_CONTENT_LENGTH}
-						   ]]};
+					     {max_header, ?HTTP_MAX_HEADER_SIZE},
+					     {max_version,?HTTP_MAX_VERSION_STRING}, 
+					     {max_method, ?HTTP_MAX_METHOD_STRING},
+					     {max_content_length, ?HTTP_MAX_CONTENT_LENGTH},
+					     {customize, httpd_custom}
+					    ]]};
 		Data ->	
 		    handle_request(httpd_request, parse, 
 				   [Data, [{max_uri,    ?HTTP_MAX_URI_SIZE},
-					    {max_header, ?HTTP_MAX_HEADER_SIZE},
+					   {max_header, ?HTTP_MAX_HEADER_SIZE},
 					    {max_version,?HTTP_MAX_VERSION_STRING}, 
 					    {max_method, ?HTTP_MAX_METHOD_STRING},
-					    {max_content_length, ?HTTP_MAX_CONTENT_LENGTH}
+					    {max_content_length, ?HTTP_MAX_CONTENT_LENGTH},
+					   {customize, httpd_custom}
 					  ]], Socket)
 	    end;
 	NewMFA ->
diff --git a/lib/inets/test/httpd_SUITE.erl b/lib/inets/test/httpd_SUITE.erl
index 342004f19b..1457f735ad 100644
--- a/lib/inets/test/httpd_SUITE.erl
+++ b/lib/inets/test/httpd_SUITE.erl
@@ -53,6 +53,8 @@ all() ->
      {group, https_basic},
      {group, http_limit},
      {group, https_limit},
+     {group, http_custom},
+     {group, https_custom},
      {group, http_basic_auth},
      {group, https_basic_auth},
      {group, http_auth_api},
@@ -75,6 +77,8 @@ groups() ->
      {https_basic, [], basic_groups()},
      {http_limit, [], [{group, limit}]},
      {https_limit, [], [{group, limit}]},
+     {http_custom, [], [{group,  custom}]},
+     {https_custom, [], [{group,  custom}]},
      {http_basic_auth, [], [{group, basic_auth}]},
      {https_basic_auth, [], [{group, basic_auth}]},
      {http_auth_api, [], [{group, auth_api}]},
@@ -89,7 +93,8 @@ groups() ->
      {https_security, [], [{group, security}]},
      {http_reload, [], [{group, reload}]},
      {https_reload, [], [{group, reload}]},
-     {limit, [],  [max_clients_1_1, max_clients_1_0, max_clients_0_9]},  
+     {limit, [],  [max_clients_1_1, max_clients_1_0, max_clients_0_9]}, 
+     {custom, [],  [customize]},  
      {reload, [], [non_disturbing_reconfiger_dies,
 		   disturbing_reconfiger_dies,
 		   non_disturbing_1_1, 
@@ -177,6 +182,7 @@ end_per_suite(_Config) ->
 %%--------------------------------------------------------------------
 init_per_group(Group, Config0) when Group == https_basic;
 				    Group == https_limit;
+				    Group == https_custom;
 				    Group == https_basic_auth;
 				    Group == https_auth_api;
 				    Group == https_auth_api_dets;
@@ -187,6 +193,7 @@ init_per_group(Group, Config0) when Group == https_basic;
     init_ssl(Group, Config0);
 init_per_group(Group, Config0)  when  Group == http_basic;
 				      Group == http_limit;
+				      Group == http_custom;
 				      Group == http_basic_auth;
 				      Group == http_auth_api;
 				      Group == http_auth_api_dets;
@@ -973,6 +980,30 @@ missing_CR(Config) ->
 					{version, Version}]).
 
 %%-------------------------------------------------------------------------
+customize() ->
+    [{doc, "Test filtering of headers with custom callback"}].
+
+customize(Config) when is_list(Config) -> 
+    Version = "HTTP/1.1",
+    Host = ?config(host, Config),
+    Type = ?config(type, Config),
+    ok = httpd_test_lib:verify_request(?config(type, Config), Host, 
+				       ?config(port, Config),  
+				       transport_opts(Type, Config),
+				       ?config(node, Config),
+				       http_request("GET /index.html ", Version, Host),
+				       [{statuscode, 200},
+					{header, "Content-Type", "text/html"},
+					{header, "Date"},
+					{no_header, "Server"},
+					{version, Version}]).
+
+response_header({"server", _}) ->
+    false;
+response_header(Header) ->
+    {true, Header}.
+
+%%-------------------------------------------------------------------------
 max_header() ->
     ["Denial Of Service (DOS) attack, prevented by max_header"].
 max_header(Config) when is_list(Config) ->
@@ -1312,24 +1343,26 @@ setup_server_dirs(ServerRoot, DocRoot, DataDir) ->
     
 start_apps(Group) when  Group == https_basic;
 			Group == https_limit;
+			Group == https_custom;
 			Group == https_basic_auth;
 			Group == https_auth_api;
 			Group == https_auth_api_dets;
 			Group == https_auth_api_mnesia;
-			Group == http_htaccess;
-			Group == http_security;
-			Group == http_reload
+			Group == https_htaccess;
+			Group == https_security;
+			Group == https_reload
 			->
     inets_test_lib:start_apps([inets, asn1, crypto, public_key, ssl]);
 start_apps(Group) when  Group == http_basic;
 			Group == http_limit;
+			Group == http_custom;
 			Group == http_basic_auth;
 			Group == http_auth_api;
 			Group == http_auth_api_dets;
 			Group == http_auth_api_mnesia;			
-			Group == https_htaccess;
-			Group == https_security;
-			Group == https_reload->
+			Group == http_htaccess;
+			Group == http_security;
+			Group == http_reload->
     inets_test_lib:start_apps([inets]).
 
 server_start(_, HttpdConfig) ->
@@ -1381,6 +1414,10 @@ server_config(http_limit, Config) ->
     [{max_clients, 1},
      %% Make sure option checking code is run
      {max_content_length, 100000002}]  ++ server_config(http, Config);
+server_config(http_custom, Config) ->
+    [{custom, ?MODULE}]  ++ server_config(http, Config);
+server_config(https_custom, Config) ->
+    [{custom, ?MODULE}]  ++ server_config(https, Config);
 server_config(https_limit, Config) ->
     [{max_clients, 1}]  ++ server_config(https, Config);
 server_config(http_basic_auth, Config) ->
diff --git a/lib/inets/vsn.mk b/lib/inets/vsn.mk
index ecb84e447c..38d46cc6fd 100644
--- a/lib/inets/vsn.mk
+++ b/lib/inets/vsn.mk
@@ -2,7 +2,7 @@
 
 # %CopyrightBegin%
 # 
-# Copyright Ericsson AB 2001-2014. All Rights Reserved.
+# Copyright Ericsson AB 2001-2015. All Rights Reserved.
 # 
 # The contents of this file are subject to the Erlang Public License,
 # Version 1.1, (the "License"); you may not use this file except in
@@ -18,6 +18,6 @@
 # %CopyrightEnd%
 
 APPLICATION = inets
-INETS_VSN   = 5.10.8
+INETS_VSN   = 5.10.9
 PRE_VSN     =
 APP_VSN     = "$(APPLICATION)-$(INETS_VSN)$(PRE_VSN)"
diff --git a/lib/ssh/doc/src/notes.xml b/lib/ssh/doc/src/notes.xml
index 579a3ae4a8..c77ee1e77a 100644
--- a/lib/ssh/doc/src/notes.xml
+++ b/lib/ssh/doc/src/notes.xml
@@ -29,6 +29,33 @@
     <file>notes.xml</file>
   </header>
 
+<section><title>Ssh 3.2.4</title>
+
+    <section><title>Fixed Bugs and Malfunctions</title>
+      <list>
+        <item>
+          <p>
+	    Gracefully terminate if sockets is unexpectedly closed.</p>
+          <p>
+	    Own Id: OTP-12782</p>
+        </item>
+        <item>
+          <p>
+	    Made Codenomicon Defensics test suite pass: <list>
+	    <item>limit number of algorithms in kexinit
+	    message</item> <item>check 'e' and 'f' parameters in
+	    kexdh</item> <item>implement 'keyboard-interactive' user
+	    authentication on server side</item> <item> return plain
+	    text message to bad version exchange message</item>
+	    </list></p>
+          <p>
+	    Own Id: OTP-12784</p>
+        </item>
+      </list>
+    </section>
+
+</section>
+
 <section><title>Ssh 3.2.3</title>
 
     <section><title>Fixed Bugs and Malfunctions</title>
diff --git a/lib/ssh/src/ssh.erl b/lib/ssh/src/ssh.erl
index 71e7d77475..7ed17618e7 100644
--- a/lib/ssh/src/ssh.erl
+++ b/lib/ssh/src/ssh.erl
@@ -331,6 +331,8 @@ handle_option([{exec, _} = Opt | Rest], SocketOptions, SshOptions) ->
     handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
 handle_option([{auth_methods, _} = Opt | Rest], SocketOptions, SshOptions) ->
     handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
+handle_option([{auth_method_kb_interactive_data, _} = Opt | Rest], SocketOptions, SshOptions) ->
+    handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
 handle_option([{pref_public_key_algs, _} = Opt | Rest], SocketOptions, SshOptions) ->
     handle_option(Rest, SocketOptions, [handle_ssh_option(Opt) | SshOptions]);
 handle_option([{quiet_mode, _} = Opt|Rest], SocketOptions, SshOptions) ->
@@ -411,6 +413,13 @@ handle_ssh_option({exec, Function} = Opt) when is_function(Function) ->
     Opt;
 handle_ssh_option({auth_methods, Value} = Opt)  when is_list(Value) ->
     Opt;
+handle_ssh_option({auth_method_kb_interactive_data, {Name,Instruction,Prompt,Echo}} = Opt) when is_list(Name),
+												is_list(Instruction),
+												is_list(Prompt),
+												is_boolean(Echo) ->
+    Opt;
+handle_ssh_option({auth_method_kb_interactive_data, F} = Opt) when is_function(F,3) ->
+    Opt;
 handle_ssh_option({infofun, Value} = Opt)  when is_function(Value) ->
     Opt;
 handle_ssh_option({connectfun, Value} = Opt) when is_function(Value) ->
diff --git a/lib/ssh/src/ssh_auth.erl b/lib/ssh/src/ssh_auth.erl
index 45c4d52d7e..9d1ab14ce9 100644
--- a/lib/ssh/src/ssh_auth.erl
+++ b/lib/ssh/src/ssh_auth.erl
@@ -259,6 +259,54 @@ handle_userauth_request(#ssh_msg_userauth_request{user = User,
 
 handle_userauth_request(#ssh_msg_userauth_request{user = User,
 						  service = "ssh-connection",
+						  method = "keyboard-interactive",
+						  data = _},
+			_, #ssh{opts = Opts} = Ssh) ->
+    %% RFC4256
+    %% The data field contains:
+    %%   - language tag (deprecated). If =/=[] SHOULD use it however. We skip
+    %%                                it for simplicity.
+    %%   - submethods. "... the user can give a hint of which actual methods
+    %%                  he wants to use. ...".  It's a "MAY use" so we skip
+    %%                  it. It also needs an understanding between the client
+    %%                  and the server.
+    %%                  
+    %% "The server MUST reply with an SSH_MSG_USERAUTH_SUCCESS,
+    %%  SSH_MSG_USERAUTH_FAILURE, or SSH_MSG_USERAUTH_INFO_REQUEST message."
+    Default = {"SSH server",
+	       "Enter password for \""++User++"\"",
+	       "pwd: ",
+	       false},
+
+    {Name, Instruction, Prompt, Echo} =
+	case proplists:get_value(auth_method_kb_interactive_data, Opts) of
+	    undefined -> 
+		Default;
+	    {_,_,_,_}=V -> 
+		V;
+	    F when is_function(F) ->
+		{_,PeerName} = Ssh#ssh.peer,
+		F(PeerName, User, "ssh-connection")
+	end,
+    EchoEnc = case Echo of
+		  true -> <<?TRUE>>;
+		  false -> <<?FALSE>>
+	      end,
+    Msg = #ssh_msg_userauth_info_request{name = unicode:characters_to_list(Name),
+					 instruction = unicode:characters_to_list(Instruction),
+					 language_tag = "",
+					 num_prompts = 1,
+					 data = <<?STRING(unicode:characters_to_binary(Prompt)),
+						  EchoEnc/binary
+						>>
+					},
+    {not_authorized, {User, undefined}, 
+     ssh_transport:ssh_packet(Msg, Ssh#ssh{user = User,
+					   opts = [{max_kb_tries,3},{kb_userauth_info_msg,Msg}|Opts]
+					  })};
+
+handle_userauth_request(#ssh_msg_userauth_request{user = User,
+						  service = "ssh-connection",
 						  method = Other}, _,
 			#ssh{userauth_supported_methods = Methods} = Ssh) ->
     {not_authorized, {User, {authmethod, Other}}, 
@@ -280,6 +328,38 @@ handle_userauth_info_request(
        #ssh_msg_userauth_info_response{num_responses = NumPrompts,
 				       data = Responses}, Ssh)}.
 
+handle_userauth_info_response(#ssh_msg_userauth_info_response{num_responses = 1,
+							      data = <<?UINT32(Sz), Password:Sz/binary>>},
+			      #ssh{opts = Opts0,
+				   user = User} = Ssh) ->
+    NumTriesLeft = proplists:get_value(max_kb_tries, Opts0, 0) - 1,
+    Opts = lists:keydelete(max_kb_tries,1,Opts0),
+    case check_password(User, unicode:characters_to_list(Password), Opts) of
+	true ->
+	    {authorized, User,
+	     ssh_transport:ssh_packet(#ssh_msg_userauth_success{}, Ssh)};
+	false when NumTriesLeft > 0 ->
+	    UserAuthInfoMsg = 
+		(proplists:get_value(kb_userauth_info_msg,Opts))
+		#ssh_msg_userauth_info_request{name = "",
+					       instruction = 
+						   lists:concat(
+						     ["Bad user or password, try again. ",
+						      integer_to_list(NumTriesLeft),
+						      " tries left."])},
+	    {not_authorized, {User, undefined}, 
+	     ssh_transport:ssh_packet(UserAuthInfoMsg,
+				      Ssh#ssh{opts = [{max_kb_tries,NumTriesLeft}|Opts]})};
+	     
+	false ->
+	    {not_authorized, {User, {error,"Bad user or password"}}, 
+	     ssh_transport:ssh_packet(#ssh_msg_userauth_failure{
+					 authentications = "",
+					 partial_success = false}, 
+				      Ssh#ssh{opts = lists:keydelete(kb_userauth_info_msg,1,Opts)}
+				     )}
+    end;
+
 handle_userauth_info_response(#ssh_msg_userauth_info_response{},
 			      _Auth) ->
     throw(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_SERVICE_NOT_AVAILABLE,
diff --git a/lib/ssh/src/ssh_connection_handler.erl b/lib/ssh/src/ssh_connection_handler.erl
index 0f6162db60..f751094211 100644
--- a/lib/ssh/src/ssh_connection_handler.erl
+++ b/lib/ssh/src/ssh_connection_handler.erl
@@ -326,22 +326,25 @@ info(ConnectionHandler, ChannelProcess) ->
 hello(socket_control, #state{socket = Socket, ssh_params = Ssh} = State) ->
     VsnMsg = ssh_transport:hello_version_msg(string_version(Ssh)),
     send_msg(VsnMsg, State),
-    {ok, [{recbuf, Size}]} = inet:getopts(Socket, [recbuf]),
-    inet:setopts(Socket, [{packet, line}, {active, once}, {recbuf, ?MAX_PROTO_VERSION}]),
-    {next_state, hello, State#state{recbuf = Size}};
+    case getopt(recbuf, Socket) of
+	{ok, Size} ->
+	    inet:setopts(Socket, [{packet, line}, {active, once}, {recbuf, ?MAX_PROTO_VERSION}]),
+	    {next_state, hello, State#state{recbuf = Size}};
+	{error, Reason} ->
+	    {stop, {shutdown, Reason}, State}
+    end;
 
 hello({info_line, _Line},#state{role = client, socket = Socket} = State) ->
     %% The server may send info lines before the version_exchange
     inet:setopts(Socket, [{active, once}]),
     {next_state, hello, State};
 
-hello({info_line, _Line},#state{role = server} = State) ->
-    DisconnectMsg =
-	#ssh_msg_disconnect{code =
-				?SSH_DISCONNECT_PROTOCOL_ERROR,
-			    description = "Did not receive expected protocol version exchange",
-			    language = "en"},
-    handle_disconnect(DisconnectMsg, State);
+hello({info_line, _Line},#state{role = server,
+				socket = Socket,
+				transport_cb = Transport } = State) ->
+    %% as openssh
+    Transport:send(Socket, "Protocol mismatch."),
+    {stop, {shutdown,"Protocol mismatch in version exchange."}, State};
 
 hello({version_exchange, Version}, #state{ssh_params = Ssh0,
 					  socket = Socket,
@@ -496,10 +499,21 @@ userauth(#ssh_msg_userauth_info_request{} = Msg,
     {next_state, userauth, next_packet(State#state{ssh_params = Ssh})};
 
 userauth(#ssh_msg_userauth_info_response{} = Msg, 
-	 #state{ssh_params = #ssh{role = server} = Ssh0} = State) ->
-    {ok, {Reply, Ssh}} = ssh_auth:handle_userauth_info_response(Msg, Ssh0),
-    send_msg(Reply, State),
-    {next_state, userauth, next_packet(State#state{ssh_params = Ssh})};
+	 #state{ssh_params = #ssh{role = server,
+				  peer = {_, Address}} = Ssh0,
+		opts = Opts, starter = Pid} = State) ->
+    case ssh_auth:handle_userauth_info_response(Msg, Ssh0) of
+	{authorized, User, {Reply, Ssh}} ->
+	    send_msg(Reply, State),
+	    Pid ! ssh_connected,
+	    connected_fun(User, Address, "keyboard-interactive", Opts),
+	    {next_state, connected, 
+	     next_packet(State#state{auth_user = User, ssh_params = Ssh})};
+	{not_authorized, {User, Reason}, {Reply, Ssh}} ->
+	    retry_fun(User, Address, Reason, Opts),
+	    send_msg(Reply, State),
+	    {next_state, userauth, next_packet(State#state{ssh_params = Ssh})} 
+    end;
 			
 userauth(#ssh_msg_userauth_success{}, #state{ssh_params = #ssh{role = client} = Ssh,
 					     starter = Pid} = State) ->
@@ -1719,3 +1733,12 @@ start_timeout(_,_, infinity) ->
     ok;
 start_timeout(Channel, From, Time) ->
     erlang:send_after(Time, self(), {timeout, {Channel, From}}).
+
+getopt(Opt, Socket) ->
+    case inet:getopts(Socket, [Opt]) of
+	{ok, [{Opt, Value}]} ->
+	    {ok, Value};
+	Other ->
+	    {error, {unexpected_getopts_return, Other}}
+    end.
+		
diff --git a/lib/ssh/src/ssh_transport.erl b/lib/ssh/src/ssh_transport.erl
index 8669be570e..6c0873fd9e 100644
--- a/lib/ssh/src/ssh_transport.erl
+++ b/lib/ssh/src/ssh_transport.erl
@@ -240,20 +240,30 @@ key_exchange_first_msg('diffie-hellman-group-exchange-sha1', Ssh0) ->
 
 handle_kexdh_init(#ssh_msg_kexdh_init{e = E}, Ssh0) ->
     {G, P} = dh_group1(),
-    {Private, Public} = dh_gen_key(G, P, 1024),
-    K = ssh_math:ipow(E, Private, P),
-    Key = get_host_key(Ssh0),
-    H = kex_h(Ssh0, Key, E, Public, K),
-    H_SIG = sign_host_key(Ssh0, Key, H),
-    {SshPacket, Ssh1} = ssh_packet(#ssh_msg_kexdh_reply{public_host_key = Key,
-							f = Public,
-							h_sig = H_SIG
-						       }, Ssh0),
-
-    {ok, SshPacket, Ssh1#ssh{keyex_key = {{Private, Public}, {G, P}},
-			     shared_secret = K,
-			     exchanged_hash = H,
-			     session_id = sid(Ssh1, H)}}.
+    if
+	1=<E, E=<(P-1) ->
+	    {Private, Public} = dh_gen_key(G, P, 1024),
+	    K = ssh_math:ipow(E, Private, P),
+	    Key = get_host_key(Ssh0),
+	    H = kex_h(Ssh0, Key, E, Public, K),
+	    H_SIG = sign_host_key(Ssh0, Key, H),
+	    {SshPacket, Ssh1} = ssh_packet(#ssh_msg_kexdh_reply{public_host_key = Key,
+								f = Public,
+								h_sig = H_SIG
+							       }, Ssh0),
+	    
+	    {ok, SshPacket, Ssh1#ssh{keyex_key = {{Private, Public}, {G, P}},
+				     shared_secret = K,
+				     exchanged_hash = H,
+				     session_id = sid(Ssh1, H)}};
+	true ->
+	    Error = {error,bad_e_from_peer},
+	    Disconnect = #ssh_msg_disconnect{
+			    code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
+			    description = "Key exchange failed, 'f' out of bounds",
+			    language = "en"},
+	    throw({Error, Disconnect})
+    end.
 
 handle_kex_dh_gex_group(#ssh_msg_kex_dh_gex_group{p = P, g = G}, Ssh0) ->
     {Private, Public} = dh_gen_key(G,P,1024),
@@ -277,7 +287,7 @@ handle_new_keys(#ssh_msg_newkeys{}, Ssh0) ->
 %% %% Select algorithms
 handle_kexdh_reply(#ssh_msg_kexdh_reply{public_host_key = HostKey, f = F,
 					h_sig = H_SIG}, 
-		   #ssh{keyex_key = {{Private, Public}, {_G, P}}} = Ssh0) ->
+		   #ssh{keyex_key = {{Private, Public}, {_G, P}}} = Ssh0) when 1=<F, F=<(P-1)->
     K = ssh_math:ipow(F, Private, P),
     H = kex_h(Ssh0, HostKey, Public, F, K),
 
@@ -293,7 +303,15 @@ handle_kexdh_reply(#ssh_msg_kexdh_reply{public_host_key = HostKey, f = F,
 	      description = "Key exchange failed",
 	      language = "en"},
 	    throw({Error, Disconnect})
-    end.
+    end;
+handle_kexdh_reply(#ssh_msg_kexdh_reply{}, _SSH) ->
+    Error = {error,bad_f_from_peer},
+    Disconnect = #ssh_msg_disconnect{
+		    code = ?SSH_DISCONNECT_KEY_EXCHANGE_FAILED,
+		    description = "Key exchange failed, 'f' out of bounds",
+		    language = "en"},
+    throw({Error, Disconnect}).
+
 
 handle_kex_dh_gex_request(#ssh_msg_kex_dh_gex_request{min = _Min,
 						      n   = _NBits,
@@ -519,10 +537,15 @@ alg_final(SSH0) ->
     {ok,SSH6} = decompress_final(SSH5),
     SSH6.
 
-select_all(CL, SL) ->
+select_all(CL, SL) when length(CL) + length(SL) < 50 ->
     A = CL -- SL,  %% algortihms only used by client
     %% algorithms used by client and server (client pref)
-    lists:map(fun(ALG) -> list_to_atom(ALG) end, (CL -- A)).
+    lists:map(fun(ALG) -> list_to_atom(ALG) end, (CL -- A));
+select_all(_CL, _SL) ->
+    throw(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_PROTOCOL_ERROR,
+			      description = "Too many algorithms", 
+			      language = "en"}).
+
 
 select([], []) ->
     none;
diff --git a/lib/ssh/vsn.mk b/lib/ssh/vsn.mk
index 40bda0c19f..9d486f8890 100644
--- a/lib/ssh/vsn.mk
+++ b/lib/ssh/vsn.mk
@@ -1,4 +1,4 @@
 #-*-makefile-*-   ; force emacs to enter makefile-mode
 
-SSH_VSN = 3.2.3
+SSH_VSN = 3.2.4
 APP_VSN    = "ssh-$(SSH_VSN)"
diff --git a/lib/ssl/doc/src/notes.xml b/lib/ssl/doc/src/notes.xml
index 352563700b..fe0606b1a3 100644
--- a/lib/ssl/doc/src/notes.xml
+++ b/lib/ssl/doc/src/notes.xml
@@ -25,7 +25,23 @@
     <file>notes.xml</file>
   </header>
   <p>This document describes the changes made to the SSL application.</p>
-  <section><title>SSL 6.0</title>
+  <section><title>SSL 6.0.1</title>
+
+    <section><title>Fixed Bugs and Malfunctions</title>
+      <list>
+        <item>
+          <p>
+	    Terminate gracefully when receving bad input to premaster
+	    secret calculation</p>
+          <p>
+	    Own Id: OTP-12783</p>
+        </item>
+      </list>
+    </section>
+
+</section>
+
+<section><title>SSL 6.0</title>
 
     <section><title>Fixed Bugs and Malfunctions</title>
       <list>
diff --git a/lib/ssl/src/ssl.appup.src b/lib/ssl/src/ssl.appup.src
index 7986722094..d100e41930 100644
--- a/lib/ssl/src/ssl.appup.src
+++ b/lib/ssl/src/ssl.appup.src
@@ -1,12 +1,14 @@
 %% -*- erlang -*-
 {"%VSN%",
  [
+  {<<"6.0">>, [{load_module, ssl_handshake, soft_purge, soft_purge, []}]},
   {<<"5\\.3\\.[1-7]($|\\..*)">>, [{restart_application, ssl}]},
   {<<"5\\.[0-2]($|\\..*)">>, [{restart_application, ssl}]},
   {<<"4\\..*">>, [{restart_application, ssl}]},
   {<<"3\\..*">>, [{restart_application, ssl}]}
  ], 
  [
+  {<<"6.0">>, [{load_module, ssl_handshake, soft_purge, soft_purge, []}]},
   {<<"5\\.3\\.[1-7]($|\\..*)">>, [{restart_application, ssl}]},
   {<<"5\\.[0-2]($|\\..*)">>, [{restart_application, ssl}]},
   {<<"4\\..*">>, [{restart_application, ssl}]},
diff --git a/lib/ssl/src/ssl_handshake.erl b/lib/ssl/src/ssl_handshake.erl
index 88ccb94e0b..29b64f7a81 100644
--- a/lib/ssl/src/ssl_handshake.erl
+++ b/lib/ssl/src/ssl_handshake.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2013-2014. All Rights Reserved.
+%% Copyright Ericsson AB 2013-2015. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -500,19 +500,27 @@ update_handshake_history({Handshake0, _Prev}, Data) ->
 %%     end.
 
 premaster_secret(OtherPublicDhKey, MyPrivateKey, #'DHParameter'{} = Params) ->
-    public_key:compute_key(OtherPublicDhKey, MyPrivateKey, Params);
-
+    try 
+	public_key:compute_key(OtherPublicDhKey, MyPrivateKey, Params)  
+    catch 
+	error:computation_failed -> 
+	    throw(?ALERT_REC(?FATAL, ?ILLEGAL_PARAMETER))
+    end;	   
 premaster_secret(PublicDhKey, PrivateDhKey, #server_dh_params{dh_p = Prime, dh_g = Base}) ->
-    crypto:compute_key(dh, PublicDhKey, PrivateDhKey, [Prime, Base]);
+    try 
+	crypto:compute_key(dh, PublicDhKey, PrivateDhKey, [Prime, Base])
+    catch 
+	error:computation_failed -> 
+	    throw(?ALERT_REC(?FATAL, ?ILLEGAL_PARAMETER))
+    end;
 premaster_secret(#client_srp_public{srp_a = ClientPublicKey}, ServerKey, #srp_user{prime = Prime,
 										   verifier = Verifier}) ->
     case crypto:compute_key(srp, ClientPublicKey, ServerKey, {host, [Verifier, Prime, '6a']}) of
 	error ->
-	    ?ALERT_REC(?FATAL, ?ILLEGAL_PARAMETER);
+	    throw(?ALERT_REC(?FATAL, ?ILLEGAL_PARAMETER));
 	PremasterSecret ->
 	    PremasterSecret
     end;
-
 premaster_secret(#server_srp_params{srp_n = Prime, srp_g = Generator, srp_s = Salt, srp_b = Public},
 		 ClientKeys, {Username, Password}) ->
     case ssl_srp_primes:check_srp_params(Generator, Prime) of
@@ -520,21 +528,19 @@ premaster_secret(#server_srp_params{srp_n = Prime, srp_g = Generator, srp_s = Sa
 	    DerivedKey = crypto:hash(sha, [Salt, crypto:hash(sha, [Username, <<$:>>, Password])]),
 	    case crypto:compute_key(srp, Public, ClientKeys, {user, [DerivedKey, Prime, Generator, '6a']}) of
 		error ->
-		    ?ALERT_REC(?FATAL, ?ILLEGAL_PARAMETER);
+		    throw(?ALERT_REC(?FATAL, ?ILLEGAL_PARAMETER));
 		PremasterSecret ->
 		    PremasterSecret
 	    end;
 	_ ->
-	    ?ALERT_REC(?FATAL, ?ILLEGAL_PARAMETER)
+	    throw(?ALERT_REC(?FATAL, ?ILLEGAL_PARAMETER))
     end;
-
 premaster_secret(#client_rsa_psk_identity{
 		    identity = PSKIdentity,
 		    exchange_keys = #encrypted_premaster_secret{premaster_secret = EncPMS}
 		   }, #'RSAPrivateKey'{} = Key, PSKLookup) ->
     PremasterSecret = premaster_secret(EncPMS, Key),
     psk_secret(PSKIdentity, PSKLookup, PremasterSecret);
-
 premaster_secret(#server_dhe_psk_params{
 		    hint = IdentityHint,
 		    dh_params =  #server_dh_params{dh_y = PublicDhKey} = Params},
@@ -542,7 +548,6 @@ premaster_secret(#server_dhe_psk_params{
 		    LookupFun) ->
     PremasterSecret = premaster_secret(PublicDhKey, PrivateDhKey, Params),
     psk_secret(IdentityHint, LookupFun, PremasterSecret);
-
 premaster_secret({rsa_psk, PSKIdentity}, PSKLookup, RSAPremasterSecret) ->
     psk_secret(PSKIdentity, PSKLookup, RSAPremasterSecret).
 
@@ -551,13 +556,10 @@ premaster_secret(#client_dhe_psk_identity{
 		    dh_public = PublicDhKey}, PrivateKey, #'DHParameter'{} = Params, PSKLookup) ->
     PremasterSecret = premaster_secret(PublicDhKey, PrivateKey, Params),
     psk_secret(PSKIdentity, PSKLookup, PremasterSecret).
-
 premaster_secret(#client_psk_identity{identity = PSKIdentity}, PSKLookup) ->
     psk_secret(PSKIdentity, PSKLookup);
-
 premaster_secret({psk, PSKIdentity}, PSKLookup) ->
     psk_secret(PSKIdentity, PSKLookup);
-
 premaster_secret(#'ECPoint'{} = ECPoint, #'ECPrivateKey'{} = ECDHKeys) ->
     public_key:compute_key(ECPoint, ECDHKeys);
 premaster_secret(EncSecret, #'RSAPrivateKey'{} = RSAPrivateKey) ->
@@ -1933,7 +1935,7 @@ psk_secret(PSKIdentity, PSKLookup) ->
 	#alert{} = Alert ->
 	    Alert;
 	_ ->
-	    ?ALERT_REC(?FATAL, ?ILLEGAL_PARAMETER)
+	    throw(?ALERT_REC(?FATAL, ?ILLEGAL_PARAMETER))
     end.
 
 psk_secret(PSKIdentity, PSKLookup, PremasterSecret) ->
@@ -1945,7 +1947,7 @@ psk_secret(PSKIdentity, PSKLookup, PremasterSecret) ->
 	#alert{} = Alert ->
 	    Alert;
 	_ ->
-	    ?ALERT_REC(?FATAL, ?ILLEGAL_PARAMETER)
+	    throw(?ALERT_REC(?FATAL, ?ILLEGAL_PARAMETER))
     end.
 
 handle_psk_identity(_PSKIdentity, LookupFun)
diff --git a/lib/ssl/vsn.mk b/lib/ssl/vsn.mk
index 3663fb7857..d5a9a71736 100644
--- a/lib/ssl/vsn.mk
+++ b/lib/ssl/vsn.mk
@@ -1 +1 @@
-SSL_VSN = 6.0
+SSL_VSN = 6.0.1