Merge branch 'ia/ssl-forgot-DH-params-DER' into dev

* ia/ssl-forgot-DH-params-DER:
  Add missed DER dh option.

4 files changed, 23 insertions, 8 deletions

diff --git a/lib/ssl/src/ssl.erl b/lib/ssl/src/ssl.erl
index dbc5faff14..cc01b35b64 100644
--- a/lib/ssl/src/ssl.erl
+++ b/lib/ssl/src/ssl.erl
@@ -580,6 +580,7 @@ handle_options(Opts0, _Role) ->
       password   = handle_option(password, Opts, ""),
       cacerts    = CaCerts,
       cacertfile = handle_option(cacertfile, Opts, CaCertDefault),
+      dh         = handle_option(dh, Opts, undefined),
       dhfile     = handle_option(dhfile, Opts, undefined),
       ciphers    = handle_option(ciphers, Opts, []),
       %% Server side option
@@ -594,7 +595,7 @@ handle_options(Opts0, _Role) ->
     SslOptions = [versions, verify, verify_fun,
 		  fail_if_no_peer_cert, verify_client_once,
 		  depth, cert, certfile, key, keyfile,
-		  password, cacerts, cacertfile, dhfile, ciphers,
+		  password, cacerts, cacertfile, dh, dhfile, ciphers,
 		  debug, reuse_session, reuse_sessions, ssl_imp,
 		  cb_info, renegotiate_at, secure_renegotiate],
     
@@ -669,6 +670,9 @@ validate_option(cacertfile, undefined) ->
     "";
 validate_option(cacertfile, Value) when is_list(Value), Value =/= "" ->
     Value;
+validate_option(dh, Value) when Value == undefined;
+				is_binary(Value) ->
+    Value;
 validate_option(dhfile, undefined = Value)  ->
     Value;
 validate_option(dhfile, Value) when is_list(Value), Value =/= "" ->
diff --git a/lib/ssl/src/ssl_connection.erl b/lib/ssl/src/ssl_connection.erl
index 7689976ff6..c94199c336 100644
--- a/lib/ssl/src/ssl_connection.erl
+++ b/lib/ssl/src/ssl_connection.erl
@@ -1034,7 +1034,7 @@ ssl_init(SslOpts, Role) ->
     PrivateKey =
 	init_private_key(SslOpts#ssl_options.key, SslOpts#ssl_options.keyfile,
 			 SslOpts#ssl_options.password, Role),
-    DHParams = init_diffie_hellman(SslOpts#ssl_options.dhfile, Role),
+    DHParams = init_diffie_hellman(SslOpts#ssl_options.dh, SslOpts#ssl_options.dhfile, Role),
     {ok, CertDbRef, CacheRef, OwnCert, PrivateKey, DHParams}.
 
 
@@ -1111,11 +1111,13 @@ file_error(Line, Error, Reason, File, Throw, Stack) ->
     error_logger:error_report(Report),
     throw(Throw).
 
-init_diffie_hellman(_, client) ->
+init_diffie_hellman(Params, _,_) when is_binary(Params)->
+    public_key:der_decode('DHParameter', Params);
+init_diffie_hellman(_,_, client) ->
     undefined;
-init_diffie_hellman(undefined, _) ->
+init_diffie_hellman(_,undefined, _) ->
     ?DEFAULT_DIFFIE_HELLMAN_PARAMS;
-init_diffie_hellman(DHParamFile, server) ->
+init_diffie_hellman(_, DHParamFile, server) ->
     try
 	{ok, List} = ssl_manager:cache_pem_file(DHParamFile), 
 	case [Entry || Entry = {'DHParameter', _ , _} <- List] of
diff --git a/lib/ssl/src/ssl_internal.hrl b/lib/ssl/src/ssl_internal.hrl
index 3862dc75de..ddb05e70f6 100644
--- a/lib/ssl/src/ssl_internal.hrl
+++ b/lib/ssl/src/ssl_internal.hrl
@@ -69,6 +69,7 @@
 	  password,   % 
 	  cacerts,    % [der_encoded()]
 	  cacertfile, % file()
+	  dh,         % der_encoded()
 	  dhfile,     % file()
 	  ciphers,    % 
 	  %% Local policy for the server if it want's to reuse the session
diff --git a/lib/ssl/test/ssl_basic_SUITE.erl b/lib/ssl/test/ssl_basic_SUITE.erl
index 47c7407a2e..1e96880801 100644
--- a/lib/ssl/test/ssl_basic_SUITE.erl
+++ b/lib/ssl/test/ssl_basic_SUITE.erl
@@ -2990,14 +2990,20 @@ der_input(suite) ->
     [];
 
 der_input(Config) when is_list(Config) ->
+    DataDir = ?config(data_dir, Config),
+    DHParamFile = filename:join(DataDir, "dHParam.pem"),
 
     SeverVerifyOpts = ?config(server_verification_opts, Config),
-    {ServerCert, ServerKey, ServerCaCerts} = der_input_opts(SeverVerifyOpts),
+    {ServerCert, ServerKey, ServerCaCerts, DHParams} = der_input_opts([{dhfile, DHParamFile} |
+								       SeverVerifyOpts]),
     ClientVerifyOpts = ?config(client_verification_opts, Config),
-    {ClientCert, ClientKey, ClientCaCerts} = der_input_opts(ClientVerifyOpts),
+    {ClientCert, ClientKey, ClientCaCerts, DHParams} = der_input_opts([{dhfile, DHParamFile} |
+								       ClientVerifyOpts]),
     ServerOpts = [{verify, verify_peer}, {fail_if_no_peer_cert, true},
+		  {dh, DHParams},
 		  {cert, ServerCert}, {key, ServerKey}, {cacerts, ServerCaCerts}],
     ClientOpts = [{verify, verify_peer}, {fail_if_no_peer_cert, true},
+		  {dh, DHParams},
 		  {cert, ClientCert}, {key, ClientKey}, {cacerts, ClientCaCerts}],
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
     Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
@@ -3019,14 +3025,16 @@ der_input_opts(Opts) ->
     Certfile = proplists:get_value(certfile, Opts),
     CaCertsfile = proplists:get_value(cacertfile, Opts),
     Keyfile = proplists:get_value(keyfile, Opts),
+    Dhfile = proplists:get_value(dhfile, Opts),
     [{_, Cert, _}] = ssl_test_lib:pem_to_der(Certfile),
     [{_, Key, _}]  = ssl_test_lib:pem_to_der(Keyfile),
+    [{_, DHParams, _}]  = ssl_test_lib:pem_to_der(Dhfile),
     CaCerts =
 	lists:map(fun(Entry) ->
 			  {_, CaCert, _} = Entry,
 			  CaCert
 		  end, ssl_test_lib:pem_to_der(CaCertsfile)),
-    {Cert, {rsa, Key}, CaCerts}.
+    {Cert, {rsa, Key}, CaCerts, DHParams}.
 
 %%--------------------------------------------------------------------
 %%% Internal functions