1 files changed, 30 insertions, 19 deletions

diff --git a/lib/ssl/src/ssl.erl b/lib/ssl/src/ssl.erl
index 965e40a109..3cd4c7fdbd 100644
--- a/lib/ssl/src/ssl.erl
+++ b/lib/ssl/src/ssl.erl
@@ -153,18 +153,23 @@ transport_accept(#sslsocket{pid = {ListenSocket, #config{cb=CbInfo, ssl=SslOpts}
     %% and options should be inherited.
     EmOptions = emulated_options(),
     {ok, InetValues} = inet:getopts(ListenSocket, EmOptions),
-    {CbModule,_,_} = CbInfo,
-    {ok, Socket} = CbModule:accept(ListenSocket, Timeout),
-    inet:setopts(Socket, internal_inet_values()),
-    {ok, Port} = inet:port(Socket),
-    case ssl_connection_sup:start_child([server, "localhost", Port, Socket,
-                                         {SslOpts, socket_options(InetValues)}, self(),
-                                         CbInfo]) of
-        {ok, Pid} ->
-            CbModule:controlling_process(Socket, Pid),
-            {ok, SslSocket#sslsocket{pid = Pid}};
-        {error, Reason} ->
-            {error, Reason}
+    ok = inet:setopts(ListenSocket, internal_inet_values()),
+    {CbModule,_,_} = CbInfo,    
+    case CbModule:accept(ListenSocket, Timeout) of
+	{ok, Socket} ->
+	    ok = inet:setopts(ListenSocket, InetValues),
+	    {ok, Port} = inet:port(Socket),
+	    ConnArgs = [server, "localhost", Port, Socket,
+			{SslOpts, socket_options(InetValues)}, self(), CbInfo],
+	    case ssl_connection_sup:start_child(ConnArgs) of
+		{ok, Pid} ->
+		    CbModule:controlling_process(Socket, Pid),
+		    {ok, SslSocket#sslsocket{pid = Pid}};
+		{error, Reason} ->
+		    {error, Reason}
+	    end;
+	{error, Reason} ->
+	    {error, Reason}
     end;
 
 transport_accept(#sslsocket{} = ListenSocket, Timeout) ->
@@ -515,6 +520,9 @@ handle_options(Opts0, Role) ->
 		end
 	end,
 
+    UserFailIfNoPeerCert = validate_option(fail_if_no_peer_cert, 
+					   proplists:get_value(fail_if_no_peer_cert, Opts, false)),
+
     {Verify, FailIfNoPeerCert, CaCertDefault} = 
 	%% Handle 0, 1, 2 for backwards compatibility
 	case proplists:get_value(verify, Opts, verify_none) of
@@ -527,9 +535,7 @@ handle_options(Opts0, Role) ->
 	    verify_none ->
 		{verify_none, false, ca_cert_default(verify_none, Role)};
 	    verify_peer ->
-		{verify_peer, proplists:get_value(fail_if_no_peer_cert,
-						  Opts, false),
-		 ca_cert_default(verify_peer, Role)};
+		{verify_peer, UserFailIfNoPeerCert, ca_cert_default(verify_peer, Role)};
 	    Value ->
 		throw({error, {eoptions, {verify, Value}}})
 	end,   
@@ -540,9 +546,9 @@ handle_options(Opts0, Role) ->
       versions   = handle_option(versions, Opts, []),
       verify     = validate_option(verify, Verify),
       verify_fun = handle_option(verify_fun, Opts, VerifyFun),
-      fail_if_no_peer_cert = validate_option(fail_if_no_peer_cert, 
-					     FailIfNoPeerCert),
+      fail_if_no_peer_cert = FailIfNoPeerCert,
       verify_client_once =  handle_option(verify_client_once, Opts, false),
+      validate_extensions_fun = handle_option(validate_extensions_fun, Opts, undefined),
       depth      = handle_option(depth,  Opts, 1),
       certfile   = CertFile,
       keyfile    = handle_option(keyfile,  Opts, CertFile),
@@ -559,7 +565,7 @@ handle_options(Opts0, Role) ->
      },
 
     CbInfo  = proplists:get_value(cb_info, Opts, {gen_tcp, tcp, tcp_closed}),    
-    SslOptions = [versions, verify, verify_fun, 
+    SslOptions = [versions, verify, verify_fun, validate_extensions_fun, 
 		  fail_if_no_peer_cert, verify_client_once,
 		  depth, certfile, keyfile,
 		  key, password, cacertfile, dhfile, ciphers,
@@ -594,6 +600,9 @@ validate_option(fail_if_no_peer_cert, Value)
 validate_option(verify_client_once, Value) 
   when Value == true; Value == false ->
     Value;
+
+validate_option(validate_extensions_fun, Value) when Value == undefined; is_function(Value) ->
+    Value;
 validate_option(depth, Value) when is_integer(Value), 
                                    Value >= 0, Value =< 255->
     Value;
@@ -623,6 +632,8 @@ validate_option(ciphers, Value)  when is_list(Value) ->
     try cipher_suites(Version, Value)
     catch
 	exit:_ ->
+	    throw({error, {eoptions, {ciphers, Value}}});
+	error:_->
 	    throw({error, {eoptions, {ciphers, Value}}})
     end;
 validate_option(reuse_session, Value) when is_function(Value) ->
@@ -644,7 +655,7 @@ validate_versions([Version | Rest], Versions) when Version == 'tlsv1.1';
                                                    Version == tlsv1; 
                                                    Version == sslv3 ->
     validate_versions(Rest, Versions);					   
-validate_versions(Ver, Versions) ->
+validate_versions([Ver| _], Versions) ->
     throw({error, {eoptions, {Ver, {versions, Versions}}}}).
 
 validate_inet_option(mode, Value)