1 files changed, 278 insertions, 135 deletions

diff --git a/lib/ssl/src/ssl.erl b/lib/ssl/src/ssl.erl
index 40d933a256..0ba59cede2 100644
--- a/lib/ssl/src/ssl.erl
+++ b/lib/ssl/src/ssl.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 1999-2012. All Rights Reserved.
+%% Copyright Ericsson AB 1999-2013. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -28,16 +28,15 @@
 	 cipher_suites/0, cipher_suites/1, suite_definition/1,
 	 close/1, shutdown/2,
 	 connect/3, connect/2, connect/4, connection_info/1,
-	 controlling_process/2, listen/2, pid/1, peername/1, peercert/1,
+	 controlling_process/2, listen/2, peername/1, peercert/1,
 	 recv/2, recv/3, send/2, getopts/2, setopts/2, sockname/1,
 	 versions/0, session_info/1, format_error/1,
-	 renegotiate/1, prf/5, clear_pem_cache/0, random_bytes/1]).
-
--deprecated({pid, 1, next_major_release}).
+	 renegotiate/1, prf/5, clear_pem_cache/0, random_bytes/1, negotiated_next_protocol/1]).
 
 -include("ssl_internal.hrl").
 -include("ssl_record.hrl").
 -include("ssl_cipher.hrl").
+-include("ssl_handshake.hrl").
 
 -include_lib("public_key/include/public_key.hrl"). 
 
@@ -45,7 +44,7 @@
 -export_type([connect_option/0, listen_option/0, ssl_option/0, transport_option/0,
 	      erl_cipher_suite/0, %% From ssl_cipher.hrl 
 	      tls_atom_version/0, %% From ssl_internal.hrl
-	      prf_random/0]).
+	      prf_random/0, sslsocket/0]).
 
 -record(config, {ssl,               %% SSL parameters
 		 inet_user,         %% User set inet options
@@ -53,6 +52,8 @@
 		 inet_ssl,          %% inet options for internal ssl socket 
 		 cb                 %% Callback info
 		}).
+
+-type sslsocket()                :: #sslsocket{}.
 -type connect_option()           :: socket_connect_option() | ssl_option() | transport_option().
 -type socket_connect_option()    :: gen_tcp:connect_option().
 -type listen_option()            :: socket_listen_option() | ssl_option() | transport_option().
@@ -65,7 +66,9 @@
                         {keyfile, path()} | {password, string()} | {cacerts, [Der::binary()]} |
                         {cacertfile, path()} | {dh, Der::binary()} | {dhfile, path()} |
                         {ciphers, ciphers()} | {ssl_imp, ssl_imp()} | {reuse_sessions, boolean()} |
-                        {reuse_session, fun()} | {hibernate_after, integer()|undefined}.
+                        {reuse_session, fun()} | {hibernate_after, integer()|undefined} |
+                        {next_protocols_advertised, list(binary())} |
+                        {client_preferred_next_protocols, binary(), client | server, list(binary())}.
 
 -type verify_type()  :: verify_none | verify_peer.
 -type path()         :: string().
@@ -73,7 +76,8 @@
 			string(). % (according to old API)
 -type ssl_imp()      :: new | old.
 
--type transport_option() :: {cb_info, {CallbackModule::atom(), DataTag::atom(), ClosedTag::atom()}}.
+-type transport_option() :: {cb_info, {CallbackModule::atom(), DataTag::atom(), 
+				       ClosedTag::atom(), ErrTag::atom()}}.
 -type prf_random() :: client_random | server_random.
 
 %%--------------------------------------------------------------------
@@ -105,7 +109,8 @@ stop() ->
 %%--------------------------------------------------------------------
 -spec connect(host() | port(), [connect_option()]) -> {ok, #sslsocket{}} |
 					      {error, reason()}.
--spec connect(host() | port(), [connect_option()] | inet:port_number(), timeout() | list()) ->
+-spec connect(host() | port(), [connect_option()] | inet:port_number(), 
+	      timeout() | list()) ->
 		     {ok, #sslsocket{}} | {error, reason()}.
 -spec connect(host() | port(), inet:port_number(), list(), timeout()) ->
 		     {ok, #sslsocket{}} | {error, reason()}.
@@ -117,12 +122,15 @@ connect(Socket, SslOptions) when is_port(Socket) ->
     connect(Socket, SslOptions, infinity).
 
 connect(Socket, SslOptions0, Timeout) when is_port(Socket) ->
+    {Transport,_,_,_} = proplists:get_value(cb_info, SslOptions0, 
+					      {gen_tcp, tcp, tcp_closed, tcp_error}),    
     EmulatedOptions = emulated_options(),
-    {ok, InetValues} = inet:getopts(Socket, EmulatedOptions),
-    ok = inet:setopts(Socket, internal_inet_values()),
-    try handle_options(SslOptions0 ++ InetValues, client) of
-	{ok, #config{cb=CbInfo, ssl=SslOptions, emulated=EmOpts}} ->
-	    case inet:peername(Socket) of
+    {ok, SocketValues} = ssl_socket:getopts(Transport, Socket, EmulatedOptions),
+    try handle_options(SslOptions0 ++ SocketValues, client) of
+	{ok, #config{cb = CbInfo, ssl = SslOptions, emulated = EmOpts}} ->
+	   
+	    ok = ssl_socket:setopts(Transport, Socket, internal_inet_values()),
+	    case ssl_socket:peername(Transport, Socket) of
 		{ok, {Address, Port}} ->
 		    ssl_connection:connect(Address, Port, Socket, 
 					   {SslOptions, EmOpts},
@@ -154,14 +162,14 @@ connect(Host, Port, Options, Timeout) ->
 %% Description: Creates an ssl listen socket.
 %%--------------------------------------------------------------------
 listen(_Port, []) ->
-    {error, enooptions};
+    {error, nooptions};
 listen(Port, Options0) ->
     try
 	{ok, Config} = handle_options(Options0, server),
-	#config{cb={CbModule, _, _, _},inet_user=Options} = Config,
-	case CbModule:listen(Port, Options) of
+	#config{cb = {Transport, _, _, _}, inet_user = Options} = Config,
+	case Transport:listen(Port, Options) of
 	    {ok, ListenSocket} ->
-		{ok, #sslsocket{pid = {ListenSocket, Config}, fd = new_ssl}};
+		{ok, #sslsocket{pid = {ListenSocket, Config}}};
 	    Err = {error, _} ->
 		Err
 	end
@@ -180,23 +188,23 @@ listen(Port, Options0) ->
 transport_accept(ListenSocket) ->
     transport_accept(ListenSocket, infinity).
 
-transport_accept(#sslsocket{pid = {ListenSocket, #config{cb=CbInfo, ssl=SslOpts}}}, Timeout) ->
+transport_accept(#sslsocket{pid = {ListenSocket, #config{cb = CbInfo, ssl = SslOpts}}}, Timeout) ->
     
     %% The setopt could have been invoked on the listen socket
     %% and options should be inherited.
     EmOptions = emulated_options(),
-    {ok, InetValues} = inet:getopts(ListenSocket, EmOptions),
-    ok = inet:setopts(ListenSocket, internal_inet_values()),
-    {CbModule,_,_, _} = CbInfo,    
-    case CbModule:accept(ListenSocket, Timeout) of
+    {Transport,_,_, _} = CbInfo,    
+    {ok, SocketValues} = ssl_socket:getopts(Transport, ListenSocket, EmOptions),
+    ok = ssl_socket:setopts(Transport, ListenSocket, internal_inet_values()),
+    case Transport:accept(ListenSocket, Timeout) of
 	{ok, Socket} ->
-	    ok = inet:setopts(ListenSocket, InetValues),
-	    {ok, Port} = inet:port(Socket),
+	    ok = ssl_socket:setopts(Transport, ListenSocket, SocketValues),
+	    {ok, Port} = ssl_socket:port(Transport, Socket),
 	    ConnArgs = [server, "localhost", Port, Socket,
-			{SslOpts, socket_options(InetValues)}, self(), CbInfo],
+			{SslOpts, socket_options(SocketValues)}, self(), CbInfo],
 	    case ssl_connection_sup:start_child(ConnArgs) of
 		{ok, Pid} ->
-		    ssl_connection:socket_control(Socket, Pid, CbModule);
+		    ssl_connection:socket_control(Socket, Pid, Transport);
 		{error, Reason} ->
 		    {error, Reason}
 	    end;
@@ -206,9 +214,11 @@ transport_accept(#sslsocket{pid = {ListenSocket, #config{cb=CbInfo, ssl=SslOpts}
 
 %%--------------------------------------------------------------------
 -spec ssl_accept(#sslsocket{}) -> ok | {error, reason()}.
--spec ssl_accept(#sslsocket{} | port(), timeout()| [ssl_option() | transport_option()]) ->
+-spec ssl_accept(#sslsocket{} | port(), timeout()| [ssl_option() 
+						    | transport_option()]) ->
 			ok | {ok, #sslsocket{}} | {error, reason()}.
--spec ssl_accept(port(), [ssl_option()| transport_option()], timeout()) -> {ok, #sslsocket{}} | {error, reason()}.
+-spec ssl_accept(port(), [ssl_option()| transport_option()], timeout()) -> 
+			{ok, #sslsocket{}} | {error, reason()}.
 %%
 %% Description: Performs accept on an ssl listen socket. e.i. performs
 %%              ssl handshake. 
@@ -223,12 +233,14 @@ ssl_accept(ListenSocket, SslOptions)  when is_port(ListenSocket) ->
     ssl_accept(ListenSocket, SslOptions, infinity).
 
 ssl_accept(Socket, SslOptions, Timeout) when is_port(Socket) -> 
+    {Transport,_,_,_} = 
+	proplists:get_value(cb_info, SslOptions, {gen_tcp, tcp, tcp_closed, tcp_error}),    
     EmulatedOptions = emulated_options(),
-    {ok, InetValues} = inet:getopts(Socket, EmulatedOptions),
-    ok = inet:setopts(Socket, internal_inet_values()),
-    try handle_options(SslOptions ++ InetValues, server) of
-	{ok, #config{cb=CbInfo,ssl=SslOpts, emulated=EmOpts}} ->
-	    {ok, Port} = inet:port(Socket),
+    {ok, SocketValues} = ssl_socket:getopts(Transport, Socket, EmulatedOptions),
+    try handle_options(SslOptions ++ SocketValues, server) of
+	{ok, #config{cb = CbInfo, ssl = SslOpts, emulated = EmOpts}} ->
+	    ok = ssl_socket:setopts(Transport, Socket, internal_inet_values()),
+	    {ok, Port} = ssl_socket:port(Transport, Socket),
 	    ssl_connection:ssl_accept(Port, Socket,
 				      {SslOpts, EmOpts},
 				      self(), CbInfo, Timeout)
@@ -241,18 +253,20 @@ ssl_accept(Socket, SslOptions, Timeout) when is_port(Socket) ->
 %%
 %% Description: Close an ssl connection
 %%--------------------------------------------------------------------  
-close(#sslsocket{pid = {ListenSocket, #config{cb={CbMod,_, _, _}}}}) ->
-    CbMod:close(ListenSocket);
-close(#sslsocket{pid = Pid}) ->
-    ssl_connection:close(Pid).
+close(#sslsocket{pid = Pid}) when is_pid(Pid) ->
+    ssl_connection:close(Pid);
+close(#sslsocket{pid = {ListenSocket, #config{cb={Transport,_, _, _}}}}) ->
+    Transport:close(ListenSocket).
 
 %%--------------------------------------------------------------------
 -spec send(#sslsocket{}, iodata()) -> ok | {error, reason()}.
 %% 
 %% Description: Sends data over the ssl connection
 %%--------------------------------------------------------------------
-send(#sslsocket{pid = Pid}, Data) ->
-    ssl_connection:send(Pid, Data).
+send(#sslsocket{pid = Pid}, Data) when is_pid(Pid) ->
+    ssl_connection:send(Pid, Data);
+send(#sslsocket{pid = {ListenSocket, #config{cb={Transport, _, _, _}}}}, Data) ->
+    Transport:send(ListenSocket, Data). %% {error,enotconn}
 
 %%--------------------------------------------------------------------
 -spec recv(#sslsocket{}, integer()) -> {ok, binary()| list()} | {error, reason()}.
@@ -262,8 +276,11 @@ send(#sslsocket{pid = Pid}, Data) ->
 %%--------------------------------------------------------------------
 recv(Socket, Length) ->
     recv(Socket, Length, infinity).
-recv(#sslsocket{pid = Pid, fd = new_ssl}, Length, Timeout) ->
-    ssl_connection:recv(Pid, Length, Timeout).
+recv(#sslsocket{pid = Pid}, Length, Timeout) when is_pid(Pid) ->
+    ssl_connection:recv(Pid, Length, Timeout);
+recv(#sslsocket{pid = {Listen, 
+		       #config{cb={Transport, _, _, _}}}}, _,_) when is_port(Listen)->
+    Transport:recv(Listen, 0). %% {error,enotconn}
 
 %%--------------------------------------------------------------------
 -spec controlling_process(#sslsocket{}, pid()) -> ok | {error, reason()}.
@@ -271,8 +288,13 @@ recv(#sslsocket{pid = Pid, fd = new_ssl}, Length, Timeout) ->
 %% Description: Changes process that receives the messages when active = true
 %% or once. 
 %%--------------------------------------------------------------------
-controlling_process(#sslsocket{pid = Pid}, NewOwner) when is_pid(Pid) ->
-    ssl_connection:new_user(Pid, NewOwner).
+controlling_process(#sslsocket{pid = Pid}, NewOwner) when is_pid(Pid), is_pid(NewOwner) ->
+    ssl_connection:new_user(Pid, NewOwner);
+controlling_process(#sslsocket{pid = {Listen,
+				      #config{cb={Transport, _, _, _}}}}, 
+		    NewOwner) when is_port(Listen),
+				   is_pid(NewOwner) ->
+    Transport:controlling_process(Listen, NewOwner).
 
 %%--------------------------------------------------------------------
 -spec connection_info(#sslsocket{}) -> 	{ok, {tls_atom_version(), erl_cipher_suite()}} | 
@@ -280,29 +302,35 @@ controlling_process(#sslsocket{pid = Pid}, NewOwner) when is_pid(Pid) ->
 %%
 %% Description: Returns ssl protocol and cipher used for the connection
 %%--------------------------------------------------------------------
-connection_info(#sslsocket{pid = Pid}) ->
-    ssl_connection:info(Pid).
+connection_info(#sslsocket{pid = Pid}) when is_pid(Pid) ->
+    ssl_connection:info(Pid);
+connection_info(#sslsocket{pid = {Listen, _}}) when is_port(Listen) ->
+    {error, enotconn}.
 
 %%--------------------------------------------------------------------
 -spec peername(#sslsocket{}) -> {ok, {inet:ip_address(), inet:port_number()}} | {error, reason()}.
 %%
 %% Description: same as inet:peername/1.
 %%--------------------------------------------------------------------
-peername(#sslsocket{pid = Pid}) ->
-    ssl_connection:peername(Pid).
+peername(#sslsocket{pid = Pid, fd = {Transport, Socket}}) when is_pid(Pid)->
+    ssl_socket:peername(Transport, Socket);
+peername(#sslsocket{pid = {ListenSocket,  #config{cb = {Transport,_,_,_}}}}) ->
+    ssl_socket:peername(Transport, ListenSocket). %% Will return {error, enotconn}
 
 %%--------------------------------------------------------------------
 -spec peercert(#sslsocket{}) ->{ok, DerCert::binary()} | {error, reason()}.
 %%
 %% Description: Returns the peercert.
 %%--------------------------------------------------------------------
-peercert(#sslsocket{pid = Pid}) ->
+peercert(#sslsocket{pid = Pid}) when is_pid(Pid) ->
     case ssl_connection:peer_certificate(Pid) of
 	{ok, undefined} ->
 	    {error, no_peercert};
         Result ->
 	    Result
-    end.
+    end;
+peercert(#sslsocket{pid = {Listen, _}}) when is_port(Listen) ->
+    {error, enotconn}.
 
 %%--------------------------------------------------------------------
 -spec suite_definition(cipher_suite()) -> erl_cipher_suite().
@@ -314,6 +342,14 @@ suite_definition(S) ->
     {KeyExchange, Cipher, Hash}.
 
 %%--------------------------------------------------------------------
+-spec negotiated_next_protocol(#sslsocket{}) -> {ok, binary()} | {error, reason()}.
+%%
+%% Description: Returns the next protocol that has been negotiated. If no
+%% protocol has been negotiated will return {error, next_protocol_not_negotiated}
+%%--------------------------------------------------------------------
+negotiated_next_protocol(#sslsocket{pid = Pid}) ->
+    ssl_connection:negotiated_next_protocol(Pid).
+
 -spec cipher_suites() -> [erl_cipher_suite()].
 -spec cipher_suites(erlang | openssl) -> [erl_cipher_suite()] | [string()].
 			   
@@ -338,18 +374,19 @@ cipher_suites(openssl) ->
 %%--------------------------------------------------------------------
 getopts(#sslsocket{pid = Pid}, OptionTags) when is_pid(Pid), is_list(OptionTags) ->
     ssl_connection:get_opts(Pid, OptionTags);
-getopts(#sslsocket{pid = {ListenSocket, _}}, OptionTags) when is_list(OptionTags) ->
-    try inet:getopts(ListenSocket, OptionTags) of
+getopts(#sslsocket{pid = {ListenSocket,  #config{cb = {Transport,_,_,_}}}}, 
+	OptionTags) when is_list(OptionTags) ->
+    try ssl_socket:getopts(Transport, ListenSocket, OptionTags) of
 	{ok, _} = Result ->
 	    Result;
 	{error, InetError} ->
-	    {error, {eoptions, {inet_options, OptionTags, InetError}}}
+	    {error, {options, {socket_options, OptionTags, InetError}}}
     catch
 	_:_ ->
-	    {error, {eoptions, {inet_options, OptionTags}}}
+	    {error, {options, {socket_options, OptionTags}}}
     end;
 getopts(#sslsocket{}, OptionTags) ->
-    {error, {eoptions, {inet_options, OptionTags}}}.
+    {error, {options, {socket_options, OptionTags}}}.
 
 %%--------------------------------------------------------------------
 -spec setopts(#sslsocket{},  [gen_tcp:option()]) -> ok | {error, reason()}.
@@ -363,29 +400,30 @@ setopts(#sslsocket{pid = Pid}, Options0) when is_pid(Pid), is_list(Options0)  ->
 	    ssl_connection:set_opts(Pid, Options)
     catch
 	_:_ ->
-	    {error, {eoptions, {not_a_proplist, Options0}}}
+	    {error, {options, {not_a_proplist, Options0}}}
     end;
 
-setopts(#sslsocket{pid = {ListenSocket, _}}, Options) when is_list(Options) ->
-    try inet:setopts(ListenSocket, Options) of
+setopts(#sslsocket{pid = {ListenSocket, #config{cb = {Transport,_,_,_}}}}, Options) when is_list(Options) ->
+    try ssl_socket:setopts(Transport, ListenSocket, Options) of
 	ok ->
 	    ok;
 	{error, InetError} ->
-	    {error, {eoptions, {inet_options, Options, InetError}}}
+	    {error, {options, {socket_options, Options, InetError}}}
     catch
 	_:Error ->
-	    {error, {eoptions, {inet_options, Options, Error}}}
+	    {error, {options, {socket_options, Options, Error}}}
     end;
 setopts(#sslsocket{}, Options) ->
-    {error, {eoptions,{not_a_proplist, Options}}}.
+    {error, {options,{not_a_proplist, Options}}}.
 
 %%---------------------------------------------------------------
 -spec shutdown(#sslsocket{}, read | write | read_write) ->  ok | {error, reason()}.
 %%		      
 %% Description: Same as gen_tcp:shutdown/2
 %%--------------------------------------------------------------------
-shutdown(#sslsocket{pid = {ListenSocket, #config{cb={CbMod,_, _, _}}}}, How) ->
-    CbMod:shutdown(ListenSocket, How);
+shutdown(#sslsocket{pid = {Listen, #config{cb={Transport,_, _, _}}}},
+	 How) when is_port(Listen) ->
+    Transport:shutdown(Listen, How);
 shutdown(#sslsocket{pid = Pid}, How) ->
     ssl_connection:shutdown(Pid, How).
 
@@ -394,11 +432,11 @@ shutdown(#sslsocket{pid = Pid}, How) ->
 %%		     
 %% Description: Same as inet:sockname/1
 %%--------------------------------------------------------------------
-sockname(#sslsocket{pid = {ListenSocket, _}}) ->
-    inet:sockname(ListenSocket);
+sockname(#sslsocket{pid = {Listen,  #config{cb={Transport,_, _, _}}}}) when is_port(Listen) ->
+    ssl_socket:sockname(Transport, Listen);
 
-sockname(#sslsocket{pid = Pid}) ->
-    ssl_connection:sockname(Pid).
+sockname(#sslsocket{pid = Pid, fd = {Transport, Socket}}) when is_pid(Pid) ->
+    ssl_socket:sockname(Transport, Socket).
 
 %%---------------------------------------------------------------
 -spec session_info(#sslsocket{}) -> {ok, list()} | {error, reason()}.
@@ -406,12 +444,14 @@ sockname(#sslsocket{pid = Pid}) ->
 %% Description: Returns list of session info currently [{session_id, session_id(),
 %% {cipher_suite, cipher_suite()}]
 %%--------------------------------------------------------------------
-session_info(#sslsocket{pid = Pid, fd = new_ssl}) ->
-    ssl_connection:session_info(Pid).
+session_info(#sslsocket{pid = Pid}) when is_pid(Pid) ->
+    ssl_connection:session_info(Pid);
+session_info(#sslsocket{pid = {Listen,_}}) when is_port(Listen) ->
+    {error, enotconn}.
 
 %%---------------------------------------------------------------
 -spec versions() -> [{ssl_app, string()} | {supported, [tls_atom_version()]} | 
-		      {available, [tls_atom_version()]}]. 
+		     {available, [tls_atom_version()]}].
 %%
 %% Description: Returns a list of relevant versions.
 %%--------------------------------------------------------------------
@@ -427,8 +467,10 @@ versions() ->
 %% 
 %% Description: Initiates a renegotiation.
 %%--------------------------------------------------------------------
-renegotiate(#sslsocket{pid = Pid, fd = new_ssl}) ->
-    ssl_connection:renegotiation(Pid).
+renegotiate(#sslsocket{pid = Pid}) when is_pid(Pid) ->
+    ssl_connection:renegotiation(Pid);
+renegotiate(#sslsocket{pid = {Listen,_}}) when is_port(Listen) ->
+    {error, enotconn}.
 
 %%--------------------------------------------------------------------
 -spec prf(#sslsocket{}, binary() | 'master_secret', binary(),
@@ -437,10 +479,11 @@ renegotiate(#sslsocket{pid = Pid, fd = new_ssl}) ->
 %%
 %% Description: use a ssl sessions TLS PRF to generate key material
 %%--------------------------------------------------------------------
-prf(#sslsocket{pid = Pid, fd = new_ssl},
-    Secret, Label, Seed, WantedLength) ->
-    ssl_connection:prf(Pid, Secret, Label, Seed, WantedLength).
-
+prf(#sslsocket{pid = Pid},
+    Secret, Label, Seed, WantedLength) when is_pid(Pid) ->
+    ssl_connection:prf(Pid, Secret, Label, Seed, WantedLength);
+prf(#sslsocket{pid = {Listen,_}}, _,_,_,_) when is_port(Listen) ->
+    {error, enotconn}.
 
 %%--------------------------------------------------------------------
 -spec clear_pem_cache() -> ok.
@@ -460,26 +503,26 @@ format_error({error, Reason}) ->
 format_error(Reason) when is_list(Reason) ->
     Reason;
 format_error(closed) ->
-    "The connection is closed";
-format_error(ecacertfile) ->
-    "Own CA certificate file is invalid.";
-format_error(ecertfile) ->
-    "Own certificate file is invalid.";
-format_error(ekeyfile) ->
-    "Own private key file is invalid.";
-format_error(esslaccept) ->
-    "Server SSL handshake procedure between client and server failed.";
-format_error(esslconnect) ->
-    "Client SSL handshake procedure between client and server failed.";
-format_error({eoptions, Options}) ->
-    lists:flatten(io_lib:format("Error in options list: ~p~n", [Options]));
+    "TLS connection is closed";
+format_error({tls_alert, Description}) ->
+    "TLS Alert: " ++ Description;
+format_error({options,{FileType, File, Reason}}) when FileType == cacertfile;
+						      FileType == certfile;
+						      FileType == keyfile;
+						      FileType == dhfile ->
+    Error = file_error_format(Reason),
+    file_desc(FileType) ++ File ++ ": " ++ Error;
+format_error({options, {socket_options, Option, Error}}) ->
+    lists:flatten(io_lib:format("Invalid transport socket option ~p: ~s", [Option, format_error(Error)]));
+format_error({options, {socket_options, Option}}) ->
+    lists:flatten(io_lib:format("Invalid socket option: ~p", [Option]));
+format_error({options, Options}) ->
+    lists:flatten(io_lib:format("Invalid TLS option: ~p", [Options]));
 
 format_error(Error) ->
-    case (catch inet:format_error(Error)) of
-        "unkknown POSIX" ++ _ ->
-            no_format(Error);
-        {'EXIT', _} ->
-            no_format(Error);
+    case inet:format_error(Error) of
+        "unknown POSIX" ++ _ ->
+            unexpected_format(Error);
         Other ->
             Other
     end.
@@ -500,7 +543,6 @@ random_bytes(N) ->
 	    crypto:rand_bytes(N)
     end.
 
-
 %%%--------------------------------------------------------------
 %%% Internal functions
 %%%--------------------------------------------------------------------
@@ -508,8 +550,8 @@ do_connect(Address, Port,
 	       #config{cb=CbInfo, inet_user=UserOpts, ssl=SslOpts,
 		       emulated=EmOpts,inet_ssl=SocketOpts},
 	       Timeout) ->
-    {CbModule, _, _, _} = CbInfo,    
-    try CbModule:connect(Address, Port,  SocketOpts, Timeout) of
+    {Transport, _, _, _} = CbInfo,    
+    try Transport:connect(Address, Port,  SocketOpts, Timeout) of
 	{ok, Socket} ->
 	    ssl_connection:connect(Address, Port, Socket, {SslOpts,EmOpts},
 				   self(), CbInfo, Timeout);
@@ -517,11 +559,11 @@ do_connect(Address, Port,
 	    {error, Reason}
     catch
 	exit:{function_clause, _} ->
-	    {error, {eoptions, {cb_info, CbInfo}}};
+	    {error, {options, {cb_info, CbInfo}}};
 	exit:badarg ->
-	    {error, {eoptions, {inet_options, UserOpts}}};
+	    {error, {options, {socket_options, UserOpts}}};
 	exit:{badarg, _} ->
-	    {error, {eoptions, {inet_options, UserOpts}}}
+	    {error, {options, {socket_options, UserOpts}}}
     end.
 
 handle_options(Opts0, _Role) ->
@@ -565,7 +607,7 @@ handle_options(Opts0, _Role) ->
 		{verify_peer, UserFailIfNoPeerCert,
 		 ca_cert_default(verify_peer, UserVerifyFun, CaCerts), UserVerifyFun};
 	    Value ->
-		throw({error, {eoptions, {verify, Value}}})
+		throw({error, {options, {verify, Value}}})
 	end,
 
     CertFile = handle_option(certfile, Opts, <<>>),
@@ -592,9 +634,13 @@ handle_options(Opts0, _Role) ->
       reuse_sessions = handle_option(reuse_sessions, Opts, true),
       secure_renegotiate = handle_option(secure_renegotiate, Opts, false),
       renegotiate_at = handle_option(renegotiate_at, Opts, ?DEFAULT_RENEGOTIATE_AT),
-      debug      = handle_option(debug, Opts, []),
       hibernate_after = handle_option(hibernate_after, Opts, undefined),
-      erl_dist = handle_option(erl_dist, Opts, false)
+      erl_dist = handle_option(erl_dist, Opts, false),
+      next_protocols_advertised = 
+			handle_option(next_protocols_advertised, Opts, undefined),
+      next_protocol_selector = 
+			make_next_protocol_selector(
+			  handle_option(client_preferred_next_protocols, Opts, undefined))
      },
 
     CbInfo  = proplists:get_value(cb_info, Opts, {gen_tcp, tcp, tcp_closed, tcp_error}),    
@@ -602,8 +648,10 @@ handle_options(Opts0, _Role) ->
 		  fail_if_no_peer_cert, verify_client_once,
 		  depth, cert, certfile, key, keyfile,
 		  password, cacerts, cacertfile, dh, dhfile, ciphers,
-		  debug, reuse_session, reuse_sessions, ssl_imp,
-		  cb_info, renegotiate_at, secure_renegotiate, hibernate_after, erl_dist],
+		  reuse_session, reuse_sessions, ssl_imp,
+		  cb_info, renegotiate_at, secure_renegotiate, hibernate_after, 
+		  erl_dist, next_protocols_advertised,
+		  client_preferred_next_protocols],
     
     SockOpts = lists:foldl(fun(Key, PropList) -> 
 				   proplists:delete(Key, PropList)
@@ -706,9 +754,9 @@ validate_option(ciphers, Value)  when is_list(Value) ->
     try cipher_suites(Version, Value)
     catch
 	exit:_ ->
-	    throw({error, {eoptions, {ciphers, Value}}});
+	    throw({error, {options, {ciphers, Value}}});
 	error:_->
-	    throw({error, {eoptions, {ciphers, Value}}})
+	    throw({error, {options, {ciphers, Value}}})
     end;
 validate_option(reuse_session, Value) when is_function(Value) ->
     Value;
@@ -722,18 +770,68 @@ validate_option(secure_renegotiate, Value) when Value == true;
 validate_option(renegotiate_at, Value) when is_integer(Value) ->
     erlang:min(Value, ?DEFAULT_RENEGOTIATE_AT);
 
-validate_option(debug, Value) when is_list(Value); Value == true ->
-    Value;
 validate_option(hibernate_after, undefined) ->
     undefined;
 validate_option(hibernate_after, Value) when is_integer(Value), Value >= 0 ->
     Value;
-validate_option(erl_dist,Value) when Value == true; 
+validate_option(erl_dist,Value) when Value == true;
 				     Value == false ->
     Value;
+validate_option(client_preferred_next_protocols = Opt, {Precedence, PreferredProtocols} = Value)
+  when is_list(PreferredProtocols) ->
+    case ssl_record:highest_protocol_version([]) of
+	{3,0} ->
+	    throw({error, {options, {not_supported_in_sslv3, {Opt, Value}}}});
+	_ ->
+	    validate_binary_list(client_preferred_next_protocols, PreferredProtocols),
+	    validate_npn_ordering(Precedence),
+	    {Precedence, PreferredProtocols, ?NO_PROTOCOL}
+    end;
+validate_option(client_preferred_next_protocols = Opt, {Precedence, PreferredProtocols, Default} = Value)
+      when is_list(PreferredProtocols), is_binary(Default),
+           byte_size(Default) > 0, byte_size(Default) < 256 ->
+    case ssl_record:highest_protocol_version([]) of
+	{3,0} ->
+	    throw({error, {options, {not_supported_in_sslv3, {Opt, Value}}}});
+	_ ->
+	    validate_binary_list(client_preferred_next_protocols, PreferredProtocols),
+	    validate_npn_ordering(Precedence),
+	    Value
+    end;
+	
+validate_option(client_preferred_next_protocols, undefined) ->
+    undefined;
+validate_option(next_protocols_advertised = Opt, Value) when is_list(Value) ->
+    case ssl_record:highest_protocol_version([]) of
+	{3,0} ->
+	    throw({error, {options, {not_supported_in_sslv3, {Opt, Value}}}});
+	_ ->
+	    validate_binary_list(next_protocols_advertised, Value),
+	    Value
+    end;
+
+validate_option(next_protocols_advertised, undefined) ->
+    undefined;
 validate_option(Opt, Value) ->
-    throw({error, {eoptions, {Opt, Value}}}).
-    
+    throw({error, {options, {Opt, Value}}}).
+
+validate_npn_ordering(client) ->
+    ok;
+validate_npn_ordering(server) ->
+    ok;
+validate_npn_ordering(Value) ->
+    throw({error, {options, {client_preferred_next_protocols, {invalid_precedence, Value}}}}).
+
+validate_binary_list(Opt, List) ->
+    lists:foreach(
+        fun(Bin) when is_binary(Bin),
+                      byte_size(Bin) > 0,
+                      byte_size(Bin) < 256 ->
+            ok;
+           (Bin) ->
+            throw({error, {options, {Opt, {invalid_protocol, Bin}}}})
+        end, List).
+
 validate_versions([], Versions) ->
     Versions;
 validate_versions([Version | Rest], Versions) when Version == 'tlsv1.2';
@@ -742,23 +840,23 @@ validate_versions([Version | Rest], Versions) when Version == 'tlsv1.2';
                                                    Version == sslv3 ->
     validate_versions(Rest, Versions);					   
 validate_versions([Ver| _], Versions) ->
-    throw({error, {eoptions, {Ver, {versions, Versions}}}}).
+    throw({error, {options, {Ver, {versions, Versions}}}}).
 
 validate_inet_option(mode, Value)
   when Value =/= list, Value =/= binary ->
-    throw({error, {eoptions, {mode,Value}}});
+    throw({error, {options, {mode,Value}}});
 validate_inet_option(packet, Value)
   when not (is_atom(Value) orelse is_integer(Value)) ->
-    throw({error, {eoptions, {packet,Value}}});
+    throw({error, {options, {packet,Value}}});
 validate_inet_option(packet_size, Value)
   when not is_integer(Value) ->
-    throw({error, {eoptions, {packet_size,Value}}});
+    throw({error, {options, {packet_size,Value}}});
 validate_inet_option(header, Value)
   when not is_integer(Value) ->
-    throw({error, {eoptions, {header,Value}}});
+    throw({error, {options, {header,Value}}});
 validate_inet_option(active, Value)
   when Value =/= true, Value =/= false, Value =/= once ->
-    throw({error, {eoptions, {active,Value}}});
+    throw({error, {options, {active,Value}}});
 validate_inet_option(_, _) ->
     ok.
 
@@ -782,10 +880,10 @@ internal_inet_values() ->
 
 socket_options(InetValues) ->
     #socket_options{
-		mode   = proplists:get_value(mode, InetValues),
-		header = proplists:get_value(header, InetValues),
-		active = proplists:get_value(active, InetValues),
-		packet = proplists:get_value(packet, InetValues),
+		mode   = proplists:get_value(mode, InetValues, lists),
+		header = proplists:get_value(header, InetValues, 0),
+		active = proplists:get_value(active, InetValues, active),
+		packet = proplists:get_value(packet, InetValues, 0),
 		packet_size = proplists:get_value(packet_size, InetValues)	     
 	       }.
 
@@ -837,16 +935,61 @@ cipher_suites(Version, Ciphers0)  ->
     Ciphers = [ssl_cipher:openssl_suite(C) || C <- string:tokens(Ciphers0, ":")],
     cipher_suites(Version, Ciphers).
 
-no_format(Error) ->    
-    lists:flatten(io_lib:format("No format string for error: \"~p\" available.", [Error])).
-                                
-%% Only used to remove exit messages from old ssl
-%% First is a nonsense clause to provide some
-%% backward compatibility for orber that uses this
-%% function in a none recommended way, but will
-%% work correctly if a valid pid is returned.
-%% Deprcated to be removed in r16
-pid(#sslsocket{fd = new_ssl}) ->
-     whereis(ssl_connection_sup);
-pid(#sslsocket{pid = Pid}) ->
-     Pid.
+unexpected_format(Error) ->    
+    lists:flatten(io_lib:format("Unexpected error: ~p", [Error])).
+
+file_error_format({error, Error})->
+    case file:format_error(Error) of 
+	"unknown POSIX error" ->
+	    "decoding error";
+	Str ->
+	    Str
+    end;
+file_error_format(_) ->
+    "decoding error".
+    
+file_desc(cacertfile) ->
+    "Invalid CA certificate file ";
+file_desc(certfile) ->
+    "Invalid certificate file ";
+file_desc(keyfile) ->
+    "Invalid key file "; 
+file_desc(dhfile) ->
+    "Invalid DH params file ".
+
+detect(_Pred, []) ->
+    undefined;
+detect(Pred, [H|T]) ->
+    case Pred(H) of
+        true ->
+            H;
+        _ ->
+            detect(Pred, T)
+    end.
+
+make_next_protocol_selector(undefined) ->
+    undefined;
+make_next_protocol_selector({client, AllProtocols, DefaultProtocol}) ->
+    fun(AdvertisedProtocols) ->
+        case detect(fun(PreferredProtocol) -> 
+			    lists:member(PreferredProtocol, AdvertisedProtocols) 
+		    end, AllProtocols) of
+            undefined -> 
+		DefaultProtocol;
+            PreferredProtocol -> 
+		PreferredProtocol
+        end
+    end;
+
+make_next_protocol_selector({server, AllProtocols, DefaultProtocol}) ->
+    fun(AdvertisedProtocols) ->
+	    case detect(fun(PreferredProtocol) -> 
+				lists:member(PreferredProtocol, AllProtocols) 
+			end, 
+			AdvertisedProtocols) of
+		undefined -> 
+		    DefaultProtocol;
+            PreferredProtocol -> 
+		    PreferredProtocol
+	    end
+    end.