1 files changed, 297 insertions, 148 deletions

diff --git a/lib/ssl/test/ssl_test_lib.erl b/lib/ssl/test/ssl_test_lib.erl
index 74fadc0cc7..da744f7368 100644
--- a/lib/ssl/test/ssl_test_lib.erl
+++ b/lib/ssl/test/ssl_test_lib.erl
@@ -1,18 +1,19 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2008-2013. All Rights Reserved.
+%% Copyright Ericsson AB 2008-2015. All Rights Reserved.
 %%
-%% The contents of this file are subject to the Erlang Public License,
-%% Version 1.1, (the "License"); you may not use this file except in
-%% compliance with the License. You should have received a copy of the
-%% Erlang Public License along with this software. If not, it can be
-%% retrieved online at http://www.erlang.org/.
+%% Licensed under the Apache License, Version 2.0 (the "License");
+%% you may not use this file except in compliance with the License.
+%% You may obtain a copy of the License at
 %%
-%% Software distributed under the License is distributed on an "AS IS"
-%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
-%% the License for the specific language governing rights and limitations
-%% under the License.
+%%     http://www.apache.org/licenses/LICENSE-2.0
+%%
+%% Unless required by applicable law or agreed to in writing, software
+%% distributed under the License is distributed on an "AS IS" BASIS,
+%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+%% See the License for the specific language governing permissions and
+%% limitations under the License.
 %%
 %% %CopyrightEnd%
 %%
@@ -60,14 +61,23 @@ run_server(Opts) ->
     Options = proplists:get_value(options, Opts),
     Pid = proplists:get_value(from, Opts),
     Transport =  proplists:get_value(transport, Opts, ssl),
-    ct:log("ssl:listen(~p, ~p)~n", [Port, Options]),
+    ct:log("~p:~p~nssl:listen(~p, ~p)~n", [?MODULE,?LINE, Port, Options]),
     {ok, ListenSocket} = rpc:call(Node, Transport, listen, [Port, Options]),
     Pid ! {listen, up},
     send_selected_port(Pid, Port, ListenSocket),
     run_server(ListenSocket, Opts).
 
 run_server(ListenSocket, Opts) ->
-    do_run_server(ListenSocket, connect(ListenSocket, Opts), Opts).
+    Accepters = proplists:get_value(accepters, Opts, 1),
+    run_server(ListenSocket, Opts, Accepters). 
+    
+run_server(ListenSocket, Opts, 1) ->
+    do_run_server(ListenSocket, connect(ListenSocket, Opts), Opts);
+run_server(ListenSocket, Opts, N) ->
+    Pid = proplists:get_value(from, Opts),
+    Server = spawn(?MODULE, run_server, [ListenSocket, Opts, 1]),
+    Pid ! {accepter, N, Server},
+    run_server(ListenSocket, Opts, N-1).
 
 do_run_server(_, {error, timeout} = Result, Opts)  ->
     Pid = proplists:get_value(from, Opts),
@@ -78,13 +88,13 @@ do_run_server(ListenSocket, AcceptSocket, Opts) ->
     Pid = proplists:get_value(from, Opts),
     Transport = proplists:get_value(transport, Opts, ssl),
     {Module, Function, Args} = proplists:get_value(mfa, Opts),
-    ct:log("Server: apply(~p,~p,~p)~n",
-		       [Module, Function, [AcceptSocket | Args]]),
+    ct:log("~p:~p~nServer: apply(~p,~p,~p)~n",
+		       [?MODULE,?LINE, Module, Function, [AcceptSocket | Args]]),
     case rpc:call(Node, Module, Function, [AcceptSocket | Args]) of
 	no_result_msg ->
 	    ok;
 	Msg ->
-	    ct:log("Server Msg: ~p ~n", [Msg]),
+	    ct:log("~p:~p~nServer Msg: ~p ~n", [?MODULE,?LINE, Msg]),
 	    Pid ! {self(), Msg}
     end,
     receive
@@ -93,10 +103,10 @@ do_run_server(ListenSocket, AcceptSocket, Opts) ->
 	{listen, MFA} ->
 	    run_server(ListenSocket, [MFA | proplists:delete(mfa, Opts)]);
 	close ->
-	    ct:log("Server closing  ~p ~n", [self()]),
+	    ct:log("~p:~p~nServer closing  ~p ~n", [?MODULE,?LINE, self()]),
 	    Result = rpc:call(Node, Transport, close, [AcceptSocket], 500),
 	    Result1 = rpc:call(Node, Transport, close, [ListenSocket], 500),
-	    ct:log("Result ~p : ~p ~n", [Result, Result1]);
+	    ct:log("~p:~p~nResult ~p : ~p ~n", [?MODULE,?LINE, Result, Result1]);
 	{ssl_closed, _} ->
 	    ok
     end.
@@ -106,7 +116,8 @@ connect(#sslsocket{} = ListenSocket, Opts) ->
     Node = proplists:get_value(node, Opts),
     ReconnectTimes =  proplists:get_value(reconnect_times, Opts, 0),
     Timeout = proplists:get_value(timeout, Opts, infinity),
-    AcceptSocket = connect(ListenSocket, Node, 1 + ReconnectTimes, dummy, Timeout),
+    SslOpts = proplists:get_value(ssl_extra_opts, Opts, []),
+    AcceptSocket = connect(ListenSocket, Node, 1 + ReconnectTimes, dummy, Timeout, SslOpts),
     case ReconnectTimes of
 	0 ->
 	    AcceptSocket;
@@ -116,27 +127,35 @@ connect(#sslsocket{} = ListenSocket, Opts) ->
     end;
 connect(ListenSocket, Opts) ->
     Node = proplists:get_value(node, Opts),
-    ct:log("gen_tcp:accept(~p)~n", [ListenSocket]),
+    ct:log("~p:~p~ngen_tcp:accept(~p)~n", [?MODULE,?LINE, ListenSocket]),
     {ok, AcceptSocket} = rpc:call(Node, gen_tcp, accept, 
 				  [ListenSocket]),
     AcceptSocket.
 
-connect(_, _, 0, AcceptSocket, _) ->
+connect(_, _, 0, AcceptSocket, _, _) ->
     AcceptSocket;
-connect(ListenSocket, Node, N, _, Timeout) ->
+
+connect(ListenSocket, Node, N, _, Timeout, []) ->
     ct:log("ssl:transport_accept(~p)~n", [ListenSocket]),
     {ok, AcceptSocket} = rpc:call(Node, ssl, transport_accept, 
 				  [ListenSocket]),    
-    ct:log("ssl:ssl_accept(~p, ~p)~n", [AcceptSocket, Timeout]),
+    ct:log("~p:~p~nssl:ssl_accept(~p, ~p)~n", [?MODULE,?LINE, AcceptSocket, Timeout]),
 
     case rpc:call(Node, ssl, ssl_accept, [AcceptSocket, Timeout]) of
 	ok ->
-	    connect(ListenSocket, Node, N-1, AcceptSocket, Timeout);
+	    connect(ListenSocket, Node, N-1, AcceptSocket, Timeout, []);
 	Result ->
+	    ct:log("~p:~p~nssl:ssl_accept@~p ret ~p",[?MODULE,?LINE, Node,Result]),
 	    Result
-    end.
+    end;
+connect(ListenSocket, Node, _, _, Timeout, Opts) ->
+    ct:log("ssl:transport_accept(~p)~n", [ListenSocket]),
+    {ok, AcceptSocket} = rpc:call(Node, ssl, transport_accept, 
+				  [ListenSocket]),    
+    ct:log("ssl:ssl_accept(~p,~p, ~p)~n", [AcceptSocket, Opts, Timeout]),
+    rpc:call(Node, ssl, ssl_accept, [AcceptSocket, Opts, Timeout]),
+    AcceptSocket.
 
-  
 remove_close_msg(0) ->
     ok;
 remove_close_msg(ReconnectTimes) ->
@@ -146,15 +165,21 @@ remove_close_msg(ReconnectTimes) ->
     end.
 	    
 start_client(Args) ->
-    Result = spawn_link(?MODULE, run_client, [lists:delete(return_socket, Args)]),
+    Result = spawn_link(?MODULE, run_client_init, [lists:delete(return_socket, Args)]),
     receive 
-	{ connected, Socket } ->
-        case lists:member(return_socket, Args) of
-            true -> { Result, Socket };
-            false -> Result
-        end
+	{connected, Socket} ->
+	    case lists:member(return_socket, Args) of
+		true -> {Result, Socket};
+		false -> Result
+	    end;
+	{connect_failed, Reason} ->
+	    {connect_failed, Reason}
     end.
 
+run_client_init(Opts) ->
+    put(retries, 0),
+    run_client(Opts).
+
 run_client(Opts) ->
     Node = proplists:get_value(node, Opts),
     Host = proplists:get_value(host, Opts),
@@ -162,72 +187,74 @@ run_client(Opts) ->
     Pid = proplists:get_value(from, Opts),
     Transport =  proplists:get_value(transport, Opts, ssl),
     Options = proplists:get_value(options, Opts),
-    ct:log("ssl:connect(~p, ~p, ~p)~n", [Host, Port, Options]),
+    ct:log("~p:~p~n~p:connect(~p, ~p)@~p~n", [?MODULE,?LINE, Transport, Host, Port, Node]),
+    ct:log("SSLOpts: ~p", [Options]),
     case rpc:call(Node, Transport, connect, [Host, Port, Options]) of
 	{ok, Socket} ->
-	    Pid ! { connected, Socket },
-	    ct:log("Client: connected~n", []),
+	    Pid ! {connected, Socket},
+	    ct:log("~p:~p~nClient: connected~n", [?MODULE,?LINE]),
 	    %% In special cases we want to know the client port, it will
 	    %% be indicated by sending {port, 0} in options list!
 	    send_selected_port(Pid,  proplists:get_value(port, Options), Socket),
 	    {Module, Function, Args} = proplists:get_value(mfa, Opts),
-	    ct:log("Client: apply(~p,~p,~p)~n",
-			       [Module, Function, [Socket | Args]]),
+	    ct:log("~p:~p~nClient: apply(~p,~p,~p)~n",
+			       [?MODULE,?LINE, Module, Function, [Socket | Args]]),
 	    case rpc:call(Node, Module, Function, [Socket | Args]) of
 		no_result_msg ->
 		    ok;
 		Msg ->
-		    ct:log("Client Msg: ~p ~n", [Msg]),
+		    ct:log("~p:~p~nClient Msg: ~p ~n", [?MODULE,?LINE, Msg]),
 		    Pid ! {self(), Msg}
 	    end,
 	    receive
 		close ->
-		    ct:log("Client closing~n", []),
+		    ct:log("~p:~p~nClient closing~n", [?MODULE,?LINE]),
 		    rpc:call(Node, Transport, close, [Socket]);
 		{ssl_closed, Socket} ->
 		    ok;
 		{gen_tcp, closed} ->
 		    ok
 	    end;
+	{error, econnrefused = Reason} ->
+	    case get(retries) of
+		N when N < 5 ->
+		    ct:log("~p:~p~neconnrefused retries=~p sleep ~p",[?MODULE,?LINE, N,?SLEEP]),
+		    put(retries, N+1),
+		    ct:sleep(?SLEEP),
+		    run_client(Opts);
+	       _ ->
+		    ct:log("~p:~p~nClient faild several times: connection failed: ~p ~n", [?MODULE,?LINE, Reason]),
+		    Pid ! {self(), {error, Reason}}
+	    end;
 	{error, Reason} ->
-	    ct:log("Client: connection failed: ~p ~n", [Reason]),
-	       Pid ! {self(), {error, Reason}}
+	    ct:log("~p:~p~nClient: connection failed: ~p ~n", [?MODULE,?LINE, Reason]),
+	    Pid ! {connect_failed, Reason};
+	{badrpc,BadRPC} ->
+            ct:log("~p:~p~nBad rpc: ~p",[?MODULE,?LINE, BadRPC]),
+            Pid ! {connect_failed, {badrpc,BadRPC}}
     end.
 
 close(Pid) ->
-    ct:log("Close ~p ~n", [Pid]),
+    ct:log("~p:~p~nClose ~p ~n", [?MODULE,?LINE, Pid]),
     Monitor = erlang:monitor(process, Pid),
     Pid ! close,
     receive
 	{'DOWN', Monitor, process, Pid, Reason} ->
 	    erlang:demonitor(Monitor),
-	    ct:log("Pid: ~p down due to:~p ~n", [Pid, Reason])
+	    ct:log("~p:~p~nPid: ~p down due to:~p ~n", [?MODULE,?LINE, Pid, Reason])
     end.
 
 check_result(Server, ServerMsg, Client, ClientMsg) -> 
     receive 
-	{Server, ServerMsg} -> 
-	    receive 
-		{Client, ClientMsg} ->
-		    ok;
-		Unexpected ->
-		    Reason = {{expected, {Client, ClientMsg}}, 
-			      {got, Unexpected}},
-		    ct:fail(Reason)
-	    end;
-	{Client, ClientMsg} -> 
-	    receive 
-		{Server, ServerMsg} ->
-		    ok;
-		Unexpected ->
-		    Reason = {{expected, {Server, ClientMsg}}, 
-			      {got, Unexpected}},
-		    ct:fail(Reason)
-	    end;
+	{Server, ServerMsg} ->
+	    check_result(Client, ClientMsg);
+
+	{Client, ClientMsg} ->
+	    check_result(Server, ServerMsg);
+
 	{Port, {data,Debug}} when is_port(Port) ->
-	    io:format("openssl ~s~n",[Debug]),
+	    ct:log("~p:~p~nopenssl ~s~n",[?MODULE,?LINE, Debug]),
 	    check_result(Server, ServerMsg, Client, ClientMsg);
-
 	Unexpected ->
 	    Reason = {{expected, {Client, ClientMsg}},
 		      {expected, {Server, ServerMsg}}, {got, Unexpected}},
@@ -239,8 +266,11 @@ check_result(Pid, Msg) ->
 	{Pid, Msg} -> 
 	    ok;
 	{Port, {data,Debug}} when is_port(Port) ->
-	    io:format("openssl ~s~n",[Debug]),
+	    ct:log("~p:~p~nopenssl ~s~n",[?MODULE,?LINE, Debug]),
 	    check_result(Pid,Msg);
+	%% {Port, {exit_status, Status}} when is_port(Port) ->
+	%%     ct:log("~p:~p Exit status: ~p~n",[?MODULE,?LINE, Status]),
+	%%    check_result(Pid, Msg);
 	Unexpected ->
 	    Reason = {{expected, {Pid, Msg}}, 
 		      {got, Unexpected}},
@@ -264,19 +294,28 @@ wait_for_result(Server, ServerMsg, Client, ClientMsg) ->
 		%%     Unexpected
 	    end;
 	{Port, {data,Debug}} when is_port(Port) ->
-	    io:format("openssl ~s~n",[Debug]),
+	    ct:log("~p:~p~nopenssl ~s~n",[?MODULE,?LINE, Debug]),
 	    wait_for_result(Server, ServerMsg, Client, ClientMsg)
 	%% Unexpected ->
 	%%     Unexpected
     end.
 
-
+check_ok([]) ->
+    ok;
+check_ok(Pids) ->
+    receive 
+	{Pid, ok} ->
+	    check_ok(lists:delete(Pid, Pids));
+	Other ->
+	    ct:fail({expected, {"pid()", ok}, got, Other})
+    end.
+	
 wait_for_result(Pid, Msg) -> 
     receive 
 	{Pid, Msg} -> 
 	    ok;
 	{Port, {data,Debug}} when is_port(Port) ->
-	    io:format("openssl ~s~n",[Debug]),
+	    ct:log("~p:~p~nopenssl ~s~n",[?MODULE,?LINE, Debug]),
 	    wait_for_result(Pid,Msg)
 	%% Unexpected ->
 	%%     Unexpected
@@ -316,6 +355,11 @@ cert_options(Config) ->
     BadKeyFile = filename:join([?config(priv_dir, Config), 
 			      "badkey.pem"]),
     PskSharedSecret = <<1,2,3,4,5,6,7,8,9,10,11,12,13,14,15>>,
+
+    SNIServerACertFile = filename:join([?config(priv_dir, Config), "a.server", "cert.pem"]),
+    SNIServerAKeyFile = filename:join([?config(priv_dir, Config), "a.server", "key.pem"]),
+    SNIServerBCertFile = filename:join([?config(priv_dir, Config), "b.server", "cert.pem"]),
+    SNIServerBKeyFile = filename:join([?config(priv_dir, Config), "b.server", "key.pem"]),
     [{client_opts, [{ssl_imp, new},{reuseaddr, true}]}, 
      {client_verification_opts, [{cacertfile, ClientCaCertFile}, 
 				{certfile, ClientCertFile},  
@@ -376,7 +420,17 @@ cert_options(Config) ->
      {server_bad_cert, [{ssl_imp, new},{cacertfile, ServerCaCertFile},
 			{certfile, BadCertFile}, {keyfile, ServerKeyFile}]},
      {server_bad_key, [{ssl_imp, new},{cacertfile, ServerCaCertFile},
-		       {certfile, ServerCertFile}, {keyfile, BadKeyFile}]}
+		       {certfile, ServerCertFile}, {keyfile, BadKeyFile}]},
+     {sni_server_opts, [{sni_hosts, [
+                                     {"a.server", [
+                                                   {certfile, SNIServerACertFile},
+                                                   {keyfile, SNIServerAKeyFile}
+                                                  ]},
+                                     {"b.server", [
+                                                   {certfile, SNIServerBCertFile},
+                                                   {keyfile, SNIServerBKeyFile}
+                                                  ]}
+                                    ]}]}
      | Config].
 
 
@@ -415,7 +469,7 @@ make_ecdsa_cert(Config) ->
 				  {cacertfile, ServerCaCertFile},
 				  {certfile, ServerCertFile}, {keyfile, ServerKeyFile}]},
 	     {server_ecdsa_verify_opts, [{ssl_imp, new},{reuseaddr, true},
-					 {cacertfile, ClientCaCertFile},
+					 {cacertfile, ServerCaCertFile},
 					 {certfile, ServerCertFile}, {keyfile, ServerKeyFile},
 					 {verify, verify_peer}]},
 	     {client_ecdsa_opts, [{ssl_imp, new},{reuseaddr, true},
@@ -440,7 +494,7 @@ make_ecdh_rsa_cert(Config) ->
 				     {cacertfile, ServerCaCertFile},
 				     {certfile, ServerCertFile}, {keyfile, ServerKeyFile}]},
 	     {server_ecdh_rsa_verify_opts, [{ssl_imp, new},{reuseaddr, true},
-					    {cacertfile, ClientCaCertFile},
+					    {cacertfile, ServerCaCertFile},
 					    {certfile, ServerCertFile}, {keyfile, ServerKeyFile},
 					    {verify, verify_peer}]},
 	     {client_ecdh_rsa_opts, [{ssl_imp, new},{reuseaddr, true},
@@ -501,33 +555,33 @@ run_upgrade_server(Opts) ->
     SslOptions = proplists:get_value(ssl_options, Opts),
     Pid = proplists:get_value(from, Opts),
 
-    ct:log("gen_tcp:listen(~p, ~p)~n", [Port, TcpOptions]),
+    ct:log("~p:~p~ngen_tcp:listen(~p, ~p)~n", [?MODULE,?LINE, Port, TcpOptions]),
     {ok, ListenSocket} = rpc:call(Node, gen_tcp, listen, [Port, TcpOptions]),
     Pid ! {listen, up},
     send_selected_port(Pid, Port, ListenSocket),
-    ct:log("gen_tcp:accept(~p)~n", [ListenSocket]),
+    ct:log("~p:~p~ngen_tcp:accept(~p)~n", [?MODULE,?LINE, ListenSocket]),
     {ok, AcceptSocket} = rpc:call(Node, gen_tcp, accept, [ListenSocket]),
 
     try
 	{ok, SslAcceptSocket} = case TimeOut of
 				    infinity ->
-					ct:log("ssl:ssl_accept(~p, ~p)~n",
-							   [AcceptSocket, SslOptions]),
+					ct:log("~p:~p~nssl:ssl_accept(~p, ~p)~n",
+							   [?MODULE,?LINE, AcceptSocket, SslOptions]),
 					rpc:call(Node, ssl, ssl_accept,
 						 [AcceptSocket, SslOptions]);
 				    _ ->
-					ct:log("ssl:ssl_accept(~p, ~p, ~p)~n",
-							   [AcceptSocket, SslOptions, TimeOut]),
+					ct:log("~p:~p~nssl:ssl_accept(~p, ~p, ~p)~n",
+							   [?MODULE,?LINE, AcceptSocket, SslOptions, TimeOut]),
 					rpc:call(Node, ssl, ssl_accept,
 						 [AcceptSocket, SslOptions, TimeOut])
 				end,
 	{Module, Function, Args} = proplists:get_value(mfa, Opts),
 	Msg = rpc:call(Node, Module, Function, [SslAcceptSocket | Args]),
-	ct:log("Upgrade Server Msg: ~p ~n", [Msg]),
+	ct:log("~p:~p~nUpgrade Server Msg: ~p ~n", [?MODULE,?LINE, Msg]),
 	Pid ! {self(), Msg},
 	receive
 	    close ->
-		ct:log("Upgrade Server closing~n", []),
+		ct:log("~p:~p~nUpgrade Server closing~n", [?MODULE,?LINE]),
 		rpc:call(Node, ssl, close, [SslAcceptSocket])
 	end
     catch error:{badmatch, Error} ->
@@ -545,24 +599,24 @@ run_upgrade_client(Opts) ->
     TcpOptions = proplists:get_value(tcp_options, Opts),
     SslOptions = proplists:get_value(ssl_options, Opts),
     
-    ct:log("gen_tcp:connect(~p, ~p, ~p)~n",
-		       [Host, Port, TcpOptions]),
+    ct:log("~p:~p~ngen_tcp:connect(~p, ~p, ~p)~n",
+		       [?MODULE,?LINE, Host, Port, TcpOptions]),
     {ok, Socket} = rpc:call(Node, gen_tcp, connect, [Host, Port, TcpOptions]),
 
     send_selected_port(Pid, Port, Socket),
 
-    ct:log("ssl:connect(~p, ~p)~n", [Socket, SslOptions]),
+    ct:log("~p:~p~nssl:connect(~p, ~p)~n", [?MODULE,?LINE, Socket, SslOptions]),
     {ok, SslSocket} = rpc:call(Node, ssl, connect, [Socket, SslOptions]),
 
     {Module, Function, Args} = proplists:get_value(mfa, Opts),
-    ct:log("apply(~p, ~p, ~p)~n",
-		       [Module, Function, [SslSocket | Args]]),
+    ct:log("~p:~p~napply(~p, ~p, ~p)~n",
+		       [?MODULE,?LINE, Module, Function, [SslSocket | Args]]),
     Msg = rpc:call(Node, Module, Function, [SslSocket | Args]),
-    ct:log("Upgrade Client Msg: ~p ~n", [Msg]),
+    ct:log("~p:~p~nUpgrade Client Msg: ~p ~n", [?MODULE,?LINE, Msg]),
     Pid ! {self(), Msg},
     receive 
 	close ->
-	    ct:log("Upgrade Client closing~n", []),
+	    ct:log("~p:~p~nUpgrade Client closing~n", [?MODULE,?LINE]),
 	    rpc:call(Node, ssl, close, [SslSocket])
     end.
 
@@ -581,21 +635,21 @@ run_upgrade_server_error(Opts) ->
     SslOptions = proplists:get_value(ssl_options, Opts),
     Pid = proplists:get_value(from, Opts),
 
-    ct:log("gen_tcp:listen(~p, ~p)~n", [Port, TcpOptions]),
+    ct:log("~p:~p~ngen_tcp:listen(~p, ~p)~n", [?MODULE,?LINE, Port, TcpOptions]),
     {ok, ListenSocket} = rpc:call(Node, gen_tcp, listen, [Port, TcpOptions]),
     Pid ! {listen, up},
     send_selected_port(Pid, Port, ListenSocket),
-    ct:log("gen_tcp:accept(~p)~n", [ListenSocket]),
+    ct:log("~p:~p~ngen_tcp:accept(~p)~n", [?MODULE,?LINE, ListenSocket]),
     {ok, AcceptSocket} = rpc:call(Node, gen_tcp, accept, [ListenSocket]),
     Error = case TimeOut of
 		infinity ->
-		    ct:log("ssl:ssl_accept(~p, ~p)~n",
-				       [AcceptSocket, SslOptions]),
+		    ct:log("~p:~p~nssl:ssl_accept(~p, ~p)~n",
+				       [?MODULE,?LINE, AcceptSocket, SslOptions]),
 		    rpc:call(Node, ssl, ssl_accept,
 			     [AcceptSocket, SslOptions]);
 		_ ->
-		    ct:log("ssl:ssl_accept(~p, ~p, ~p)~n",
-				       [AcceptSocket, SslOptions, TimeOut]),
+		    ct:log("~p:~p~nssl:ssl_accept(~p, ~p, ~p)~n",
+				       [?MODULE,?LINE, AcceptSocket, SslOptions, TimeOut]),
 		    rpc:call(Node, ssl, ssl_accept,
 			     [AcceptSocket, SslOptions, TimeOut])
 	    end,
@@ -614,26 +668,26 @@ run_server_error(Opts) ->
     Options = proplists:get_value(options, Opts),
     Pid = proplists:get_value(from, Opts),
     Transport =  proplists:get_value(transport, Opts, ssl),
-    ct:log("ssl:listen(~p, ~p)~n", [Port, Options]),
+    ct:log("~p:~p~nssl:listen(~p, ~p)~n", [?MODULE,?LINE, Port, Options]),
     case rpc:call(Node, Transport, listen, [Port, Options]) of
 	{ok, #sslsocket{} = ListenSocket} ->
 	    %% To make sure error_client will
 	    %% get {error, closed} and not {error, connection_refused}
 	    Pid ! {listen, up},
 	    send_selected_port(Pid, Port, ListenSocket),
-	    ct:log("ssl:transport_accept(~p)~n", [ListenSocket]),
+	    ct:log("~p:~p~nssl:transport_accept(~p)~n", [?MODULE,?LINE, ListenSocket]),
 	    case rpc:call(Node, Transport, transport_accept, [ListenSocket]) of
 		{error, _} = Error ->
 		    Pid ! {self(), Error};
 		{ok, AcceptSocket} ->
-		    ct:log("ssl:ssl_accept(~p)~n", [AcceptSocket]),
+		    ct:log("~p:~p~nssl:ssl_accept(~p)~n", [?MODULE,?LINE, AcceptSocket]),
 		    Error = rpc:call(Node, ssl, ssl_accept, [AcceptSocket]),
 		    Pid ! {self(), Error}
 	    end;
 	{ok, ListenSocket} ->
 	    Pid ! {listen, up},
 	    send_selected_port(Pid, Port, ListenSocket),
-	    ct:log("~p:accept(~p)~n", [Transport, ListenSocket]),
+	    ct:log("~p:~p~n~p:accept(~p)~n", [?MODULE,?LINE, Transport, ListenSocket]),
 	     case rpc:call(Node, Transport, accept, [ListenSocket]) of
 		{error, _} = Error ->
 		     Pid ! {self(), Error}
@@ -655,10 +709,21 @@ run_client_error(Opts) ->
     Pid = proplists:get_value(from, Opts),
     Transport = proplists:get_value(transport, Opts, ssl),
     Options = proplists:get_value(options, Opts),
-    ct:log("ssl:connect(~p, ~p, ~p)~n", [Host, Port, Options]),
+    ct:log("~p:~p~nssl:connect(~p, ~p, ~p)~n", [?MODULE,?LINE, Host, Port, Options]),
     Error = rpc:call(Node, Transport, connect, [Host, Port, Options]),
     Pid ! {self(), Error}.
 
+accepters(N) ->
+    accepters([], N).
+
+accepters(Acc, 0) ->
+    Acc;
+accepters(Acc, N) ->
+    receive 
+	{accepter, _, Server} ->
+	    accepters([Server| Acc], N-1)
+    end.
+
 inet_port(Pid) when is_pid(Pid)->
     receive
 	{Pid, {port, Port}} ->
@@ -714,7 +779,12 @@ send_selected_port(_,_,_) ->
 
 rsa_suites(CounterPart) ->
     ECC = is_sane_ecc(CounterPart),
-    lists:filter(fun({rsa, _, _}) ->
+    FIPS = is_fips(CounterPart),
+    lists:filter(fun({rsa, des_cbc, sha}) when FIPS == true ->
+			 false;
+		    ({dhe_rsa, des_cbc, sha}) when FIPS == true ->
+			 false;
+		    ({rsa, _, _}) ->
 			 true;
 		    ({dhe_rsa, _, _}) ->
 			 true;
@@ -765,48 +835,34 @@ openssl_rsa_suites(CounterPart) ->
 		false ->
 		    "DSS | ECDHE | ECDH"
 		end,
-    lists:filter(fun(Str) ->
-			 case re:run(Str, Names,[]) of
-			     nomatch ->
-				 false;
-			     _ ->
-				 true
-			 end 
-		     end, Ciphers).
+    lists:filter(fun(Str) -> string_regex_filter(Str, Names)
+		 end, Ciphers).
 
 openssl_dsa_suites() ->
     Ciphers = ssl:cipher_suites(openssl),
-    lists:filter(fun(Str) ->
-			 case re:run(Str,"DSS",[]) of
-			     nomatch ->
-				 false;
-			     _ ->
-				 true
-			 end 
+    lists:filter(fun(Str) -> string_regex_filter(Str, "DSS")
 		 end, Ciphers).
 
 openssl_ecdsa_suites() ->
     Ciphers = ssl:cipher_suites(openssl),
-    lists:filter(fun(Str) ->
-			 case re:run(Str,"ECDHE-ECDSA",[]) of
-			     nomatch ->
-				 false;
-			     _ ->
-				 true
-			 end
+    lists:filter(fun(Str) -> string_regex_filter(Str, "ECDHE-ECDSA")
 		 end, Ciphers).
 
 openssl_ecdh_rsa_suites() ->
     Ciphers = ssl:cipher_suites(openssl),
-    lists:filter(fun(Str) ->
-			 case re:run(Str,"ECDH-RSA",[]) of
-			     nomatch ->
-				 false;
-			     _ ->
-				 true
-			 end
+    lists:filter(fun(Str) -> string_regex_filter(Str, "ECDH-RSA")
 		 end, Ciphers).
 
+string_regex_filter(Str, Search) when is_list(Str) ->
+    case re:run(Str, Search, []) of
+	nomatch ->
+	    false;
+	_ ->
+	    true
+    end;
+string_regex_filter(_Str, _Search) ->
+    false.
+
 anonymous_suites() ->
     Suites =
 	[{dh_anon, rc4_128, md5},
@@ -814,6 +870,8 @@ anonymous_suites() ->
 	 {dh_anon, '3des_ede_cbc', sha},
 	 {dh_anon, aes_128_cbc, sha},
 	 {dh_anon, aes_256_cbc, sha},
+	 {dh_anon, aes_128_gcm, null},
+	 {dh_anon, aes_256_gcm, null},
 	 {ecdh_anon,rc4_128,sha},
 	 {ecdh_anon,'3des_ede_cbc',sha},
 	 {ecdh_anon,aes_128_cbc,sha},
@@ -826,25 +884,39 @@ psk_suites() ->
 	 {psk, '3des_ede_cbc', sha},
 	 {psk, aes_128_cbc, sha},
 	 {psk, aes_256_cbc, sha},
+	 {psk, aes_128_cbc, sha256},
+	 {psk, aes_256_cbc, sha384},
 	 {dhe_psk, rc4_128, sha},
 	 {dhe_psk, '3des_ede_cbc', sha},
 	 {dhe_psk, aes_128_cbc, sha},
 	 {dhe_psk, aes_256_cbc, sha},
+	 {dhe_psk, aes_128_cbc, sha256},
+	 {dhe_psk, aes_256_cbc, sha384},
 	 {rsa_psk, rc4_128, sha},
 	 {rsa_psk, '3des_ede_cbc', sha},
 	 {rsa_psk, aes_128_cbc, sha},
-	 {rsa_psk, aes_256_cbc, sha}],
+	 {rsa_psk, aes_256_cbc, sha},
+	 {rsa_psk, aes_128_cbc, sha256},
+	 {rsa_psk, aes_256_cbc, sha384},
+	 {psk, aes_128_gcm, null},
+	 {psk, aes_256_gcm, null},
+	 {dhe_psk, aes_128_gcm, null},
+	 {dhe_psk, aes_256_gcm, null},
+	 {rsa_psk, aes_128_gcm, null},
+	 {rsa_psk, aes_256_gcm, null}],
     ssl_cipher:filter_suites(Suites).
 
 psk_anon_suites() ->
-    [{psk, rc4_128, sha},
-     {psk, '3des_ede_cbc', sha},
-     {psk, aes_128_cbc, sha},
-     {psk, aes_256_cbc, sha},
-     {dhe_psk, rc4_128, sha},
-     {dhe_psk, '3des_ede_cbc', sha},
-     {dhe_psk, aes_128_cbc, sha},
-     {dhe_psk, aes_256_cbc, sha}].
+    Suites =
+	[{psk, rc4_128, sha},
+	 {psk, '3des_ede_cbc', sha},
+	 {psk, aes_128_cbc, sha},
+	 {psk, aes_256_cbc, sha},
+	 {dhe_psk, rc4_128, sha},
+	 {dhe_psk, '3des_ede_cbc', sha},
+	 {dhe_psk, aes_128_cbc, sha},
+	 {dhe_psk, aes_256_cbc, sha}],
+    ssl_cipher:filter_suites(Suites).
 
 srp_suites() ->
     Suites =
@@ -857,9 +929,11 @@ srp_suites() ->
     ssl_cipher:filter_suites(Suites).
 
 srp_anon_suites() ->
-    [{srp_anon, '3des_ede_cbc', sha},
-     {srp_anon, aes_128_cbc, sha},
-     {srp_anon, aes_256_cbc, sha}].
+    Suites =
+	[{srp_anon, '3des_ede_cbc', sha},
+	 {srp_anon, aes_128_cbc, sha},
+	 {srp_anon, aes_256_cbc, sha}],
+    ssl_cipher:filter_suites(Suites).
 
 srp_dss_suites() ->
     Suites =
@@ -868,6 +942,10 @@ srp_dss_suites() ->
 	 {srp_dss, aes_256_cbc, sha}],
     ssl_cipher:filter_suites(Suites).
 
+rc4_suites(Version) ->
+    Suites = ssl_cipher:rc4_suites(Version),
+    ssl_cipher:filter_suites(Suites).
+
 pem_to_der(File) ->
     {ok, PemBin} = file:read_file(File),
     public_key:pem_decode(PemBin).
@@ -877,8 +955,9 @@ der_to_pem(File, Entries) ->
     file:write_file(File, PemBin).
 
 cipher_result(Socket, Result) ->
-    Result = ssl:connection_info(Socket),
-    ct:log("Successfull connect: ~p~n", [Result]),
+    {ok, Info} = ssl:connection_information(Socket),
+    Result = {ok, {proplists:get_value(protocol, Info), proplists:get_value(cipher_suite, Info)}},
+    ct:log("~p:~p~nSuccessfull connect: ~p~n", [?MODULE,?LINE, Result]),
     %% Importante to send two packets here
     %% to properly test "cipher state" handling
     ssl:send(Socket, "Hello\n"),
@@ -1017,6 +1096,25 @@ is_sane_ecc(crypto) ->
 is_sane_ecc(_) ->
     true.
 
+is_fips(openssl) ->
+    VersionStr = os:cmd("openssl version"),
+    case re:split(VersionStr, "fips") of
+	[_] ->
+	    false;
+	_ ->
+	    true
+    end;
+is_fips(crypto) ->
+    [{_,_, Bin}]  = crypto:info_lib(),
+    case re:split(Bin, <<"fips">>) of
+	[_] ->
+	    false;
+	_ ->
+	    true
+    end;
+is_fips(_) ->
+    false.
+
 cipher_restriction(Config0) ->
     case is_sane_ecc(openssl) of
 	false ->
@@ -1033,6 +1131,8 @@ cipher_restriction(Config0) ->
 
 check_sane_openssl_version(Version) ->
     case {Version, os:cmd("openssl version")} of
+	{_, "OpenSSL 1.0.2" ++ _} ->
+	    true;
 	{_, "OpenSSL 1.0.1" ++ _} ->
 	    true;
 	{'tlsv1.2', "OpenSSL 1.0" ++ _} ->
@@ -1047,15 +1147,20 @@ check_sane_openssl_version(Version) ->
 	    true
     end.
 
-wait_for_openssl_server() ->
-    receive
-	{Port, {data, Debug}} when is_port(Port) ->
-	    ct:log("openssl ~s~n",[Debug]),
-	    %% openssl has started make sure
-	    %% it will be in accept. Parsing
-	    %% output is too error prone. (Even
-	    %% more so than sleep!)
-	    ct:sleep(?SLEEP)
+enough_openssl_crl_support("OpenSSL 0." ++ _) -> false;
+enough_openssl_crl_support(_) -> true.
+
+wait_for_openssl_server(Port) ->
+    wait_for_openssl_server(Port, 10).
+wait_for_openssl_server(_, 0) ->
+    exit(failed_to_connect_to_openssl);
+wait_for_openssl_server(Port, N) ->
+    case gen_tcp:connect("localhost", Port, []) of
+	{ok, S} ->
+	    gen_tcp:close(S);
+	_  ->
+	    ct:sleep(?SLEEP),
+	    wait_for_openssl_server(Port, N-1)
     end.
 
 version_flag(tlsv1) ->
@@ -1066,3 +1171,47 @@ version_flag('tlsv1.2') ->
     " -tls1_2 ";
 version_flag(sslv3) ->
     " -ssl3 ".
+
+filter_suites(Ciphers0) ->
+    Version = tls_record:highest_protocol_version([]),
+    Supported0 = ssl_cipher:suites(Version)
+	++ ssl_cipher:anonymous_suites(Version)
+	++ ssl_cipher:psk_suites(Version)
+	++ ssl_cipher:srp_suites() 
+	++ ssl_cipher:rc4_suites(Version),
+    Supported1 = ssl_cipher:filter_suites(Supported0),
+    Supported2 = [ssl:suite_definition(S) || S <- Supported1],
+    [Cipher || Cipher <- Ciphers0, lists:member(Cipher, Supported2)].
+
+-define(OPENSSL_QUIT, "Q\n").
+close_port(Port) ->
+    catch port_command(Port, ?OPENSSL_QUIT),
+    close_loop(Port, 500, false).
+
+close_loop(Port, Time, SentClose) ->
+    receive 
+	{Port, {data,Debug}} when is_port(Port) ->
+	    ct:log("openssl ~s~n",[Debug]),
+	    close_loop(Port, Time, SentClose);	
+	{ssl,_,Msg} ->
+	    ct:log("ssl Msg ~s~n",[Msg]),
+	    close_loop(Port, Time, SentClose);	
+	{Port, closed} -> 
+	    ct:log("Port Closed~n",[]),
+	    ok;
+	{'EXIT', Port, Reason} ->
+	    ct:log("Port Closed ~p~n",[Reason]),
+	    ok;
+	Msg ->
+	    ct:log("Port Msg ~p~n",[Msg]),
+	    close_loop(Port, Time, SentClose)
+    after Time ->
+	    case SentClose of
+		false -> 
+		    ct:log("Closing port ~n",[]),
+		    catch erlang:port_close(Port),
+		    close_loop(Port, Time, true);
+		true ->
+		    ct:log("Timeout~n",[])
+	    end
+    end.