Merge neptunus.(none):/home/msvensson/mysql/yassl_import/my50-yassl_import

into  neptunus.(none):/home/msvensson/mysql/mysql-5.0-maint


extra/yassl/src/Makefile.am:
  Auto merged
extra/yassl/taocrypt/benchmark/Makefile.am:
  Auto merged
extra/yassl/taocrypt/src/Makefile.am:
  Auto merged
extra/yassl/taocrypt/test/Makefile.am:
  Auto merged
extra/yassl/testsuite/Makefile.am:
  Auto merged

11 files changed, 582 insertions, 128 deletions

diff --git a/extra/yassl/src/Makefile.am b/extra/yassl/src/Makefile.am
index b68abc11422..910bbbdd13f 100644
--- a/extra/yassl/src/Makefile.am
+++ b/extra/yassl/src/Makefile.am
@@ -1,4 +1,4 @@
-INCLUDES = -I../include -I../taocrypt/include -I../mySTL
+INCLUDES = -I../include -I../taocrypt/include -I../taocrypt/mySTL
 
 noinst_LTLIBRARIES = libyassl.la
 libyassl_la_SOURCES = buffer.cpp cert_wrapper.cpp crypto_wrapper.cpp \
diff --git a/extra/yassl/src/cert_wrapper.cpp b/extra/yassl/src/cert_wrapper.cpp
index 6ad0aa568ed..c3ae9c0c561 100644
--- a/extra/yassl/src/cert_wrapper.cpp
+++ b/extra/yassl/src/cert_wrapper.cpp
@@ -63,8 +63,8 @@ x509::x509(const x509& that) : length_(that.length_),
 
 void x509::Swap(x509& that)
 {
-    mySTL::swap(length_, that.length_);
-    mySTL::swap(buffer_, that.buffer_);
+    STL::swap(length_, that.length_);
+    STL::swap(buffer_, that.buffer_);
 }
 
 
@@ -105,11 +105,11 @@ CertManager::~CertManager()
 {
     ysDelete(peerX509_);
 
-    mySTL::for_each(signers_.begin(), signers_.end(), del_ptr_zero()) ;
+    STL::for_each(signers_.begin(), signers_.end(), del_ptr_zero()) ;
 
-    mySTL::for_each(peerList_.begin(), peerList_.end(), del_ptr_zero()) ;
+    STL::for_each(peerList_.begin(), peerList_.end(), del_ptr_zero()) ;
 
-    mySTL::for_each(list_.begin(), list_.end(), del_ptr_zero()) ;
+    STL::for_each(list_.begin(), list_.end(), del_ptr_zero()) ;
 }
 
 
@@ -242,7 +242,7 @@ uint CertManager::get_privateKeyLength() const
 // Validate the peer's certificate list, from root to peer (last to first)
 int CertManager::Validate()
 {
-    CertList::iterator last  = peerList_.rbegin();  // fix this
+    CertList::reverse_iterator last = peerList_.rbegin();
     int count = peerList_.size();
 
     while ( count > 1 ) {
@@ -255,7 +255,7 @@ int CertManager::Validate()
         const TaoCrypt::PublicKey& key = cert.GetPublicKey();
         signers_.push_back(NEW_YS TaoCrypt::Signer(key.GetKey(), key.size(),
                                         cert.GetCommonName(), cert.GetHash()));
-        --last;
+        ++last;
         --count;
     }
 
@@ -310,6 +310,23 @@ int CertManager::SetPrivateKey(const x509& key)
 }
 
 
+// Store OpenSSL type peer's cert
+void CertManager::setPeerX509(X509* x)
+{
+    assert(peerX509_ == 0);
+    if (x == 0) return;
+
+    X509_NAME* issuer   = x->GetIssuer();
+    X509_NAME* subject  = x->GetSubject();
+    ASN1_STRING* before = x->GetBefore();
+    ASN1_STRING* after  = x->GetAfter();
+
+    peerX509_ = NEW_YS X509(issuer->GetName(), issuer->GetLength(),
+        subject->GetName(), subject->GetLength(), (const char*) before->data,
+        before->length, (const char*) after->data, after->length);
+}
+
+
 #if defined(USE_CML_LIB)
 
 // Get the peer's certificate, extract and save public key
diff --git a/extra/yassl/src/crypto_wrapper.cpp b/extra/yassl/src/crypto_wrapper.cpp
index 799106ec7c0..7344a70b367 100644
--- a/extra/yassl/src/crypto_wrapper.cpp
+++ b/extra/yassl/src/crypto_wrapper.cpp
@@ -908,7 +908,7 @@ void DiffieHellman::get_parms(byte* bp, byte* bg, byte* bpub) const
 
 
 // convert PEM file to DER x509 type
-x509* PemToDer(FILE* file, CertType type)
+x509* PemToDer(FILE* file, CertType type, EncryptedInfo* info)
 {
     using namespace TaoCrypt;
 
@@ -935,6 +935,37 @@ x509* PemToDer(FILE* file, CertType type)
             break;
         }
 
+    // remove encrypted header if there
+    if (fgets(line, sizeof(line), file)) {
+        char encHeader[] = "Proc-Type";
+        if (strncmp(encHeader, line, strlen(encHeader)) == 0 &&
+            fgets(line,sizeof(line), file)) {
+
+            char* start  = strstr(line, "DES");
+            char* finish = strstr(line, ",");
+            if (!start)
+                start    = strstr(line, "AES");
+
+            if (!info) return 0;
+
+            if ( start && finish && (start < finish)) {
+                memcpy(info->name, start, finish - start);
+                info->name[finish - start] = 0;
+                memcpy(info->iv, finish + 1, sizeof(info->iv));
+
+                char* newline = strstr(line, "\r");
+                if (!newline) newline = strstr(line, "\n");
+                if (newline && (newline > finish)) {
+                    info->ivSz = newline - (finish + 1);
+                    info->set = true;
+                }
+            }
+            fgets(line,sizeof(line), file); // get blank line
+            begin = ftell(file);
+        }
+          
+    }
+
     while(fgets(line, sizeof(line), file))
         if (strncmp(footer, line, strlen(footer)) == 0) {
             foundEnd = true;
@@ -956,7 +987,7 @@ x509* PemToDer(FILE* file, CertType type)
     Base64Decoder b64Dec(der);
 
     uint sz = der.size();
-    mySTL::auto_ptr<x509> x(NEW_YS x509(sz), ysDelete);
+    mySTL::auto_ptr<x509> x(NEW_YS x509(sz));
     memcpy(x->use_buffer(), der.get_buffer(), sz);
 
     return x.release();
diff --git a/extra/yassl/src/handshake.cpp b/extra/yassl/src/handshake.cpp
index e93f5385b3d..25f36c4ea8c 100644
--- a/extra/yassl/src/handshake.cpp
+++ b/extra/yassl/src/handshake.cpp
@@ -37,7 +37,6 @@
 
 namespace yaSSL {
 
-using mySTL::min;
 
 
 // Build a client hello message from cipher suites and compression method
@@ -363,7 +362,7 @@ void p_hash(output_buffer& result, const output_buffer& secret,
     uint   lastLen = result.get_capacity() % len;
     opaque previous[SHA_LEN];  // max size
     opaque current[SHA_LEN];   // max size
-    mySTL::auto_ptr<Digest> hmac(ysDelete);
+    mySTL::auto_ptr<Digest> hmac;
 
     if (lastLen) times += 1;
 
@@ -582,7 +581,7 @@ void hmac(SSL& ssl, byte* digest, const byte* buffer, uint sz,
 void TLS_hmac(SSL& ssl, byte* digest, const byte* buffer, uint sz,
               ContentType content, bool verify)
 {
-    mySTL::auto_ptr<Digest> hmac(ysDelete);
+    mySTL::auto_ptr<Digest> hmac;
     opaque seq[SEQ_SZ] = { 0x00, 0x00, 0x00, 0x00 };
     opaque length[LENGTH_SZ];
     opaque inner[SIZEOF_ENUM + VERSION_SZ + LENGTH_SZ]; // type + version + len
@@ -660,25 +659,25 @@ void build_certHashes(SSL& ssl, Hashes& hashes)
 
 
 
-// do process input requests
-mySTL::auto_ptr<input_buffer>
-DoProcessReply(SSL& ssl, mySTL::auto_ptr<input_buffer> buffered)
+// do process input requests, return 0 is done, 1 is call again to complete
+int DoProcessReply(SSL& ssl)
 {
     // wait for input if blocking
     if (!ssl.useSocket().wait()) {
       ssl.SetError(receive_error);
-        buffered.reset(0);
-        return buffered;
+        return 0;
     }
     uint ready = ssl.getSocket().get_ready();
-    if (!ready) return buffered; 
+    if (!ready) return 1; 
 
     // add buffered data if its there
-    uint buffSz = buffered.get() ? buffered.get()->get_size() : 0;
+    input_buffer* buffered = ssl.useBuffers().TakeRawInput();
+    uint buffSz = buffered ? buffered->get_size() : 0;
     input_buffer buffer(buffSz + ready);
     if (buffSz) {
-        buffer.assign(buffered.get()->get_buffer(), buffSz);
-        buffered.reset(0);
+        buffer.assign(buffered->get_buffer(), buffSz);
+        ysDelete(buffered);
+        buffered = 0;
     }
 
     // add new data
@@ -692,10 +691,8 @@ DoProcessReply(SSL& ssl, mySTL::auto_ptr<input_buffer> buffered)
                   ssl.getStates().getServer() == clientNull) 
         if (buffer.peek() != handshake) {
             ProcessOldClientHello(buffer, ssl);
-            if (ssl.GetError()) {
-                buffered.reset(0);
-                return buffered;
-            }
+            if (ssl.GetError())
+                return 0;
         }
 
     while(!buffer.eof()) {
@@ -715,31 +712,28 @@ DoProcessReply(SSL& ssl, mySTL::auto_ptr<input_buffer> buffered)
             // put header in front for next time processing
             uint extra = needHdr ? 0 : RECORD_HEADER;
             uint sz = buffer.get_remaining() + extra;
-            buffered.reset(NEW_YS input_buffer(sz, buffer.get_buffer() +
-                           buffer.get_current() - extra, sz));
-            break;
+            ssl.useBuffers().SetRawInput(NEW_YS input_buffer(sz,
+                      buffer.get_buffer() + buffer.get_current() - extra, sz));
+            return 1;
         }
 
         while (buffer.get_current() < hdr.length_ + RECORD_HEADER + offset) {
             // each message in record, can be more than 1 if not encrypted
             if (ssl.getSecurity().get_parms().pending_ == false) // cipher on
                 decrypt_message(ssl, buffer, hdr.length_);
-            mySTL::auto_ptr<Message> msg(mf.CreateObject(hdr.type_), ysDelete);
+            mySTL::auto_ptr<Message> msg(mf.CreateObject(hdr.type_));
             if (!msg.get()) {
                 ssl.SetError(factory_error);
-                buffered.reset(0);
-                return buffered;
+                return 0;
             }
             buffer >> *msg;
             msg->Process(buffer, ssl);
-            if (ssl.GetError()) {
-                buffered.reset(0);
-                return buffered;
-            }
+            if (ssl.GetError())
+                return 0;
         }
         offset += hdr.length_ + RECORD_HEADER;
     }
-    return buffered;
+    return 0;
 }
 
 
@@ -747,16 +741,17 @@ DoProcessReply(SSL& ssl, mySTL::auto_ptr<input_buffer> buffered)
 void processReply(SSL& ssl)
 {
     if (ssl.GetError()) return;
-    mySTL::auto_ptr<input_buffer> buffered(ysDelete);
 
-    for (;;) {
-        mySTL::auto_ptr<input_buffer> tmp(DoProcessReply(ssl, buffered));
-        if (tmp.get())      // had only part of a record's data, call again
-            buffered = tmp;
-        else
-            break;
-        if (ssl.GetError()) return;
+    if (DoProcessReply(ssl))
+        // didn't complete process
+        if (!ssl.getSocket().IsBlocking()) {
+            // keep trying now
+            while (!ssl.GetError())
+                if (DoProcessReply(ssl) == 0) break;
     }
+        else
+            // user will have try again later
+            ssl.SetError(YasslError(SSL_ERROR_WANT_READ));
 }
 
 
@@ -793,7 +788,7 @@ void sendClientKeyExchange(SSL& ssl, BufferOutput buffer)
 
     RecordLayerHeader rlHeader;
     HandShakeHeader   hsHeader;
-    mySTL::auto_ptr<output_buffer> out(NEW_YS output_buffer, ysDelete);
+    mySTL::auto_ptr<output_buffer> out(NEW_YS output_buffer);
     buildHeaders(ssl, hsHeader, rlHeader, ck);
     buildOutput(*out.get(), rlHeader, hsHeader, ck);
     hashHandShake(ssl, *out.get());
@@ -814,7 +809,7 @@ void sendServerKeyExchange(SSL& ssl, BufferOutput buffer)
 
     RecordLayerHeader rlHeader;
     HandShakeHeader   hsHeader;
-    mySTL::auto_ptr<output_buffer> out(NEW_YS output_buffer, ysDelete);
+    mySTL::auto_ptr<output_buffer> out(NEW_YS output_buffer);
     buildHeaders(ssl, hsHeader, rlHeader, sk);
     buildOutput(*out.get(), rlHeader, hsHeader, sk);
     hashHandShake(ssl, *out.get());
@@ -839,7 +834,7 @@ void sendChangeCipher(SSL& ssl, BufferOutput buffer)
     ChangeCipherSpec ccs;
     RecordLayerHeader rlHeader;
     buildHeader(ssl, rlHeader, ccs);
-    mySTL::auto_ptr<output_buffer> out(NEW_YS output_buffer, ysDelete);
+    mySTL::auto_ptr<output_buffer> out(NEW_YS output_buffer);
     buildOutput(*out.get(), rlHeader, ccs);
    
     if (buffer == buffered)
@@ -856,7 +851,7 @@ void sendFinished(SSL& ssl, ConnectionEnd side, BufferOutput buffer)
 
     Finished fin;
     buildFinished(ssl, fin, side == client_end ? client : server);
-    mySTL::auto_ptr<output_buffer> out(NEW_YS output_buffer, ysDelete);
+    mySTL::auto_ptr<output_buffer> out(NEW_YS output_buffer);
     cipherFinished(ssl, fin, *out.get());                   // hashes handshake
 
     if (ssl.getSecurity().get_resuming()) {
@@ -955,7 +950,7 @@ void sendServerHello(SSL& ssl, BufferOutput buffer)
     ServerHello       sh(ssl.getSecurity().get_connection().version_);
     RecordLayerHeader rlHeader;
     HandShakeHeader   hsHeader;
-    mySTL::auto_ptr<output_buffer> out(NEW_YS output_buffer, ysDelete);
+    mySTL::auto_ptr<output_buffer> out(NEW_YS output_buffer);
 
     buildServerHello(ssl, sh);
     ssl.set_random(sh.get_random(), server_end);
@@ -978,7 +973,7 @@ void sendServerHelloDone(SSL& ssl, BufferOutput buffer)
     ServerHelloDone   shd;
     RecordLayerHeader rlHeader;
     HandShakeHeader   hsHeader;
-    mySTL::auto_ptr<output_buffer> out(NEW_YS output_buffer, ysDelete);
+    mySTL::auto_ptr<output_buffer> out(NEW_YS output_buffer);
 
     buildHeaders(ssl, hsHeader, rlHeader, shd);
     buildOutput(*out.get(), rlHeader, hsHeader, shd);
@@ -999,7 +994,7 @@ void sendCertificate(SSL& ssl, BufferOutput buffer)
     Certificate       cert(ssl.getCrypto().get_certManager().get_cert());
     RecordLayerHeader rlHeader;
     HandShakeHeader   hsHeader;
-    mySTL::auto_ptr<output_buffer> out(NEW_YS output_buffer, ysDelete);
+    mySTL::auto_ptr<output_buffer> out(NEW_YS output_buffer);
 
     buildHeaders(ssl, hsHeader, rlHeader, cert);
     buildOutput(*out.get(), rlHeader, hsHeader, cert);
@@ -1021,7 +1016,7 @@ void sendCertificateRequest(SSL& ssl, BufferOutput buffer)
     request.Build();
     RecordLayerHeader  rlHeader;
     HandShakeHeader    hsHeader;
-    mySTL::auto_ptr<output_buffer> out(NEW_YS output_buffer, ysDelete);
+    mySTL::auto_ptr<output_buffer> out(NEW_YS output_buffer);
 
     buildHeaders(ssl, hsHeader, rlHeader, request);
     buildOutput(*out.get(), rlHeader, hsHeader, request);
@@ -1043,7 +1038,7 @@ void sendCertificateVerify(SSL& ssl, BufferOutput buffer)
     verify.Build(ssl);
     RecordLayerHeader  rlHeader;
     HandShakeHeader    hsHeader;
-    mySTL::auto_ptr<output_buffer> out(NEW_YS output_buffer, ysDelete);
+    mySTL::auto_ptr<output_buffer> out(NEW_YS output_buffer);
 
     buildHeaders(ssl, hsHeader, rlHeader, verify);
     buildOutput(*out.get(), rlHeader, hsHeader, verify);
diff --git a/extra/yassl/src/socket_wrapper.cpp b/extra/yassl/src/socket_wrapper.cpp
index 7790001fc2d..70944831884 100644
--- a/extra/yassl/src/socket_wrapper.cpp
+++ b/extra/yassl/src/socket_wrapper.cpp
@@ -41,9 +41,10 @@
     #include <netinet/in.h>
     #include <sys/ioctl.h>
     #include <string.h>
+    #include <fcntl.h>
 #endif // _WIN32
 
-#if defined(__sun) || defined(__SCO_VERSION__)
+#if defined(__sun) || defined(__SCO_VERSION__) || defined(__NETWARE__)
     #include <sys/filio.h>
 #endif
 
@@ -62,7 +63,7 @@ namespace yaSSL {
 
 
 Socket::Socket(socket_t s) 
-    : socket_(s), wouldBlock_(false)
+    : socket_(s), wouldBlock_(false), blocking_(false)
 {}
 
 
@@ -148,6 +149,7 @@ uint Socket::receive(byte* buf, unsigned int sz, int flags)
         if (get_lastError() == SOCKET_EWOULDBLOCK || 
             get_lastError() == SOCKET_EAGAIN) {
             wouldBlock_ = true;
+            blocking_   = true; // socket can block, only way to tell for win32
         return 0;
     }
     }
@@ -189,6 +191,12 @@ bool Socket::WouldBlock() const
 }
 
 
+bool Socket::IsBlocking() const
+{
+    return blocking_;
+}
+
+
 void Socket::set_lastError(int errorCode)
 {
 #ifdef _WIN32
diff --git a/extra/yassl/src/ssl.cpp b/extra/yassl/src/ssl.cpp
index 81e585ff735..a008ea7228b 100644
--- a/extra/yassl/src/ssl.cpp
+++ b/extra/yassl/src/ssl.cpp
@@ -42,6 +42,9 @@
 #include "yassl_int.hpp"
 #include "md5.hpp"              // for TaoCrypt MD5 size assert
 #include "md4.hpp"              // for TaoCrypt MD4 size assert
+#include "file.hpp"             // for TaoCrypt Source
+#include "coding.hpp"           // HexDecoder
+#include "helpers.hpp"          // for placement new hack
 #include <stdio.h>
 
 #ifdef _WIN32
@@ -55,7 +58,6 @@
 
 namespace yaSSL {
 
-using mySTL::min;
 
 
 int read_file(SSL_CTX* ctx, const char* file, int format, CertType type)
@@ -93,11 +95,55 @@ int read_file(SSL_CTX* ctx, const char* file, int format, CertType type)
             }
         }
         else {
-            x = PemToDer(input, type);
+            EncryptedInfo info;
+            x = PemToDer(input, type, &info);
             if (!x) {
                 fclose(input);
                 return SSL_BAD_FILE;
             }
+            if (info.set) {
+                // decrypt
+                char password[80];
+                pem_password_cb cb = ctx->GetPasswordCb();
+                if (!cb) {
+                    fclose(input);
+                    return SSL_BAD_FILE;
+                }
+                int passwordSz = cb(password, sizeof(password), 0,
+                                    ctx->GetUserData());
+                byte key[AES_256_KEY_SZ];  // max sizes
+                byte iv[AES_IV_SZ];
+                
+                // use file's salt for key derivation, but not real iv
+                TaoCrypt::Source source(info.iv, info.ivSz);
+                TaoCrypt::HexDecoder dec(source);
+                memcpy(info.iv, source.get_buffer(), min((uint)sizeof(info.iv),
+                                                         source.size()));
+                EVP_BytesToKey(info.name, "MD5", info.iv, (byte*)password,
+                               passwordSz, 1, key, iv);
+
+                STL::auto_ptr<BulkCipher> cipher;
+                if (strncmp(info.name, "DES-CBC", 7) == 0)
+                    cipher.reset(NEW_YS DES);
+                else if (strncmp(info.name, "DES-EDE3-CBC", 13) == 0)
+                    cipher.reset(NEW_YS DES_EDE);
+                else if (strncmp(info.name, "AES-128-CBC", 13) == 0)
+                    cipher.reset(NEW_YS AES(AES_128_KEY_SZ));
+                else if (strncmp(info.name, "AES-192-CBC", 13) == 0)
+                    cipher.reset(NEW_YS AES(AES_192_KEY_SZ));
+                else if (strncmp(info.name, "AES-256-CBC", 13) == 0)
+                    cipher.reset(NEW_YS AES(AES_256_KEY_SZ));
+                else {
+                    fclose(input);
+                    return SSL_BAD_FILE;
+                }
+                cipher->set_decryptKey(key, info.iv);
+                STL::auto_ptr<x509> newx(NEW_YS x509(x->get_length()));   
+                cipher->decrypt(newx->use_buffer(), x->get_buffer(),
+                                x->get_length());
+                ysDelete(x);
+                x = newx.release();
+            }
         }
     }
     fclose(input);
@@ -140,8 +186,17 @@ SSL_METHOD* TLSv1_client_method()
 
 SSL_METHOD* SSLv23_server_method()
 {
-    // compatibility only, no version 2 support
-    return SSLv3_server_method();
+    // compatibility only, no version 2 support, but does SSL 3 and TLS 1
+    return NEW_YS SSL_METHOD(server_end, ProtocolVersion(3,1), true);
+}
+
+
+SSL_METHOD* SSLv23_client_method()
+{
+    // compatibility only, no version 2 support, but does SSL 3 and TLS 1
+    // though it sends TLS1 hello not SSLv2 so SSLv3 only servers will decline
+    // TODO: maybe add support to send SSLv2 hello ???
+    return NEW_YS SSL_METHOD(client_end, ProtocolVersion(3,1), true);
 }
 
 
@@ -178,14 +233,29 @@ int SSL_set_fd(SSL* ssl, int fd)
 
 int SSL_connect(SSL* ssl)
 {
+    if (ssl->GetError() == YasslError(SSL_ERROR_WANT_READ))
+        ssl->SetError(no_error);
+
+    ClientState neededState;
+
+    switch (ssl->getStates().GetConnect()) {
+
+    case CONNECT_BEGIN :
     sendClientHello(*ssl);
-    ClientState neededState = ssl->getSecurity().get_resuming() ?
+        if (!ssl->GetError())
+            ssl->useStates().UseConnect() = CLIENT_HELLO_SENT;
+
+    case CLIENT_HELLO_SENT :
+        neededState = ssl->getSecurity().get_resuming() ?
         serverFinishedComplete : serverHelloDoneComplete;
     while (ssl->getStates().getClient() < neededState) {
         if (ssl->GetError()) break;
     processReply(*ssl);
     }
+        if (!ssl->GetError())
+            ssl->useStates().UseConnect() = FIRST_REPLY_DONE;
 
+    case FIRST_REPLY_DONE :
     if(ssl->getCrypto().get_certManager().sendVerify())
         sendCertificate(*ssl);
 
@@ -198,18 +268,32 @@ int SSL_connect(SSL* ssl)
     sendChangeCipher(*ssl);
     sendFinished(*ssl, client_end);
     ssl->flushBuffer();
+
+        if (!ssl->GetError())
+            ssl->useStates().UseConnect() = FINISHED_DONE;
+
+    case FINISHED_DONE :
     if (!ssl->getSecurity().get_resuming())
         while (ssl->getStates().getClient() < serverFinishedComplete) {
             if (ssl->GetError()) break;
         processReply(*ssl);
         }
+        if (!ssl->GetError())
+            ssl->useStates().UseConnect() = SECOND_REPLY_DONE;
 
+    case SECOND_REPLY_DONE :
     ssl->verifyState(serverFinishedComplete);
     ssl->useLog().ShowTCP(ssl->getSocket().get_fd());
 
-    if (ssl->GetError())
+        if (ssl->GetError()) {
+            GetErrors().Add(ssl->GetError());
         return SSL_FATAL_ERROR;
+        }   
     return SSL_SUCCESS;
+
+    default :
+        return SSL_FATAL_ERROR; // unkown state
+    }
 }
 
 
@@ -228,7 +312,17 @@ int SSL_read(SSL* ssl, void* buffer, int sz)
 
 int SSL_accept(SSL* ssl)
 {
+    if (ssl->GetError() == YasslError(SSL_ERROR_WANT_READ))
+        ssl->SetError(no_error);
+
+    switch (ssl->getStates().GetAccept()) {
+
+    case ACCEPT_BEGIN :
     processReply(*ssl);
+        if (!ssl->GetError())
+            ssl->useStates().UseAccept() = ACCEPT_FIRST_REPLY_DONE;
+
+    case ACCEPT_FIRST_REPLY_DONE :
     sendServerHello(*ssl);
 
     if (!ssl->getSecurity().get_resuming()) {
@@ -242,27 +336,51 @@ int SSL_accept(SSL* ssl)
 
         sendServerHelloDone(*ssl);
         ssl->flushBuffer();
+        }
+      
+        if (!ssl->GetError())
+            ssl->useStates().UseAccept() = SERVER_HELLO_DONE;
 
+    case SERVER_HELLO_DONE :
+        if (!ssl->getSecurity().get_resuming()) {
         while (ssl->getStates().getServer() < clientFinishedComplete) {
             if (ssl->GetError()) break;
             processReply(*ssl);
         }
     }
+        if (!ssl->GetError())
+            ssl->useStates().UseAccept() = ACCEPT_SECOND_REPLY_DONE;
+
+    case ACCEPT_SECOND_REPLY_DONE :
     sendChangeCipher(*ssl);
     sendFinished(*ssl, server_end);
     ssl->flushBuffer();
+
+        if (!ssl->GetError())
+            ssl->useStates().UseAccept() = ACCEPT_FINISHED_DONE;
+
+    case ACCEPT_FINISHED_DONE :
     if (ssl->getSecurity().get_resuming()) {
         while (ssl->getStates().getServer() < clientFinishedComplete) {
           if (ssl->GetError()) break;
           processReply(*ssl);
       }
     }
+        if (!ssl->GetError())
+            ssl->useStates().UseAccept() = ACCEPT_THIRD_REPLY_DONE;
 
+    case ACCEPT_THIRD_REPLY_DONE :
     ssl->useLog().ShowTCP(ssl->getSocket().get_fd());
 
-    if (ssl->GetError())
+        if (ssl->GetError()) {
+            GetErrors().Add(ssl->GetError());
         return SSL_FATAL_ERROR;
+        }
     return SSL_SUCCESS;
+
+    default:
+        return SSL_FATAL_ERROR; // unknown state
+    }
 }
 
 
@@ -278,6 +396,8 @@ int SSL_do_handshake(SSL* ssl)
 int SSL_clear(SSL* ssl)
 {
     ssl->useSocket().closeSocket();
+    GetErrors().Remove();
+
     return SSL_SUCCESS;
 }
 
@@ -289,6 +409,8 @@ int SSL_shutdown(SSL* ssl)
     ssl->useLog().ShowTCP(ssl->getSocket().get_fd(), true);
     ssl->useSocket().closeSocket();
 
+    GetErrors().Remove();
+
     return SSL_SUCCESS;
 }
 
@@ -762,9 +884,8 @@ void DH_free(DH* dh)
 // be created
 BIGNUM* BN_bin2bn(const unsigned char* num, int sz, BIGNUM* retVal)
 {
-    using mySTL::auto_ptr;
     bool created = false;
-    auto_ptr<BIGNUM> bn(ysDelete);
+    mySTL::auto_ptr<BIGNUM> bn;
 
     if (!retVal) {
         created = true;
@@ -825,7 +946,7 @@ const EVP_MD* EVP_md5(void)
 
 const EVP_CIPHER* EVP_des_ede3_cbc(void)
 {
-    static const char* type = "DES_EDE3_CBC";
+    static const char* type = "DES-EDE3-CBC";
     return type;
 }
 
@@ -836,16 +957,37 @@ int EVP_BytesToKey(const EVP_CIPHER* type, const EVP_MD* md, const byte* salt,
     // only support MD5 for now
     if (strncmp(md, "MD5", 3)) return 0;
 
-    // only support DES_EDE3_CBC for now
-    if (strncmp(type, "DES_EDE3_CBC", 12)) return 0; 
+    int keyLen = 0;
+    int ivLen  = 0;
+
+    // only support CBC DES and AES for now
+    if (strncmp(type, "DES-CBC", 7) == 0) {
+        keyLen = DES_KEY_SZ;
+        ivLen  = DES_IV_SZ;
+    }
+    else if (strncmp(type, "DES-EDE3-CBC", 12) == 0) {
+        keyLen = DES_EDE_KEY_SZ;
+        ivLen  = DES_IV_SZ;
+    }
+    else if (strncmp(type, "AES-128-CBC", 11) == 0) {
+        keyLen = AES_128_KEY_SZ;
+        ivLen  = AES_IV_SZ;
+    }
+    else if (strncmp(type, "AES-192-CBC", 11) == 0) {
+        keyLen = AES_192_KEY_SZ;
+        ivLen  = AES_IV_SZ;
+    }
+    else if (strncmp(type, "AES-256-CBC", 11) == 0) {
+        keyLen = AES_256_KEY_SZ;
+        ivLen  = AES_IV_SZ;
+    }
+    else
+        return 0;
 
     yaSSL::MD5 myMD;
     uint digestSz = myMD.get_digestSize();
     byte digest[SHA_LEN];                   // max size
 
-    yaSSL::DES_EDE cipher;
-    int keyLen    = cipher.get_keySize();
-    int ivLen     = cipher.get_ivSize();
     int keyLeft   = keyLen;
     int ivLeft    = ivLen;
     int keyOutput = 0;
@@ -878,7 +1020,7 @@ int EVP_BytesToKey(const EVP_CIPHER* type, const EVP_MD* md, const byte* salt,
 
         if (ivLeft && digestLeft) {
             int store = min(ivLeft, digestLeft);
-            memcpy(&iv[ivLen - ivLeft], digest, store);
+            memcpy(&iv[ivLen - ivLeft], &digest[digestSz - digestLeft], store);
 
             keyOutput += store;
             ivLeft    -= store;
@@ -954,10 +1096,9 @@ void DES_ecb_encrypt(DES_cblock* input, DES_cblock* output,
 }
 
 
-void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX*, void* userdata)
+void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX* ctx, void* userdata)
 {
-    // yaSSL doesn't support yet, unencrypt your PEM file with userdata
-    // before handing off to yaSSL
+    ctx->SetUserData(userdata);
 }
 
 
@@ -1034,12 +1175,6 @@ ASN1_TIME* X509_get_notAfter(X509* x)
 }
 
 
-SSL_METHOD* SSLv23_client_method(void)  /* doesn't actually roll back */
-{
-    return SSLv3_client_method();
-}
-
-
 SSL_METHOD* SSLv2_client_method(void)   /* will never work, no v 2    */
 {
     return 0;
@@ -1363,9 +1498,9 @@ int SSL_pending(SSL* ssl)
     }
 
 
-    void SSL_CTX_set_default_passwd_cb(SSL_CTX*, pem_password_cb)
+    void SSL_CTX_set_default_passwd_cb(SSL_CTX* ctx, pem_password_cb cb)
     {
-        // TDOD:
+        ctx->SetPasswordCb(cb);
     }
 
 
@@ -1428,7 +1563,7 @@ int SSL_pending(SSL* ssl)
 
     void ERR_remove_state(unsigned long)
     {
-        // TODO:
+        GetErrors().Remove();
     }
 
 
@@ -1437,16 +1572,30 @@ int SSL_pending(SSL* ssl)
         return l & 0xfff;
     }
 
+    unsigned long err_helper(bool peek = false)
+    {
+        int ysError = GetErrors().Lookup(peek);
+
+        // translate cert error for libcurl, it uses OpenSSL hex code
+        switch (ysError) {
+        case TaoCrypt::SIG_OTHER_E:
+            return CERTFICATE_ERROR;
+            break;
+        default :
+            return 0;
+        }
+    }
+
 
     unsigned long ERR_peek_error()
     {
-        return 0;  // TODO:
+        return err_helper(true);
     }
 
 
     unsigned long ERR_get_error()
     {
-        return ERR_peek_error();
+        return err_helper();
     }
 
 
diff --git a/extra/yassl/src/template_instnt.cpp b/extra/yassl/src/template_instnt.cpp
index c5fc23dabdb..0a3c4c64392 100644
--- a/extra/yassl/src/template_instnt.cpp
+++ b/extra/yassl/src/template_instnt.cpp
@@ -65,6 +65,19 @@ template yaSSL::del_ptr_zero for_each<mySTL::list<yaSSL::output_buffer*>::iterat
 template yaSSL::del_ptr_zero for_each<mySTL::list<yaSSL::x509*>::iterator, yaSSL::del_ptr_zero>(mySTL::list<yaSSL::x509*>::iterator, mySTL::list<yaSSL::x509*>::iterator, yaSSL::del_ptr_zero);
 template yaSSL::del_ptr_zero for_each<mySTL::list<yaSSL::Digest*>::iterator, yaSSL::del_ptr_zero>(mySTL::list<yaSSL::Digest*>::iterator, mySTL::list<yaSSL::Digest*>::iterator, yaSSL::del_ptr_zero);
 template yaSSL::del_ptr_zero for_each<mySTL::list<yaSSL::BulkCipher*>::iterator, yaSSL::del_ptr_zero>(mySTL::list<yaSSL::BulkCipher*>::iterator, mySTL::list<yaSSL::BulkCipher*>::iterator, yaSSL::del_ptr_zero);
+template bool list<yaSSL::ThreadError>::erase(list<yaSSL::ThreadError>::iterator);
+template void list<yaSSL::ThreadError>::push_back(yaSSL::ThreadError);
+template void list<yaSSL::ThreadError>::pop_front();
+template void list<yaSSL::ThreadError>::pop_back();
+template list<yaSSL::ThreadError>::~list();
+template pair<int, yaSSL::Message* (*)()>* GetArrayMemory<pair<int, yaSSL::Message* (*)()> >(size_t);
+template void FreeArrayMemory<pair<int, yaSSL::Message* (*)()> >(pair<int, yaSSL::Message* (*)()>*);
+template pair<int, yaSSL::HandShakeBase* (*)()>* GetArrayMemory<pair<int, yaSSL::HandShakeBase* (*)()> >(size_t);
+template void FreeArrayMemory<pair<int, yaSSL::HandShakeBase* (*)()> >(pair<int, yaSSL::HandShakeBase* (*)()>*);
+template pair<int, yaSSL::ServerKeyBase* (*)()>* GetArrayMemory<pair<int, yaSSL::ServerKeyBase* (*)()> >(size_t);
+template void FreeArrayMemory<pair<int, yaSSL::ServerKeyBase* (*)()> >(pair<int, yaSSL::ServerKeyBase* (*)()>*);
+template pair<int, yaSSL::ClientKeyBase* (*)()>* GetArrayMemory<pair<int, yaSSL::ClientKeyBase* (*)()> >(size_t);
+template void FreeArrayMemory<pair<int, yaSSL::ClientKeyBase* (*)()> >(pair<int, yaSSL::ClientKeyBase* (*)()>*);
 }
 
 namespace yaSSL {
@@ -90,8 +103,12 @@ template void ysDelete<X509>(X509*);
 template void ysDelete<Message>(Message*);
 template void ysDelete<sslFactory>(sslFactory*);
 template void ysDelete<Sessions>(Sessions*);
+template void ysDelete<Errors>(Errors*);
 template void ysArrayDelete<unsigned char>(unsigned char*);
 template void ysArrayDelete<char>(char*);
+
+template int min<int>(int, int);
+template unsigned int min<unsigned int>(unsigned int, unsigned int);
 }
 
 #endif // HAVE_EXPLICIT_TEMPLATE_INSTANTIATION
diff --git a/extra/yassl/src/yassl.cpp b/extra/yassl/src/yassl.cpp
index 5bc8bad8bbc..e253ef84bb5 100644
--- a/extra/yassl/src/yassl.cpp
+++ b/extra/yassl/src/yassl.cpp
@@ -36,21 +36,9 @@
 #include "openssl/ssl.h"  // get rid of this
 
 
-// yaSSL overloads hide these
-void* operator new[](size_t sz)
-{
-    return ::operator new(sz);
-}
-
-void operator delete[](void* ptr)
-{
-    ::operator delete(ptr);
-}
-
 
 namespace yaSSL {
 
-using mySTL::min;
 
 
 struct Base {
diff --git a/extra/yassl/src/yassl_error.cpp b/extra/yassl/src/yassl_error.cpp
index 4f75de34a98..3531c0a2c74 100644
--- a/extra/yassl/src/yassl_error.cpp
+++ b/extra/yassl/src/yassl_error.cpp
@@ -125,13 +125,21 @@ void SetErrorString(YasslError error, char* buffer)
         strncpy(buffer, "unable to proccess cerificate", max);
         break; 
 
+    case privateKey_error :
+        strncpy(buffer, "unable to proccess private key, bad format", max);
+        break;
+
+    case badVersion_error :
+        strncpy(buffer, "protocl version mismatch", max);
+        break;
+        
         // openssl errors
     case SSL_ERROR_WANT_READ :
         strncpy(buffer, "the read operation would block", max);
         break;
 
         // TaoCrypt errors
-    case NO_ERROR :
+    case NO_ERROR_E :
         strncpy(buffer, "not in error state", max);
         break;
 
@@ -235,6 +243,10 @@ void SetErrorString(YasslError error, char* buffer)
         strncpy(buffer, "ASN: bad other signature confirmation", max);
         break;
 
+    case CERTFICATE_ERROR :
+        strncpy(buffer, "Unable to verify certificate", max);
+        break;
+
     default :
         strncpy(buffer, "unknown error number", max);
     }
diff --git a/extra/yassl/src/yassl_imp.cpp b/extra/yassl/src/yassl_imp.cpp
index 98f8035732e..bd07f8b70f2 100644
--- a/extra/yassl/src/yassl_imp.cpp
+++ b/extra/yassl/src/yassl_imp.cpp
@@ -139,7 +139,7 @@ void DH_Server::build(SSL& ssl)
                        parms_.alloc_pub(pubSz));
 
     short sigSz = 0;
-    mySTL::auto_ptr<Auth> auth(ysDelete);
+    mySTL::auto_ptr<Auth> auth;
     const CertManager& cert = ssl.getCrypto().get_certManager();
     
     if (ssl.getSecurity().get_parms().sig_algo_ == rsa_sa_algo)
@@ -151,9 +151,11 @@ void DH_Server::build(SSL& ssl)
         sigSz += DSS_ENCODED_EXTRA;
     }
     
-
     sigSz += auth->get_signatureLength();
-
+    if (!sigSz) {
+        ssl.SetError(privateKey_error);
+        return;
+    }
 
     length_ = 8; // pLen + gLen + YsLen + SigLen
     length_ += pSz + gSz + pubSz + sigSz;
@@ -612,7 +614,7 @@ void HandShakeHeader::Process(input_buffer& input, SSL& ssl)
 {
     ssl.verifyState(*this);
     const HandShakeFactory& hsf = ssl.getFactory().getHandShake();
-    mySTL::auto_ptr<HandShakeBase> hs(hsf.CreateObject(type_), ysDelete);
+    mySTL::auto_ptr<HandShakeBase> hs(hsf.CreateObject(type_));
     if (!hs.get()) {
         ssl.SetError(factory_error);
         return;
@@ -1214,6 +1216,20 @@ output_buffer& operator<<(output_buffer& output, const ServerHello& hello)
 // Server Hello processing handler
 void ServerHello::Process(input_buffer&, SSL& ssl)
 {
+    if (ssl.GetMultiProtocol()) {   // SSLv23 support
+        if (ssl.isTLS() && server_version_.minor_ < 1)
+            // downgrade to SSLv3
+            ssl.useSecurity().use_connection().TurnOffTLS();
+    }
+    else if (ssl.isTLS() && server_version_.minor_ < 1) {
+        ssl.SetError(badVersion_error);
+        return;
+    }
+    else if (!ssl.isTLS() && (server_version_.major_ == 3 &&
+                              server_version_.minor_ >= 1)) {
+        ssl.SetError(badVersion_error);
+        return;
+    }
     ssl.set_pending(cipher_suite_[1]);
     ssl.set_random(random_, server_end);
     if (id_len_)
@@ -1384,11 +1400,23 @@ output_buffer& operator<<(output_buffer& output, const ClientHello& hello)
 // Client Hello processing handler
 void ClientHello::Process(input_buffer&, SSL& ssl)
 {
-    if (ssl.isTLS() && client_version_.minor_ == 0) {
+    if (ssl.GetMultiProtocol()) {   // SSLv23 support
+        if (ssl.isTLS() && client_version_.minor_ < 1) {
+            // downgrade to SSLv3
         ssl.useSecurity().use_connection().TurnOffTLS();
         ProtocolVersion pv = ssl.getSecurity().get_connection().version_;
         ssl.useSecurity().use_parms().SetSuites(pv);  // reset w/ SSL suites
     }
+    }
+    else if (ssl.isTLS() && client_version_.minor_ < 1) {
+        ssl.SetError(badVersion_error);
+        return;
+    }
+    else if (!ssl.isTLS() && (client_version_.major_ == 3 &&
+                              client_version_.minor_ >= 1)) {
+        ssl.SetError(badVersion_error);
+        return;
+    }
     ssl.set_random(random_, client_end);
 
     while (id_len_) {  // trying to resume
@@ -1541,7 +1569,7 @@ CertificateRequest::CertificateRequest()
 CertificateRequest::~CertificateRequest()
 {
 
-    mySTL::for_each(certificate_authorities_.begin(),
+    STL::for_each(certificate_authorities_.begin(),
                   certificate_authorities_.end(),
                   del_ptr_zero()) ;
 }
@@ -1634,9 +1662,9 @@ output_buffer& operator<<(output_buffer& output,
            request.typeTotal_ - REQUEST_HEADER, tmp);
     output.write(tmp, sizeof(tmp));
 
-    mySTL::list<DistinguishedName>::const_iterator first =
+    STL::list<DistinguishedName>::const_iterator first =
                                     request.certificate_authorities_.begin();
-    mySTL::list<DistinguishedName>::const_iterator last =
+    STL::list<DistinguishedName>::const_iterator last =
                                     request.certificate_authorities_.end();
     while (first != last) {
         uint16 sz;
@@ -1684,7 +1712,7 @@ void CertificateVerify::Build(SSL& ssl)
 
     uint16 sz = 0;
     byte   len[VERIFY_HEADER];
-    mySTL::auto_ptr<byte> sig(ysArrayDelete);
+    mySTL::auto_array<byte> sig;
 
     // sign
     const CertManager& cert = ssl.getCrypto().get_certManager();
diff --git a/extra/yassl/src/yassl_int.cpp b/extra/yassl/src/yassl_int.cpp
index 9b83f964348..5288acb2bcd 100644
--- a/extra/yassl/src/yassl_int.cpp
+++ b/extra/yassl/src/yassl_int.cpp
@@ -33,6 +33,10 @@
 #include "handshake.hpp"
 #include "timer.hpp"
 
+#ifdef _POSIX_THREADS
+    #include "pthread.h"
+#endif
+
 
 #ifdef YASSL_PURE_C
 
@@ -74,7 +78,6 @@
 namespace yaSSL {
 
 
-using mySTL::min;
 
 
 
@@ -155,6 +158,7 @@ void c32toa(uint32 u32, opaque* c)
 
 States::States() : recordLayer_(recordReady), handshakeLayer_(preHandshake),
            clientState_(serverNull),  serverState_(clientNull),
+           connectState_(CONNECT_BEGIN), acceptState_(ACCEPT_BEGIN),
            what_(no_error) {}
 
 const RecordLayerState& States::getRecord() const 
@@ -181,6 +185,18 @@ const ServerState& States::getServer() const
 }
 
 
+const ConnectState& States::GetConnect() const
+{
+    return connectState_;
+}
+
+
+const AcceptState& States::GetAccept() const
+{
+    return acceptState_;
+}
+
+
 const char* States::getString() const
 {
     return errorString_;
@@ -217,6 +233,18 @@ ServerState& States::useServer()
 }
 
 
+ConnectState& States::UseConnect()
+{
+    return connectState_;
+}
+
+
+AcceptState& States::UseAccept()
+{
+    return acceptState_;
+}
+
+
 char* States::useString()
 {
     return errorString_;
@@ -722,6 +750,12 @@ void SSL::SetError(YasslError ye)
 }
 
 
+Buffers& SSL::useBuffers()
+{
+    return buffers_;
+}
+
+
 // locals
 namespace {
 
@@ -959,7 +993,7 @@ using namespace yassl_int_cpp_local1;
 
 uint SSL::bufferedData()
 {
-    return mySTL::for_each(buffers_.getData().begin(),buffers_.getData().end(),
+    return STL::for_each(buffers_.getData().begin(),buffers_.getData().end(),
                            SumData()).total_;
 }
 
@@ -1002,7 +1036,7 @@ void SSL::PeekData(Data& data)
     data.set_length(0);                         // output, actual data filled
     dataSz = min(dataSz, bufferedData());
 
-    Buffers::inputList::iterator front = buffers_.getData().begin();
+    Buffers::inputList::iterator front = buffers_.useData().begin();
 
     while (elements) {
         uint frontSz = (*front)->get_remaining();
@@ -1027,7 +1061,7 @@ void SSL::flushBuffer()
 {
     if (GetError()) return;
 
-    uint sz = mySTL::for_each(buffers_.getHandShake().begin(),
+    uint sz = STL::for_each(buffers_.getHandShake().begin(),
                             buffers_.getHandShake().end(),
                             SumBuffer()).total_;
     output_buffer out(sz);
@@ -1213,8 +1247,10 @@ void SSL::matchSuite(const opaque* peer, uint length)
 
 void SSL::set_session(SSL_SESSION* s) 
 { 
-    if (s && GetSessions().lookup(s->GetID(), &secure_.use_resume()))
+    if (s && GetSessions().lookup(s->GetID(), &secure_.use_resume())) {
         secure_.set_resuming(true);
+        crypto_.use_certManager().setPeerX509(s->GetPeerX509());
+    }
 }
 
 
@@ -1260,6 +1296,12 @@ YasslError SSL::GetError() const
 }
 
 
+bool SSL::GetMultiProtocol() const
+{
+    return secure_.GetContext()->getMethod()->multipleProtocol();
+}
+
+
 Crypto& SSL::useCrypto()
 {
     return crypto_;
@@ -1314,9 +1356,25 @@ void SSL::addBuffer(output_buffer* b)
 }
 
 
+void SSL_SESSION::CopyX509(X509* x)
+{
+    assert(peerX509_ == 0);
+    if (x == 0) return;
+
+    X509_NAME* issuer   = x->GetIssuer();
+    X509_NAME* subject  = x->GetSubject();
+    ASN1_STRING* before = x->GetBefore();
+    ASN1_STRING* after  = x->GetAfter();
+
+    peerX509_ = NEW_YS X509(issuer->GetName(), issuer->GetLength(),
+        subject->GetName(), subject->GetLength(), (const char*) before->data,
+        before->length, (const char*) after->data, after->length);
+}
+
+
 // store connection parameters
 SSL_SESSION::SSL_SESSION(const SSL& ssl, RandomPool& ran) 
-    : timeout_(DEFAULT_TIMEOUT), random_(ran)
+    : timeout_(DEFAULT_TIMEOUT), random_(ran), peerX509_(0)
 {
     const Connection& conn = ssl.getSecurity().get_connection();
 
@@ -1325,12 +1383,14 @@ SSL_SESSION::SSL_SESSION(const SSL& ssl, RandomPool& ran)
     memcpy(suite_, ssl.getSecurity().get_parms().suite_, SUITE_LEN);
 
     bornOn_ = lowResTimer();
+
+    CopyX509(ssl.getCrypto().get_certManager().get_peerX509());
 }
 
 
 // for resumption copy in ssl::parameters
 SSL_SESSION::SSL_SESSION(RandomPool& ran) 
-    : bornOn_(0), timeout_(0), random_(ran)
+    : bornOn_(0), timeout_(0), random_(ran), peerX509_(0)
 {
     memset(sessionID_, 0, ID_LEN);
     memset(master_secret_, 0, SECRET_LEN);
@@ -1347,6 +1407,12 @@ SSL_SESSION& SSL_SESSION::operator=(const SSL_SESSION& that)
     bornOn_  = that.bornOn_;
     timeout_ = that.timeout_;
 
+    if (peerX509_) {
+        ysDelete(peerX509_);
+        peerX509_ = 0;
+    }
+    CopyX509(that.peerX509_);
+
     return *this;
 }
 
@@ -1369,6 +1435,12 @@ const Cipher* SSL_SESSION::GetSuite() const
 }
 
 
+X509* SSL_SESSION::GetPeerX509() const
+{
+    return peerX509_;
+}
+
+
 uint SSL_SESSION::GetBornOn() const
 {
     return bornOn_;
@@ -1395,6 +1467,8 @@ SSL_SESSION::~SSL_SESSION()
 {
     volatile opaque* p = master_secret_;
     clean(p, SECRET_LEN, random_);
+
+    ysDelete(peerX509_);
 }
 
 
@@ -1418,6 +1492,15 @@ sslFactory& GetSSL_Factory()
 }
 
 
+static Errors* errorsInstance = 0;
+
+Errors& GetErrors()
+{
+    if (!errorsInstance)
+        errorsInstance = NEW_YS Errors;
+    return *errorsInstance;
+}
+
 
 typedef Mutex::Lock Lock;
 
@@ -1433,14 +1516,15 @@ void Sessions::add(const SSL& ssl)
 
 Sessions::~Sessions() 
 { 
-    mySTL::for_each(list_.begin(), list_.end(), del_ptr_zero()); 
+    STL::for_each(list_.begin(), list_.end(), del_ptr_zero()); 
 }
 
 
 // locals
 namespace yassl_int_cpp_local2 { // for explicit templates
 
-typedef mySTL::list<SSL_SESSION*>::iterator iterator;
+typedef STL::list<SSL_SESSION*>::iterator sess_iterator;
+typedef STL::list<ThreadError>::iterator  thr_iterator;
 
 struct sess_match {
     const opaque* id_;
@@ -1455,6 +1539,28 @@ struct sess_match {
 };
 
 
+THREAD_ID_T GetSelf()
+{
+#ifndef _POSIX_THREADS
+    return GetCurrentThreadId();
+#else
+    return pthread_self();
+#endif
+}
+
+struct thr_match {
+    THREAD_ID_T id_;
+    explicit thr_match() : id_(GetSelf()) {}
+
+    bool operator()(ThreadError thr)
+    {
+        if (thr.threadID_ == id_)
+            return true;
+        return false;
+    }
+};
+
+
 } // local namespace
 using namespace yassl_int_cpp_local2;
 
@@ -1463,8 +1569,8 @@ using namespace yassl_int_cpp_local2;
 SSL_SESSION* Sessions::lookup(const opaque* id, SSL_SESSION* copy)
 {
     Lock guard(mutex_);
-    iterator find = mySTL::find_if(list_.begin(), list_.end(), sess_match(id));
-
+    sess_iterator find = STL::find_if(list_.begin(), list_.end(),
+                                        sess_match(id));
     if (find != list_.end()) {
         uint current = lowResTimer();
         if ( ((*find)->GetBornOn() + (*find)->GetTimeOut()) < current) {
@@ -1484,8 +1590,8 @@ SSL_SESSION* Sessions::lookup(const opaque* id, SSL_SESSION* copy)
 void Sessions::remove(const opaque* id)
 {
     Lock guard(mutex_);
-    iterator find = mySTL::find_if(list_.begin(), list_.end(), sess_match(id));
-
+    sess_iterator find = STL::find_if(list_.begin(), list_.end(),
+                                        sess_match(id));
     if (find != list_.end()) {
         del_ptr_zero()(*find);
         list_.erase(find);
@@ -1493,9 +1599,51 @@ void Sessions::remove(const opaque* id)
 }
 
 
-SSL_METHOD::SSL_METHOD(ConnectionEnd ce, ProtocolVersion pv) 
+// remove a self thread error
+void Errors::Remove()
+{
+    Lock guard(mutex_);
+    thr_iterator find = STL::find_if(list_.begin(), list_.end(),
+                                       thr_match());
+    if (find != list_.end())
+        list_.erase(find);
+}
+
+
+// lookup self error code
+int Errors::Lookup(bool peek)
+{
+    Lock guard(mutex_);
+    thr_iterator find = STL::find_if(list_.begin(), list_.end(),
+                                       thr_match());
+    if (find != list_.end()) {
+        int ret = find->errorID_;
+        if (!peek)
+            list_.erase(find);
+        return ret;
+    }
+    else
+        return 0;
+}
+
+
+// add a new error code for self
+void Errors::Add(int error)
+{
+    ThreadError add;
+    add.errorID_  = error;
+    add.threadID_ = GetSelf();
+
+    Remove();   // may have old error
+
+    Lock guard(mutex_);
+    list_.push_back(add);
+}
+
+
+SSL_METHOD::SSL_METHOD(ConnectionEnd ce, ProtocolVersion pv, bool multiProto) 
     : version_(pv), side_(ce), verifyPeer_(false), verifyNone_(false),
-      failNoCert_(false) 
+      failNoCert_(false), multipleProtocol_(multiProto)
 {}
 
 
@@ -1547,8 +1695,15 @@ bool SSL_METHOD::failNoCert() const
 }
 
 
+bool SSL_METHOD::multipleProtocol() const
+{
+    return multipleProtocol_;
+}
+
+
 SSL_CTX::SSL_CTX(SSL_METHOD* meth) 
-    : method_(meth), certificate_(0), privateKey_(0)
+    : method_(meth), certificate_(0), privateKey_(0), passwordCb_(0),
+      userData_(0)
 {}
 
 
@@ -1558,7 +1713,7 @@ SSL_CTX::~SSL_CTX()
     ysDelete(certificate_);
     ysDelete(privateKey_);
 
-    mySTL::for_each(caList_.begin(), caList_.end(), del_ptr_zero());
+    STL::for_each(caList_.begin(), caList_.end(), del_ptr_zero());
 }
 
 
@@ -1611,6 +1766,30 @@ const Stats& SSL_CTX::GetStats() const
 }
 
 
+pem_password_cb SSL_CTX::GetPasswordCb() const
+{
+    return passwordCb_;
+}
+
+
+void SSL_CTX::SetPasswordCb(pem_password_cb cb)
+{
+    passwordCb_ = cb;
+}
+
+
+void* SSL_CTX::GetUserData() const
+{
+    return userData_;
+}
+
+
+void SSL_CTX::SetUserData(void* data)
+{
+    userData_ = data;
+}
+
+
 void SSL_CTX::setVerifyPeer()
 {
     method_->setVerifyPeer();
@@ -1914,12 +2093,33 @@ Hashes& sslHashes::use_certVerify()
 }
 
 
+Buffers::Buffers() : rawInput_(0)
+{}
+
+
 Buffers::~Buffers()
 {
-    mySTL::for_each(handShakeList_.begin(), handShakeList_.end(),
+    STL::for_each(handShakeList_.begin(), handShakeList_.end(),
                   del_ptr_zero()) ;
-    mySTL::for_each(dataList_.begin(), dataList_.end(),
+    STL::for_each(dataList_.begin(), dataList_.end(),
                   del_ptr_zero()) ;
+    ysDelete(rawInput_);
+}
+
+
+void Buffers::SetRawInput(input_buffer* ib)
+{
+    assert(rawInput_ == 0);
+    rawInput_ = ib;
+}
+
+
+input_buffer* Buffers::TakeRawInput()
+{
+    input_buffer* ret = rawInput_;
+    rawInput_ = 0;
+
+    return ret;
 }
 
 
@@ -2026,12 +2226,18 @@ X509_NAME::~X509_NAME()
 }
 
 
-char* X509_NAME::GetName()
+const char* X509_NAME::GetName() const
 {
     return name_;
 }
 
 
+size_t X509_NAME::GetLength() const
+{
+    return sz_;
+}
+
+
 X509::X509(const char* i, size_t iSz, const char* s, size_t sSz,
            const char* b, int bSz, const char* a, int aSz)
     : issuer_(i, iSz), subject_(s, sSz),
@@ -2114,10 +2320,12 @@ extern "C" void yaSSL_CleanUp()
     TaoCrypt::CleanUp();
     yaSSL::ysDelete(yaSSL::sslFactoryInstance);
     yaSSL::ysDelete(yaSSL::sessionsInstance);
+    yaSSL::ysDelete(yaSSL::errorsInstance);
 
     // In case user calls more than once, prevent seg fault
     yaSSL::sslFactoryInstance = 0;
     yaSSL::sessionsInstance = 0;
+    yaSSL::errorsInstance = 0;
 }
 
 
@@ -2126,6 +2334,7 @@ namespace mySTL {
 template yaSSL::yassl_int_cpp_local1::SumData for_each<mySTL::list<yaSSL::input_buffer*>::iterator, yaSSL::yassl_int_cpp_local1::SumData>(mySTL::list<yaSSL::input_buffer*>::iterator, mySTL::list<yaSSL::input_buffer*>::iterator, yaSSL::yassl_int_cpp_local1::SumData);
 template yaSSL::yassl_int_cpp_local1::SumBuffer for_each<mySTL::list<yaSSL::output_buffer*>::iterator, yaSSL::yassl_int_cpp_local1::SumBuffer>(mySTL::list<yaSSL::output_buffer*>::iterator, mySTL::list<yaSSL::output_buffer*>::iterator, yaSSL::yassl_int_cpp_local1::SumBuffer);
 template mySTL::list<yaSSL::SSL_SESSION*>::iterator find_if<mySTL::list<yaSSL::SSL_SESSION*>::iterator, yaSSL::yassl_int_cpp_local2::sess_match>(mySTL::list<yaSSL::SSL_SESSION*>::iterator, mySTL::list<yaSSL::SSL_SESSION*>::iterator, yaSSL::yassl_int_cpp_local2::sess_match);
+template mySTL::list<yaSSL::ThreadError>::iterator find_if<mySTL::list<yaSSL::ThreadError>::iterator, yaSSL::yassl_int_cpp_local2::thr_match>(mySTL::list<yaSSL::ThreadError>::iterator, mySTL::list<yaSSL::ThreadError>::iterator, yaSSL::yassl_int_cpp_local2::thr_match);
 }
 #endif