Merge commit 'origin/R3_3_branch'

Conflicts:

	cs/demo/WCF/latency/Client.cs
	cs/demo/WCF/latency_m/Client.cs
	cs/demo/WCF/throughput/Client.cs
	cs/demo/WCF/throughput_m/Client.cs
	cs/demo/WCF/throughput_m/Service.cs
	java/demo/Database/library/BookI.java
	java/demo/Database/library/BookQueryResultI.java
	java/demo/Database/library/Client.java
	java/demo/Database/library/ConnectionPool.java
	java/demo/Database/library/DispatchInterceptorI.java
	java/demo/Database/library/Glacier2Session.ice
	java/demo/Database/library/Glacier2SessionManagerI.java
	java/demo/Database/library/Grammar.java
	java/demo/Database/library/Library.ice
	java/demo/Database/library/LibraryI.java
	java/demo/Database/library/Parser.java
	java/demo/Database/library/ReapThread.java
	java/demo/Database/library/RunParser.java
	java/demo/Database/library/SQLRequestContext.java
	java/demo/Database/library/Scanner.java
	java/demo/Database/library/Server.java
	java/demo/Database/library/Session.ice
	java/demo/Database/library/SessionFactoryI.java
	java/demo/Database/library/SessionI.java
	java/demo/Database/library/Token.java
	java/demo/Database/library/build.xml
	java/demo/Database/library/config.client

13 files changed, 267 insertions, 103 deletions

diff --git a/java/src/Ice/PluginManagerI.java b/java/src/Ice/PluginManagerI.java
index f76789f4a21..2c5e33bfb63 100644
--- a/java/src/Ice/PluginManagerI.java
+++ b/java/src/Ice/PluginManagerI.java
@@ -19,12 +19,12 @@ public final class PluginManagerI implements PluginManager
         if(_initialized)
         {
             InitializationException ex = new InitializationException();
-            ex.reason = "plugins already initialized";
+            ex.reason = "plug-ins already initialized";
             throw ex;
         }
 
         //
-        // Invoke initialize() on the plugins, in the order they were loaded.
+        // Invoke initialize() on the plug-ins, in the order they were loaded.
         //
         java.util.List<Plugin> initializedPlugins = new java.util.ArrayList<Plugin>();
         try
@@ -40,7 +40,7 @@ public final class PluginManagerI implements PluginManager
         catch(RuntimeException ex)
         {
             //
-            // Destroy the plugins that have been successfully initialized, in the
+            // Destroy the plug-ins that have been successfully initialized, in the
             // reverse order.
             //
             java.util.ListIterator<Plugin> i = initializedPlugins.listIterator(initializedPlugins.size());
@@ -104,11 +104,24 @@ public final class PluginManagerI implements PluginManager
     {
         if(_communicator != null)
         {
-            java.util.Iterator<Plugin> i = _plugins.values().iterator();
-            while(i.hasNext())
+            if(_initialized)
             {
-                Plugin p = i.next();
-                p.destroy();
+                java.util.Iterator<java.util.Map.Entry<String, Plugin> > i = _plugins.entrySet().iterator();
+                java.util.Map.Entry<String, Plugin> entry;
+                while(i.hasNext())
+                {
+                    entry = i.next();
+                    try
+                    {
+                        Plugin p = entry.getValue();
+                        p.destroy();
+                    }
+                    catch(RuntimeException ex)
+                    {
+                        Ice.Util.getProcessLogger().warning("unexpected exception raised by plug-in '" + entry.getKey() + "' destruction.\n");
+                        Ice.Util.getProcessLogger().warning("exception: " + ex.toString());
+                    }
+                }
             }
 
             _communicator = null;
@@ -135,8 +148,8 @@ public final class PluginManagerI implements PluginManager
         // Ice.Plugin.name[.<language>]=entry_point [args]
         //
         // If the Ice.PluginLoadOrder property is defined, load the
-        // specified plugins in the specified order, then load any
-        // remaining plugins.
+        // specified plug-ins in the specified order, then load any
+        // remaining plug-ins.
         //
         final String prefix = "Ice.Plugin.";
         Properties properties = _communicator.getProperties();
@@ -148,7 +161,7 @@ public final class PluginManagerI implements PluginManager
             if(_plugins.containsKey(loadOrder[i]))
             {
                 PluginInitializationException ex = new PluginInitializationException();
-                ex.reason = "plugin `" + loadOrder[i] + "' already loaded";
+                ex.reason = "plug-in `" + loadOrder[i] + "' already loaded";
                 throw ex;
             }
 
@@ -173,13 +186,13 @@ public final class PluginManagerI implements PluginManager
             else
             {
                 PluginInitializationException ex = new PluginInitializationException();
-                ex.reason = "plugin `" + loadOrder[i] + "' not defined";
+                ex.reason = "plug-in `" + loadOrder[i] + "' not defined";
                 throw ex;
             }
         }
 
         //
-        // Load any remaining plugins that weren't specified in PluginLoadOrder.
+        // Load any remaining plug-ins that weren't specified in PluginLoadOrder.
         //
         while(!plugins.isEmpty())
         {
@@ -240,7 +253,7 @@ public final class PluginManagerI implements PluginManager
         //
         // An application can set Ice.InitPlugins=0 if it wants to postpone
         // initialization until after it has interacted directly with the
-        // plugins.
+        // plug-ins.
         //
         if(properties.getPropertyAsIntWithDefault("Ice.InitPlugins", 1) > 0)
         {
diff --git a/java/src/Ice/Util.java b/java/src/Ice/Util.java
index 6db12d27cc2..4d9b5488691 100644
--- a/java/src/Ice/Util.java
+++ b/java/src/Ice/Util.java
@@ -343,13 +343,13 @@ public final class Util
     public static String
     stringVersion()
     {
-        return "3.3.0"; // "A.B.C", with A=major, B=minor, C=patch
+        return "3.3.1"; // "A.B.C", with A=major, B=minor, C=patch
     }
 
     public static int
     intVersion()
     {
-        return 30300; // AABBCC, with AA=major, BB=minor, CC=patch
+        return 30301; // AABBCC, with AA=major, BB=minor, CC=patch
     }
 
     private static String _localAddress = null;
diff --git a/java/src/IceBox/ServiceManagerI.java b/java/src/IceBox/ServiceManagerI.java
index d327c4bfa9a..87fb274fac1 100644
--- a/java/src/IceBox/ServiceManagerI.java
+++ b/java/src/IceBox/ServiceManagerI.java
@@ -981,7 +981,7 @@ public class ServiceManagerI extends _ServiceManagerDisp
 
         //
         // Remaining command line options are passed to the communicator. This is
-        // necessary for Ice plugin properties (e.g.: IceSSL).
+        // necessary for Ice plug-in properties (e.g.: IceSSL).
         //
         Ice.InitializationData initData = new Ice.InitializationData();
         initData.properties = properties;
diff --git a/java/src/IceInternal/Instance.java b/java/src/IceInternal/Instance.java
index 37f95cfe1ff..a11d2044b66 100644
--- a/java/src/IceInternal/Instance.java
+++ b/java/src/IceInternal/Instance.java
@@ -553,7 +553,7 @@ public final class Instance
     setLogger(Ice.Logger logger)
     {
         // 
-        // No locking, as it can only be called during plugin loading
+        // No locking, as it can only be called during plug-in loading
         //
         _initData.logger = logger;
     }
diff --git a/java/src/IceInternal/Network.java b/java/src/IceInternal/Network.java
index 40b411d5f9d..3eb8a840d14 100644
--- a/java/src/IceInternal/Network.java
+++ b/java/src/IceInternal/Network.java
@@ -772,9 +772,7 @@ public final class Network
             //
         }
 
-        if(addr == null ||
-           (addr instanceof java.net.Inet4Address && protocol == EnableIPv6) ||
-           (addr instanceof java.net.Inet6Address && protocol == EnableIPv4))
+        if(addr == null || isValidAddr(addr, protocol))
         {
             //
             // Iterate over the network interfaces and pick an IP
@@ -785,9 +783,7 @@ public final class Network
             while(addr == null && iter.hasNext())
             {
                 java.net.InetAddress a = iter.next();
-                if(protocol == EnableBoth ||
-                   (protocol == EnableIPv4 && a instanceof java.net.Inet4Address) ||
-                   (protocol == EnableIPv6 && a instanceof java.net.Inet6Address))
+                if(protocol == EnableBoth || isValidAddr(a, protocol))
                 {
                     addr = a;
                 }
@@ -822,9 +818,7 @@ public final class Network
 
             for(int i = 0; i < addrs.length; ++i)
             {
-                if(protocol == EnableBoth ||
-                   (protocol == EnableIPv4 && addrs[i] instanceof java.net.Inet4Address) ||
-                   (protocol == EnableIPv6 && addrs[i] instanceof java.net.Inet6Address))
+                if(protocol == EnableBoth || isValidAddr(addrs[i], protocol))
                 {
                     addresses.add(new java.net.InetSocketAddress(addrs[i], port));
                 }
@@ -873,9 +867,7 @@ public final class Network
                     java.net.InetAddress addr = addrs.nextElement();
                     if(!addr.isLoopbackAddress())
                     {
-                        if(protocol == EnableBoth ||
-                           (protocol == EnableIPv4 && addr instanceof java.net.Inet4Address) ||
-                           (protocol == EnableIPv6 && addr instanceof java.net.Inet6Address))
+                        if(protocol == EnableBoth || isValidAddr(addr, protocol))
                         {
                             result.add(addr);
                         }
@@ -1148,6 +1140,20 @@ public final class Network
         return ex instanceof java.io.InterruptedIOException;
     }
 
+    private static boolean
+    isValidAddr(java.net.InetAddress addr, int protocol)
+    {
+	 byte[] bytes = null;
+	 if(addr != null)
+	 {
+	     bytes = addr.getAddress();
+	 }
+	 return bytes != null && 
+	       ((bytes.length == 16 && protocol == EnableIPv6) ||
+	        (bytes.length == 4 && protocol == EnableIPv4));
+    }
+
+
     private static java.net.InetSocketAddress
     getAddressImpl(String host, int port, int protocol, boolean server)
     {
@@ -1172,9 +1178,7 @@ public final class Network
 
             for(int i = 0; i < addrs.length; ++i)
             {
-                if(protocol == EnableBoth ||
-                   (protocol == EnableIPv4 && addrs[i] instanceof java.net.Inet4Address) ||
-                   (protocol == EnableIPv6 && addrs[i] instanceof java.net.Inet6Address))
+                if(protocol == EnableBoth || isValidAddr(addrs[i], protocol))
                 {
                     return new java.net.InetSocketAddress(addrs[i], port);
                 }
diff --git a/java/src/IceSSL/AcceptorI.java b/java/src/IceSSL/AcceptorI.java
index d07846bcc15..4ce1e5f70bf 100644
--- a/java/src/IceSSL/AcceptorI.java
+++ b/java/src/IceSSL/AcceptorI.java
@@ -47,12 +47,12 @@ final class AcceptorI implements IceInternal.Acceptor
     accept()
     {
         //
-        // The plugin may not be fully initialized.
+        // The plug-in may not be fully initialized.
         //
         if(!_instance.initialized())
         {
             Ice.PluginInitializationException ex = new Ice.PluginInitializationException();
-            ex.reason = "IceSSL: plugin is not initialized";
+            ex.reason = "IceSSL: plug-in is not initialized";
             throw ex;
         }
 
diff --git a/java/src/IceSSL/ConnectionInfo.java b/java/src/IceSSL/ConnectionInfo.java
index 53433eb4e3d..5e10a24bec8 100644
--- a/java/src/IceSSL/ConnectionInfo.java
+++ b/java/src/IceSSL/ConnectionInfo.java
@@ -42,11 +42,11 @@ public class ConnectionInfo
     // If the connection is incoming this bool is true, false
     // otherwise.
     //
-    boolean incoming;
+    public boolean incoming;
 
     //
     // The name of the object adapter that hosts this endpoint, if
     // any.
     //
-    String adapterName;
+    public String adapterName;
 }
diff --git a/java/src/IceSSL/ConnectorI.java b/java/src/IceSSL/ConnectorI.java
index b5606444887..847cb173d0a 100644
--- a/java/src/IceSSL/ConnectorI.java
+++ b/java/src/IceSSL/ConnectorI.java
@@ -15,12 +15,12 @@ final class ConnectorI implements IceInternal.Connector, java.lang.Comparable
     connect()
     {
         //
-        // The plugin may not be fully initialized.
+        // The plug-in may not be fully initialized.
         //
         if(!_instance.initialized())
         {
             Ice.PluginInitializationException ex = new Ice.PluginInitializationException();
-            ex.reason = "IceSSL: plugin is not initialized";
+            ex.reason = "IceSSL: plug-in is not initialized";
             throw ex;
         }
 
diff --git a/java/src/IceSSL/Instance.java b/java/src/IceSSL/Instance.java
index 9a53f10e9a9..afddf43071a 100644
--- a/java/src/IceSSL/Instance.java
+++ b/java/src/IceSSL/Instance.java
@@ -9,6 +9,12 @@
 
 package IceSSL;
 
+import java.io.InputStream;
+import java.util.ArrayList;
+import java.util.List;
+
+import Ice.Logger;
+
 class Instance
 {
     Instance(Ice.Communicator communicator)
@@ -19,10 +25,10 @@ class Instance
         _securityTraceCategory = "Security";
         _trustManager = new TrustManager(communicator);
 
-        // 
+        //
         // Register the endpoint factory. We have to do this now, rather than
         // in initialize, because the communicator may need to interpret
-        // proxies before the plugin is fully initialized.
+        // proxies before the plug-in is fully initialized.
         //
         _facade.addEndpointFactory(new EndpointFactoryI(this));
     }
@@ -31,7 +37,7 @@ class Instance
     initialize()
     {
         if(_initialized)
-        {   
+        {
             return;
         }
 
@@ -89,12 +95,12 @@ class Instance
         //
         _verifyDepthMax = properties.getPropertyAsIntWithDefault(prefix + "VerifyDepthMax", 2);
 
-        //  
+        //
         // Check for a certificate verifier.
-        //      
+        //
         final String certVerifierClass = properties.getProperty(prefix + "CertVerifier");
         if(certVerifierClass.length() > 0)
-        {   
+        {
             if(_verifier != null)
             {
                 Ice.PluginInitializationException e = new Ice.PluginInitializationException();
@@ -200,8 +206,6 @@ class Instance
                 final String seedFiles = properties.getProperty(prefix + "Random");
                 if(seedFiles.length() > 0)
                 {
-                    byte[] seed = null;
-                    int start = 0;
                     final String[] arr = seedFiles.split(java.io.File.pathSeparator);
                     for(int i = 0; i < arr.length; ++i)
                     {
@@ -213,34 +217,54 @@ class Instance
                             throw e;
                         }
                         java.io.File f = new java.io.File(seedFile.value);
-                        int num = (int)f.length();
-                        if(seed == null)
+                        try
                         {
-                            seed = new byte[num];
+                            _seeds.add(new java.io.FileInputStream(f));
                         }
-                        else
+                        catch(java.io.IOException ex)
                         {
-                            byte[] tmp = new byte[seed.length + num];
-                            System.arraycopy(seed, 0, tmp, 0, seed.length);
-                            start = seed.length;
-                            seed = tmp;
+                            Ice.PluginInitializationException e = new Ice.PluginInitializationException();
+                            e.reason = "IceSSL: error while reading random seed file:\n" + arr[i];
+                            e.initCause(ex);
+                            throw e;
                         }
+                    }
+                }
+
+                if(!_seeds.isEmpty())
+                {
+                    byte[] seed = null;
+                    int start = 0;
+                    for(java.util.Iterator<InputStream> p = _seeds.iterator(); p.hasNext();)
+                    {
+                        InputStream in = p.next();
                         try
                         {
-                            java.io.FileInputStream in = new java.io.FileInputStream(f);
+                            int num = in.available();
+                            if(seed == null)
+                            {
+                                seed = new byte[num];
+                            }
+                            else
+                            {
+                                byte[] tmp = new byte[seed.length + num];
+                                System.arraycopy(seed, 0, tmp, 0, seed.length);
+                                start = seed.length;
+                                seed = tmp;
+                            }
                             in.read(seed, start, num);
-                            in.close();
                         }
                         catch(java.io.IOException ex)
                         {
                             Ice.PluginInitializationException e = new Ice.PluginInitializationException();
-                            e.reason = "IceSSL: error while reading random seed file:\n" + arr[i];
+                            e.reason = "IceSSL: error while reading random seed";
                             e.initCause(ex);
                             throw e;
                         }
                     }
                     rand.setSeed(seed);
                 }
+                _seeds.clear();
 
                 //
                 // We call nextInt() in order to force the object to perform any time-consuming
@@ -264,7 +288,8 @@ class Instance
                 String keystorePassword = properties.getProperty(prefix + "KeystorePassword");
 
                 //
-                // The default keystore type value is "JKS", but it can also be "PKCS12".
+                // The default keystore type is usually "JKS", but the legal values are determined
+                // by the JVM implementation. Other possibilities include "PKCS12" and "BKS".
                 //
                 final String defaultType = java.security.KeyStore.getDefaultType();
                 final String keystoreType = properties.getPropertyWithDefault(prefix + "KeystoreType", defaultType);
@@ -285,7 +310,8 @@ class Instance
                 String truststorePassword = properties.getProperty(prefix + "TruststorePassword");
 
                 //
-                // The truststore type defaults to "JKS", but it can also be "PKCS12".
+                // The default truststore type is usually "JKS", but the legal values are determined
+                // by the JVM implementation. Other possibilities include "PKCS12" and "BKS".
                 //
                 final String truststoreType =
                     properties.getPropertyWithDefault(prefix + "TruststoreType",
@@ -295,15 +321,16 @@ class Instance
                 // Collect the key managers.
                 //
                 javax.net.ssl.KeyManager[] keyManagers = null;
-                if(keystorePath.value.length() > 0)
+                java.security.KeyStore keys = null;
+                if(_keystoreStream != null || keystorePath.value.length() > 0)
                 {
-                    if(!checkPath(keystorePath, false))
+                    if(_keystoreStream == null && !checkPath(keystorePath, false))
                     {
                         Ice.PluginInitializationException e = new Ice.PluginInitializationException();
                         e.reason = "IceSSL: keystore file not found:\n" + keystorePath.value;
                         throw e;
                     }
-                    java.security.KeyStore keys = java.security.KeyStore.getInstance(keystoreType);
+                    keys = java.security.KeyStore.getInstance(keystoreType);
                     try
                     {
                         char[] passwordChars = null;
@@ -315,9 +342,21 @@ class Instance
                         {
                             passwordChars = _passwordCallback.getKeystorePassword();
                         }
+                        else if(keystoreType.equals("BKS"))
+                        {
+                            // Bouncy Castle does not permit null passwords.
+                            passwordChars = new char[0];
+                        }
 
-                        java.io.BufferedInputStream bis =
-                            new java.io.BufferedInputStream(new java.io.FileInputStream(keystorePath.value));
+                        java.io.InputStream bis;
+                        if(_keystoreStream != null)
+                        {
+                            bis = _keystoreStream;
+                        }
+                        else
+                        {
+                            bis = new java.io.BufferedInputStream(new java.io.FileInputStream(keystorePath.value));
+                        }
                         keys.load(bis, passwordChars);
 
                         if(passwordChars != null)
@@ -337,7 +376,7 @@ class Instance
                     String algorithm = javax.net.ssl.KeyManagerFactory.getDefaultAlgorithm();
                     javax.net.ssl.KeyManagerFactory kmf = javax.net.ssl.KeyManagerFactory.getInstance(algorithm);
                     char[] passwordChars = new char[0]; // This password cannot be null.
-                    if(password.length() > 0) 
+                    if(password.length() > 0)
                     {
                         passwordChars = password.toCharArray();
                     }
@@ -377,43 +416,71 @@ class Instance
                 // Collect the trust managers.
                 //
                 javax.net.ssl.TrustManager[] trustManagers = null;
-                if(truststorePath.value.length() > 0)
+                if(_truststoreStream != null || truststorePath.value.length() > 0)
                 {
-                    if(!checkPath(truststorePath, false))
+                    if(_truststoreStream == null && !checkPath(truststorePath, false))
                     {
                         Ice.PluginInitializationException e = new Ice.PluginInitializationException();
                         e.reason = "IceSSL: truststore file not found:\n" + truststorePath.value;
                         throw e;
                     }
-                    java.security.KeyStore ts = java.security.KeyStore.getInstance(truststoreType);
-                    try
+
+                    //
+                    // If the trust store and the key store are the same input
+                    // stream or file, don't create another key store.
+                    //
+                    java.security.KeyStore ts;
+                    if((_truststoreStream != null && _truststoreStream == _keystoreStream) ||
+                       (truststorePath.value.length() > 0 && truststorePath.value.equals(keystorePath.value)))
                     {
-                        char[] passwordChars = null;
-                        if(truststorePassword.length() > 0)
-                        {
-                            passwordChars = truststorePassword.toCharArray();
-                        }
-                        else if(_passwordCallback != null)
+                        assert keys != null;
+                        ts = keys;
+                    }
+                    else
+                    {
+                        ts = java.security.KeyStore.getInstance(truststoreType);
+                        try
                         {
-                            passwordChars = _passwordCallback.getTruststorePassword();
-                        }
+                            char[] passwordChars = null;
+                            if(truststorePassword.length() > 0)
+                            {
+                                passwordChars = truststorePassword.toCharArray();
+                            }
+                            else if(_passwordCallback != null)
+                            {
+                                passwordChars = _passwordCallback.getTruststorePassword();
+                            }
+                            else if(truststoreType.equals("BKS"))
+                            {
+                                // Bouncy Castle does not permit null passwords.
+                                passwordChars = new char[0];
+                            }
 
-                        java.io.BufferedInputStream bis =
-                            new java.io.BufferedInputStream(new java.io.FileInputStream(truststorePath.value));
-                        ts.load(bis, passwordChars);
+                            java.io.InputStream bis;
+                            if(_truststoreStream != null)
+                            {
+                                bis = _truststoreStream;
+                            }
+                            else
+                            {
+                                bis = new java.io.BufferedInputStream(
+                                    new java.io.FileInputStream(truststorePath.value));
+                            }
+                            ts.load(bis, passwordChars);
 
-                        if(passwordChars != null)
+                            if(passwordChars != null)
+                            {
+                                java.util.Arrays.fill(passwordChars, '\0');
+                            }
+                            truststorePassword = null;
+                        }
+                        catch(java.io.IOException ex)
                         {
-                            java.util.Arrays.fill(passwordChars, '\0');
+                            Ice.PluginInitializationException e = new Ice.PluginInitializationException();
+                            e.reason = "IceSSL: unable to load truststore:\n" + truststorePath.value;
+                            e.initCause(ex);
+                            throw e;
                         }
-                        truststorePassword = null;
-                    }
-                    catch(java.io.IOException ex)
-                    {
-                        Ice.PluginInitializationException e = new Ice.PluginInitializationException();
-                        e.reason = "IceSSL: unable to load truststore:\n" + truststorePath.value;
-                        e.initCause(ex);
-                        throw e;
                     }
 
                     String algorithm = javax.net.ssl.TrustManagerFactory.getDefaultAlgorithm();
@@ -442,7 +509,7 @@ class Instance
                 //
                 // Initialize the SSL context.
                 //
-                _context = javax.net.ssl.SSLContext.getInstance("SSL");
+                _context = javax.net.ssl.SSLContext.getInstance("TLS");
                 _context.init(keyManagers, trustManagers, rand);
             }
             catch(java.security.GeneralSecurityException ex)
@@ -454,6 +521,13 @@ class Instance
             }
         }
 
+        //
+        // Clear cached input streams.
+        //
+        _seeds.clear();
+        _keystoreStream = null;
+        _truststoreStream = null;
+
         _initialized = true;
     }
 
@@ -463,7 +537,7 @@ class Instance
         if(_initialized)
         {
             Ice.PluginInitializationException ex = new Ice.PluginInitializationException();
-            ex.reason = "IceSSL: plugin is already initialized";
+            ex.reason = "IceSSL: plug-in is already initialized";
             throw ex;
         }
 
@@ -500,6 +574,38 @@ class Instance
         return _passwordCallback;
     }
 
+    void
+    setKeystoreStream(java.io.InputStream stream)
+    {
+        if(_initialized)
+        {
+            Ice.PluginInitializationException ex = new Ice.PluginInitializationException();
+            ex.reason = "IceSSL: plugin is already initialized";
+            throw ex;
+        }
+
+        _keystoreStream = stream;
+    }
+
+    void
+    setTruststoreStream(java.io.InputStream stream)
+    {
+        if(_initialized)
+        {
+            Ice.PluginInitializationException ex = new Ice.PluginInitializationException();
+            ex.reason = "IceSSL: plugin is already initialized";
+            throw ex;
+        }
+
+        _truststoreStream = stream;
+    }
+
+    void
+    addSeedStream(java.io.InputStream stream)
+    {
+        _seeds.add(stream);
+    }
+
     Ice.Communicator
     communicator()
     {
@@ -713,7 +819,6 @@ class Instance
         return _protocols;
     }
 
-    // TODO: Remove
     void
     traceConnection(java.nio.channels.SocketChannel fd, javax.net.ssl.SSLEngine engine, boolean incoming)
     {
@@ -861,12 +966,12 @@ class Instance
         {
             String msg = (incoming ? "incoming" : "outgoing") + " connection rejected by certificate verifier\n" +
                 IceInternal.Network.fdToString(fd);
-            
+
             if(_securityTraceLevel > 0)
             {
                 _logger.trace(_securityTraceCategory, msg);
             }
-            
+
             Ice.SecurityException ex = new Ice.SecurityException();
             ex.reason = msg;
             throw ex;
@@ -1004,4 +1109,8 @@ class Instance
     private CertificateVerifier _verifier;
     private PasswordCallback _passwordCallback;
     private TrustManager _trustManager;
+
+    private InputStream _keystoreStream;
+    private InputStream _truststoreStream;
+    private List<InputStream> _seeds = new ArrayList<InputStream>();
 }
diff --git a/java/src/IceSSL/PasswordCallback.java b/java/src/IceSSL/PasswordCallback.java
index 5a7cbb3db83..be1e9dff4cd 100644
--- a/java/src/IceSSL/PasswordCallback.java
+++ b/java/src/IceSSL/PasswordCallback.java
@@ -10,7 +10,7 @@
 package IceSSL;
 
 //
-// A password callback is an alternate way of supplying the plugin with
+// A password callback is an alternate way of supplying the plug-in with
 // passwords that avoids using plaintext configuration properties.
 //
 public interface PasswordCallback
diff --git a/java/src/IceSSL/Plugin.java b/java/src/IceSSL/Plugin.java
index c192b8d0953..7e7aabf5651 100644
--- a/java/src/IceSSL/Plugin.java
+++ b/java/src/IceSSL/Plugin.java
@@ -13,13 +13,13 @@ public interface Plugin extends Ice.Plugin
 {
     //
     // Establish the SSL context. This must be done before the
-    // plugin is initialized, therefore the application must define
+    // plug-in is initialized, therefore the application must define
     // the property Ice.InitPlugins=0, set the context, and finally
     // invoke initializePlugins on the PluginManager.
     //
     // When the application supplies its own SSL context, the
-    // plugin skips its normal property-based configuration.
-    // 
+    // plug-in skips its normal property-based configuration.
+    //
     void setContext(javax.net.ssl.SSLContext context);
 
     //
@@ -28,7 +28,7 @@ public interface Plugin extends Ice.Plugin
     //
     javax.net.ssl.SSLContext getContext();
 
-    // 
+    //
     // Establish the certificate verifier object. This should be
     // done before any connections are established.
     //
@@ -42,7 +42,7 @@ public interface Plugin extends Ice.Plugin
 
     //
     // Establish the password callback object. This should be
-    // done before the plugin is initialized.
+    // done before the plug-in is initialized.
     //
     void setPasswordCallback(PasswordCallback callback);
 
@@ -51,4 +51,24 @@ public interface Plugin extends Ice.Plugin
     // callback is set.
     //
     PasswordCallback getPasswordCallback();
+
+    //
+    // Supplies an input stream for the keystore. Calling this method
+    // causes IceSSL to ignore the IceSSL.Keystore property.
+    //
+    void setKeystoreStream(java.io.InputStream stream);
+
+    //
+    // Supplies an input stream for the truststore. Calling this method
+    // causes IceSSL to ignore the IceSSL.Truststore property. It is
+    // legal to supply the same input stream as setKeystoreStream, in
+    // which case IceSSL uses the certificates contained in the keystore.
+    //
+    void setTruststoreStream(java.io.InputStream stream);
+
+    //
+    // Add an input stream for the random number seed. You may call
+    // this method multiple times if necessary.
+    //
+    void addSeedStream(java.io.InputStream stream);
 }
diff --git a/java/src/IceSSL/PluginI.java b/java/src/IceSSL/PluginI.java
index 2e9ac2427f8..cb5cc915bc6 100644
--- a/java/src/IceSSL/PluginI.java
+++ b/java/src/IceSSL/PluginI.java
@@ -64,5 +64,23 @@ class PluginI implements Plugin
         return _instance.getPasswordCallback();
     }
 
+    public void
+    setKeystoreStream(java.io.InputStream stream)
+    {
+        _instance.setKeystoreStream(stream);
+    }
+
+    public void
+    setTruststoreStream(java.io.InputStream stream)
+    {
+        _instance.setTruststoreStream(stream);
+    }
+
+    public void
+    addSeedStream(java.io.InputStream stream)
+    {
+        _instance.addSeedStream(stream);
+    }
+
     private Instance _instance;
 }
diff --git a/java/src/IceUtil/Version.java b/java/src/IceUtil/Version.java
index db4ce177de4..cb153ac230c 100644
--- a/java/src/IceUtil/Version.java
+++ b/java/src/IceUtil/Version.java
@@ -18,6 +18,6 @@ public final class Version
     //
     // The Ice version.
     //
-    public final static String ICE_STRING_VERSION = "3.3.0"; // "A.B.C", with A=major, B=minor, C=patch
-    public final static int ICE_INT_VERSION = 30300;         // AABBCC, with AA=major, BB=minor, CC=patch
+    public final static String ICE_STRING_VERSION = "3.3.1"; // "A.B.C", with A=major, B=minor, C=patch
+    public final static int ICE_INT_VERSION = 30301;         // AABBCC, with AA=major, BB=minor, CC=patch
 }