More KNF.

2 files changed, 244 insertions, 206 deletions

diff --git a/src/lib/libssl/d1_clnt.c b/src/lib/libssl/d1_clnt.c
index fe5f1aa200..ef4a74e0af 100644
--- a/src/lib/libssl/d1_clnt.c
+++ b/src/lib/libssl/d1_clnt.c
@@ -1,7 +1,7 @@
 /* ssl/d1_clnt.c */
-/* 
+/*
  * DTLS implementation written by Nagendra Modadugu
- * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.  
+ * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
  */
 /* ====================================================================
  * Copyright (c) 1999-2007 The OpenSSL Project.  All rights reserved.
@@ -11,7 +11,7 @@
  * are met:
  *
  * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer. 
+ *    notice, this list of conditions and the following disclaimer.
  *
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in
@@ -62,21 +62,21 @@
  * This package is an SSL implementation written
  * by Eric Young (eay@cryptsoft.com).
  * The implementation was written so as to conform with Netscapes SSL.
- * 
+ *
  * This library is free for commercial and non-commercial use as long as
  * the following conditions are aheared to.  The following conditions
  * apply to all code found in this distribution, be it the RC4, RSA,
  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  * included with this distribution is covered by the same copyright terms
  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- * 
+ *
  * Copyright remains Eric Young's, and as such any Copyright notices in
  * the code are not to be removed.
  * If this package is used in a product, Eric Young should be given attribution
  * as the author of the parts of the library used.
  * This can be in the form of a textual message at program startup or
  * in documentation (online or textual) provided with the package.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -91,10 +91,10 @@
  *     Eric Young (eay@cryptsoft.com)"
  *    The word 'cryptographic' can be left out if the rouines from the library
  *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from 
+ * 4. If you include any Windows specific code (or a derivative thereof) from
  *    the apps directory (application code) you must include an acknowledgement:
  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -106,7 +106,7 @@
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
- * 
+ *
  * The licence and distribution terms for any publically available version or
  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  * copied and put under another distribution licence
@@ -225,7 +225,8 @@ dtls1_connect(SSL *s)
 
                         if ((s->version & 0xff00 ) != (DTLS1_VERSION & 0xff00) &&
                             (s->version & 0xff00 ) != (DTLS1_BAD_VER & 0xff00)) {
-                                SSLerr(SSL_F_DTLS1_CONNECT, ERR_R_INTERNAL_ERROR);
+                                SSLerr(SSL_F_DTLS1_CONNECT,
+                                    ERR_R_INTERNAL_ERROR);
                                 ret = -1;
                                 goto end;
                         }
@@ -263,7 +264,8 @@ dtls1_connect(SSL *s)
                         s->ctx->stats.sess_connect++;
                         s->init_num = 0;
                         /* mark client_random uninitialized */
-                        memset(s->s3->client_random, 0, sizeof(s->s3->client_random));
+                        memset(s->s3->client_random, 0,
+                            sizeof(s->s3->client_random));
                         s->d1->send_cookie = 0;
                         s->hit = 0;
                         break;
@@ -334,7 +336,6 @@ dtls1_connect(SSL *s)
 #ifndef OPENSSL_NO_SCTP
                         }
 #endif
-
                         break;
 
                 case SSL3_ST_CR_SRVR_HELLO_A:
@@ -349,14 +350,14 @@ dtls1_connect(SSL *s)
                                          * will be ignored if no SCTP used.
                                          */
                                         snprintf((char*) labelbuffer, sizeof(DTLS1_SCTP_AUTH_LABEL),
-                                        DTLS1_SCTP_AUTH_LABEL);
+                                            DTLS1_SCTP_AUTH_LABEL);
 
                                         SSL_export_keying_material(s, sctpauthkey,
-                                        sizeof(sctpauthkey), labelbuffer,
-                                        sizeof(labelbuffer), NULL, 0, 0);
+                                            sizeof(sctpauthkey), labelbuffer,
+                                            sizeof(labelbuffer), NULL, 0, 0);
 
                                         BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY,
-                                        sizeof(sctpauthkey), sctpauthkey);
+                                            sizeof(sctpauthkey), sctpauthkey);
 #endif
 
                                         s->state = SSL3_ST_CR_FINISHED_A;
@@ -448,12 +449,12 @@ dtls1_connect(SSL *s)
                                 s->s3->tmp.next_state = SSL3_ST_CW_KEY_EXCH_A;
                         s->init_num = 0;
 
-#ifndef OPENSSL_NO_SCTP                 
+#ifndef OPENSSL_NO_SCTP
                         if (BIO_dgram_is_sctp(SSL_get_wbio(s)) &&
                             state == SSL_ST_RENEGOTIATE)
                                 s->state = DTLS1_SCTP_ST_CR_READ_SOCK;
                         else
-#endif                  
+#endif
                                 s->state = s->s3->tmp.next_state;
                         break;
 
@@ -535,7 +536,7 @@ dtls1_connect(SSL *s)
                         if (!s->hit)
                                 dtls1_start_timer(s);
                         ret = dtls1_send_change_cipher_spec(s,
-                        SSL3_ST_CW_CHANGE_A, SSL3_ST_CW_CHANGE_B);
+                            SSL3_ST_CW_CHANGE_A, SSL3_ST_CW_CHANGE_B);
                         if (ret <= 0)
                                 goto end;
 
@@ -581,9 +582,9 @@ dtls1_connect(SSL *s)
                         if (!s->hit)
                                 dtls1_start_timer(s);
                         ret = dtls1_send_finished(s,
-                        SSL3_ST_CW_FINISHED_A, SSL3_ST_CW_FINISHED_B,
-                        s->method->ssl3_enc->client_finished_label,
-                        s->method->ssl3_enc->client_finished_label_len);
+                            SSL3_ST_CW_FINISHED_A, SSL3_ST_CW_FINISHED_B,
+                            s->method->ssl3_enc->client_finished_label,
+                            s->method->ssl3_enc->client_finished_label_len);
                         if (ret <= 0)
                                 goto end;
                         s->state = SSL3_ST_CW_FLUSH;
@@ -606,7 +607,7 @@ dtls1_connect(SSL *s)
                                                 s->state = DTLS1_SCTP_ST_CW_WRITE_SOCK;
                                         }
 #endif
-                                        s->s3->flags|=SSL3_FLAGS_POP_BUFFER;
+                                        s->s3->flags |= SSL3_FLAGS_POP_BUFFER;
                                         s->s3->delay_buf_pop_ret = 0;
                                 }
                         } else {
@@ -614,15 +615,17 @@ dtls1_connect(SSL *s)
                                 /* Change to new shared key of SCTP-Auth,
                                  * will be ignored if no SCTP used.
                                  */
-                                BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 0, NULL);
+                                BIO_ctrl(SSL_get_wbio(s),
+                                    BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 0, NULL);
 #endif
 
                                 /* Allow NewSessionTicket if ticket expected */
                                 if (s->tlsext_ticket_expected)
-                                        s->s3->tmp.next_state = SSL3_ST_CR_SESSION_TICKET_A;
+                                        s->s3->tmp.next_state =
+                                            SSL3_ST_CR_SESSION_TICKET_A;
                                 else
-
-                                        s->s3->tmp.next_state = SSL3_ST_CR_FINISHED_A;
+                                        s->s3->tmp.next_state =
+                                            SSL3_ST_CR_FINISHED_A;
                         }
                         s->init_num = 0;
                         break;
@@ -661,7 +664,7 @@ dtls1_connect(SSL *s)
 
 #ifndef OPENSSL_NO_SCTP
                         if (BIO_dgram_is_sctp(SSL_get_wbio(s)) &&
-                                state == SSL_ST_RENEGOTIATE) {
+                            state == SSL_ST_RENEGOTIATE) {
                                 s->d1->next_state = s->state;
                                 s->state = DTLS1_SCTP_ST_CW_WRITE_SOCK;
                         }
@@ -786,7 +789,7 @@ dtls1_client_hello(SSL *s)
                 /* if client_random is initialized, reuse it, we are
                  * required to use same upon reply to HelloVerify */
                 for (i = 0; p[i]=='\0' && i < sizeof(s->s3->client_random); i++)
-;
+                        ;
                 if (i == sizeof(s->s3->client_random))
                         ssl_fill_hello_random(s, 0, p,
                             sizeof(s->s3->client_random));
@@ -810,7 +813,8 @@ dtls1_client_hello(SSL *s)
                 *(p++) = i;
                 if (i != 0) {
                         if (i > sizeof s->session->session_id) {
-                                SSLerr(SSL_F_DTLS1_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
+                                SSLerr(SSL_F_DTLS1_CLIENT_HELLO,
+                                    ERR_R_INTERNAL_ERROR);
                                 goto err;
                         }
                         memcpy(p, s->session->session_id, i);
@@ -829,7 +833,8 @@ dtls1_client_hello(SSL *s)
                 /* Ciphers supported */
                 i = ssl_cipher_list_to_bytes(s, SSL_get_ciphers(s), &(p[2]), 0);
                 if (i == 0) {
-                        SSLerr(SSL_F_DTLS1_CLIENT_HELLO, SSL_R_NO_CIPHERS_AVAILABLE);
+                        SSLerr(SSL_F_DTLS1_CLIENT_HELLO,
+                            SSL_R_NO_CIPHERS_AVAILABLE);
                         goto err;
                 }
                 s2n(i, p);
@@ -847,7 +852,8 @@ dtls1_client_hello(SSL *s)
                 }
                 *(p++) = 0; /* Add the NULL method */
 
-                if ((p = ssl_add_clienthello_tlsext(s, p, buf + SSL3_RT_MAX_PLAIN_LENGTH)) == NULL) {
+                if ((p = ssl_add_clienthello_tlsext(s, p,
+                    buf + SSL3_RT_MAX_PLAIN_LENGTH)) == NULL) {
                         SSLerr(SSL_F_DTLS1_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
                         goto err;
                 }
@@ -855,7 +861,8 @@ dtls1_client_hello(SSL *s)
                 l = (p - d);
                 d = buf;
 
-                d = dtls1_set_message_header(s, d, SSL3_MT_CLIENT_HELLO, l, 0, l);
+                d = dtls1_set_message_header(s, d, SSL3_MT_CLIENT_HELLO,
+                    l, 0, l);
 
                 s->state = SSL3_ST_CW_CLNT_HELLO_B;
                 /* number of bytes to write */
@@ -879,12 +886,8 @@ dtls1_get_hello_verify(SSL *s)
         unsigned char *data;
         unsigned int cookie_len;
 
-        n = s->method->ssl_get_message(s,
-        DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A,
-        DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B,
-        -1,
-        s->max_cert_list,
-        &ok);
+        n = s->method->ssl_get_message(s, DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A,
+            DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B, -1, s->max_cert_list, &ok);
 
         if (!ok)
                 return ((int)n);
@@ -954,7 +957,8 @@ dtls1_send_client_key_exchange(SSL *s)
                                 if ((pkey == NULL) ||
                                     (pkey->type != EVP_PKEY_RSA) ||
                                     (pkey->pkey.rsa == NULL)) {
-                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
+                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                            ERR_R_INTERNAL_ERROR);
                                         goto err;
                                 }
                                 rsa = pkey->pkey.rsa;
@@ -973,9 +977,10 @@ dtls1_send_client_key_exchange(SSL *s)
                         if (s->version > SSL3_VERSION)
                                 p += 2;
                         n = RSA_public_encrypt(sizeof tmp_buf,
-                        tmp_buf, p, rsa, RSA_PKCS1_PADDING);
+                            tmp_buf, p, rsa, RSA_PKCS1_PADDING);
                         if (n <= 0) {
-                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, SSL_R_BAD_RSA_ENCRYPT);
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                    SSL_R_BAD_RSA_ENCRYPT);
                                 goto err;
                         }
 
@@ -986,30 +991,33 @@ dtls1_send_client_key_exchange(SSL *s)
                         }
 
                         s->session->master_key_length =
-                        s->method->ssl3_enc->generate_master_secret(s,
-                        s->session->master_key,
-                        tmp_buf, sizeof tmp_buf);
+                            s->method->ssl3_enc->generate_master_secret(s,
+                            s->session->master_key,
+                            tmp_buf, sizeof tmp_buf);
                         OPENSSL_cleanse(tmp_buf, sizeof tmp_buf);
-                }
-                else if (alg_k & (SSL_kEDH|SSL_kDHr|SSL_kDHd)) {
+                } else if (alg_k & (SSL_kEDH|SSL_kDHr|SSL_kDHd)) {
                         DH *dh_srvr, *dh_clnt;
 
                         if (s->session->sess_cert->peer_dh_tmp != NULL)
                                 dh_srvr = s->session->sess_cert->peer_dh_tmp;
                         else {
                                 /* we get them from the cert */
-                                ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
-                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, SSL_R_UNABLE_TO_FIND_DH_PARAMETERS);
+                                ssl3_send_alert(s, SSL3_AL_FATAL,
+                                    SSL_AD_HANDSHAKE_FAILURE);
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                    SSL_R_UNABLE_TO_FIND_DH_PARAMETERS);
                                 goto err;
                         }
 
                         /* generate a new random key */
                         if ((dh_clnt = DHparams_dup(dh_srvr)) == NULL) {
-                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_DH_LIB);
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                    ERR_R_DH_LIB);
                                 goto err;
                         }
                         if (!DH_generate_key(dh_clnt)) {
-                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_DH_LIB);
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                    ERR_R_DH_LIB);
                                 goto err;
                         }
 
@@ -1019,14 +1027,15 @@ dtls1_send_client_key_exchange(SSL *s)
                         n = DH_compute_key(p, dh_srvr->pub_key, dh_clnt);
 
                         if (n <= 0) {
-                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_DH_LIB);
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                    ERR_R_DH_LIB);
                                 goto err;
                         }
 
                         /* generate master key from the result */
                         s->session->master_key_length =
-                            s->method->ssl3_enc->generate_master_secret(s,
-                                s->session->master_key, p, n);
+                            s->method->ssl3_enc->generate_master_secret(
+                                s, s->session->master_key, p, n);
                         /* clean up */
                         memset(p, 0, n);
 
@@ -1039,8 +1048,7 @@ dtls1_send_client_key_exchange(SSL *s)
                         DH_free(dh_clnt);
 
                         /* perhaps clean things up a bit EAY EAY EAY EAY*/
-                }
-                else if (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) {
+                } else if (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) {
                         const EC_GROUP *srvr_group = NULL;
                         EC_KEY *tkey;
                         int ecdh_clnt_cert = 0;
@@ -1051,11 +1059,12 @@ dtls1_send_client_key_exchange(SSL *s)
                          * computation as part of client certificate?
                          * If so, set ecdh_clnt_cert to 1.
                          */
-                        if ((alg_k & (SSL_kECDHr|SSL_kECDHe)) && (s->cert != NULL)) {
+                        if ((alg_k & (SSL_kECDHr|SSL_kECDHe)) &&
+                            (s->cert != NULL)) {
                                 /* XXX: For now, we do not support client
                                  * authentication using ECDH certificates.
                                  * To add such support, one needs to add
-                                 * code that checks for appropriate 
+                                 * code that checks for appropriate
                                  * conditions and sets ecdh_clnt_cert to 1.
                                  * For example, the cert have an ECC
                                  * key on the same curve as the server's
@@ -1083,7 +1092,7 @@ dtls1_send_client_key_exchange(SSL *s)
                                     (srvr_pub_pkey->type != EVP_PKEY_EC) ||
                                     (srvr_pub_pkey->pkey.ec == NULL)) {
                                         SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
-                                        ERR_R_INTERNAL_ERROR);
+                                            ERR_R_INTERNAL_ERROR);
                                         goto err;
                                 }
 
@@ -1095,17 +1104,19 @@ dtls1_send_client_key_exchange(SSL *s)
 
                         if ((srvr_group == NULL) || (srvr_ecpoint == NULL)) {
                                 SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
-                                ERR_R_INTERNAL_ERROR);
+                                    ERR_R_INTERNAL_ERROR);
                                 goto err;
                         }
 
                         if ((clnt_ecdh = EC_KEY_new()) == NULL) {
-                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE);
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                    ERR_R_MALLOC_FAILURE);
                                 goto err;
                         }
 
                         if (!EC_KEY_set_group(clnt_ecdh, srvr_group)) {
-                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_EC_LIB);
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                    ERR_R_EC_LIB);
                                 goto err;
                         }
                         if (ecdh_clnt_cert) {
@@ -1117,17 +1128,20 @@ dtls1_send_client_key_exchange(SSL *s)
                                 tkey = s->cert->key->privatekey->pkey.ec;
                                 priv_key = EC_KEY_get0_private_key(tkey);
                                 if (priv_key == NULL) {
-                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE);
+                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                            ERR_R_MALLOC_FAILURE);
                                         goto err;
                                 }
                                 if (!EC_KEY_set_private_key(clnt_ecdh, priv_key)) {
-                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_EC_LIB);
+                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                            ERR_R_EC_LIB);
                                         goto err;
                                 }
                         } else {
                                 /* Generate a new ECDH key pair */
                                 if (!(EC_KEY_generate_key(clnt_ecdh))) {
-                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_ECDH_LIB);
+                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                            ERR_R_ECDH_LIB);
                                         goto err;
                                 }
                         }
@@ -1139,22 +1153,20 @@ dtls1_send_client_key_exchange(SSL *s)
                         field_size = EC_GROUP_get_degree(srvr_group);
                         if (field_size <= 0) {
                                 SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
-                                ERR_R_ECDH_LIB);
+                                    ERR_R_ECDH_LIB);
                                 goto err;
                         }
                         n = ECDH_compute_key(p, (field_size + 7)/8, srvr_ecpoint, clnt_ecdh, NULL);
                         if (n <= 0) {
                                 SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
-                                ERR_R_ECDH_LIB);
+                                    ERR_R_ECDH_LIB);
                                 goto err;
                         }
 
                         /* generate master key from the result */
-                        s->session->master_key_length = s->method->ssl3_enc \
-                            -> generate_master_secret(s, 
-                        s->session->master_key,
-                        p, n);
-
+                        s->session->master_key_length =
+                            s->method->ssl3_enc->generate_master_secret(
+                                s, s->session->master_key, p, n);
                         memset(p, 0, n); /* clean up */
 
                         if (ecdh_clnt_cert) {
@@ -1164,26 +1176,26 @@ dtls1_send_client_key_exchange(SSL *s)
                                 /* First check the size of encoding and
                                  * allocate memory accordingly.
                                  */
-                                encoded_pt_len =
-                                    EC_POINT_point2oct(srvr_group,
-                                        EC_KEY_get0_public_key(clnt_ecdh),
-                                        POINT_CONVERSION_UNCOMPRESSED,
-                                        NULL, 0, NULL);
+                                encoded_pt_len = EC_POINT_point2oct(srvr_group,
+                                    EC_KEY_get0_public_key(clnt_ecdh),
+                                    POINT_CONVERSION_UNCOMPRESSED,
+                                    NULL, 0, NULL);
 
                                 encodedPoint = malloc(encoded_pt_len);
 
                                 bn_ctx = BN_CTX_new();
                                 if ((encodedPoint == NULL) ||
                                     (bn_ctx == NULL)) {
-                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE);
+                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                            ERR_R_MALLOC_FAILURE);
                                         goto err;
                                 }
 
                                 /* Encode the public key */
                                 n = EC_POINT_point2oct(srvr_group,
                                     EC_KEY_get0_public_key(clnt_ecdh),
-                                        POINT_CONVERSION_UNCOMPRESSED,
-                                        encodedPoint, encoded_pt_len, bn_ctx);
+                                    POINT_CONVERSION_UNCOMPRESSED,
+                                    encodedPoint, encoded_pt_len, bn_ctx);
 
                                 *p = n; /* length of encoded point */
                                 /* Encoded point will be copied here */
@@ -1215,7 +1227,7 @@ dtls1_send_client_key_exchange(SSL *s)
                         n = 0;
                         if (s->psk_client_callback == NULL) {
                                 SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
-                                SSL_R_PSK_NO_CLIENT_CB);
+                                    SSL_R_PSK_NO_CLIENT_CB);
                                 goto err;
                         }
 
@@ -1236,7 +1248,8 @@ dtls1_send_client_key_exchange(SSL *s)
                         /* create PSK pre_master_secret */
                         pre_ms_len = 2 + psk_len + 2 + psk_len;
                         t = psk_or_pre_ms;
-                        memmove(psk_or_pre_ms + psk_len + 4, psk_or_pre_ms, psk_len);
+                        memmove(psk_or_pre_ms + psk_len + 4,
+                            psk_or_pre_ms, psk_len);
                         s2n(psk_len, t);
                         memset(t, 0, psk_len);
                         t += psk_len;
@@ -1246,9 +1259,9 @@ dtls1_send_client_key_exchange(SSL *s)
                         s->session->psk_identity_hint =
                             BUF_strdup(s->ctx->psk_identity_hint);
                         if (s->ctx->psk_identity_hint != NULL &&
-                                s->session->psk_identity_hint == NULL) {
+                            s->session->psk_identity_hint == NULL) {
                                 SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
-                                ERR_R_MALLOC_FAILURE);
+                                    ERR_R_MALLOC_FAILURE);
                                 goto psk_err;
                         }
 
@@ -1256,14 +1269,14 @@ dtls1_send_client_key_exchange(SSL *s)
                         s->session->psk_identity = BUF_strdup(identity);
                         if (s->session->psk_identity == NULL) {
                                 SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
-                                ERR_R_MALLOC_FAILURE);
+                                    ERR_R_MALLOC_FAILURE);
                                 goto psk_err;
                         }
 
                         s->session->master_key_length =
                             s->method->ssl3_enc->generate_master_secret(s,
-                                s->session->master_key,
-                                psk_or_pre_ms, pre_ms_len);
+                            s->session->master_key,
+                            psk_or_pre_ms, pre_ms_len);
 
                         n = strlen(identity);
                         s2n(n, p);
@@ -1274,14 +1287,17 @@ psk_err:
                         OPENSSL_cleanse(identity, PSK_MAX_IDENTITY_LEN);
                         OPENSSL_cleanse(psk_or_pre_ms, sizeof(psk_or_pre_ms));
                         if (psk_err != 0) {
-                                ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
+                                ssl3_send_alert(s, SSL3_AL_FATAL,
+                                    SSL_AD_HANDSHAKE_FAILURE);
                                 goto err;
                         }
                 }
 #endif
                 else {
-                        ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
-                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
+                        ssl3_send_alert(s, SSL3_AL_FATAL,
+                            SSL_AD_HANDSHAKE_FAILURE);
+                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                            ERR_R_INTERNAL_ERROR);
                         goto err;
                 }
 
@@ -1338,42 +1354,42 @@ dtls1_send_client_verify(SSL *s)
                         if (RSA_sign(NID_md5_sha1, data,
                             MD5_DIGEST_LENGTH + SHA_DIGEST_LENGTH,
                             &(p[2]), &u, pkey->pkey.rsa) <= 0 ) {
-                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_VERIFY, ERR_R_RSA_LIB);
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_VERIFY,
+                                    ERR_R_RSA_LIB);
                                 goto err;
                         }
                         s2n(u, p);
                         n = u + 2;
-                } else
-                if (pkey->type == EVP_PKEY_DSA) {
+                } else if (pkey->type == EVP_PKEY_DSA) {
                         if (!DSA_sign(pkey->save_type,
                             &(data[MD5_DIGEST_LENGTH]),
                             SHA_DIGEST_LENGTH, &(p[2]),
                             (unsigned int *)&j, pkey->pkey.dsa)) {
-                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_VERIFY, ERR_R_DSA_LIB);
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_VERIFY,
+                                    ERR_R_DSA_LIB);
                                 goto err;
                         }
                         s2n(j, p);
                         n = j + 2;
-                } else
-                if (pkey->type == EVP_PKEY_EC) {
+                } else if (pkey->type == EVP_PKEY_EC) {
                         if (!ECDSA_sign(pkey->save_type,
                             &(data[MD5_DIGEST_LENGTH]),
                             SHA_DIGEST_LENGTH, &(p[2]),
                             (unsigned int *)&j, pkey->pkey.ec)) {
                                 SSLerr(SSL_F_DTLS1_SEND_CLIENT_VERIFY,
-                                ERR_R_ECDSA_LIB);
+                                    ERR_R_ECDSA_LIB);
                                 goto err;
                         }
                         s2n(j, p);
                         n = j + 2;
-                } else
-                {
-                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_VERIFY, ERR_R_INTERNAL_ERROR);
+                } else {
+                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_VERIFY,
+                            ERR_R_INTERNAL_ERROR);
                         goto err;
                 }
 
                 d = dtls1_set_message_header(s, d,
-                SSL3_MT_CERTIFICATE_VERIFY, n, 0, n);
+                    SSL3_MT_CERTIFICATE_VERIFY, n, 0, n);
 
                 s->init_num = (int)n + DTLS1_HM_HEADER_LENGTH;
                 s->init_off = 0;
@@ -1425,7 +1441,8 @@ dtls1_send_client_certificate(SSL *s)
                                 i = 0;
                 } else if (i == 1) {
                         i = 0;
-                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_CERTIFICATE, SSL_R_BAD_DATA_RETURNED_BY_CALLBACK);
+                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_CERTIFICATE,
+                            SSL_R_BAD_DATA_RETURNED_BY_CALLBACK);
                 }
 
                 if (x509 != NULL)
@@ -1435,7 +1452,8 @@ dtls1_send_client_certificate(SSL *s)
                 if (i == 0) {
                         if (s->version == SSL3_VERSION) {
                                 s->s3->tmp.cert_req = 0;
-                                ssl3_send_alert(s, SSL3_AL_WARNING, SSL_AD_NO_CERTIFICATE);
+                                ssl3_send_alert(s, SSL3_AL_WARNING,
+                                    SSL_AD_NO_CERTIFICATE);
                                 return (1);
                         } else {
                                 s->s3->tmp.cert_req = 2;
@@ -1458,6 +1476,7 @@ dtls1_send_client_certificate(SSL *s)
                 /* buffer the message to handle re-xmits */
                 dtls1_buffer_message(s, 0);
         }
+
         /* SSL3_ST_CW_CERT_D */
         return (dtls1_do_write(s, SSL3_RT_HANDSHAKE));
 }
diff --git a/src/lib/libssl/src/ssl/d1_clnt.c b/src/lib/libssl/src/ssl/d1_clnt.c
index fe5f1aa200..ef4a74e0af 100644
--- a/src/lib/libssl/src/ssl/d1_clnt.c
+++ b/src/lib/libssl/src/ssl/d1_clnt.c
@@ -1,7 +1,7 @@
 /* ssl/d1_clnt.c */
-/* 
+/*
  * DTLS implementation written by Nagendra Modadugu
- * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.  
+ * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
  */
 /* ====================================================================
  * Copyright (c) 1999-2007 The OpenSSL Project.  All rights reserved.
@@ -11,7 +11,7 @@
  * are met:
  *
  * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer. 
+ *    notice, this list of conditions and the following disclaimer.
  *
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in
@@ -62,21 +62,21 @@
  * This package is an SSL implementation written
  * by Eric Young (eay@cryptsoft.com).
  * The implementation was written so as to conform with Netscapes SSL.
- * 
+ *
  * This library is free for commercial and non-commercial use as long as
  * the following conditions are aheared to.  The following conditions
  * apply to all code found in this distribution, be it the RC4, RSA,
  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  * included with this distribution is covered by the same copyright terms
  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- * 
+ *
  * Copyright remains Eric Young's, and as such any Copyright notices in
  * the code are not to be removed.
  * If this package is used in a product, Eric Young should be given attribution
  * as the author of the parts of the library used.
  * This can be in the form of a textual message at program startup or
  * in documentation (online or textual) provided with the package.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -91,10 +91,10 @@
  *     Eric Young (eay@cryptsoft.com)"
  *    The word 'cryptographic' can be left out if the rouines from the library
  *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from 
+ * 4. If you include any Windows specific code (or a derivative thereof) from
  *    the apps directory (application code) you must include an acknowledgement:
  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -106,7 +106,7 @@
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
- * 
+ *
  * The licence and distribution terms for any publically available version or
  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  * copied and put under another distribution licence
@@ -225,7 +225,8 @@ dtls1_connect(SSL *s)
 
                         if ((s->version & 0xff00 ) != (DTLS1_VERSION & 0xff00) &&
                             (s->version & 0xff00 ) != (DTLS1_BAD_VER & 0xff00)) {
-                                SSLerr(SSL_F_DTLS1_CONNECT, ERR_R_INTERNAL_ERROR);
+                                SSLerr(SSL_F_DTLS1_CONNECT,
+                                    ERR_R_INTERNAL_ERROR);
                                 ret = -1;
                                 goto end;
                         }
@@ -263,7 +264,8 @@ dtls1_connect(SSL *s)
                         s->ctx->stats.sess_connect++;
                         s->init_num = 0;
                         /* mark client_random uninitialized */
-                        memset(s->s3->client_random, 0, sizeof(s->s3->client_random));
+                        memset(s->s3->client_random, 0,
+                            sizeof(s->s3->client_random));
                         s->d1->send_cookie = 0;
                         s->hit = 0;
                         break;
@@ -334,7 +336,6 @@ dtls1_connect(SSL *s)
 #ifndef OPENSSL_NO_SCTP
                         }
 #endif
-
                         break;
 
                 case SSL3_ST_CR_SRVR_HELLO_A:
@@ -349,14 +350,14 @@ dtls1_connect(SSL *s)
                                          * will be ignored if no SCTP used.
                                          */
                                         snprintf((char*) labelbuffer, sizeof(DTLS1_SCTP_AUTH_LABEL),
-                                        DTLS1_SCTP_AUTH_LABEL);
+                                            DTLS1_SCTP_AUTH_LABEL);
 
                                         SSL_export_keying_material(s, sctpauthkey,
-                                        sizeof(sctpauthkey), labelbuffer,
-                                        sizeof(labelbuffer), NULL, 0, 0);
+                                            sizeof(sctpauthkey), labelbuffer,
+                                            sizeof(labelbuffer), NULL, 0, 0);
 
                                         BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY,
-                                        sizeof(sctpauthkey), sctpauthkey);
+                                            sizeof(sctpauthkey), sctpauthkey);
 #endif
 
                                         s->state = SSL3_ST_CR_FINISHED_A;
@@ -448,12 +449,12 @@ dtls1_connect(SSL *s)
                                 s->s3->tmp.next_state = SSL3_ST_CW_KEY_EXCH_A;
                         s->init_num = 0;
 
-#ifndef OPENSSL_NO_SCTP                 
+#ifndef OPENSSL_NO_SCTP
                         if (BIO_dgram_is_sctp(SSL_get_wbio(s)) &&
                             state == SSL_ST_RENEGOTIATE)
                                 s->state = DTLS1_SCTP_ST_CR_READ_SOCK;
                         else
-#endif                  
+#endif
                                 s->state = s->s3->tmp.next_state;
                         break;
 
@@ -535,7 +536,7 @@ dtls1_connect(SSL *s)
                         if (!s->hit)
                                 dtls1_start_timer(s);
                         ret = dtls1_send_change_cipher_spec(s,
-                        SSL3_ST_CW_CHANGE_A, SSL3_ST_CW_CHANGE_B);
+                            SSL3_ST_CW_CHANGE_A, SSL3_ST_CW_CHANGE_B);
                         if (ret <= 0)
                                 goto end;
 
@@ -581,9 +582,9 @@ dtls1_connect(SSL *s)
                         if (!s->hit)
                                 dtls1_start_timer(s);
                         ret = dtls1_send_finished(s,
-                        SSL3_ST_CW_FINISHED_A, SSL3_ST_CW_FINISHED_B,
-                        s->method->ssl3_enc->client_finished_label,
-                        s->method->ssl3_enc->client_finished_label_len);
+                            SSL3_ST_CW_FINISHED_A, SSL3_ST_CW_FINISHED_B,
+                            s->method->ssl3_enc->client_finished_label,
+                            s->method->ssl3_enc->client_finished_label_len);
                         if (ret <= 0)
                                 goto end;
                         s->state = SSL3_ST_CW_FLUSH;
@@ -606,7 +607,7 @@ dtls1_connect(SSL *s)
                                                 s->state = DTLS1_SCTP_ST_CW_WRITE_SOCK;
                                         }
 #endif
-                                        s->s3->flags|=SSL3_FLAGS_POP_BUFFER;
+                                        s->s3->flags |= SSL3_FLAGS_POP_BUFFER;
                                         s->s3->delay_buf_pop_ret = 0;
                                 }
                         } else {
@@ -614,15 +615,17 @@ dtls1_connect(SSL *s)
                                 /* Change to new shared key of SCTP-Auth,
                                  * will be ignored if no SCTP used.
                                  */
-                                BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 0, NULL);
+                                BIO_ctrl(SSL_get_wbio(s),
+                                    BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 0, NULL);
 #endif
 
                                 /* Allow NewSessionTicket if ticket expected */
                                 if (s->tlsext_ticket_expected)
-                                        s->s3->tmp.next_state = SSL3_ST_CR_SESSION_TICKET_A;
+                                        s->s3->tmp.next_state =
+                                            SSL3_ST_CR_SESSION_TICKET_A;
                                 else
-
-                                        s->s3->tmp.next_state = SSL3_ST_CR_FINISHED_A;
+                                        s->s3->tmp.next_state =
+                                            SSL3_ST_CR_FINISHED_A;
                         }
                         s->init_num = 0;
                         break;
@@ -661,7 +664,7 @@ dtls1_connect(SSL *s)
 
 #ifndef OPENSSL_NO_SCTP
                         if (BIO_dgram_is_sctp(SSL_get_wbio(s)) &&
-                                state == SSL_ST_RENEGOTIATE) {
+                            state == SSL_ST_RENEGOTIATE) {
                                 s->d1->next_state = s->state;
                                 s->state = DTLS1_SCTP_ST_CW_WRITE_SOCK;
                         }
@@ -786,7 +789,7 @@ dtls1_client_hello(SSL *s)
                 /* if client_random is initialized, reuse it, we are
                  * required to use same upon reply to HelloVerify */
                 for (i = 0; p[i]=='\0' && i < sizeof(s->s3->client_random); i++)
-;
+                        ;
                 if (i == sizeof(s->s3->client_random))
                         ssl_fill_hello_random(s, 0, p,
                             sizeof(s->s3->client_random));
@@ -810,7 +813,8 @@ dtls1_client_hello(SSL *s)
                 *(p++) = i;
                 if (i != 0) {
                         if (i > sizeof s->session->session_id) {
-                                SSLerr(SSL_F_DTLS1_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
+                                SSLerr(SSL_F_DTLS1_CLIENT_HELLO,
+                                    ERR_R_INTERNAL_ERROR);
                                 goto err;
                         }
                         memcpy(p, s->session->session_id, i);
@@ -829,7 +833,8 @@ dtls1_client_hello(SSL *s)
                 /* Ciphers supported */
                 i = ssl_cipher_list_to_bytes(s, SSL_get_ciphers(s), &(p[2]), 0);
                 if (i == 0) {
-                        SSLerr(SSL_F_DTLS1_CLIENT_HELLO, SSL_R_NO_CIPHERS_AVAILABLE);
+                        SSLerr(SSL_F_DTLS1_CLIENT_HELLO,
+                            SSL_R_NO_CIPHERS_AVAILABLE);
                         goto err;
                 }
                 s2n(i, p);
@@ -847,7 +852,8 @@ dtls1_client_hello(SSL *s)
                 }
                 *(p++) = 0; /* Add the NULL method */
 
-                if ((p = ssl_add_clienthello_tlsext(s, p, buf + SSL3_RT_MAX_PLAIN_LENGTH)) == NULL) {
+                if ((p = ssl_add_clienthello_tlsext(s, p,
+                    buf + SSL3_RT_MAX_PLAIN_LENGTH)) == NULL) {
                         SSLerr(SSL_F_DTLS1_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
                         goto err;
                 }
@@ -855,7 +861,8 @@ dtls1_client_hello(SSL *s)
                 l = (p - d);
                 d = buf;
 
-                d = dtls1_set_message_header(s, d, SSL3_MT_CLIENT_HELLO, l, 0, l);
+                d = dtls1_set_message_header(s, d, SSL3_MT_CLIENT_HELLO,
+                    l, 0, l);
 
                 s->state = SSL3_ST_CW_CLNT_HELLO_B;
                 /* number of bytes to write */
@@ -879,12 +886,8 @@ dtls1_get_hello_verify(SSL *s)
         unsigned char *data;
         unsigned int cookie_len;
 
-        n = s->method->ssl_get_message(s,
-        DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A,
-        DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B,
-        -1,
-        s->max_cert_list,
-        &ok);
+        n = s->method->ssl_get_message(s, DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A,
+            DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B, -1, s->max_cert_list, &ok);
 
         if (!ok)
                 return ((int)n);
@@ -954,7 +957,8 @@ dtls1_send_client_key_exchange(SSL *s)
                                 if ((pkey == NULL) ||
                                     (pkey->type != EVP_PKEY_RSA) ||
                                     (pkey->pkey.rsa == NULL)) {
-                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
+                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                            ERR_R_INTERNAL_ERROR);
                                         goto err;
                                 }
                                 rsa = pkey->pkey.rsa;
@@ -973,9 +977,10 @@ dtls1_send_client_key_exchange(SSL *s)
                         if (s->version > SSL3_VERSION)
                                 p += 2;
                         n = RSA_public_encrypt(sizeof tmp_buf,
-                        tmp_buf, p, rsa, RSA_PKCS1_PADDING);
+                            tmp_buf, p, rsa, RSA_PKCS1_PADDING);
                         if (n <= 0) {
-                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, SSL_R_BAD_RSA_ENCRYPT);
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                    SSL_R_BAD_RSA_ENCRYPT);
                                 goto err;
                         }
 
@@ -986,30 +991,33 @@ dtls1_send_client_key_exchange(SSL *s)
                         }
 
                         s->session->master_key_length =
-                        s->method->ssl3_enc->generate_master_secret(s,
-                        s->session->master_key,
-                        tmp_buf, sizeof tmp_buf);
+                            s->method->ssl3_enc->generate_master_secret(s,
+                            s->session->master_key,
+                            tmp_buf, sizeof tmp_buf);
                         OPENSSL_cleanse(tmp_buf, sizeof tmp_buf);
-                }
-                else if (alg_k & (SSL_kEDH|SSL_kDHr|SSL_kDHd)) {
+                } else if (alg_k & (SSL_kEDH|SSL_kDHr|SSL_kDHd)) {
                         DH *dh_srvr, *dh_clnt;
 
                         if (s->session->sess_cert->peer_dh_tmp != NULL)
                                 dh_srvr = s->session->sess_cert->peer_dh_tmp;
                         else {
                                 /* we get them from the cert */
-                                ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
-                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, SSL_R_UNABLE_TO_FIND_DH_PARAMETERS);
+                                ssl3_send_alert(s, SSL3_AL_FATAL,
+                                    SSL_AD_HANDSHAKE_FAILURE);
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                    SSL_R_UNABLE_TO_FIND_DH_PARAMETERS);
                                 goto err;
                         }
 
                         /* generate a new random key */
                         if ((dh_clnt = DHparams_dup(dh_srvr)) == NULL) {
-                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_DH_LIB);
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                    ERR_R_DH_LIB);
                                 goto err;
                         }
                         if (!DH_generate_key(dh_clnt)) {
-                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_DH_LIB);
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                    ERR_R_DH_LIB);
                                 goto err;
                         }
 
@@ -1019,14 +1027,15 @@ dtls1_send_client_key_exchange(SSL *s)
                         n = DH_compute_key(p, dh_srvr->pub_key, dh_clnt);
 
                         if (n <= 0) {
-                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_DH_LIB);
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                    ERR_R_DH_LIB);
                                 goto err;
                         }
 
                         /* generate master key from the result */
                         s->session->master_key_length =
-                            s->method->ssl3_enc->generate_master_secret(s,
-                                s->session->master_key, p, n);
+                            s->method->ssl3_enc->generate_master_secret(
+                                s, s->session->master_key, p, n);
                         /* clean up */
                         memset(p, 0, n);
 
@@ -1039,8 +1048,7 @@ dtls1_send_client_key_exchange(SSL *s)
                         DH_free(dh_clnt);
 
                         /* perhaps clean things up a bit EAY EAY EAY EAY*/
-                }
-                else if (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) {
+                } else if (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) {
                         const EC_GROUP *srvr_group = NULL;
                         EC_KEY *tkey;
                         int ecdh_clnt_cert = 0;
@@ -1051,11 +1059,12 @@ dtls1_send_client_key_exchange(SSL *s)
                          * computation as part of client certificate?
                          * If so, set ecdh_clnt_cert to 1.
                          */
-                        if ((alg_k & (SSL_kECDHr|SSL_kECDHe)) && (s->cert != NULL)) {
+                        if ((alg_k & (SSL_kECDHr|SSL_kECDHe)) &&
+                            (s->cert != NULL)) {
                                 /* XXX: For now, we do not support client
                                  * authentication using ECDH certificates.
                                  * To add such support, one needs to add
-                                 * code that checks for appropriate 
+                                 * code that checks for appropriate
                                  * conditions and sets ecdh_clnt_cert to 1.
                                  * For example, the cert have an ECC
                                  * key on the same curve as the server's
@@ -1083,7 +1092,7 @@ dtls1_send_client_key_exchange(SSL *s)
                                     (srvr_pub_pkey->type != EVP_PKEY_EC) ||
                                     (srvr_pub_pkey->pkey.ec == NULL)) {
                                         SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
-                                        ERR_R_INTERNAL_ERROR);
+                                            ERR_R_INTERNAL_ERROR);
                                         goto err;
                                 }
 
@@ -1095,17 +1104,19 @@ dtls1_send_client_key_exchange(SSL *s)
 
                         if ((srvr_group == NULL) || (srvr_ecpoint == NULL)) {
                                 SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
-                                ERR_R_INTERNAL_ERROR);
+                                    ERR_R_INTERNAL_ERROR);
                                 goto err;
                         }
 
                         if ((clnt_ecdh = EC_KEY_new()) == NULL) {
-                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE);
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                    ERR_R_MALLOC_FAILURE);
                                 goto err;
                         }
 
                         if (!EC_KEY_set_group(clnt_ecdh, srvr_group)) {
-                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_EC_LIB);
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                    ERR_R_EC_LIB);
                                 goto err;
                         }
                         if (ecdh_clnt_cert) {
@@ -1117,17 +1128,20 @@ dtls1_send_client_key_exchange(SSL *s)
                                 tkey = s->cert->key->privatekey->pkey.ec;
                                 priv_key = EC_KEY_get0_private_key(tkey);
                                 if (priv_key == NULL) {
-                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE);
+                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                            ERR_R_MALLOC_FAILURE);
                                         goto err;
                                 }
                                 if (!EC_KEY_set_private_key(clnt_ecdh, priv_key)) {
-                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_EC_LIB);
+                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                            ERR_R_EC_LIB);
                                         goto err;
                                 }
                         } else {
                                 /* Generate a new ECDH key pair */
                                 if (!(EC_KEY_generate_key(clnt_ecdh))) {
-                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_ECDH_LIB);
+                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                            ERR_R_ECDH_LIB);
                                         goto err;
                                 }
                         }
@@ -1139,22 +1153,20 @@ dtls1_send_client_key_exchange(SSL *s)
                         field_size = EC_GROUP_get_degree(srvr_group);
                         if (field_size <= 0) {
                                 SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
-                                ERR_R_ECDH_LIB);
+                                    ERR_R_ECDH_LIB);
                                 goto err;
                         }
                         n = ECDH_compute_key(p, (field_size + 7)/8, srvr_ecpoint, clnt_ecdh, NULL);
                         if (n <= 0) {
                                 SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
-                                ERR_R_ECDH_LIB);
+                                    ERR_R_ECDH_LIB);
                                 goto err;
                         }
 
                         /* generate master key from the result */
-                        s->session->master_key_length = s->method->ssl3_enc \
-                            -> generate_master_secret(s, 
-                        s->session->master_key,
-                        p, n);
-
+                        s->session->master_key_length =
+                            s->method->ssl3_enc->generate_master_secret(
+                                s, s->session->master_key, p, n);
                         memset(p, 0, n); /* clean up */
 
                         if (ecdh_clnt_cert) {
@@ -1164,26 +1176,26 @@ dtls1_send_client_key_exchange(SSL *s)
                                 /* First check the size of encoding and
                                  * allocate memory accordingly.
                                  */
-                                encoded_pt_len =
-                                    EC_POINT_point2oct(srvr_group,
-                                        EC_KEY_get0_public_key(clnt_ecdh),
-                                        POINT_CONVERSION_UNCOMPRESSED,
-                                        NULL, 0, NULL);
+                                encoded_pt_len = EC_POINT_point2oct(srvr_group,
+                                    EC_KEY_get0_public_key(clnt_ecdh),
+                                    POINT_CONVERSION_UNCOMPRESSED,
+                                    NULL, 0, NULL);
 
                                 encodedPoint = malloc(encoded_pt_len);
 
                                 bn_ctx = BN_CTX_new();
                                 if ((encodedPoint == NULL) ||
                                     (bn_ctx == NULL)) {
-                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE);
+                                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                                            ERR_R_MALLOC_FAILURE);
                                         goto err;
                                 }
 
                                 /* Encode the public key */
                                 n = EC_POINT_point2oct(srvr_group,
                                     EC_KEY_get0_public_key(clnt_ecdh),
-                                        POINT_CONVERSION_UNCOMPRESSED,
-                                        encodedPoint, encoded_pt_len, bn_ctx);
+                                    POINT_CONVERSION_UNCOMPRESSED,
+                                    encodedPoint, encoded_pt_len, bn_ctx);
 
                                 *p = n; /* length of encoded point */
                                 /* Encoded point will be copied here */
@@ -1215,7 +1227,7 @@ dtls1_send_client_key_exchange(SSL *s)
                         n = 0;
                         if (s->psk_client_callback == NULL) {
                                 SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
-                                SSL_R_PSK_NO_CLIENT_CB);
+                                    SSL_R_PSK_NO_CLIENT_CB);
                                 goto err;
                         }
 
@@ -1236,7 +1248,8 @@ dtls1_send_client_key_exchange(SSL *s)
                         /* create PSK pre_master_secret */
                         pre_ms_len = 2 + psk_len + 2 + psk_len;
                         t = psk_or_pre_ms;
-                        memmove(psk_or_pre_ms + psk_len + 4, psk_or_pre_ms, psk_len);
+                        memmove(psk_or_pre_ms + psk_len + 4,
+                            psk_or_pre_ms, psk_len);
                         s2n(psk_len, t);
                         memset(t, 0, psk_len);
                         t += psk_len;
@@ -1246,9 +1259,9 @@ dtls1_send_client_key_exchange(SSL *s)
                         s->session->psk_identity_hint =
                             BUF_strdup(s->ctx->psk_identity_hint);
                         if (s->ctx->psk_identity_hint != NULL &&
-                                s->session->psk_identity_hint == NULL) {
+                            s->session->psk_identity_hint == NULL) {
                                 SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
-                                ERR_R_MALLOC_FAILURE);
+                                    ERR_R_MALLOC_FAILURE);
                                 goto psk_err;
                         }
 
@@ -1256,14 +1269,14 @@ dtls1_send_client_key_exchange(SSL *s)
                         s->session->psk_identity = BUF_strdup(identity);
                         if (s->session->psk_identity == NULL) {
                                 SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
-                                ERR_R_MALLOC_FAILURE);
+                                    ERR_R_MALLOC_FAILURE);
                                 goto psk_err;
                         }
 
                         s->session->master_key_length =
                             s->method->ssl3_enc->generate_master_secret(s,
-                                s->session->master_key,
-                                psk_or_pre_ms, pre_ms_len);
+                            s->session->master_key,
+                            psk_or_pre_ms, pre_ms_len);
 
                         n = strlen(identity);
                         s2n(n, p);
@@ -1274,14 +1287,17 @@ psk_err:
                         OPENSSL_cleanse(identity, PSK_MAX_IDENTITY_LEN);
                         OPENSSL_cleanse(psk_or_pre_ms, sizeof(psk_or_pre_ms));
                         if (psk_err != 0) {
-                                ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
+                                ssl3_send_alert(s, SSL3_AL_FATAL,
+                                    SSL_AD_HANDSHAKE_FAILURE);
                                 goto err;
                         }
                 }
 #endif
                 else {
-                        ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
-                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
+                        ssl3_send_alert(s, SSL3_AL_FATAL,
+                            SSL_AD_HANDSHAKE_FAILURE);
+                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+                            ERR_R_INTERNAL_ERROR);
                         goto err;
                 }
 
@@ -1338,42 +1354,42 @@ dtls1_send_client_verify(SSL *s)
                         if (RSA_sign(NID_md5_sha1, data,
                             MD5_DIGEST_LENGTH + SHA_DIGEST_LENGTH,
                             &(p[2]), &u, pkey->pkey.rsa) <= 0 ) {
-                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_VERIFY, ERR_R_RSA_LIB);
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_VERIFY,
+                                    ERR_R_RSA_LIB);
                                 goto err;
                         }
                         s2n(u, p);
                         n = u + 2;
-                } else
-                if (pkey->type == EVP_PKEY_DSA) {
+                } else if (pkey->type == EVP_PKEY_DSA) {
                         if (!DSA_sign(pkey->save_type,
                             &(data[MD5_DIGEST_LENGTH]),
                             SHA_DIGEST_LENGTH, &(p[2]),
                             (unsigned int *)&j, pkey->pkey.dsa)) {
-                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_VERIFY, ERR_R_DSA_LIB);
+                                SSLerr(SSL_F_DTLS1_SEND_CLIENT_VERIFY,
+                                    ERR_R_DSA_LIB);
                                 goto err;
                         }
                         s2n(j, p);
                         n = j + 2;
-                } else
-                if (pkey->type == EVP_PKEY_EC) {
+                } else if (pkey->type == EVP_PKEY_EC) {
                         if (!ECDSA_sign(pkey->save_type,
                             &(data[MD5_DIGEST_LENGTH]),
                             SHA_DIGEST_LENGTH, &(p[2]),
                             (unsigned int *)&j, pkey->pkey.ec)) {
                                 SSLerr(SSL_F_DTLS1_SEND_CLIENT_VERIFY,
-                                ERR_R_ECDSA_LIB);
+                                    ERR_R_ECDSA_LIB);
                                 goto err;
                         }
                         s2n(j, p);
                         n = j + 2;
-                } else
-                {
-                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_VERIFY, ERR_R_INTERNAL_ERROR);
+                } else {
+                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_VERIFY,
+                            ERR_R_INTERNAL_ERROR);
                         goto err;
                 }
 
                 d = dtls1_set_message_header(s, d,
-                SSL3_MT_CERTIFICATE_VERIFY, n, 0, n);
+                    SSL3_MT_CERTIFICATE_VERIFY, n, 0, n);
 
                 s->init_num = (int)n + DTLS1_HM_HEADER_LENGTH;
                 s->init_off = 0;
@@ -1425,7 +1441,8 @@ dtls1_send_client_certificate(SSL *s)
                                 i = 0;
                 } else if (i == 1) {
                         i = 0;
-                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_CERTIFICATE, SSL_R_BAD_DATA_RETURNED_BY_CALLBACK);
+                        SSLerr(SSL_F_DTLS1_SEND_CLIENT_CERTIFICATE,
+                            SSL_R_BAD_DATA_RETURNED_BY_CALLBACK);
                 }
 
                 if (x509 != NULL)
@@ -1435,7 +1452,8 @@ dtls1_send_client_certificate(SSL *s)
                 if (i == 0) {
                         if (s->version == SSL3_VERSION) {
                                 s->s3->tmp.cert_req = 0;
-                                ssl3_send_alert(s, SSL3_AL_WARNING, SSL_AD_NO_CERTIFICATE);
+                                ssl3_send_alert(s, SSL3_AL_WARNING,
+                                    SSL_AD_NO_CERTIFICATE);
                                 return (1);
                         } else {
                                 s->s3->tmp.cert_req = 2;
@@ -1458,6 +1476,7 @@ dtls1_send_client_certificate(SSL *s)
                 /* buffer the message to handle re-xmits */
                 dtls1_buffer_message(s, 0);
         }
+
         /* SSL3_ST_CW_CERT_D */
         return (dtls1_do_write(s, SSL3_RT_HANDSHAKE));
 }