First pass at applying KNF to the OpenSSL code, which almost makes it

readable. This pass is whitespace only and can readily be verified using
tr and md5.

10 files changed, 7852 insertions, 8356 deletions

diff --git a/src/lib/libssl/s3_both.c b/src/lib/libssl/s3_both.c
index 77f825af31..b2fd5c6f80 100644
--- a/src/lib/libssl/s3_both.c
+++ b/src/lib/libssl/s3_both.c
@@ -125,82 +125,81 @@
 #include <openssl/x509.h>
 
 /* send s->init_buf in records of type 'type' (SSL3_RT_HANDSHAKE or SSL3_RT_CHANGE_CIPHER_SPEC) */
-int ssl3_do_write(SSL *s, int type)
-        {
+int
+ssl3_do_write(SSL *s, int type)
+{
         int ret;
 
-        ret=ssl3_write_bytes(s,type,&s->init_buf->data[s->init_off],
-                             s->init_num);
-        if (ret < 0) return(-1);
+        ret = ssl3_write_bytes(s, type, &s->init_buf->data[s->init_off],
+        s->init_num);
+        if (ret < 0)
+                return (-1);
         if (type == SSL3_RT_HANDSHAKE)
                 /* should not be done for 'Hello Request's, but in that case
                  * we'll ignore the result anyway */
-                ssl3_finish_mac(s,(unsigned char *)&s->init_buf->data[s->init_off],ret);
-        
-        if (ret == s->init_num)
-                {
+                ssl3_finish_mac(s,(unsigned char *)&s->init_buf->data[s->init_off], ret);
+
+        if (ret == s->init_num) {
                 if (s->msg_callback)
                         s->msg_callback(1, s->version, type, s->init_buf->data, (size_t)(s->init_off + s->init_num), s, s->msg_callback_arg);
-                return(1);
-                }
-        s->init_off+=ret;
-        s->init_num-=ret;
-        return(0);
+                return (1);
         }
+        s->init_off += ret;
+        s->init_num -= ret;
+        return (0);
+}
 
-int ssl3_send_finished(SSL *s, int a, int b, const char *sender, int slen)
-        {
-        unsigned char *p,*d;
+int
+ssl3_send_finished(SSL *s, int a, int b, const char *sender, int slen)
+{
+        unsigned char *p, *d;
         int i;
         unsigned long l;
 
-        if (s->state == a)
-                {
-                d=(unsigned char *)s->init_buf->data;
-                p= &(d[4]);
+        if (s->state == a) {
+                d = (unsigned char *)s->init_buf->data;
+                p = &(d[4]);
 
-                i=s->method->ssl3_enc->final_finish_mac(s,
-                        sender,slen,s->s3->tmp.finish_md);
+                i = s->method->ssl3_enc->final_finish_mac(s,
+                sender, slen, s->s3->tmp.finish_md);
                 if (i == 0)
                         return 0;
                 s->s3->tmp.finish_md_len = i;
                 memcpy(p, s->s3->tmp.finish_md, i);
-                p+=i;
-                l=i;
+                p += i;
+                l = i;
 
                 /* Copy the finished so we can use it for
                    renegotiation checks */
-                if(s->type == SSL_ST_CONNECT)
-                        {
-                         OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
-                         memcpy(s->s3->previous_client_finished, 
-                             s->s3->tmp.finish_md, i);
-                         s->s3->previous_client_finished_len=i;
-                        }
-                else
-                        {
-                        OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
-                        memcpy(s->s3->previous_server_finished, 
-                            s->s3->tmp.finish_md, i);
-                        s->s3->previous_server_finished_len=i;
-                        }
-
-                *(d++)=SSL3_MT_FINISHED;
-                l2n3(l,d);
-                s->init_num=(int)l+4;
-                s->init_off=0;
-
-                s->state=b;
+                if (s->type == SSL_ST_CONNECT) {
+                        OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
+                        memcpy(s->s3->previous_client_finished,
+                        s->s3->tmp.finish_md, i);
+                        s->s3->previous_client_finished_len = i;
+                } else {
+                        OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
+                        memcpy(s->s3->previous_server_finished,
+                        s->s3->tmp.finish_md, i);
+                        s->s3->previous_server_finished_len = i;
                 }
 
-        /* SSL3_ST_SEND_xxxxxx_HELLO_B */
-        return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
+                *(d++) = SSL3_MT_FINISHED;
+                l2n3(l, d);
+                s->init_num = (int)l + 4;
+                s->init_off = 0;
+
+                s->state = b;
         }
 
+        /* SSL3_ST_SEND_xxxxxx_HELLO_B */
+        return (ssl3_do_write(s, SSL3_RT_HANDSHAKE));
+}
+
 #ifndef OPENSSL_NO_NEXTPROTONEG
 /* ssl3_take_mac calculates the Finished MAC for the handshakes messages seen to far. */
-static void ssl3_take_mac(SSL *s)
-        {
+static void
+ssl3_take_mac(SSL *s)
+{
         const char *sender;
         int slen;
         /* If no new cipher setup return immediately: other functions will
@@ -208,25 +207,23 @@ static void ssl3_take_mac(SSL *s)
          */
         if (s->s3->tmp.new_cipher == NULL)
                 return;
-        if (s->state & SSL_ST_CONNECT)
-                {
-                sender=s->method->ssl3_enc->server_finished_label;
-                slen=s->method->ssl3_enc->server_finished_label_len;
-                }
-        else
-                {
-                sender=s->method->ssl3_enc->client_finished_label;
-                slen=s->method->ssl3_enc->client_finished_label_len;
-                }
+        if (s->state & SSL_ST_CONNECT) {
+                sender = s->method->ssl3_enc->server_finished_label;
+                slen = s->method->ssl3_enc->server_finished_label_len;
+        } else {
+                sender = s->method->ssl3_enc->client_finished_label;
+                slen = s->method->ssl3_enc->client_finished_label_len;
+        }
 
         s->s3->tmp.peer_finish_md_len = s->method->ssl3_enc->final_finish_mac(s,
-                sender,slen,s->s3->tmp.peer_finish_md);
-        }
+        sender, slen, s->s3->tmp.peer_finish_md);
+}
 #endif
 
-int ssl3_get_finished(SSL *s, int a, int b)
-        {
-        int al,i,ok;
+int
+ssl3_get_finished(SSL *s, int a, int b)
+{
+        int al, i, ok;
         long n;
         unsigned char *p;
 
@@ -236,64 +233,55 @@ int ssl3_get_finished(SSL *s, int a, int b)
          */ 
 #endif
 
-        n=s->method->ssl_get_message(s,
-                a,
-                b,
-                SSL3_MT_FINISHED,
-                64, /* should actually be 36+4 :-) */
-                &ok);
+        n = s->method->ssl_get_message(s, a, b, SSL3_MT_FINISHED,
+            64, /* should actually be 36+4 :-) */ &ok);
 
-        if (!ok) return((int)n);
+        if (!ok)
+                return ((int)n);
 
         /* If this occurs, we have missed a message */
-        if (!s->s3->change_cipher_spec)
-                {
-                al=SSL_AD_UNEXPECTED_MESSAGE;
-                SSLerr(SSL_F_SSL3_GET_FINISHED,SSL_R_GOT_A_FIN_BEFORE_A_CCS);
+        if (!s->s3->change_cipher_spec) {
+                al = SSL_AD_UNEXPECTED_MESSAGE;
+                SSLerr(SSL_F_SSL3_GET_FINISHED, SSL_R_GOT_A_FIN_BEFORE_A_CCS);
                 goto f_err;
-                }
-        s->s3->change_cipher_spec=0;
+        }
+        s->s3->change_cipher_spec = 0;
 
         p = (unsigned char *)s->init_msg;
         i = s->s3->tmp.peer_finish_md_len;
 
-        if (i != n)
-                {
-                al=SSL_AD_DECODE_ERROR;
-                SSLerr(SSL_F_SSL3_GET_FINISHED,SSL_R_BAD_DIGEST_LENGTH);
+        if (i != n) {
+                al = SSL_AD_DECODE_ERROR;
+                SSLerr(SSL_F_SSL3_GET_FINISHED, SSL_R_BAD_DIGEST_LENGTH);
                 goto f_err;
-                }
+        }
 
-        if (CRYPTO_memcmp(p, s->s3->tmp.peer_finish_md, i) != 0)
-                {
-                al=SSL_AD_DECRYPT_ERROR;
-                SSLerr(SSL_F_SSL3_GET_FINISHED,SSL_R_DIGEST_CHECK_FAILED);
+        if (CRYPTO_memcmp(p, s->s3->tmp.peer_finish_md, i) != 0) {
+                al = SSL_AD_DECRYPT_ERROR;
+                SSLerr(SSL_F_SSL3_GET_FINISHED, SSL_R_DIGEST_CHECK_FAILED);
                 goto f_err;
-                }
+        }
 
         /* Copy the finished so we can use it for
            renegotiation checks */
-        if(s->type == SSL_ST_ACCEPT)
-                {
-                OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
-                memcpy(s->s3->previous_client_finished, 
-                    s->s3->tmp.peer_finish_md, i);
-                s->s3->previous_client_finished_len=i;
-                }
-        else
-                {
-                OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
-                memcpy(s->s3->previous_server_finished, 
-                    s->s3->tmp.peer_finish_md, i);
-                s->s3->previous_server_finished_len=i;
-                }
-
-        return(1);
-f_err:
-        ssl3_send_alert(s,SSL3_AL_FATAL,al);
-        return(0);
+        if (s->type == SSL_ST_ACCEPT) {
+                OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
+                memcpy(s->s3->previous_client_finished,
+                s->s3->tmp.peer_finish_md, i);
+                s->s3->previous_client_finished_len = i;
+        } else {
+                OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
+                memcpy(s->s3->previous_server_finished,
+                s->s3->tmp.peer_finish_md, i);
+                s->s3->previous_server_finished_len = i;
         }
 
+        return (1);
+f_err:
+        ssl3_send_alert(s, SSL3_AL_FATAL, al);
+        return (0);
+}
+
 /* for these 2 messages, we need to
  * ssl->enc_read_ctx                    re-init
  * ssl->s3->read_sequence               zero
@@ -302,48 +290,49 @@ f_err:
  * ssl->session->read_compression       assign
  * ssl->session->read_hash              assign
  */
-int ssl3_send_change_cipher_spec(SSL *s, int a, int b)
-        { 
+int
+ssl3_send_change_cipher_spec(SSL *s, int a, int b)
+{
         unsigned char *p;
 
-        if (s->state == a)
-                {
-                p=(unsigned char *)s->init_buf->data;
-                *p=SSL3_MT_CCS;
-                s->init_num=1;
-                s->init_off=0;
+        if (s->state == a) {
+                p = (unsigned char *)s->init_buf->data;
+                *p = SSL3_MT_CCS;
+                s->init_num = 1;
+                s->init_off = 0;
 
-                s->state=b;
-                }
+                s->state = b;
+        }
 
         /* SSL3_ST_CW_CHANGE_B */
-        return(ssl3_do_write(s,SSL3_RT_CHANGE_CIPHER_SPEC));
-        }
+        return (ssl3_do_write(s, SSL3_RT_CHANGE_CIPHER_SPEC));
+}
 
-static int ssl3_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)
-        {
+static int
+ssl3_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)
+{
         int n;
         unsigned char *p;
 
-        n=i2d_X509(x,NULL);
-        if (!BUF_MEM_grow_clean(buf,(int)(n+(*l)+3)))
-                {
-                SSLerr(SSL_F_SSL3_ADD_CERT_TO_BUF,ERR_R_BUF_LIB);
-                return(-1);
-                }
-        p=(unsigned char *)&(buf->data[*l]);
-        l2n3(n,p);
-        i2d_X509(x,&p);
-        *l+=n+3;
-
-        return(0);
+        n = i2d_X509(x, NULL);
+        if (!BUF_MEM_grow_clean(buf,(int)(n + (*l) + 3))) {
+                SSLerr(SSL_F_SSL3_ADD_CERT_TO_BUF, ERR_R_BUF_LIB);
+                return (-1);
         }
+        p = (unsigned char *)&(buf->data[*l]);
+        l2n3(n, p);
+        i2d_X509(x, &p);
+        *l += n + 3;
 
-unsigned long ssl3_output_cert_chain(SSL *s, X509 *x)
-        {
+        return (0);
+}
+
+unsigned long
+ssl3_output_cert_chain(SSL *s, X509 *x)
+{
         unsigned char *p;
         int i;
-        unsigned long l=7;
+        unsigned long l = 7;
         BUF_MEM *buf;
         int no_chain;
 
@@ -353,111 +342,99 @@ unsigned long ssl3_output_cert_chain(SSL *s, X509 *x)
                 no_chain = 0;
 
         /* TLSv1 sends a chain with nothing in it, instead of an alert */
-        buf=s->init_buf;
-        if (!BUF_MEM_grow_clean(buf,10))
-                {
-                SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN,ERR_R_BUF_LIB);
-                return(0);
-                }
-        if (x != NULL)
-                {
-                if (no_chain)
-                        {
+        buf = s->init_buf;
+        if (!BUF_MEM_grow_clean(buf, 10)) {
+                SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN, ERR_R_BUF_LIB);
+                return (0);
+        }
+        if (x != NULL) {
+                if (no_chain) {
                         if (ssl3_add_cert_to_buf(buf, &l, x))
-                                return(0);
-                        }
-                else
-                        {
+                                return (0);
+                } else {
                         X509_STORE_CTX xs_ctx;
 
-                        if (!X509_STORE_CTX_init(&xs_ctx,s->ctx->cert_store,x,NULL))
-                                {
-                                SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN,ERR_R_X509_LIB);
-                                return(0);
-                                }
+                        if (!X509_STORE_CTX_init(&xs_ctx, s->ctx->cert_store, x, NULL)) {
+                                SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN, ERR_R_X509_LIB);
+                                return (0);
+                        }
                         X509_verify_cert(&xs_ctx);
                         /* Don't leave errors in the queue */
                         ERR_clear_error();
-                        for (i=0; i < sk_X509_num(xs_ctx.chain); i++)
-                                {
+                        for (i = 0; i < sk_X509_num(xs_ctx.chain); i++) {
                                 x = sk_X509_value(xs_ctx.chain, i);
 
-                                if (ssl3_add_cert_to_buf(buf, &l, x))
-                                        {
+                                if (ssl3_add_cert_to_buf(buf, &l, x)) {
                                         X509_STORE_CTX_cleanup(&xs_ctx);
                                         return 0;
-                                        }
                                 }
-                        X509_STORE_CTX_cleanup(&xs_ctx);
                         }
+                        X509_STORE_CTX_cleanup(&xs_ctx);
                 }
+        }
         /* Thawte special :-) */
-        for (i=0; i<sk_X509_num(s->ctx->extra_certs); i++)
-                {
-                x=sk_X509_value(s->ctx->extra_certs,i);
+        for (i = 0; i < sk_X509_num(s->ctx->extra_certs); i++) {
+                x = sk_X509_value(s->ctx->extra_certs, i);
                 if (ssl3_add_cert_to_buf(buf, &l, x))
-                        return(0);
-                }
-
-        l-=7;
-        p=(unsigned char *)&(buf->data[4]);
-        l2n3(l,p);
-        l+=3;
-        p=(unsigned char *)&(buf->data[0]);
-        *(p++)=SSL3_MT_CERTIFICATE;
-        l2n3(l,p);
-        l+=4;
-        return(l);
+                        return (0);
         }
 
+        l -= 7;
+        p = (unsigned char *)&(buf->data[4]);
+        l2n3(l, p);
+        l += 3;
+        p = (unsigned char *)&(buf->data[0]);
+        *(p++) = SSL3_MT_CERTIFICATE;
+        l2n3(l, p);
+        l += 4;
+        return (l);
+}
+
 /* Obtain handshake message of message type 'mt' (any if mt == -1),
  * maximum acceptable body length 'max'.
  * The first four bytes (msg_type and length) are read in state 'st1',
  * the body is read in state 'stn'.
  */
-long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
-        {
+long
+ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
+{
         unsigned char *p;
         unsigned long l;
         long n;
-        int i,al;
+        int i, al;
 
-        if (s->s3->tmp.reuse_message)
-                {
-                s->s3->tmp.reuse_message=0;
-                if ((mt >= 0) && (s->s3->tmp.message_type != mt))
-                        {
-                        al=SSL_AD_UNEXPECTED_MESSAGE;
-                        SSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_UNEXPECTED_MESSAGE);
+        if (s->s3->tmp.reuse_message) {
+                s->s3->tmp.reuse_message = 0;
+                if ((mt >= 0) && (s->s3->tmp.message_type != mt)) {
+                        al = SSL_AD_UNEXPECTED_MESSAGE;
+                        SSLerr(SSL_F_SSL3_GET_MESSAGE, SSL_R_UNEXPECTED_MESSAGE);
                         goto f_err;
-                        }
-                *ok=1;
+                }
+                *ok = 1;
                 s->init_msg = s->init_buf->data + 4;
                 s->init_num = (int)s->s3->tmp.message_size;
                 return s->init_num;
-                }
+        }
 
-        p=(unsigned char *)s->init_buf->data;
+        p = (unsigned char *)s->init_buf->data;
 
         if (s->state == st1) /* s->init_num < 4 */
-                {
+        {
                 int skip_message;
 
-                do
-                        {
-                        while (s->init_num < 4)
-                                {
-                                i=s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE,
-                                        &p[s->init_num],4 - s->init_num, 0);
-                                if (i <= 0)
-                                        {
-                                        s->rwstate=SSL_READING;
+                do {
+                        while (s->init_num < 4) {
+                                i = s->method->ssl_read_bytes(s,
+                                    SSL3_RT_HANDSHAKE, &p[s->init_num],
+                                    4 - s->init_num, 0);
+                                if (i <= 0) {
+                                        s->rwstate = SSL_READING;
                                         *ok = 0;
                                         return i;
-                                        }
-                                s->init_num+=i;
                                 }
-                        
+                                s->init_num += i;
+                        }
+
                         skip_message = 0;
                         if (!s->server)
                                 if (p[0] == SSL3_MT_HELLO_REQUEST)
@@ -465,79 +442,72 @@ long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
                                          * we are doing a handshake anyway now, so ignore them
                                          * if their format is correct. Does not count for
                                          * 'Finished' MAC. */
-                                        if (p[1] == 0 && p[2] == 0 &&p[3] == 0)
-                                                {
-                                                s->init_num = 0;
-                                                skip_message = 1;
-
-                                                if (s->msg_callback)
-                                                        s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, p, 4, s, s->msg_callback_arg);
-                                                }
+                        if (p[1] == 0 && p[2] == 0 &&p[3] == 0) {
+                                s->init_num = 0;
+                                skip_message = 1;
+
+                                if (s->msg_callback)
+                                        s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, p, 4, s, s->msg_callback_arg);
                         }
+                }
                 while (skip_message);
 
                 /* s->init_num == 4 */
 
-                if ((mt >= 0) && (*p != mt))
-                        {
-                        al=SSL_AD_UNEXPECTED_MESSAGE;
-                        SSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_UNEXPECTED_MESSAGE);
+                if ((mt >= 0) && (*p != mt)) {
+                        al = SSL_AD_UNEXPECTED_MESSAGE;
+                        SSLerr(SSL_F_SSL3_GET_MESSAGE, SSL_R_UNEXPECTED_MESSAGE);
                         goto f_err;
-                        }
+                }
                 if ((mt < 0) && (*p == SSL3_MT_CLIENT_HELLO) &&
-                                        (st1 == SSL3_ST_SR_CERT_A) &&
-                                        (stn == SSL3_ST_SR_CERT_B))
-                        {
+                    (st1 == SSL3_ST_SR_CERT_A) && (stn == SSL3_ST_SR_CERT_B)) {
                         /* At this point we have got an MS SGC second client
                          * hello (maybe we should always allow the client to
                          * start a new handshake?). We need to restart the mac.
                          * Don't increment {num,total}_renegotiations because
                          * we have not completed the handshake. */
                         ssl3_init_finished_mac(s);
-                        }
+                }
 
                 s->s3->tmp.message_type= *(p++);
 
-                n2l3(p,l);
-                if (l > (unsigned long)max)
-                        {
-                        al=SSL_AD_ILLEGAL_PARAMETER;
-                        SSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_EXCESSIVE_MESSAGE_SIZE);
+                n2l3(p, l);
+                if (l > (unsigned long)max) {
+                        al = SSL_AD_ILLEGAL_PARAMETER;
+                        SSLerr(SSL_F_SSL3_GET_MESSAGE, SSL_R_EXCESSIVE_MESSAGE_SIZE);
                         goto f_err;
-                        }
+                }
                 if (l > (INT_MAX-4)) /* BUF_MEM_grow takes an 'int' parameter */
-                        {
-                        al=SSL_AD_ILLEGAL_PARAMETER;
-                        SSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_EXCESSIVE_MESSAGE_SIZE);
+                {
+                        al = SSL_AD_ILLEGAL_PARAMETER;
+                        SSLerr(SSL_F_SSL3_GET_MESSAGE, SSL_R_EXCESSIVE_MESSAGE_SIZE);
                         goto f_err;
-                        }
-                if (l && !BUF_MEM_grow_clean(s->init_buf,(int)l+4))
-                        {
-                        SSLerr(SSL_F_SSL3_GET_MESSAGE,ERR_R_BUF_LIB);
+                }
+                if (l && !BUF_MEM_grow_clean(s->init_buf,(int)l + 4)) {
+                        SSLerr(SSL_F_SSL3_GET_MESSAGE, ERR_R_BUF_LIB);
                         goto err;
-                        }
-                s->s3->tmp.message_size=l;
-                s->state=stn;
+                }
+                s->s3->tmp.message_size = l;
+                s->state = stn;
 
                 s->init_msg = s->init_buf->data + 4;
                 s->init_num = 0;
-                }
+        }
 
         /* next state (stn) */
         p = s->init_msg;
         n = s->s3->tmp.message_size - s->init_num;
-        while (n > 0)
-                {
-                i=s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],n,0);
-                if (i <= 0)
-                        {
-                        s->rwstate=SSL_READING;
+        while (n > 0) {
+                i = s->method->ssl_read_bytes(s, SSL3_RT_HANDSHAKE,
+                    &p[s->init_num], n, 0);
+                if (i <= 0) {
+                        s->rwstate = SSL_READING;
                         *ok = 0;
                         return i;
-                        }
+                }
                 s->init_num += i;
                 n -= i;
-                }
+        }
 
 #ifndef OPENSSL_NO_NEXTPROTONEG
         /* If receiving Finished, record MAC of prior handshake messages for
@@ -550,64 +520,60 @@ long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
         ssl3_finish_mac(s, (unsigned char *)s->init_buf->data, s->init_num + 4);
         if (s->msg_callback)
                 s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, s->init_buf->data, (size_t)s->init_num + 4, s, s->msg_callback_arg);
-        *ok=1;
+        *ok = 1;
         return s->init_num;
 f_err:
-        ssl3_send_alert(s,SSL3_AL_FATAL,al);
+        ssl3_send_alert(s, SSL3_AL_FATAL, al);
 err:
-        *ok=0;
-        return(-1);
-        }
+        *ok = 0;
+        return (-1);
+}
 
-int ssl_cert_type(X509 *x, EVP_PKEY *pkey)
-        {
+int
+ssl_cert_type(X509 *x, EVP_PKEY *pkey)
+{
         EVP_PKEY *pk;
-        int ret= -1,i;
+        int ret = -1, i;
 
         if (pkey == NULL)
-                pk=X509_get_pubkey(x);
+                pk = X509_get_pubkey(x);
         else
-                pk=pkey;
-        if (pk == NULL) goto err;
-
-        i=pk->type;
-        if (i == EVP_PKEY_RSA)
-                {
-                ret=SSL_PKEY_RSA_ENC;
-                }
-        else if (i == EVP_PKEY_DSA)
-                {
-                ret=SSL_PKEY_DSA_SIGN;
-                }
+                pk = pkey;
+        if (pk == NULL)
+                goto err;
+
+        i = pk->type;
+        if (i == EVP_PKEY_RSA) {
+                ret = SSL_PKEY_RSA_ENC;
+        } else if (i == EVP_PKEY_DSA) {
+                ret = SSL_PKEY_DSA_SIGN;
+        }
 #ifndef OPENSSL_NO_EC
-        else if (i == EVP_PKEY_EC)
-                {
+        else if (i == EVP_PKEY_EC) {
                 ret = SSL_PKEY_ECC;
-                }       
+        }
 #endif
-        else if (i == NID_id_GostR3410_94 || i == NID_id_GostR3410_94_cc) 
-                {
+        else if (i == NID_id_GostR3410_94 || i == NID_id_GostR3410_94_cc) {
                 ret = SSL_PKEY_GOST94;
-                }
-        else if (i == NID_id_GostR3410_2001 || i == NID_id_GostR3410_2001_cc) 
-                {
+        } else if (i == NID_id_GostR3410_2001 || i == NID_id_GostR3410_2001_cc) {
                 ret = SSL_PKEY_GOST01;
-                }
-err:
-        if(!pkey) EVP_PKEY_free(pk);
-        return(ret);
         }
+err:
+        if (!pkey)
+                EVP_PKEY_free(pk);
+        return (ret);
+}
 
-int ssl_verify_alarm_type(long type)
-        {
+int
+ssl_verify_alarm_type(long type)
+{
         int al;
 
-        switch(type)
-                {
+        switch (type) {
         case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
         case X509_V_ERR_UNABLE_TO_GET_CRL:
         case X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER:
-                al=SSL_AD_UNKNOWN_CA;
+                al = SSL_AD_UNKNOWN_CA;
                 break;
         case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE:
         case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE:
@@ -620,21 +586,21 @@ int ssl_verify_alarm_type(long type)
         case X509_V_ERR_CRL_NOT_YET_VALID:
         case X509_V_ERR_CERT_UNTRUSTED:
         case X509_V_ERR_CERT_REJECTED:
-                al=SSL_AD_BAD_CERTIFICATE;
+                al = SSL_AD_BAD_CERTIFICATE;
                 break;
         case X509_V_ERR_CERT_SIGNATURE_FAILURE:
         case X509_V_ERR_CRL_SIGNATURE_FAILURE:
-                al=SSL_AD_DECRYPT_ERROR;
+                al = SSL_AD_DECRYPT_ERROR;
                 break;
         case X509_V_ERR_CERT_HAS_EXPIRED:
         case X509_V_ERR_CRL_HAS_EXPIRED:
-                al=SSL_AD_CERTIFICATE_EXPIRED;
+                al = SSL_AD_CERTIFICATE_EXPIRED;
                 break;
         case X509_V_ERR_CERT_REVOKED:
-                al=SSL_AD_CERTIFICATE_REVOKED;
+                al = SSL_AD_CERTIFICATE_REVOKED;
                 break;
         case X509_V_ERR_OUT_OF_MEM:
-                al=SSL_AD_INTERNAL_ERROR;
+                al = SSL_AD_INTERNAL_ERROR;
                 break;
         case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
         case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
@@ -643,20 +609,20 @@ int ssl_verify_alarm_type(long type)
         case X509_V_ERR_CERT_CHAIN_TOO_LONG:
         case X509_V_ERR_PATH_LENGTH_EXCEEDED:
         case X509_V_ERR_INVALID_CA:
-                al=SSL_AD_UNKNOWN_CA;
+                al = SSL_AD_UNKNOWN_CA;
                 break;
         case X509_V_ERR_APPLICATION_VERIFICATION:
-                al=SSL_AD_HANDSHAKE_FAILURE;
+                al = SSL_AD_HANDSHAKE_FAILURE;
                 break;
         case X509_V_ERR_INVALID_PURPOSE:
-                al=SSL_AD_UNSUPPORTED_CERTIFICATE;
+                al = SSL_AD_UNSUPPORTED_CERTIFICATE;
                 break;
         default:
-                al=SSL_AD_CERTIFICATE_UNKNOWN;
+                al = SSL_AD_CERTIFICATE_UNKNOWN;
                 break;
-                }
-        return(al);
         }
+        return (al);
+}
 
 #ifndef OPENSSL_NO_BUF_FREELISTS
 /* On some platforms, malloc() performance is bad enough that you can't just
@@ -680,7 +646,7 @@ int ssl_verify_alarm_type(long type)
  */
 static void *
 freelist_extract(SSL_CTX *ctx, int for_read, int sz)
-        {
+{
         SSL3_BUF_FREELIST *list;
         SSL3_BUF_FREELIST_ENTRY *ent = NULL;
         void *result = NULL;
@@ -689,13 +655,12 @@ freelist_extract(SSL_CTX *ctx, int for_read, int sz)
         list = for_read ? ctx->rbuf_freelist : ctx->wbuf_freelist;
         if (list != NULL && sz == (int)list->chunklen)
                 ent = list->head;
-        if (ent != NULL)
-                {
+        if (ent != NULL) {
                 list->head = ent->next;
                 result = ent;
                 if (--list->len == 0)
                         list->chunklen = 0;
-                }
+        }
         CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
         if (!result)
                 result = OPENSSL_malloc(sz);
@@ -704,80 +669,76 @@ freelist_extract(SSL_CTX *ctx, int for_read, int sz)
 
 static void
 freelist_insert(SSL_CTX *ctx, int for_read, size_t sz, void *mem)
-        {
+{
         SSL3_BUF_FREELIST *list;
         SSL3_BUF_FREELIST_ENTRY *ent;
 
         CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
         list = for_read ? ctx->rbuf_freelist : ctx->wbuf_freelist;
-        if (list != NULL &&
-            (sz == list->chunklen || list->chunklen == 0) &&
-            list->len < ctx->freelist_max_len &&
-            sz >= sizeof(*ent))
-                {
+        if (list != NULL && (sz == list->chunklen || list->chunklen == 0) &&
+            list->len < ctx->freelist_max_len && sz >= sizeof(*ent)) {
                 list->chunklen = sz;
                 ent = mem;
                 ent->next = list->head;
                 list->head = ent;
                 ++list->len;
                 mem = NULL;
-                }
+        }
 
         CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
         if (mem)
                 OPENSSL_free(mem);
-        }
+}
 #else
 #define freelist_extract(c,fr,sz) OPENSSL_malloc(sz)
 #define freelist_insert(c,fr,sz,m) OPENSSL_free(m)
 #endif
 
-int ssl3_setup_read_buffer(SSL *s)
-        {
+int
+ssl3_setup_read_buffer(SSL *s)
+{
         unsigned char *p;
-        size_t len,align=0,headerlen;
-        
+        size_t len, align = 0, headerlen;
+
         if (SSL_version(s) == DTLS1_VERSION || SSL_version(s) == DTLS1_BAD_VER)
                 headerlen = DTLS1_RT_HEADER_LENGTH;
         else
                 headerlen = SSL3_RT_HEADER_LENGTH;
 
 #if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD!=0
-        align = (-SSL3_RT_HEADER_LENGTH)&(SSL3_ALIGN_PAYLOAD-1);
+        align = (-SSL3_RT_HEADER_LENGTH)&(SSL3_ALIGN_PAYLOAD - 1);
 #endif
 
-        if (s->s3->rbuf.buf == NULL)
-                {
-                len = SSL3_RT_MAX_PLAIN_LENGTH
-                        + SSL3_RT_MAX_ENCRYPTED_OVERHEAD
-                        + headerlen + align;
-                if (s->options & SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER)
-                        {
+        if (s->s3->rbuf.buf == NULL) {
+                len = SSL3_RT_MAX_PLAIN_LENGTH +
+                    SSL3_RT_MAX_ENCRYPTED_OVERHEAD + headerlen + align;
+                if (s->options & SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER) {
                         s->s3->init_extra = 1;
                         len += SSL3_RT_MAX_EXTRA;
-                        }
+                }
 #ifndef OPENSSL_NO_COMP
                 if (!(s->options & SSL_OP_NO_COMPRESSION))
                         len += SSL3_RT_MAX_COMPRESSED_OVERHEAD;
 #endif
-                if ((p=freelist_extract(s->ctx, 1, len)) == NULL)
+                if ((p = freelist_extract(s->ctx, 1, len)) == NULL)
                         goto err;
                 s->s3->rbuf.buf = p;
                 s->s3->rbuf.len = len;
-                }
+        }
 
-        s->packet= &(s->s3->rbuf.buf[0]);
+        s->packet = &(s->s3->rbuf.buf[0]);
         return 1;
 
 err:
-        SSLerr(SSL_F_SSL3_SETUP_READ_BUFFER,ERR_R_MALLOC_FAILURE);
+        SSLerr(SSL_F_SSL3_SETUP_READ_BUFFER, ERR_R_MALLOC_FAILURE);
         return 0;
-        }
+}
 
-int ssl3_setup_write_buffer(SSL *s)
-        {
+int
+ssl3_setup_write_buffer(SSL *s)
+{
         unsigned char *p;
-        size_t len,align=0,headerlen;
+        size_t len, align = 0, headerlen;
 
         if (SSL_version(s) == DTLS1_VERSION || SSL_version(s) == DTLS1_BAD_VER)
                 headerlen = DTLS1_RT_HEADER_LENGTH + 1;
@@ -785,62 +746,61 @@ int ssl3_setup_write_buffer(SSL *s)
                 headerlen = SSL3_RT_HEADER_LENGTH;
 
 #if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD!=0
-        align = (-SSL3_RT_HEADER_LENGTH)&(SSL3_ALIGN_PAYLOAD-1);
+        align = (-SSL3_RT_HEADER_LENGTH)&(SSL3_ALIGN_PAYLOAD - 1);
 #endif
 
-        if (s->s3->wbuf.buf == NULL)
-                {
-                len = s->max_send_fragment
-                        + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD
-                        + headerlen + align;
+        if (s->s3->wbuf.buf == NULL) {
+                len = s->max_send_fragment +
+                    SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD + headerlen + align;
 #ifndef OPENSSL_NO_COMP
                 if (!(s->options & SSL_OP_NO_COMPRESSION))
                         len += SSL3_RT_MAX_COMPRESSED_OVERHEAD;
 #endif
                 if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS))
-                        len += headerlen + align
-                                + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD;
+                        len += headerlen + align +
+                            SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD;
 
-                if ((p=freelist_extract(s->ctx, 0, len)) == NULL)
+                if ((p = freelist_extract(s->ctx, 0, len)) == NULL)
                         goto err;
                 s->s3->wbuf.buf = p;
                 s->s3->wbuf.len = len;
-                }
+        }
 
         return 1;
 
 err:
-        SSLerr(SSL_F_SSL3_SETUP_WRITE_BUFFER,ERR_R_MALLOC_FAILURE);
+        SSLerr(SSL_F_SSL3_SETUP_WRITE_BUFFER, ERR_R_MALLOC_FAILURE);
         return 0;
-        }
+}
 
 
-int ssl3_setup_buffers(SSL *s)
-        {
+int
+ssl3_setup_buffers(SSL *s)
+{
         if (!ssl3_setup_read_buffer(s))
                 return 0;
         if (!ssl3_setup_write_buffer(s))
                 return 0;
         return 1;
-        }
+}
 
-int ssl3_release_write_buffer(SSL *s)
-        {
-        if (s->s3->wbuf.buf != NULL)
-                {
+int
+ssl3_release_write_buffer(SSL *s)
+{
+        if (s->s3->wbuf.buf != NULL) {
                 freelist_insert(s->ctx, 0, s->s3->wbuf.len, s->s3->wbuf.buf);
                 s->s3->wbuf.buf = NULL;
-                }
-        return 1;
         }
+        return 1;
+}
 
-int ssl3_release_read_buffer(SSL *s)
-        {
-        if (s->s3->rbuf.buf != NULL)
-                {
+int
+ssl3_release_read_buffer(SSL *s)
+{
+        if (s->s3->rbuf.buf != NULL) {
                 freelist_insert(s->ctx, 1, s->s3->rbuf.len, s->s3->rbuf.buf);
                 s->s3->rbuf.buf = NULL;
-                }
-        return 1;
         }
+        return 1;
+}
 
diff --git a/src/lib/libssl/s3_cbc.c b/src/lib/libssl/s3_cbc.c
index 443a31e746..d6cc9b4771 100644
--- a/src/lib/libssl/s3_cbc.c
+++ b/src/lib/libssl/s3_cbc.c
@@ -73,30 +73,33 @@
  * bits. They use the fact that arithmetic shift shifts-in the sign bit.
  * However, this is not ensured by the C standard so you may need to replace
  * them with something else on odd CPUs. */
-#define DUPLICATE_MSB_TO_ALL(x) ( (unsigned)( (int)(x) >> (sizeof(int)*8-1) ) )
+#define DUPLICATE_MSB_TO_ALL(x) ((unsigned)((int)(x) >> (sizeof(int) * 8 - 1)))
 #define DUPLICATE_MSB_TO_ALL_8(x) ((unsigned char)(DUPLICATE_MSB_TO_ALL(x)))
 
 /* constant_time_lt returns 0xff if a<b and 0x00 otherwise. */
-static unsigned constant_time_lt(unsigned a, unsigned b)
-        {
+static unsigned
+constant_time_lt(unsigned a, unsigned b)
+{
         a -= b;
         return DUPLICATE_MSB_TO_ALL(a);
-        }
+}
 
 /* constant_time_ge returns 0xff if a>=b and 0x00 otherwise. */
-static unsigned constant_time_ge(unsigned a, unsigned b)
-        {
+static unsigned
+constant_time_ge(unsigned a, unsigned b)
+{
         a -= b;
         return DUPLICATE_MSB_TO_ALL(~a);
-        }
+}
 
 /* constant_time_eq_8 returns 0xff if a==b and 0x00 otherwise. */
-static unsigned char constant_time_eq_8(unsigned a, unsigned b)
-        {
+static unsigned char
+constant_time_eq_8(unsigned a, unsigned b)
+{
         unsigned c = a ^ b;
         c--;
         return DUPLICATE_MSB_TO_ALL_8(c);
-        }
+}
 
 /* ssl3_cbc_remove_padding removes padding from the decrypted, SSLv3, CBC
  * record in |rec| by updating |rec->length| in constant time.
@@ -106,11 +109,10 @@ static unsigned char constant_time_eq_8(unsigned a, unsigned b)
  *   0: (in non-constant time) if the record is publicly invalid.
  *   1: if the padding was valid
  *  -1: otherwise. */
-int ssl3_cbc_remove_padding(const SSL* s,
-                            SSL3_RECORD *rec,
-                            unsigned block_size,
-                            unsigned mac_size)
-        {
+int
+ssl3_cbc_remove_padding(const SSL* s, SSL3_RECORD *rec, unsigned block_size,
+    unsigned mac_size)
+{
         unsigned padding_length, good;
         const unsigned overhead = 1 /* padding length byte */ + mac_size;
 
@@ -119,13 +121,13 @@ int ssl3_cbc_remove_padding(const SSL* s,
         if (overhead > rec->length)
                 return 0;
 
-        padding_length = rec->data[rec->length-1];
-        good = constant_time_ge(rec->length, padding_length+overhead);
+        padding_length = rec->data[rec->length - 1];
+        good = constant_time_ge(rec->length, padding_length + overhead);
         /* SSLv3 requires that the padding is minimal. */
-        good &= constant_time_ge(block_size, padding_length+1);
-        padding_length = good & (padding_length+1);
+        good &= constant_time_ge(block_size, padding_length + 1);
+        padding_length = good & (padding_length + 1);
         rec->length -= padding_length;
-        rec->type |= padding_length<<8; /* kludge: pass padding length */
+        rec->type |= padding_length << 8; /* kludge: pass padding length */
         return (int)((good & 1) | (~good & -1));
 }
 
@@ -140,16 +142,14 @@ int ssl3_cbc_remove_padding(const SSL* s,
  *   0: (in non-constant time) if the record is publicly invalid.
  *   1: if the padding was valid
  *  -1: otherwise. */
-int tls1_cbc_remove_padding(const SSL* s,
-                            SSL3_RECORD *rec,
-                            unsigned block_size,
-                            unsigned mac_size)
-        {
+int
+tls1_cbc_remove_padding(const SSL* s, SSL3_RECORD *rec, unsigned block_size,
+    unsigned mac_size)
+{
         unsigned padding_length, good, to_check, i;
         const unsigned overhead = 1 /* padding length byte */ + mac_size;
         /* Check if version requires explicit IV */
-        if (s->version >= TLS1_1_VERSION || s->version == DTLS1_BAD_VER)
-                {
+        if (s->version >= TLS1_1_VERSION || s->version == DTLS1_BAD_VER) {
                 /* These lengths are all public so we can test them in
                  * non-constant time.
                  */
@@ -159,40 +159,35 @@ int tls1_cbc_remove_padding(const SSL* s,
                 rec->data += block_size;
                 rec->input += block_size;
                 rec->length -= block_size;
-                }
-        else if (overhead > rec->length)
+        } else if (overhead > rec->length)
                 return 0;
 
-        padding_length = rec->data[rec->length-1];
+        padding_length = rec->data[rec->length - 1];
 
         /* NB: if compression is in operation the first packet may not be of
          * even length so the padding bug check cannot be performed. This bug
          * workaround has been around since SSLeay so hopefully it is either
          * fixed now or no buggy implementation supports compression [steve]
          */
-        if ( (s->options&SSL_OP_TLS_BLOCK_PADDING_BUG) && !s->expand)
-                {
+        if ((s->options & SSL_OP_TLS_BLOCK_PADDING_BUG) && !s->expand) {
                 /* First packet is even in size, so check */
-                if ((memcmp(s->s3->read_sequence, "\0\0\0\0\0\0\0\0",8) == 0) &&
-                    !(padding_length & 1))
-                        {
+                if ((memcmp(s->s3->read_sequence, "\0\0\0\0\0\0\0\0", 8) == 0) &&
+                    !(padding_length & 1)) {
                         s->s3->flags|=TLS1_FLAGS_TLS_PADDING_BUG;
-                        }
+                }
                 if ((s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG) &&
-                    padding_length > 0)
-                        {
+                    padding_length > 0) {
                         padding_length--;
-                        }
                 }
+        }
 
-        if (EVP_CIPHER_flags(s->enc_read_ctx->cipher)&EVP_CIPH_FLAG_AEAD_CIPHER)
-                {
+        if (EVP_CIPHER_flags(s->enc_read_ctx->cipher) & EVP_CIPH_FLAG_AEAD_CIPHER) {
                 /* padding is already verified */
                 rec->length -= padding_length + 1;
                 return 1;
-                }
+        }
 
-        good = constant_time_ge(rec->length, overhead+padding_length);
+        good = constant_time_ge(rec->length, overhead + padding_length);
         /* The padding consists of a length byte at the end of the record and
          * then that many bytes of padding, all with the same value as the
          * length byte. Thus, with the length byte included, there are i+1
@@ -203,17 +198,16 @@ int tls1_cbc_remove_padding(const SSL* s,
          * amount of padding possible. (Again, the length of the record is
          * public information so we can use it.) */
         to_check = 255; /* maximum amount of padding. */
-        if (to_check > rec->length-1)
-                to_check = rec->length-1;
+        if (to_check > rec->length - 1)
+                to_check = rec->length - 1;
 
-        for (i = 0; i < to_check; i++)
-                {
+        for (i = 0; i < to_check; i++) {
                 unsigned char mask = constant_time_ge(padding_length, i);
-                unsigned char b = rec->data[rec->length-1-i];
+                unsigned char b = rec->data[rec->length - 1 - i];
                 /* The final |padding_length+1| bytes should all have the value
                  * |padding_length|. Therefore the XOR should be zero. */
                 good &= ~(mask&(padding_length ^ b));
-                }
+        }
 
         /* If any of the final |padding_length+1| bytes had the wrong value,
          * one or more of the lower eight bits of |good| will be cleared. We
@@ -222,15 +216,15 @@ int tls1_cbc_remove_padding(const SSL* s,
         good &= good >> 4;
         good &= good >> 2;
         good &= good >> 1;
-        good <<= sizeof(good)*8-1;
+        good <<= sizeof(good)*8 - 1;
         good = DUPLICATE_MSB_TO_ALL(good);
 
-        padding_length = good & (padding_length+1);
+        padding_length = good & (padding_length + 1);
         rec->length -= padding_length;
         rec->type |= padding_length<<8; /* kludge: pass padding length */
 
         return (int)((good & 1) | (~good & -1));
-        }
+}
 
 /* ssl3_cbc_copy_mac copies |md_size| bytes from the end of |rec| to |out| in
  * constant time (independent of the concrete value of rec->length, which may
@@ -251,12 +245,12 @@ int tls1_cbc_remove_padding(const SSL* s,
  */
 #define CBC_MAC_ROTATE_IN_PLACE
 
-void ssl3_cbc_copy_mac(unsigned char* out,
-                       const SSL3_RECORD *rec,
-                       unsigned md_size,unsigned orig_len)
-        {
+void
+ssl3_cbc_copy_mac(unsigned char* out, const SSL3_RECORD *rec,
+    unsigned md_size, unsigned orig_len)
+{
 #if defined(CBC_MAC_ROTATE_IN_PLACE)
-        unsigned char rotated_mac_buf[64+EVP_MAX_MD_SIZE];
+        unsigned char rotated_mac_buf[64 + EVP_MAX_MD_SIZE];
         unsigned char *rotated_mac;
 #else
         unsigned char rotated_mac[EVP_MAX_MD_SIZE];
@@ -276,7 +270,7 @@ void ssl3_cbc_copy_mac(unsigned char* out,
         OPENSSL_assert(md_size <= EVP_MAX_MD_SIZE);
 
 #if defined(CBC_MAC_ROTATE_IN_PLACE)
-        rotated_mac = rotated_mac_buf + ((0-(size_t)rotated_mac_buf)&63);
+        rotated_mac = rotated_mac_buf + ((0 - (size_t)rotated_mac_buf)&63);
 #endif
 
         /* This information is public so it's safe to branch based on it. */
@@ -290,42 +284,39 @@ void ssl3_cbc_copy_mac(unsigned char* out,
          * figure out that it can remove div_spoiler as that would require it
          * to prove that md_size is always even, which I hope is beyond it. */
         div_spoiler = md_size >> 1;
-        div_spoiler <<= (sizeof(div_spoiler)-1)*8;
+        div_spoiler <<= (sizeof(div_spoiler) - 1) * 8;
         rotate_offset = (div_spoiler + mac_start - scan_start) % md_size;
 
         memset(rotated_mac, 0, md_size);
-        for (i = scan_start, j = 0; i < orig_len; i++)
-                {
+        for (i = scan_start, j = 0; i < orig_len; i++) {
                 unsigned char mac_started = constant_time_ge(i, mac_start);
                 unsigned char mac_ended = constant_time_ge(i, mac_end);
                 unsigned char b = rec->data[i];
                 rotated_mac[j++] |= b & mac_started & ~mac_ended;
-                j &= constant_time_lt(j,md_size);
-                }
+                j &= constant_time_lt(j, md_size);
+        }
 
         /* Now rotate the MAC */
 #if defined(CBC_MAC_ROTATE_IN_PLACE)
         j = 0;
-        for (i = 0; i < md_size; i++)
-                {
+        for (i = 0; i < md_size; i++) {
                 /* in case cache-line is 32 bytes, touch second line */
                 ((volatile unsigned char *)rotated_mac)[rotate_offset^32];
                 out[j++] = rotated_mac[rotate_offset++];
-                rotate_offset &= constant_time_lt(rotate_offset,md_size);
-                }
+                rotate_offset &= constant_time_lt(rotate_offset, md_size);
+        }
 #else
         memset(out, 0, md_size);
         rotate_offset = md_size - rotate_offset;
-        rotate_offset &= constant_time_lt(rotate_offset,md_size);
-        for (i = 0; i < md_size; i++)
-                {
+        rotate_offset &= constant_time_lt(rotate_offset, md_size);
+        for (i = 0; i < md_size; i++) {
                 for (j = 0; j < md_size; j++)
                         out[j] |= rotated_mac[i] & constant_time_eq_8(j, rotate_offset);
                 rotate_offset++;
-                rotate_offset &= constant_time_lt(rotate_offset,md_size);
-                }
-#endif
+                rotate_offset &= constant_time_lt(rotate_offset, md_size);
         }
+#endif
+}
 
 /* u32toLE serialises an unsigned, 32-bit number (n) as four bytes at (p) in
  * little-endian order. The value of p is advanced by four. */
@@ -338,81 +329,83 @@ void ssl3_cbc_copy_mac(unsigned char* out,
 /* These functions serialize the state of a hash and thus perform the standard
  * "final" operation without adding the padding and length that such a function
  * typically does. */
-static void tls1_md5_final_raw(void* ctx, unsigned char *md_out)
-        {
+static void
+tls1_md5_final_raw(void* ctx, unsigned char *md_out)
+{
         MD5_CTX *md5 = ctx;
         u32toLE(md5->A, md_out);
         u32toLE(md5->B, md_out);
         u32toLE(md5->C, md_out);
         u32toLE(md5->D, md_out);
-        }
+}
 
-static void tls1_sha1_final_raw(void* ctx, unsigned char *md_out)
-        {
+static void
+tls1_sha1_final_raw(void* ctx, unsigned char *md_out)
+{
         SHA_CTX *sha1 = ctx;
         l2n(sha1->h0, md_out);
         l2n(sha1->h1, md_out);
         l2n(sha1->h2, md_out);
         l2n(sha1->h3, md_out);
         l2n(sha1->h4, md_out);
-        }
+}
 #define LARGEST_DIGEST_CTX SHA_CTX
 
 #ifndef OPENSSL_NO_SHA256
-static void tls1_sha256_final_raw(void* ctx, unsigned char *md_out)
-        {
+static void
+tls1_sha256_final_raw(void* ctx, unsigned char *md_out)
+{
         SHA256_CTX *sha256 = ctx;
         unsigned i;
 
-        for (i = 0; i < 8; i++)
-                {
+        for (i = 0; i < 8; i++) {
                 l2n(sha256->h[i], md_out);
-                }
         }
+}
 #undef  LARGEST_DIGEST_CTX
 #define LARGEST_DIGEST_CTX SHA256_CTX
 #endif
 
 #ifndef OPENSSL_NO_SHA512
-static void tls1_sha512_final_raw(void* ctx, unsigned char *md_out)
-        {
+static void
+tls1_sha512_final_raw(void* ctx, unsigned char *md_out)
+{
         SHA512_CTX *sha512 = ctx;
         unsigned i;
 
-        for (i = 0; i < 8; i++)
-                {
+        for (i = 0; i < 8; i++) {
                 l2n8(sha512->h[i], md_out);
-                }
         }
+}
 #undef  LARGEST_DIGEST_CTX
 #define LARGEST_DIGEST_CTX SHA512_CTX
 #endif
 
 /* ssl3_cbc_record_digest_supported returns 1 iff |ctx| uses a hash function
  * which ssl3_cbc_digest_record supports. */
-char ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx)
-        {
+char
+ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx)
+{
 #ifdef OPENSSL_FIPS
         if (FIPS_mode())
                 return 0;
 #endif
-        switch (EVP_MD_CTX_type(ctx))
-                {
-                case NID_md5:
-                case NID_sha1:
+        switch (EVP_MD_CTX_type(ctx)) {
+        case NID_md5:
+        case NID_sha1:
 #ifndef OPENSSL_NO_SHA256
-                case NID_sha224:
-                case NID_sha256:
+        case NID_sha224:
+        case NID_sha256:
 #endif
 #ifndef OPENSSL_NO_SHA512
-                case NID_sha384:
-                case NID_sha512:
+        case NID_sha384:
+        case NID_sha512:
 #endif
-                        return 1;
-                default:
-                        return 0;
-                }
+                return 1;
+        default:
+                return 0;
         }
+}
 
 /* ssl3_cbc_digest_record computes the MAC of a decrypted, padded SSLv3/TLS
  * record.
@@ -433,26 +426,21 @@ char ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx)
  * functions, above, we know that data_plus_mac_size is large enough to contain
  * a padding byte and MAC. (If the padding was invalid, it might contain the
  * padding too. ) */
-void ssl3_cbc_digest_record(
-        const EVP_MD_CTX *ctx,
-        unsigned char* md_out,
-        size_t* md_out_size,
-        const unsigned char header[13],
-        const unsigned char *data,
-        size_t data_plus_mac_size,
-        size_t data_plus_mac_plus_padding_size,
-        const unsigned char *mac_secret,
-        unsigned mac_secret_length,
-        char is_sslv3)
-        {
+void ssl3_cbc_digest_record(const EVP_MD_CTX *ctx, unsigned char* md_out,
+    size_t* md_out_size, const unsigned char header[13],
+    const unsigned char *data, size_t data_plus_mac_size,
+    size_t data_plus_mac_plus_padding_size, const unsigned char *mac_secret,
+    unsigned mac_secret_length, char is_sslv3)
+{
         union { double align;
-                unsigned char c[sizeof(LARGEST_DIGEST_CTX)]; } md_state;
+                unsigned char c[sizeof(LARGEST_DIGEST_CTX)];
+        } md_state;
         void (*md_final_raw)(void *ctx, unsigned char *md_out);
         void (*md_transform)(void *ctx, const unsigned char *block);
         unsigned md_size, md_block_size = 64;
         unsigned sslv3_pad_length = 40, header_length, variance_blocks,
-                 len, max_mac_bytes, num_blocks,
-                 num_starting_blocks, k, mac_end_offset, c, index_a, index_b;
+        len, max_mac_bytes, num_blocks,
+        num_starting_blocks, k, mac_end_offset, c, index_a, index_b;
         unsigned int bits;      /* at most 18 bits */
         unsigned char length_bytes[MAX_HASH_BIT_COUNT_BYTES];
         /* hmac_pad is the masked HMAC key. */
@@ -470,78 +458,74 @@ void ssl3_cbc_digest_record(
          * many possible overflows later in this function. */
         OPENSSL_assert(data_plus_mac_plus_padding_size < 1024*1024);
 
-        switch (EVP_MD_CTX_type(ctx))
-                {
-                case NID_md5:
-                        MD5_Init((MD5_CTX*)md_state.c);
-                        md_final_raw = tls1_md5_final_raw;
-                        md_transform = (void(*)(void *ctx, const unsigned char *block)) MD5_Transform;
-                        md_size = 16;
-                        sslv3_pad_length = 48;
-                        length_is_big_endian = 0;
-                        break;
-                case NID_sha1:
-                        SHA1_Init((SHA_CTX*)md_state.c);
-                        md_final_raw = tls1_sha1_final_raw;
-                        md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA1_Transform;
-                        md_size = 20;
-                        break;
+        switch (EVP_MD_CTX_type(ctx)) {
+        case NID_md5:
+                MD5_Init((MD5_CTX*)md_state.c);
+                md_final_raw = tls1_md5_final_raw;
+                md_transform = (void(*)(void *ctx, const unsigned char *block)) MD5_Transform;
+                md_size = 16;
+                sslv3_pad_length = 48;
+                length_is_big_endian = 0;
+                break;
+        case NID_sha1:
+                SHA1_Init((SHA_CTX*)md_state.c);
+                md_final_raw = tls1_sha1_final_raw;
+                md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA1_Transform;
+                md_size = 20;
+                break;
 #ifndef OPENSSL_NO_SHA256
-                case NID_sha224:
-                        SHA224_Init((SHA256_CTX*)md_state.c);
-                        md_final_raw = tls1_sha256_final_raw;
-                        md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA256_Transform;
-                        md_size = 224/8;
-                        break;
-                case NID_sha256:
-                        SHA256_Init((SHA256_CTX*)md_state.c);
-                        md_final_raw = tls1_sha256_final_raw;
-                        md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA256_Transform;
-                        md_size = 32;
-                        break;
+        case NID_sha224:
+                SHA224_Init((SHA256_CTX*)md_state.c);
+                md_final_raw = tls1_sha256_final_raw;
+                md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA256_Transform;
+                md_size = 224/8;
+                break;
+        case NID_sha256:
+                SHA256_Init((SHA256_CTX*)md_state.c);
+                md_final_raw = tls1_sha256_final_raw;
+                md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA256_Transform;
+                md_size = 32;
+                break;
 #endif
 #ifndef OPENSSL_NO_SHA512
-                case NID_sha384:
-                        SHA384_Init((SHA512_CTX*)md_state.c);
-                        md_final_raw = tls1_sha512_final_raw;
-                        md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA512_Transform;
-                        md_size = 384/8;
-                        md_block_size = 128;
-                        md_length_size = 16;
-                        break;
-                case NID_sha512:
-                        SHA512_Init((SHA512_CTX*)md_state.c);
-                        md_final_raw = tls1_sha512_final_raw;
-                        md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA512_Transform;
-                        md_size = 64;
-                        md_block_size = 128;
-                        md_length_size = 16;
-                        break;
+        case NID_sha384:
+                SHA384_Init((SHA512_CTX*)md_state.c);
+                md_final_raw = tls1_sha512_final_raw;
+                md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA512_Transform;
+                md_size = 384/8;
+                md_block_size = 128;
+                md_length_size = 16;
+                break;
+        case NID_sha512:
+                SHA512_Init((SHA512_CTX*)md_state.c);
+                md_final_raw = tls1_sha512_final_raw;
+                md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA512_Transform;
+                md_size = 64;
+                md_block_size = 128;
+                md_length_size = 16;
+                break;
 #endif
-                default:
-                        /* ssl3_cbc_record_digest_supported should have been
-                         * called first to check that the hash function is
-                         * supported. */
-                        OPENSSL_assert(0);
-                        if (md_out_size)
-                                *md_out_size = -1;
-                        return;
-                }
+        default:
+                /* ssl3_cbc_record_digest_supported should have been
+                 * called first to check that the hash function is
+                 * supported. */
+                OPENSSL_assert(0);
+                if (md_out_size)
+                        *md_out_size = -1;
+                return;
+        }
 
         OPENSSL_assert(md_length_size <= MAX_HASH_BIT_COUNT_BYTES);
         OPENSSL_assert(md_block_size <= MAX_HASH_BLOCK_SIZE);
         OPENSSL_assert(md_size <= EVP_MAX_MD_SIZE);
 
         header_length = 13;
-        if (is_sslv3)
-                {
-                header_length =
-                        mac_secret_length +
-                        sslv3_pad_length +
-                        8 /* sequence number */ +
-                        1 /* record type */ +
-                        2 /* record length */;
-                }
+        if (is_sslv3) {
+                header_length = mac_secret_length + sslv3_pad_length +
+                    8 /* sequence number */ +
+                    1 /* record type */ +
+                    2 /* record length */;
+        }
 
         /* variance_blocks is the number of blocks of the hash that we have to
          * calculate in constant time because they could be altered by the
@@ -597,15 +581,13 @@ void ssl3_cbc_digest_record(
 
         /* For SSLv3, if we're going to have any starting blocks then we need
          * at least two because the header is larger than a single block. */
-        if (num_blocks > variance_blocks + (is_sslv3 ? 1 : 0))
-                {
+        if (num_blocks > variance_blocks + (is_sslv3 ? 1 : 0)) {
                 num_starting_blocks = num_blocks - variance_blocks;
                 k = md_block_size*num_starting_blocks;
-                }
+        }
 
         bits = 8*mac_end_offset;
-        if (!is_sslv3)
-                {
+        if (!is_sslv3) {
                 /* Compute the initial HMAC block. For SSLv3, the padding and
                  * secret bytes are included in |header| because they take more
                  * than a single block. */
@@ -617,51 +599,44 @@ void ssl3_cbc_digest_record(
                         hmac_pad[i] ^= 0x36;
 
                 md_transform(md_state.c, hmac_pad);
-                }
+        }
 
-        if (length_is_big_endian)
-                {
-                memset(length_bytes,0,md_length_size-4);
-                length_bytes[md_length_size-4] = (unsigned char)(bits>>24);
-                length_bytes[md_length_size-3] = (unsigned char)(bits>>16);
-                length_bytes[md_length_size-2] = (unsigned char)(bits>>8);
-                length_bytes[md_length_size-1] = (unsigned char)bits;
-                }
-        else
-                {
-                memset(length_bytes,0,md_length_size);
-                length_bytes[md_length_size-5] = (unsigned char)(bits>>24);
-                length_bytes[md_length_size-6] = (unsigned char)(bits>>16);
-                length_bytes[md_length_size-7] = (unsigned char)(bits>>8);
-                length_bytes[md_length_size-8] = (unsigned char)bits;
-                }
+        if (length_is_big_endian) {
+                memset(length_bytes, 0, md_length_size - 4);
+                length_bytes[md_length_size - 4] = (unsigned char)(bits >> 24);
+                length_bytes[md_length_size - 3] = (unsigned char)(bits >> 16);
+                length_bytes[md_length_size - 2] = (unsigned char)(bits >> 8);
+                length_bytes[md_length_size - 1] = (unsigned char)bits;
+        } else {
+                memset(length_bytes, 0, md_length_size);
+                length_bytes[md_length_size - 5] = (unsigned char)(bits >> 24);
+                length_bytes[md_length_size - 6] = (unsigned char)(bits >> 16);
+                length_bytes[md_length_size - 7] = (unsigned char)(bits >> 8);
+                length_bytes[md_length_size - 8] = (unsigned char)bits;
+        }
 
-        if (k > 0)
-                {
-                if (is_sslv3)
-                        {
+        if (k > 0) {
+                if (is_sslv3) {
                         /* The SSLv3 header is larger than a single block.
                          * overhang is the number of bytes beyond a single
                          * block that the header consumes: either 7 bytes
                          * (SHA1) or 11 bytes (MD5). */
-                        unsigned overhang = header_length-md_block_size;
+                        unsigned overhang = header_length - md_block_size;
                         md_transform(md_state.c, header);
                         memcpy(first_block, header + md_block_size, overhang);
-                        memcpy(first_block + overhang, data, md_block_size-overhang);
+                        memcpy(first_block + overhang, data, md_block_size - overhang);
                         md_transform(md_state.c, first_block);
                         for (i = 1; i < k/md_block_size - 1; i++)
                                 md_transform(md_state.c, data + md_block_size*i - overhang);
-                        }
-                else
-                        {
+                } else {
                         /* k is a multiple of md_block_size. */
                         memcpy(first_block, header, 13);
-                        memcpy(first_block+13, data, md_block_size-13);
+                        memcpy(first_block + 13, data, md_block_size - 13);
                         md_transform(md_state.c, first_block);
                         for (i = 1; i < k/md_block_size; i++)
                                 md_transform(md_state.c, data + md_block_size*i - 13);
-                        }
                 }
+        }
 
         memset(mac_out, 0, sizeof(mac_out));
 
@@ -669,22 +644,20 @@ void ssl3_cbc_digest_record(
          * it in constant time. If the |i==index_a| then we'll include the 0x80
          * bytes and zero pad etc. For each block we selectively copy it, in
          * constant time, to |mac_out|. */
-        for (i = num_starting_blocks; i <= num_starting_blocks+variance_blocks; i++)
-                {
+        for (i = num_starting_blocks; i <= num_starting_blocks + variance_blocks; i++) {
                 unsigned char block[MAX_HASH_BLOCK_SIZE];
                 unsigned char is_block_a = constant_time_eq_8(i, index_a);
                 unsigned char is_block_b = constant_time_eq_8(i, index_b);
-                for (j = 0; j < md_block_size; j++)
-                        {
+                for (j = 0; j < md_block_size; j++) {
                         unsigned char b = 0, is_past_c, is_past_cp1;
                         if (k < header_length)
                                 b = header[k];
                         else if (k < data_plus_mac_plus_padding_size + header_length)
-                                b = data[k-header_length];
+                                b = data[k - header_length];
                         k++;
 
                         is_past_c = is_block_a & constant_time_ge(j, c);
-                        is_past_cp1 = is_block_a & constant_time_ge(j, c+1);
+                        is_past_cp1 = is_block_a & constant_time_ge(j, c + 1);
                         /* If this is the block containing the end of the
                          * application data, and we are at the offset for the
                          * 0x80 value, then overwrite b with 0x80. */
@@ -701,46 +674,42 @@ void ssl3_cbc_digest_record(
 
                         /* The final bytes of one of the blocks contains the
                          * length. */
-                        if (j >= md_block_size - md_length_size)
-                                {
+                        if (j >= md_block_size - md_length_size) {
                                 /* If this is index_b, write a length byte. */
-                                b = (b&~is_block_b) | (is_block_b&length_bytes[j-(md_block_size-md_length_size)]);
-                                }
-                        block[j] = b;
+                                b = (b&~is_block_b) | (is_block_b&length_bytes[j - (md_block_size - md_length_size)]);
                         }
+                        block[j] = b;
+                }
 
                 md_transform(md_state.c, block);
                 md_final_raw(md_state.c, block);
                 /* If this is index_b, copy the hash value to |mac_out|. */
                 for (j = 0; j < md_size; j++)
                         mac_out[j] |= block[j]&is_block_b;
-                }
+        }
 
         EVP_MD_CTX_init(&md_ctx);
         EVP_DigestInit_ex(&md_ctx, ctx->digest, NULL /* engine */);
-        if (is_sslv3)
-                {
+        if (is_sslv3) {
                 /* We repurpose |hmac_pad| to contain the SSLv3 pad2 block. */
                 memset(hmac_pad, 0x5c, sslv3_pad_length);
 
                 EVP_DigestUpdate(&md_ctx, mac_secret, mac_secret_length);
                 EVP_DigestUpdate(&md_ctx, hmac_pad, sslv3_pad_length);
                 EVP_DigestUpdate(&md_ctx, mac_out, md_size);
-                }
-        else
-                {
+        } else {
                 /* Complete the HMAC in the standard manner. */
                 for (i = 0; i < md_block_size; i++)
                         hmac_pad[i] ^= 0x6a;
 
                 EVP_DigestUpdate(&md_ctx, hmac_pad, md_block_size);
                 EVP_DigestUpdate(&md_ctx, mac_out, md_size);
-                }
+        }
         EVP_DigestFinal(&md_ctx, md_out, &md_out_size_u);
         if (md_out_size)
                 *md_out_size = md_out_size_u;
         EVP_MD_CTX_cleanup(&md_ctx);
-        }
+}
 
 #ifdef OPENSSL_FIPS
 
@@ -749,10 +718,10 @@ void ssl3_cbc_digest_record(
  * by digesting additional data.
  */
 
-void tls_fips_digest_extra(
-        const EVP_CIPHER_CTX *cipher_ctx, EVP_MD_CTX *mac_ctx,
-        const unsigned char *data, size_t data_len, size_t orig_len)
-        {
+void tls_fips_digest_extra(const EVP_CIPHER_CTX *cipher_ctx,
+    EVP_MD_CTX *mac_ctx, const unsigned char *data, size_t data_len,
+    size_t orig_len)
+{
         size_t block_size, digest_pad, blocks_data, blocks_orig;
         if (EVP_CIPHER_CTX_mode(cipher_ctx) != EVP_CIPH_CBC_MODE)
                 return;
@@ -785,6 +754,6 @@ void tls_fips_digest_extra(
          * length TLS buffer. 
          */
         EVP_DigestSignUpdate(mac_ctx, data,
-                                (blocks_orig - blocks_data + 1) * block_size);
-        }
+        (blocks_orig - blocks_data + 1) * block_size);
+}
 #endif
diff --git a/src/lib/libssl/s3_lib.c b/src/lib/libssl/s3_lib.c
index fd1e7b80d8..926071fffa 100644
--- a/src/lib/libssl/s3_lib.c
+++ b/src/lib/libssl/s3_lib.c
@@ -164,496 +164,496 @@
 
 const char ssl3_version_str[]="SSLv3" OPENSSL_VERSION_PTEXT;
 
-#define SSL3_NUM_CIPHERS        (sizeof(ssl3_ciphers)/sizeof(SSL_CIPHER))
+#define SSL3_NUM_CIPHERS        (sizeof(ssl3_ciphers) / sizeof(SSL_CIPHER))
 
 /* list of available SSLv3 ciphers (sorted by id) */
-OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
+OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
 
 /* The RSA ciphers */
 /* Cipher 01 */
         {
-        1,
-        SSL3_TXT_RSA_NULL_MD5,
-        SSL3_CK_RSA_NULL_MD5,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_eNULL,
-        SSL_MD5,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_STRONG_NONE,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        0,
-        0,
+                1,
+                SSL3_TXT_RSA_NULL_MD5,
+                SSL3_CK_RSA_NULL_MD5,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_eNULL,
+                SSL_MD5,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_STRONG_NONE,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                0,
+                0,
         },
 
 /* Cipher 02 */
         {
-        1,
-        SSL3_TXT_RSA_NULL_SHA,
-        SSL3_CK_RSA_NULL_SHA,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_eNULL,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        0,
-        0,
+                1,
+                SSL3_TXT_RSA_NULL_SHA,
+                SSL3_CK_RSA_NULL_SHA,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_eNULL,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                0,
+                0,
         },
 
 /* Cipher 03 */
         {
-        1,
-        SSL3_TXT_RSA_RC4_40_MD5,
-        SSL3_CK_RSA_RC4_40_MD5,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_RC4,
-        SSL_MD5,
-        SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        40,
-        128,
+                1,
+                SSL3_TXT_RSA_RC4_40_MD5,
+                SSL3_CK_RSA_RC4_40_MD5,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_RC4,
+                SSL_MD5,
+                SSL_SSLV3,
+                SSL_EXPORT|SSL_EXP40,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                40,
+                128,
         },
 
 /* Cipher 04 */
         {
-        1,
-        SSL3_TXT_RSA_RC4_128_MD5,
-        SSL3_CK_RSA_RC4_128_MD5,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_RC4,
-        SSL_MD5,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                SSL3_TXT_RSA_RC4_128_MD5,
+                SSL3_CK_RSA_RC4_128_MD5,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_RC4,
+                SSL_MD5,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
 /* Cipher 05 */
         {
-        1,
-        SSL3_TXT_RSA_RC4_128_SHA,
-        SSL3_CK_RSA_RC4_128_SHA,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_RC4,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                SSL3_TXT_RSA_RC4_128_SHA,
+                SSL3_CK_RSA_RC4_128_SHA,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_RC4,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
 /* Cipher 06 */
         {
-        1,
-        SSL3_TXT_RSA_RC2_40_MD5,
-        SSL3_CK_RSA_RC2_40_MD5,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_RC2,
-        SSL_MD5,
-        SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        40,
-        128,
+                1,
+                SSL3_TXT_RSA_RC2_40_MD5,
+                SSL3_CK_RSA_RC2_40_MD5,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_RC2,
+                SSL_MD5,
+                SSL_SSLV3,
+                SSL_EXPORT|SSL_EXP40,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                40,
+                128,
         },
 
 /* Cipher 07 */
 #ifndef OPENSSL_NO_IDEA
         {
-        1,
-        SSL3_TXT_RSA_IDEA_128_SHA,
-        SSL3_CK_RSA_IDEA_128_SHA,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_IDEA,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                SSL3_TXT_RSA_IDEA_128_SHA,
+                SSL3_CK_RSA_IDEA_128_SHA,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_IDEA,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 #endif
 
 /* Cipher 08 */
         {
-        1,
-        SSL3_TXT_RSA_DES_40_CBC_SHA,
-        SSL3_CK_RSA_DES_40_CBC_SHA,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        40,
-        56,
+                1,
+                SSL3_TXT_RSA_DES_40_CBC_SHA,
+                SSL3_CK_RSA_DES_40_CBC_SHA,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_EXPORT|SSL_EXP40,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                40,
+                56,
         },
 
 /* Cipher 09 */
         {
-        1,
-        SSL3_TXT_RSA_DES_64_CBC_SHA,
-        SSL3_CK_RSA_DES_64_CBC_SHA,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_LOW,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        56,
-        56,
+                1,
+                SSL3_TXT_RSA_DES_64_CBC_SHA,
+                SSL3_CK_RSA_DES_64_CBC_SHA,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_LOW,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                56,
+                56,
         },
 
 /* Cipher 0A */
         {
-        1,
-        SSL3_TXT_RSA_DES_192_CBC3_SHA,
-        SSL3_CK_RSA_DES_192_CBC3_SHA,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                1,
+                SSL3_TXT_RSA_DES_192_CBC3_SHA,
+                SSL3_CK_RSA_DES_192_CBC3_SHA,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
 /* The DH ciphers */
 /* Cipher 0B */
         {
-        0,
-        SSL3_TXT_DH_DSS_DES_40_CBC_SHA,
-        SSL3_CK_DH_DSS_DES_40_CBC_SHA,
-        SSL_kDHd,
-        SSL_aDH,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        40,
-        56,
+                0,
+                SSL3_TXT_DH_DSS_DES_40_CBC_SHA,
+                SSL3_CK_DH_DSS_DES_40_CBC_SHA,
+                SSL_kDHd,
+                SSL_aDH,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_EXPORT|SSL_EXP40,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                40,
+                56,
         },
 
 /* Cipher 0C */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        SSL3_TXT_DH_DSS_DES_64_CBC_SHA,
-        SSL3_CK_DH_DSS_DES_64_CBC_SHA,
-        SSL_kDHd,
-        SSL_aDH,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_LOW,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        56,
-        56,
+                0, /* not implemented (non-ephemeral DH) */
+                SSL3_TXT_DH_DSS_DES_64_CBC_SHA,
+                SSL3_CK_DH_DSS_DES_64_CBC_SHA,
+                SSL_kDHd,
+                SSL_aDH,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_LOW,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                56,
+                56,
         },
 
 /* Cipher 0D */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        SSL3_TXT_DH_DSS_DES_192_CBC3_SHA,
-        SSL3_CK_DH_DSS_DES_192_CBC3_SHA,
-        SSL_kDHd,
-        SSL_aDH,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                0, /* not implemented (non-ephemeral DH) */
+                SSL3_TXT_DH_DSS_DES_192_CBC3_SHA,
+                SSL3_CK_DH_DSS_DES_192_CBC3_SHA,
+                SSL_kDHd,
+                SSL_aDH,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
 /* Cipher 0E */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        SSL3_TXT_DH_RSA_DES_40_CBC_SHA,
-        SSL3_CK_DH_RSA_DES_40_CBC_SHA,
-        SSL_kDHr,
-        SSL_aDH,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        40,
-        56,
+                0, /* not implemented (non-ephemeral DH) */
+                SSL3_TXT_DH_RSA_DES_40_CBC_SHA,
+                SSL3_CK_DH_RSA_DES_40_CBC_SHA,
+                SSL_kDHr,
+                SSL_aDH,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_EXPORT|SSL_EXP40,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                40,
+                56,
         },
 
 /* Cipher 0F */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        SSL3_TXT_DH_RSA_DES_64_CBC_SHA,
-        SSL3_CK_DH_RSA_DES_64_CBC_SHA,
-        SSL_kDHr,
-        SSL_aDH,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_LOW,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        56,
-        56,
+                0, /* not implemented (non-ephemeral DH) */
+                SSL3_TXT_DH_RSA_DES_64_CBC_SHA,
+                SSL3_CK_DH_RSA_DES_64_CBC_SHA,
+                SSL_kDHr,
+                SSL_aDH,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_LOW,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                56,
+                56,
         },
 
 /* Cipher 10 */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        SSL3_TXT_DH_RSA_DES_192_CBC3_SHA,
-        SSL3_CK_DH_RSA_DES_192_CBC3_SHA,
-        SSL_kDHr,
-        SSL_aDH,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                0, /* not implemented (non-ephemeral DH) */
+                SSL3_TXT_DH_RSA_DES_192_CBC3_SHA,
+                SSL3_CK_DH_RSA_DES_192_CBC3_SHA,
+                SSL_kDHr,
+                SSL_aDH,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
 /* The Ephemeral DH ciphers */
 /* Cipher 11 */
         {
-        1,
-        SSL3_TXT_EDH_DSS_DES_40_CBC_SHA,
-        SSL3_CK_EDH_DSS_DES_40_CBC_SHA,
-        SSL_kEDH,
-        SSL_aDSS,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        40,
-        56,
+                1,
+                SSL3_TXT_EDH_DSS_DES_40_CBC_SHA,
+                SSL3_CK_EDH_DSS_DES_40_CBC_SHA,
+                SSL_kEDH,
+                SSL_aDSS,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_EXPORT|SSL_EXP40,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                40,
+                56,
         },
 
 /* Cipher 12 */
         {
-        1,
-        SSL3_TXT_EDH_DSS_DES_64_CBC_SHA,
-        SSL3_CK_EDH_DSS_DES_64_CBC_SHA,
-        SSL_kEDH,
-        SSL_aDSS,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_LOW,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        56,
-        56,
+                1,
+                SSL3_TXT_EDH_DSS_DES_64_CBC_SHA,
+                SSL3_CK_EDH_DSS_DES_64_CBC_SHA,
+                SSL_kEDH,
+                SSL_aDSS,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_LOW,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                56,
+                56,
         },
 
 /* Cipher 13 */
         {
-        1,
-        SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA,
-        SSL3_CK_EDH_DSS_DES_192_CBC3_SHA,
-        SSL_kEDH,
-        SSL_aDSS,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                1,
+                SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA,
+                SSL3_CK_EDH_DSS_DES_192_CBC3_SHA,
+                SSL_kEDH,
+                SSL_aDSS,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
 /* Cipher 14 */
         {
-        1,
-        SSL3_TXT_EDH_RSA_DES_40_CBC_SHA,
-        SSL3_CK_EDH_RSA_DES_40_CBC_SHA,
-        SSL_kEDH,
-        SSL_aRSA,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        40,
-        56,
+                1,
+                SSL3_TXT_EDH_RSA_DES_40_CBC_SHA,
+                SSL3_CK_EDH_RSA_DES_40_CBC_SHA,
+                SSL_kEDH,
+                SSL_aRSA,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_EXPORT|SSL_EXP40,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                40,
+                56,
         },
 
 /* Cipher 15 */
         {
-        1,
-        SSL3_TXT_EDH_RSA_DES_64_CBC_SHA,
-        SSL3_CK_EDH_RSA_DES_64_CBC_SHA,
-        SSL_kEDH,
-        SSL_aRSA,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_LOW,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        56,
-        56,
+                1,
+                SSL3_TXT_EDH_RSA_DES_64_CBC_SHA,
+                SSL3_CK_EDH_RSA_DES_64_CBC_SHA,
+                SSL_kEDH,
+                SSL_aRSA,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_LOW,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                56,
+                56,
         },
 
 /* Cipher 16 */
         {
-        1,
-        SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA,
-        SSL3_CK_EDH_RSA_DES_192_CBC3_SHA,
-        SSL_kEDH,
-        SSL_aRSA,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                1,
+                SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA,
+                SSL3_CK_EDH_RSA_DES_192_CBC3_SHA,
+                SSL_kEDH,
+                SSL_aRSA,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
 /* Cipher 17 */
         {
-        1,
-        SSL3_TXT_ADH_RC4_40_MD5,
-        SSL3_CK_ADH_RC4_40_MD5,
-        SSL_kEDH,
-        SSL_aNULL,
-        SSL_RC4,
-        SSL_MD5,
-        SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        40,
-        128,
+                1,
+                SSL3_TXT_ADH_RC4_40_MD5,
+                SSL3_CK_ADH_RC4_40_MD5,
+                SSL_kEDH,
+                SSL_aNULL,
+                SSL_RC4,
+                SSL_MD5,
+                SSL_SSLV3,
+                SSL_EXPORT|SSL_EXP40,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                40,
+                128,
         },
 
 /* Cipher 18 */
         {
-        1,
-        SSL3_TXT_ADH_RC4_128_MD5,
-        SSL3_CK_ADH_RC4_128_MD5,
-        SSL_kEDH,
-        SSL_aNULL,
-        SSL_RC4,
-        SSL_MD5,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                SSL3_TXT_ADH_RC4_128_MD5,
+                SSL3_CK_ADH_RC4_128_MD5,
+                SSL_kEDH,
+                SSL_aNULL,
+                SSL_RC4,
+                SSL_MD5,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
 /* Cipher 19 */
         {
-        1,
-        SSL3_TXT_ADH_DES_40_CBC_SHA,
-        SSL3_CK_ADH_DES_40_CBC_SHA,
-        SSL_kEDH,
-        SSL_aNULL,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        40,
-        128,
+                1,
+                SSL3_TXT_ADH_DES_40_CBC_SHA,
+                SSL3_CK_ADH_DES_40_CBC_SHA,
+                SSL_kEDH,
+                SSL_aNULL,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_EXPORT|SSL_EXP40,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                40,
+                128,
         },
 
 /* Cipher 1A */
         {
-        1,
-        SSL3_TXT_ADH_DES_64_CBC_SHA,
-        SSL3_CK_ADH_DES_64_CBC_SHA,
-        SSL_kEDH,
-        SSL_aNULL,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_LOW,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        56,
-        56,
+                1,
+                SSL3_TXT_ADH_DES_64_CBC_SHA,
+                SSL3_CK_ADH_DES_64_CBC_SHA,
+                SSL_kEDH,
+                SSL_aNULL,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_LOW,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                56,
+                56,
         },
 
 /* Cipher 1B */
         {
-        1,
-        SSL3_TXT_ADH_DES_192_CBC_SHA,
-        SSL3_CK_ADH_DES_192_CBC_SHA,
-        SSL_kEDH,
-        SSL_aNULL,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                1,
+                SSL3_TXT_ADH_DES_192_CBC_SHA,
+                SSL3_CK_ADH_DES_192_CBC_SHA,
+                SSL_kEDH,
+                SSL_aNULL,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
 /* Fortezza ciphersuite from SSL 3.0 spec */
 #if 0
 /* Cipher 1C */
         {
-        0,
-        SSL3_TXT_FZA_DMS_NULL_SHA,
-        SSL3_CK_FZA_DMS_NULL_SHA,
-        SSL_kFZA,
-        SSL_aFZA,
-        SSL_eNULL,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_STRONG_NONE,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        0,
-        0,
+                0,
+                SSL3_TXT_FZA_DMS_NULL_SHA,
+                SSL3_CK_FZA_DMS_NULL_SHA,
+                SSL_kFZA,
+                SSL_aFZA,
+                SSL_eNULL,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_STRONG_NONE,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                0,
+                0,
         },
 
 /* Cipher 1D */
         {
-        0,
-        SSL3_TXT_FZA_DMS_FZA_SHA,
-        SSL3_CK_FZA_DMS_FZA_SHA,
-        SSL_kFZA,
-        SSL_aFZA,
-        SSL_eFZA,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_STRONG_NONE,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        0,
-        0,
+                0,
+                SSL3_TXT_FZA_DMS_FZA_SHA,
+                SSL3_CK_FZA_DMS_FZA_SHA,
+                SSL_kFZA,
+                SSL_aFZA,
+                SSL_eFZA,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_STRONG_NONE,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                0,
+                0,
         },
 
 /* Cipher 1E */
         {
-        0,
-        SSL3_TXT_FZA_DMS_RC4_SHA,
-        SSL3_CK_FZA_DMS_RC4_SHA,
-        SSL_kFZA,
-        SSL_aFZA,
-        SSL_RC4,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                0,
+                SSL3_TXT_FZA_DMS_RC4_SHA,
+                SSL3_CK_FZA_DMS_RC4_SHA,
+                SSL_kFZA,
+                SSL_aFZA,
+                SSL_RC4,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 #endif
 
@@ -661,511 +661,511 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 /* The Kerberos ciphers*/
 /* Cipher 1E */
         {
-        1,
-        SSL3_TXT_KRB5_DES_64_CBC_SHA,
-        SSL3_CK_KRB5_DES_64_CBC_SHA,
-        SSL_kKRB5,
-        SSL_aKRB5,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_LOW,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        56,
-        56,
+                1,
+                SSL3_TXT_KRB5_DES_64_CBC_SHA,
+                SSL3_CK_KRB5_DES_64_CBC_SHA,
+                SSL_kKRB5,
+                SSL_aKRB5,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_LOW,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                56,
+                56,
         },
 
 /* Cipher 1F */
         {
-        1,
-        SSL3_TXT_KRB5_DES_192_CBC3_SHA,
-        SSL3_CK_KRB5_DES_192_CBC3_SHA,
-        SSL_kKRB5,
-        SSL_aKRB5,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                1,
+                SSL3_TXT_KRB5_DES_192_CBC3_SHA,
+                SSL3_CK_KRB5_DES_192_CBC3_SHA,
+                SSL_kKRB5,
+                SSL_aKRB5,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
 /* Cipher 20 */
         {
-        1,
-        SSL3_TXT_KRB5_RC4_128_SHA,
-        SSL3_CK_KRB5_RC4_128_SHA,
-        SSL_kKRB5,
-        SSL_aKRB5,
-        SSL_RC4,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                SSL3_TXT_KRB5_RC4_128_SHA,
+                SSL3_CK_KRB5_RC4_128_SHA,
+                SSL_kKRB5,
+                SSL_aKRB5,
+                SSL_RC4,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
 /* Cipher 21 */
         {
-        1,
-        SSL3_TXT_KRB5_IDEA_128_CBC_SHA,
-        SSL3_CK_KRB5_IDEA_128_CBC_SHA,
-        SSL_kKRB5,
-        SSL_aKRB5,
-        SSL_IDEA,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                SSL3_TXT_KRB5_IDEA_128_CBC_SHA,
+                SSL3_CK_KRB5_IDEA_128_CBC_SHA,
+                SSL_kKRB5,
+                SSL_aKRB5,
+                SSL_IDEA,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
 /* Cipher 22 */
         {
-        1,
-        SSL3_TXT_KRB5_DES_64_CBC_MD5,
-        SSL3_CK_KRB5_DES_64_CBC_MD5,
-        SSL_kKRB5,
-        SSL_aKRB5,
-        SSL_DES,
-        SSL_MD5,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_LOW,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        56,
-        56,
+                1,
+                SSL3_TXT_KRB5_DES_64_CBC_MD5,
+                SSL3_CK_KRB5_DES_64_CBC_MD5,
+                SSL_kKRB5,
+                SSL_aKRB5,
+                SSL_DES,
+                SSL_MD5,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_LOW,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                56,
+                56,
         },
 
 /* Cipher 23 */
         {
-        1,
-        SSL3_TXT_KRB5_DES_192_CBC3_MD5,
-        SSL3_CK_KRB5_DES_192_CBC3_MD5,
-        SSL_kKRB5,
-        SSL_aKRB5,
-        SSL_3DES,
-        SSL_MD5,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                1,
+                SSL3_TXT_KRB5_DES_192_CBC3_MD5,
+                SSL3_CK_KRB5_DES_192_CBC3_MD5,
+                SSL_kKRB5,
+                SSL_aKRB5,
+                SSL_3DES,
+                SSL_MD5,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
 /* Cipher 24 */
         {
-        1,
-        SSL3_TXT_KRB5_RC4_128_MD5,
-        SSL3_CK_KRB5_RC4_128_MD5,
-        SSL_kKRB5,
-        SSL_aKRB5,
-        SSL_RC4,
-        SSL_MD5,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                SSL3_TXT_KRB5_RC4_128_MD5,
+                SSL3_CK_KRB5_RC4_128_MD5,
+                SSL_kKRB5,
+                SSL_aKRB5,
+                SSL_RC4,
+                SSL_MD5,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
 /* Cipher 25 */
         {
-        1,
-        SSL3_TXT_KRB5_IDEA_128_CBC_MD5,
-        SSL3_CK_KRB5_IDEA_128_CBC_MD5,
-        SSL_kKRB5,
-        SSL_aKRB5,
-        SSL_IDEA,
-        SSL_MD5,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                SSL3_TXT_KRB5_IDEA_128_CBC_MD5,
+                SSL3_CK_KRB5_IDEA_128_CBC_MD5,
+                SSL_kKRB5,
+                SSL_aKRB5,
+                SSL_IDEA,
+                SSL_MD5,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
 /* Cipher 26 */
         {
-        1,
-        SSL3_TXT_KRB5_DES_40_CBC_SHA,
-        SSL3_CK_KRB5_DES_40_CBC_SHA,
-        SSL_kKRB5,
-        SSL_aKRB5,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        40,
-        56,
+                1,
+                SSL3_TXT_KRB5_DES_40_CBC_SHA,
+                SSL3_CK_KRB5_DES_40_CBC_SHA,
+                SSL_kKRB5,
+                SSL_aKRB5,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_EXPORT|SSL_EXP40,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                40,
+                56,
         },
 
 /* Cipher 27 */
         {
-        1,
-        SSL3_TXT_KRB5_RC2_40_CBC_SHA,
-        SSL3_CK_KRB5_RC2_40_CBC_SHA,
-        SSL_kKRB5,
-        SSL_aKRB5,
-        SSL_RC2,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        40,
-        128,
+                1,
+                SSL3_TXT_KRB5_RC2_40_CBC_SHA,
+                SSL3_CK_KRB5_RC2_40_CBC_SHA,
+                SSL_kKRB5,
+                SSL_aKRB5,
+                SSL_RC2,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_EXPORT|SSL_EXP40,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                40,
+                128,
         },
 
 /* Cipher 28 */
         {
-        1,
-        SSL3_TXT_KRB5_RC4_40_SHA,
-        SSL3_CK_KRB5_RC4_40_SHA,
-        SSL_kKRB5,
-        SSL_aKRB5,
-        SSL_RC4,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        40,
-        128,
+                1,
+                SSL3_TXT_KRB5_RC4_40_SHA,
+                SSL3_CK_KRB5_RC4_40_SHA,
+                SSL_kKRB5,
+                SSL_aKRB5,
+                SSL_RC4,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_EXPORT|SSL_EXP40,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                40,
+                128,
         },
 
 /* Cipher 29 */
         {
-        1,
-        SSL3_TXT_KRB5_DES_40_CBC_MD5,
-        SSL3_CK_KRB5_DES_40_CBC_MD5,
-        SSL_kKRB5,
-        SSL_aKRB5,
-        SSL_DES,
-        SSL_MD5,
-        SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        40,
-        56,
+                1,
+                SSL3_TXT_KRB5_DES_40_CBC_MD5,
+                SSL3_CK_KRB5_DES_40_CBC_MD5,
+                SSL_kKRB5,
+                SSL_aKRB5,
+                SSL_DES,
+                SSL_MD5,
+                SSL_SSLV3,
+                SSL_EXPORT|SSL_EXP40,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                40,
+                56,
         },
 
 /* Cipher 2A */
         {
-        1,
-        SSL3_TXT_KRB5_RC2_40_CBC_MD5,
-        SSL3_CK_KRB5_RC2_40_CBC_MD5,
-        SSL_kKRB5,
-        SSL_aKRB5,
-        SSL_RC2,
-        SSL_MD5,
-        SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        40,
-        128,
+                1,
+                SSL3_TXT_KRB5_RC2_40_CBC_MD5,
+                SSL3_CK_KRB5_RC2_40_CBC_MD5,
+                SSL_kKRB5,
+                SSL_aKRB5,
+                SSL_RC2,
+                SSL_MD5,
+                SSL_SSLV3,
+                SSL_EXPORT|SSL_EXP40,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                40,
+                128,
         },
 
 /* Cipher 2B */
         {
-        1,
-        SSL3_TXT_KRB5_RC4_40_MD5,
-        SSL3_CK_KRB5_RC4_40_MD5,
-        SSL_kKRB5,
-        SSL_aKRB5,
-        SSL_RC4,
-        SSL_MD5,
-        SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        40,
-        128,
+                1,
+                SSL3_TXT_KRB5_RC4_40_MD5,
+                SSL3_CK_KRB5_RC4_40_MD5,
+                SSL_kKRB5,
+                SSL_aKRB5,
+                SSL_RC4,
+                SSL_MD5,
+                SSL_SSLV3,
+                SSL_EXPORT|SSL_EXP40,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                40,
+                128,
         },
 #endif  /* OPENSSL_NO_KRB5 */
 
 /* New AES ciphersuites */
 /* Cipher 2F */
         {
-        1,
-        TLS1_TXT_RSA_WITH_AES_128_SHA,
-        TLS1_CK_RSA_WITH_AES_128_SHA,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_AES128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_RSA_WITH_AES_128_SHA,
+                TLS1_CK_RSA_WITH_AES_128_SHA,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_AES128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 /* Cipher 30 */
         {
-        0,
-        TLS1_TXT_DH_DSS_WITH_AES_128_SHA,
-        TLS1_CK_DH_DSS_WITH_AES_128_SHA,
-        SSL_kDHd,
-        SSL_aDH,
-        SSL_AES128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                0,
+                TLS1_TXT_DH_DSS_WITH_AES_128_SHA,
+                TLS1_CK_DH_DSS_WITH_AES_128_SHA,
+                SSL_kDHd,
+                SSL_aDH,
+                SSL_AES128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 /* Cipher 31 */
         {
-        0,
-        TLS1_TXT_DH_RSA_WITH_AES_128_SHA,
-        TLS1_CK_DH_RSA_WITH_AES_128_SHA,
-        SSL_kDHr,
-        SSL_aDH,
-        SSL_AES128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                0,
+                TLS1_TXT_DH_RSA_WITH_AES_128_SHA,
+                TLS1_CK_DH_RSA_WITH_AES_128_SHA,
+                SSL_kDHr,
+                SSL_aDH,
+                SSL_AES128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 /* Cipher 32 */
         {
-        1,
-        TLS1_TXT_DHE_DSS_WITH_AES_128_SHA,
-        TLS1_CK_DHE_DSS_WITH_AES_128_SHA,
-        SSL_kEDH,
-        SSL_aDSS,
-        SSL_AES128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_DHE_DSS_WITH_AES_128_SHA,
+                TLS1_CK_DHE_DSS_WITH_AES_128_SHA,
+                SSL_kEDH,
+                SSL_aDSS,
+                SSL_AES128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 /* Cipher 33 */
         {
-        1,
-        TLS1_TXT_DHE_RSA_WITH_AES_128_SHA,
-        TLS1_CK_DHE_RSA_WITH_AES_128_SHA,
-        SSL_kEDH,
-        SSL_aRSA,
-        SSL_AES128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_DHE_RSA_WITH_AES_128_SHA,
+                TLS1_CK_DHE_RSA_WITH_AES_128_SHA,
+                SSL_kEDH,
+                SSL_aRSA,
+                SSL_AES128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 /* Cipher 34 */
         {
-        1,
-        TLS1_TXT_ADH_WITH_AES_128_SHA,
-        TLS1_CK_ADH_WITH_AES_128_SHA,
-        SSL_kEDH,
-        SSL_aNULL,
-        SSL_AES128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_ADH_WITH_AES_128_SHA,
+                TLS1_CK_ADH_WITH_AES_128_SHA,
+                SSL_kEDH,
+                SSL_aNULL,
+                SSL_AES128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
 /* Cipher 35 */
         {
-        1,
-        TLS1_TXT_RSA_WITH_AES_256_SHA,
-        TLS1_CK_RSA_WITH_AES_256_SHA,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_AES256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_RSA_WITH_AES_256_SHA,
+                TLS1_CK_RSA_WITH_AES_256_SHA,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_AES256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 /* Cipher 36 */
         {
-        0,
-        TLS1_TXT_DH_DSS_WITH_AES_256_SHA,
-        TLS1_CK_DH_DSS_WITH_AES_256_SHA,
-        SSL_kDHd,
-        SSL_aDH,
-        SSL_AES256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                0,
+                TLS1_TXT_DH_DSS_WITH_AES_256_SHA,
+                TLS1_CK_DH_DSS_WITH_AES_256_SHA,
+                SSL_kDHd,
+                SSL_aDH,
+                SSL_AES256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
 /* Cipher 37 */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        TLS1_TXT_DH_RSA_WITH_AES_256_SHA,
-        TLS1_CK_DH_RSA_WITH_AES_256_SHA,
-        SSL_kDHr,
-        SSL_aDH,
-        SSL_AES256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                0, /* not implemented (non-ephemeral DH) */
+                TLS1_TXT_DH_RSA_WITH_AES_256_SHA,
+                TLS1_CK_DH_RSA_WITH_AES_256_SHA,
+                SSL_kDHr,
+                SSL_aDH,
+                SSL_AES256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
 /* Cipher 38 */
         {
-        1,
-        TLS1_TXT_DHE_DSS_WITH_AES_256_SHA,
-        TLS1_CK_DHE_DSS_WITH_AES_256_SHA,
-        SSL_kEDH,
-        SSL_aDSS,
-        SSL_AES256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_DHE_DSS_WITH_AES_256_SHA,
+                TLS1_CK_DHE_DSS_WITH_AES_256_SHA,
+                SSL_kEDH,
+                SSL_aDSS,
+                SSL_AES256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
 /* Cipher 39 */
         {
-        1,
-        TLS1_TXT_DHE_RSA_WITH_AES_256_SHA,
-        TLS1_CK_DHE_RSA_WITH_AES_256_SHA,
-        SSL_kEDH,
-        SSL_aRSA,
-        SSL_AES256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_DHE_RSA_WITH_AES_256_SHA,
+                TLS1_CK_DHE_RSA_WITH_AES_256_SHA,
+                SSL_kEDH,
+                SSL_aRSA,
+                SSL_AES256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher 3A */
         {
-        1,
-        TLS1_TXT_ADH_WITH_AES_256_SHA,
-        TLS1_CK_ADH_WITH_AES_256_SHA,
-        SSL_kEDH,
-        SSL_aNULL,
-        SSL_AES256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_ADH_WITH_AES_256_SHA,
+                TLS1_CK_ADH_WITH_AES_256_SHA,
+                SSL_kEDH,
+                SSL_aNULL,
+                SSL_AES256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* TLS v1.2 ciphersuites */
         /* Cipher 3B */
         {
-        1,
-        TLS1_TXT_RSA_WITH_NULL_SHA256,
-        TLS1_CK_RSA_WITH_NULL_SHA256,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_eNULL,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        0,
-        0,
+                1,
+                TLS1_TXT_RSA_WITH_NULL_SHA256,
+                TLS1_CK_RSA_WITH_NULL_SHA256,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_eNULL,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                0,
+                0,
         },
 
         /* Cipher 3C */
         {
-        1,
-        TLS1_TXT_RSA_WITH_AES_128_SHA256,
-        TLS1_CK_RSA_WITH_AES_128_SHA256,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_AES128,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_RSA_WITH_AES_128_SHA256,
+                TLS1_CK_RSA_WITH_AES_128_SHA256,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_AES128,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 3D */
         {
-        1,
-        TLS1_TXT_RSA_WITH_AES_256_SHA256,
-        TLS1_CK_RSA_WITH_AES_256_SHA256,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_AES256,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_RSA_WITH_AES_256_SHA256,
+                TLS1_CK_RSA_WITH_AES_256_SHA256,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_AES256,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher 3E */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        TLS1_TXT_DH_DSS_WITH_AES_128_SHA256,
-        TLS1_CK_DH_DSS_WITH_AES_128_SHA256,
-        SSL_kDHd,
-        SSL_aDH,
-        SSL_AES128,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                0, /* not implemented (non-ephemeral DH) */
+                TLS1_TXT_DH_DSS_WITH_AES_128_SHA256,
+                TLS1_CK_DH_DSS_WITH_AES_128_SHA256,
+                SSL_kDHd,
+                SSL_aDH,
+                SSL_AES128,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 3F */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        TLS1_TXT_DH_RSA_WITH_AES_128_SHA256,
-        TLS1_CK_DH_RSA_WITH_AES_128_SHA256,
-        SSL_kDHr,
-        SSL_aDH,
-        SSL_AES128,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                0, /* not implemented (non-ephemeral DH) */
+                TLS1_TXT_DH_RSA_WITH_AES_128_SHA256,
+                TLS1_CK_DH_RSA_WITH_AES_128_SHA256,
+                SSL_kDHr,
+                SSL_aDH,
+                SSL_AES128,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 40 */
         {
-        1,
-        TLS1_TXT_DHE_DSS_WITH_AES_128_SHA256,
-        TLS1_CK_DHE_DSS_WITH_AES_128_SHA256,
-        SSL_kEDH,
-        SSL_aDSS,
-        SSL_AES128,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_DHE_DSS_WITH_AES_128_SHA256,
+                TLS1_CK_DHE_DSS_WITH_AES_128_SHA256,
+                SSL_kEDH,
+                SSL_aDSS,
+                SSL_AES128,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
 #ifndef OPENSSL_NO_CAMELLIA
@@ -1173,98 +1173,98 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
         /* Cipher 41 */
         {
-        1,
-        TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA,
-        TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_CAMELLIA128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA,
+                TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_CAMELLIA128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 42 */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        TLS1_TXT_DH_DSS_WITH_CAMELLIA_128_CBC_SHA,
-        TLS1_CK_DH_DSS_WITH_CAMELLIA_128_CBC_SHA,
-        SSL_kDHd,
-        SSL_aDH,
-        SSL_CAMELLIA128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                0, /* not implemented (non-ephemeral DH) */
+                TLS1_TXT_DH_DSS_WITH_CAMELLIA_128_CBC_SHA,
+                TLS1_CK_DH_DSS_WITH_CAMELLIA_128_CBC_SHA,
+                SSL_kDHd,
+                SSL_aDH,
+                SSL_CAMELLIA128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 43 */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        TLS1_TXT_DH_RSA_WITH_CAMELLIA_128_CBC_SHA,
-        TLS1_CK_DH_RSA_WITH_CAMELLIA_128_CBC_SHA,
-        SSL_kDHr,
-        SSL_aDH,
-        SSL_CAMELLIA128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                0, /* not implemented (non-ephemeral DH) */
+                TLS1_TXT_DH_RSA_WITH_CAMELLIA_128_CBC_SHA,
+                TLS1_CK_DH_RSA_WITH_CAMELLIA_128_CBC_SHA,
+                SSL_kDHr,
+                SSL_aDH,
+                SSL_CAMELLIA128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 44 */
         {
-        1,
-        TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA,
-        TLS1_CK_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA,
-        SSL_kEDH,
-        SSL_aDSS,
-        SSL_CAMELLIA128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA,
+                TLS1_CK_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA,
+                SSL_kEDH,
+                SSL_aDSS,
+                SSL_CAMELLIA128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 45 */
         {
-        1,
-        TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
-        TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
-        SSL_kEDH,
-        SSL_aRSA,
-        SSL_CAMELLIA128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
+                TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
+                SSL_kEDH,
+                SSL_aRSA,
+                SSL_CAMELLIA128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 46 */
         {
-        1,
-        TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA,
-        TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA,
-        SSL_kEDH,
-        SSL_aNULL,
-        SSL_CAMELLIA128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA,
+                TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA,
+                SSL_kEDH,
+                SSL_aNULL,
+                SSL_CAMELLIA128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 #endif /* OPENSSL_NO_CAMELLIA */
 
@@ -1273,288 +1273,288 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 #if 0
         /* Cipher 60 */
         {
-        1,
-        TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_MD5,
-        TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_MD5,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_RC4,
-        SSL_MD5,
-        SSL_TLSV1,
-        SSL_EXPORT|SSL_EXP56,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        56,
-        128,
+                1,
+                TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_MD5,
+                TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_MD5,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_RC4,
+                SSL_MD5,
+                SSL_TLSV1,
+                SSL_EXPORT|SSL_EXP56,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                56,
+                128,
         },
 
         /* Cipher 61 */
         {
-        1,
-        TLS1_TXT_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5,
-        TLS1_CK_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_RC2,
-        SSL_MD5,
-        SSL_TLSV1,
-        SSL_EXPORT|SSL_EXP56,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        56,
-        128,
+                1,
+                TLS1_TXT_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5,
+                TLS1_CK_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_RC2,
+                SSL_MD5,
+                SSL_TLSV1,
+                SSL_EXPORT|SSL_EXP56,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                56,
+                128,
         },
 #endif
 
         /* Cipher 62 */
         {
-        1,
-        TLS1_TXT_RSA_EXPORT1024_WITH_DES_CBC_SHA,
-        TLS1_CK_RSA_EXPORT1024_WITH_DES_CBC_SHA,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_EXPORT|SSL_EXP56,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        56,
-        56,
+                1,
+                TLS1_TXT_RSA_EXPORT1024_WITH_DES_CBC_SHA,
+                TLS1_CK_RSA_EXPORT1024_WITH_DES_CBC_SHA,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_EXPORT|SSL_EXP56,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                56,
+                56,
         },
 
         /* Cipher 63 */
         {
-        1,
-        TLS1_TXT_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
-        TLS1_CK_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
-        SSL_kEDH,
-        SSL_aDSS,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_EXPORT|SSL_EXP56,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        56,
-        56,
+                1,
+                TLS1_TXT_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
+                TLS1_CK_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
+                SSL_kEDH,
+                SSL_aDSS,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_EXPORT|SSL_EXP56,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                56,
+                56,
         },
 
         /* Cipher 64 */
         {
-        1,
-        TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_SHA,
-        TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_SHA,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_RC4,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_EXPORT|SSL_EXP56,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        56,
-        128,
+                1,
+                TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_SHA,
+                TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_SHA,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_RC4,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_EXPORT|SSL_EXP56,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                56,
+                128,
         },
 
         /* Cipher 65 */
         {
-        1,
-        TLS1_TXT_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA,
-        TLS1_CK_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA,
-        SSL_kEDH,
-        SSL_aDSS,
-        SSL_RC4,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_EXPORT|SSL_EXP56,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        56,
-        128,
+                1,
+                TLS1_TXT_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA,
+                TLS1_CK_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA,
+                SSL_kEDH,
+                SSL_aDSS,
+                SSL_RC4,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_EXPORT|SSL_EXP56,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                56,
+                128,
         },
 
         /* Cipher 66 */
         {
-        1,
-        TLS1_TXT_DHE_DSS_WITH_RC4_128_SHA,
-        TLS1_CK_DHE_DSS_WITH_RC4_128_SHA,
-        SSL_kEDH,
-        SSL_aDSS,
-        SSL_RC4,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_DHE_DSS_WITH_RC4_128_SHA,
+                TLS1_CK_DHE_DSS_WITH_RC4_128_SHA,
+                SSL_kEDH,
+                SSL_aDSS,
+                SSL_RC4,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 #endif
 
         /* TLS v1.2 ciphersuites */
         /* Cipher 67 */
         {
-        1,
-        TLS1_TXT_DHE_RSA_WITH_AES_128_SHA256,
-        TLS1_CK_DHE_RSA_WITH_AES_128_SHA256,
-        SSL_kEDH,
-        SSL_aRSA,
-        SSL_AES128,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_DHE_RSA_WITH_AES_128_SHA256,
+                TLS1_CK_DHE_RSA_WITH_AES_128_SHA256,
+                SSL_kEDH,
+                SSL_aRSA,
+                SSL_AES128,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 68 */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        TLS1_TXT_DH_DSS_WITH_AES_256_SHA256,
-        TLS1_CK_DH_DSS_WITH_AES_256_SHA256,
-        SSL_kDHd,
-        SSL_aDH,
-        SSL_AES256,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                0, /* not implemented (non-ephemeral DH) */
+                TLS1_TXT_DH_DSS_WITH_AES_256_SHA256,
+                TLS1_CK_DH_DSS_WITH_AES_256_SHA256,
+                SSL_kDHd,
+                SSL_aDH,
+                SSL_AES256,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher 69 */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        TLS1_TXT_DH_RSA_WITH_AES_256_SHA256,
-        TLS1_CK_DH_RSA_WITH_AES_256_SHA256,
-        SSL_kDHr,
-        SSL_aDH,
-        SSL_AES256,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                0, /* not implemented (non-ephemeral DH) */
+                TLS1_TXT_DH_RSA_WITH_AES_256_SHA256,
+                TLS1_CK_DH_RSA_WITH_AES_256_SHA256,
+                SSL_kDHr,
+                SSL_aDH,
+                SSL_AES256,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher 6A */
         {
-        1,
-        TLS1_TXT_DHE_DSS_WITH_AES_256_SHA256,
-        TLS1_CK_DHE_DSS_WITH_AES_256_SHA256,
-        SSL_kEDH,
-        SSL_aDSS,
-        SSL_AES256,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_DHE_DSS_WITH_AES_256_SHA256,
+                TLS1_CK_DHE_DSS_WITH_AES_256_SHA256,
+                SSL_kEDH,
+                SSL_aDSS,
+                SSL_AES256,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher 6B */
         {
-        1,
-        TLS1_TXT_DHE_RSA_WITH_AES_256_SHA256,
-        TLS1_CK_DHE_RSA_WITH_AES_256_SHA256,
-        SSL_kEDH,
-        SSL_aRSA,
-        SSL_AES256,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_DHE_RSA_WITH_AES_256_SHA256,
+                TLS1_CK_DHE_RSA_WITH_AES_256_SHA256,
+                SSL_kEDH,
+                SSL_aRSA,
+                SSL_AES256,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher 6C */
         {
-        1,
-        TLS1_TXT_ADH_WITH_AES_128_SHA256,
-        TLS1_CK_ADH_WITH_AES_128_SHA256,
-        SSL_kEDH,
-        SSL_aNULL,
-        SSL_AES128,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_ADH_WITH_AES_128_SHA256,
+                TLS1_CK_ADH_WITH_AES_128_SHA256,
+                SSL_kEDH,
+                SSL_aNULL,
+                SSL_AES128,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 6D */
         {
-        1,
-        TLS1_TXT_ADH_WITH_AES_256_SHA256,
-        TLS1_CK_ADH_WITH_AES_256_SHA256,
-        SSL_kEDH,
-        SSL_aNULL,
-        SSL_AES256,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_ADH_WITH_AES_256_SHA256,
+                TLS1_CK_ADH_WITH_AES_256_SHA256,
+                SSL_kEDH,
+                SSL_aNULL,
+                SSL_AES256,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* GOST Ciphersuites */
 
         {
-        1,
-        "GOST94-GOST89-GOST89",
-        0x3000080,
-        SSL_kGOST,
-        SSL_aGOST94,
-        SSL_eGOST2814789CNT,
-        SSL_GOST89MAC,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_GOST94|TLS1_PRF_GOST94|TLS1_STREAM_MAC,
-        256,
-        256
-        },
-        {
-        1,
-        "GOST2001-GOST89-GOST89",
-        0x3000081,
-        SSL_kGOST,
-        SSL_aGOST01,
-        SSL_eGOST2814789CNT,
-        SSL_GOST89MAC,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_GOST94|TLS1_PRF_GOST94|TLS1_STREAM_MAC,
-        256,
-        256
-        },
-        {
-        1,
-        "GOST94-NULL-GOST94",
-        0x3000082,
-        SSL_kGOST,
-        SSL_aGOST94,
-        SSL_eNULL,
-        SSL_GOST94,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_STRONG_NONE,
-        SSL_HANDSHAKE_MAC_GOST94|TLS1_PRF_GOST94,
-        0,
-        0
-        },
-        {
-        1,
-        "GOST2001-NULL-GOST94",
-        0x3000083,
-        SSL_kGOST,
-        SSL_aGOST01,
-        SSL_eNULL,
-        SSL_GOST94,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_STRONG_NONE,
-        SSL_HANDSHAKE_MAC_GOST94|TLS1_PRF_GOST94,
-        0,
-        0
+                1,
+                "GOST94-GOST89-GOST89",
+                0x3000080,
+                SSL_kGOST,
+                SSL_aGOST94,
+                SSL_eGOST2814789CNT,
+                SSL_GOST89MAC,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_GOST94|TLS1_PRF_GOST94|TLS1_STREAM_MAC,
+                256,
+                256
+        },
+        {
+                1,
+                "GOST2001-GOST89-GOST89",
+                0x3000081,
+                SSL_kGOST,
+                SSL_aGOST01,
+                SSL_eGOST2814789CNT,
+                SSL_GOST89MAC,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_GOST94|TLS1_PRF_GOST94|TLS1_STREAM_MAC,
+                256,
+                256
+        },
+        {
+                1,
+                "GOST94-NULL-GOST94",
+                0x3000082,
+                SSL_kGOST,
+                SSL_aGOST94,
+                SSL_eNULL,
+                SSL_GOST94,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_STRONG_NONE,
+                SSL_HANDSHAKE_MAC_GOST94|TLS1_PRF_GOST94,
+                0,
+                0
+        },
+        {
+                1,
+                "GOST2001-NULL-GOST94",
+                0x3000083,
+                SSL_kGOST,
+                SSL_aGOST01,
+                SSL_eNULL,
+                SSL_GOST94,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_STRONG_NONE,
+                SSL_HANDSHAKE_MAC_GOST94|TLS1_PRF_GOST94,
+                0,
+                0
         },
 
 #ifndef OPENSSL_NO_CAMELLIA
@@ -1562,163 +1562,163 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
         /* Cipher 84 */
         {
-        1,
-        TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA,
-        TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_CAMELLIA256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA,
+                TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_CAMELLIA256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
         /* Cipher 85 */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        TLS1_TXT_DH_DSS_WITH_CAMELLIA_256_CBC_SHA,
-        TLS1_CK_DH_DSS_WITH_CAMELLIA_256_CBC_SHA,
-        SSL_kDHd,
-        SSL_aDH,
-        SSL_CAMELLIA256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                0, /* not implemented (non-ephemeral DH) */
+                TLS1_TXT_DH_DSS_WITH_CAMELLIA_256_CBC_SHA,
+                TLS1_CK_DH_DSS_WITH_CAMELLIA_256_CBC_SHA,
+                SSL_kDHd,
+                SSL_aDH,
+                SSL_CAMELLIA256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher 86 */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        TLS1_TXT_DH_RSA_WITH_CAMELLIA_256_CBC_SHA,
-        TLS1_CK_DH_RSA_WITH_CAMELLIA_256_CBC_SHA,
-        SSL_kDHr,
-        SSL_aDH,
-        SSL_CAMELLIA256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                0, /* not implemented (non-ephemeral DH) */
+                TLS1_TXT_DH_RSA_WITH_CAMELLIA_256_CBC_SHA,
+                TLS1_CK_DH_RSA_WITH_CAMELLIA_256_CBC_SHA,
+                SSL_kDHr,
+                SSL_aDH,
+                SSL_CAMELLIA256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher 87 */
         {
-        1,
-        TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA,
-        TLS1_CK_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA,
-        SSL_kEDH,
-        SSL_aDSS,
-        SSL_CAMELLIA256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA,
+                TLS1_CK_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA,
+                SSL_kEDH,
+                SSL_aDSS,
+                SSL_CAMELLIA256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher 88 */
         {
-        1,
-        TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
-        TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
-        SSL_kEDH,
-        SSL_aRSA,
-        SSL_CAMELLIA256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
+                TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
+                SSL_kEDH,
+                SSL_aRSA,
+                SSL_CAMELLIA256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher 89 */
         {
-        1,
-        TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA,
-        TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA,
-        SSL_kEDH,
-        SSL_aNULL,
-        SSL_CAMELLIA256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA,
+                TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA,
+                SSL_kEDH,
+                SSL_aNULL,
+                SSL_CAMELLIA256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 #endif /* OPENSSL_NO_CAMELLIA */
 
 #ifndef OPENSSL_NO_PSK
         /* Cipher 8A */
         {
-        1,
-        TLS1_TXT_PSK_WITH_RC4_128_SHA,
-        TLS1_CK_PSK_WITH_RC4_128_SHA,
-        SSL_kPSK,
-        SSL_aPSK,
-        SSL_RC4,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_PSK_WITH_RC4_128_SHA,
+                TLS1_CK_PSK_WITH_RC4_128_SHA,
+                SSL_kPSK,
+                SSL_aPSK,
+                SSL_RC4,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 8B */
         {
-        1,
-        TLS1_TXT_PSK_WITH_3DES_EDE_CBC_SHA,
-        TLS1_CK_PSK_WITH_3DES_EDE_CBC_SHA,
-        SSL_kPSK,
-        SSL_aPSK,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                1,
+                TLS1_TXT_PSK_WITH_3DES_EDE_CBC_SHA,
+                TLS1_CK_PSK_WITH_3DES_EDE_CBC_SHA,
+                SSL_kPSK,
+                SSL_aPSK,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
         /* Cipher 8C */
         {
-        1,
-        TLS1_TXT_PSK_WITH_AES_128_CBC_SHA,
-        TLS1_CK_PSK_WITH_AES_128_CBC_SHA,
-        SSL_kPSK,
-        SSL_aPSK,
-        SSL_AES128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_PSK_WITH_AES_128_CBC_SHA,
+                TLS1_CK_PSK_WITH_AES_128_CBC_SHA,
+                SSL_kPSK,
+                SSL_aPSK,
+                SSL_AES128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 8D */
         {
-        1,
-        TLS1_TXT_PSK_WITH_AES_256_CBC_SHA,
-        TLS1_CK_PSK_WITH_AES_256_CBC_SHA,
-        SSL_kPSK,
-        SSL_aPSK,
-        SSL_AES256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_PSK_WITH_AES_256_CBC_SHA,
+                TLS1_CK_PSK_WITH_AES_256_CBC_SHA,
+                SSL_kPSK,
+                SSL_aPSK,
+                SSL_AES256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 #endif  /* OPENSSL_NO_PSK */
 
@@ -1727,98 +1727,98 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
         /* Cipher 96 */
         {
-        1,
-        TLS1_TXT_RSA_WITH_SEED_SHA,
-        TLS1_CK_RSA_WITH_SEED_SHA,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_SEED,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_RSA_WITH_SEED_SHA,
+                TLS1_CK_RSA_WITH_SEED_SHA,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_SEED,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 97 */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        TLS1_TXT_DH_DSS_WITH_SEED_SHA,
-        TLS1_CK_DH_DSS_WITH_SEED_SHA,
-        SSL_kDHd,
-        SSL_aDH,
-        SSL_SEED,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                0, /* not implemented (non-ephemeral DH) */
+                TLS1_TXT_DH_DSS_WITH_SEED_SHA,
+                TLS1_CK_DH_DSS_WITH_SEED_SHA,
+                SSL_kDHd,
+                SSL_aDH,
+                SSL_SEED,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 98 */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        TLS1_TXT_DH_RSA_WITH_SEED_SHA,
-        TLS1_CK_DH_RSA_WITH_SEED_SHA,
-        SSL_kDHr,
-        SSL_aDH,
-        SSL_SEED,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                0, /* not implemented (non-ephemeral DH) */
+                TLS1_TXT_DH_RSA_WITH_SEED_SHA,
+                TLS1_CK_DH_RSA_WITH_SEED_SHA,
+                SSL_kDHr,
+                SSL_aDH,
+                SSL_SEED,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 99 */
         {
-        1,
-        TLS1_TXT_DHE_DSS_WITH_SEED_SHA,
-        TLS1_CK_DHE_DSS_WITH_SEED_SHA,
-        SSL_kEDH,
-        SSL_aDSS,
-        SSL_SEED,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_DHE_DSS_WITH_SEED_SHA,
+                TLS1_CK_DHE_DSS_WITH_SEED_SHA,
+                SSL_kEDH,
+                SSL_aDSS,
+                SSL_SEED,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 9A */
         {
-        1,
-        TLS1_TXT_DHE_RSA_WITH_SEED_SHA,
-        TLS1_CK_DHE_RSA_WITH_SEED_SHA,
-        SSL_kEDH,
-        SSL_aRSA,
-        SSL_SEED,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_DHE_RSA_WITH_SEED_SHA,
+                TLS1_CK_DHE_RSA_WITH_SEED_SHA,
+                SSL_kEDH,
+                SSL_aRSA,
+                SSL_SEED,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 9B */
         {
-        1,
-        TLS1_TXT_ADH_WITH_SEED_SHA,
-        TLS1_CK_ADH_WITH_SEED_SHA,
-        SSL_kEDH,
-        SSL_aNULL,
-        SSL_SEED,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_ADH_WITH_SEED_SHA,
+                TLS1_CK_ADH_WITH_SEED_SHA,
+                SSL_kEDH,
+                SSL_aNULL,
+                SSL_SEED,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
 #endif /* OPENSSL_NO_SEED */
@@ -1827,741 +1827,741 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
         /* Cipher 9C */
         {
-        1,
-        TLS1_TXT_RSA_WITH_AES_128_GCM_SHA256,
-        TLS1_CK_RSA_WITH_AES_128_GCM_SHA256,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_AES128GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
-        128,
-        128,
+                1,
+                TLS1_TXT_RSA_WITH_AES_128_GCM_SHA256,
+                TLS1_CK_RSA_WITH_AES_128_GCM_SHA256,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_AES128GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+                128,
+                128,
         },
 
         /* Cipher 9D */
         {
-        1,
-        TLS1_TXT_RSA_WITH_AES_256_GCM_SHA384,
-        TLS1_CK_RSA_WITH_AES_256_GCM_SHA384,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_AES256GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
-        256,
-        256,
+                1,
+                TLS1_TXT_RSA_WITH_AES_256_GCM_SHA384,
+                TLS1_CK_RSA_WITH_AES_256_GCM_SHA384,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_AES256GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
+                256,
+                256,
         },
 
         /* Cipher 9E */
         {
-        1,
-        TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256,
-        TLS1_CK_DHE_RSA_WITH_AES_128_GCM_SHA256,
-        SSL_kEDH,
-        SSL_aRSA,
-        SSL_AES128GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
-        128,
-        128,
+                1,
+                TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256,
+                TLS1_CK_DHE_RSA_WITH_AES_128_GCM_SHA256,
+                SSL_kEDH,
+                SSL_aRSA,
+                SSL_AES128GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+                128,
+                128,
         },
 
         /* Cipher 9F */
         {
-        1,
-        TLS1_TXT_DHE_RSA_WITH_AES_256_GCM_SHA384,
-        TLS1_CK_DHE_RSA_WITH_AES_256_GCM_SHA384,
-        SSL_kEDH,
-        SSL_aRSA,
-        SSL_AES256GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
-        256,
-        256,
+                1,
+                TLS1_TXT_DHE_RSA_WITH_AES_256_GCM_SHA384,
+                TLS1_CK_DHE_RSA_WITH_AES_256_GCM_SHA384,
+                SSL_kEDH,
+                SSL_aRSA,
+                SSL_AES256GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
+                256,
+                256,
         },
 
         /* Cipher A0 */
         {
-        0,
-        TLS1_TXT_DH_RSA_WITH_AES_128_GCM_SHA256,
-        TLS1_CK_DH_RSA_WITH_AES_128_GCM_SHA256,
-        SSL_kDHr,
-        SSL_aDH,
-        SSL_AES128GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
-        128,
-        128,
+                0,
+                TLS1_TXT_DH_RSA_WITH_AES_128_GCM_SHA256,
+                TLS1_CK_DH_RSA_WITH_AES_128_GCM_SHA256,
+                SSL_kDHr,
+                SSL_aDH,
+                SSL_AES128GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+                128,
+                128,
         },
 
         /* Cipher A1 */
         {
-        0,
-        TLS1_TXT_DH_RSA_WITH_AES_256_GCM_SHA384,
-        TLS1_CK_DH_RSA_WITH_AES_256_GCM_SHA384,
-        SSL_kDHr,
-        SSL_aDH,
-        SSL_AES256GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
-        256,
-        256,
+                0,
+                TLS1_TXT_DH_RSA_WITH_AES_256_GCM_SHA384,
+                TLS1_CK_DH_RSA_WITH_AES_256_GCM_SHA384,
+                SSL_kDHr,
+                SSL_aDH,
+                SSL_AES256GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
+                256,
+                256,
         },
 
         /* Cipher A2 */
         {
-        1,
-        TLS1_TXT_DHE_DSS_WITH_AES_128_GCM_SHA256,
-        TLS1_CK_DHE_DSS_WITH_AES_128_GCM_SHA256,
-        SSL_kEDH,
-        SSL_aDSS,
-        SSL_AES128GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
-        128,
-        128,
+                1,
+                TLS1_TXT_DHE_DSS_WITH_AES_128_GCM_SHA256,
+                TLS1_CK_DHE_DSS_WITH_AES_128_GCM_SHA256,
+                SSL_kEDH,
+                SSL_aDSS,
+                SSL_AES128GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+                128,
+                128,
         },
 
         /* Cipher A3 */
         {
-        1,
-        TLS1_TXT_DHE_DSS_WITH_AES_256_GCM_SHA384,
-        TLS1_CK_DHE_DSS_WITH_AES_256_GCM_SHA384,
-        SSL_kEDH,
-        SSL_aDSS,
-        SSL_AES256GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
-        256,
-        256,
+                1,
+                TLS1_TXT_DHE_DSS_WITH_AES_256_GCM_SHA384,
+                TLS1_CK_DHE_DSS_WITH_AES_256_GCM_SHA384,
+                SSL_kEDH,
+                SSL_aDSS,
+                SSL_AES256GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
+                256,
+                256,
         },
 
         /* Cipher A4 */
         {
-        0,
-        TLS1_TXT_DH_DSS_WITH_AES_128_GCM_SHA256,
-        TLS1_CK_DH_DSS_WITH_AES_128_GCM_SHA256,
-        SSL_kDHd,
-        SSL_aDH,
-        SSL_AES128GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
-        128,
-        128,
+                0,
+                TLS1_TXT_DH_DSS_WITH_AES_128_GCM_SHA256,
+                TLS1_CK_DH_DSS_WITH_AES_128_GCM_SHA256,
+                SSL_kDHd,
+                SSL_aDH,
+                SSL_AES128GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+                128,
+                128,
         },
 
         /* Cipher A5 */
         {
-        0,
-        TLS1_TXT_DH_DSS_WITH_AES_256_GCM_SHA384,
-        TLS1_CK_DH_DSS_WITH_AES_256_GCM_SHA384,
-        SSL_kDHd,
-        SSL_aDH,
-        SSL_AES256GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
-        256,
-        256,
+                0,
+                TLS1_TXT_DH_DSS_WITH_AES_256_GCM_SHA384,
+                TLS1_CK_DH_DSS_WITH_AES_256_GCM_SHA384,
+                SSL_kDHd,
+                SSL_aDH,
+                SSL_AES256GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
+                256,
+                256,
         },
 
         /* Cipher A6 */
         {
-        1,
-        TLS1_TXT_ADH_WITH_AES_128_GCM_SHA256,
-        TLS1_CK_ADH_WITH_AES_128_GCM_SHA256,
-        SSL_kEDH,
-        SSL_aNULL,
-        SSL_AES128GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
-        128,
-        128,
+                1,
+                TLS1_TXT_ADH_WITH_AES_128_GCM_SHA256,
+                TLS1_CK_ADH_WITH_AES_128_GCM_SHA256,
+                SSL_kEDH,
+                SSL_aNULL,
+                SSL_AES128GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+                128,
+                128,
         },
 
         /* Cipher A7 */
         {
-        1,
-        TLS1_TXT_ADH_WITH_AES_256_GCM_SHA384,
-        TLS1_CK_ADH_WITH_AES_256_GCM_SHA384,
-        SSL_kEDH,
-        SSL_aNULL,
-        SSL_AES256GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
-        256,
-        256,
+                1,
+                TLS1_TXT_ADH_WITH_AES_256_GCM_SHA384,
+                TLS1_CK_ADH_WITH_AES_256_GCM_SHA384,
+                SSL_kEDH,
+                SSL_aNULL,
+                SSL_AES256GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
+                256,
+                256,
         },
 
 #ifndef OPENSSL_NO_ECDH
         /* Cipher C001 */
         {
-        1,
-        TLS1_TXT_ECDH_ECDSA_WITH_NULL_SHA,
-        TLS1_CK_ECDH_ECDSA_WITH_NULL_SHA,
-        SSL_kECDHe,
-        SSL_aECDH,
-        SSL_eNULL,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        0,
-        0,
+                1,
+                TLS1_TXT_ECDH_ECDSA_WITH_NULL_SHA,
+                TLS1_CK_ECDH_ECDSA_WITH_NULL_SHA,
+                SSL_kECDHe,
+                SSL_aECDH,
+                SSL_eNULL,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                0,
+                0,
         },
 
         /* Cipher C002 */
         {
-        1,
-        TLS1_TXT_ECDH_ECDSA_WITH_RC4_128_SHA,
-        TLS1_CK_ECDH_ECDSA_WITH_RC4_128_SHA,
-        SSL_kECDHe,
-        SSL_aECDH,
-        SSL_RC4,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDH_ECDSA_WITH_RC4_128_SHA,
+                TLS1_CK_ECDH_ECDSA_WITH_RC4_128_SHA,
+                SSL_kECDHe,
+                SSL_aECDH,
+                SSL_RC4,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher C003 */
         {
-        1,
-        TLS1_TXT_ECDH_ECDSA_WITH_DES_192_CBC3_SHA,
-        TLS1_CK_ECDH_ECDSA_WITH_DES_192_CBC3_SHA,
-        SSL_kECDHe,
-        SSL_aECDH,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                1,
+                TLS1_TXT_ECDH_ECDSA_WITH_DES_192_CBC3_SHA,
+                TLS1_CK_ECDH_ECDSA_WITH_DES_192_CBC3_SHA,
+                SSL_kECDHe,
+                SSL_aECDH,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
         /* Cipher C004 */
         {
-        1,
-        TLS1_TXT_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
-        TLS1_CK_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
-        SSL_kECDHe,
-        SSL_aECDH,
-        SSL_AES128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
+                TLS1_CK_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
+                SSL_kECDHe,
+                SSL_aECDH,
+                SSL_AES128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher C005 */
         {
-        1,
-        TLS1_TXT_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
-        TLS1_CK_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
-        SSL_kECDHe,
-        SSL_aECDH,
-        SSL_AES256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
+                TLS1_CK_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
+                SSL_kECDHe,
+                SSL_aECDH,
+                SSL_AES256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher C006 */
         {
-        1,
-        TLS1_TXT_ECDHE_ECDSA_WITH_NULL_SHA,
-        TLS1_CK_ECDHE_ECDSA_WITH_NULL_SHA,
-        SSL_kEECDH,
-        SSL_aECDSA,
-        SSL_eNULL,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        0,
-        0,
+                1,
+                TLS1_TXT_ECDHE_ECDSA_WITH_NULL_SHA,
+                TLS1_CK_ECDHE_ECDSA_WITH_NULL_SHA,
+                SSL_kEECDH,
+                SSL_aECDSA,
+                SSL_eNULL,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                0,
+                0,
         },
 
         /* Cipher C007 */
         {
-        1,
-        TLS1_TXT_ECDHE_ECDSA_WITH_RC4_128_SHA,
-        TLS1_CK_ECDHE_ECDSA_WITH_RC4_128_SHA,
-        SSL_kEECDH,
-        SSL_aECDSA,
-        SSL_RC4,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDHE_ECDSA_WITH_RC4_128_SHA,
+                TLS1_CK_ECDHE_ECDSA_WITH_RC4_128_SHA,
+                SSL_kEECDH,
+                SSL_aECDSA,
+                SSL_RC4,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher C008 */
         {
-        1,
-        TLS1_TXT_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA,
-        TLS1_CK_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA,
-        SSL_kEECDH,
-        SSL_aECDSA,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                1,
+                TLS1_TXT_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA,
+                TLS1_CK_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA,
+                SSL_kEECDH,
+                SSL_aECDSA,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
         /* Cipher C009 */
         {
-        1,
-        TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
-        TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
-        SSL_kEECDH,
-        SSL_aECDSA,
-        SSL_AES128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
+                TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
+                SSL_kEECDH,
+                SSL_aECDSA,
+                SSL_AES128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher C00A */
         {
-        1,
-        TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
-        TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
-        SSL_kEECDH,
-        SSL_aECDSA,
-        SSL_AES256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
+                TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
+                SSL_kEECDH,
+                SSL_aECDSA,
+                SSL_AES256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher C00B */
         {
-        1,
-        TLS1_TXT_ECDH_RSA_WITH_NULL_SHA,
-        TLS1_CK_ECDH_RSA_WITH_NULL_SHA,
-        SSL_kECDHr,
-        SSL_aECDH,
-        SSL_eNULL,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        0,
-        0,
+                1,
+                TLS1_TXT_ECDH_RSA_WITH_NULL_SHA,
+                TLS1_CK_ECDH_RSA_WITH_NULL_SHA,
+                SSL_kECDHr,
+                SSL_aECDH,
+                SSL_eNULL,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                0,
+                0,
         },
 
         /* Cipher C00C */
         {
-        1,
-        TLS1_TXT_ECDH_RSA_WITH_RC4_128_SHA,
-        TLS1_CK_ECDH_RSA_WITH_RC4_128_SHA,
-        SSL_kECDHr,
-        SSL_aECDH,
-        SSL_RC4,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDH_RSA_WITH_RC4_128_SHA,
+                TLS1_CK_ECDH_RSA_WITH_RC4_128_SHA,
+                SSL_kECDHr,
+                SSL_aECDH,
+                SSL_RC4,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher C00D */
         {
-        1,
-        TLS1_TXT_ECDH_RSA_WITH_DES_192_CBC3_SHA,
-        TLS1_CK_ECDH_RSA_WITH_DES_192_CBC3_SHA,
-        SSL_kECDHr,
-        SSL_aECDH,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                1,
+                TLS1_TXT_ECDH_RSA_WITH_DES_192_CBC3_SHA,
+                TLS1_CK_ECDH_RSA_WITH_DES_192_CBC3_SHA,
+                SSL_kECDHr,
+                SSL_aECDH,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
         /* Cipher C00E */
         {
-        1,
-        TLS1_TXT_ECDH_RSA_WITH_AES_128_CBC_SHA,
-        TLS1_CK_ECDH_RSA_WITH_AES_128_CBC_SHA,
-        SSL_kECDHr,
-        SSL_aECDH,
-        SSL_AES128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDH_RSA_WITH_AES_128_CBC_SHA,
+                TLS1_CK_ECDH_RSA_WITH_AES_128_CBC_SHA,
+                SSL_kECDHr,
+                SSL_aECDH,
+                SSL_AES128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher C00F */
         {
-        1,
-        TLS1_TXT_ECDH_RSA_WITH_AES_256_CBC_SHA,
-        TLS1_CK_ECDH_RSA_WITH_AES_256_CBC_SHA,
-        SSL_kECDHr,
-        SSL_aECDH,
-        SSL_AES256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_ECDH_RSA_WITH_AES_256_CBC_SHA,
+                TLS1_CK_ECDH_RSA_WITH_AES_256_CBC_SHA,
+                SSL_kECDHr,
+                SSL_aECDH,
+                SSL_AES256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher C010 */
         {
-        1,
-        TLS1_TXT_ECDHE_RSA_WITH_NULL_SHA,
-        TLS1_CK_ECDHE_RSA_WITH_NULL_SHA,
-        SSL_kEECDH,
-        SSL_aRSA,
-        SSL_eNULL,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        0,
-        0,
+                1,
+                TLS1_TXT_ECDHE_RSA_WITH_NULL_SHA,
+                TLS1_CK_ECDHE_RSA_WITH_NULL_SHA,
+                SSL_kEECDH,
+                SSL_aRSA,
+                SSL_eNULL,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                0,
+                0,
         },
 
         /* Cipher C011 */
         {
-        1,
-        TLS1_TXT_ECDHE_RSA_WITH_RC4_128_SHA,
-        TLS1_CK_ECDHE_RSA_WITH_RC4_128_SHA,
-        SSL_kEECDH,
-        SSL_aRSA,
-        SSL_RC4,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDHE_RSA_WITH_RC4_128_SHA,
+                TLS1_CK_ECDHE_RSA_WITH_RC4_128_SHA,
+                SSL_kEECDH,
+                SSL_aRSA,
+                SSL_RC4,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher C012 */
         {
-        1,
-        TLS1_TXT_ECDHE_RSA_WITH_DES_192_CBC3_SHA,
-        TLS1_CK_ECDHE_RSA_WITH_DES_192_CBC3_SHA,
-        SSL_kEECDH,
-        SSL_aRSA,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                1,
+                TLS1_TXT_ECDHE_RSA_WITH_DES_192_CBC3_SHA,
+                TLS1_CK_ECDHE_RSA_WITH_DES_192_CBC3_SHA,
+                SSL_kEECDH,
+                SSL_aRSA,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
         /* Cipher C013 */
         {
-        1,
-        TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA,
-        TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA,
-        SSL_kEECDH,
-        SSL_aRSA,
-        SSL_AES128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA,
+                TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA,
+                SSL_kEECDH,
+                SSL_aRSA,
+                SSL_AES128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher C014 */
         {
-        1,
-        TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA,
-        TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA,
-        SSL_kEECDH,
-        SSL_aRSA,
-        SSL_AES256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA,
+                TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA,
+                SSL_kEECDH,
+                SSL_aRSA,
+                SSL_AES256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher C015 */
         {
-        1,
-        TLS1_TXT_ECDH_anon_WITH_NULL_SHA,
-        TLS1_CK_ECDH_anon_WITH_NULL_SHA,
-        SSL_kEECDH,
-        SSL_aNULL,
-        SSL_eNULL,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        0,
-        0,
+                1,
+                TLS1_TXT_ECDH_anon_WITH_NULL_SHA,
+                TLS1_CK_ECDH_anon_WITH_NULL_SHA,
+                SSL_kEECDH,
+                SSL_aNULL,
+                SSL_eNULL,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                0,
+                0,
         },
 
         /* Cipher C016 */
         {
-        1,
-        TLS1_TXT_ECDH_anon_WITH_RC4_128_SHA,
-        TLS1_CK_ECDH_anon_WITH_RC4_128_SHA,
-        SSL_kEECDH,
-        SSL_aNULL,
-        SSL_RC4,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDH_anon_WITH_RC4_128_SHA,
+                TLS1_CK_ECDH_anon_WITH_RC4_128_SHA,
+                SSL_kEECDH,
+                SSL_aNULL,
+                SSL_RC4,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher C017 */
         {
-        1,
-        TLS1_TXT_ECDH_anon_WITH_DES_192_CBC3_SHA,
-        TLS1_CK_ECDH_anon_WITH_DES_192_CBC3_SHA,
-        SSL_kEECDH,
-        SSL_aNULL,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                1,
+                TLS1_TXT_ECDH_anon_WITH_DES_192_CBC3_SHA,
+                TLS1_CK_ECDH_anon_WITH_DES_192_CBC3_SHA,
+                SSL_kEECDH,
+                SSL_aNULL,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
         /* Cipher C018 */
         {
-        1,
-        TLS1_TXT_ECDH_anon_WITH_AES_128_CBC_SHA,
-        TLS1_CK_ECDH_anon_WITH_AES_128_CBC_SHA,
-        SSL_kEECDH,
-        SSL_aNULL,
-        SSL_AES128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDH_anon_WITH_AES_128_CBC_SHA,
+                TLS1_CK_ECDH_anon_WITH_AES_128_CBC_SHA,
+                SSL_kEECDH,
+                SSL_aNULL,
+                SSL_AES128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher C019 */
         {
-        1,
-        TLS1_TXT_ECDH_anon_WITH_AES_256_CBC_SHA,
-        TLS1_CK_ECDH_anon_WITH_AES_256_CBC_SHA,
-        SSL_kEECDH,
-        SSL_aNULL,
-        SSL_AES256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_ECDH_anon_WITH_AES_256_CBC_SHA,
+                TLS1_CK_ECDH_anon_WITH_AES_256_CBC_SHA,
+                SSL_kEECDH,
+                SSL_aNULL,
+                SSL_AES256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 #endif  /* OPENSSL_NO_ECDH */
 
 #ifndef OPENSSL_NO_SRP
         /* Cipher C01A */
         {
-        1,
-        TLS1_TXT_SRP_SHA_WITH_3DES_EDE_CBC_SHA,
-        TLS1_CK_SRP_SHA_WITH_3DES_EDE_CBC_SHA,
-        SSL_kSRP,
-        SSL_aNULL,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                1,
+                TLS1_TXT_SRP_SHA_WITH_3DES_EDE_CBC_SHA,
+                TLS1_CK_SRP_SHA_WITH_3DES_EDE_CBC_SHA,
+                SSL_kSRP,
+                SSL_aNULL,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
         /* Cipher C01B */
         {
-        1,
-        TLS1_TXT_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA,
-        TLS1_CK_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA,
-        SSL_kSRP,
-        SSL_aRSA,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                1,
+                TLS1_TXT_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA,
+                TLS1_CK_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA,
+                SSL_kSRP,
+                SSL_aRSA,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
         /* Cipher C01C */
         {
-        1,
-        TLS1_TXT_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA,
-        TLS1_CK_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA,
-        SSL_kSRP,
-        SSL_aDSS,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                1,
+                TLS1_TXT_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA,
+                TLS1_CK_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA,
+                SSL_kSRP,
+                SSL_aDSS,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
         /* Cipher C01D */
         {
-        1,
-        TLS1_TXT_SRP_SHA_WITH_AES_128_CBC_SHA,
-        TLS1_CK_SRP_SHA_WITH_AES_128_CBC_SHA,
-        SSL_kSRP,
-        SSL_aNULL,
-        SSL_AES128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_SRP_SHA_WITH_AES_128_CBC_SHA,
+                TLS1_CK_SRP_SHA_WITH_AES_128_CBC_SHA,
+                SSL_kSRP,
+                SSL_aNULL,
+                SSL_AES128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher C01E */
         {
-        1,
-        TLS1_TXT_SRP_SHA_RSA_WITH_AES_128_CBC_SHA,
-        TLS1_CK_SRP_SHA_RSA_WITH_AES_128_CBC_SHA,
-        SSL_kSRP,
-        SSL_aRSA,
-        SSL_AES128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_SRP_SHA_RSA_WITH_AES_128_CBC_SHA,
+                TLS1_CK_SRP_SHA_RSA_WITH_AES_128_CBC_SHA,
+                SSL_kSRP,
+                SSL_aRSA,
+                SSL_AES128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher C01F */
         {
-        1,
-        TLS1_TXT_SRP_SHA_DSS_WITH_AES_128_CBC_SHA,
-        TLS1_CK_SRP_SHA_DSS_WITH_AES_128_CBC_SHA,
-        SSL_kSRP,
-        SSL_aDSS,
-        SSL_AES128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_SRP_SHA_DSS_WITH_AES_128_CBC_SHA,
+                TLS1_CK_SRP_SHA_DSS_WITH_AES_128_CBC_SHA,
+                SSL_kSRP,
+                SSL_aDSS,
+                SSL_AES128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher C020 */
         {
-        1,
-        TLS1_TXT_SRP_SHA_WITH_AES_256_CBC_SHA,
-        TLS1_CK_SRP_SHA_WITH_AES_256_CBC_SHA,
-        SSL_kSRP,
-        SSL_aNULL,
-        SSL_AES256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_SRP_SHA_WITH_AES_256_CBC_SHA,
+                TLS1_CK_SRP_SHA_WITH_AES_256_CBC_SHA,
+                SSL_kSRP,
+                SSL_aNULL,
+                SSL_AES256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher C021 */
         {
-        1,
-        TLS1_TXT_SRP_SHA_RSA_WITH_AES_256_CBC_SHA,
-        TLS1_CK_SRP_SHA_RSA_WITH_AES_256_CBC_SHA,
-        SSL_kSRP,
-        SSL_aRSA,
-        SSL_AES256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_SRP_SHA_RSA_WITH_AES_256_CBC_SHA,
+                TLS1_CK_SRP_SHA_RSA_WITH_AES_256_CBC_SHA,
+                SSL_kSRP,
+                SSL_aRSA,
+                SSL_AES256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher C022 */
         {
-        1,
-        TLS1_TXT_SRP_SHA_DSS_WITH_AES_256_CBC_SHA,
-        TLS1_CK_SRP_SHA_DSS_WITH_AES_256_CBC_SHA,
-        SSL_kSRP,
-        SSL_aDSS,
-        SSL_AES256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_SRP_SHA_DSS_WITH_AES_256_CBC_SHA,
+                TLS1_CK_SRP_SHA_DSS_WITH_AES_256_CBC_SHA,
+                SSL_kSRP,
+                SSL_aDSS,
+                SSL_AES256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 #endif  /* OPENSSL_NO_SRP */
 #ifndef OPENSSL_NO_ECDH
@@ -2570,260 +2570,260 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
         /* Cipher C023 */
         {
-        1,
-        TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_SHA256,
-        TLS1_CK_ECDHE_ECDSA_WITH_AES_128_SHA256,
-        SSL_kEECDH,
-        SSL_aECDSA,
-        SSL_AES128,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_SHA256,
+                TLS1_CK_ECDHE_ECDSA_WITH_AES_128_SHA256,
+                SSL_kEECDH,
+                SSL_aECDSA,
+                SSL_AES128,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+                128,
+                128,
         },
 
         /* Cipher C024 */
         {
-        1,
-        TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_SHA384,
-        TLS1_CK_ECDHE_ECDSA_WITH_AES_256_SHA384,
-        SSL_kEECDH,
-        SSL_aECDSA,
-        SSL_AES256,
-        SSL_SHA384,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
-        256,
-        256,
+                1,
+                TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_SHA384,
+                TLS1_CK_ECDHE_ECDSA_WITH_AES_256_SHA384,
+                SSL_kEECDH,
+                SSL_aECDSA,
+                SSL_AES256,
+                SSL_SHA384,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
+                256,
+                256,
         },
 
         /* Cipher C025 */
         {
-        1,
-        TLS1_TXT_ECDH_ECDSA_WITH_AES_128_SHA256,
-        TLS1_CK_ECDH_ECDSA_WITH_AES_128_SHA256,
-        SSL_kECDHe,
-        SSL_aECDH,
-        SSL_AES128,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDH_ECDSA_WITH_AES_128_SHA256,
+                TLS1_CK_ECDH_ECDSA_WITH_AES_128_SHA256,
+                SSL_kECDHe,
+                SSL_aECDH,
+                SSL_AES128,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+                128,
+                128,
         },
 
         /* Cipher C026 */
         {
-        1,
-        TLS1_TXT_ECDH_ECDSA_WITH_AES_256_SHA384,
-        TLS1_CK_ECDH_ECDSA_WITH_AES_256_SHA384,
-        SSL_kECDHe,
-        SSL_aECDH,
-        SSL_AES256,
-        SSL_SHA384,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
-        256,
-        256,
+                1,
+                TLS1_TXT_ECDH_ECDSA_WITH_AES_256_SHA384,
+                TLS1_CK_ECDH_ECDSA_WITH_AES_256_SHA384,
+                SSL_kECDHe,
+                SSL_aECDH,
+                SSL_AES256,
+                SSL_SHA384,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
+                256,
+                256,
         },
 
         /* Cipher C027 */
         {
-        1,
-        TLS1_TXT_ECDHE_RSA_WITH_AES_128_SHA256,
-        TLS1_CK_ECDHE_RSA_WITH_AES_128_SHA256,
-        SSL_kEECDH,
-        SSL_aRSA,
-        SSL_AES128,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDHE_RSA_WITH_AES_128_SHA256,
+                TLS1_CK_ECDHE_RSA_WITH_AES_128_SHA256,
+                SSL_kEECDH,
+                SSL_aRSA,
+                SSL_AES128,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+                128,
+                128,
         },
 
         /* Cipher C028 */
         {
-        1,
-        TLS1_TXT_ECDHE_RSA_WITH_AES_256_SHA384,
-        TLS1_CK_ECDHE_RSA_WITH_AES_256_SHA384,
-        SSL_kEECDH,
-        SSL_aRSA,
-        SSL_AES256,
-        SSL_SHA384,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
-        256,
-        256,
+                1,
+                TLS1_TXT_ECDHE_RSA_WITH_AES_256_SHA384,
+                TLS1_CK_ECDHE_RSA_WITH_AES_256_SHA384,
+                SSL_kEECDH,
+                SSL_aRSA,
+                SSL_AES256,
+                SSL_SHA384,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
+                256,
+                256,
         },
 
         /* Cipher C029 */
         {
-        1,
-        TLS1_TXT_ECDH_RSA_WITH_AES_128_SHA256,
-        TLS1_CK_ECDH_RSA_WITH_AES_128_SHA256,
-        SSL_kECDHr,
-        SSL_aECDH,
-        SSL_AES128,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDH_RSA_WITH_AES_128_SHA256,
+                TLS1_CK_ECDH_RSA_WITH_AES_128_SHA256,
+                SSL_kECDHr,
+                SSL_aECDH,
+                SSL_AES128,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+                128,
+                128,
         },
 
         /* Cipher C02A */
         {
-        1,
-        TLS1_TXT_ECDH_RSA_WITH_AES_256_SHA384,
-        TLS1_CK_ECDH_RSA_WITH_AES_256_SHA384,
-        SSL_kECDHr,
-        SSL_aECDH,
-        SSL_AES256,
-        SSL_SHA384,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
-        256,
-        256,
+                1,
+                TLS1_TXT_ECDH_RSA_WITH_AES_256_SHA384,
+                TLS1_CK_ECDH_RSA_WITH_AES_256_SHA384,
+                SSL_kECDHr,
+                SSL_aECDH,
+                SSL_AES256,
+                SSL_SHA384,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
+                256,
+                256,
         },
 
         /* GCM based TLS v1.2 ciphersuites from RFC5289 */
 
         /* Cipher C02B */
         {
-        1,
-        TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
-        TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
-        SSL_kEECDH,
-        SSL_aECDSA,
-        SSL_AES128GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+                TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+                SSL_kEECDH,
+                SSL_aECDSA,
+                SSL_AES128GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+                128,
+                128,
         },
 
         /* Cipher C02C */
         {
-        1,
-        TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-        TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-        SSL_kEECDH,
-        SSL_aECDSA,
-        SSL_AES256GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
-        256,
-        256,
+                1,
+                TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+                TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+                SSL_kEECDH,
+                SSL_aECDSA,
+                SSL_AES256GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
+                256,
+                256,
         },
 
         /* Cipher C02D */
         {
-        1,
-        TLS1_TXT_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,
-        TLS1_CK_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,
-        SSL_kECDHe,
-        SSL_aECDH,
-        SSL_AES128GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,
+                TLS1_CK_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,
+                SSL_kECDHe,
+                SSL_aECDH,
+                SSL_AES128GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+                128,
+                128,
         },
 
         /* Cipher C02E */
         {
-        1,
-        TLS1_TXT_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,
-        TLS1_CK_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,
-        SSL_kECDHe,
-        SSL_aECDH,
-        SSL_AES256GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
-        256,
-        256,
+                1,
+                TLS1_TXT_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,
+                TLS1_CK_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,
+                SSL_kECDHe,
+                SSL_aECDH,
+                SSL_AES256GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
+                256,
+                256,
         },
 
         /* Cipher C02F */
         {
-        1,
-        TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-        TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-        SSL_kEECDH,
-        SSL_aRSA,
-        SSL_AES128GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+                TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+                SSL_kEECDH,
+                SSL_aRSA,
+                SSL_AES128GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+                128,
+                128,
         },
 
         /* Cipher C030 */
         {
-        1,
-        TLS1_TXT_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
-        TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
-        SSL_kEECDH,
-        SSL_aRSA,
-        SSL_AES256GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
-        256,
-        256,
+                1,
+                TLS1_TXT_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+                TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+                SSL_kEECDH,
+                SSL_aRSA,
+                SSL_AES256GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
+                256,
+                256,
         },
 
         /* Cipher C031 */
         {
-        1,
-        TLS1_TXT_ECDH_RSA_WITH_AES_128_GCM_SHA256,
-        TLS1_CK_ECDH_RSA_WITH_AES_128_GCM_SHA256,
-        SSL_kECDHr,
-        SSL_aECDH,
-        SSL_AES128GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDH_RSA_WITH_AES_128_GCM_SHA256,
+                TLS1_CK_ECDH_RSA_WITH_AES_128_GCM_SHA256,
+                SSL_kECDHr,
+                SSL_aECDH,
+                SSL_AES128GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+                128,
+                128,
         },
 
         /* Cipher C032 */
         {
-        1,
-        TLS1_TXT_ECDH_RSA_WITH_AES_256_GCM_SHA384,
-        TLS1_CK_ECDH_RSA_WITH_AES_256_GCM_SHA384,
-        SSL_kECDHr,
-        SSL_aECDH,
-        SSL_AES256GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
-        256,
-        256,
+                1,
+                TLS1_TXT_ECDH_RSA_WITH_AES_256_GCM_SHA384,
+                TLS1_CK_ECDH_RSA_WITH_AES_256_GCM_SHA384,
+                SSL_kECDHr,
+                SSL_aECDH,
+                SSL_AES256GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
+                256,
+                256,
         },
 
 #endif /* OPENSSL_NO_ECDH */
@@ -2832,135 +2832,141 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 #ifdef TEMP_GOST_TLS
 /* Cipher FF00 */
         {
-        1,
-        "GOST-MD5",
-        0x0300ff00,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_eGOST2814789CNT,
-        SSL_MD5,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
-        },
-        {
-        1,
-        "GOST-GOST94",
-        0x0300ff01,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_eGOST2814789CNT,
-        SSL_GOST94,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256
-        },
-        {
-        1,
-        "GOST-GOST89MAC",
-        0x0300ff02,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_eGOST2814789CNT,
-        SSL_GOST89MAC,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256
-        },
-        {
-        1,
-        "GOST-GOST89STREAM",
-        0x0300ff03,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_eGOST2814789CNT,
-        SSL_GOST89MAC,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF|TLS1_STREAM_MAC,
-        256,
-        256
+                1,
+                "GOST-MD5",
+                0x0300ff00,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_eGOST2814789CNT,
+                SSL_MD5,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
+        },
+        {
+                1,
+                "GOST-GOST94",
+                0x0300ff01,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_eGOST2814789CNT,
+                SSL_GOST94,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256
+        },
+        {
+                1,
+                "GOST-GOST89MAC",
+                0x0300ff02,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_eGOST2814789CNT,
+                SSL_GOST89MAC,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256
+        },
+        {
+                1,
+                "GOST-GOST89STREAM",
+                0x0300ff03,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_eGOST2814789CNT,
+                SSL_GOST89MAC,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF|TLS1_STREAM_MAC,
+                256,
+                256
         },
 #endif
 
 /* end of list */
-        };
+};
 
-SSL3_ENC_METHOD SSLv3_enc_data={
+SSL3_ENC_METHOD SSLv3_enc_data = {
         ssl3_enc,
         n_ssl3_mac,
         ssl3_setup_key_block,
         ssl3_generate_master_secret,
         ssl3_change_cipher_state,
         ssl3_final_finish_mac,
-        MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH,
+        MD5_DIGEST_LENGTH + SHA_DIGEST_LENGTH,
         ssl3_cert_verify_mac,
-        SSL3_MD_CLIENT_FINISHED_CONST,4,
-        SSL3_MD_SERVER_FINISHED_CONST,4,
+        SSL3_MD_CLIENT_FINISHED_CONST, 4,
+        SSL3_MD_SERVER_FINISHED_CONST, 4,
         ssl3_alert_code,
         (int (*)(SSL *, unsigned char *, size_t, const char *,
-                 size_t, const unsigned char *, size_t,
-                 int use_context))ssl_undefined_function,
-        };
+        size_t, const unsigned char *, size_t,
+        int use_context))ssl_undefined_function,
+};
 
-long ssl3_default_timeout(void)
-        {
+long
+ssl3_default_timeout(void)
+{
         /* 2 hours, the 24 hours mentioned in the SSLv3 spec
          * is way too long for http, the cache would over fill */
-        return(60*60*2);
-        }
-
-int ssl3_num_ciphers(void)
-        {
-        return(SSL3_NUM_CIPHERS);
-        }
-
-const SSL_CIPHER *ssl3_get_cipher(unsigned int u)
-        {
+        return (60*60*2);
+}
+
+int
+ssl3_num_ciphers(void)
+{
+        return (SSL3_NUM_CIPHERS);
+}
+
+const SSL_CIPHER
+*ssl3_get_cipher(unsigned int u)
+{
         if (u < SSL3_NUM_CIPHERS)
-                return(&(ssl3_ciphers[SSL3_NUM_CIPHERS-1-u]));
+                return (&(ssl3_ciphers[SSL3_NUM_CIPHERS - 1 - u]));
         else
-                return(NULL);
-        }
+                return (NULL);
+}
 
-int ssl3_pending(const SSL *s)
-        {
+int
+ssl3_pending(const SSL *s)
+{
         if (s->rstate == SSL_ST_READ_BODY)
                 return 0;
-        
+
         return (s->s3->rrec.type == SSL3_RT_APPLICATION_DATA) ? s->s3->rrec.length : 0;
-        }
+}
 
-int ssl3_new(SSL *s)
-        {
+int
+ssl3_new(SSL *s)
+{
         SSL3_STATE *s3;
 
-        if ((s3=OPENSSL_malloc(sizeof *s3)) == NULL) goto err;
-        memset(s3,0,sizeof *s3);
-        memset(s3->rrec.seq_num,0,sizeof(s3->rrec.seq_num));
-        memset(s3->wrec.seq_num,0,sizeof(s3->wrec.seq_num));
+        if ((s3 = OPENSSL_malloc(sizeof *s3)) == NULL) goto err;
+                memset(s3, 0, sizeof *s3);
+        memset(s3->rrec.seq_num, 0, sizeof(s3->rrec.seq_num));
+        memset(s3->wrec.seq_num, 0, sizeof(s3->wrec.seq_num));
 
-        s->s3=s3;
+        s->s3 = s3;
 
 #ifndef OPENSSL_NO_SRP
         SSL_SRP_CTX_init(s);
 #endif
         s->method->ssl_clear(s);
-        return(1);
+        return (1);
 err:
-        return(0);
-        }
+        return (0);
+}
 
-void ssl3_free(SSL *s)
-        {
-        if(s == NULL)
-            return;
+void
+ssl3_free(SSL *s)
+{
+        if (s == NULL)
+                return;
 
 #ifdef TLSEXT_TYPE_opaque_prf_input
         if (s->s3->client_opaque_prf_input != NULL)
@@ -2986,22 +2992,24 @@ void ssl3_free(SSL *s)
 #endif
 
         if (s->s3->tmp.ca_names != NULL)
-                sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free);
+                sk_X509_NAME_pop_free(s->s3->tmp.ca_names, X509_NAME_free);
         if (s->s3->handshake_buffer) {
                 BIO_free(s->s3->handshake_buffer);
         }
-        if (s->s3->handshake_dgst) ssl3_free_digest_list(s);
+        if (s->s3->handshake_dgst)
+                ssl3_free_digest_list(s);
 #ifndef OPENSSL_NO_SRP
         SSL_SRP_CTX_free(s);
 #endif
-        OPENSSL_cleanse(s->s3,sizeof *s->s3);
+        OPENSSL_cleanse(s->s3, sizeof *s->s3);
         OPENSSL_free(s->s3);
-        s->s3=NULL;
-        }
+        s->s3 = NULL;
+}
 
-void ssl3_clear(SSL *s)
-        {
-        unsigned char *rp,*wp;
+void
+ssl3_clear(SSL *s)
+{
+        unsigned char *rp, *wp;
         size_t rlen, wlen;
         int init_extra;
 
@@ -3016,26 +3024,23 @@ void ssl3_clear(SSL *s)
 
         ssl3_cleanup_key_block(s);
         if (s->s3->tmp.ca_names != NULL)
-                sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free);
+                sk_X509_NAME_pop_free(s->s3->tmp.ca_names, X509_NAME_free);
 
-        if (s->s3->rrec.comp != NULL)
-                {
+        if (s->s3->rrec.comp != NULL) {
                 OPENSSL_free(s->s3->rrec.comp);
-                s->s3->rrec.comp=NULL;
-                }
+                s->s3->rrec.comp = NULL;
+        }
 #ifndef OPENSSL_NO_DH
-        if (s->s3->tmp.dh != NULL)
-                {
+        if (s->s3->tmp.dh != NULL) {
                 DH_free(s->s3->tmp.dh);
                 s->s3->tmp.dh = NULL;
-                }
+        }
 #endif
 #ifndef OPENSSL_NO_ECDH
-        if (s->s3->tmp.ecdh != NULL)
-                {
+        if (s->s3->tmp.ecdh != NULL) {
                 EC_KEY_free(s->s3->tmp.ecdh);
                 s->s3->tmp.ecdh = NULL;
-                }
+        }
 #endif
 #ifndef OPENSSL_NO_TLSEXT
 #ifndef OPENSSL_NO_EC
@@ -3046,7 +3051,7 @@ void ssl3_clear(SSL *s)
         rp = s->s3->rbuf.buf;
         wp = s->s3->wbuf.buf;
         rlen = s->s3->rbuf.len;
-        wlen = s->s3->wbuf.len;
+        wlen = s->s3->wbuf.len;
         init_extra = s->s3->init_extra;
         if (s->s3->handshake_buffer) {
                 BIO_free(s->s3->handshake_buffer);
@@ -3054,104 +3059,100 @@ void ssl3_clear(SSL *s)
         }
         if (s->s3->handshake_dgst) {
                 ssl3_free_digest_list(s);
-        }       
-        memset(s->s3,0,sizeof *s->s3);
+        }
+        memset(s->s3, 0, sizeof *s->s3);
         s->s3->rbuf.buf = rp;
         s->s3->wbuf.buf = wp;
         s->s3->rbuf.len = rlen;
-        s->s3->wbuf.len = wlen;
+        s->s3->wbuf.len = wlen;
         s->s3->init_extra = init_extra;
 
         ssl_free_wbio_buffer(s);
 
-        s->packet_length=0;
-        s->s3->renegotiate=0;
-        s->s3->total_renegotiations=0;
-        s->s3->num_renegotiations=0;
-        s->s3->in_read_app_data=0;
-        s->version=SSL3_VERSION;
+        s->packet_length = 0;
+        s->s3->renegotiate = 0;
+        s->s3->total_renegotiations = 0;
+        s->s3->num_renegotiations = 0;
+        s->s3->in_read_app_data = 0;
+        s->version = SSL3_VERSION;
 
 #if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
-        if (s->next_proto_negotiated)
-                {
+        if (s->next_proto_negotiated) {
                 OPENSSL_free(s->next_proto_negotiated);
                 s->next_proto_negotiated = NULL;
                 s->next_proto_negotiated_len = 0;
-                }
-#endif
         }
+#endif
+}
 
 #ifndef OPENSSL_NO_SRP
-static char * srp_password_from_info_cb(SSL *s, void *arg)
-        {
-        return BUF_strdup(s->srp_ctx.info) ;
-        }
+static char *
+srp_password_from_info_cb(SSL *s, void *arg)
+{
+        return BUF_strdup(s->srp_ctx.info);
+}
 #endif
 
-long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
-        {
-        int ret=0;
+long
+ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
+{
+        int ret = 0;
 
 #if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_RSA)
         if (
 #ifndef OPENSSL_NO_RSA
-            cmd == SSL_CTRL_SET_TMP_RSA ||
-            cmd == SSL_CTRL_SET_TMP_RSA_CB ||
+        cmd == SSL_CTRL_SET_TMP_RSA ||
+        cmd == SSL_CTRL_SET_TMP_RSA_CB ||
 #endif
 #ifndef OPENSSL_NO_DSA
-            cmd == SSL_CTRL_SET_TMP_DH ||
-            cmd == SSL_CTRL_SET_TMP_DH_CB ||
+        cmd == SSL_CTRL_SET_TMP_DH ||
+        cmd == SSL_CTRL_SET_TMP_DH_CB ||
 #endif
-                0)
-                {
-                if (!ssl_cert_inst(&s->cert))
-                        {
+        0) {
+                if (!ssl_cert_inst(&s->cert)) {
                         SSLerr(SSL_F_SSL3_CTRL, ERR_R_MALLOC_FAILURE);
-                        return(0);
-                        }
+                        return (0);
                 }
+        }
 #endif
 
-        switch (cmd)
-                {
+        switch (cmd) {
         case SSL_CTRL_GET_SESSION_REUSED:
-                ret=s->hit;
+                ret = s->hit;
                 break;
         case SSL_CTRL_GET_CLIENT_CERT_REQUEST:
                 break;
         case SSL_CTRL_GET_NUM_RENEGOTIATIONS:
-                ret=s->s3->num_renegotiations;
+                ret = s->s3->num_renegotiations;
                 break;
         case SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS:
-                ret=s->s3->num_renegotiations;
-                s->s3->num_renegotiations=0;
+                ret = s->s3->num_renegotiations;
+                s->s3->num_renegotiations = 0;
                 break;
         case SSL_CTRL_GET_TOTAL_RENEGOTIATIONS:
-                ret=s->s3->total_renegotiations;
+                ret = s->s3->total_renegotiations;
                 break;
         case SSL_CTRL_GET_FLAGS:
-                ret=(int)(s->s3->flags);
+                ret = (int)(s->s3->flags);
                 break;
 #ifndef OPENSSL_NO_RSA
         case SSL_CTRL_NEED_TMP_RSA:
                 if ((s->cert != NULL) && (s->cert->rsa_tmp == NULL) &&
-                    ((s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL) ||
-                     (EVP_PKEY_size(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey) > (512/8))))
+                   ((s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL) ||
+                   (EVP_PKEY_size(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey) > (512 / 8))))
                         ret = 1;
                 break;
         case SSL_CTRL_SET_TMP_RSA:
                 {
                         RSA *rsa = (RSA *)parg;
-                        if (rsa == NULL)
-                                {
+                        if (rsa == NULL) {
                                 SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER);
-                                return(ret);
-                                }
-                        if ((rsa = RSAPrivateKey_dup(rsa)) == NULL)
-                                {
+                                return (ret);
+                        }
+                        if ((rsa = RSAPrivateKey_dup(rsa)) == NULL) {
                                 SSLerr(SSL_F_SSL3_CTRL, ERR_R_RSA_LIB);
-                                return(ret);
-                                }
+                                return (ret);
+                        }
                         if (s->cert->rsa_tmp != NULL)
                                 RSA_free(s->cert->rsa_tmp);
                         s->cert->rsa_tmp = rsa;
@@ -3160,8 +3161,8 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
                 break;
         case SSL_CTRL_SET_TMP_RSA_CB:
                 {
-                SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-                return(ret);
+                        SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                        return (ret);
                 }
                 break;
 #endif
@@ -3169,25 +3170,21 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
         case SSL_CTRL_SET_TMP_DH:
                 {
                         DH *dh = (DH *)parg;
-                        if (dh == NULL)
-                                {
+                        if (dh == NULL) {
                                 SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER);
-                                return(ret);
-                                }
-                        if ((dh = DHparams_dup(dh)) == NULL)
-                                {
+                                return (ret);
+                        }
+                        if ((dh = DHparams_dup(dh)) == NULL) {
                                 SSLerr(SSL_F_SSL3_CTRL, ERR_R_DH_LIB);
-                                return(ret);
-                                }
-                        if (!(s->options & SSL_OP_SINGLE_DH_USE))
-                                {
-                                if (!DH_generate_key(dh))
-                                        {
+                                return (ret);
+                        }
+                        if (!(s->options & SSL_OP_SINGLE_DH_USE)) {
+                                if (!DH_generate_key(dh)) {
                                         DH_free(dh);
                                         SSLerr(SSL_F_SSL3_CTRL, ERR_R_DH_LIB);
-                                        return(ret);
-                                        }
+                                        return (ret);
                                 }
+                        }
                         if (s->cert->dh_tmp != NULL)
                                 DH_free(s->cert->dh_tmp);
                         s->cert->dh_tmp = dh;
@@ -3196,79 +3193,70 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
                 break;
         case SSL_CTRL_SET_TMP_DH_CB:
                 {
-                SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-                return(ret);
+                        SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                        return (ret);
                 }
                 break;
 #endif
 #ifndef OPENSSL_NO_ECDH
         case SSL_CTRL_SET_TMP_ECDH:
                 {
-                EC_KEY *ecdh = NULL;
-                        
-                if (parg == NULL)
-                        {
-                        SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER);
-                        return(ret);
+                        EC_KEY *ecdh = NULL;
+
+                        if (parg == NULL) {
+                                SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER);
+                                return (ret);
                         }
-                if (!EC_KEY_up_ref((EC_KEY *)parg))
-                        {
-                        SSLerr(SSL_F_SSL3_CTRL,ERR_R_ECDH_LIB);
-                        return(ret);
+                        if (!EC_KEY_up_ref((EC_KEY *)parg)) {
+                                SSLerr(SSL_F_SSL3_CTRL, ERR_R_ECDH_LIB);
+                                return (ret);
                         }
-                ecdh = (EC_KEY *)parg;
-                if (!(s->options & SSL_OP_SINGLE_ECDH_USE))
-                        {
-                        if (!EC_KEY_generate_key(ecdh))
-                                {
-                                EC_KEY_free(ecdh);
-                                SSLerr(SSL_F_SSL3_CTRL,ERR_R_ECDH_LIB);
-                                return(ret);
+                        ecdh = (EC_KEY *)parg;
+                        if (!(s->options & SSL_OP_SINGLE_ECDH_USE)) {
+                                if (!EC_KEY_generate_key(ecdh)) {
+                                        EC_KEY_free(ecdh);
+                                        SSLerr(SSL_F_SSL3_CTRL, ERR_R_ECDH_LIB);
+                                        return (ret);
                                 }
                         }
-                if (s->cert->ecdh_tmp != NULL)
-                        EC_KEY_free(s->cert->ecdh_tmp);
-                s->cert->ecdh_tmp = ecdh;
-                ret = 1;
+                        if (s->cert->ecdh_tmp != NULL)
+                                EC_KEY_free(s->cert->ecdh_tmp);
+                        s->cert->ecdh_tmp = ecdh;
+                        ret = 1;
                 }
                 break;
         case SSL_CTRL_SET_TMP_ECDH_CB:
                 {
-                SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-                return(ret);
+                        SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                        return (ret);
                 }
                 break;
 #endif /* !OPENSSL_NO_ECDH */
 #ifndef OPENSSL_NO_TLSEXT
         case SSL_CTRL_SET_TLSEXT_HOSTNAME:
-                if (larg == TLSEXT_NAMETYPE_host_name)
-                        {
-                        if (s->tlsext_hostname != NULL) 
+                if (larg == TLSEXT_NAMETYPE_host_name) {
+                        if (s->tlsext_hostname != NULL)
                                 OPENSSL_free(s->tlsext_hostname);
                         s->tlsext_hostname = NULL;
 
                         ret = 1;
-                        if (parg == NULL) 
+                        if (parg == NULL)
                                 break;
-                        if (strlen((char *)parg) > TLSEXT_MAXLEN_host_name)
-                                {
+                        if (strlen((char *)parg) > TLSEXT_MAXLEN_host_name) {
                                 SSLerr(SSL_F_SSL3_CTRL, SSL_R_SSL3_EXT_INVALID_SERVERNAME);
                                 return 0;
-                                }
-                        if ((s->tlsext_hostname = BUF_strdup((char *)parg)) == NULL)
-                                {
+                        }
+                        if ((s->tlsext_hostname = BUF_strdup((char *)parg)) == NULL) {
                                 SSLerr(SSL_F_SSL3_CTRL, ERR_R_INTERNAL_ERROR);
                                 return 0;
-                                }
                         }
-                else
-                        {
+                } else {
                         SSLerr(SSL_F_SSL3_CTRL, SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE);
                         return 0;
-                        }
-                break;
+                }
+                break;
         case SSL_CTRL_SET_TLSEXT_DEBUG_ARG:
-                s->tlsext_debug_arg=parg;
+                s->tlsext_debug_arg = parg;
                 ret = 1;
                 break;
 
@@ -3276,28 +3264,26 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
         case SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT:
                 if (larg > 12288) /* actual internal limit is 2^16 for the complete hello message
                                    * (including the cert chain and everything) */
-                        {
+                {
                         SSLerr(SSL_F_SSL3_CTRL, SSL_R_OPAQUE_PRF_INPUT_TOO_LONG);
                         break;
-                        }
+                }
                 if (s->tlsext_opaque_prf_input != NULL)
                         OPENSSL_free(s->tlsext_opaque_prf_input);
                 if ((size_t)larg == 0)
                         s->tlsext_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
                 else
                         s->tlsext_opaque_prf_input = BUF_memdup(parg, (size_t)larg);
-                if (s->tlsext_opaque_prf_input != NULL)
-                        {
+                if (s->tlsext_opaque_prf_input != NULL) {
                         s->tlsext_opaque_prf_input_len = (size_t)larg;
                         ret = 1;
-                        }
-                else
+                } else
                         s->tlsext_opaque_prf_input_len = 0;
                 break;
 #endif
 
         case SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE:
-                s->tlsext_status_type=larg;
+                s->tlsext_status_type = larg;
                 ret = 1;
                 break;
 
@@ -3324,7 +3310,7 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
         case SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP:
                 *(unsigned char **)parg = s->tlsext_ocsp_resp;
                 return s->tlsext_ocsp_resplen;
-                
+
         case SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP:
                 if (s->tlsext_ocsp_resp)
                         OPENSSL_free(s->tlsext_ocsp_resp);
@@ -3357,222 +3343,204 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
 #endif /* !OPENSSL_NO_TLSEXT */
         default:
                 break;
-                }
-        return(ret);
         }
+        return (ret);
+}
 
-long ssl3_callback_ctrl(SSL *s, int cmd, void (*fp)(void))
-        {
-        int ret=0;
+long
+ssl3_callback_ctrl(SSL *s, int cmd, void (*fp)(void))
+{
+        int ret = 0;
 
 #if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_RSA)
         if (
 #ifndef OPENSSL_NO_RSA
-            cmd == SSL_CTRL_SET_TMP_RSA_CB ||
+        cmd == SSL_CTRL_SET_TMP_RSA_CB ||
 #endif
 #ifndef OPENSSL_NO_DSA
-            cmd == SSL_CTRL_SET_TMP_DH_CB ||
+        cmd == SSL_CTRL_SET_TMP_DH_CB ||
 #endif
-                0)
-                {
-                if (!ssl_cert_inst(&s->cert))
-                        {
+        0) {
+                if (!ssl_cert_inst(&s->cert)) {
                         SSLerr(SSL_F_SSL3_CALLBACK_CTRL, ERR_R_MALLOC_FAILURE);
-                        return(0);
-                        }
+                        return (0);
                 }
+        }
 #endif
 
-        switch (cmd)
-                {
+        switch (cmd) {
 #ifndef OPENSSL_NO_RSA
         case SSL_CTRL_SET_TMP_RSA_CB:
                 {
-                s->cert->rsa_tmp_cb = (RSA *(*)(SSL *, int, int))fp;
+                        s->cert->rsa_tmp_cb = (RSA *(*)(SSL *, int, int))fp;
                 }
                 break;
 #endif
 #ifndef OPENSSL_NO_DH
         case SSL_CTRL_SET_TMP_DH_CB:
                 {
-                s->cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp;
+                        s->cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp;
                 }
                 break;
 #endif
 #ifndef OPENSSL_NO_ECDH
         case SSL_CTRL_SET_TMP_ECDH_CB:
                 {
-                s->cert->ecdh_tmp_cb = (EC_KEY *(*)(SSL *, int, int))fp;
+                        s->cert->ecdh_tmp_cb = (EC_KEY *(*)(SSL *, int, int))fp;
                 }
                 break;
 #endif
 #ifndef OPENSSL_NO_TLSEXT
         case SSL_CTRL_SET_TLSEXT_DEBUG_CB:
-                s->tlsext_debug_cb=(void (*)(SSL *,int ,int,
-                                        unsigned char *, int, void *))fp;
+                s->tlsext_debug_cb = (void (*)(SSL *, int , int,
+                unsigned char *, int, void *))fp;
                 break;
 #endif
         default:
                 break;
-                }
-        return(ret);
         }
+        return (ret);
+}
 
-long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
-        {
+long
+ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
+{
         CERT *cert;
 
-        cert=ctx->cert;
+        cert = ctx->cert;
 
-        switch (cmd)
-                {
+        switch (cmd) {
 #ifndef OPENSSL_NO_RSA
         case SSL_CTRL_NEED_TMP_RSA:
-                if (    (cert->rsa_tmp == NULL) &&
-                        ((cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL) ||
-                         (EVP_PKEY_size(cert->pkeys[SSL_PKEY_RSA_ENC].privatekey) > (512/8)))
-                        )
-                        return(1);
+                if ((cert->rsa_tmp == NULL) &&
+                    ((cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL) ||
+                    (EVP_PKEY_size(cert->pkeys[SSL_PKEY_RSA_ENC].privatekey) > (512 / 8)))
+                )
+                return (1);
                 else
-                        return(0);
+                        return (0);
                 /* break; */
         case SSL_CTRL_SET_TMP_RSA:
                 {
-                RSA *rsa;
-                int i;
+                        RSA *rsa;
+                        int i;
 
-                rsa=(RSA *)parg;
-                i=1;
-                if (rsa == NULL)
-                        i=0;
-                else
-                        {
-                        if ((rsa=RSAPrivateKey_dup(rsa)) == NULL)
-                                i=0;
+                        rsa = (RSA *)parg;
+                        i = 1;
+                        if (rsa == NULL)
+                                i = 0;
+                        else {
+                                if ((rsa = RSAPrivateKey_dup(rsa)) == NULL)
+                                        i = 0;
                         }
-                if (!i)
-                        {
-                        SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_RSA_LIB);
-                        return(0);
-                        }
-                else
-                        {
-                        if (cert->rsa_tmp != NULL)
-                                RSA_free(cert->rsa_tmp);
-                        cert->rsa_tmp=rsa;
-                        return(1);
+                        if (!i) {
+                                SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_RSA_LIB);
+                                return (0);
+                        } else {
+                                if (cert->rsa_tmp != NULL)
+                                        RSA_free(cert->rsa_tmp);
+                                cert->rsa_tmp = rsa;
+                                return (1);
                         }
                 }
                 /* break; */
         case SSL_CTRL_SET_TMP_RSA_CB:
                 {
-                SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-                return(0);
+                        SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                        return (0);
                 }
                 break;
 #endif
 #ifndef OPENSSL_NO_DH
         case SSL_CTRL_SET_TMP_DH:
                 {
-                DH *new=NULL,*dh;
+                        DH *new = NULL, *dh;
 
-                dh=(DH *)parg;
-                if ((new=DHparams_dup(dh)) == NULL)
-                        {
-                        SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_DH_LIB);
-                        return 0;
-                        }
-                if (!(ctx->options & SSL_OP_SINGLE_DH_USE))
-                        {
-                        if (!DH_generate_key(new))
-                                {
-                                SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_DH_LIB);
-                                DH_free(new);
+                        dh = (DH *)parg;
+                        if ((new = DHparams_dup(dh)) == NULL) {
+                                SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_DH_LIB);
                                 return 0;
+                        }
+                        if (!(ctx->options & SSL_OP_SINGLE_DH_USE)) {
+                                if (!DH_generate_key(new)) {
+                                        SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_DH_LIB);
+                                        DH_free(new);
+                                        return 0;
                                 }
                         }
-                if (cert->dh_tmp != NULL)
-                        DH_free(cert->dh_tmp);
-                cert->dh_tmp=new;
-                return 1;
+                        if (cert->dh_tmp != NULL)
+                                DH_free(cert->dh_tmp);
+                        cert->dh_tmp = new;
+                        return 1;
                 }
                 /*break; */
         case SSL_CTRL_SET_TMP_DH_CB:
                 {
-                SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-                return(0);
+                        SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                        return (0);
                 }
                 break;
 #endif
 #ifndef OPENSSL_NO_ECDH
         case SSL_CTRL_SET_TMP_ECDH:
                 {
-                EC_KEY *ecdh = NULL;
-                        
-                if (parg == NULL)
-                        {
-                        SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_ECDH_LIB);
-                        return 0;
-                        }
-                ecdh = EC_KEY_dup((EC_KEY *)parg);
-                if (ecdh == NULL)
-                        {
-                        SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_EC_LIB);
-                        return 0;
+                        EC_KEY *ecdh = NULL;
+
+                        if (parg == NULL) {
+                                SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_ECDH_LIB);
+                                return 0;
                         }
-                if (!(ctx->options & SSL_OP_SINGLE_ECDH_USE))
-                        {
-                        if (!EC_KEY_generate_key(ecdh))
-                                {
-                                EC_KEY_free(ecdh);
-                                SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_ECDH_LIB);
+                        ecdh = EC_KEY_dup((EC_KEY *)parg);
+                        if (ecdh == NULL) {
+                                SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_EC_LIB);
                                 return 0;
+                        }
+                        if (!(ctx->options & SSL_OP_SINGLE_ECDH_USE)) {
+                                if (!EC_KEY_generate_key(ecdh)) {
+                                        EC_KEY_free(ecdh);
+                                        SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_ECDH_LIB);
+                                        return 0;
                                 }
                         }
 
-                if (cert->ecdh_tmp != NULL)
-                        {
-                        EC_KEY_free(cert->ecdh_tmp);
+                        if (cert->ecdh_tmp != NULL) {
+                                EC_KEY_free(cert->ecdh_tmp);
                         }
-                cert->ecdh_tmp = ecdh;
-                return 1;
+                        cert->ecdh_tmp = ecdh;
+                        return 1;
                 }
                 /* break; */
         case SSL_CTRL_SET_TMP_ECDH_CB:
                 {
-                SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-                return(0);
+                        SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                        return (0);
                 }
                 break;
 #endif /* !OPENSSL_NO_ECDH */
 #ifndef OPENSSL_NO_TLSEXT
         case SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG:
-                ctx->tlsext_servername_arg=parg;
+                ctx->tlsext_servername_arg = parg;
                 break;
         case SSL_CTRL_SET_TLSEXT_TICKET_KEYS:
         case SSL_CTRL_GET_TLSEXT_TICKET_KEYS:
                 {
-                unsigned char *keys = parg;
-                if (!keys)
-                        return 48;
-                if (larg != 48)
-                        {
-                        SSLerr(SSL_F_SSL3_CTX_CTRL, SSL_R_INVALID_TICKET_KEYS_LENGTH);
-                        return 0;
-                        }
-                if (cmd == SSL_CTRL_SET_TLSEXT_TICKET_KEYS)
-                        {
-                        memcpy(ctx->tlsext_tick_key_name, keys, 16);
-                        memcpy(ctx->tlsext_tick_hmac_key, keys + 16, 16);
-                        memcpy(ctx->tlsext_tick_aes_key, keys + 32, 16);
+                        unsigned char *keys = parg;
+                        if (!keys)
+                                return 48;
+                        if (larg != 48) {
+                                SSLerr(SSL_F_SSL3_CTX_CTRL, SSL_R_INVALID_TICKET_KEYS_LENGTH);
+                                return 0;
                         }
-                else
-                        {
-                        memcpy(keys, ctx->tlsext_tick_key_name, 16);
-                        memcpy(keys + 16, ctx->tlsext_tick_hmac_key, 16);
-                        memcpy(keys + 32, ctx->tlsext_tick_aes_key, 16);
+                        if (cmd == SSL_CTRL_SET_TLSEXT_TICKET_KEYS) {
+                                memcpy(ctx->tlsext_tick_key_name, keys, 16);
+                                memcpy(ctx->tlsext_tick_hmac_key, keys + 16, 16);
+                                memcpy(ctx->tlsext_tick_aes_key, keys + 32, 16);
+                        } else {
+                                memcpy(keys, ctx->tlsext_tick_key_name, 16);
+                                memcpy(keys + 16, ctx->tlsext_tick_hmac_key, 16);
+                                memcpy(keys + 32, ctx->tlsext_tick_aes_key, 16);
                         }
-                return 1;
+                        return 1;
                 }
 
 #ifdef TLSEXT_TYPE_opaque_prf_input
@@ -3582,7 +3550,7 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
 #endif
 
         case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG:
-                ctx->tlsext_status_arg=parg;
+                ctx->tlsext_status_arg = parg;
                 return 1;
                 break;
 
@@ -3594,182 +3562,182 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
                 ctx->srp_ctx.login = NULL;
                 if (parg == NULL)
                         break;
-                if (strlen((const char *)parg) > 255 || strlen((const char *)parg) < 1)
-                        {
+                if (strlen((const char *)parg) > 255 || strlen((const char *)parg) < 1) {
                         SSLerr(SSL_F_SSL3_CTX_CTRL, SSL_R_INVALID_SRP_USERNAME);
                         return 0;
-                        } 
-                if ((ctx->srp_ctx.login = BUF_strdup((char *)parg)) == NULL)
-                        {
+                }
+                if ((ctx->srp_ctx.login = BUF_strdup((char *)parg)) == NULL) {
                         SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_INTERNAL_ERROR);
                         return 0;
-                        }
+                }
                 break;
         case SSL_CTRL_SET_TLS_EXT_SRP_PASSWORD:
-                ctx->srp_ctx.SRP_give_srp_client_pwd_callback=srp_password_from_info_cb;
-                ctx->srp_ctx.info=parg;
+                ctx->srp_ctx.SRP_give_srp_client_pwd_callback = srp_password_from_info_cb;
+                ctx->srp_ctx.info = parg;
                 break;
         case SSL_CTRL_SET_SRP_ARG:
                 ctx->srp_ctx.srp_Mask|=SSL_kSRP;
-                ctx->srp_ctx.SRP_cb_arg=parg;
+                ctx->srp_ctx.SRP_cb_arg = parg;
                 break;
 
         case SSL_CTRL_SET_TLS_EXT_SRP_STRENGTH:
-                ctx->srp_ctx.strength=larg;
+                ctx->srp_ctx.strength = larg;
                 break;
 #endif
 #endif /* !OPENSSL_NO_TLSEXT */
 
-        /* A Thawte special :-) */
+                /* A Thawte special :-) */
         case SSL_CTRL_EXTRA_CHAIN_CERT:
-                if (ctx->extra_certs == NULL)
-                        {
-                        if ((ctx->extra_certs=sk_X509_new_null()) == NULL)
-                                return(0);
-                        }
+                if (ctx->extra_certs == NULL) {
+                        if ((ctx->extra_certs = sk_X509_new_null()) == NULL)
+                                return (0);
+                }
                 sk_X509_push(ctx->extra_certs,(X509 *)parg);
                 break;
 
         case SSL_CTRL_GET_EXTRA_CHAIN_CERTS:
-                *(STACK_OF(X509) **)parg =  ctx->extra_certs;
+                *(STACK_OF(X509) **)parg = ctx->extra_certs;
                 break;
 
         case SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS:
-                if (ctx->extra_certs)
-                        {
+                if (ctx->extra_certs) {
                         sk_X509_pop_free(ctx->extra_certs, X509_free);
                         ctx->extra_certs = NULL;
-                        }
+                }
                 break;
 
         default:
-                return(0);
-                }
-        return(1);
+                return (0);
         }
+        return (1);
+}
 
-long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)(void))
-        {
+long
+ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)(void))
+{
         CERT *cert;
 
-        cert=ctx->cert;
+        cert = ctx->cert;
 
-        switch (cmd)
-                {
+        switch (cmd) {
 #ifndef OPENSSL_NO_RSA
         case SSL_CTRL_SET_TMP_RSA_CB:
                 {
-                cert->rsa_tmp_cb = (RSA *(*)(SSL *, int, int))fp;
+                        cert->rsa_tmp_cb = (RSA *(*)(SSL *, int, int))fp;
                 }
                 break;
 #endif
 #ifndef OPENSSL_NO_DH
         case SSL_CTRL_SET_TMP_DH_CB:
                 {
-                cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp;
+                        cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp;
                 }
                 break;
 #endif
 #ifndef OPENSSL_NO_ECDH
         case SSL_CTRL_SET_TMP_ECDH_CB:
                 {
-                cert->ecdh_tmp_cb = (EC_KEY *(*)(SSL *, int, int))fp;
+                        cert->ecdh_tmp_cb = (EC_KEY *(*)(SSL *, int, int))fp;
                 }
                 break;
 #endif
 #ifndef OPENSSL_NO_TLSEXT
         case SSL_CTRL_SET_TLSEXT_SERVERNAME_CB:
-                ctx->tlsext_servername_callback=(int (*)(SSL *,int *,void *))fp;
+                ctx->tlsext_servername_callback = (int (*)(SSL *, int *, void *))fp;
                 break;
 
 #ifdef TLSEXT_TYPE_opaque_prf_input
         case SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT_CB:
-                ctx->tlsext_opaque_prf_input_callback = (int (*)(SSL *,void *, size_t, void *))fp;
+                ctx->tlsext_opaque_prf_input_callback = (int (*)(SSL *, void *, size_t, void *))fp;
                 break;
 #endif
 
         case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB:
-                ctx->tlsext_status_cb=(int (*)(SSL *,void *))fp;
+                ctx->tlsext_status_cb = (int (*)(SSL *, void *))fp;
                 break;
 
         case SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB:
-                ctx->tlsext_ticket_key_cb=(int (*)(SSL *,unsigned char  *,
-                                                unsigned char *,
-                                                EVP_CIPHER_CTX *,
-                                                HMAC_CTX *, int))fp;
+                ctx->tlsext_ticket_key_cb = (int (*)(SSL *, unsigned char  *,
+                    unsigned char *, EVP_CIPHER_CTX *, HMAC_CTX *, int))fp;
                 break;
 
 #ifndef OPENSSL_NO_SRP
         case SSL_CTRL_SET_SRP_VERIFY_PARAM_CB:
                 ctx->srp_ctx.srp_Mask|=SSL_kSRP;
-                ctx->srp_ctx.SRP_verify_param_callback=(int (*)(SSL *,void *))fp;
+                ctx->srp_ctx.SRP_verify_param_callback =
+                    (int (*)(SSL *, void *))fp;
                 break;
         case SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB:
                 ctx->srp_ctx.srp_Mask|=SSL_kSRP;
-                ctx->srp_ctx.TLS_ext_srp_username_callback=(int (*)(SSL *,int *,void *))fp;
+                ctx->srp_ctx.TLS_ext_srp_username_callback =
+                    (int (*)(SSL *, int *, void *))fp;
                 break;
         case SSL_CTRL_SET_SRP_GIVE_CLIENT_PWD_CB:
                 ctx->srp_ctx.srp_Mask|=SSL_kSRP;
-                ctx->srp_ctx.SRP_give_srp_client_pwd_callback=(char *(*)(SSL *,void *))fp;
+                ctx->srp_ctx.SRP_give_srp_client_pwd_callback =
+                    (char *(*)(SSL *, void *))fp;
                 break;
 #endif
 #endif
         default:
-                return(0);
-                }
-        return(1);
+                return (0);
         }
+        return (1);
+}
 
 /* This function needs to check if the ciphers required are actually
  * available */
-const SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p)
-        {
+const SSL_CIPHER
+*ssl3_get_cipher_by_char(const unsigned char *p)
+{
         SSL_CIPHER c;
         const SSL_CIPHER *cp;
         unsigned long id;
 
-        id=0x03000000L|((unsigned long)p[0]<<8L)|(unsigned long)p[1];
-        c.id=id;
+        id = 0x03000000L | ((unsigned long)p[0] << 8L) | (unsigned long)p[1];
+        c.id = id;
         cp = OBJ_bsearch_ssl_cipher_id(&c, ssl3_ciphers, SSL3_NUM_CIPHERS);
 #ifdef DEBUG_PRINT_UNKNOWN_CIPHERSUITES
-if (cp == NULL) fprintf(stderr, "Unknown cipher ID %x\n", (p[0] << 8) | p[1]);
+        if (cp == NULL)
+                fprintf(stderr, "Unknown cipher ID %x\n", (p[0] << 8) | p[1]);
 #endif
         if (cp == NULL || cp->valid == 0)
                 return NULL;
         else
                 return cp;
-        }
+}
 
-int ssl3_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p)
-        {
+int
+ssl3_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p)
+{
         long l;
 
-        if (p != NULL)
-                {
-                l=c->id;
-                if ((l & 0xff000000) != 0x03000000) return(0);
-                p[0]=((unsigned char)(l>> 8L))&0xFF;
-                p[1]=((unsigned char)(l     ))&0xFF;
-                }
-        return(2);
+        if (p != NULL) {
+                l = c->id;
+                if ((l & 0xff000000) != 0x03000000)
+                        return (0);
+                p[0] = ((unsigned char)(l >> 8L)) & 0xFF;
+                p[1] = ((unsigned char)(l)) & 0xFF;
         }
+        return (2);
+}
 
 SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
-             STACK_OF(SSL_CIPHER) *srvr)
-        {
-        SSL_CIPHER *c,*ret=NULL;
+    STACK_OF(SSL_CIPHER) *srvr)
+{
+        SSL_CIPHER *c, *ret = NULL;
         STACK_OF(SSL_CIPHER) *prio, *allow;
-        int i,ii,ok;
+        int i, ii, ok;
 #if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_EC)
         unsigned int j;
         int ec_ok, ec_nid;
         unsigned char ec_search1 = 0, ec_search2 = 0;
 #endif
         CERT *cert;
-        unsigned long alg_k,alg_a,mask_k,mask_a,emask_k,emask_a;
+        unsigned long alg_k, alg_a, mask_k, mask_a, emask_k, emask_a;
 
         /* Let's see which ciphers we can support */
-        cert=s->cert;
+        cert = s->cert;
 
 #if 0
         /* Do not set the compare functions, because this may lead to a
@@ -3783,62 +3751,55 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
 
 #ifdef CIPHER_DEBUG
         printf("Server has %d from %p:\n", sk_SSL_CIPHER_num(srvr), (void *)srvr);
-        for(i=0 ; i < sk_SSL_CIPHER_num(srvr) ; ++i)
-                {
-                c=sk_SSL_CIPHER_value(srvr,i);
-                printf("%p:%s\n",(void *)c,c->name);
-                }
+        for (i = 0; i < sk_SSL_CIPHER_num(srvr); ++i) {
+                c = sk_SSL_CIPHER_value(srvr, i);
+                printf("%p:%s\n",(void *)c, c->name);
+        }
         printf("Client sent %d from %p:\n", sk_SSL_CIPHER_num(clnt), (void *)clnt);
-        for(i=0 ; i < sk_SSL_CIPHER_num(clnt) ; ++i)
-            {
-            c=sk_SSL_CIPHER_value(clnt,i);
-            printf("%p:%s\n",(void *)c,c->name);
-            }
+        for (i = 0; i < sk_SSL_CIPHER_num(clnt); ++i) {
+                c = sk_SSL_CIPHER_value(clnt, i);
+                printf("%p:%s\n",(void *)c, c->name);
+        }
 #endif
 
-        if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE)
-                {
+        if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) {
                 prio = srvr;
                 allow = clnt;
-                }
-        else
-                {
+        } else {
                 prio = clnt;
                 allow = srvr;
-                }
+        }
 
-        for (i=0; i<sk_SSL_CIPHER_num(prio); i++)
-                {
-                c=sk_SSL_CIPHER_value(prio,i);
+        for (i = 0; i < sk_SSL_CIPHER_num(prio); i++) {
+                c = sk_SSL_CIPHER_value(prio, i);
 
                 /* Skip TLS v1.2 only ciphersuites if lower than v1.2 */
-                if ((c->algorithm_ssl & SSL_TLSV1_2) && 
-                        (TLS1_get_version(s) < TLS1_2_VERSION))
+                if ((c->algorithm_ssl & SSL_TLSV1_2) &&
+                    (TLS1_get_version(s) < TLS1_2_VERSION))
                         continue;
 
-                ssl_set_cert_masks(cert,c);
+                ssl_set_cert_masks(cert, c);
                 mask_k = cert->mask_k;
                 mask_a = cert->mask_a;
                 emask_k = cert->export_mask_k;
                 emask_a = cert->export_mask_a;
 #ifndef OPENSSL_NO_SRP
-                mask_k=cert->mask_k | s->srp_ctx.srp_Mask;
-                emask_k=cert->export_mask_k | s->srp_ctx.srp_Mask;
+                mask_k = cert->mask_k | s->srp_ctx.srp_Mask;
+                emask_k = cert->export_mask_k | s->srp_ctx.srp_Mask;
 #endif
-                        
+
 #ifdef KSSL_DEBUG
 /*              printf("ssl3_choose_cipher %d alg= %lx\n", i,c->algorithms);*/
 #endif    /* KSSL_DEBUG */
 
-                alg_k=c->algorithm_mkey;
-                alg_a=c->algorithm_auth;
+                alg_k = c->algorithm_mkey;
+                alg_a = c->algorithm_auth;
 
 #ifndef OPENSSL_NO_KRB5
-                if (alg_k & SSL_kKRB5)
-                        {
-                        if ( !kssl_keytab_is_available(s->kssl_ctx) )
-                            continue;
-                        }
+                if (alg_k & SSL_kKRB5) {
+                        if (!kssl_keytab_is_available(s->kssl_ctx) )
+                                continue;
+                }
 #endif /* OPENSSL_NO_KRB5 */
 #ifndef OPENSSL_NO_PSK
                 /* with PSK there must be server callback set */
@@ -3846,449 +3807,405 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
                         continue;
 #endif /* OPENSSL_NO_PSK */
 
-                if (SSL_C_IS_EXPORT(c))
-                        {
+                if (SSL_C_IS_EXPORT(c)) {
                         ok = (alg_k & emask_k) && (alg_a & emask_a);
 #ifdef CIPHER_DEBUG
-                        printf("%d:[%08lX:%08lX:%08lX:%08lX]%p:%s (export)\n",ok,alg_k,alg_a,emask_k,emask_a,
-                               (void *)c,c->name);
+                        printf("%d:[%08lX:%08lX:%08lX:%08lX]%p:%s (export)\n", ok, alg_k, alg_a, emask_k, emask_a,
+                        (void *)c, c->name);
 #endif
-                        }
-                else
-                        {
+                } else {
                         ok = (alg_k & mask_k) && (alg_a & mask_a);
 #ifdef CIPHER_DEBUG
-                        printf("%d:[%08lX:%08lX:%08lX:%08lX]%p:%s\n",ok,alg_k,alg_a,mask_k,mask_a,(void *)c,
-                               c->name);
+                        printf("%d:[%08lX:%08lX:%08lX:%08lX]%p:%s\n", ok, alg_k, alg_a, mask_k, mask_a,(void *)c,
+                        c->name);
 #endif
-                        }
+                }
 
 #ifndef OPENSSL_NO_TLSEXT
 #ifndef OPENSSL_NO_EC
                 if (
-                        /* if we are considering an ECC cipher suite that uses our certificate */
-                        (alg_a & SSL_aECDSA || alg_a & SSL_aECDH)
-                        /* and we have an ECC certificate */
-                        && (s->cert->pkeys[SSL_PKEY_ECC].x509 != NULL)
-                        /* and the client specified a Supported Point Formats extension */
-                        && ((s->session->tlsext_ecpointformatlist_length > 0) && (s->session->tlsext_ecpointformatlist != NULL))
-                        /* and our certificate's point is compressed */
-                        && (
-                                (s->cert->pkeys[SSL_PKEY_ECC].x509->cert_info != NULL)
-                                && (s->cert->pkeys[SSL_PKEY_ECC].x509->cert_info->key != NULL)
-                                && (s->cert->pkeys[SSL_PKEY_ECC].x509->cert_info->key->public_key != NULL)
-                                && (s->cert->pkeys[SSL_PKEY_ECC].x509->cert_info->key->public_key->data != NULL)
-                                && (
-                                        (*(s->cert->pkeys[SSL_PKEY_ECC].x509->cert_info->key->public_key->data) == POINT_CONVERSION_COMPRESSED)
-                                        || (*(s->cert->pkeys[SSL_PKEY_ECC].x509->cert_info->key->public_key->data) == POINT_CONVERSION_COMPRESSED + 1)
-                                        )
-                                )
+                /* if we are considering an ECC cipher suite that uses our certificate */
+                (alg_a & SSL_aECDSA || alg_a & SSL_aECDH)
+                /* and we have an ECC certificate */
+                && (s->cert->pkeys[SSL_PKEY_ECC].x509 != NULL)
+                /* and the client specified a Supported Point Formats extension */
+                && ((s->session->tlsext_ecpointformatlist_length > 0) && (s->session->tlsext_ecpointformatlist != NULL))
+                /* and our certificate's point is compressed */
+                && (
+                (s->cert->pkeys[SSL_PKEY_ECC].x509->cert_info != NULL)
+                && (s->cert->pkeys[SSL_PKEY_ECC].x509->cert_info->key != NULL)
+                && (s->cert->pkeys[SSL_PKEY_ECC].x509->cert_info->key->public_key != NULL)
+                && (s->cert->pkeys[SSL_PKEY_ECC].x509->cert_info->key->public_key->data != NULL)
+                && (
+                (*(s->cert->pkeys[SSL_PKEY_ECC].x509->cert_info->key->public_key->data) == POINT_CONVERSION_COMPRESSED)
+                || (*(s->cert->pkeys[SSL_PKEY_ECC].x509->cert_info->key->public_key->data) == POINT_CONVERSION_COMPRESSED + 1)
                 )
-                        {
+                )
+                ) {
                         ec_ok = 0;
                         /* if our certificate's curve is over a field type that the client does not support
                          * then do not allow this cipher suite to be negotiated */
                         if (
-                                (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec != NULL)
-                                && (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group != NULL)
-                                && (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group->meth != NULL)
-                                && (EC_METHOD_get_field_type(s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group->meth) == NID_X9_62_prime_field)
-                        )
-                                {
-                                for (j = 0; j < s->session->tlsext_ecpointformatlist_length; j++)
-                                        {
-                                        if (s->session->tlsext_ecpointformatlist[j] == TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime)
-                                                {
+                        (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec != NULL)
+                        && (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group != NULL)
+                        && (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group->meth != NULL)
+                        && (EC_METHOD_get_field_type(s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group->meth) == NID_X9_62_prime_field)
+                        ) {
+                                for (j = 0; j < s->session->tlsext_ecpointformatlist_length; j++) {
+                                        if (s->session->tlsext_ecpointformatlist[j] == TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime) {
                                                 ec_ok = 1;
                                                 break;
-                                                }
                                         }
                                 }
-                        else if (EC_METHOD_get_field_type(s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group->meth) == NID_X9_62_characteristic_two_field)
-                                {
-                                for (j = 0; j < s->session->tlsext_ecpointformatlist_length; j++)
-                                        {
-                                        if (s->session->tlsext_ecpointformatlist[j] == TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2)
-                                                {
+                        } else if (EC_METHOD_get_field_type(s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group->meth) == NID_X9_62_characteristic_two_field) {
+                                for (j = 0; j < s->session->tlsext_ecpointformatlist_length; j++) {
+                                        if (s->session->tlsext_ecpointformatlist[j] == TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2) {
                                                 ec_ok = 1;
                                                 break;
-                                                }
                                         }
                                 }
-                        ok = ok && ec_ok;
                         }
+                        ok = ok && ec_ok;
+                }
                 if (
-                        /* if we are considering an ECC cipher suite that uses our certificate */
-                        (alg_a & SSL_aECDSA || alg_a & SSL_aECDH)
-                        /* and we have an ECC certificate */
-                        && (s->cert->pkeys[SSL_PKEY_ECC].x509 != NULL)
-                        /* and the client specified an EllipticCurves extension */
-                        && ((s->session->tlsext_ellipticcurvelist_length > 0) && (s->session->tlsext_ellipticcurvelist != NULL))
-                )
-                        {
+                /* if we are considering an ECC cipher suite that uses our certificate */
+                (alg_a & SSL_aECDSA || alg_a & SSL_aECDH)
+                /* and we have an ECC certificate */
+                && (s->cert->pkeys[SSL_PKEY_ECC].x509 != NULL)
+                /* and the client specified an EllipticCurves extension */
+                && ((s->session->tlsext_ellipticcurvelist_length > 0) && (s->session->tlsext_ellipticcurvelist != NULL))
+                ) {
                         ec_ok = 0;
                         if (
-                                (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec != NULL)
-                                && (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group != NULL)
-                        )
-                                {
+                        (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec != NULL)
+                        && (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group != NULL)
+                        ) {
                                 ec_nid = EC_GROUP_get_curve_name(s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group);
                                 if ((ec_nid == 0)
-                                        && (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group->meth != NULL)
-                                )
-                                        {
-                                        if (EC_METHOD_get_field_type(s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group->meth) == NID_X9_62_prime_field)
-                                                {
+                                && (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group->meth != NULL)
+                                ) {
+                                        if (EC_METHOD_get_field_type(s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group->meth) == NID_X9_62_prime_field) {
                                                 ec_search1 = 0xFF;
                                                 ec_search2 = 0x01;
-                                                }
-                                        else if (EC_METHOD_get_field_type(s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group->meth) == NID_X9_62_characteristic_two_field)
-                                                {
+                                        } else if (EC_METHOD_get_field_type(s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group->meth) == NID_X9_62_characteristic_two_field) {
                                                 ec_search1 = 0xFF;
                                                 ec_search2 = 0x02;
-                                                }
                                         }
-                                else
-                                        {
+                                } else {
                                         ec_search1 = 0x00;
                                         ec_search2 = tls1_ec_nid2curve_id(ec_nid);
-                                        }
-                                if ((ec_search1 != 0) || (ec_search2 != 0))
-                                        {
-                                        for (j = 0; j < s->session->tlsext_ellipticcurvelist_length / 2; j++)
-                                                {
-                                                if ((s->session->tlsext_ellipticcurvelist[2*j] == ec_search1) && (s->session->tlsext_ellipticcurvelist[2*j+1] == ec_search2))
-                                                        {
+                                }
+                                if ((ec_search1 != 0) || (ec_search2 != 0)) {
+                                        for (j = 0; j < s->session->tlsext_ellipticcurvelist_length / 2; j++) {
+                                                if ((s->session->tlsext_ellipticcurvelist[2*j] == ec_search1) && (s->session->tlsext_ellipticcurvelist[2*j + 1] == ec_search2)) {
                                                         ec_ok = 1;
                                                         break;
-                                                        }
                                                 }
                                         }
                                 }
-                        ok = ok && ec_ok;
                         }
+                        ok = ok && ec_ok;
+                }
                 if (
-                        /* if we are considering an ECC cipher suite that uses an ephemeral EC key */
-                        (alg_k & SSL_kEECDH)
-                        /* and we have an ephemeral EC key */
-                        && (s->cert->ecdh_tmp != NULL)
-                        /* and the client specified an EllipticCurves extension */
-                        && ((s->session->tlsext_ellipticcurvelist_length > 0) && (s->session->tlsext_ellipticcurvelist != NULL))
-                )
-                        {
+                /* if we are considering an ECC cipher suite that uses an ephemeral EC key */
+                (alg_k & SSL_kEECDH)
+                /* and we have an ephemeral EC key */
+                && (s->cert->ecdh_tmp != NULL)
+                /* and the client specified an EllipticCurves extension */
+                && ((s->session->tlsext_ellipticcurvelist_length > 0) && (s->session->tlsext_ellipticcurvelist != NULL))
+                ) {
                         ec_ok = 0;
-                        if (s->cert->ecdh_tmp->group != NULL)
-                                {
+                        if (s->cert->ecdh_tmp->group != NULL) {
                                 ec_nid = EC_GROUP_get_curve_name(s->cert->ecdh_tmp->group);
                                 if ((ec_nid == 0)
-                                        && (s->cert->ecdh_tmp->group->meth != NULL)
-                                )
-                                        {
-                                        if (EC_METHOD_get_field_type(s->cert->ecdh_tmp->group->meth) == NID_X9_62_prime_field)
-                                                {
+                                && (s->cert->ecdh_tmp->group->meth != NULL)
+                                ) {
+                                        if (EC_METHOD_get_field_type(s->cert->ecdh_tmp->group->meth) == NID_X9_62_prime_field) {
                                                 ec_search1 = 0xFF;
                                                 ec_search2 = 0x01;
-                                                }
-                                        else if (EC_METHOD_get_field_type(s->cert->ecdh_tmp->group->meth) == NID_X9_62_characteristic_two_field)
-                                                {
+                                        } else if (EC_METHOD_get_field_type(s->cert->ecdh_tmp->group->meth) == NID_X9_62_characteristic_two_field) {
                                                 ec_search1 = 0xFF;
                                                 ec_search2 = 0x02;
-                                                }
                                         }
-                                else
-                                        {
+                                } else {
                                         ec_search1 = 0x00;
                                         ec_search2 = tls1_ec_nid2curve_id(ec_nid);
-                                        }
-                                if ((ec_search1 != 0) || (ec_search2 != 0))
-                                        {
-                                        for (j = 0; j < s->session->tlsext_ellipticcurvelist_length / 2; j++)
-                                                {
-                                                if ((s->session->tlsext_ellipticcurvelist[2*j] == ec_search1) && (s->session->tlsext_ellipticcurvelist[2*j+1] == ec_search2))
-                                                        {
+                                }
+                                if ((ec_search1 != 0) || (ec_search2 != 0)) {
+                                        for (j = 0; j < s->session->tlsext_ellipticcurvelist_length / 2; j++) {
+                                                if ((s->session->tlsext_ellipticcurvelist[2*j] == ec_search1) && (s->session->tlsext_ellipticcurvelist[2*j + 1] == ec_search2)) {
                                                         ec_ok = 1;
                                                         break;
-                                                        }
                                                 }
                                         }
                                 }
-                        ok = ok && ec_ok;
                         }
+                        ok = ok && ec_ok;
+                }
 #endif /* OPENSSL_NO_EC */
 #endif /* OPENSSL_NO_TLSEXT */
 
-                if (!ok) continue;
-                ii=sk_SSL_CIPHER_find(allow,c);
-                if (ii >= 0)
-                        {
+                if (!ok)
+                        continue;
+                ii = sk_SSL_CIPHER_find(allow, c);
+                if (ii >= 0) {
 #if !defined(OPENSSL_NO_EC) && !defined(OPENSSL_NO_TLSEXT)
-                        if ((alg_k & SSL_kEECDH) && (alg_a & SSL_aECDSA) && s->s3->is_probably_safari)
-                                {
-                                if (!ret) ret=sk_SSL_CIPHER_value(allow,ii);
+                        if ((alg_k & SSL_kEECDH) && (alg_a & SSL_aECDSA) && s->s3->is_probably_safari) {
+                                if (!ret)
+                                        ret = sk_SSL_CIPHER_value(allow, ii);
                                 continue;
-                                }
+                        }
 #endif
-                        ret=sk_SSL_CIPHER_value(allow,ii);
+                        ret = sk_SSL_CIPHER_value(allow, ii);
                         break;
-                        }
                 }
-        return(ret);
         }
+        return (ret);
+}
 
-int ssl3_get_req_cert_type(SSL *s, unsigned char *p)
-        {
-        int ret=0;
+int
+ssl3_get_req_cert_type(SSL *s, unsigned char *p)
+{
+        int ret = 0;
         unsigned long alg_k;
 
         alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
 
 #ifndef OPENSSL_NO_GOST
-        if (s->version >= TLS1_VERSION)
-                {
-                if (alg_k & SSL_kGOST)
-                        {
-                        p[ret++]=TLS_CT_GOST94_SIGN;
-                        p[ret++]=TLS_CT_GOST01_SIGN;
-                        return(ret);
-                        }
+        if (s->version >= TLS1_VERSION) {
+                if (alg_k & SSL_kGOST) {
+                        p[ret++] = TLS_CT_GOST94_SIGN;
+                        p[ret++] = TLS_CT_GOST01_SIGN;
+                        return (ret);
                 }
+        }
 #endif
 
 #ifndef OPENSSL_NO_DH
-        if (alg_k & (SSL_kDHr|SSL_kEDH))
-                {
+        if (alg_k & (SSL_kDHr|SSL_kEDH)) {
 #  ifndef OPENSSL_NO_RSA
-                p[ret++]=SSL3_CT_RSA_FIXED_DH;
+                p[ret++] = SSL3_CT_RSA_FIXED_DH;
 #  endif
 #  ifndef OPENSSL_NO_DSA
-                p[ret++]=SSL3_CT_DSS_FIXED_DH;
+                p[ret++] = SSL3_CT_DSS_FIXED_DH;
 #  endif
-                }
+        }
         if ((s->version == SSL3_VERSION) &&
-                (alg_k & (SSL_kEDH|SSL_kDHd|SSL_kDHr)))
-                {
+                (alg_k & (SSL_kEDH|SSL_kDHd|SSL_kDHr))) {
 #  ifndef OPENSSL_NO_RSA
-                p[ret++]=SSL3_CT_RSA_EPHEMERAL_DH;
+                p[ret++] = SSL3_CT_RSA_EPHEMERAL_DH;
 #  endif
 #  ifndef OPENSSL_NO_DSA
-                p[ret++]=SSL3_CT_DSS_EPHEMERAL_DH;
+                p[ret++] = SSL3_CT_DSS_EPHEMERAL_DH;
 #  endif
-                }
+        }
 #endif /* !OPENSSL_NO_DH */
 #ifndef OPENSSL_NO_RSA
-        p[ret++]=SSL3_CT_RSA_SIGN;
+        p[ret++] = SSL3_CT_RSA_SIGN;
 #endif
 #ifndef OPENSSL_NO_DSA
-        p[ret++]=SSL3_CT_DSS_SIGN;
+        p[ret++] = SSL3_CT_DSS_SIGN;
 #endif
 #ifndef OPENSSL_NO_ECDH
-        if ((alg_k & (SSL_kECDHr|SSL_kECDHe)) && (s->version >= TLS1_VERSION))
-                {
-                p[ret++]=TLS_CT_RSA_FIXED_ECDH;
-                p[ret++]=TLS_CT_ECDSA_FIXED_ECDH;
-                }
+        if ((alg_k & (SSL_kECDHr|SSL_kECDHe)) && (s->version >= TLS1_VERSION)) {
+                p[ret++] = TLS_CT_RSA_FIXED_ECDH;
+                p[ret++] = TLS_CT_ECDSA_FIXED_ECDH;
+        }
 #endif
 
 #ifndef OPENSSL_NO_ECDSA
         /* ECDSA certs can be used with RSA cipher suites as well 
          * so we don't need to check for SSL_kECDH or SSL_kEECDH
          */
-        if (s->version >= TLS1_VERSION)
-                {
-                p[ret++]=TLS_CT_ECDSA_SIGN;
-                }
-#endif  
-        return(ret);
+        if (s->version >= TLS1_VERSION) {
+                p[ret++] = TLS_CT_ECDSA_SIGN;
         }
+#endif  
+        return (ret);
+}
 
-int ssl3_shutdown(SSL *s)
-        {
+int
+ssl3_shutdown(SSL *s)
+{
         int ret;
 
         /* Don't do anything much if we have not done the handshake or
          * we don't want to send messages :-) */
-        if ((s->quiet_shutdown) || (s->state == SSL_ST_BEFORE))
-                {
-                s->shutdown=(SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
-                return(1);
-                }
+        if ((s->quiet_shutdown) || (s->state == SSL_ST_BEFORE)) {
+                s->shutdown = (SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
+                return (1);
+        }
 
-        if (!(s->shutdown & SSL_SENT_SHUTDOWN))
-                {
+        if (!(s->shutdown & SSL_SENT_SHUTDOWN)) {
                 s->shutdown|=SSL_SENT_SHUTDOWN;
 #if 1
-                ssl3_send_alert(s,SSL3_AL_WARNING,SSL_AD_CLOSE_NOTIFY);
+                ssl3_send_alert(s, SSL3_AL_WARNING, SSL_AD_CLOSE_NOTIFY);
 #endif
                 /* our shutdown alert has been sent now, and if it still needs
                  * to be written, s->s3->alert_dispatch will be true */
-                if (s->s3->alert_dispatch)
-                        return(-1);     /* return WANT_WRITE */
-                }
-        else if (s->s3->alert_dispatch)
-                {
+                if (s->s3->alert_dispatch)
+                        return(-1);     /* return WANT_WRITE */
+        } else if (s->s3->alert_dispatch) {
                 /* resend it if not sent */
 #if 1
-                ret=s->method->ssl_dispatch_alert(s);
-                if(ret == -1)
-                        {
+                ret = s->method->ssl_dispatch_alert(s);
+                if (ret == -1) {
                         /* we only get to return -1 here the 2nd/Nth
                          * invocation, we must  have already signalled
                          * return 0 upon a previous invoation,
                          * return WANT_WRITE */
-                        return(ret);
-                        }
-#endif
+                        return (ret);
                 }
-        else if (!(s->shutdown & SSL_RECEIVED_SHUTDOWN))
-                {
+#endif
+        } else if (!(s->shutdown & SSL_RECEIVED_SHUTDOWN)) {
                 /* If we are waiting for a close from our peer, we are closed */
-                s->method->ssl_read_bytes(s,0,NULL,0,0);
-                if(!(s->shutdown & SSL_RECEIVED_SHUTDOWN))
-                        {
+                s->method->ssl_read_bytes(s, 0, NULL, 0, 0);
+                if (!(s->shutdown & SSL_RECEIVED_SHUTDOWN)) {
                         return(-1);     /* return WANT_READ */
-                        }
                 }
+        }
 
         if ((s->shutdown == (SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN)) &&
-                !s->s3->alert_dispatch)
-                return(1);
+            !s->s3->alert_dispatch)
+                return (1);
         else
-                return(0);
-        }
+                return (0);
+}
 
-int ssl3_write(SSL *s, const void *buf, int len)
-        {
-        int ret,n;
+int
+ssl3_write(SSL *s, const void *buf, int len)
+{
+        int ret, n;
 
 #if 0
-        if (s->shutdown & SSL_SEND_SHUTDOWN)
-                {
-                s->rwstate=SSL_NOTHING;
-                return(0);
-                }
+        if (s->shutdown & SSL_SEND_SHUTDOWN) {
+                s->rwstate = SSL_NOTHING;
+                return (0);
+        }
 #endif
         errno = 0;
-        if (s->s3->renegotiate) ssl3_renegotiate_check(s);
+        if (s->s3->renegotiate)
+                ssl3_renegotiate_check(s);
 
         /* This is an experimental flag that sends the
          * last handshake message in the same packet as the first
          * use data - used to see if it helps the TCP protocol during
          * session-id reuse */
         /* The second test is because the buffer may have been removed */
-        if ((s->s3->flags & SSL3_FLAGS_POP_BUFFER) && (s->wbio == s->bbio))
-                {
+        if ((s->s3->flags & SSL3_FLAGS_POP_BUFFER) && (s->wbio == s->bbio)) {
                 /* First time through, we write into the buffer */
-                if (s->s3->delay_buf_pop_ret == 0)
-                        {
-                        ret=ssl3_write_bytes(s,SSL3_RT_APPLICATION_DATA,
-                                             buf,len);
-                        if (ret <= 0) return(ret);
+                if (s->s3->delay_buf_pop_ret == 0) {
+                        ret = ssl3_write_bytes(s, SSL3_RT_APPLICATION_DATA,
+                        buf, len);
+                        if (ret <= 0)
+                                return (ret);
 
-                        s->s3->delay_buf_pop_ret=ret;
-                        }
+                        s->s3->delay_buf_pop_ret = ret;
+                }
 
-                s->rwstate=SSL_WRITING;
-                n=BIO_flush(s->wbio);
-                if (n <= 0) return(n);
-                s->rwstate=SSL_NOTHING;
+                s->rwstate = SSL_WRITING;
+                n = BIO_flush(s->wbio);
+                if (n <= 0)
+                        return (n);
+                s->rwstate = SSL_NOTHING;
 
                 /* We have flushed the buffer, so remove it */
                 ssl_free_wbio_buffer(s);
                 s->s3->flags&= ~SSL3_FLAGS_POP_BUFFER;
 
-                ret=s->s3->delay_buf_pop_ret;
-                s->s3->delay_buf_pop_ret=0;
-                }
-        else
-                {
-                ret=s->method->ssl_write_bytes(s,SSL3_RT_APPLICATION_DATA,
-                        buf,len);
-                if (ret <= 0) return(ret);
-                }
-
-        return(ret);
+                ret = s->s3->delay_buf_pop_ret;
+                s->s3->delay_buf_pop_ret = 0;
+        } else {
+                ret = s->method->ssl_write_bytes(s, SSL3_RT_APPLICATION_DATA,
+                buf, len);
+                if (ret <= 0)
+                        return (ret);
         }
 
-static int ssl3_read_internal(SSL *s, void *buf, int len, int peek)
-        {
+        return (ret);
+}
+
+static int
+ssl3_read_internal(SSL *s, void *buf, int len, int peek)
+{
         int ret;
-        
+
         errno = 0;
-        if (s->s3->renegotiate) ssl3_renegotiate_check(s);
-        s->s3->in_read_app_data=1;
-        ret=s->method->ssl_read_bytes(s,SSL3_RT_APPLICATION_DATA,buf,len,peek);
-        if ((ret == -1) && (s->s3->in_read_app_data == 2))
-                {
+        if (s->s3->renegotiate)
+                ssl3_renegotiate_check(s);
+        s->s3->in_read_app_data = 1;
+        ret = s->method->ssl_read_bytes(s, SSL3_RT_APPLICATION_DATA, buf, len, peek);
+        if ((ret == -1) && (s->s3->in_read_app_data == 2)) {
                 /* ssl3_read_bytes decided to call s->handshake_func, which
                  * called ssl3_read_bytes to read handshake data.
                  * However, ssl3_read_bytes actually found application data
                  * and thinks that application data makes sense here; so disable
                  * handshake processing and try to read application data again. */
                 s->in_handshake++;
-                ret=s->method->ssl_read_bytes(s,SSL3_RT_APPLICATION_DATA,buf,len,peek);
+                ret = s->method->ssl_read_bytes(s, SSL3_RT_APPLICATION_DATA, buf, len, peek);
                 s->in_handshake--;
-                }
-        else
-                s->s3->in_read_app_data=0;
+        } else
+                s->s3->in_read_app_data = 0;
 
-        return(ret);
-        }
+        return (ret);
+}
 
-int ssl3_read(SSL *s, void *buf, int len)
-        {
+int
+ssl3_read(SSL *s, void *buf, int len)
+{
         return ssl3_read_internal(s, buf, len, 0);
-        }
+}
 
-int ssl3_peek(SSL *s, void *buf, int len)
-        {
+int
+ssl3_peek(SSL *s, void *buf, int len)
+{
         return ssl3_read_internal(s, buf, len, 1);
-        }
+}
 
-int ssl3_renegotiate(SSL *s)
-        {
+int
+ssl3_renegotiate(SSL *s)
+{
         if (s->handshake_func == NULL)
-                return(1);
+                return (1);
 
         if (s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS)
-                return(0);
+                return (0);
 
-        s->s3->renegotiate=1;
-        return(1);
-        }
+        s->s3->renegotiate = 1;
+        return (1);
+}
 
-int ssl3_renegotiate_check(SSL *s)
-        {
-        int ret=0;
+int
+ssl3_renegotiate_check(SSL *s)
+{
+        int ret = 0;
 
-        if (s->s3->renegotiate)
-                {
-                if (    (s->s3->rbuf.left == 0) &&
-                        (s->s3->wbuf.left == 0) &&
-                        !SSL_in_init(s))
-                        {
+        if (s->s3->renegotiate) {
+                if ((s->s3->rbuf.left == 0) && (s->s3->wbuf.left == 0) &&
+                    !SSL_in_init(s)) {
 /*
 if we are the server, and we have sent a 'RENEGOTIATE' message, we
 need to go to SSL_ST_ACCEPT.
 */
                         /* SSL_ST_ACCEPT */
-                        s->state=SSL_ST_RENEGOTIATE;
-                        s->s3->renegotiate=0;
+                        s->state = SSL_ST_RENEGOTIATE;
+                        s->s3->renegotiate = 0;
                         s->s3->num_renegotiations++;
                         s->s3->total_renegotiations++;
-                        ret=1;
-                        }
+                        ret = 1;
                 }
-        return(ret);
         }
+        return (ret);
+}
 /* If we are using TLS v1.2 or later and default SHA1+MD5 algorithms switch
  * to new SHA256 PRF and handshake macs
  */
-long ssl_get_algorithm2(SSL *s)
-        {
+long
+ssl_get_algorithm2(SSL *s)
+{
         long alg2 = s->s3->tmp.new_cipher->algorithm2;
         if (s->method->version == TLS1_2_VERSION &&
-            alg2 == (SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF))
-                return SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256;
+                alg2 == (SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF))
+        return SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256;
         return alg2;
-        }
-                
+}
diff --git a/src/lib/libssl/s3_pkt.c b/src/lib/libssl/s3_pkt.c
index 6b55d21a3e..6c677d9f6b 100644
--- a/src/lib/libssl/s3_pkt.c
+++ b/src/lib/libssl/s3_pkt.c
@@ -118,11 +118,12 @@
 #include <openssl/rand.h>
 
 static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
-                         unsigned int len, int create_empty_fragment);
+    unsigned int len, int create_empty_fragment);
 static int ssl3_get_record(SSL *s);
 
-int ssl3_read_n(SSL *s, int n, int max, int extend)
-        {
+int
+ssl3_read_n(SSL *s, int n, int max, int extend)
+{
         /* If extend == 0, obtain new n-byte packet; if extend == 1, increase
          * packet by another n bytes.
          * The packet will be in the sub-array of s->s3->rbuf.buf specified
@@ -130,37 +131,35 @@ int ssl3_read_n(SSL *s, int n, int max, int extend)
          * (If s->read_ahead is set, 'max' bytes may be stored in rbuf
          * [plus s->packet_length bytes if extend == 1].)
          */
-        int i,len,left;
-        long align=0;
+        int i, len, left;
+        long align = 0;
         unsigned char *pkt;
         SSL3_BUFFER *rb;
 
-        if (n <= 0) return n;
+        if (n <= 0)
+                return n;
 
-        rb    = &(s->s3->rbuf);
+        rb = &(s->s3->rbuf);
         if (rb->buf == NULL)
                 if (!ssl3_setup_read_buffer(s))
                         return -1;
 
-        left  = rb->left;
+        left = rb->left;
 #if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD!=0
         align = (long)rb->buf + SSL3_RT_HEADER_LENGTH;
-        align = (-align)&(SSL3_ALIGN_PAYLOAD-1);
+        align = (-align)&(SSL3_ALIGN_PAYLOAD - 1);
 #endif
 
-        if (!extend)
-                {
+        if (!extend) {
                 /* start with empty packet ... */
                 if (left == 0)
                         rb->offset = align;
-                else if (align != 0 && left >= SSL3_RT_HEADER_LENGTH)
-                        {
+                else if (align != 0 && left >= SSL3_RT_HEADER_LENGTH) {
                         /* check if next packet length is large
                          * enough to justify payload alignment... */
                         pkt = rb->buf + rb->offset;
                         if (pkt[0] == SSL3_RT_APPLICATION_DATA
-                            && (pkt[3]<<8|pkt[4]) >= 128)
-                                {
+                                && (pkt[3]<<8|pkt[4]) >= 128) {
                                 /* Note that even if packet is corrupted
                                  * and its length field is insane, we can
                                  * only be led to wrong decision about
@@ -168,109 +167,100 @@ int ssl3_read_n(SSL *s, int n, int max, int extend)
                                  * Header values has no effect on memmove
                                  * arguments and therefore no buffer
                                  * overrun can be triggered. */
-                                memmove (rb->buf+align,pkt,left);
+                                memmove (rb->buf + align, pkt, left);
                                 rb->offset = align;
-                                }
                         }
+                }
                 s->packet = rb->buf + rb->offset;
                 s->packet_length = 0;
                 /* ... now we can act as if 'extend' was set */
-                }
+        }
 
         /* For DTLS/UDP reads should not span multiple packets
          * because the read operation returns the whole packet
          * at once (as long as it fits into the buffer). */
-        if (SSL_version(s) == DTLS1_VERSION || SSL_version(s) == DTLS1_BAD_VER)
-                {
+        if (SSL_version(s) == DTLS1_VERSION || SSL_version(s) == DTLS1_BAD_VER) {
                 if (left > 0 && n > left)
                         n = left;
-                }
+        }
 
         /* if there is enough in the buffer from a previous read, take some */
-        if (left >= n)
-                {
-                s->packet_length+=n;
-                rb->left=left-n;
-                rb->offset+=n;
-                return(n);
-                }
+        if (left >= n) {
+                s->packet_length += n;
+                rb->left = left - n;
+                rb->offset += n;
+                return (n);
+        }
 
         /* else we need to read more data */
 
         len = s->packet_length;
-        pkt = rb->buf+align;
+        pkt = rb->buf + align;
         /* Move any available bytes to front of buffer:
          * 'len' bytes already pointed to by 'packet',
          * 'left' extra ones at the end */
         if (s->packet != pkt) /* len > 0 */
-                {
-                memmove(pkt, s->packet, len+left);
+        {
+                memmove(pkt, s->packet, len + left);
                 s->packet = pkt;
                 rb->offset = len + align;
-                }
+        }
 
         if (n > (int)(rb->len - rb->offset)) /* does not happen */
-                {
-                SSLerr(SSL_F_SSL3_READ_N,ERR_R_INTERNAL_ERROR);
+        {
+                SSLerr(SSL_F_SSL3_READ_N, ERR_R_INTERNAL_ERROR);
                 return -1;
-                }
+        }
 
         if (!s->read_ahead)
                 /* ignore max parameter */
                 max = n;
-        else
-                {
+        else {
                 if (max < n)
                         max = n;
                 if (max > (int)(rb->len - rb->offset))
                         max = rb->len - rb->offset;
-                }
+        }
 
-        while (left < n)
-                {
+        while (left < n) {
                 /* Now we have len+left bytes at the front of s->s3->rbuf.buf
                  * and need to read in more until we have len+n (up to
                  * len+max if possible) */
 
                 errno = 0;
-                if (s->rbio != NULL)
-                        {
-                        s->rwstate=SSL_READING;
-                        i=BIO_read(s->rbio,pkt+len+left, max-left);
-                        }
-                else
-                        {
-                        SSLerr(SSL_F_SSL3_READ_N,SSL_R_READ_BIO_NOT_SET);
+                if (s->rbio != NULL) {
+                        s->rwstate = SSL_READING;
+                        i = BIO_read(s->rbio, pkt + len + left, max - left);
+                } else {
+                        SSLerr(SSL_F_SSL3_READ_N, SSL_R_READ_BIO_NOT_SET);
                         i = -1;
-                        }
+                }
 
-                if (i <= 0)
-                        {
+                if (i <= 0) {
                         rb->left = left;
                         if (s->mode & SSL_MODE_RELEASE_BUFFERS &&
-                            SSL_version(s) != DTLS1_VERSION && SSL_version(s) != DTLS1_BAD_VER)
-                                if (len+left == 0)
-                                        ssl3_release_read_buffer(s);
-                        return(i);
-                        }
-                left+=i;
+                                SSL_version(s) != DTLS1_VERSION && SSL_version(s) != DTLS1_BAD_VER)
+                        if (len + left == 0)
+                                ssl3_release_read_buffer(s);
+                        return (i);
+                }
+                left += i;
                 /* reads should *never* span multiple packets for DTLS because
                  * the underlying transport protocol is message oriented as opposed
                  * to byte oriented as in the TLS case. */
-                if (SSL_version(s) == DTLS1_VERSION || SSL_version(s) == DTLS1_BAD_VER)
-                        {
+                if (SSL_version(s) == DTLS1_VERSION || SSL_version(s) == DTLS1_BAD_VER) {
                         if (n > left)
                                 n = left; /* makes the while condition false */
-                        }
                 }
+        }
 
         /* done reading, now the book-keeping */
         rb->offset += n;
         rb->left = left - n;
         s->packet_length += n;
-        s->rwstate=SSL_NOTHING;
-        return(n);
-        }
+        s->rwstate = SSL_NOTHING;
+        return (n);
+}
 
 /* Call this to get a new input record.
  * It will return <= 0 if more data is needed, normally due to an error
@@ -281,10 +271,11 @@ int ssl3_read_n(SSL *s, int n, int max, int extend)
  * ssl->s3->rrec.length, - number of bytes
  */
 /* used only by ssl3_read_bytes */
-static int ssl3_get_record(SSL *s)
-        {
-        int ssl_major,ssl_minor,al;
-        int enc_err,n,i,ret= -1;
+static int
+ssl3_get_record(SSL *s)
+{
+        int ssl_major, ssl_minor, al;
+        int enc_err, n, i, ret = -1;
         SSL3_RECORD *rr;
         SSL_SESSION *sess;
         unsigned char *p;
@@ -293,90 +284,83 @@ static int ssl3_get_record(SSL *s)
         unsigned mac_size, orig_len;
         size_t extra;
 
-        rr= &(s->s3->rrec);
-        sess=s->session;
+        rr = &(s->s3->rrec);
+        sess = s->session;
 
         if (s->options & SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER)
-                extra=SSL3_RT_MAX_EXTRA;
+                extra = SSL3_RT_MAX_EXTRA;
         else
-                extra=0;
-        if (extra && !s->s3->init_extra)
-                {
+                extra = 0;
+        if (extra && !s->s3->init_extra) {
                 /* An application error: SLS_OP_MICROSOFT_BIG_SSLV3_BUFFER
                  * set after ssl3_setup_buffers() was done */
                 SSLerr(SSL_F_SSL3_GET_RECORD, ERR_R_INTERNAL_ERROR);
                 return -1;
-                }
+        }
 
 again:
         /* check if we have the header */
-        if (    (s->rstate != SSL_ST_READ_BODY) ||
-                (s->packet_length < SSL3_RT_HEADER_LENGTH)) 
-                {
-                n=ssl3_read_n(s, SSL3_RT_HEADER_LENGTH, s->s3->rbuf.len, 0);
+        if ((s->rstate != SSL_ST_READ_BODY) ||
+            (s->packet_length < SSL3_RT_HEADER_LENGTH)) {
+                n = ssl3_read_n(s, SSL3_RT_HEADER_LENGTH, s->s3->rbuf.len, 0);
                 if (n <= 0) return(n); /* error or non-blocking */
-                s->rstate=SSL_ST_READ_BODY;
+                        s->rstate = SSL_ST_READ_BODY;
 
-                p=s->packet;
+                p = s->packet;
 
                 /* Pull apart the header into the SSL3_RECORD */
                 rr->type= *(p++);
                 ssl_major= *(p++);
                 ssl_minor= *(p++);
-                version=(ssl_major<<8)|ssl_minor;
-                n2s(p,rr->length);
+                version = (ssl_major << 8)|ssl_minor;
+                n2s(p, rr->length);
 #if 0
-fprintf(stderr, "Record type=%d, Length=%d\n", rr->type, rr->length);
+                fprintf(stderr, "Record type=%d, Length=%d\n", rr->type, rr->length);
 #endif
 
                 /* Lets check version */
-                if (!s->first_packet)
-                        {
-                        if (version != s->version)
-                                {
-                                SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_WRONG_VERSION_NUMBER);
-                                if ((s->version & 0xFF00) == (version & 0xFF00) && !s->enc_write_ctx && !s->write_hash)
-                                        /* Send back error using their minor version number :-) */
-                                        s->version = (unsigned short)version;
-                                al=SSL_AD_PROTOCOL_VERSION;
+                if (!s->first_packet) {
+                        if (version != s->version) {
+                                SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_WRONG_VERSION_NUMBER);
+                                if ((s->version & 0xFF00) == (version & 0xFF00) && !s->enc_write_ctx && !s->write_hash)
+                                        /* Send back error using their minor version number :-) */
+                                s->version = (unsigned short)version;
+                                al = SSL_AD_PROTOCOL_VERSION;
                                 goto f_err;
-                                }
                         }
+                }
 
-                if ((version>>8) != SSL3_VERSION_MAJOR)
-                        {
-                        SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_WRONG_VERSION_NUMBER);
+                if ((version >> 8) != SSL3_VERSION_MAJOR) {
+                        SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_WRONG_VERSION_NUMBER);
                         goto err;
-                        }
+                }
 
-                if (rr->length > s->s3->rbuf.len - SSL3_RT_HEADER_LENGTH)
-                        {
-                        al=SSL_AD_RECORD_OVERFLOW;
-                        SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_PACKET_LENGTH_TOO_LONG);
+                if (rr->length > s->s3->rbuf.len - SSL3_RT_HEADER_LENGTH) {
+                        al = SSL_AD_RECORD_OVERFLOW;
+                        SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_PACKET_LENGTH_TOO_LONG);
                         goto f_err;
-                        }
+                }
 
                 /* now s->rstate == SSL_ST_READ_BODY */
-                }
+        }
 
         /* s->rstate == SSL_ST_READ_BODY, get and decode the data */
 
-        if (rr->length > s->packet_length-SSL3_RT_HEADER_LENGTH)
-                {
+        if (rr->length > s->packet_length - SSL3_RT_HEADER_LENGTH) {
                 /* now s->packet_length == SSL3_RT_HEADER_LENGTH */
-                i=rr->length;
-                n=ssl3_read_n(s,i,i,1);
+                i = rr->length;
+                n = ssl3_read_n(s, i, i, 1);
                 if (n <= 0) return(n); /* error or non-blocking io */
                 /* now n == rr->length,
                  * and s->packet_length == SSL3_RT_HEADER_LENGTH + rr->length */
-                }
+        }
 
         s->rstate=SSL_ST_READ_HEADER; /* set state for later operations */
 
         /* At this point, s->packet_length == SSL3_RT_HEADER_LNGTH + rr->length,
          * and we have that many bytes in s->packet
          */
-        rr->input= &(s->packet[SSL3_RT_HEADER_LENGTH]);
+        rr->input = &(s->packet[SSL3_RT_HEADER_LENGTH]);
 
         /* ok, we can now read from 's->packet' data into 'rr'
          * rr->input points at rr->length bytes, which
@@ -389,47 +373,43 @@ fprintf(stderr, "Record type=%d, Length=%d\n", rr->type, rr->length);
          * rr->length bytes of encrypted compressed stuff. */
 
         /* check is not needed I believe */
-        if (rr->length > SSL3_RT_MAX_ENCRYPTED_LENGTH+extra)
-                {
-                al=SSL_AD_RECORD_OVERFLOW;
-                SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_ENCRYPTED_LENGTH_TOO_LONG);
+        if (rr->length > SSL3_RT_MAX_ENCRYPTED_LENGTH + extra) {
+                al = SSL_AD_RECORD_OVERFLOW;
+                SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_ENCRYPTED_LENGTH_TOO_LONG);
                 goto f_err;
-                }
+        }
 
         /* decrypt in place in 'rr->input' */
-        rr->data=rr->input;
+        rr->data = rr->input;
 
-        enc_err = s->method->ssl3_enc->enc(s,0);
+        enc_err = s->method->ssl3_enc->enc(s, 0);
         /* enc_err is:
          *    0: (in non-constant time) if the record is publically invalid.
          *    1: if the padding is valid
          *    -1: if the padding is invalid */
-        if (enc_err == 0)
-                {
-                al=SSL_AD_DECRYPTION_FAILED;
-                SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);
+        if (enc_err == 0) {
+                al = SSL_AD_DECRYPTION_FAILED;
+                SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);
                 goto f_err;
-                }
+        }
 
 #ifdef TLS_DEBUG
-printf("dec %d\n",rr->length);
-{ unsigned int z; for (z=0; z<rr->length; z++) printf("%02X%c",rr->data[z],((z+1)%16)?' ':'\n'); }
-printf("\n");
+        printf("dec %d\n", rr->length);
+        { unsigned int z; for (z = 0; z<rr->length; z++) printf("%02X%c", rr->data[z],((z+1)%16)?' ':'\n'); }
+        printf("\n");
 #endif
 
         /* r->length is now the compressed data plus mac */
-        if ((sess != NULL) &&
-            (s->enc_read_ctx != NULL) &&
-            (EVP_MD_CTX_md(s->read_hash) != NULL))
-                {
+        if ((sess != NULL) && (s->enc_read_ctx != NULL) &&
+            (EVP_MD_CTX_md(s->read_hash) != NULL)) {
                 /* s->read_hash != NULL => mac_size != -1 */
                 unsigned char *mac = NULL;
                 unsigned char mac_tmp[EVP_MAX_MD_SIZE];
-                mac_size=EVP_MD_CTX_size(s->read_hash);
+                mac_size = EVP_MD_CTX_size(s->read_hash);
                 OPENSSL_assert(mac_size <= EVP_MAX_MD_SIZE);
 
                 /* kludge: *_cbc_remove_padding passes padding length in rr->type */
-                orig_len = rr->length+((unsigned int)rr->type>>8);
+                orig_len = rr->length + ((unsigned int)rr->type >> 8);
 
                 /* orig_len is the length of the record before any padding was
                  * removed. This is public information, as is the MAC in use,
@@ -437,17 +417,15 @@ printf("\n");
                  * amount of time if it's too short to possibly contain a MAC.
                  */
                 if (orig_len < mac_size ||
-                    /* CBC records must have a padding length byte too. */
+                        /* CBC records must have a padding length byte too. */
                     (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
-                     orig_len < mac_size+1))
-                        {
-                        al=SSL_AD_DECODE_ERROR;
-                        SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_LENGTH_TOO_SHORT);
+                    orig_len < mac_size + 1)) {
+                        al = SSL_AD_DECODE_ERROR;
+                        SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_LENGTH_TOO_SHORT);
                         goto f_err;
-                        }
+                }
 
-                if (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE)
-                        {
+                if (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE) {
                         /* We update the length so that the TLS header bytes
                          * can be constructed correctly but we need to extract
                          * the MAC in constant time from within the record,
@@ -456,60 +434,53 @@ printf("\n");
                         mac = mac_tmp;
                         ssl3_cbc_copy_mac(mac_tmp, rr, mac_size, orig_len);
                         rr->length -= mac_size;
-                        }
-                else
-                        {
+                } else {
                         /* In this case there's no padding, so |orig_len|
                          * equals |rec->length| and we checked that there's
                          * enough bytes for |mac_size| above. */
                         rr->length -= mac_size;
                         mac = &rr->data[rr->length];
-                        }
+                }
 
                 i=s->method->ssl3_enc->mac(s,md,0 /* not send */);
                 if (i < 0 || mac == NULL || CRYPTO_memcmp(md, mac, (size_t)mac_size) != 0)
                         enc_err = -1;
-                if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+extra+mac_size)
+                if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH + extra + mac_size)
                         enc_err = -1;
-                }
+        }
 
-        if (enc_err < 0)
-                {
+        if (enc_err < 0) {
                 /* A separate 'decryption_failed' alert was introduced with TLS 1.0,
                  * SSL 3.0 only has 'bad_record_mac'.  But unless a decryption
                  * failure is directly visible from the ciphertext anyway,
                  * we should not reveal which kind of error occured -- this
                  * might become visible to an attacker (e.g. via a logfile) */
-                al=SSL_AD_BAD_RECORD_MAC;
-                SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);
+                al = SSL_AD_BAD_RECORD_MAC;
+                SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);
                 goto f_err;
-                }
+        }
 
         /* r->length is now just compressed */
-        if (s->expand != NULL)
-                {
-                if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+extra)
-                        {
-                        al=SSL_AD_RECORD_OVERFLOW;
-                        SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_COMPRESSED_LENGTH_TOO_LONG);
+        if (s->expand != NULL) {
+                if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH + extra) {
+                        al = SSL_AD_RECORD_OVERFLOW;
+                        SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_COMPRESSED_LENGTH_TOO_LONG);
                         goto f_err;
-                        }
-                if (!ssl3_do_uncompress(s))
-                        {
-                        al=SSL_AD_DECOMPRESSION_FAILURE;
-                        SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_BAD_DECOMPRESSION);
+                }
+                if (!ssl3_do_uncompress(s)) {
+                        al = SSL_AD_DECOMPRESSION_FAILURE;
+                        SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_BAD_DECOMPRESSION);
                         goto f_err;
-                        }
                 }
+        }
 
-        if (rr->length > SSL3_RT_MAX_PLAIN_LENGTH+extra)
-                {
-                al=SSL_AD_RECORD_OVERFLOW;
-                SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_DATA_LENGTH_TOO_LONG);
+        if (rr->length > SSL3_RT_MAX_PLAIN_LENGTH + extra) {
+                al = SSL_AD_RECORD_OVERFLOW;
+                SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_DATA_LENGTH_TOO_LONG);
                 goto f_err;
-                }
+        }
 
-        rr->off=0;
+        rr->off = 0;
         /* So at this point the following is true
          * ssl->s3->rrec.type   is the type of record
          * ssl->s3->rrec.length == number of bytes in record
@@ -519,178 +490,171 @@ printf("\n");
          */
 
         /* we have pulled in a full packet so zero things */
-        s->packet_length=0;
+        s->packet_length = 0;
 
         /* just read a 0 length packet */
-        if (rr->length == 0) goto again;
+        if (rr->length == 0)
+                goto again;
 
 #if 0
-fprintf(stderr, "Ultimate Record type=%d, Length=%d\n", rr->type, rr->length);
+        fprintf(stderr, "Ultimate Record type=%d, Length=%d\n", rr->type, rr->length);
 #endif
 
-        return(1);
+        return (1);
 
 f_err:
-        ssl3_send_alert(s,SSL3_AL_FATAL,al);
+        ssl3_send_alert(s, SSL3_AL_FATAL, al);
 err:
-        return(ret);
-        }
+        return (ret);
+}
 
-int ssl3_do_uncompress(SSL *ssl)
-        {
+int
+ssl3_do_uncompress(SSL *ssl)
+{
 #ifndef OPENSSL_NO_COMP
         int i;
         SSL3_RECORD *rr;
 
-        rr= &(ssl->s3->rrec);
-        i=COMP_expand_block(ssl->expand,rr->comp,
-                SSL3_RT_MAX_PLAIN_LENGTH,rr->data,(int)rr->length);
+        rr = &(ssl->s3->rrec);
+        i = COMP_expand_block(ssl->expand, rr->comp,
+        SSL3_RT_MAX_PLAIN_LENGTH, rr->data,(int)rr->length);
         if (i < 0)
-                return(0);
+                return (0);
         else
-                rr->length=i;
-        rr->data=rr->comp;
+                rr->length = i;
+        rr->data = rr->comp;
 #endif
-        return(1);
-        }
+        return (1);
+}
 
-int ssl3_do_compress(SSL *ssl)
-        {
+int
+ssl3_do_compress(SSL *ssl)
+{
 #ifndef OPENSSL_NO_COMP
         int i;
         SSL3_RECORD *wr;
 
-        wr= &(ssl->s3->wrec);
-        i=COMP_compress_block(ssl->compress,wr->data,
-                SSL3_RT_MAX_COMPRESSED_LENGTH,
-                wr->input,(int)wr->length);
+        wr = &(ssl->s3->wrec);
+        i = COMP_compress_block(ssl->compress, wr->data,
+        SSL3_RT_MAX_COMPRESSED_LENGTH,
+        wr->input,(int)wr->length);
         if (i < 0)
-                return(0);
+                return (0);
         else
-                wr->length=i;
+                wr->length = i;
 
-        wr->input=wr->data;
+        wr->input = wr->data;
 #endif
-        return(1);
-        }
+        return (1);
+}
 
 /* Call this to write data in records of type 'type'
  * It will return <= 0 if not all data has been sent or non-blocking IO.
  */
-int ssl3_write_bytes(SSL *s, int type, const void *buf_, int len)
-        {
-        const unsigned char *buf=buf_;
-        unsigned int tot,n,nw;
+int
+ssl3_write_bytes(SSL *s, int type, const void *buf_, int len)
+{
+        const unsigned char *buf = buf_;
+        unsigned int tot, n, nw;
         int i;
 
-        s->rwstate=SSL_NOTHING;
-        tot=s->s3->wnum;
-        s->s3->wnum=0;
+        s->rwstate = SSL_NOTHING;
+        tot = s->s3->wnum;
+        s->s3->wnum = 0;
 
-        if (SSL_in_init(s) && !s->in_handshake)
-                {
-                i=s->handshake_func(s);
-                if (i < 0) return(i);
-                if (i == 0)
-                        {
-                        SSLerr(SSL_F_SSL3_WRITE_BYTES,SSL_R_SSL_HANDSHAKE_FAILURE);
+        if (SSL_in_init(s) && !s->in_handshake) {
+                i = s->handshake_func(s);
+                if (i < 0)
+                        return (i);
+                if (i == 0) {
+                        SSLerr(SSL_F_SSL3_WRITE_BYTES, SSL_R_SSL_HANDSHAKE_FAILURE);
                         return -1;
-                        }
                 }
+        }
 
-        n=(len-tot);
-        for (;;)
-                {
+        n = (len - tot);
+        for (;;) {
                 if (n > s->max_send_fragment)
-                        nw=s->max_send_fragment;
+                        nw = s->max_send_fragment;
                 else
-                        nw=n;
+                        nw = n;
 
-                i=do_ssl3_write(s, type, &(buf[tot]), nw, 0);
-                if (i <= 0)
-                        {
-                        s->s3->wnum=tot;
+                i = do_ssl3_write(s, type, &(buf[tot]), nw, 0);
+                if (i <= 0) {
+                        s->s3->wnum = tot;
                         return i;
-                        }
+                }
 
-                if ((i == (int)n) ||
-                        (type == SSL3_RT_APPLICATION_DATA &&
-                         (s->mode & SSL_MODE_ENABLE_PARTIAL_WRITE)))
-                        {
+                if ((i == (int)n) || (type == SSL3_RT_APPLICATION_DATA &&
+                    (s->mode & SSL_MODE_ENABLE_PARTIAL_WRITE))) {
                         /* next chunk of data should get another prepended empty fragment
                          * in ciphersuites with known-IV weakness: */
                         s->s3->empty_fragment_done = 0;
-                        
-                        return tot+i;
-                        }
 
-                n-=i;
-                tot+=i;
+                        return tot + i;
                 }
-        }
 
-static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
-                         unsigned int len, int create_empty_fragment)
-        {
-        unsigned char *p,*plen;
-        int i,mac_size,clear=0;
-        int prefix_len=0;
+                n -= i;
+                tot += i;
+        }
+}
+
+static int
+do_ssl3_write(SSL *s, int type, const unsigned char *buf,
+    unsigned int len, int create_empty_fragment)
+{
+        unsigned char *p, *plen;
+        int i, mac_size, clear = 0;
+        int prefix_len = 0;
         int eivlen;
-        long align=0;
+        long align = 0;
         SSL3_RECORD *wr;
-        SSL3_BUFFER *wb=&(s->s3->wbuf);
+        SSL3_BUFFER *wb = &(s->s3->wbuf);
         SSL_SESSION *sess;
 
-        if (wb->buf == NULL)
+        if (wb->buf == NULL)
                 if (!ssl3_setup_write_buffer(s))
                         return -1;
 
         /* first check if there is a SSL3_BUFFER still being written
          * out.  This will happen with non blocking IO */
         if (wb->left != 0)
-                return(ssl3_write_pending(s,type,buf,len));
+                return (ssl3_write_pending(s, type, buf, len));
 
         /* If we have an alert to send, lets send it */
-        if (s->s3->alert_dispatch)
-                {
-                i=s->method->ssl_dispatch_alert(s);
+        if (s->s3->alert_dispatch) {
+                i = s->method->ssl_dispatch_alert(s);
                 if (i <= 0)
-                        return(i);
+                        return (i);
                 /* if it went, fall through and send more stuff */
-                }
+        }
 
         if (len == 0 && !create_empty_fragment)
                 return 0;
 
-        wr= &(s->s3->wrec);
-        sess=s->session;
+        wr = &(s->s3->wrec);
+        sess = s->session;
 
-        if (    (sess == NULL) ||
-                (s->enc_write_ctx == NULL) ||
-                (EVP_MD_CTX_md(s->write_hash) == NULL))
-                {
+        if ((sess == NULL) || (s->enc_write_ctx == NULL) ||
+            (EVP_MD_CTX_md(s->write_hash) == NULL)) {
 #if 1
-                clear=s->enc_write_ctx?0:1;     /* must be AEAD cipher */
+                clear = s->enc_write_ctx ? 0 : 1; /* must be AEAD cipher */
 #else
-                clear=1;
+                clear = 1;
 #endif
-                mac_size=0;
-                }
-        else
-                {
-                mac_size=EVP_MD_CTX_size(s->write_hash);
+                mac_size = 0;
+        } else {
+                mac_size = EVP_MD_CTX_size(s->write_hash);
                 if (mac_size < 0)
                         goto err;
-                }
+        }
 
         /* 'create_empty_fragment' is true only when this function calls itself */
-        if (!clear && !create_empty_fragment && !s->s3->empty_fragment_done)
-                {
+        if (!clear && !create_empty_fragment && !s->s3->empty_fragment_done) {
                 /* countermeasure against known-IV weakness in CBC ciphersuites
                  * (see http://www.openssl.org/~bodo/tls-cbc.txt) */
 
-                if (s->s3->need_empty_fragments && type == SSL3_RT_APPLICATION_DATA)
-                        {
+                if (s->s3->need_empty_fragments && type == SSL3_RT_APPLICATION_DATA) {
                         /* recursive function call with 'create_empty_fragment' set;
                          * this prepares and buffers the data for an empty fragment
                          * (these 'prefix_len' bytes are sent out later
@@ -700,216 +664,195 @@ static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
                                 goto err;
 
                         if (prefix_len >
-                (SSL3_RT_HEADER_LENGTH + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD))
-                                {
+                                (SSL3_RT_HEADER_LENGTH + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD)) {
                                 /* insufficient space */
                                 SSLerr(SSL_F_DO_SSL3_WRITE, ERR_R_INTERNAL_ERROR);
                                 goto err;
-                                }
                         }
-                
-                s->s3->empty_fragment_done = 1;
                 }
 
-        if (create_empty_fragment)
-                {
+                s->s3->empty_fragment_done = 1;
+        }
+
+        if (create_empty_fragment) {
 #if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD!=0
                 /* extra fragment would be couple of cipher blocks,
                  * which would be multiple of SSL3_ALIGN_PAYLOAD, so
                  * if we want to align the real payload, then we can
                  * just pretent we simply have two headers. */
                 align = (long)wb->buf + 2*SSL3_RT_HEADER_LENGTH;
-                align = (-align)&(SSL3_ALIGN_PAYLOAD-1);
+                align = (-align)&(SSL3_ALIGN_PAYLOAD - 1);
 #endif
                 p = wb->buf + align;
-                wb->offset  = align;
-                }
-        else if (prefix_len)
-                {
+                wb->offset = align;
+        } else if (prefix_len) {
                 p = wb->buf + wb->offset + prefix_len;
-                }
-        else
-                {
+        } else {
 #if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD!=0
                 align = (long)wb->buf + SSL3_RT_HEADER_LENGTH;
-                align = (-align)&(SSL3_ALIGN_PAYLOAD-1);
+                align = (-align)&(SSL3_ALIGN_PAYLOAD - 1);
 #endif
                 p = wb->buf + align;
-                wb->offset  = align;
-                }
+                wb->offset = align;
+        }
 
         /* write the header */
 
-        *(p++)=type&0xff;
-        wr->type=type;
+        *(p++) = type&0xff;
+        wr->type = type;
 
-        *(p++)=(s->version>>8);
+        *(p++) = (s->version >> 8);
         /* Some servers hang if iniatial client hello is larger than 256
          * bytes and record version number > TLS 1.0
          */
-        if (s->state == SSL3_ST_CW_CLNT_HELLO_B
-                                && !s->renegotiate
-                                && TLS1_get_version(s) > TLS1_VERSION)
+        if (s->state == SSL3_ST_CW_CLNT_HELLO_B && !s->renegotiate &&
+            TLS1_get_version(s) > TLS1_VERSION)
                 *(p++) = 0x1;
         else
-                *(p++)=s->version&0xff;
+                *(p++) = s->version&0xff;
 
         /* field where we are to write out packet length */
-        plen=p; 
-        p+=2;
+        plen = p;
+
+        p += 2;
         /* Explicit IV length, block ciphers and TLS version 1.1 or later */
-        if (s->enc_write_ctx && s->version >= TLS1_1_VERSION)
-                {
+        if (s->enc_write_ctx && s->version >= TLS1_1_VERSION) {
                 int mode = EVP_CIPHER_CTX_mode(s->enc_write_ctx);
-                if (mode == EVP_CIPH_CBC_MODE)
-                        {
+                if (mode == EVP_CIPH_CBC_MODE) {
                         eivlen = EVP_CIPHER_CTX_iv_length(s->enc_write_ctx);
                         if (eivlen <= 1)
                                 eivlen = 0;
-                        }
+                }
                 /* Need explicit part of IV for GCM mode */
                 else if (mode == EVP_CIPH_GCM_MODE)
                         eivlen = EVP_GCM_TLS_EXPLICIT_IV_LEN;
                 else
                         eivlen = 0;
-                }
-        else 
+        } else
                 eivlen = 0;
 
         /* lets setup the record stuff. */
-        wr->data=p + eivlen;
-        wr->length=(int)len;
-        wr->input=(unsigned char *)buf;
+        wr->data = p + eivlen;
+        wr->length = (int)len;
+        wr->input = (unsigned char *)buf;
 
         /* we now 'read' from wr->input, wr->length bytes into
          * wr->data */
 
         /* first we compress */
-        if (s->compress != NULL)
-                {
-                if (!ssl3_do_compress(s))
-                        {
-                        SSLerr(SSL_F_DO_SSL3_WRITE,SSL_R_COMPRESSION_FAILURE);
+        if (s->compress != NULL) {
+                if (!ssl3_do_compress(s)) {
+                        SSLerr(SSL_F_DO_SSL3_WRITE, SSL_R_COMPRESSION_FAILURE);
                         goto err;
-                        }
-                }
-        else
-                {
-                memcpy(wr->data,wr->input,wr->length);
-                wr->input=wr->data;
                 }
+        } else {
+                memcpy(wr->data, wr->input, wr->length);
+                wr->input = wr->data;
+        }
 
         /* we should still have the output to wr->data and the input
          * from wr->input.  Length should be wr->length.
          * wr->data still points in the wb->buf */
 
-        if (mac_size != 0)
-                {
-                if (s->method->ssl3_enc->mac(s,&(p[wr->length + eivlen]),1) < 0)
+        if (mac_size != 0) {
+                if (s->method->ssl3_enc->mac(s, &(p[wr->length + eivlen]), 1) < 0)
                         goto err;
-                wr->length+=mac_size;
-                }
+                wr->length += mac_size;
+        }
 
-        wr->input=p;
-        wr->data=p;
+        wr->input = p;
+        wr->data = p;
 
-        if (eivlen)
-                {
+        if (eivlen) {
         /*      if (RAND_pseudo_bytes(p, eivlen) <= 0)
-                        goto err; */
+                        goto err;
+*/
                 wr->length += eivlen;
-                }
+        }
 
         /* ssl3_enc can only have an error on read */
-        s->method->ssl3_enc->enc(s,1);
+        s->method->ssl3_enc->enc(s, 1);
 
         /* record length after mac and block padding */
-        s2n(wr->length,plen);
+        s2n(wr->length, plen);
 
         /* we should now have
          * wr->data pointing to the encrypted data, which is
          * wr->length long */
         wr->type=type; /* not needed but helps for debugging */
-        wr->length+=SSL3_RT_HEADER_LENGTH;
+        wr->length += SSL3_RT_HEADER_LENGTH;
 
-        if (create_empty_fragment)
-                {
+        if (create_empty_fragment) {
                 /* we are in a recursive call;
                  * just return the length, don't write out anything here
                  */
                 return wr->length;
-                }
+        }
 
         /* now let's set up wb */
         wb->left = prefix_len + wr->length;
 
         /* memorize arguments so that ssl3_write_pending can detect bad write retries later */
-        s->s3->wpend_tot=len;
-        s->s3->wpend_buf=buf;
-        s->s3->wpend_type=type;
-        s->s3->wpend_ret=len;
+        s->s3->wpend_tot = len;
+        s->s3->wpend_buf = buf;
+        s->s3->wpend_type = type;
+        s->s3->wpend_ret = len;
 
         /* we now just need to write the buffer */
-        return ssl3_write_pending(s,type,buf,len);
+        return ssl3_write_pending(s, type, buf, len);
 err:
         return -1;
-        }
+}
 
 /* if s->s3->wbuf.left != 0, we need to call this */
-int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
-        unsigned int len)
-        {
+int
+ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
+    unsigned int len)
+{
         int i;
-        SSL3_BUFFER *wb=&(s->s3->wbuf);
+        SSL3_BUFFER *wb = &(s->s3->wbuf);
 
 /* XXXX */
-        if ((s->s3->wpend_tot > (int)len)
-                || ((s->s3->wpend_buf != buf) &&
-                        !(s->mode & SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER))
-                || (s->s3->wpend_type != type))
-                {
-                SSLerr(SSL_F_SSL3_WRITE_PENDING,SSL_R_BAD_WRITE_RETRY);
-                return(-1);
-                }
+        if ((s->s3->wpend_tot > (int)len) || ((s->s3->wpend_buf != buf) &&
+            !(s->mode & SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER)) ||
+            (s->s3->wpend_type != type)) {
+                SSLerr(SSL_F_SSL3_WRITE_PENDING, SSL_R_BAD_WRITE_RETRY);
+                return (-1);
+        }
 
-        for (;;)
-                {
+        for (;;) {
                 errno = 0;
-                if (s->wbio != NULL)
-                        {
-                        s->rwstate=SSL_WRITING;
-                        i=BIO_write(s->wbio,
-                                (char *)&(wb->buf[wb->offset]),
-                                (unsigned int)wb->left);
-                        }
-                else
-                        {
-                        SSLerr(SSL_F_SSL3_WRITE_PENDING,SSL_R_BIO_NOT_SET);
-                        i= -1;
-                        }
-                if (i == wb->left)
-                        {
-                        wb->left=0;
-                        wb->offset+=i;
+                if (s->wbio != NULL) {
+                        s->rwstate = SSL_WRITING;
+                        i = BIO_write(s->wbio,
+                        (char *)&(wb->buf[wb->offset]),
+                        (unsigned int)wb->left);
+                } else {
+                        SSLerr(SSL_F_SSL3_WRITE_PENDING, SSL_R_BIO_NOT_SET);
+                        i = -1;
+                }
+                if (i == wb->left) {
+                        wb->left = 0;
+                        wb->offset += i;
                         if (s->mode & SSL_MODE_RELEASE_BUFFERS &&
-                            SSL_version(s) != DTLS1_VERSION && SSL_version(s) != DTLS1_BAD_VER)
+                            SSL_version(s) != DTLS1_VERSION &&
+                            SSL_version(s) != DTLS1_BAD_VER)
                                 ssl3_release_write_buffer(s);
-                        s->rwstate=SSL_NOTHING;
-                        return(s->s3->wpend_ret);
-                        }
-                else if (i <= 0) {
+                        s->rwstate = SSL_NOTHING;
+                        return (s->s3->wpend_ret);
+                } else if (i <= 0) {
                         if (s->version == DTLS1_VERSION ||
                             s->version == DTLS1_BAD_VER) {
                                 /* For DTLS, just drop it. That's kind of the whole
                                    point in using a datagram service */
                                 wb->left = 0;
                         }
-                        return(i);
-                }
-                wb->offset+=i;
-                wb->left-=i;
+                        return (i);
                 }
+                wb->offset += i;
+                wb->left -= i;
         }
+}
 
 /* Return up to 'len' payload bytes received in 'type' records.
  * 'type' is one of the following:
@@ -938,39 +881,40 @@ int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
  *     Application data protocol
  *             none of our business
  */
-int ssl3_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek)
-        {
-        int al,i,j,ret;
+int
+ssl3_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek)
+{
+        int al, i, j, ret;
         unsigned int n;
         SSL3_RECORD *rr;
-        void (*cb)(const SSL *ssl,int type2,int val)=NULL;
+        void (*cb)(const SSL *ssl, int type2, int val) = NULL;
 
         if (s->s3->rbuf.buf == NULL) /* Not initialized yet */
                 if (!ssl3_setup_read_buffer(s))
-                        return(-1);
+                        return (-1);
 
-        if ((type && (type != SSL3_RT_APPLICATION_DATA) && (type != SSL3_RT_HANDSHAKE) && type) ||
-            (peek && (type != SSL3_RT_APPLICATION_DATA)))
-                {
+        if ((type && (type != SSL3_RT_APPLICATION_DATA) &&
+            (type != SSL3_RT_HANDSHAKE) && type) ||
+            (peek && (type != SSL3_RT_APPLICATION_DATA))) {
                 SSLerr(SSL_F_SSL3_READ_BYTES, ERR_R_INTERNAL_ERROR);
                 return -1;
-                }
+        }
 
         if ((type == SSL3_RT_HANDSHAKE) && (s->s3->handshake_fragment_len > 0))
                 /* (partially) satisfy request from storage */
-                {
+        {
                 unsigned char *src = s->s3->handshake_fragment;
                 unsigned char *dst = buf;
                 unsigned int k;
 
                 /* peek == 0 */
                 n = 0;
-                while ((len > 0) && (s->s3->handshake_fragment_len > 0))
-                        {
+                while ((len > 0) && (s->s3->handshake_fragment_len > 0)) {
                         *dst++ = *src++;
-                        len--; s->s3->handshake_fragment_len--;
+                        len--;
+                        s->s3->handshake_fragment_len--;
                         n++;
-                        }
+                }
                 /* move any remaining fragment bytes: */
                 for (k = 0; k < s->s3->handshake_fragment_len; k++)
                         s->s3->handshake_fragment[k] = *src++;
@@ -979,19 +923,18 @@ int ssl3_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek)
 
         /* Now s->s3->handshake_fragment_len == 0 if type == SSL3_RT_HANDSHAKE. */
 
-        if (!s->in_handshake && SSL_in_init(s))
-                {
+        if (!s->in_handshake && SSL_in_init(s)) {
                 /* type == SSL3_RT_APPLICATION_DATA */
-                i=s->handshake_func(s);
-                if (i < 0) return(i);
-                if (i == 0)
-                        {
-                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_SSL_HANDSHAKE_FAILURE);
-                        return(-1);
-                        }
+                i = s->handshake_func(s);
+                if (i < 0)
+                        return (i);
+                if (i == 0) {
+                        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_SSL_HANDSHAKE_FAILURE);
+                        return (-1);
                 }
+        }
 start:
-        s->rwstate=SSL_NOTHING;
+        s->rwstate = SSL_NOTHING;
 
         /* s->s3->rrec.type         - is the type of record
          * s->s3->rrec.data,    - data
@@ -1000,67 +943,63 @@ start:
         rr = &(s->s3->rrec);
 
         /* get new packet if necessary */
-        if ((rr->length == 0) || (s->rstate == SSL_ST_READ_BODY))
-                {
-                ret=ssl3_get_record(s);
-                if (ret <= 0) return(ret);
-                }
+        if ((rr->length == 0) || (s->rstate == SSL_ST_READ_BODY)) {
+                ret = ssl3_get_record(s);
+                if (ret <= 0)
+                        return (ret);
+        }
 
         /* we now have a packet which can be read and processed */
 
         if (s->s3->change_cipher_spec /* set when we receive ChangeCipherSpec,
                                        * reset by ssl3_get_finished */
-                && (rr->type != SSL3_RT_HANDSHAKE))
-                {
-                al=SSL_AD_UNEXPECTED_MESSAGE;
-                SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_DATA_BETWEEN_CCS_AND_FINISHED);
+            && (rr->type != SSL3_RT_HANDSHAKE)) {
+                al = SSL_AD_UNEXPECTED_MESSAGE;
+                SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_DATA_BETWEEN_CCS_AND_FINISHED);
                 goto f_err;
-                }
+        }
 
         /* If the other end has shut down, throw anything we read away
          * (even in 'peek' mode) */
-        if (s->shutdown & SSL_RECEIVED_SHUTDOWN)
-                {
-                rr->length=0;
-                s->rwstate=SSL_NOTHING;
-                return(0);
-                }
+        if (s->shutdown & SSL_RECEIVED_SHUTDOWN) {
+                rr->length = 0;
+                s->rwstate = SSL_NOTHING;
+                return (0);
+        }
 
 
         if (type == rr->type) /* SSL3_RT_APPLICATION_DATA or SSL3_RT_HANDSHAKE */
-                {
+        {
                 /* make sure that we are not getting application data when we
                  * are doing a handshake for the first time */
                 if (SSL_in_init(s) && (type == SSL3_RT_APPLICATION_DATA) &&
-                        (s->enc_read_ctx == NULL))
-                        {
-                        al=SSL_AD_UNEXPECTED_MESSAGE;
-                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_APP_DATA_IN_HANDSHAKE);
+                        (s->enc_read_ctx == NULL)) {
+                        al = SSL_AD_UNEXPECTED_MESSAGE;
+                        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_APP_DATA_IN_HANDSHAKE);
                         goto f_err;
-                        }
+                }
 
-                if (len <= 0) return(len);
+                if (len <= 0)
+                        return (len);
 
                 if ((unsigned int)len > rr->length)
                         n = rr->length;
                 else
                         n = (unsigned int)len;
 
-                memcpy(buf,&(rr->data[rr->off]),n);
-                if (!peek)
-                        {
-                        rr->length-=n;
-                        rr->off+=n;
-                        if (rr->length == 0)
-                                {
-                                s->rstate=SSL_ST_READ_HEADER;
-                                rr->off=0;
+                memcpy(buf, &(rr->data[rr->off]), n);
+                if (!peek) {
+                        rr->length -= n;
+                        rr->off += n;
+                        if (rr->length == 0) {
+                                s->rstate = SSL_ST_READ_HEADER;
+                                rr->off = 0;
                                 if (s->mode & SSL_MODE_RELEASE_BUFFERS)
                                         ssl3_release_read_buffer(s);
-                                }
                         }
-                return(n);
                 }
+                return (n);
+        }
 
 
         /* If we get here, then type != rr->type; if we have a handshake
@@ -1069,137 +1008,122 @@ start:
         /* In case of record types for which we have 'fragment' storage,
          * fill that so that we can process the data at a fixed place.
          */
-                {
+        {
                 unsigned int dest_maxlen = 0;
                 unsigned char *dest = NULL;
                 unsigned int *dest_len = NULL;
 
-                if (rr->type == SSL3_RT_HANDSHAKE)
-                        {
+                if (rr->type == SSL3_RT_HANDSHAKE) {
                         dest_maxlen = sizeof s->s3->handshake_fragment;
                         dest = s->s3->handshake_fragment;
                         dest_len = &s->s3->handshake_fragment_len;
-                        }
-                else if (rr->type == SSL3_RT_ALERT)
-                        {
+                } else if (rr->type == SSL3_RT_ALERT) {
                         dest_maxlen = sizeof s->s3->alert_fragment;
                         dest = s->s3->alert_fragment;
                         dest_len = &s->s3->alert_fragment_len;
-                        }
+                }
 #ifndef OPENSSL_NO_HEARTBEATS
-                else if (rr->type == TLS1_RT_HEARTBEAT)
-                        {
+                else if (rr->type == TLS1_RT_HEARTBEAT) {
                         tls1_process_heartbeat(s);
 
                         /* Exit and notify application to read again */
                         rr->length = 0;
-                        s->rwstate=SSL_READING;
+                        s->rwstate = SSL_READING;
                         BIO_clear_retry_flags(SSL_get_rbio(s));
                         BIO_set_retry_read(SSL_get_rbio(s));
-                        return(-1);
-                        }
+                        return (-1);
+                }
 #endif
 
-                if (dest_maxlen > 0)
-                        {
+                if (dest_maxlen > 0) {
                         n = dest_maxlen - *dest_len; /* available space in 'dest' */
                         if (rr->length < n)
                                 n = rr->length; /* available bytes */
 
                         /* now move 'n' bytes: */
-                        while (n-- > 0)
-                                {
+                        while (n-- > 0) {
                                 dest[(*dest_len)++] = rr->data[rr->off++];
                                 rr->length--;
-                                }
+                        }
 
                         if (*dest_len < dest_maxlen)
                                 goto start; /* fragment was too small */
-                        }
                 }
+        }
 
         /* s->s3->handshake_fragment_len == 4  iff  rr->type == SSL3_RT_HANDSHAKE;
          * s->s3->alert_fragment_len == 2      iff  rr->type == SSL3_RT_ALERT.
          * (Possibly rr is 'empty' now, i.e. rr->length may be 0.) */
 
         /* If we are a client, check for an incoming 'Hello Request': */
-        if ((!s->server) &&
-                (s->s3->handshake_fragment_len >= 4) &&
-                (s->s3->handshake_fragment[0] == SSL3_MT_HELLO_REQUEST) &&
-                (s->session != NULL) && (s->session->cipher != NULL))
-                {
+        if ((!s->server) && (s->s3->handshake_fragment_len >= 4) &&
+            (s->s3->handshake_fragment[0] == SSL3_MT_HELLO_REQUEST) &&
+            (s->session != NULL) && (s->session->cipher != NULL)) {
                 s->s3->handshake_fragment_len = 0;
 
                 if ((s->s3->handshake_fragment[1] != 0) ||
-                        (s->s3->handshake_fragment[2] != 0) ||
-                        (s->s3->handshake_fragment[3] != 0))
-                        {
-                        al=SSL_AD_DECODE_ERROR;
-                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_BAD_HELLO_REQUEST);
+                    (s->s3->handshake_fragment[2] != 0) ||
+                    (s->s3->handshake_fragment[3] != 0)) {
+                        al = SSL_AD_DECODE_ERROR;
+                        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_BAD_HELLO_REQUEST);
                         goto f_err;
-                        }
+                }
 
                 if (s->msg_callback)
                         s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, s->s3->handshake_fragment, 4, s, s->msg_callback_arg);
 
                 if (SSL_is_init_finished(s) &&
-                        !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS) &&
-                        !s->s3->renegotiate)
-                        {
+                    !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS) &&
+                    !s->s3->renegotiate) {
                         ssl3_renegotiate(s);
-                        if (ssl3_renegotiate_check(s))
-                                {
-                                i=s->handshake_func(s);
-                                if (i < 0) return(i);
-                                if (i == 0)
-                                        {
-                                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_SSL_HANDSHAKE_FAILURE);
-                                        return(-1);
-                                        }
+                        if (ssl3_renegotiate_check(s)) {
+                                i = s->handshake_func(s);
+                                if (i < 0)
+                                        return (i);
+                                if (i == 0) {
+                                        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_SSL_HANDSHAKE_FAILURE);
+                                        return (-1);
+                                }
 
-                                if (!(s->mode & SSL_MODE_AUTO_RETRY))
-                                        {
+                                if (!(s->mode & SSL_MODE_AUTO_RETRY)) {
                                         if (s->s3->rbuf.left == 0) /* no read-ahead left? */
-                                                {
+                                        {
                                                 BIO *bio;
                                                 /* In the case where we try to read application data,
                                                  * but we trigger an SSL handshake, we return -1 with
                                                  * the retry option set.  Otherwise renegotiation may
                                                  * cause nasty problems in the blocking world */
-                                                s->rwstate=SSL_READING;
-                                                bio=SSL_get_rbio(s);
+                                                s->rwstate = SSL_READING;
+                                                bio = SSL_get_rbio(s);
                                                 BIO_clear_retry_flags(bio);
                                                 BIO_set_retry_read(bio);
-                                                return(-1);
-                                                }
+                                                return (-1);
                                         }
                                 }
                         }
+                }
                 /* we either finished a handshake or ignored the request,
                  * now try again to obtain the (application) data we were asked for */
                 goto start;
-                }
+        }
         /* If we are a server and get a client hello when renegotiation isn't
          * allowed send back a no renegotiation alert and carry on.
          * WARNING: experimental code, needs reviewing (steve)
          */
         if (s->server &&
-                SSL_is_init_finished(s) &&
-                !s->s3->send_connection_binding &&
-                (s->version > SSL3_VERSION) &&
-                (s->s3->handshake_fragment_len >= 4) &&
-                (s->s3->handshake_fragment[0] == SSL3_MT_CLIENT_HELLO) &&
-                (s->session != NULL) && (s->session->cipher != NULL) &&
-                !(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
-                
-                {
+            SSL_is_init_finished(s) &&
+            !s->s3->send_connection_binding &&
+            (s->version > SSL3_VERSION) &&
+            (s->s3->handshake_fragment_len >= 4) &&
+            (s->s3->handshake_fragment[0] == SSL3_MT_CLIENT_HELLO) &&
+            (s->session != NULL) && (s->session->cipher != NULL) &&
+            !(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)) {
                 /*s->s3->handshake_fragment_len = 0;*/
                 rr->length = 0;
-                ssl3_send_alert(s,SSL3_AL_WARNING, SSL_AD_NO_RENEGOTIATION);
+                ssl3_send_alert(s, SSL3_AL_WARNING, SSL_AD_NO_RENEGOTIATION);
                 goto start;
-                }
-        if (s->s3->alert_fragment_len >= 2)
-                {
+        }
+        if (s->s3->alert_fragment_len >= 2) {
                 int alert_level = s->s3->alert_fragment[0];
                 int alert_descr = s->s3->alert_fragment[1];
 
@@ -1209,24 +1133,22 @@ start:
                         s->msg_callback(0, s->version, SSL3_RT_ALERT, s->s3->alert_fragment, 2, s, s->msg_callback_arg);
 
                 if (s->info_callback != NULL)
-                        cb=s->info_callback;
+                        cb = s->info_callback;
                 else if (s->ctx->info_callback != NULL)
-                        cb=s->ctx->info_callback;
+                        cb = s->ctx->info_callback;
 
-                if (cb != NULL)
-                        {
+                if (cb != NULL) {
                         j = (alert_level << 8) | alert_descr;
                         cb(s, SSL_CB_READ_ALERT, j);
-                        }
+                }
 
                 if (alert_level == 1) /* warning */
-                        {
+                {
                         s->s3->warn_alert = alert_descr;
-                        if (alert_descr == SSL_AD_CLOSE_NOTIFY)
-                                {
+                        if (alert_descr == SSL_AD_CLOSE_NOTIFY) {
                                 s->shutdown |= SSL_RECEIVED_SHUTDOWN;
-                                return(0);
-                                }
+                                return (0);
+                        }
                         /* This is a warning but we receive it if we requested
                          * renegotiation and the peer denied it. Terminate with
                          * a fatal alert because if application tried to
@@ -1236,139 +1158,126 @@ start:
                          * In future we might have a renegotiation where we
                          * don't care if the peer refused it where we carry on.
                          */
-                        else if (alert_descr == SSL_AD_NO_RENEGOTIATION)
-                                {
+                        else if (alert_descr == SSL_AD_NO_RENEGOTIATION) {
                                 al = SSL_AD_HANDSHAKE_FAILURE;
-                                SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_NO_RENEGOTIATION);
+                                SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_NO_RENEGOTIATION);
                                 goto f_err;
-                                }
+                        }
 #ifdef SSL_AD_MISSING_SRP_USERNAME
                         else if (alert_descr == SSL_AD_MISSING_SRP_USERNAME)
-                                return(0);
+                                return (0);
 #endif
-                        }
-                else if (alert_level == 2) /* fatal */
-                        {
+                } else if (alert_level == 2) /* fatal */
+                {
                         char tmp[16];
 
-                        s->rwstate=SSL_NOTHING;
+                        s->rwstate = SSL_NOTHING;
                         s->s3->fatal_alert = alert_descr;
                         SSLerr(SSL_F_SSL3_READ_BYTES, SSL_AD_REASON_OFFSET + alert_descr);
-                        BIO_snprintf(tmp,sizeof tmp,"%d",alert_descr);
-                        ERR_add_error_data(2,"SSL alert number ",tmp);
+                        BIO_snprintf(tmp, sizeof tmp, "%d", alert_descr);
+                        ERR_add_error_data(2, "SSL alert number ", tmp);
                         s->shutdown|=SSL_RECEIVED_SHUTDOWN;
-                        SSL_CTX_remove_session(s->ctx,s->session);
-                        return(0);
-                        }
-                else
-                        {
-                        al=SSL_AD_ILLEGAL_PARAMETER;
-                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_UNKNOWN_ALERT_TYPE);
+                        SSL_CTX_remove_session(s->ctx, s->session);
+                        return (0);
+                } else {
+                        al = SSL_AD_ILLEGAL_PARAMETER;
+                        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_UNKNOWN_ALERT_TYPE);
                         goto f_err;
-                        }
+                }
 
                 goto start;
-                }
+        }
 
         if (s->shutdown & SSL_SENT_SHUTDOWN) /* but we have not received a shutdown */
-                {
-                s->rwstate=SSL_NOTHING;
-                rr->length=0;
-                return(0);
-                }
+        {
+                s->rwstate = SSL_NOTHING;
+                rr->length = 0;
+                return (0);
+        }
 
-        if (rr->type == SSL3_RT_CHANGE_CIPHER_SPEC)
-                {
+        if (rr->type == SSL3_RT_CHANGE_CIPHER_SPEC) {
                 /* 'Change Cipher Spec' is just a single byte, so we know
                  * exactly what the record payload has to look like */
-                if (    (rr->length != 1) || (rr->off != 0) ||
-                        (rr->data[0] != SSL3_MT_CCS))
-                        {
-                        al=SSL_AD_ILLEGAL_PARAMETER;
-                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_BAD_CHANGE_CIPHER_SPEC);
+                if ((rr->length != 1) || (rr->off != 0) ||
+                        (rr->data[0] != SSL3_MT_CCS)) {
+                        al = SSL_AD_ILLEGAL_PARAMETER;
+                        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_BAD_CHANGE_CIPHER_SPEC);
                         goto f_err;
-                        }
+                }
 
                 /* Check we have a cipher to change to */
-                if (s->s3->tmp.new_cipher == NULL)
-                        {
-                        al=SSL_AD_UNEXPECTED_MESSAGE;
-                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_CCS_RECEIVED_EARLY);
+                if (s->s3->tmp.new_cipher == NULL) {
+                        al = SSL_AD_UNEXPECTED_MESSAGE;
+                        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_CCS_RECEIVED_EARLY);
                         goto f_err;
-                        }
+                }
 
-                rr->length=0;
+                rr->length = 0;
 
                 if (s->msg_callback)
                         s->msg_callback(0, s->version, SSL3_RT_CHANGE_CIPHER_SPEC, rr->data, 1, s, s->msg_callback_arg);
 
-                s->s3->change_cipher_spec=1;
+                s->s3->change_cipher_spec = 1;
                 if (!ssl3_do_change_cipher_spec(s))
                         goto err;
                 else
                         goto start;
-                }
+        }
 
         /* Unexpected handshake message (Client Hello, or protocol violation) */
-        if ((s->s3->handshake_fragment_len >= 4) &&     !s->in_handshake)
-                {
+        if ((s->s3->handshake_fragment_len >= 4) && !s->in_handshake) {
                 if (((s->state&SSL_ST_MASK) == SSL_ST_OK) &&
-                        !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS))
-                        {
+                    !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS)) {
 #if 0 /* worked only because C operator preferences are not as expected (and
-       * because this is not really needed for clients except for detecting
+                        * because this is not really needed for clients except for detecting
        * protocol violations): */
-                        s->state=SSL_ST_BEFORE|(s->server)
-                                ?SSL_ST_ACCEPT
-                                :SSL_ST_CONNECT;
+                        s->state = SSL_ST_BEFORE |
+                            (s->server) ? SSL_ST_ACCEPT : SSL_ST_CONNECT;
 #else
                         s->state = s->server ? SSL_ST_ACCEPT : SSL_ST_CONNECT;
 #endif
-                        s->renegotiate=1;
-                        s->new_session=1;
-                        }
-                i=s->handshake_func(s);
-                if (i < 0) return(i);
-                if (i == 0)
-                        {
-                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_SSL_HANDSHAKE_FAILURE);
-                        return(-1);
-                        }
+                        s->renegotiate = 1;
+                        s->new_session = 1;
+                }
+                i = s->handshake_func(s);
+                if (i < 0)
+                        return (i);
+                if (i == 0) {
+                        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_SSL_HANDSHAKE_FAILURE);
+                        return (-1);
+                }
 
-                if (!(s->mode & SSL_MODE_AUTO_RETRY))
-                        {
+                if (!(s->mode & SSL_MODE_AUTO_RETRY)) {
                         if (s->s3->rbuf.left == 0) /* no read-ahead left? */
-                                {
+                        {
                                 BIO *bio;
                                 /* In the case where we try to read application data,
                                  * but we trigger an SSL handshake, we return -1 with
                                  * the retry option set.  Otherwise renegotiation may
                                  * cause nasty problems in the blocking world */
-                                s->rwstate=SSL_READING;
-                                bio=SSL_get_rbio(s);
+                                s->rwstate = SSL_READING;
+                                bio = SSL_get_rbio(s);
                                 BIO_clear_retry_flags(bio);
                                 BIO_set_retry_read(bio);
-                                return(-1);
-                                }
+                                return (-1);
                         }
-                goto start;
                 }
+                goto start;
+        }
 
-        switch (rr->type)
-                {
+        switch (rr->type) {
         default:
 #ifndef OPENSSL_NO_TLS
                 /* TLS up to v1.1 just ignores unknown message types:
                  * TLS v1.2 give an unexpected message alert.
                  */
-                if (s->version >= TLS1_VERSION && s->version <= TLS1_1_VERSION)
-                        {
+                if (s->version >= TLS1_VERSION && s->version <= TLS1_1_VERSION) {
                         rr->length = 0;
                         goto start;
-                        }
+                }
 #endif
-                al=SSL_AD_UNEXPECTED_MESSAGE;
-                SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_UNEXPECTED_RECORD);
+                al = SSL_AD_UNEXPECTED_MESSAGE;
+                SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_UNEXPECTED_RECORD);
                 goto f_err;
         case SSL3_RT_CHANGE_CIPHER_SPEC:
         case SSL3_RT_ALERT:
@@ -1376,8 +1285,8 @@ start:
                 /* we already handled all of these, with the possible exception
                  * of SSL3_RT_HANDSHAKE when s->in_handshake is set, but that
                  * should not happen when type != rr->type */
-                al=SSL_AD_UNEXPECTED_MESSAGE;
-                SSLerr(SSL_F_SSL3_READ_BYTES,ERR_R_INTERNAL_ERROR);
+                al = SSL_AD_UNEXPECTED_MESSAGE;
+                SSLerr(SSL_F_SSL3_READ_BYTES, ERR_R_INTERNAL_ERROR);
                 goto f_err;
         case SSL3_RT_APPLICATION_DATA:
                 /* At this point, we were expecting handshake data,
@@ -1388,123 +1297,116 @@ start:
                  * we will indulge it.
                  */
                 if (s->s3->in_read_app_data &&
-                        (s->s3->total_renegotiations != 0) &&
-                        ((
-                                (s->state & SSL_ST_CONNECT) &&
-                                (s->state >= SSL3_ST_CW_CLNT_HELLO_A) &&
-                                (s->state <= SSL3_ST_CR_SRVR_HELLO_A)
-                                ) || (
-                                        (s->state & SSL_ST_ACCEPT) &&
-                                        (s->state <= SSL3_ST_SW_HELLO_REQ_A) &&
-                                        (s->state >= SSL3_ST_SR_CLNT_HELLO_A)
-                                        )
-                                ))
-                        {
-                        s->s3->in_read_app_data=2;
-                        return(-1);
-                        }
-                else
-                        {
-                        al=SSL_AD_UNEXPECTED_MESSAGE;
-                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_UNEXPECTED_RECORD);
+                    (s->s3->total_renegotiations != 0) &&
+                    ((
+                    (s->state & SSL_ST_CONNECT) &&
+                    (s->state >= SSL3_ST_CW_CLNT_HELLO_A) &&
+                    (s->state <= SSL3_ST_CR_SRVR_HELLO_A)
+                    ) || (
+                    (s->state & SSL_ST_ACCEPT) &&
+                    (s->state <= SSL3_ST_SW_HELLO_REQ_A) &&
+                    (s->state >= SSL3_ST_SR_CLNT_HELLO_A)
+                    )
+                    )) {
+                        s->s3->in_read_app_data = 2;
+                        return (-1);
+                } else {
+                        al = SSL_AD_UNEXPECTED_MESSAGE;
+                        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_UNEXPECTED_RECORD);
                         goto f_err;
-                        }
                 }
+        }
         /* not reached */
 
 f_err:
-        ssl3_send_alert(s,SSL3_AL_FATAL,al);
+        ssl3_send_alert(s, SSL3_AL_FATAL, al);
 err:
-        return(-1);
-        }
+        return (-1);
+}
 
-int ssl3_do_change_cipher_spec(SSL *s)
-        {
+int
+ssl3_do_change_cipher_spec(SSL *s)
+{
         int i;
         const char *sender;
         int slen;
 
         if (s->state & SSL_ST_ACCEPT)
-                i=SSL3_CHANGE_CIPHER_SERVER_READ;
+                i = SSL3_CHANGE_CIPHER_SERVER_READ;
         else
-                i=SSL3_CHANGE_CIPHER_CLIENT_READ;
+                i = SSL3_CHANGE_CIPHER_CLIENT_READ;
 
-        if (s->s3->tmp.key_block == NULL)
-                {
-                if (s->session == NULL) 
-                        {
+        if (s->s3->tmp.key_block == NULL) {
+                if (s->session == NULL) {
                         /* might happen if dtls1_read_bytes() calls this */
-                        SSLerr(SSL_F_SSL3_DO_CHANGE_CIPHER_SPEC,SSL_R_CCS_RECEIVED_EARLY);
+                        SSLerr(SSL_F_SSL3_DO_CHANGE_CIPHER_SPEC, SSL_R_CCS_RECEIVED_EARLY);
                         return (0);
-                        }
-
-                s->session->cipher=s->s3->tmp.new_cipher;
-                if (!s->method->ssl3_enc->setup_key_block(s)) return(0);
                 }
 
-        if (!s->method->ssl3_enc->change_cipher_state(s,i))
-                return(0);
+                s->session->cipher = s->s3->tmp.new_cipher;
+                if (!s->method->ssl3_enc->setup_key_block(s))
+                        return (0);
+        }
+
+        if (!s->method->ssl3_enc->change_cipher_state(s, i))
+                return (0);
 
         /* we have to record the message digest at
          * this point so we can get it before we read
          * the finished message */
-        if (s->state & SSL_ST_CONNECT)
-                {
-                sender=s->method->ssl3_enc->server_finished_label;
-                slen=s->method->ssl3_enc->server_finished_label_len;
-                }
-        else
-                {
-                sender=s->method->ssl3_enc->client_finished_label;
-                slen=s->method->ssl3_enc->client_finished_label_len;
-                }
+        if (s->state & SSL_ST_CONNECT) {
+                sender = s->method->ssl3_enc->server_finished_label;
+                slen = s->method->ssl3_enc->server_finished_label_len;
+        } else {
+                sender = s->method->ssl3_enc->client_finished_label;
+                slen = s->method->ssl3_enc->client_finished_label_len;
+        }
 
         i = s->method->ssl3_enc->final_finish_mac(s,
-                sender,slen,s->s3->tmp.peer_finish_md);
-        if (i == 0)
-                {
+        sender, slen, s->s3->tmp.peer_finish_md);
+        if (i == 0) {
                 SSLerr(SSL_F_SSL3_DO_CHANGE_CIPHER_SPEC, ERR_R_INTERNAL_ERROR);
                 return 0;
-                }
+        }
         s->s3->tmp.peer_finish_md_len = i;
 
-        return(1);
-        }
+        return (1);
+}
 
-int ssl3_send_alert(SSL *s, int level, int desc)
-        {
+int
+ssl3_send_alert(SSL *s, int level, int desc)
+{
         /* Map tls/ssl alert value to correct one */
-        desc=s->method->ssl3_enc->alert_value(desc);
+        desc = s->method->ssl3_enc->alert_value(desc);
         if (s->version == SSL3_VERSION && desc == SSL_AD_PROTOCOL_VERSION)
                 desc = SSL_AD_HANDSHAKE_FAILURE; /* SSL 3.0 does not have protocol_version alerts */
-        if (desc < 0) return -1;
+        if (desc < 0)
+                return -1;
         /* If a fatal one, remove from cache */
         if ((level == 2) && (s->session != NULL))
-                SSL_CTX_remove_session(s->ctx,s->session);
+                SSL_CTX_remove_session(s->ctx, s->session);
 
-        s->s3->alert_dispatch=1;
-        s->s3->send_alert[0]=level;
-        s->s3->send_alert[1]=desc;
+        s->s3->alert_dispatch = 1;
+        s->s3->send_alert[0] = level;
+        s->s3->send_alert[1] = desc;
         if (s->s3->wbuf.left == 0) /* data still being written out? */
                 return s->method->ssl_dispatch_alert(s);
         /* else data is still being written out, we will get written
          * some time in the future */
         return -1;
-        }
+}
 
-int ssl3_dispatch_alert(SSL *s)
-        {
-        int i,j;
-        void (*cb)(const SSL *ssl,int type,int val)=NULL;
+int
+ssl3_dispatch_alert(SSL *s)
+{
+        int i, j;
+        void (*cb)(const SSL *ssl, int type, int val) = NULL;
 
-        s->s3->alert_dispatch=0;
+        s->s3->alert_dispatch = 0;
         i = do_ssl3_write(s, SSL3_RT_ALERT, &s->s3->send_alert[0], 2, 0);
-        if (i <= 0)
-                {
-                s->s3->alert_dispatch=1;
-                }
-        else
-                {
+        if (i <= 0) {
+                s->s3->alert_dispatch = 1;
+        } else {
                 /* Alert sent to BIO.  If it is important, flush it now.
                  * If the message does not get sent due to non-blocking IO,
                  * we will not worry too much. */
@@ -1515,15 +1417,14 @@ int ssl3_dispatch_alert(SSL *s)
                         s->msg_callback(1, s->version, SSL3_RT_ALERT, s->s3->send_alert, 2, s, s->msg_callback_arg);
 
                 if (s->info_callback != NULL)
-                        cb=s->info_callback;
+                        cb = s->info_callback;
                 else if (s->ctx->info_callback != NULL)
-                        cb=s->ctx->info_callback;
+                        cb = s->ctx->info_callback;
 
-                if (cb != NULL)
-                        {
-                        j=(s->s3->send_alert[0]<<8)|s->s3->send_alert[1];
-                        cb(s,SSL_CB_WRITE_ALERT,j);
-                        }
+                if (cb != NULL) {
+                        j = (s->s3->send_alert[0]<<8)|s->s3->send_alert[1];
+                        cb(s, SSL_CB_WRITE_ALERT, j);
                 }
-        return(i);
         }
+        return (i);
+}
diff --git a/src/lib/libssl/src/ssl/s3_both.c b/src/lib/libssl/src/ssl/s3_both.c
index 77f825af31..b2fd5c6f80 100644
--- a/src/lib/libssl/src/ssl/s3_both.c
+++ b/src/lib/libssl/src/ssl/s3_both.c
@@ -125,82 +125,81 @@
 #include <openssl/x509.h>
 
 /* send s->init_buf in records of type 'type' (SSL3_RT_HANDSHAKE or SSL3_RT_CHANGE_CIPHER_SPEC) */
-int ssl3_do_write(SSL *s, int type)
-        {
+int
+ssl3_do_write(SSL *s, int type)
+{
         int ret;
 
-        ret=ssl3_write_bytes(s,type,&s->init_buf->data[s->init_off],
-                             s->init_num);
-        if (ret < 0) return(-1);
+        ret = ssl3_write_bytes(s, type, &s->init_buf->data[s->init_off],
+        s->init_num);
+        if (ret < 0)
+                return (-1);
         if (type == SSL3_RT_HANDSHAKE)
                 /* should not be done for 'Hello Request's, but in that case
                  * we'll ignore the result anyway */
-                ssl3_finish_mac(s,(unsigned char *)&s->init_buf->data[s->init_off],ret);
-        
-        if (ret == s->init_num)
-                {
+                ssl3_finish_mac(s,(unsigned char *)&s->init_buf->data[s->init_off], ret);
+
+        if (ret == s->init_num) {
                 if (s->msg_callback)
                         s->msg_callback(1, s->version, type, s->init_buf->data, (size_t)(s->init_off + s->init_num), s, s->msg_callback_arg);
-                return(1);
-                }
-        s->init_off+=ret;
-        s->init_num-=ret;
-        return(0);
+                return (1);
         }
+        s->init_off += ret;
+        s->init_num -= ret;
+        return (0);
+}
 
-int ssl3_send_finished(SSL *s, int a, int b, const char *sender, int slen)
-        {
-        unsigned char *p,*d;
+int
+ssl3_send_finished(SSL *s, int a, int b, const char *sender, int slen)
+{
+        unsigned char *p, *d;
         int i;
         unsigned long l;
 
-        if (s->state == a)
-                {
-                d=(unsigned char *)s->init_buf->data;
-                p= &(d[4]);
+        if (s->state == a) {
+                d = (unsigned char *)s->init_buf->data;
+                p = &(d[4]);
 
-                i=s->method->ssl3_enc->final_finish_mac(s,
-                        sender,slen,s->s3->tmp.finish_md);
+                i = s->method->ssl3_enc->final_finish_mac(s,
+                sender, slen, s->s3->tmp.finish_md);
                 if (i == 0)
                         return 0;
                 s->s3->tmp.finish_md_len = i;
                 memcpy(p, s->s3->tmp.finish_md, i);
-                p+=i;
-                l=i;
+                p += i;
+                l = i;
 
                 /* Copy the finished so we can use it for
                    renegotiation checks */
-                if(s->type == SSL_ST_CONNECT)
-                        {
-                         OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
-                         memcpy(s->s3->previous_client_finished, 
-                             s->s3->tmp.finish_md, i);
-                         s->s3->previous_client_finished_len=i;
-                        }
-                else
-                        {
-                        OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
-                        memcpy(s->s3->previous_server_finished, 
-                            s->s3->tmp.finish_md, i);
-                        s->s3->previous_server_finished_len=i;
-                        }
-
-                *(d++)=SSL3_MT_FINISHED;
-                l2n3(l,d);
-                s->init_num=(int)l+4;
-                s->init_off=0;
-
-                s->state=b;
+                if (s->type == SSL_ST_CONNECT) {
+                        OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
+                        memcpy(s->s3->previous_client_finished,
+                        s->s3->tmp.finish_md, i);
+                        s->s3->previous_client_finished_len = i;
+                } else {
+                        OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
+                        memcpy(s->s3->previous_server_finished,
+                        s->s3->tmp.finish_md, i);
+                        s->s3->previous_server_finished_len = i;
                 }
 
-        /* SSL3_ST_SEND_xxxxxx_HELLO_B */
-        return(ssl3_do_write(s,SSL3_RT_HANDSHAKE));
+                *(d++) = SSL3_MT_FINISHED;
+                l2n3(l, d);
+                s->init_num = (int)l + 4;
+                s->init_off = 0;
+
+                s->state = b;
         }
 
+        /* SSL3_ST_SEND_xxxxxx_HELLO_B */
+        return (ssl3_do_write(s, SSL3_RT_HANDSHAKE));
+}
+
 #ifndef OPENSSL_NO_NEXTPROTONEG
 /* ssl3_take_mac calculates the Finished MAC for the handshakes messages seen to far. */
-static void ssl3_take_mac(SSL *s)
-        {
+static void
+ssl3_take_mac(SSL *s)
+{
         const char *sender;
         int slen;
         /* If no new cipher setup return immediately: other functions will
@@ -208,25 +207,23 @@ static void ssl3_take_mac(SSL *s)
          */
         if (s->s3->tmp.new_cipher == NULL)
                 return;
-        if (s->state & SSL_ST_CONNECT)
-                {
-                sender=s->method->ssl3_enc->server_finished_label;
-                slen=s->method->ssl3_enc->server_finished_label_len;
-                }
-        else
-                {
-                sender=s->method->ssl3_enc->client_finished_label;
-                slen=s->method->ssl3_enc->client_finished_label_len;
-                }
+        if (s->state & SSL_ST_CONNECT) {
+                sender = s->method->ssl3_enc->server_finished_label;
+                slen = s->method->ssl3_enc->server_finished_label_len;
+        } else {
+                sender = s->method->ssl3_enc->client_finished_label;
+                slen = s->method->ssl3_enc->client_finished_label_len;
+        }
 
         s->s3->tmp.peer_finish_md_len = s->method->ssl3_enc->final_finish_mac(s,
-                sender,slen,s->s3->tmp.peer_finish_md);
-        }
+        sender, slen, s->s3->tmp.peer_finish_md);
+}
 #endif
 
-int ssl3_get_finished(SSL *s, int a, int b)
-        {
-        int al,i,ok;
+int
+ssl3_get_finished(SSL *s, int a, int b)
+{
+        int al, i, ok;
         long n;
         unsigned char *p;
 
@@ -236,64 +233,55 @@ int ssl3_get_finished(SSL *s, int a, int b)
          */ 
 #endif
 
-        n=s->method->ssl_get_message(s,
-                a,
-                b,
-                SSL3_MT_FINISHED,
-                64, /* should actually be 36+4 :-) */
-                &ok);
+        n = s->method->ssl_get_message(s, a, b, SSL3_MT_FINISHED,
+            64, /* should actually be 36+4 :-) */ &ok);
 
-        if (!ok) return((int)n);
+        if (!ok)
+                return ((int)n);
 
         /* If this occurs, we have missed a message */
-        if (!s->s3->change_cipher_spec)
-                {
-                al=SSL_AD_UNEXPECTED_MESSAGE;
-                SSLerr(SSL_F_SSL3_GET_FINISHED,SSL_R_GOT_A_FIN_BEFORE_A_CCS);
+        if (!s->s3->change_cipher_spec) {
+                al = SSL_AD_UNEXPECTED_MESSAGE;
+                SSLerr(SSL_F_SSL3_GET_FINISHED, SSL_R_GOT_A_FIN_BEFORE_A_CCS);
                 goto f_err;
-                }
-        s->s3->change_cipher_spec=0;
+        }
+        s->s3->change_cipher_spec = 0;
 
         p = (unsigned char *)s->init_msg;
         i = s->s3->tmp.peer_finish_md_len;
 
-        if (i != n)
-                {
-                al=SSL_AD_DECODE_ERROR;
-                SSLerr(SSL_F_SSL3_GET_FINISHED,SSL_R_BAD_DIGEST_LENGTH);
+        if (i != n) {
+                al = SSL_AD_DECODE_ERROR;
+                SSLerr(SSL_F_SSL3_GET_FINISHED, SSL_R_BAD_DIGEST_LENGTH);
                 goto f_err;
-                }
+        }
 
-        if (CRYPTO_memcmp(p, s->s3->tmp.peer_finish_md, i) != 0)
-                {
-                al=SSL_AD_DECRYPT_ERROR;
-                SSLerr(SSL_F_SSL3_GET_FINISHED,SSL_R_DIGEST_CHECK_FAILED);
+        if (CRYPTO_memcmp(p, s->s3->tmp.peer_finish_md, i) != 0) {
+                al = SSL_AD_DECRYPT_ERROR;
+                SSLerr(SSL_F_SSL3_GET_FINISHED, SSL_R_DIGEST_CHECK_FAILED);
                 goto f_err;
-                }
+        }
 
         /* Copy the finished so we can use it for
            renegotiation checks */
-        if(s->type == SSL_ST_ACCEPT)
-                {
-                OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
-                memcpy(s->s3->previous_client_finished, 
-                    s->s3->tmp.peer_finish_md, i);
-                s->s3->previous_client_finished_len=i;
-                }
-        else
-                {
-                OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
-                memcpy(s->s3->previous_server_finished, 
-                    s->s3->tmp.peer_finish_md, i);
-                s->s3->previous_server_finished_len=i;
-                }
-
-        return(1);
-f_err:
-        ssl3_send_alert(s,SSL3_AL_FATAL,al);
-        return(0);
+        if (s->type == SSL_ST_ACCEPT) {
+                OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
+                memcpy(s->s3->previous_client_finished,
+                s->s3->tmp.peer_finish_md, i);
+                s->s3->previous_client_finished_len = i;
+        } else {
+                OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
+                memcpy(s->s3->previous_server_finished,
+                s->s3->tmp.peer_finish_md, i);
+                s->s3->previous_server_finished_len = i;
         }
 
+        return (1);
+f_err:
+        ssl3_send_alert(s, SSL3_AL_FATAL, al);
+        return (0);
+}
+
 /* for these 2 messages, we need to
  * ssl->enc_read_ctx                    re-init
  * ssl->s3->read_sequence               zero
@@ -302,48 +290,49 @@ f_err:
  * ssl->session->read_compression       assign
  * ssl->session->read_hash              assign
  */
-int ssl3_send_change_cipher_spec(SSL *s, int a, int b)
-        { 
+int
+ssl3_send_change_cipher_spec(SSL *s, int a, int b)
+{
         unsigned char *p;
 
-        if (s->state == a)
-                {
-                p=(unsigned char *)s->init_buf->data;
-                *p=SSL3_MT_CCS;
-                s->init_num=1;
-                s->init_off=0;
+        if (s->state == a) {
+                p = (unsigned char *)s->init_buf->data;
+                *p = SSL3_MT_CCS;
+                s->init_num = 1;
+                s->init_off = 0;
 
-                s->state=b;
-                }
+                s->state = b;
+        }
 
         /* SSL3_ST_CW_CHANGE_B */
-        return(ssl3_do_write(s,SSL3_RT_CHANGE_CIPHER_SPEC));
-        }
+        return (ssl3_do_write(s, SSL3_RT_CHANGE_CIPHER_SPEC));
+}
 
-static int ssl3_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)
-        {
+static int
+ssl3_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)
+{
         int n;
         unsigned char *p;
 
-        n=i2d_X509(x,NULL);
-        if (!BUF_MEM_grow_clean(buf,(int)(n+(*l)+3)))
-                {
-                SSLerr(SSL_F_SSL3_ADD_CERT_TO_BUF,ERR_R_BUF_LIB);
-                return(-1);
-                }
-        p=(unsigned char *)&(buf->data[*l]);
-        l2n3(n,p);
-        i2d_X509(x,&p);
-        *l+=n+3;
-
-        return(0);
+        n = i2d_X509(x, NULL);
+        if (!BUF_MEM_grow_clean(buf,(int)(n + (*l) + 3))) {
+                SSLerr(SSL_F_SSL3_ADD_CERT_TO_BUF, ERR_R_BUF_LIB);
+                return (-1);
         }
+        p = (unsigned char *)&(buf->data[*l]);
+        l2n3(n, p);
+        i2d_X509(x, &p);
+        *l += n + 3;
 
-unsigned long ssl3_output_cert_chain(SSL *s, X509 *x)
-        {
+        return (0);
+}
+
+unsigned long
+ssl3_output_cert_chain(SSL *s, X509 *x)
+{
         unsigned char *p;
         int i;
-        unsigned long l=7;
+        unsigned long l = 7;
         BUF_MEM *buf;
         int no_chain;
 
@@ -353,111 +342,99 @@ unsigned long ssl3_output_cert_chain(SSL *s, X509 *x)
                 no_chain = 0;
 
         /* TLSv1 sends a chain with nothing in it, instead of an alert */
-        buf=s->init_buf;
-        if (!BUF_MEM_grow_clean(buf,10))
-                {
-                SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN,ERR_R_BUF_LIB);
-                return(0);
-                }
-        if (x != NULL)
-                {
-                if (no_chain)
-                        {
+        buf = s->init_buf;
+        if (!BUF_MEM_grow_clean(buf, 10)) {
+                SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN, ERR_R_BUF_LIB);
+                return (0);
+        }
+        if (x != NULL) {
+                if (no_chain) {
                         if (ssl3_add_cert_to_buf(buf, &l, x))
-                                return(0);
-                        }
-                else
-                        {
+                                return (0);
+                } else {
                         X509_STORE_CTX xs_ctx;
 
-                        if (!X509_STORE_CTX_init(&xs_ctx,s->ctx->cert_store,x,NULL))
-                                {
-                                SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN,ERR_R_X509_LIB);
-                                return(0);
-                                }
+                        if (!X509_STORE_CTX_init(&xs_ctx, s->ctx->cert_store, x, NULL)) {
+                                SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN, ERR_R_X509_LIB);
+                                return (0);
+                        }
                         X509_verify_cert(&xs_ctx);
                         /* Don't leave errors in the queue */
                         ERR_clear_error();
-                        for (i=0; i < sk_X509_num(xs_ctx.chain); i++)
-                                {
+                        for (i = 0; i < sk_X509_num(xs_ctx.chain); i++) {
                                 x = sk_X509_value(xs_ctx.chain, i);
 
-                                if (ssl3_add_cert_to_buf(buf, &l, x))
-                                        {
+                                if (ssl3_add_cert_to_buf(buf, &l, x)) {
                                         X509_STORE_CTX_cleanup(&xs_ctx);
                                         return 0;
-                                        }
                                 }
-                        X509_STORE_CTX_cleanup(&xs_ctx);
                         }
+                        X509_STORE_CTX_cleanup(&xs_ctx);
                 }
+        }
         /* Thawte special :-) */
-        for (i=0; i<sk_X509_num(s->ctx->extra_certs); i++)
-                {
-                x=sk_X509_value(s->ctx->extra_certs,i);
+        for (i = 0; i < sk_X509_num(s->ctx->extra_certs); i++) {
+                x = sk_X509_value(s->ctx->extra_certs, i);
                 if (ssl3_add_cert_to_buf(buf, &l, x))
-                        return(0);
-                }
-
-        l-=7;
-        p=(unsigned char *)&(buf->data[4]);
-        l2n3(l,p);
-        l+=3;
-        p=(unsigned char *)&(buf->data[0]);
-        *(p++)=SSL3_MT_CERTIFICATE;
-        l2n3(l,p);
-        l+=4;
-        return(l);
+                        return (0);
         }
 
+        l -= 7;
+        p = (unsigned char *)&(buf->data[4]);
+        l2n3(l, p);
+        l += 3;
+        p = (unsigned char *)&(buf->data[0]);
+        *(p++) = SSL3_MT_CERTIFICATE;
+        l2n3(l, p);
+        l += 4;
+        return (l);
+}
+
 /* Obtain handshake message of message type 'mt' (any if mt == -1),
  * maximum acceptable body length 'max'.
  * The first four bytes (msg_type and length) are read in state 'st1',
  * the body is read in state 'stn'.
  */
-long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
-        {
+long
+ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
+{
         unsigned char *p;
         unsigned long l;
         long n;
-        int i,al;
+        int i, al;
 
-        if (s->s3->tmp.reuse_message)
-                {
-                s->s3->tmp.reuse_message=0;
-                if ((mt >= 0) && (s->s3->tmp.message_type != mt))
-                        {
-                        al=SSL_AD_UNEXPECTED_MESSAGE;
-                        SSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_UNEXPECTED_MESSAGE);
+        if (s->s3->tmp.reuse_message) {
+                s->s3->tmp.reuse_message = 0;
+                if ((mt >= 0) && (s->s3->tmp.message_type != mt)) {
+                        al = SSL_AD_UNEXPECTED_MESSAGE;
+                        SSLerr(SSL_F_SSL3_GET_MESSAGE, SSL_R_UNEXPECTED_MESSAGE);
                         goto f_err;
-                        }
-                *ok=1;
+                }
+                *ok = 1;
                 s->init_msg = s->init_buf->data + 4;
                 s->init_num = (int)s->s3->tmp.message_size;
                 return s->init_num;
-                }
+        }
 
-        p=(unsigned char *)s->init_buf->data;
+        p = (unsigned char *)s->init_buf->data;
 
         if (s->state == st1) /* s->init_num < 4 */
-                {
+        {
                 int skip_message;
 
-                do
-                        {
-                        while (s->init_num < 4)
-                                {
-                                i=s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE,
-                                        &p[s->init_num],4 - s->init_num, 0);
-                                if (i <= 0)
-                                        {
-                                        s->rwstate=SSL_READING;
+                do {
+                        while (s->init_num < 4) {
+                                i = s->method->ssl_read_bytes(s,
+                                    SSL3_RT_HANDSHAKE, &p[s->init_num],
+                                    4 - s->init_num, 0);
+                                if (i <= 0) {
+                                        s->rwstate = SSL_READING;
                                         *ok = 0;
                                         return i;
-                                        }
-                                s->init_num+=i;
                                 }
-                        
+                                s->init_num += i;
+                        }
+
                         skip_message = 0;
                         if (!s->server)
                                 if (p[0] == SSL3_MT_HELLO_REQUEST)
@@ -465,79 +442,72 @@ long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
                                          * we are doing a handshake anyway now, so ignore them
                                          * if their format is correct. Does not count for
                                          * 'Finished' MAC. */
-                                        if (p[1] == 0 && p[2] == 0 &&p[3] == 0)
-                                                {
-                                                s->init_num = 0;
-                                                skip_message = 1;
-
-                                                if (s->msg_callback)
-                                                        s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, p, 4, s, s->msg_callback_arg);
-                                                }
+                        if (p[1] == 0 && p[2] == 0 &&p[3] == 0) {
+                                s->init_num = 0;
+                                skip_message = 1;
+
+                                if (s->msg_callback)
+                                        s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, p, 4, s, s->msg_callback_arg);
                         }
+                }
                 while (skip_message);
 
                 /* s->init_num == 4 */
 
-                if ((mt >= 0) && (*p != mt))
-                        {
-                        al=SSL_AD_UNEXPECTED_MESSAGE;
-                        SSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_UNEXPECTED_MESSAGE);
+                if ((mt >= 0) && (*p != mt)) {
+                        al = SSL_AD_UNEXPECTED_MESSAGE;
+                        SSLerr(SSL_F_SSL3_GET_MESSAGE, SSL_R_UNEXPECTED_MESSAGE);
                         goto f_err;
-                        }
+                }
                 if ((mt < 0) && (*p == SSL3_MT_CLIENT_HELLO) &&
-                                        (st1 == SSL3_ST_SR_CERT_A) &&
-                                        (stn == SSL3_ST_SR_CERT_B))
-                        {
+                    (st1 == SSL3_ST_SR_CERT_A) && (stn == SSL3_ST_SR_CERT_B)) {
                         /* At this point we have got an MS SGC second client
                          * hello (maybe we should always allow the client to
                          * start a new handshake?). We need to restart the mac.
                          * Don't increment {num,total}_renegotiations because
                          * we have not completed the handshake. */
                         ssl3_init_finished_mac(s);
-                        }
+                }
 
                 s->s3->tmp.message_type= *(p++);
 
-                n2l3(p,l);
-                if (l > (unsigned long)max)
-                        {
-                        al=SSL_AD_ILLEGAL_PARAMETER;
-                        SSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_EXCESSIVE_MESSAGE_SIZE);
+                n2l3(p, l);
+                if (l > (unsigned long)max) {
+                        al = SSL_AD_ILLEGAL_PARAMETER;
+                        SSLerr(SSL_F_SSL3_GET_MESSAGE, SSL_R_EXCESSIVE_MESSAGE_SIZE);
                         goto f_err;
-                        }
+                }
                 if (l > (INT_MAX-4)) /* BUF_MEM_grow takes an 'int' parameter */
-                        {
-                        al=SSL_AD_ILLEGAL_PARAMETER;
-                        SSLerr(SSL_F_SSL3_GET_MESSAGE,SSL_R_EXCESSIVE_MESSAGE_SIZE);
+                {
+                        al = SSL_AD_ILLEGAL_PARAMETER;
+                        SSLerr(SSL_F_SSL3_GET_MESSAGE, SSL_R_EXCESSIVE_MESSAGE_SIZE);
                         goto f_err;
-                        }
-                if (l && !BUF_MEM_grow_clean(s->init_buf,(int)l+4))
-                        {
-                        SSLerr(SSL_F_SSL3_GET_MESSAGE,ERR_R_BUF_LIB);
+                }
+                if (l && !BUF_MEM_grow_clean(s->init_buf,(int)l + 4)) {
+                        SSLerr(SSL_F_SSL3_GET_MESSAGE, ERR_R_BUF_LIB);
                         goto err;
-                        }
-                s->s3->tmp.message_size=l;
-                s->state=stn;
+                }
+                s->s3->tmp.message_size = l;
+                s->state = stn;
 
                 s->init_msg = s->init_buf->data + 4;
                 s->init_num = 0;
-                }
+        }
 
         /* next state (stn) */
         p = s->init_msg;
         n = s->s3->tmp.message_size - s->init_num;
-        while (n > 0)
-                {
-                i=s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],n,0);
-                if (i <= 0)
-                        {
-                        s->rwstate=SSL_READING;
+        while (n > 0) {
+                i = s->method->ssl_read_bytes(s, SSL3_RT_HANDSHAKE,
+                    &p[s->init_num], n, 0);
+                if (i <= 0) {
+                        s->rwstate = SSL_READING;
                         *ok = 0;
                         return i;
-                        }
+                }
                 s->init_num += i;
                 n -= i;
-                }
+        }
 
 #ifndef OPENSSL_NO_NEXTPROTONEG
         /* If receiving Finished, record MAC of prior handshake messages for
@@ -550,64 +520,60 @@ long ssl3_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
         ssl3_finish_mac(s, (unsigned char *)s->init_buf->data, s->init_num + 4);
         if (s->msg_callback)
                 s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, s->init_buf->data, (size_t)s->init_num + 4, s, s->msg_callback_arg);
-        *ok=1;
+        *ok = 1;
         return s->init_num;
 f_err:
-        ssl3_send_alert(s,SSL3_AL_FATAL,al);
+        ssl3_send_alert(s, SSL3_AL_FATAL, al);
 err:
-        *ok=0;
-        return(-1);
-        }
+        *ok = 0;
+        return (-1);
+}
 
-int ssl_cert_type(X509 *x, EVP_PKEY *pkey)
-        {
+int
+ssl_cert_type(X509 *x, EVP_PKEY *pkey)
+{
         EVP_PKEY *pk;
-        int ret= -1,i;
+        int ret = -1, i;
 
         if (pkey == NULL)
-                pk=X509_get_pubkey(x);
+                pk = X509_get_pubkey(x);
         else
-                pk=pkey;
-        if (pk == NULL) goto err;
-
-        i=pk->type;
-        if (i == EVP_PKEY_RSA)
-                {
-                ret=SSL_PKEY_RSA_ENC;
-                }
-        else if (i == EVP_PKEY_DSA)
-                {
-                ret=SSL_PKEY_DSA_SIGN;
-                }
+                pk = pkey;
+        if (pk == NULL)
+                goto err;
+
+        i = pk->type;
+        if (i == EVP_PKEY_RSA) {
+                ret = SSL_PKEY_RSA_ENC;
+        } else if (i == EVP_PKEY_DSA) {
+                ret = SSL_PKEY_DSA_SIGN;
+        }
 #ifndef OPENSSL_NO_EC
-        else if (i == EVP_PKEY_EC)
-                {
+        else if (i == EVP_PKEY_EC) {
                 ret = SSL_PKEY_ECC;
-                }       
+        }
 #endif
-        else if (i == NID_id_GostR3410_94 || i == NID_id_GostR3410_94_cc) 
-                {
+        else if (i == NID_id_GostR3410_94 || i == NID_id_GostR3410_94_cc) {
                 ret = SSL_PKEY_GOST94;
-                }
-        else if (i == NID_id_GostR3410_2001 || i == NID_id_GostR3410_2001_cc) 
-                {
+        } else if (i == NID_id_GostR3410_2001 || i == NID_id_GostR3410_2001_cc) {
                 ret = SSL_PKEY_GOST01;
-                }
-err:
-        if(!pkey) EVP_PKEY_free(pk);
-        return(ret);
         }
+err:
+        if (!pkey)
+                EVP_PKEY_free(pk);
+        return (ret);
+}
 
-int ssl_verify_alarm_type(long type)
-        {
+int
+ssl_verify_alarm_type(long type)
+{
         int al;
 
-        switch(type)
-                {
+        switch (type) {
         case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
         case X509_V_ERR_UNABLE_TO_GET_CRL:
         case X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER:
-                al=SSL_AD_UNKNOWN_CA;
+                al = SSL_AD_UNKNOWN_CA;
                 break;
         case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE:
         case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE:
@@ -620,21 +586,21 @@ int ssl_verify_alarm_type(long type)
         case X509_V_ERR_CRL_NOT_YET_VALID:
         case X509_V_ERR_CERT_UNTRUSTED:
         case X509_V_ERR_CERT_REJECTED:
-                al=SSL_AD_BAD_CERTIFICATE;
+                al = SSL_AD_BAD_CERTIFICATE;
                 break;
         case X509_V_ERR_CERT_SIGNATURE_FAILURE:
         case X509_V_ERR_CRL_SIGNATURE_FAILURE:
-                al=SSL_AD_DECRYPT_ERROR;
+                al = SSL_AD_DECRYPT_ERROR;
                 break;
         case X509_V_ERR_CERT_HAS_EXPIRED:
         case X509_V_ERR_CRL_HAS_EXPIRED:
-                al=SSL_AD_CERTIFICATE_EXPIRED;
+                al = SSL_AD_CERTIFICATE_EXPIRED;
                 break;
         case X509_V_ERR_CERT_REVOKED:
-                al=SSL_AD_CERTIFICATE_REVOKED;
+                al = SSL_AD_CERTIFICATE_REVOKED;
                 break;
         case X509_V_ERR_OUT_OF_MEM:
-                al=SSL_AD_INTERNAL_ERROR;
+                al = SSL_AD_INTERNAL_ERROR;
                 break;
         case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
         case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
@@ -643,20 +609,20 @@ int ssl_verify_alarm_type(long type)
         case X509_V_ERR_CERT_CHAIN_TOO_LONG:
         case X509_V_ERR_PATH_LENGTH_EXCEEDED:
         case X509_V_ERR_INVALID_CA:
-                al=SSL_AD_UNKNOWN_CA;
+                al = SSL_AD_UNKNOWN_CA;
                 break;
         case X509_V_ERR_APPLICATION_VERIFICATION:
-                al=SSL_AD_HANDSHAKE_FAILURE;
+                al = SSL_AD_HANDSHAKE_FAILURE;
                 break;
         case X509_V_ERR_INVALID_PURPOSE:
-                al=SSL_AD_UNSUPPORTED_CERTIFICATE;
+                al = SSL_AD_UNSUPPORTED_CERTIFICATE;
                 break;
         default:
-                al=SSL_AD_CERTIFICATE_UNKNOWN;
+                al = SSL_AD_CERTIFICATE_UNKNOWN;
                 break;
-                }
-        return(al);
         }
+        return (al);
+}
 
 #ifndef OPENSSL_NO_BUF_FREELISTS
 /* On some platforms, malloc() performance is bad enough that you can't just
@@ -680,7 +646,7 @@ int ssl_verify_alarm_type(long type)
  */
 static void *
 freelist_extract(SSL_CTX *ctx, int for_read, int sz)
-        {
+{
         SSL3_BUF_FREELIST *list;
         SSL3_BUF_FREELIST_ENTRY *ent = NULL;
         void *result = NULL;
@@ -689,13 +655,12 @@ freelist_extract(SSL_CTX *ctx, int for_read, int sz)
         list = for_read ? ctx->rbuf_freelist : ctx->wbuf_freelist;
         if (list != NULL && sz == (int)list->chunklen)
                 ent = list->head;
-        if (ent != NULL)
-                {
+        if (ent != NULL) {
                 list->head = ent->next;
                 result = ent;
                 if (--list->len == 0)
                         list->chunklen = 0;
-                }
+        }
         CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
         if (!result)
                 result = OPENSSL_malloc(sz);
@@ -704,80 +669,76 @@ freelist_extract(SSL_CTX *ctx, int for_read, int sz)
 
 static void
 freelist_insert(SSL_CTX *ctx, int for_read, size_t sz, void *mem)
-        {
+{
         SSL3_BUF_FREELIST *list;
         SSL3_BUF_FREELIST_ENTRY *ent;
 
         CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
         list = for_read ? ctx->rbuf_freelist : ctx->wbuf_freelist;
-        if (list != NULL &&
-            (sz == list->chunklen || list->chunklen == 0) &&
-            list->len < ctx->freelist_max_len &&
-            sz >= sizeof(*ent))
-                {
+        if (list != NULL && (sz == list->chunklen || list->chunklen == 0) &&
+            list->len < ctx->freelist_max_len && sz >= sizeof(*ent)) {
                 list->chunklen = sz;
                 ent = mem;
                 ent->next = list->head;
                 list->head = ent;
                 ++list->len;
                 mem = NULL;
-                }
+        }
 
         CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
         if (mem)
                 OPENSSL_free(mem);
-        }
+}
 #else
 #define freelist_extract(c,fr,sz) OPENSSL_malloc(sz)
 #define freelist_insert(c,fr,sz,m) OPENSSL_free(m)
 #endif
 
-int ssl3_setup_read_buffer(SSL *s)
-        {
+int
+ssl3_setup_read_buffer(SSL *s)
+{
         unsigned char *p;
-        size_t len,align=0,headerlen;
-        
+        size_t len, align = 0, headerlen;
+
         if (SSL_version(s) == DTLS1_VERSION || SSL_version(s) == DTLS1_BAD_VER)
                 headerlen = DTLS1_RT_HEADER_LENGTH;
         else
                 headerlen = SSL3_RT_HEADER_LENGTH;
 
 #if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD!=0
-        align = (-SSL3_RT_HEADER_LENGTH)&(SSL3_ALIGN_PAYLOAD-1);
+        align = (-SSL3_RT_HEADER_LENGTH)&(SSL3_ALIGN_PAYLOAD - 1);
 #endif
 
-        if (s->s3->rbuf.buf == NULL)
-                {
-                len = SSL3_RT_MAX_PLAIN_LENGTH
-                        + SSL3_RT_MAX_ENCRYPTED_OVERHEAD
-                        + headerlen + align;
-                if (s->options & SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER)
-                        {
+        if (s->s3->rbuf.buf == NULL) {
+                len = SSL3_RT_MAX_PLAIN_LENGTH +
+                    SSL3_RT_MAX_ENCRYPTED_OVERHEAD + headerlen + align;
+                if (s->options & SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER) {
                         s->s3->init_extra = 1;
                         len += SSL3_RT_MAX_EXTRA;
-                        }
+                }
 #ifndef OPENSSL_NO_COMP
                 if (!(s->options & SSL_OP_NO_COMPRESSION))
                         len += SSL3_RT_MAX_COMPRESSED_OVERHEAD;
 #endif
-                if ((p=freelist_extract(s->ctx, 1, len)) == NULL)
+                if ((p = freelist_extract(s->ctx, 1, len)) == NULL)
                         goto err;
                 s->s3->rbuf.buf = p;
                 s->s3->rbuf.len = len;
-                }
+        }
 
-        s->packet= &(s->s3->rbuf.buf[0]);
+        s->packet = &(s->s3->rbuf.buf[0]);
         return 1;
 
 err:
-        SSLerr(SSL_F_SSL3_SETUP_READ_BUFFER,ERR_R_MALLOC_FAILURE);
+        SSLerr(SSL_F_SSL3_SETUP_READ_BUFFER, ERR_R_MALLOC_FAILURE);
         return 0;
-        }
+}
 
-int ssl3_setup_write_buffer(SSL *s)
-        {
+int
+ssl3_setup_write_buffer(SSL *s)
+{
         unsigned char *p;
-        size_t len,align=0,headerlen;
+        size_t len, align = 0, headerlen;
 
         if (SSL_version(s) == DTLS1_VERSION || SSL_version(s) == DTLS1_BAD_VER)
                 headerlen = DTLS1_RT_HEADER_LENGTH + 1;
@@ -785,62 +746,61 @@ int ssl3_setup_write_buffer(SSL *s)
                 headerlen = SSL3_RT_HEADER_LENGTH;
 
 #if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD!=0
-        align = (-SSL3_RT_HEADER_LENGTH)&(SSL3_ALIGN_PAYLOAD-1);
+        align = (-SSL3_RT_HEADER_LENGTH)&(SSL3_ALIGN_PAYLOAD - 1);
 #endif
 
-        if (s->s3->wbuf.buf == NULL)
-                {
-                len = s->max_send_fragment
-                        + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD
-                        + headerlen + align;
+        if (s->s3->wbuf.buf == NULL) {
+                len = s->max_send_fragment +
+                    SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD + headerlen + align;
 #ifndef OPENSSL_NO_COMP
                 if (!(s->options & SSL_OP_NO_COMPRESSION))
                         len += SSL3_RT_MAX_COMPRESSED_OVERHEAD;
 #endif
                 if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS))
-                        len += headerlen + align
-                                + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD;
+                        len += headerlen + align +
+                            SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD;
 
-                if ((p=freelist_extract(s->ctx, 0, len)) == NULL)
+                if ((p = freelist_extract(s->ctx, 0, len)) == NULL)
                         goto err;
                 s->s3->wbuf.buf = p;
                 s->s3->wbuf.len = len;
-                }
+        }
 
         return 1;
 
 err:
-        SSLerr(SSL_F_SSL3_SETUP_WRITE_BUFFER,ERR_R_MALLOC_FAILURE);
+        SSLerr(SSL_F_SSL3_SETUP_WRITE_BUFFER, ERR_R_MALLOC_FAILURE);
         return 0;
-        }
+}
 
 
-int ssl3_setup_buffers(SSL *s)
-        {
+int
+ssl3_setup_buffers(SSL *s)
+{
         if (!ssl3_setup_read_buffer(s))
                 return 0;
         if (!ssl3_setup_write_buffer(s))
                 return 0;
         return 1;
-        }
+}
 
-int ssl3_release_write_buffer(SSL *s)
-        {
-        if (s->s3->wbuf.buf != NULL)
-                {
+int
+ssl3_release_write_buffer(SSL *s)
+{
+        if (s->s3->wbuf.buf != NULL) {
                 freelist_insert(s->ctx, 0, s->s3->wbuf.len, s->s3->wbuf.buf);
                 s->s3->wbuf.buf = NULL;
-                }
-        return 1;
         }
+        return 1;
+}
 
-int ssl3_release_read_buffer(SSL *s)
-        {
-        if (s->s3->rbuf.buf != NULL)
-                {
+int
+ssl3_release_read_buffer(SSL *s)
+{
+        if (s->s3->rbuf.buf != NULL) {
                 freelist_insert(s->ctx, 1, s->s3->rbuf.len, s->s3->rbuf.buf);
                 s->s3->rbuf.buf = NULL;
-                }
-        return 1;
         }
+        return 1;
+}
 
diff --git a/src/lib/libssl/src/ssl/s3_cbc.c b/src/lib/libssl/src/ssl/s3_cbc.c
index 443a31e746..d6cc9b4771 100644
--- a/src/lib/libssl/src/ssl/s3_cbc.c
+++ b/src/lib/libssl/src/ssl/s3_cbc.c
@@ -73,30 +73,33 @@
  * bits. They use the fact that arithmetic shift shifts-in the sign bit.
  * However, this is not ensured by the C standard so you may need to replace
  * them with something else on odd CPUs. */
-#define DUPLICATE_MSB_TO_ALL(x) ( (unsigned)( (int)(x) >> (sizeof(int)*8-1) ) )
+#define DUPLICATE_MSB_TO_ALL(x) ((unsigned)((int)(x) >> (sizeof(int) * 8 - 1)))
 #define DUPLICATE_MSB_TO_ALL_8(x) ((unsigned char)(DUPLICATE_MSB_TO_ALL(x)))
 
 /* constant_time_lt returns 0xff if a<b and 0x00 otherwise. */
-static unsigned constant_time_lt(unsigned a, unsigned b)
-        {
+static unsigned
+constant_time_lt(unsigned a, unsigned b)
+{
         a -= b;
         return DUPLICATE_MSB_TO_ALL(a);
-        }
+}
 
 /* constant_time_ge returns 0xff if a>=b and 0x00 otherwise. */
-static unsigned constant_time_ge(unsigned a, unsigned b)
-        {
+static unsigned
+constant_time_ge(unsigned a, unsigned b)
+{
         a -= b;
         return DUPLICATE_MSB_TO_ALL(~a);
-        }
+}
 
 /* constant_time_eq_8 returns 0xff if a==b and 0x00 otherwise. */
-static unsigned char constant_time_eq_8(unsigned a, unsigned b)
-        {
+static unsigned char
+constant_time_eq_8(unsigned a, unsigned b)
+{
         unsigned c = a ^ b;
         c--;
         return DUPLICATE_MSB_TO_ALL_8(c);
-        }
+}
 
 /* ssl3_cbc_remove_padding removes padding from the decrypted, SSLv3, CBC
  * record in |rec| by updating |rec->length| in constant time.
@@ -106,11 +109,10 @@ static unsigned char constant_time_eq_8(unsigned a, unsigned b)
  *   0: (in non-constant time) if the record is publicly invalid.
  *   1: if the padding was valid
  *  -1: otherwise. */
-int ssl3_cbc_remove_padding(const SSL* s,
-                            SSL3_RECORD *rec,
-                            unsigned block_size,
-                            unsigned mac_size)
-        {
+int
+ssl3_cbc_remove_padding(const SSL* s, SSL3_RECORD *rec, unsigned block_size,
+    unsigned mac_size)
+{
         unsigned padding_length, good;
         const unsigned overhead = 1 /* padding length byte */ + mac_size;
 
@@ -119,13 +121,13 @@ int ssl3_cbc_remove_padding(const SSL* s,
         if (overhead > rec->length)
                 return 0;
 
-        padding_length = rec->data[rec->length-1];
-        good = constant_time_ge(rec->length, padding_length+overhead);
+        padding_length = rec->data[rec->length - 1];
+        good = constant_time_ge(rec->length, padding_length + overhead);
         /* SSLv3 requires that the padding is minimal. */
-        good &= constant_time_ge(block_size, padding_length+1);
-        padding_length = good & (padding_length+1);
+        good &= constant_time_ge(block_size, padding_length + 1);
+        padding_length = good & (padding_length + 1);
         rec->length -= padding_length;
-        rec->type |= padding_length<<8; /* kludge: pass padding length */
+        rec->type |= padding_length << 8; /* kludge: pass padding length */
         return (int)((good & 1) | (~good & -1));
 }
 
@@ -140,16 +142,14 @@ int ssl3_cbc_remove_padding(const SSL* s,
  *   0: (in non-constant time) if the record is publicly invalid.
  *   1: if the padding was valid
  *  -1: otherwise. */
-int tls1_cbc_remove_padding(const SSL* s,
-                            SSL3_RECORD *rec,
-                            unsigned block_size,
-                            unsigned mac_size)
-        {
+int
+tls1_cbc_remove_padding(const SSL* s, SSL3_RECORD *rec, unsigned block_size,
+    unsigned mac_size)
+{
         unsigned padding_length, good, to_check, i;
         const unsigned overhead = 1 /* padding length byte */ + mac_size;
         /* Check if version requires explicit IV */
-        if (s->version >= TLS1_1_VERSION || s->version == DTLS1_BAD_VER)
-                {
+        if (s->version >= TLS1_1_VERSION || s->version == DTLS1_BAD_VER) {
                 /* These lengths are all public so we can test them in
                  * non-constant time.
                  */
@@ -159,40 +159,35 @@ int tls1_cbc_remove_padding(const SSL* s,
                 rec->data += block_size;
                 rec->input += block_size;
                 rec->length -= block_size;
-                }
-        else if (overhead > rec->length)
+        } else if (overhead > rec->length)
                 return 0;
 
-        padding_length = rec->data[rec->length-1];
+        padding_length = rec->data[rec->length - 1];
 
         /* NB: if compression is in operation the first packet may not be of
          * even length so the padding bug check cannot be performed. This bug
          * workaround has been around since SSLeay so hopefully it is either
          * fixed now or no buggy implementation supports compression [steve]
          */
-        if ( (s->options&SSL_OP_TLS_BLOCK_PADDING_BUG) && !s->expand)
-                {
+        if ((s->options & SSL_OP_TLS_BLOCK_PADDING_BUG) && !s->expand) {
                 /* First packet is even in size, so check */
-                if ((memcmp(s->s3->read_sequence, "\0\0\0\0\0\0\0\0",8) == 0) &&
-                    !(padding_length & 1))
-                        {
+                if ((memcmp(s->s3->read_sequence, "\0\0\0\0\0\0\0\0", 8) == 0) &&
+                    !(padding_length & 1)) {
                         s->s3->flags|=TLS1_FLAGS_TLS_PADDING_BUG;
-                        }
+                }
                 if ((s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG) &&
-                    padding_length > 0)
-                        {
+                    padding_length > 0) {
                         padding_length--;
-                        }
                 }
+        }
 
-        if (EVP_CIPHER_flags(s->enc_read_ctx->cipher)&EVP_CIPH_FLAG_AEAD_CIPHER)
-                {
+        if (EVP_CIPHER_flags(s->enc_read_ctx->cipher) & EVP_CIPH_FLAG_AEAD_CIPHER) {
                 /* padding is already verified */
                 rec->length -= padding_length + 1;
                 return 1;
-                }
+        }
 
-        good = constant_time_ge(rec->length, overhead+padding_length);
+        good = constant_time_ge(rec->length, overhead + padding_length);
         /* The padding consists of a length byte at the end of the record and
          * then that many bytes of padding, all with the same value as the
          * length byte. Thus, with the length byte included, there are i+1
@@ -203,17 +198,16 @@ int tls1_cbc_remove_padding(const SSL* s,
          * amount of padding possible. (Again, the length of the record is
          * public information so we can use it.) */
         to_check = 255; /* maximum amount of padding. */
-        if (to_check > rec->length-1)
-                to_check = rec->length-1;
+        if (to_check > rec->length - 1)
+                to_check = rec->length - 1;
 
-        for (i = 0; i < to_check; i++)
-                {
+        for (i = 0; i < to_check; i++) {
                 unsigned char mask = constant_time_ge(padding_length, i);
-                unsigned char b = rec->data[rec->length-1-i];
+                unsigned char b = rec->data[rec->length - 1 - i];
                 /* The final |padding_length+1| bytes should all have the value
                  * |padding_length|. Therefore the XOR should be zero. */
                 good &= ~(mask&(padding_length ^ b));
-                }
+        }
 
         /* If any of the final |padding_length+1| bytes had the wrong value,
          * one or more of the lower eight bits of |good| will be cleared. We
@@ -222,15 +216,15 @@ int tls1_cbc_remove_padding(const SSL* s,
         good &= good >> 4;
         good &= good >> 2;
         good &= good >> 1;
-        good <<= sizeof(good)*8-1;
+        good <<= sizeof(good)*8 - 1;
         good = DUPLICATE_MSB_TO_ALL(good);
 
-        padding_length = good & (padding_length+1);
+        padding_length = good & (padding_length + 1);
         rec->length -= padding_length;
         rec->type |= padding_length<<8; /* kludge: pass padding length */
 
         return (int)((good & 1) | (~good & -1));
-        }
+}
 
 /* ssl3_cbc_copy_mac copies |md_size| bytes from the end of |rec| to |out| in
  * constant time (independent of the concrete value of rec->length, which may
@@ -251,12 +245,12 @@ int tls1_cbc_remove_padding(const SSL* s,
  */
 #define CBC_MAC_ROTATE_IN_PLACE
 
-void ssl3_cbc_copy_mac(unsigned char* out,
-                       const SSL3_RECORD *rec,
-                       unsigned md_size,unsigned orig_len)
-        {
+void
+ssl3_cbc_copy_mac(unsigned char* out, const SSL3_RECORD *rec,
+    unsigned md_size, unsigned orig_len)
+{
 #if defined(CBC_MAC_ROTATE_IN_PLACE)
-        unsigned char rotated_mac_buf[64+EVP_MAX_MD_SIZE];
+        unsigned char rotated_mac_buf[64 + EVP_MAX_MD_SIZE];
         unsigned char *rotated_mac;
 #else
         unsigned char rotated_mac[EVP_MAX_MD_SIZE];
@@ -276,7 +270,7 @@ void ssl3_cbc_copy_mac(unsigned char* out,
         OPENSSL_assert(md_size <= EVP_MAX_MD_SIZE);
 
 #if defined(CBC_MAC_ROTATE_IN_PLACE)
-        rotated_mac = rotated_mac_buf + ((0-(size_t)rotated_mac_buf)&63);
+        rotated_mac = rotated_mac_buf + ((0 - (size_t)rotated_mac_buf)&63);
 #endif
 
         /* This information is public so it's safe to branch based on it. */
@@ -290,42 +284,39 @@ void ssl3_cbc_copy_mac(unsigned char* out,
          * figure out that it can remove div_spoiler as that would require it
          * to prove that md_size is always even, which I hope is beyond it. */
         div_spoiler = md_size >> 1;
-        div_spoiler <<= (sizeof(div_spoiler)-1)*8;
+        div_spoiler <<= (sizeof(div_spoiler) - 1) * 8;
         rotate_offset = (div_spoiler + mac_start - scan_start) % md_size;
 
         memset(rotated_mac, 0, md_size);
-        for (i = scan_start, j = 0; i < orig_len; i++)
-                {
+        for (i = scan_start, j = 0; i < orig_len; i++) {
                 unsigned char mac_started = constant_time_ge(i, mac_start);
                 unsigned char mac_ended = constant_time_ge(i, mac_end);
                 unsigned char b = rec->data[i];
                 rotated_mac[j++] |= b & mac_started & ~mac_ended;
-                j &= constant_time_lt(j,md_size);
-                }
+                j &= constant_time_lt(j, md_size);
+        }
 
         /* Now rotate the MAC */
 #if defined(CBC_MAC_ROTATE_IN_PLACE)
         j = 0;
-        for (i = 0; i < md_size; i++)
-                {
+        for (i = 0; i < md_size; i++) {
                 /* in case cache-line is 32 bytes, touch second line */
                 ((volatile unsigned char *)rotated_mac)[rotate_offset^32];
                 out[j++] = rotated_mac[rotate_offset++];
-                rotate_offset &= constant_time_lt(rotate_offset,md_size);
-                }
+                rotate_offset &= constant_time_lt(rotate_offset, md_size);
+        }
 #else
         memset(out, 0, md_size);
         rotate_offset = md_size - rotate_offset;
-        rotate_offset &= constant_time_lt(rotate_offset,md_size);
-        for (i = 0; i < md_size; i++)
-                {
+        rotate_offset &= constant_time_lt(rotate_offset, md_size);
+        for (i = 0; i < md_size; i++) {
                 for (j = 0; j < md_size; j++)
                         out[j] |= rotated_mac[i] & constant_time_eq_8(j, rotate_offset);
                 rotate_offset++;
-                rotate_offset &= constant_time_lt(rotate_offset,md_size);
-                }
-#endif
+                rotate_offset &= constant_time_lt(rotate_offset, md_size);
         }
+#endif
+}
 
 /* u32toLE serialises an unsigned, 32-bit number (n) as four bytes at (p) in
  * little-endian order. The value of p is advanced by four. */
@@ -338,81 +329,83 @@ void ssl3_cbc_copy_mac(unsigned char* out,
 /* These functions serialize the state of a hash and thus perform the standard
  * "final" operation without adding the padding and length that such a function
  * typically does. */
-static void tls1_md5_final_raw(void* ctx, unsigned char *md_out)
-        {
+static void
+tls1_md5_final_raw(void* ctx, unsigned char *md_out)
+{
         MD5_CTX *md5 = ctx;
         u32toLE(md5->A, md_out);
         u32toLE(md5->B, md_out);
         u32toLE(md5->C, md_out);
         u32toLE(md5->D, md_out);
-        }
+}
 
-static void tls1_sha1_final_raw(void* ctx, unsigned char *md_out)
-        {
+static void
+tls1_sha1_final_raw(void* ctx, unsigned char *md_out)
+{
         SHA_CTX *sha1 = ctx;
         l2n(sha1->h0, md_out);
         l2n(sha1->h1, md_out);
         l2n(sha1->h2, md_out);
         l2n(sha1->h3, md_out);
         l2n(sha1->h4, md_out);
-        }
+}
 #define LARGEST_DIGEST_CTX SHA_CTX
 
 #ifndef OPENSSL_NO_SHA256
-static void tls1_sha256_final_raw(void* ctx, unsigned char *md_out)
-        {
+static void
+tls1_sha256_final_raw(void* ctx, unsigned char *md_out)
+{
         SHA256_CTX *sha256 = ctx;
         unsigned i;
 
-        for (i = 0; i < 8; i++)
-                {
+        for (i = 0; i < 8; i++) {
                 l2n(sha256->h[i], md_out);
-                }
         }
+}
 #undef  LARGEST_DIGEST_CTX
 #define LARGEST_DIGEST_CTX SHA256_CTX
 #endif
 
 #ifndef OPENSSL_NO_SHA512
-static void tls1_sha512_final_raw(void* ctx, unsigned char *md_out)
-        {
+static void
+tls1_sha512_final_raw(void* ctx, unsigned char *md_out)
+{
         SHA512_CTX *sha512 = ctx;
         unsigned i;
 
-        for (i = 0; i < 8; i++)
-                {
+        for (i = 0; i < 8; i++) {
                 l2n8(sha512->h[i], md_out);
-                }
         }
+}
 #undef  LARGEST_DIGEST_CTX
 #define LARGEST_DIGEST_CTX SHA512_CTX
 #endif
 
 /* ssl3_cbc_record_digest_supported returns 1 iff |ctx| uses a hash function
  * which ssl3_cbc_digest_record supports. */
-char ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx)
-        {
+char
+ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx)
+{
 #ifdef OPENSSL_FIPS
         if (FIPS_mode())
                 return 0;
 #endif
-        switch (EVP_MD_CTX_type(ctx))
-                {
-                case NID_md5:
-                case NID_sha1:
+        switch (EVP_MD_CTX_type(ctx)) {
+        case NID_md5:
+        case NID_sha1:
 #ifndef OPENSSL_NO_SHA256
-                case NID_sha224:
-                case NID_sha256:
+        case NID_sha224:
+        case NID_sha256:
 #endif
 #ifndef OPENSSL_NO_SHA512
-                case NID_sha384:
-                case NID_sha512:
+        case NID_sha384:
+        case NID_sha512:
 #endif
-                        return 1;
-                default:
-                        return 0;
-                }
+                return 1;
+        default:
+                return 0;
         }
+}
 
 /* ssl3_cbc_digest_record computes the MAC of a decrypted, padded SSLv3/TLS
  * record.
@@ -433,26 +426,21 @@ char ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx)
  * functions, above, we know that data_plus_mac_size is large enough to contain
  * a padding byte and MAC. (If the padding was invalid, it might contain the
  * padding too. ) */
-void ssl3_cbc_digest_record(
-        const EVP_MD_CTX *ctx,
-        unsigned char* md_out,
-        size_t* md_out_size,
-        const unsigned char header[13],
-        const unsigned char *data,
-        size_t data_plus_mac_size,
-        size_t data_plus_mac_plus_padding_size,
-        const unsigned char *mac_secret,
-        unsigned mac_secret_length,
-        char is_sslv3)
-        {
+void ssl3_cbc_digest_record(const EVP_MD_CTX *ctx, unsigned char* md_out,
+    size_t* md_out_size, const unsigned char header[13],
+    const unsigned char *data, size_t data_plus_mac_size,
+    size_t data_plus_mac_plus_padding_size, const unsigned char *mac_secret,
+    unsigned mac_secret_length, char is_sslv3)
+{
         union { double align;
-                unsigned char c[sizeof(LARGEST_DIGEST_CTX)]; } md_state;
+                unsigned char c[sizeof(LARGEST_DIGEST_CTX)];
+        } md_state;
         void (*md_final_raw)(void *ctx, unsigned char *md_out);
         void (*md_transform)(void *ctx, const unsigned char *block);
         unsigned md_size, md_block_size = 64;
         unsigned sslv3_pad_length = 40, header_length, variance_blocks,
-                 len, max_mac_bytes, num_blocks,
-                 num_starting_blocks, k, mac_end_offset, c, index_a, index_b;
+        len, max_mac_bytes, num_blocks,
+        num_starting_blocks, k, mac_end_offset, c, index_a, index_b;
         unsigned int bits;      /* at most 18 bits */
         unsigned char length_bytes[MAX_HASH_BIT_COUNT_BYTES];
         /* hmac_pad is the masked HMAC key. */
@@ -470,78 +458,74 @@ void ssl3_cbc_digest_record(
          * many possible overflows later in this function. */
         OPENSSL_assert(data_plus_mac_plus_padding_size < 1024*1024);
 
-        switch (EVP_MD_CTX_type(ctx))
-                {
-                case NID_md5:
-                        MD5_Init((MD5_CTX*)md_state.c);
-                        md_final_raw = tls1_md5_final_raw;
-                        md_transform = (void(*)(void *ctx, const unsigned char *block)) MD5_Transform;
-                        md_size = 16;
-                        sslv3_pad_length = 48;
-                        length_is_big_endian = 0;
-                        break;
-                case NID_sha1:
-                        SHA1_Init((SHA_CTX*)md_state.c);
-                        md_final_raw = tls1_sha1_final_raw;
-                        md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA1_Transform;
-                        md_size = 20;
-                        break;
+        switch (EVP_MD_CTX_type(ctx)) {
+        case NID_md5:
+                MD5_Init((MD5_CTX*)md_state.c);
+                md_final_raw = tls1_md5_final_raw;
+                md_transform = (void(*)(void *ctx, const unsigned char *block)) MD5_Transform;
+                md_size = 16;
+                sslv3_pad_length = 48;
+                length_is_big_endian = 0;
+                break;
+        case NID_sha1:
+                SHA1_Init((SHA_CTX*)md_state.c);
+                md_final_raw = tls1_sha1_final_raw;
+                md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA1_Transform;
+                md_size = 20;
+                break;
 #ifndef OPENSSL_NO_SHA256
-                case NID_sha224:
-                        SHA224_Init((SHA256_CTX*)md_state.c);
-                        md_final_raw = tls1_sha256_final_raw;
-                        md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA256_Transform;
-                        md_size = 224/8;
-                        break;
-                case NID_sha256:
-                        SHA256_Init((SHA256_CTX*)md_state.c);
-                        md_final_raw = tls1_sha256_final_raw;
-                        md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA256_Transform;
-                        md_size = 32;
-                        break;
+        case NID_sha224:
+                SHA224_Init((SHA256_CTX*)md_state.c);
+                md_final_raw = tls1_sha256_final_raw;
+                md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA256_Transform;
+                md_size = 224/8;
+                break;
+        case NID_sha256:
+                SHA256_Init((SHA256_CTX*)md_state.c);
+                md_final_raw = tls1_sha256_final_raw;
+                md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA256_Transform;
+                md_size = 32;
+                break;
 #endif
 #ifndef OPENSSL_NO_SHA512
-                case NID_sha384:
-                        SHA384_Init((SHA512_CTX*)md_state.c);
-                        md_final_raw = tls1_sha512_final_raw;
-                        md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA512_Transform;
-                        md_size = 384/8;
-                        md_block_size = 128;
-                        md_length_size = 16;
-                        break;
-                case NID_sha512:
-                        SHA512_Init((SHA512_CTX*)md_state.c);
-                        md_final_raw = tls1_sha512_final_raw;
-                        md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA512_Transform;
-                        md_size = 64;
-                        md_block_size = 128;
-                        md_length_size = 16;
-                        break;
+        case NID_sha384:
+                SHA384_Init((SHA512_CTX*)md_state.c);
+                md_final_raw = tls1_sha512_final_raw;
+                md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA512_Transform;
+                md_size = 384/8;
+                md_block_size = 128;
+                md_length_size = 16;
+                break;
+        case NID_sha512:
+                SHA512_Init((SHA512_CTX*)md_state.c);
+                md_final_raw = tls1_sha512_final_raw;
+                md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA512_Transform;
+                md_size = 64;
+                md_block_size = 128;
+                md_length_size = 16;
+                break;
 #endif
-                default:
-                        /* ssl3_cbc_record_digest_supported should have been
-                         * called first to check that the hash function is
-                         * supported. */
-                        OPENSSL_assert(0);
-                        if (md_out_size)
-                                *md_out_size = -1;
-                        return;
-                }
+        default:
+                /* ssl3_cbc_record_digest_supported should have been
+                 * called first to check that the hash function is
+                 * supported. */
+                OPENSSL_assert(0);
+                if (md_out_size)
+                        *md_out_size = -1;
+                return;
+        }
 
         OPENSSL_assert(md_length_size <= MAX_HASH_BIT_COUNT_BYTES);
         OPENSSL_assert(md_block_size <= MAX_HASH_BLOCK_SIZE);
         OPENSSL_assert(md_size <= EVP_MAX_MD_SIZE);
 
         header_length = 13;
-        if (is_sslv3)
-                {
-                header_length =
-                        mac_secret_length +
-                        sslv3_pad_length +
-                        8 /* sequence number */ +
-                        1 /* record type */ +
-                        2 /* record length */;
-                }
+        if (is_sslv3) {
+                header_length = mac_secret_length + sslv3_pad_length +
+                    8 /* sequence number */ +
+                    1 /* record type */ +
+                    2 /* record length */;
+        }
 
         /* variance_blocks is the number of blocks of the hash that we have to
          * calculate in constant time because they could be altered by the
@@ -597,15 +581,13 @@ void ssl3_cbc_digest_record(
 
         /* For SSLv3, if we're going to have any starting blocks then we need
          * at least two because the header is larger than a single block. */
-        if (num_blocks > variance_blocks + (is_sslv3 ? 1 : 0))
-                {
+        if (num_blocks > variance_blocks + (is_sslv3 ? 1 : 0)) {
                 num_starting_blocks = num_blocks - variance_blocks;
                 k = md_block_size*num_starting_blocks;
-                }
+        }
 
         bits = 8*mac_end_offset;
-        if (!is_sslv3)
-                {
+        if (!is_sslv3) {
                 /* Compute the initial HMAC block. For SSLv3, the padding and
                  * secret bytes are included in |header| because they take more
                  * than a single block. */
@@ -617,51 +599,44 @@ void ssl3_cbc_digest_record(
                         hmac_pad[i] ^= 0x36;
 
                 md_transform(md_state.c, hmac_pad);
-                }
+        }
 
-        if (length_is_big_endian)
-                {
-                memset(length_bytes,0,md_length_size-4);
-                length_bytes[md_length_size-4] = (unsigned char)(bits>>24);
-                length_bytes[md_length_size-3] = (unsigned char)(bits>>16);
-                length_bytes[md_length_size-2] = (unsigned char)(bits>>8);
-                length_bytes[md_length_size-1] = (unsigned char)bits;
-                }
-        else
-                {
-                memset(length_bytes,0,md_length_size);
-                length_bytes[md_length_size-5] = (unsigned char)(bits>>24);
-                length_bytes[md_length_size-6] = (unsigned char)(bits>>16);
-                length_bytes[md_length_size-7] = (unsigned char)(bits>>8);
-                length_bytes[md_length_size-8] = (unsigned char)bits;
-                }
+        if (length_is_big_endian) {
+                memset(length_bytes, 0, md_length_size - 4);
+                length_bytes[md_length_size - 4] = (unsigned char)(bits >> 24);
+                length_bytes[md_length_size - 3] = (unsigned char)(bits >> 16);
+                length_bytes[md_length_size - 2] = (unsigned char)(bits >> 8);
+                length_bytes[md_length_size - 1] = (unsigned char)bits;
+        } else {
+                memset(length_bytes, 0, md_length_size);
+                length_bytes[md_length_size - 5] = (unsigned char)(bits >> 24);
+                length_bytes[md_length_size - 6] = (unsigned char)(bits >> 16);
+                length_bytes[md_length_size - 7] = (unsigned char)(bits >> 8);
+                length_bytes[md_length_size - 8] = (unsigned char)bits;
+        }
 
-        if (k > 0)
-                {
-                if (is_sslv3)
-                        {
+        if (k > 0) {
+                if (is_sslv3) {
                         /* The SSLv3 header is larger than a single block.
                          * overhang is the number of bytes beyond a single
                          * block that the header consumes: either 7 bytes
                          * (SHA1) or 11 bytes (MD5). */
-                        unsigned overhang = header_length-md_block_size;
+                        unsigned overhang = header_length - md_block_size;
                         md_transform(md_state.c, header);
                         memcpy(first_block, header + md_block_size, overhang);
-                        memcpy(first_block + overhang, data, md_block_size-overhang);
+                        memcpy(first_block + overhang, data, md_block_size - overhang);
                         md_transform(md_state.c, first_block);
                         for (i = 1; i < k/md_block_size - 1; i++)
                                 md_transform(md_state.c, data + md_block_size*i - overhang);
-                        }
-                else
-                        {
+                } else {
                         /* k is a multiple of md_block_size. */
                         memcpy(first_block, header, 13);
-                        memcpy(first_block+13, data, md_block_size-13);
+                        memcpy(first_block + 13, data, md_block_size - 13);
                         md_transform(md_state.c, first_block);
                         for (i = 1; i < k/md_block_size; i++)
                                 md_transform(md_state.c, data + md_block_size*i - 13);
-                        }
                 }
+        }
 
         memset(mac_out, 0, sizeof(mac_out));
 
@@ -669,22 +644,20 @@ void ssl3_cbc_digest_record(
          * it in constant time. If the |i==index_a| then we'll include the 0x80
          * bytes and zero pad etc. For each block we selectively copy it, in
          * constant time, to |mac_out|. */
-        for (i = num_starting_blocks; i <= num_starting_blocks+variance_blocks; i++)
-                {
+        for (i = num_starting_blocks; i <= num_starting_blocks + variance_blocks; i++) {
                 unsigned char block[MAX_HASH_BLOCK_SIZE];
                 unsigned char is_block_a = constant_time_eq_8(i, index_a);
                 unsigned char is_block_b = constant_time_eq_8(i, index_b);
-                for (j = 0; j < md_block_size; j++)
-                        {
+                for (j = 0; j < md_block_size; j++) {
                         unsigned char b = 0, is_past_c, is_past_cp1;
                         if (k < header_length)
                                 b = header[k];
                         else if (k < data_plus_mac_plus_padding_size + header_length)
-                                b = data[k-header_length];
+                                b = data[k - header_length];
                         k++;
 
                         is_past_c = is_block_a & constant_time_ge(j, c);
-                        is_past_cp1 = is_block_a & constant_time_ge(j, c+1);
+                        is_past_cp1 = is_block_a & constant_time_ge(j, c + 1);
                         /* If this is the block containing the end of the
                          * application data, and we are at the offset for the
                          * 0x80 value, then overwrite b with 0x80. */
@@ -701,46 +674,42 @@ void ssl3_cbc_digest_record(
 
                         /* The final bytes of one of the blocks contains the
                          * length. */
-                        if (j >= md_block_size - md_length_size)
-                                {
+                        if (j >= md_block_size - md_length_size) {
                                 /* If this is index_b, write a length byte. */
-                                b = (b&~is_block_b) | (is_block_b&length_bytes[j-(md_block_size-md_length_size)]);
-                                }
-                        block[j] = b;
+                                b = (b&~is_block_b) | (is_block_b&length_bytes[j - (md_block_size - md_length_size)]);
                         }
+                        block[j] = b;
+                }
 
                 md_transform(md_state.c, block);
                 md_final_raw(md_state.c, block);
                 /* If this is index_b, copy the hash value to |mac_out|. */
                 for (j = 0; j < md_size; j++)
                         mac_out[j] |= block[j]&is_block_b;
-                }
+        }
 
         EVP_MD_CTX_init(&md_ctx);
         EVP_DigestInit_ex(&md_ctx, ctx->digest, NULL /* engine */);
-        if (is_sslv3)
-                {
+        if (is_sslv3) {
                 /* We repurpose |hmac_pad| to contain the SSLv3 pad2 block. */
                 memset(hmac_pad, 0x5c, sslv3_pad_length);
 
                 EVP_DigestUpdate(&md_ctx, mac_secret, mac_secret_length);
                 EVP_DigestUpdate(&md_ctx, hmac_pad, sslv3_pad_length);
                 EVP_DigestUpdate(&md_ctx, mac_out, md_size);
-                }
-        else
-                {
+        } else {
                 /* Complete the HMAC in the standard manner. */
                 for (i = 0; i < md_block_size; i++)
                         hmac_pad[i] ^= 0x6a;
 
                 EVP_DigestUpdate(&md_ctx, hmac_pad, md_block_size);
                 EVP_DigestUpdate(&md_ctx, mac_out, md_size);
-                }
+        }
         EVP_DigestFinal(&md_ctx, md_out, &md_out_size_u);
         if (md_out_size)
                 *md_out_size = md_out_size_u;
         EVP_MD_CTX_cleanup(&md_ctx);
-        }
+}
 
 #ifdef OPENSSL_FIPS
 
@@ -749,10 +718,10 @@ void ssl3_cbc_digest_record(
  * by digesting additional data.
  */
 
-void tls_fips_digest_extra(
-        const EVP_CIPHER_CTX *cipher_ctx, EVP_MD_CTX *mac_ctx,
-        const unsigned char *data, size_t data_len, size_t orig_len)
-        {
+void tls_fips_digest_extra(const EVP_CIPHER_CTX *cipher_ctx,
+    EVP_MD_CTX *mac_ctx, const unsigned char *data, size_t data_len,
+    size_t orig_len)
+{
         size_t block_size, digest_pad, blocks_data, blocks_orig;
         if (EVP_CIPHER_CTX_mode(cipher_ctx) != EVP_CIPH_CBC_MODE)
                 return;
@@ -785,6 +754,6 @@ void tls_fips_digest_extra(
          * length TLS buffer. 
          */
         EVP_DigestSignUpdate(mac_ctx, data,
-                                (blocks_orig - blocks_data + 1) * block_size);
-        }
+        (blocks_orig - blocks_data + 1) * block_size);
+}
 #endif
diff --git a/src/lib/libssl/src/ssl/s3_enc.c b/src/lib/libssl/src/ssl/s3_enc.c
index e3cd4f062c..4536ca5995 100644
--- a/src/lib/libssl/src/ssl/s3_enc.c
+++ b/src/lib/libssl/src/ssl/s3_enc.c
@@ -140,85 +140,87 @@
 #include <openssl/evp.h>
 #include <openssl/md5.h>
 
-static unsigned char ssl3_pad_1[48]={
-        0x36,0x36,0x36,0x36,0x36,0x36,0x36,0x36,
-        0x36,0x36,0x36,0x36,0x36,0x36,0x36,0x36,
-        0x36,0x36,0x36,0x36,0x36,0x36,0x36,0x36,
-        0x36,0x36,0x36,0x36,0x36,0x36,0x36,0x36,
-        0x36,0x36,0x36,0x36,0x36,0x36,0x36,0x36,
-        0x36,0x36,0x36,0x36,0x36,0x36,0x36,0x36 };
-
-static unsigned char ssl3_pad_2[48]={
-        0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,
-        0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,
-        0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,
-        0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,
-        0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,
-        0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c,0x5c };
-static int ssl3_handshake_mac(SSL *s, int md_nid,
-        const char *sender, int len, unsigned char *p);
-static int ssl3_generate_key_block(SSL *s, unsigned char *km, int num)
-        {
+static unsigned char ssl3_pad_1[48] = {
+        0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
+        0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
+        0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
+        0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
+        0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
+        0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36
+};
+
+static unsigned char ssl3_pad_2[48] = {
+        0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
+        0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
+        0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
+        0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
+        0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
+        0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c
+};
+
+static int ssl3_handshake_mac(SSL *s, int md_nid, const char *sender,
+    int len, unsigned char *p);
+
+static int
+ssl3_generate_key_block(SSL *s, unsigned char *km, int num)
+{
         EVP_MD_CTX m5;
         EVP_MD_CTX s1;
-        unsigned char buf[16],smd[SHA_DIGEST_LENGTH];
-        unsigned char c='A';
-        unsigned int i,j,k;
+        unsigned char buf[16], smd[SHA_DIGEST_LENGTH];
+        unsigned char c = 'A';
+        unsigned int i, j, k;
 
 #ifdef CHARSET_EBCDIC
         c = os_toascii[c]; /*'A' in ASCII */
 #endif
-        k=0;
+        k = 0;
         EVP_MD_CTX_init(&m5);
         EVP_MD_CTX_set_flags(&m5, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
         EVP_MD_CTX_init(&s1);
-        for (i=0; (int)i<num; i+=MD5_DIGEST_LENGTH)
-                {
+        for (i = 0; (int)i < num; i += MD5_DIGEST_LENGTH) {
                 k++;
-                if (k > sizeof buf)
-                        {
+                if (k > sizeof buf) {
                         /* bug: 'buf' is too small for this ciphersuite */
                         SSLerr(SSL_F_SSL3_GENERATE_KEY_BLOCK, ERR_R_INTERNAL_ERROR);
                         return 0;
-                        }
-                
-                for (j=0; j<k; j++)
-                        buf[j]=c;
+                }
+
+                for (j = 0; j < k; j++)
+                        buf[j] = c;
                 c++;
-                EVP_DigestInit_ex(&s1,EVP_sha1(), NULL);
-                EVP_DigestUpdate(&s1,buf,k);
-                EVP_DigestUpdate(&s1,s->session->master_key,
-                        s->session->master_key_length);
-                EVP_DigestUpdate(&s1,s->s3->server_random,SSL3_RANDOM_SIZE);
-                EVP_DigestUpdate(&s1,s->s3->client_random,SSL3_RANDOM_SIZE);
-                EVP_DigestFinal_ex(&s1,smd,NULL);
-
-                EVP_DigestInit_ex(&m5,EVP_md5(), NULL);
-                EVP_DigestUpdate(&m5,s->session->master_key,
-                        s->session->master_key_length);
-                EVP_DigestUpdate(&m5,smd,SHA_DIGEST_LENGTH);
-                if ((int)(i+MD5_DIGEST_LENGTH) > num)
-                        {
-                        EVP_DigestFinal_ex(&m5,smd,NULL);
-                        memcpy(km,smd,(num-i));
-                        }
-                else
-                        EVP_DigestFinal_ex(&m5,km,NULL);
+                EVP_DigestInit_ex(&s1, EVP_sha1(), NULL);
+                EVP_DigestUpdate(&s1, buf, k);
+                EVP_DigestUpdate(&s1, s->session->master_key,
+                s->session->master_key_length);
+                EVP_DigestUpdate(&s1, s->s3->server_random, SSL3_RANDOM_SIZE);
+                EVP_DigestUpdate(&s1, s->s3->client_random, SSL3_RANDOM_SIZE);
+                EVP_DigestFinal_ex(&s1, smd, NULL);
 
-                km+=MD5_DIGEST_LENGTH;
-                }
-        OPENSSL_cleanse(smd,SHA_DIGEST_LENGTH);
+                EVP_DigestInit_ex(&m5, EVP_md5(), NULL);
+                EVP_DigestUpdate(&m5, s->session->master_key,
+                s->session->master_key_length);
+                EVP_DigestUpdate(&m5, smd, SHA_DIGEST_LENGTH);
+                if ((int)(i + MD5_DIGEST_LENGTH) > num) {
+                        EVP_DigestFinal_ex(&m5, smd, NULL);
+                        memcpy(km, smd,(num - i));
+                } else
+                        EVP_DigestFinal_ex(&m5, km, NULL);
+
+                km += MD5_DIGEST_LENGTH;
+        }
+        OPENSSL_cleanse(smd, SHA_DIGEST_LENGTH);
         EVP_MD_CTX_cleanup(&m5);
         EVP_MD_CTX_cleanup(&s1);
         return 1;
-        }
+}
 
-int ssl3_change_cipher_state(SSL *s, int which)
-        {
-        unsigned char *p,*mac_secret;
+int
+ssl3_change_cipher_state(SSL *s, int which)
+{
+        unsigned char *p, *mac_secret;
         unsigned char exp_key[EVP_MAX_KEY_LENGTH];
         unsigned char exp_iv[EVP_MAX_IV_LENGTH];
-        unsigned char *ms,*key,*iv,*er1,*er2;
+        unsigned char *ms, *key, *iv, *er1, *er2;
         EVP_CIPHER_CTX *dd;
         const EVP_CIPHER *c;
 #ifndef OPENSSL_NO_COMP
@@ -226,167 +228,159 @@ int ssl3_change_cipher_state(SSL *s, int which)
 #endif
         const EVP_MD *m;
         EVP_MD_CTX md;
-        int is_exp,n,i,j,k,cl;
+        int is_exp, n, i, j, k, cl;
         int reuse_dd = 0;
 
-        is_exp=SSL_C_IS_EXPORT(s->s3->tmp.new_cipher);
-        c=s->s3->tmp.new_sym_enc;
-        m=s->s3->tmp.new_hash;
+        is_exp = SSL_C_IS_EXPORT(s->s3->tmp.new_cipher);
+        c = s->s3->tmp.new_sym_enc;
+        m = s->s3->tmp.new_hash;
         /* m == NULL will lead to a crash later */
         OPENSSL_assert(m);
 #ifndef OPENSSL_NO_COMP
         if (s->s3->tmp.new_compression == NULL)
-                comp=NULL;
+                comp = NULL;
         else
-                comp=s->s3->tmp.new_compression->method;
+                comp = s->s3->tmp.new_compression->method;
 #endif
 
-        if (which & SSL3_CC_READ)
-                {
+        if (which & SSL3_CC_READ) {
                 if (s->enc_read_ctx != NULL)
                         reuse_dd = 1;
-                else if ((s->enc_read_ctx=OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL)
+                else if ((s->enc_read_ctx = OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL)
                         goto err;
                 else
                         /* make sure it's intialized in case we exit later with an error */
-                        EVP_CIPHER_CTX_init(s->enc_read_ctx);
-                dd= s->enc_read_ctx;
+                EVP_CIPHER_CTX_init(s->enc_read_ctx);
+                dd = s->enc_read_ctx;
 
-                ssl_replace_hash(&s->read_hash,m);
+                ssl_replace_hash(&s->read_hash, m);
 #ifndef OPENSSL_NO_COMP
                 /* COMPRESS */
-                if (s->expand != NULL)
-                        {
+                if (s->expand != NULL) {
                         COMP_CTX_free(s->expand);
-                        s->expand=NULL;
-                        }
-                if (comp != NULL)
-                        {
-                        s->expand=COMP_CTX_new(comp);
-                        if (s->expand == NULL)
-                                {
-                                SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,SSL_R_COMPRESSION_LIBRARY_ERROR);
+                        s->expand = NULL;
+                }
+                if (comp != NULL) {
+                        s->expand = COMP_CTX_new(comp);
+                        if (s->expand == NULL) {
+                                SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE, SSL_R_COMPRESSION_LIBRARY_ERROR);
                                 goto err2;
-                                }
+                        }
                         if (s->s3->rrec.comp == NULL)
-                                s->s3->rrec.comp=(unsigned char *)
-                                        OPENSSL_malloc(SSL3_RT_MAX_PLAIN_LENGTH);
+                                s->s3->rrec.comp = (unsigned char *)
+                        OPENSSL_malloc(SSL3_RT_MAX_PLAIN_LENGTH);
                         if (s->s3->rrec.comp == NULL)
                                 goto err;
-                        }
-#endif
-                memset(&(s->s3->read_sequence[0]),0,8);
-                mac_secret= &(s->s3->read_mac_secret[0]);
                 }
-        else
-                {
+#endif
+                memset(&(s->s3->read_sequence[0]), 0, 8);
+                mac_secret = &(s->s3->read_mac_secret[0]);
+        } else {
                 if (s->enc_write_ctx != NULL)
                         reuse_dd = 1;
-                else if ((s->enc_write_ctx=OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL)
+                else if ((s->enc_write_ctx = OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL)
                         goto err;
                 else
                         /* make sure it's intialized in case we exit later with an error */
-                        EVP_CIPHER_CTX_init(s->enc_write_ctx);
-                dd= s->enc_write_ctx;
-                ssl_replace_hash(&s->write_hash,m);
+                EVP_CIPHER_CTX_init(s->enc_write_ctx);
+                dd = s->enc_write_ctx;
+                ssl_replace_hash(&s->write_hash, m);
 #ifndef OPENSSL_NO_COMP
                 /* COMPRESS */
-                if (s->compress != NULL)
-                        {
+                if (s->compress != NULL) {
                         COMP_CTX_free(s->compress);
-                        s->compress=NULL;
-                        }
-                if (comp != NULL)
-                        {
-                        s->compress=COMP_CTX_new(comp);
-                        if (s->compress == NULL)
-                                {
-                                SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,SSL_R_COMPRESSION_LIBRARY_ERROR);
+                        s->compress = NULL;
+                }
+                if (comp != NULL) {
+                        s->compress = COMP_CTX_new(comp);
+                        if (s->compress == NULL) {
+                                SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE, SSL_R_COMPRESSION_LIBRARY_ERROR);
                                 goto err2;
-                                }
                         }
-#endif
-                memset(&(s->s3->write_sequence[0]),0,8);
-                mac_secret= &(s->s3->write_mac_secret[0]);
                 }
+#endif
+                memset(&(s->s3->write_sequence[0]), 0, 8);
+                mac_secret = &(s->s3->write_mac_secret[0]);
+        }
 
         if (reuse_dd)
                 EVP_CIPHER_CTX_cleanup(dd);
 
-        p=s->s3->tmp.key_block;
-        i=EVP_MD_size(m);
+        p = s->s3->tmp.key_block;
+        i = EVP_MD_size(m);
         if (i < 0)
                 goto err2;
-        cl=EVP_CIPHER_key_length(c);
-        j=is_exp ? (cl < SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher) ?
-                 cl : SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher)) : cl;
+        cl = EVP_CIPHER_key_length(c);
+        j = is_exp ? (cl < SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher) ?
+            cl : SSL_C_EXPORT_KEYLENGTH(s->s3->tmp.new_cipher)) : cl;
         /* Was j=(is_exp)?5:EVP_CIPHER_key_length(c); */
-        k=EVP_CIPHER_iv_length(c);
-        if (    (which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) ||
-                (which == SSL3_CHANGE_CIPHER_SERVER_READ))
-                {
-                ms=  &(p[ 0]); n=i+i;
-                key= &(p[ n]); n+=j+j;
-                iv=  &(p[ n]); n+=k+k;
-                er1= &(s->s3->client_random[0]);
-                er2= &(s->s3->server_random[0]);
-                }
-        else
-                {
-                n=i;
-                ms=  &(p[ n]); n+=i+j;
-                key= &(p[ n]); n+=j+k;
-                iv=  &(p[ n]); n+=k;
-                er1= &(s->s3->server_random[0]);
-                er2= &(s->s3->client_random[0]);
-                }
+        k = EVP_CIPHER_iv_length(c);
+        if ((which == SSL3_CHANGE_CIPHER_CLIENT_WRITE) ||
+            (which == SSL3_CHANGE_CIPHER_SERVER_READ)) {
+                ms = &(p[0]);
+                n = i + i;
+                key = &(p[n]);
+                n += j + j;
+                iv = &(p[n]);
+                n += k + k;
+                er1 = &(s->s3->client_random[0]);
+                er2 = &(s->s3->server_random[0]);
+        } else {
+                n = i;
+                ms = &(p[n]);
+                n += i + j;
+                key = &(p[n]);
+                n += j + k;
+                iv = &(p[n]);
+                n += k;
+                er1 = &(s->s3->server_random[0]);
+                er2 = &(s->s3->client_random[0]);
+        }
 
-        if (n > s->s3->tmp.key_block_length)
-                {
-                SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,ERR_R_INTERNAL_ERROR);
+        if (n > s->s3->tmp.key_block_length) {
+                SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE, ERR_R_INTERNAL_ERROR);
                 goto err2;
-                }
+        }
 
         EVP_MD_CTX_init(&md);
-        memcpy(mac_secret,ms,i);
-        if (is_exp)
-                {
+        memcpy(mac_secret, ms, i);
+        if (is_exp) {
                 /* In here I set both the read and write key/iv to the
                  * same value since only the correct one will be used :-).
                  */
-                EVP_DigestInit_ex(&md,EVP_md5(), NULL);
-                EVP_DigestUpdate(&md,key,j);
-                EVP_DigestUpdate(&md,er1,SSL3_RANDOM_SIZE);
-                EVP_DigestUpdate(&md,er2,SSL3_RANDOM_SIZE);
-                EVP_DigestFinal_ex(&md,&(exp_key[0]),NULL);
-                key= &(exp_key[0]);
-
-                if (k > 0)
-                        {
-                        EVP_DigestInit_ex(&md,EVP_md5(), NULL);
-                        EVP_DigestUpdate(&md,er1,SSL3_RANDOM_SIZE);
-                        EVP_DigestUpdate(&md,er2,SSL3_RANDOM_SIZE);
-                        EVP_DigestFinal_ex(&md,&(exp_iv[0]),NULL);
-                        iv= &(exp_iv[0]);
-                        }
+                EVP_DigestInit_ex(&md, EVP_md5(), NULL);
+                EVP_DigestUpdate(&md, key, j);
+                EVP_DigestUpdate(&md, er1, SSL3_RANDOM_SIZE);
+                EVP_DigestUpdate(&md, er2, SSL3_RANDOM_SIZE);
+                EVP_DigestFinal_ex(&md, &(exp_key[0]), NULL);
+                key = &(exp_key[0]);
+
+                if (k > 0) {
+                        EVP_DigestInit_ex(&md, EVP_md5(), NULL);
+                        EVP_DigestUpdate(&md, er1, SSL3_RANDOM_SIZE);
+                        EVP_DigestUpdate(&md, er2, SSL3_RANDOM_SIZE);
+                        EVP_DigestFinal_ex(&md, &(exp_iv[0]), NULL);
+                        iv = &(exp_iv[0]);
                 }
+        }
 
-        s->session->key_arg_length=0;
+        s->session->key_arg_length = 0;
 
-        EVP_CipherInit_ex(dd,c,NULL,key,iv,(which & SSL3_CC_WRITE));
+        EVP_CipherInit_ex(dd, c, NULL, key, iv,(which & SSL3_CC_WRITE));
 
-        OPENSSL_cleanse(&(exp_key[0]),sizeof(exp_key));
-        OPENSSL_cleanse(&(exp_iv[0]),sizeof(exp_iv));
+        OPENSSL_cleanse(&(exp_key[0]), sizeof(exp_key));
+        OPENSSL_cleanse(&(exp_iv[0]), sizeof(exp_iv));
         EVP_MD_CTX_cleanup(&md);
-        return(1);
+        return (1);
 err:
-        SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE,ERR_R_MALLOC_FAILURE);
+        SSLerr(SSL_F_SSL3_CHANGE_CIPHER_STATE, ERR_R_MALLOC_FAILURE);
 err2:
-        return(0);
-        }
+        return (0);
+}
 
-int ssl3_setup_key_block(SSL *s)
-        {
+int
+ssl3_setup_key_block(SSL *s)
+{
         unsigned char *p;
         const EVP_CIPHER *c;
         const EVP_MD *hash;
@@ -395,76 +389,73 @@ int ssl3_setup_key_block(SSL *s)
         SSL_COMP *comp;
 
         if (s->s3->tmp.key_block_length != 0)
-                return(1);
+                return (1);
 
-        if (!ssl_cipher_get_evp(s->session,&c,&hash,NULL,NULL,&comp))
-                {
-                SSLerr(SSL_F_SSL3_SETUP_KEY_BLOCK,SSL_R_CIPHER_OR_HASH_UNAVAILABLE);
-                return(0);
-                }
+        if (!ssl_cipher_get_evp(s->session, &c, &hash, NULL, NULL, &comp)) {
+                SSLerr(SSL_F_SSL3_SETUP_KEY_BLOCK, SSL_R_CIPHER_OR_HASH_UNAVAILABLE);
+                return (0);
+        }
 
-        s->s3->tmp.new_sym_enc=c;
-        s->s3->tmp.new_hash=hash;
+        s->s3->tmp.new_sym_enc = c;
+        s->s3->tmp.new_hash = hash;
 #ifdef OPENSSL_NO_COMP
-        s->s3->tmp.new_compression=NULL;
+        s->s3->tmp.new_compression = NULL;
 #else
-        s->s3->tmp.new_compression=comp;
+        s->s3->tmp.new_compression = comp;
 #endif
 
-        num=EVP_MD_size(hash);
+        num = EVP_MD_size(hash);
         if (num < 0)
                 return 0;
 
-        num=EVP_CIPHER_key_length(c)+num+EVP_CIPHER_iv_length(c);
-        num*=2;
+        num = EVP_CIPHER_key_length(c) + num + EVP_CIPHER_iv_length(c);
+        num *= 2;
 
         ssl3_cleanup_key_block(s);
 
-        if ((p=OPENSSL_malloc(num)) == NULL)
+        if ((p = OPENSSL_malloc(num)) == NULL)
                 goto err;
 
-        s->s3->tmp.key_block_length=num;
-        s->s3->tmp.key_block=p;
+        s->s3->tmp.key_block_length = num;
+        s->s3->tmp.key_block = p;
 
-        ret = ssl3_generate_key_block(s,p,num);
+        ret = ssl3_generate_key_block(s, p, num);
 
-        if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS))
-                {
+        if (!(s->options & SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS)) {
                 /* enable vulnerability countermeasure for CBC ciphers with
                  * known-IV problem (http://www.openssl.org/~bodo/tls-cbc.txt)
                  */
                 s->s3->need_empty_fragments = 1;
 
-                if (s->session->cipher != NULL)
-                        {
+                if (s->session->cipher != NULL) {
                         if (s->session->cipher->algorithm_enc == SSL_eNULL)
                                 s->s3->need_empty_fragments = 0;
-                        
+
 #ifndef OPENSSL_NO_RC4
                         if (s->session->cipher->algorithm_enc == SSL_RC4)
                                 s->s3->need_empty_fragments = 0;
 #endif
-                        }
                 }
+        }
 
         return ret;
-                
-err:
-        SSLerr(SSL_F_SSL3_SETUP_KEY_BLOCK,ERR_R_MALLOC_FAILURE);
-        return(0);
-        }
 
-void ssl3_cleanup_key_block(SSL *s)
-        {
-        if (s->s3->tmp.key_block != NULL)
-                {
+err:
+        SSLerr(SSL_F_SSL3_SETUP_KEY_BLOCK, ERR_R_MALLOC_FAILURE);
+        return (0);
+}
+
+void
+ssl3_cleanup_key_block(SSL *s)
+{
+        if (s->s3->tmp.key_block != NULL) {
                 OPENSSL_cleanse(s->s3->tmp.key_block,
-                        s->s3->tmp.key_block_length);
+                s->s3->tmp.key_block_length);
                 OPENSSL_free(s->s3->tmp.key_block);
-                s->s3->tmp.key_block=NULL;
-                }
-        s->s3->tmp.key_block_length=0;
+                s->s3->tmp.key_block = NULL;
         }
+        s->s3->tmp.key_block_length = 0;
+}
 
 /* ssl3_enc encrypts/decrypts the record in |s->wrec| / |s->rrec|, respectively.
  *
@@ -475,118 +466,114 @@ void ssl3_cleanup_key_block(SSL *s)
  *   -1: if the record's padding is invalid or, if sending, an internal error
  *       occured.
  */
-int ssl3_enc(SSL *s, int send)
-        {
+int
+ssl3_enc(SSL *s, int send)
+{
         SSL3_RECORD *rec;
         EVP_CIPHER_CTX *ds;
         unsigned long l;
-        int bs,i,mac_size=0;
+        int bs, i, mac_size = 0;
         const EVP_CIPHER *enc;
 
-        if (send)
-                {
-                ds=s->enc_write_ctx;
-                rec= &(s->s3->wrec);
+        if (send) {
+                ds = s->enc_write_ctx;
+                rec = &(s->s3->wrec);
                 if (s->enc_write_ctx == NULL)
-                        enc=NULL;
+                        enc = NULL;
                 else
-                        enc=EVP_CIPHER_CTX_cipher(s->enc_write_ctx);
-                }
-        else
-                {
-                ds=s->enc_read_ctx;
-                rec= &(s->s3->rrec);
+                        enc = EVP_CIPHER_CTX_cipher(s->enc_write_ctx);
+        } else {
+                ds = s->enc_read_ctx;
+                rec = &(s->s3->rrec);
                 if (s->enc_read_ctx == NULL)
-                        enc=NULL;
+                        enc = NULL;
                 else
-                        enc=EVP_CIPHER_CTX_cipher(s->enc_read_ctx);
-                }
+                        enc = EVP_CIPHER_CTX_cipher(s->enc_read_ctx);
+        }
 
         if ((s->session == NULL) || (ds == NULL) ||
-                (enc == NULL))
-                {
-                memmove(rec->data,rec->input,rec->length);
-                rec->input=rec->data;
-                }
-        else
-                {
-                l=rec->length;
-                bs=EVP_CIPHER_block_size(ds->cipher);
+                (enc == NULL)) {
+                memmove(rec->data, rec->input, rec->length);
+                rec->input = rec->data;
+        } else {
+                l = rec->length;
+                bs = EVP_CIPHER_block_size(ds->cipher);
 
                 /* COMPRESS */
 
-                if ((bs != 1) && send)
-                        {
-                        i=bs-((int)l%bs);
+                if ((bs != 1) && send) {
+                        i = bs - ((int)l % bs);
 
                         /* we need to add 'i-1' padding bytes */
-                        l+=i;
+                        l += i;
                         /* the last of these zero bytes will be overwritten
                          * with the padding length. */
                         memset(&rec->input[rec->length], 0, i);
-                        rec->length+=i;
-                        rec->input[l-1]=(i-1);
-                        }
-                
-                if (!send)
-                        {
-                        if (l == 0 || l%bs != 0)
+                        rec->length += i;
+                        rec->input[l - 1] = (i - 1);
+                }
+
+                if (!send) {
+                        if (l == 0 || l % bs != 0)
                                 return 0;
                         /* otherwise, rec->length >= bs */
-                        }
-                
-                EVP_Cipher(ds,rec->data,rec->input,l);
+                }
+
+                EVP_Cipher(ds, rec->data, rec->input, l);
 
                 if (EVP_MD_CTX_md(s->read_hash) != NULL)
                         mac_size = EVP_MD_CTX_size(s->read_hash);
                 if ((bs != 1) && !send)
                         return ssl3_cbc_remove_padding(s, rec, bs, mac_size);
-                }
-        return(1);
         }
+        return (1);
+}
 
-void ssl3_init_finished_mac(SSL *s)
-        {
-        if (s->s3->handshake_buffer) BIO_free(s->s3->handshake_buffer);
-        if (s->s3->handshake_dgst) ssl3_free_digest_list(s);
-    s->s3->handshake_buffer=BIO_new(BIO_s_mem());       
-        (void)BIO_set_close(s->s3->handshake_buffer,BIO_CLOSE);
-        }
+void
+ssl3_init_finished_mac(SSL *s)
+{
+        if (s->s3->handshake_buffer)
+                BIO_free(s->s3->handshake_buffer);
+        if (s->s3->handshake_dgst)
+                ssl3_free_digest_list(s);
+        s->s3->handshake_buffer = BIO_new(BIO_s_mem());
+
+        (void)BIO_set_close(s->s3->handshake_buffer, BIO_CLOSE);
+}
 
-void ssl3_free_digest_list(SSL *s) 
-        {
+void
+ssl3_free_digest_list(SSL *s)
+{
         int i;
-        if (!s->s3->handshake_dgst) return;
-        for (i=0;i<SSL_MAX_DIGEST;i++) 
-                {
+        if (!s->s3->handshake_dgst)
+                return;
+        for (i = 0; i < SSL_MAX_DIGEST; i++) {
                 if (s->s3->handshake_dgst[i])
                         EVP_MD_CTX_destroy(s->s3->handshake_dgst[i]);
-                }
+        }
         OPENSSL_free(s->s3->handshake_dgst);
-        s->s3->handshake_dgst=NULL;
-        }       
+        s->s3->handshake_dgst = NULL;
+}
 
 
 
-void ssl3_finish_mac(SSL *s, const unsigned char *buf, int len)
-        {
-        if (s->s3->handshake_buffer && !(s->s3->flags & TLS1_FLAGS_KEEP_HANDSHAKE)) 
-                {
-                BIO_write (s->s3->handshake_buffer,(void *)buf,len);
-                } 
-        else 
-                {
+void
+ssl3_finish_mac(SSL *s, const unsigned char *buf, int len)
+{
+        if (s->s3->handshake_buffer && !(s->s3->flags & TLS1_FLAGS_KEEP_HANDSHAKE)) {
+                BIO_write (s->s3->handshake_buffer,(void *)buf, len);
+        } else {
                 int i;
-                for (i=0;i< SSL_MAX_DIGEST;i++) 
-                        {
+                for (i = 0; i < SSL_MAX_DIGEST; i++) {
                         if (s->s3->handshake_dgst[i]!= NULL)
-                        EVP_DigestUpdate(s->s3->handshake_dgst[i],buf,len);
-                        }
-                }       
+                                EVP_DigestUpdate(s->s3->handshake_dgst[i], buf, len);
+                }
         }
+}
 
-int ssl3_digest_cached_records(SSL *s)
-        {
+int
+ssl3_digest_cached_records(SSL *s)
+{
         int i;
         long mask;
         const EVP_MD *md;
@@ -596,152 +583,144 @@ int ssl3_digest_cached_records(SSL *s)
         /* Allocate handshake_dgst array */
         ssl3_free_digest_list(s);
         s->s3->handshake_dgst = OPENSSL_malloc(SSL_MAX_DIGEST * sizeof(EVP_MD_CTX *));
-        memset(s->s3->handshake_dgst,0,SSL_MAX_DIGEST *sizeof(EVP_MD_CTX *));
-        hdatalen = BIO_get_mem_data(s->s3->handshake_buffer,&hdata);
-        if (hdatalen <= 0)
-                {
+        memset(s->s3->handshake_dgst, 0, SSL_MAX_DIGEST *sizeof(EVP_MD_CTX *));
+        hdatalen = BIO_get_mem_data(s->s3->handshake_buffer, &hdata);
+        if (hdatalen <= 0) {
                 SSLerr(SSL_F_SSL3_DIGEST_CACHED_RECORDS, SSL_R_BAD_HANDSHAKE_LENGTH);
                 return 0;
-                }
+        }
 
         /* Loop through bitso of algorithm2 field and create MD_CTX-es */
-        for (i=0;ssl_get_handshake_digest(i,&mask,&md); i++) 
-                {
-                if ((mask & ssl_get_algorithm2(s)) && md) 
-                        {
-                        s->s3->handshake_dgst[i]=EVP_MD_CTX_create();
+        for (i = 0; ssl_get_handshake_digest(i, &mask, &md); i++) {
+                if ((mask & ssl_get_algorithm2(s)) && md) {
+                        s->s3->handshake_dgst[i] = EVP_MD_CTX_create();
 #ifdef OPENSSL_FIPS
-                        if (EVP_MD_nid(md) == NID_md5)
-                                {
+                        if (EVP_MD_nid(md) == NID_md5) {
                                 EVP_MD_CTX_set_flags(s->s3->handshake_dgst[i],
-                                                EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
-                                }
-#endif
-                        EVP_DigestInit_ex(s->s3->handshake_dgst[i],md,NULL);
-                        EVP_DigestUpdate(s->s3->handshake_dgst[i],hdata,hdatalen);
-                        } 
-                else 
-                        {       
-                        s->s3->handshake_dgst[i]=NULL;
+                                EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
                         }
+#endif
+                        EVP_DigestInit_ex(s->s3->handshake_dgst[i], md, NULL);
+                        EVP_DigestUpdate(s->s3->handshake_dgst[i], hdata, hdatalen);
+                } else {
+                        s->s3->handshake_dgst[i] = NULL;
                 }
-        if (!(s->s3->flags & TLS1_FLAGS_KEEP_HANDSHAKE))
-                {
+        }
+        if (!(s->s3->flags & TLS1_FLAGS_KEEP_HANDSHAKE)) {
                 /* Free handshake_buffer BIO */
                 BIO_free(s->s3->handshake_buffer);
                 s->s3->handshake_buffer = NULL;
-                }
+        }
 
         return 1;
-        }
+}
 
-int ssl3_cert_verify_mac(SSL *s, int md_nid, unsigned char *p)
-        {
-        return(ssl3_handshake_mac(s,md_nid,NULL,0,p));
-        }
-int ssl3_final_finish_mac(SSL *s, 
-             const char *sender, int len, unsigned char *p)
-        {
+int
+ssl3_cert_verify_mac(SSL *s, int md_nid, unsigned char *p)
+{
+        return (ssl3_handshake_mac(s, md_nid, NULL, 0, p));
+}
+
+int
+ssl3_final_finish_mac(SSL *s, const char *sender, int len, unsigned char *p)
+{
         int ret;
-        ret=ssl3_handshake_mac(s,NID_md5,sender,len,p);
-        p+=ret;
-        ret+=ssl3_handshake_mac(s,NID_sha1,sender,len,p);
-        return(ret);
-        }
-static int ssl3_handshake_mac(SSL *s, int md_nid,
-             const char *sender, int len, unsigned char *p)
-        {
+        ret = ssl3_handshake_mac(s, NID_md5, sender, len, p);
+        p += ret;
+        ret += ssl3_handshake_mac(s, NID_sha1, sender, len, p);
+        return (ret);
+}
+
+static int
+ssl3_handshake_mac(SSL *s, int md_nid, const char *sender, int len,
+    unsigned char *p)
+{
         unsigned int ret;
-        int npad,n;
+        int npad, n;
         unsigned int i;
         unsigned char md_buf[EVP_MAX_MD_SIZE];
-        EVP_MD_CTX ctx,*d=NULL;
+        EVP_MD_CTX ctx, *d = NULL;
 
-        if (s->s3->handshake_buffer) 
+        if (s->s3->handshake_buffer)
                 if (!ssl3_digest_cached_records(s))
                         return 0;
 
         /* Search for digest of specified type in the handshake_dgst
          * array*/
-        for (i=0;i<SSL_MAX_DIGEST;i++) 
-                {
-                  if (s->s3->handshake_dgst[i]&&EVP_MD_CTX_type(s->s3->handshake_dgst[i])==md_nid) 
-                        {
-                        d=s->s3->handshake_dgst[i];
+        for (i = 0; i < SSL_MAX_DIGEST; i++) {
+                if (s->s3->handshake_dgst[i]&&EVP_MD_CTX_type(s->s3->handshake_dgst[i]) == md_nid) {
+                        d = s->s3->handshake_dgst[i];
                         break;
-                        }
                 }
+        }
         if (!d) {
-                SSLerr(SSL_F_SSL3_HANDSHAKE_MAC,SSL_R_NO_REQUIRED_DIGEST);
+                SSLerr(SSL_F_SSL3_HANDSHAKE_MAC, SSL_R_NO_REQUIRED_DIGEST);
                 return 0;
-        }       
+        }
         EVP_MD_CTX_init(&ctx);
         EVP_MD_CTX_set_flags(&ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
-        EVP_MD_CTX_copy_ex(&ctx,d);
-        n=EVP_MD_CTX_size(&ctx);
+        EVP_MD_CTX_copy_ex(&ctx, d);
+        n = EVP_MD_CTX_size(&ctx);
         if (n < 0)
                 return 0;
 
-        npad=(48/n)*n;
+        npad = (48/n)*n;
         if (sender != NULL)
-                EVP_DigestUpdate(&ctx,sender,len);
-        EVP_DigestUpdate(&ctx,s->session->master_key,
-                s->session->master_key_length);
-        EVP_DigestUpdate(&ctx,ssl3_pad_1,npad);
-        EVP_DigestFinal_ex(&ctx,md_buf,&i);
-
-        EVP_DigestInit_ex(&ctx,EVP_MD_CTX_md(&ctx), NULL);
-        EVP_DigestUpdate(&ctx,s->session->master_key,
-                s->session->master_key_length);
-        EVP_DigestUpdate(&ctx,ssl3_pad_2,npad);
-        EVP_DigestUpdate(&ctx,md_buf,i);
-        EVP_DigestFinal_ex(&ctx,p,&ret);
+                EVP_DigestUpdate(&ctx, sender, len);
+        EVP_DigestUpdate(&ctx, s->session->master_key,
+        s->session->master_key_length);
+        EVP_DigestUpdate(&ctx, ssl3_pad_1, npad);
+        EVP_DigestFinal_ex(&ctx, md_buf, &i);
+
+        EVP_DigestInit_ex(&ctx, EVP_MD_CTX_md(&ctx), NULL);
+        EVP_DigestUpdate(&ctx, s->session->master_key,
+        s->session->master_key_length);
+        EVP_DigestUpdate(&ctx, ssl3_pad_2, npad);
+        EVP_DigestUpdate(&ctx, md_buf, i);
+        EVP_DigestFinal_ex(&ctx, p, &ret);
 
         EVP_MD_CTX_cleanup(&ctx);
 
-        return((int)ret);
-        }
+        return ((int)ret);
+}
 
-int n_ssl3_mac(SSL *ssl, unsigned char *md, int send)
-        {
+int
+n_ssl3_mac(SSL *ssl, unsigned char *md, int send)
+{
         SSL3_RECORD *rec;
-        unsigned char *mac_sec,*seq;
+        unsigned char *mac_sec, *seq;
         EVP_MD_CTX md_ctx;
         const EVP_MD_CTX *hash;
-        unsigned char *p,rec_char;
+        unsigned char *p, rec_char;
         size_t md_size, orig_len;
         int npad;
         int t;
 
-        if (send)
-                {
-                rec= &(ssl->s3->wrec);
-                mac_sec= &(ssl->s3->write_mac_secret[0]);
-                seq= &(ssl->s3->write_sequence[0]);
-                hash=ssl->write_hash;
-                }
-        else
-                {
-                rec= &(ssl->s3->rrec);
-                mac_sec= &(ssl->s3->read_mac_secret[0]);
-                seq= &(ssl->s3->read_sequence[0]);
-                hash=ssl->read_hash;
-                }
+        if (send) {
+                rec = &(ssl->s3->wrec);
+                mac_sec = &(ssl->s3->write_mac_secret[0]);
+                seq = &(ssl->s3->write_sequence[0]);
+                hash = ssl->write_hash;
+        } else {
+                rec = &(ssl->s3->rrec);
+                mac_sec = &(ssl->s3->read_mac_secret[0]);
+                seq = &(ssl->s3->read_sequence[0]);
+                hash = ssl->read_hash;
+        }
 
-        t=EVP_MD_CTX_size(hash);
+        t = EVP_MD_CTX_size(hash);
         if (t < 0)
                 return -1;
-        md_size=t;
-        npad=(48/md_size)*md_size;
+        md_size = t;
+        npad = (48/md_size)*md_size;
 
         /* kludge: ssl3_cbc_remove_padding passes padding length in rec->type */
-        orig_len = rec->length+md_size+((unsigned int)rec->type>>8);
+        orig_len = rec->length + md_size + ((unsigned int)rec->type >> 8);
         rec->type &= 0xff;
 
         if (!send &&
             EVP_CIPHER_CTX_mode(ssl->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
-            ssl3_cbc_record_digest_supported(hash))
-                {
+            ssl3_cbc_record_digest_supported(hash)) {
                 /* This is a CBC-encrypted record. We must avoid leaking any
                  * timing-side channel information about how many blocks of
                  * data we are hashing because that gives an attacker a
@@ -755,71 +734,68 @@ int n_ssl3_mac(SSL *ssl, unsigned char *md, int send)
                  * total size. */
                 unsigned char header[75];
                 unsigned j = 0;
-                memcpy(header+j, mac_sec, md_size);
+                memcpy(header + j, mac_sec, md_size);
                 j += md_size;
-                memcpy(header+j, ssl3_pad_1, npad);
+                memcpy(header + j, ssl3_pad_1, npad);
                 j += npad;
-                memcpy(header+j, seq, 8);
+                memcpy(header + j, seq, 8);
                 j += 8;
                 header[j++] = rec->type;
                 header[j++] = rec->length >> 8;
                 header[j++] = rec->length & 0xff;
 
-                ssl3_cbc_digest_record(
-                        hash,
-                        md, &md_size,
-                        header, rec->input,
-                        rec->length + md_size, orig_len,
-                        mac_sec, md_size,
-                        1 /* is SSLv3 */);
-                }
-        else
-                {
+                ssl3_cbc_digest_record(hash, md, &md_size, header, rec->input,
+                    rec->length + md_size, orig_len, mac_sec, md_size,
+                    1 /* is SSLv3 */);
+        } else {
                 unsigned int md_size_u;
                 /* Chop the digest off the end :-) */
                 EVP_MD_CTX_init(&md_ctx);
 
-                EVP_MD_CTX_copy_ex( &md_ctx,hash);
-                EVP_DigestUpdate(&md_ctx,mac_sec,md_size);
-                EVP_DigestUpdate(&md_ctx,ssl3_pad_1,npad);
-                EVP_DigestUpdate(&md_ctx,seq,8);
-                rec_char=rec->type;
-                EVP_DigestUpdate(&md_ctx,&rec_char,1);
-                p=md;
-                s2n(rec->length,p);
-                EVP_DigestUpdate(&md_ctx,md,2);
-                EVP_DigestUpdate(&md_ctx,rec->input,rec->length);
-                EVP_DigestFinal_ex( &md_ctx,md,NULL);
-
-                EVP_MD_CTX_copy_ex( &md_ctx,hash);
-                EVP_DigestUpdate(&md_ctx,mac_sec,md_size);
-                EVP_DigestUpdate(&md_ctx,ssl3_pad_2,npad);
-                EVP_DigestUpdate(&md_ctx,md,md_size);
-                EVP_DigestFinal_ex( &md_ctx,md,&md_size_u);
+                EVP_MD_CTX_copy_ex( &md_ctx, hash);
+                EVP_DigestUpdate(&md_ctx, mac_sec, md_size);
+                EVP_DigestUpdate(&md_ctx, ssl3_pad_1, npad);
+                EVP_DigestUpdate(&md_ctx, seq, 8);
+                rec_char = rec->type;
+                EVP_DigestUpdate(&md_ctx, &rec_char, 1);
+                p = md;
+                s2n(rec->length, p);
+                EVP_DigestUpdate(&md_ctx, md, 2);
+                EVP_DigestUpdate(&md_ctx, rec->input, rec->length);
+                EVP_DigestFinal_ex( &md_ctx, md, NULL);
+
+                EVP_MD_CTX_copy_ex( &md_ctx, hash);
+                EVP_DigestUpdate(&md_ctx, mac_sec, md_size);
+                EVP_DigestUpdate(&md_ctx, ssl3_pad_2, npad);
+                EVP_DigestUpdate(&md_ctx, md, md_size);
+                EVP_DigestFinal_ex( &md_ctx, md, &md_size_u);
                 md_size = md_size_u;
 
                 EVP_MD_CTX_cleanup(&md_ctx);
         }
 
         ssl3_record_sequence_update(seq);
-        return(md_size);
-        }
+        return (md_size);
+}
 
-void ssl3_record_sequence_update(unsigned char *seq)
-        {
+void
+ssl3_record_sequence_update(unsigned char *seq)
+{
         int i;
 
-        for (i=7; i>=0; i--)
-                {
+        for (i = 7; i >= 0; i--) {
                 ++seq[i];
-                if (seq[i] != 0) break; 
-                }
+                if (seq[i] != 0)
+                        break;
+
         }
+}
 
-int ssl3_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p,
-             int len)
-        {
-        static const unsigned char *salt[3]={
+int
+ssl3_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p,
+    int len)
+{
+        static const unsigned char *salt[3] = {
 #ifndef CHARSET_EBCDIC
                 (const unsigned char *)"A",
                 (const unsigned char *)"BB",
@@ -829,70 +805,98 @@ int ssl3_generate_master_secret(SSL *s, unsigned char *out, unsigned char *p,
                 (const unsigned char *)"\x42\x42",
                 (const unsigned char *)"\x43\x43\x43",
 #endif
-                };
+        };
         unsigned char buf[EVP_MAX_MD_SIZE];
         EVP_MD_CTX ctx;
-        int i,ret=0;
+        int i, ret = 0;
         unsigned int n;
 
         EVP_MD_CTX_init(&ctx);
-        for (i=0; i<3; i++)
-                {
-                EVP_DigestInit_ex(&ctx,s->ctx->sha1, NULL);
-                EVP_DigestUpdate(&ctx,salt[i],strlen((const char *)salt[i]));
-                EVP_DigestUpdate(&ctx,p,len);
-                EVP_DigestUpdate(&ctx,&(s->s3->client_random[0]),
-                        SSL3_RANDOM_SIZE);
-                EVP_DigestUpdate(&ctx,&(s->s3->server_random[0]),
-                        SSL3_RANDOM_SIZE);
-                EVP_DigestFinal_ex(&ctx,buf,&n);
-
-                EVP_DigestInit_ex(&ctx,s->ctx->md5, NULL);
-                EVP_DigestUpdate(&ctx,p,len);
-                EVP_DigestUpdate(&ctx,buf,n);
-                EVP_DigestFinal_ex(&ctx,out,&n);
-                out+=n;
-                ret+=n;
-                }
-        EVP_MD_CTX_cleanup(&ctx);
-        return(ret);
+        for (i = 0; i < 3; i++) {
+                EVP_DigestInit_ex(&ctx, s->ctx->sha1, NULL);
+                EVP_DigestUpdate(&ctx, salt[i], strlen((const char *)salt[i]));
+                EVP_DigestUpdate(&ctx, p, len);
+                EVP_DigestUpdate(&ctx, &(s->s3->client_random[0]),
+                SSL3_RANDOM_SIZE);
+                EVP_DigestUpdate(&ctx, &(s->s3->server_random[0]),
+                SSL3_RANDOM_SIZE);
+                EVP_DigestFinal_ex(&ctx, buf, &n);
+
+                EVP_DigestInit_ex(&ctx, s->ctx->md5, NULL);
+                EVP_DigestUpdate(&ctx, p, len);
+                EVP_DigestUpdate(&ctx, buf, n);
+                EVP_DigestFinal_ex(&ctx, out, &n);
+                out += n;
+                ret += n;
         }
-
-int ssl3_alert_code(int code)
-        {
-        switch (code)
-                {
-        case SSL_AD_CLOSE_NOTIFY:       return(SSL3_AD_CLOSE_NOTIFY);
-        case SSL_AD_UNEXPECTED_MESSAGE: return(SSL3_AD_UNEXPECTED_MESSAGE);
-        case SSL_AD_BAD_RECORD_MAC:     return(SSL3_AD_BAD_RECORD_MAC);
-        case SSL_AD_DECRYPTION_FAILED:  return(SSL3_AD_BAD_RECORD_MAC);
-        case SSL_AD_RECORD_OVERFLOW:    return(SSL3_AD_BAD_RECORD_MAC);
-        case SSL_AD_DECOMPRESSION_FAILURE:return(SSL3_AD_DECOMPRESSION_FAILURE);
-        case SSL_AD_HANDSHAKE_FAILURE:  return(SSL3_AD_HANDSHAKE_FAILURE);
-        case SSL_AD_NO_CERTIFICATE:     return(SSL3_AD_NO_CERTIFICATE);
-        case SSL_AD_BAD_CERTIFICATE:    return(SSL3_AD_BAD_CERTIFICATE);
-        case SSL_AD_UNSUPPORTED_CERTIFICATE:return(SSL3_AD_UNSUPPORTED_CERTIFICATE);
-        case SSL_AD_CERTIFICATE_REVOKED:return(SSL3_AD_CERTIFICATE_REVOKED);
-        case SSL_AD_CERTIFICATE_EXPIRED:return(SSL3_AD_CERTIFICATE_EXPIRED);
-        case SSL_AD_CERTIFICATE_UNKNOWN:return(SSL3_AD_CERTIFICATE_UNKNOWN);
-        case SSL_AD_ILLEGAL_PARAMETER:  return(SSL3_AD_ILLEGAL_PARAMETER);
-        case SSL_AD_UNKNOWN_CA:         return(SSL3_AD_BAD_CERTIFICATE);
-        case SSL_AD_ACCESS_DENIED:      return(SSL3_AD_HANDSHAKE_FAILURE);
-        case SSL_AD_DECODE_ERROR:       return(SSL3_AD_HANDSHAKE_FAILURE);
-        case SSL_AD_DECRYPT_ERROR:      return(SSL3_AD_HANDSHAKE_FAILURE);
-        case SSL_AD_EXPORT_RESTRICTION: return(SSL3_AD_HANDSHAKE_FAILURE);
-        case SSL_AD_PROTOCOL_VERSION:   return(SSL3_AD_HANDSHAKE_FAILURE);
-        case SSL_AD_INSUFFICIENT_SECURITY:return(SSL3_AD_HANDSHAKE_FAILURE);
-        case SSL_AD_INTERNAL_ERROR:     return(SSL3_AD_HANDSHAKE_FAILURE);
-        case SSL_AD_USER_CANCELLED:     return(SSL3_AD_HANDSHAKE_FAILURE);
+        EVP_MD_CTX_cleanup(&ctx);
+        return (ret);
+}
+
+int
+ssl3_alert_code(int code)
+{
+        switch (code) {
+        case SSL_AD_CLOSE_NOTIFY:
+                return (SSL3_AD_CLOSE_NOTIFY);
+        case SSL_AD_UNEXPECTED_MESSAGE:
+                return (SSL3_AD_UNEXPECTED_MESSAGE);
+        case SSL_AD_BAD_RECORD_MAC:
+                return (SSL3_AD_BAD_RECORD_MAC);
+        case SSL_AD_DECRYPTION_FAILED:
+                return (SSL3_AD_BAD_RECORD_MAC);
+        case SSL_AD_RECORD_OVERFLOW:
+                return (SSL3_AD_BAD_RECORD_MAC);
+        case SSL_AD_DECOMPRESSION_FAILURE:
+                return (SSL3_AD_DECOMPRESSION_FAILURE);
+        case SSL_AD_HANDSHAKE_FAILURE:
+                return (SSL3_AD_HANDSHAKE_FAILURE);
+        case SSL_AD_NO_CERTIFICATE:
+                return (SSL3_AD_NO_CERTIFICATE);
+        case SSL_AD_BAD_CERTIFICATE:
+                return (SSL3_AD_BAD_CERTIFICATE);
+        case SSL_AD_UNSUPPORTED_CERTIFICATE:
+                return (SSL3_AD_UNSUPPORTED_CERTIFICATE);
+        case SSL_AD_CERTIFICATE_REVOKED:
+                return (SSL3_AD_CERTIFICATE_REVOKED);
+        case SSL_AD_CERTIFICATE_EXPIRED:
+                return (SSL3_AD_CERTIFICATE_EXPIRED);
+        case SSL_AD_CERTIFICATE_UNKNOWN:
+                return (SSL3_AD_CERTIFICATE_UNKNOWN);
+        case SSL_AD_ILLEGAL_PARAMETER:
+                return (SSL3_AD_ILLEGAL_PARAMETER);
+        case SSL_AD_UNKNOWN_CA:
+                return (SSL3_AD_BAD_CERTIFICATE);
+        case SSL_AD_ACCESS_DENIED:
+                return (SSL3_AD_HANDSHAKE_FAILURE);
+        case SSL_AD_DECODE_ERROR:
+                return (SSL3_AD_HANDSHAKE_FAILURE);
+        case SSL_AD_DECRYPT_ERROR:
+                return (SSL3_AD_HANDSHAKE_FAILURE);
+        case SSL_AD_EXPORT_RESTRICTION:
+                return (SSL3_AD_HANDSHAKE_FAILURE);
+        case SSL_AD_PROTOCOL_VERSION:
+                return (SSL3_AD_HANDSHAKE_FAILURE);
+        case SSL_AD_INSUFFICIENT_SECURITY:
+                return (SSL3_AD_HANDSHAKE_FAILURE);
+        case SSL_AD_INTERNAL_ERROR:
+                return (SSL3_AD_HANDSHAKE_FAILURE);
+        case SSL_AD_USER_CANCELLED:
+                return (SSL3_AD_HANDSHAKE_FAILURE);
         case SSL_AD_NO_RENEGOTIATION:   return(-1); /* Don't send it :-) */
-        case SSL_AD_UNSUPPORTED_EXTENSION: return(SSL3_AD_HANDSHAKE_FAILURE);
-        case SSL_AD_CERTIFICATE_UNOBTAINABLE: return(SSL3_AD_HANDSHAKE_FAILURE);
-        case SSL_AD_UNRECOGNIZED_NAME:  return(SSL3_AD_HANDSHAKE_FAILURE);
-        case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE: return(SSL3_AD_HANDSHAKE_FAILURE);
-        case SSL_AD_BAD_CERTIFICATE_HASH_VALUE: return(SSL3_AD_HANDSHAKE_FAILURE);
-        case SSL_AD_UNKNOWN_PSK_IDENTITY:return(TLS1_AD_UNKNOWN_PSK_IDENTITY);
-        default:                        return(-1);
-                }
+        case SSL_AD_UNSUPPORTED_EXTENSION:
+                return (SSL3_AD_HANDSHAKE_FAILURE);
+        case SSL_AD_CERTIFICATE_UNOBTAINABLE:
+                return (SSL3_AD_HANDSHAKE_FAILURE);
+        case SSL_AD_UNRECOGNIZED_NAME:
+                return (SSL3_AD_HANDSHAKE_FAILURE);
+        case SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE:
+                return (SSL3_AD_HANDSHAKE_FAILURE);
+        case SSL_AD_BAD_CERTIFICATE_HASH_VALUE:
+                return (SSL3_AD_HANDSHAKE_FAILURE);
+        case SSL_AD_UNKNOWN_PSK_IDENTITY:
+                return (TLS1_AD_UNKNOWN_PSK_IDENTITY);
+        default:
+                return (-1);
         }
-
+}
diff --git a/src/lib/libssl/src/ssl/s3_lib.c b/src/lib/libssl/src/ssl/s3_lib.c
index fd1e7b80d8..926071fffa 100644
--- a/src/lib/libssl/src/ssl/s3_lib.c
+++ b/src/lib/libssl/src/ssl/s3_lib.c
@@ -164,496 +164,496 @@
 
 const char ssl3_version_str[]="SSLv3" OPENSSL_VERSION_PTEXT;
 
-#define SSL3_NUM_CIPHERS        (sizeof(ssl3_ciphers)/sizeof(SSL_CIPHER))
+#define SSL3_NUM_CIPHERS        (sizeof(ssl3_ciphers) / sizeof(SSL_CIPHER))
 
 /* list of available SSLv3 ciphers (sorted by id) */
-OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
+OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[] = {
 
 /* The RSA ciphers */
 /* Cipher 01 */
         {
-        1,
-        SSL3_TXT_RSA_NULL_MD5,
-        SSL3_CK_RSA_NULL_MD5,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_eNULL,
-        SSL_MD5,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_STRONG_NONE,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        0,
-        0,
+                1,
+                SSL3_TXT_RSA_NULL_MD5,
+                SSL3_CK_RSA_NULL_MD5,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_eNULL,
+                SSL_MD5,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_STRONG_NONE,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                0,
+                0,
         },
 
 /* Cipher 02 */
         {
-        1,
-        SSL3_TXT_RSA_NULL_SHA,
-        SSL3_CK_RSA_NULL_SHA,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_eNULL,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        0,
-        0,
+                1,
+                SSL3_TXT_RSA_NULL_SHA,
+                SSL3_CK_RSA_NULL_SHA,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_eNULL,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                0,
+                0,
         },
 
 /* Cipher 03 */
         {
-        1,
-        SSL3_TXT_RSA_RC4_40_MD5,
-        SSL3_CK_RSA_RC4_40_MD5,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_RC4,
-        SSL_MD5,
-        SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        40,
-        128,
+                1,
+                SSL3_TXT_RSA_RC4_40_MD5,
+                SSL3_CK_RSA_RC4_40_MD5,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_RC4,
+                SSL_MD5,
+                SSL_SSLV3,
+                SSL_EXPORT|SSL_EXP40,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                40,
+                128,
         },
 
 /* Cipher 04 */
         {
-        1,
-        SSL3_TXT_RSA_RC4_128_MD5,
-        SSL3_CK_RSA_RC4_128_MD5,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_RC4,
-        SSL_MD5,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                SSL3_TXT_RSA_RC4_128_MD5,
+                SSL3_CK_RSA_RC4_128_MD5,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_RC4,
+                SSL_MD5,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
 /* Cipher 05 */
         {
-        1,
-        SSL3_TXT_RSA_RC4_128_SHA,
-        SSL3_CK_RSA_RC4_128_SHA,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_RC4,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                SSL3_TXT_RSA_RC4_128_SHA,
+                SSL3_CK_RSA_RC4_128_SHA,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_RC4,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
 /* Cipher 06 */
         {
-        1,
-        SSL3_TXT_RSA_RC2_40_MD5,
-        SSL3_CK_RSA_RC2_40_MD5,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_RC2,
-        SSL_MD5,
-        SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        40,
-        128,
+                1,
+                SSL3_TXT_RSA_RC2_40_MD5,
+                SSL3_CK_RSA_RC2_40_MD5,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_RC2,
+                SSL_MD5,
+                SSL_SSLV3,
+                SSL_EXPORT|SSL_EXP40,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                40,
+                128,
         },
 
 /* Cipher 07 */
 #ifndef OPENSSL_NO_IDEA
         {
-        1,
-        SSL3_TXT_RSA_IDEA_128_SHA,
-        SSL3_CK_RSA_IDEA_128_SHA,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_IDEA,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                SSL3_TXT_RSA_IDEA_128_SHA,
+                SSL3_CK_RSA_IDEA_128_SHA,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_IDEA,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 #endif
 
 /* Cipher 08 */
         {
-        1,
-        SSL3_TXT_RSA_DES_40_CBC_SHA,
-        SSL3_CK_RSA_DES_40_CBC_SHA,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        40,
-        56,
+                1,
+                SSL3_TXT_RSA_DES_40_CBC_SHA,
+                SSL3_CK_RSA_DES_40_CBC_SHA,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_EXPORT|SSL_EXP40,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                40,
+                56,
         },
 
 /* Cipher 09 */
         {
-        1,
-        SSL3_TXT_RSA_DES_64_CBC_SHA,
-        SSL3_CK_RSA_DES_64_CBC_SHA,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_LOW,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        56,
-        56,
+                1,
+                SSL3_TXT_RSA_DES_64_CBC_SHA,
+                SSL3_CK_RSA_DES_64_CBC_SHA,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_LOW,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                56,
+                56,
         },
 
 /* Cipher 0A */
         {
-        1,
-        SSL3_TXT_RSA_DES_192_CBC3_SHA,
-        SSL3_CK_RSA_DES_192_CBC3_SHA,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                1,
+                SSL3_TXT_RSA_DES_192_CBC3_SHA,
+                SSL3_CK_RSA_DES_192_CBC3_SHA,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
 /* The DH ciphers */
 /* Cipher 0B */
         {
-        0,
-        SSL3_TXT_DH_DSS_DES_40_CBC_SHA,
-        SSL3_CK_DH_DSS_DES_40_CBC_SHA,
-        SSL_kDHd,
-        SSL_aDH,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        40,
-        56,
+                0,
+                SSL3_TXT_DH_DSS_DES_40_CBC_SHA,
+                SSL3_CK_DH_DSS_DES_40_CBC_SHA,
+                SSL_kDHd,
+                SSL_aDH,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_EXPORT|SSL_EXP40,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                40,
+                56,
         },
 
 /* Cipher 0C */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        SSL3_TXT_DH_DSS_DES_64_CBC_SHA,
-        SSL3_CK_DH_DSS_DES_64_CBC_SHA,
-        SSL_kDHd,
-        SSL_aDH,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_LOW,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        56,
-        56,
+                0, /* not implemented (non-ephemeral DH) */
+                SSL3_TXT_DH_DSS_DES_64_CBC_SHA,
+                SSL3_CK_DH_DSS_DES_64_CBC_SHA,
+                SSL_kDHd,
+                SSL_aDH,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_LOW,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                56,
+                56,
         },
 
 /* Cipher 0D */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        SSL3_TXT_DH_DSS_DES_192_CBC3_SHA,
-        SSL3_CK_DH_DSS_DES_192_CBC3_SHA,
-        SSL_kDHd,
-        SSL_aDH,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                0, /* not implemented (non-ephemeral DH) */
+                SSL3_TXT_DH_DSS_DES_192_CBC3_SHA,
+                SSL3_CK_DH_DSS_DES_192_CBC3_SHA,
+                SSL_kDHd,
+                SSL_aDH,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
 /* Cipher 0E */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        SSL3_TXT_DH_RSA_DES_40_CBC_SHA,
-        SSL3_CK_DH_RSA_DES_40_CBC_SHA,
-        SSL_kDHr,
-        SSL_aDH,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        40,
-        56,
+                0, /* not implemented (non-ephemeral DH) */
+                SSL3_TXT_DH_RSA_DES_40_CBC_SHA,
+                SSL3_CK_DH_RSA_DES_40_CBC_SHA,
+                SSL_kDHr,
+                SSL_aDH,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_EXPORT|SSL_EXP40,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                40,
+                56,
         },
 
 /* Cipher 0F */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        SSL3_TXT_DH_RSA_DES_64_CBC_SHA,
-        SSL3_CK_DH_RSA_DES_64_CBC_SHA,
-        SSL_kDHr,
-        SSL_aDH,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_LOW,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        56,
-        56,
+                0, /* not implemented (non-ephemeral DH) */
+                SSL3_TXT_DH_RSA_DES_64_CBC_SHA,
+                SSL3_CK_DH_RSA_DES_64_CBC_SHA,
+                SSL_kDHr,
+                SSL_aDH,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_LOW,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                56,
+                56,
         },
 
 /* Cipher 10 */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        SSL3_TXT_DH_RSA_DES_192_CBC3_SHA,
-        SSL3_CK_DH_RSA_DES_192_CBC3_SHA,
-        SSL_kDHr,
-        SSL_aDH,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                0, /* not implemented (non-ephemeral DH) */
+                SSL3_TXT_DH_RSA_DES_192_CBC3_SHA,
+                SSL3_CK_DH_RSA_DES_192_CBC3_SHA,
+                SSL_kDHr,
+                SSL_aDH,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
 /* The Ephemeral DH ciphers */
 /* Cipher 11 */
         {
-        1,
-        SSL3_TXT_EDH_DSS_DES_40_CBC_SHA,
-        SSL3_CK_EDH_DSS_DES_40_CBC_SHA,
-        SSL_kEDH,
-        SSL_aDSS,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        40,
-        56,
+                1,
+                SSL3_TXT_EDH_DSS_DES_40_CBC_SHA,
+                SSL3_CK_EDH_DSS_DES_40_CBC_SHA,
+                SSL_kEDH,
+                SSL_aDSS,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_EXPORT|SSL_EXP40,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                40,
+                56,
         },
 
 /* Cipher 12 */
         {
-        1,
-        SSL3_TXT_EDH_DSS_DES_64_CBC_SHA,
-        SSL3_CK_EDH_DSS_DES_64_CBC_SHA,
-        SSL_kEDH,
-        SSL_aDSS,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_LOW,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        56,
-        56,
+                1,
+                SSL3_TXT_EDH_DSS_DES_64_CBC_SHA,
+                SSL3_CK_EDH_DSS_DES_64_CBC_SHA,
+                SSL_kEDH,
+                SSL_aDSS,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_LOW,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                56,
+                56,
         },
 
 /* Cipher 13 */
         {
-        1,
-        SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA,
-        SSL3_CK_EDH_DSS_DES_192_CBC3_SHA,
-        SSL_kEDH,
-        SSL_aDSS,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                1,
+                SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA,
+                SSL3_CK_EDH_DSS_DES_192_CBC3_SHA,
+                SSL_kEDH,
+                SSL_aDSS,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
 /* Cipher 14 */
         {
-        1,
-        SSL3_TXT_EDH_RSA_DES_40_CBC_SHA,
-        SSL3_CK_EDH_RSA_DES_40_CBC_SHA,
-        SSL_kEDH,
-        SSL_aRSA,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        40,
-        56,
+                1,
+                SSL3_TXT_EDH_RSA_DES_40_CBC_SHA,
+                SSL3_CK_EDH_RSA_DES_40_CBC_SHA,
+                SSL_kEDH,
+                SSL_aRSA,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_EXPORT|SSL_EXP40,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                40,
+                56,
         },
 
 /* Cipher 15 */
         {
-        1,
-        SSL3_TXT_EDH_RSA_DES_64_CBC_SHA,
-        SSL3_CK_EDH_RSA_DES_64_CBC_SHA,
-        SSL_kEDH,
-        SSL_aRSA,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_LOW,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        56,
-        56,
+                1,
+                SSL3_TXT_EDH_RSA_DES_64_CBC_SHA,
+                SSL3_CK_EDH_RSA_DES_64_CBC_SHA,
+                SSL_kEDH,
+                SSL_aRSA,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_LOW,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                56,
+                56,
         },
 
 /* Cipher 16 */
         {
-        1,
-        SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA,
-        SSL3_CK_EDH_RSA_DES_192_CBC3_SHA,
-        SSL_kEDH,
-        SSL_aRSA,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                1,
+                SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA,
+                SSL3_CK_EDH_RSA_DES_192_CBC3_SHA,
+                SSL_kEDH,
+                SSL_aRSA,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
 /* Cipher 17 */
         {
-        1,
-        SSL3_TXT_ADH_RC4_40_MD5,
-        SSL3_CK_ADH_RC4_40_MD5,
-        SSL_kEDH,
-        SSL_aNULL,
-        SSL_RC4,
-        SSL_MD5,
-        SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        40,
-        128,
+                1,
+                SSL3_TXT_ADH_RC4_40_MD5,
+                SSL3_CK_ADH_RC4_40_MD5,
+                SSL_kEDH,
+                SSL_aNULL,
+                SSL_RC4,
+                SSL_MD5,
+                SSL_SSLV3,
+                SSL_EXPORT|SSL_EXP40,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                40,
+                128,
         },
 
 /* Cipher 18 */
         {
-        1,
-        SSL3_TXT_ADH_RC4_128_MD5,
-        SSL3_CK_ADH_RC4_128_MD5,
-        SSL_kEDH,
-        SSL_aNULL,
-        SSL_RC4,
-        SSL_MD5,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                SSL3_TXT_ADH_RC4_128_MD5,
+                SSL3_CK_ADH_RC4_128_MD5,
+                SSL_kEDH,
+                SSL_aNULL,
+                SSL_RC4,
+                SSL_MD5,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
 /* Cipher 19 */
         {
-        1,
-        SSL3_TXT_ADH_DES_40_CBC_SHA,
-        SSL3_CK_ADH_DES_40_CBC_SHA,
-        SSL_kEDH,
-        SSL_aNULL,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        40,
-        128,
+                1,
+                SSL3_TXT_ADH_DES_40_CBC_SHA,
+                SSL3_CK_ADH_DES_40_CBC_SHA,
+                SSL_kEDH,
+                SSL_aNULL,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_EXPORT|SSL_EXP40,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                40,
+                128,
         },
 
 /* Cipher 1A */
         {
-        1,
-        SSL3_TXT_ADH_DES_64_CBC_SHA,
-        SSL3_CK_ADH_DES_64_CBC_SHA,
-        SSL_kEDH,
-        SSL_aNULL,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_LOW,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        56,
-        56,
+                1,
+                SSL3_TXT_ADH_DES_64_CBC_SHA,
+                SSL3_CK_ADH_DES_64_CBC_SHA,
+                SSL_kEDH,
+                SSL_aNULL,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_LOW,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                56,
+                56,
         },
 
 /* Cipher 1B */
         {
-        1,
-        SSL3_TXT_ADH_DES_192_CBC_SHA,
-        SSL3_CK_ADH_DES_192_CBC_SHA,
-        SSL_kEDH,
-        SSL_aNULL,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                1,
+                SSL3_TXT_ADH_DES_192_CBC_SHA,
+                SSL3_CK_ADH_DES_192_CBC_SHA,
+                SSL_kEDH,
+                SSL_aNULL,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
 /* Fortezza ciphersuite from SSL 3.0 spec */
 #if 0
 /* Cipher 1C */
         {
-        0,
-        SSL3_TXT_FZA_DMS_NULL_SHA,
-        SSL3_CK_FZA_DMS_NULL_SHA,
-        SSL_kFZA,
-        SSL_aFZA,
-        SSL_eNULL,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_STRONG_NONE,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        0,
-        0,
+                0,
+                SSL3_TXT_FZA_DMS_NULL_SHA,
+                SSL3_CK_FZA_DMS_NULL_SHA,
+                SSL_kFZA,
+                SSL_aFZA,
+                SSL_eNULL,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_STRONG_NONE,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                0,
+                0,
         },
 
 /* Cipher 1D */
         {
-        0,
-        SSL3_TXT_FZA_DMS_FZA_SHA,
-        SSL3_CK_FZA_DMS_FZA_SHA,
-        SSL_kFZA,
-        SSL_aFZA,
-        SSL_eFZA,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_STRONG_NONE,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        0,
-        0,
+                0,
+                SSL3_TXT_FZA_DMS_FZA_SHA,
+                SSL3_CK_FZA_DMS_FZA_SHA,
+                SSL_kFZA,
+                SSL_aFZA,
+                SSL_eFZA,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_STRONG_NONE,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                0,
+                0,
         },
 
 /* Cipher 1E */
         {
-        0,
-        SSL3_TXT_FZA_DMS_RC4_SHA,
-        SSL3_CK_FZA_DMS_RC4_SHA,
-        SSL_kFZA,
-        SSL_aFZA,
-        SSL_RC4,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                0,
+                SSL3_TXT_FZA_DMS_RC4_SHA,
+                SSL3_CK_FZA_DMS_RC4_SHA,
+                SSL_kFZA,
+                SSL_aFZA,
+                SSL_RC4,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 #endif
 
@@ -661,511 +661,511 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 /* The Kerberos ciphers*/
 /* Cipher 1E */
         {
-        1,
-        SSL3_TXT_KRB5_DES_64_CBC_SHA,
-        SSL3_CK_KRB5_DES_64_CBC_SHA,
-        SSL_kKRB5,
-        SSL_aKRB5,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_LOW,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        56,
-        56,
+                1,
+                SSL3_TXT_KRB5_DES_64_CBC_SHA,
+                SSL3_CK_KRB5_DES_64_CBC_SHA,
+                SSL_kKRB5,
+                SSL_aKRB5,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_LOW,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                56,
+                56,
         },
 
 /* Cipher 1F */
         {
-        1,
-        SSL3_TXT_KRB5_DES_192_CBC3_SHA,
-        SSL3_CK_KRB5_DES_192_CBC3_SHA,
-        SSL_kKRB5,
-        SSL_aKRB5,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                1,
+                SSL3_TXT_KRB5_DES_192_CBC3_SHA,
+                SSL3_CK_KRB5_DES_192_CBC3_SHA,
+                SSL_kKRB5,
+                SSL_aKRB5,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
 /* Cipher 20 */
         {
-        1,
-        SSL3_TXT_KRB5_RC4_128_SHA,
-        SSL3_CK_KRB5_RC4_128_SHA,
-        SSL_kKRB5,
-        SSL_aKRB5,
-        SSL_RC4,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                SSL3_TXT_KRB5_RC4_128_SHA,
+                SSL3_CK_KRB5_RC4_128_SHA,
+                SSL_kKRB5,
+                SSL_aKRB5,
+                SSL_RC4,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
 /* Cipher 21 */
         {
-        1,
-        SSL3_TXT_KRB5_IDEA_128_CBC_SHA,
-        SSL3_CK_KRB5_IDEA_128_CBC_SHA,
-        SSL_kKRB5,
-        SSL_aKRB5,
-        SSL_IDEA,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                SSL3_TXT_KRB5_IDEA_128_CBC_SHA,
+                SSL3_CK_KRB5_IDEA_128_CBC_SHA,
+                SSL_kKRB5,
+                SSL_aKRB5,
+                SSL_IDEA,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
 /* Cipher 22 */
         {
-        1,
-        SSL3_TXT_KRB5_DES_64_CBC_MD5,
-        SSL3_CK_KRB5_DES_64_CBC_MD5,
-        SSL_kKRB5,
-        SSL_aKRB5,
-        SSL_DES,
-        SSL_MD5,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_LOW,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        56,
-        56,
+                1,
+                SSL3_TXT_KRB5_DES_64_CBC_MD5,
+                SSL3_CK_KRB5_DES_64_CBC_MD5,
+                SSL_kKRB5,
+                SSL_aKRB5,
+                SSL_DES,
+                SSL_MD5,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_LOW,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                56,
+                56,
         },
 
 /* Cipher 23 */
         {
-        1,
-        SSL3_TXT_KRB5_DES_192_CBC3_MD5,
-        SSL3_CK_KRB5_DES_192_CBC3_MD5,
-        SSL_kKRB5,
-        SSL_aKRB5,
-        SSL_3DES,
-        SSL_MD5,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                1,
+                SSL3_TXT_KRB5_DES_192_CBC3_MD5,
+                SSL3_CK_KRB5_DES_192_CBC3_MD5,
+                SSL_kKRB5,
+                SSL_aKRB5,
+                SSL_3DES,
+                SSL_MD5,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
 /* Cipher 24 */
         {
-        1,
-        SSL3_TXT_KRB5_RC4_128_MD5,
-        SSL3_CK_KRB5_RC4_128_MD5,
-        SSL_kKRB5,
-        SSL_aKRB5,
-        SSL_RC4,
-        SSL_MD5,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                SSL3_TXT_KRB5_RC4_128_MD5,
+                SSL3_CK_KRB5_RC4_128_MD5,
+                SSL_kKRB5,
+                SSL_aKRB5,
+                SSL_RC4,
+                SSL_MD5,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
 /* Cipher 25 */
         {
-        1,
-        SSL3_TXT_KRB5_IDEA_128_CBC_MD5,
-        SSL3_CK_KRB5_IDEA_128_CBC_MD5,
-        SSL_kKRB5,
-        SSL_aKRB5,
-        SSL_IDEA,
-        SSL_MD5,
-        SSL_SSLV3,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                SSL3_TXT_KRB5_IDEA_128_CBC_MD5,
+                SSL3_CK_KRB5_IDEA_128_CBC_MD5,
+                SSL_kKRB5,
+                SSL_aKRB5,
+                SSL_IDEA,
+                SSL_MD5,
+                SSL_SSLV3,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
 /* Cipher 26 */
         {
-        1,
-        SSL3_TXT_KRB5_DES_40_CBC_SHA,
-        SSL3_CK_KRB5_DES_40_CBC_SHA,
-        SSL_kKRB5,
-        SSL_aKRB5,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        40,
-        56,
+                1,
+                SSL3_TXT_KRB5_DES_40_CBC_SHA,
+                SSL3_CK_KRB5_DES_40_CBC_SHA,
+                SSL_kKRB5,
+                SSL_aKRB5,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_EXPORT|SSL_EXP40,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                40,
+                56,
         },
 
 /* Cipher 27 */
         {
-        1,
-        SSL3_TXT_KRB5_RC2_40_CBC_SHA,
-        SSL3_CK_KRB5_RC2_40_CBC_SHA,
-        SSL_kKRB5,
-        SSL_aKRB5,
-        SSL_RC2,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        40,
-        128,
+                1,
+                SSL3_TXT_KRB5_RC2_40_CBC_SHA,
+                SSL3_CK_KRB5_RC2_40_CBC_SHA,
+                SSL_kKRB5,
+                SSL_aKRB5,
+                SSL_RC2,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_EXPORT|SSL_EXP40,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                40,
+                128,
         },
 
 /* Cipher 28 */
         {
-        1,
-        SSL3_TXT_KRB5_RC4_40_SHA,
-        SSL3_CK_KRB5_RC4_40_SHA,
-        SSL_kKRB5,
-        SSL_aKRB5,
-        SSL_RC4,
-        SSL_SHA1,
-        SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        40,
-        128,
+                1,
+                SSL3_TXT_KRB5_RC4_40_SHA,
+                SSL3_CK_KRB5_RC4_40_SHA,
+                SSL_kKRB5,
+                SSL_aKRB5,
+                SSL_RC4,
+                SSL_SHA1,
+                SSL_SSLV3,
+                SSL_EXPORT|SSL_EXP40,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                40,
+                128,
         },
 
 /* Cipher 29 */
         {
-        1,
-        SSL3_TXT_KRB5_DES_40_CBC_MD5,
-        SSL3_CK_KRB5_DES_40_CBC_MD5,
-        SSL_kKRB5,
-        SSL_aKRB5,
-        SSL_DES,
-        SSL_MD5,
-        SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        40,
-        56,
+                1,
+                SSL3_TXT_KRB5_DES_40_CBC_MD5,
+                SSL3_CK_KRB5_DES_40_CBC_MD5,
+                SSL_kKRB5,
+                SSL_aKRB5,
+                SSL_DES,
+                SSL_MD5,
+                SSL_SSLV3,
+                SSL_EXPORT|SSL_EXP40,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                40,
+                56,
         },
 
 /* Cipher 2A */
         {
-        1,
-        SSL3_TXT_KRB5_RC2_40_CBC_MD5,
-        SSL3_CK_KRB5_RC2_40_CBC_MD5,
-        SSL_kKRB5,
-        SSL_aKRB5,
-        SSL_RC2,
-        SSL_MD5,
-        SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        40,
-        128,
+                1,
+                SSL3_TXT_KRB5_RC2_40_CBC_MD5,
+                SSL3_CK_KRB5_RC2_40_CBC_MD5,
+                SSL_kKRB5,
+                SSL_aKRB5,
+                SSL_RC2,
+                SSL_MD5,
+                SSL_SSLV3,
+                SSL_EXPORT|SSL_EXP40,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                40,
+                128,
         },
 
 /* Cipher 2B */
         {
-        1,
-        SSL3_TXT_KRB5_RC4_40_MD5,
-        SSL3_CK_KRB5_RC4_40_MD5,
-        SSL_kKRB5,
-        SSL_aKRB5,
-        SSL_RC4,
-        SSL_MD5,
-        SSL_SSLV3,
-        SSL_EXPORT|SSL_EXP40,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        40,
-        128,
+                1,
+                SSL3_TXT_KRB5_RC4_40_MD5,
+                SSL3_CK_KRB5_RC4_40_MD5,
+                SSL_kKRB5,
+                SSL_aKRB5,
+                SSL_RC4,
+                SSL_MD5,
+                SSL_SSLV3,
+                SSL_EXPORT|SSL_EXP40,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                40,
+                128,
         },
 #endif  /* OPENSSL_NO_KRB5 */
 
 /* New AES ciphersuites */
 /* Cipher 2F */
         {
-        1,
-        TLS1_TXT_RSA_WITH_AES_128_SHA,
-        TLS1_CK_RSA_WITH_AES_128_SHA,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_AES128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_RSA_WITH_AES_128_SHA,
+                TLS1_CK_RSA_WITH_AES_128_SHA,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_AES128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 /* Cipher 30 */
         {
-        0,
-        TLS1_TXT_DH_DSS_WITH_AES_128_SHA,
-        TLS1_CK_DH_DSS_WITH_AES_128_SHA,
-        SSL_kDHd,
-        SSL_aDH,
-        SSL_AES128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                0,
+                TLS1_TXT_DH_DSS_WITH_AES_128_SHA,
+                TLS1_CK_DH_DSS_WITH_AES_128_SHA,
+                SSL_kDHd,
+                SSL_aDH,
+                SSL_AES128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 /* Cipher 31 */
         {
-        0,
-        TLS1_TXT_DH_RSA_WITH_AES_128_SHA,
-        TLS1_CK_DH_RSA_WITH_AES_128_SHA,
-        SSL_kDHr,
-        SSL_aDH,
-        SSL_AES128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                0,
+                TLS1_TXT_DH_RSA_WITH_AES_128_SHA,
+                TLS1_CK_DH_RSA_WITH_AES_128_SHA,
+                SSL_kDHr,
+                SSL_aDH,
+                SSL_AES128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 /* Cipher 32 */
         {
-        1,
-        TLS1_TXT_DHE_DSS_WITH_AES_128_SHA,
-        TLS1_CK_DHE_DSS_WITH_AES_128_SHA,
-        SSL_kEDH,
-        SSL_aDSS,
-        SSL_AES128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_DHE_DSS_WITH_AES_128_SHA,
+                TLS1_CK_DHE_DSS_WITH_AES_128_SHA,
+                SSL_kEDH,
+                SSL_aDSS,
+                SSL_AES128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 /* Cipher 33 */
         {
-        1,
-        TLS1_TXT_DHE_RSA_WITH_AES_128_SHA,
-        TLS1_CK_DHE_RSA_WITH_AES_128_SHA,
-        SSL_kEDH,
-        SSL_aRSA,
-        SSL_AES128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_DHE_RSA_WITH_AES_128_SHA,
+                TLS1_CK_DHE_RSA_WITH_AES_128_SHA,
+                SSL_kEDH,
+                SSL_aRSA,
+                SSL_AES128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 /* Cipher 34 */
         {
-        1,
-        TLS1_TXT_ADH_WITH_AES_128_SHA,
-        TLS1_CK_ADH_WITH_AES_128_SHA,
-        SSL_kEDH,
-        SSL_aNULL,
-        SSL_AES128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_ADH_WITH_AES_128_SHA,
+                TLS1_CK_ADH_WITH_AES_128_SHA,
+                SSL_kEDH,
+                SSL_aNULL,
+                SSL_AES128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
 /* Cipher 35 */
         {
-        1,
-        TLS1_TXT_RSA_WITH_AES_256_SHA,
-        TLS1_CK_RSA_WITH_AES_256_SHA,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_AES256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_RSA_WITH_AES_256_SHA,
+                TLS1_CK_RSA_WITH_AES_256_SHA,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_AES256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 /* Cipher 36 */
         {
-        0,
-        TLS1_TXT_DH_DSS_WITH_AES_256_SHA,
-        TLS1_CK_DH_DSS_WITH_AES_256_SHA,
-        SSL_kDHd,
-        SSL_aDH,
-        SSL_AES256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                0,
+                TLS1_TXT_DH_DSS_WITH_AES_256_SHA,
+                TLS1_CK_DH_DSS_WITH_AES_256_SHA,
+                SSL_kDHd,
+                SSL_aDH,
+                SSL_AES256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
 /* Cipher 37 */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        TLS1_TXT_DH_RSA_WITH_AES_256_SHA,
-        TLS1_CK_DH_RSA_WITH_AES_256_SHA,
-        SSL_kDHr,
-        SSL_aDH,
-        SSL_AES256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                0, /* not implemented (non-ephemeral DH) */
+                TLS1_TXT_DH_RSA_WITH_AES_256_SHA,
+                TLS1_CK_DH_RSA_WITH_AES_256_SHA,
+                SSL_kDHr,
+                SSL_aDH,
+                SSL_AES256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
 /* Cipher 38 */
         {
-        1,
-        TLS1_TXT_DHE_DSS_WITH_AES_256_SHA,
-        TLS1_CK_DHE_DSS_WITH_AES_256_SHA,
-        SSL_kEDH,
-        SSL_aDSS,
-        SSL_AES256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_DHE_DSS_WITH_AES_256_SHA,
+                TLS1_CK_DHE_DSS_WITH_AES_256_SHA,
+                SSL_kEDH,
+                SSL_aDSS,
+                SSL_AES256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
 /* Cipher 39 */
         {
-        1,
-        TLS1_TXT_DHE_RSA_WITH_AES_256_SHA,
-        TLS1_CK_DHE_RSA_WITH_AES_256_SHA,
-        SSL_kEDH,
-        SSL_aRSA,
-        SSL_AES256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_DHE_RSA_WITH_AES_256_SHA,
+                TLS1_CK_DHE_RSA_WITH_AES_256_SHA,
+                SSL_kEDH,
+                SSL_aRSA,
+                SSL_AES256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher 3A */
         {
-        1,
-        TLS1_TXT_ADH_WITH_AES_256_SHA,
-        TLS1_CK_ADH_WITH_AES_256_SHA,
-        SSL_kEDH,
-        SSL_aNULL,
-        SSL_AES256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_ADH_WITH_AES_256_SHA,
+                TLS1_CK_ADH_WITH_AES_256_SHA,
+                SSL_kEDH,
+                SSL_aNULL,
+                SSL_AES256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* TLS v1.2 ciphersuites */
         /* Cipher 3B */
         {
-        1,
-        TLS1_TXT_RSA_WITH_NULL_SHA256,
-        TLS1_CK_RSA_WITH_NULL_SHA256,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_eNULL,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        0,
-        0,
+                1,
+                TLS1_TXT_RSA_WITH_NULL_SHA256,
+                TLS1_CK_RSA_WITH_NULL_SHA256,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_eNULL,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                0,
+                0,
         },
 
         /* Cipher 3C */
         {
-        1,
-        TLS1_TXT_RSA_WITH_AES_128_SHA256,
-        TLS1_CK_RSA_WITH_AES_128_SHA256,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_AES128,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_RSA_WITH_AES_128_SHA256,
+                TLS1_CK_RSA_WITH_AES_128_SHA256,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_AES128,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 3D */
         {
-        1,
-        TLS1_TXT_RSA_WITH_AES_256_SHA256,
-        TLS1_CK_RSA_WITH_AES_256_SHA256,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_AES256,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_RSA_WITH_AES_256_SHA256,
+                TLS1_CK_RSA_WITH_AES_256_SHA256,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_AES256,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher 3E */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        TLS1_TXT_DH_DSS_WITH_AES_128_SHA256,
-        TLS1_CK_DH_DSS_WITH_AES_128_SHA256,
-        SSL_kDHd,
-        SSL_aDH,
-        SSL_AES128,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                0, /* not implemented (non-ephemeral DH) */
+                TLS1_TXT_DH_DSS_WITH_AES_128_SHA256,
+                TLS1_CK_DH_DSS_WITH_AES_128_SHA256,
+                SSL_kDHd,
+                SSL_aDH,
+                SSL_AES128,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 3F */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        TLS1_TXT_DH_RSA_WITH_AES_128_SHA256,
-        TLS1_CK_DH_RSA_WITH_AES_128_SHA256,
-        SSL_kDHr,
-        SSL_aDH,
-        SSL_AES128,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                0, /* not implemented (non-ephemeral DH) */
+                TLS1_TXT_DH_RSA_WITH_AES_128_SHA256,
+                TLS1_CK_DH_RSA_WITH_AES_128_SHA256,
+                SSL_kDHr,
+                SSL_aDH,
+                SSL_AES128,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 40 */
         {
-        1,
-        TLS1_TXT_DHE_DSS_WITH_AES_128_SHA256,
-        TLS1_CK_DHE_DSS_WITH_AES_128_SHA256,
-        SSL_kEDH,
-        SSL_aDSS,
-        SSL_AES128,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_DHE_DSS_WITH_AES_128_SHA256,
+                TLS1_CK_DHE_DSS_WITH_AES_128_SHA256,
+                SSL_kEDH,
+                SSL_aDSS,
+                SSL_AES128,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
 #ifndef OPENSSL_NO_CAMELLIA
@@ -1173,98 +1173,98 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
         /* Cipher 41 */
         {
-        1,
-        TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA,
-        TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_CAMELLIA128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA,
+                TLS1_CK_RSA_WITH_CAMELLIA_128_CBC_SHA,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_CAMELLIA128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 42 */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        TLS1_TXT_DH_DSS_WITH_CAMELLIA_128_CBC_SHA,
-        TLS1_CK_DH_DSS_WITH_CAMELLIA_128_CBC_SHA,
-        SSL_kDHd,
-        SSL_aDH,
-        SSL_CAMELLIA128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                0, /* not implemented (non-ephemeral DH) */
+                TLS1_TXT_DH_DSS_WITH_CAMELLIA_128_CBC_SHA,
+                TLS1_CK_DH_DSS_WITH_CAMELLIA_128_CBC_SHA,
+                SSL_kDHd,
+                SSL_aDH,
+                SSL_CAMELLIA128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 43 */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        TLS1_TXT_DH_RSA_WITH_CAMELLIA_128_CBC_SHA,
-        TLS1_CK_DH_RSA_WITH_CAMELLIA_128_CBC_SHA,
-        SSL_kDHr,
-        SSL_aDH,
-        SSL_CAMELLIA128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                0, /* not implemented (non-ephemeral DH) */
+                TLS1_TXT_DH_RSA_WITH_CAMELLIA_128_CBC_SHA,
+                TLS1_CK_DH_RSA_WITH_CAMELLIA_128_CBC_SHA,
+                SSL_kDHr,
+                SSL_aDH,
+                SSL_CAMELLIA128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 44 */
         {
-        1,
-        TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA,
-        TLS1_CK_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA,
-        SSL_kEDH,
-        SSL_aDSS,
-        SSL_CAMELLIA128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA,
+                TLS1_CK_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA,
+                SSL_kEDH,
+                SSL_aDSS,
+                SSL_CAMELLIA128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 45 */
         {
-        1,
-        TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
-        TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
-        SSL_kEDH,
-        SSL_aRSA,
-        SSL_CAMELLIA128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
+                TLS1_CK_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
+                SSL_kEDH,
+                SSL_aRSA,
+                SSL_CAMELLIA128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 46 */
         {
-        1,
-        TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA,
-        TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA,
-        SSL_kEDH,
-        SSL_aNULL,
-        SSL_CAMELLIA128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_ADH_WITH_CAMELLIA_128_CBC_SHA,
+                TLS1_CK_ADH_WITH_CAMELLIA_128_CBC_SHA,
+                SSL_kEDH,
+                SSL_aNULL,
+                SSL_CAMELLIA128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 #endif /* OPENSSL_NO_CAMELLIA */
 
@@ -1273,288 +1273,288 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 #if 0
         /* Cipher 60 */
         {
-        1,
-        TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_MD5,
-        TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_MD5,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_RC4,
-        SSL_MD5,
-        SSL_TLSV1,
-        SSL_EXPORT|SSL_EXP56,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        56,
-        128,
+                1,
+                TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_MD5,
+                TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_MD5,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_RC4,
+                SSL_MD5,
+                SSL_TLSV1,
+                SSL_EXPORT|SSL_EXP56,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                56,
+                128,
         },
 
         /* Cipher 61 */
         {
-        1,
-        TLS1_TXT_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5,
-        TLS1_CK_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_RC2,
-        SSL_MD5,
-        SSL_TLSV1,
-        SSL_EXPORT|SSL_EXP56,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        56,
-        128,
+                1,
+                TLS1_TXT_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5,
+                TLS1_CK_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_RC2,
+                SSL_MD5,
+                SSL_TLSV1,
+                SSL_EXPORT|SSL_EXP56,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                56,
+                128,
         },
 #endif
 
         /* Cipher 62 */
         {
-        1,
-        TLS1_TXT_RSA_EXPORT1024_WITH_DES_CBC_SHA,
-        TLS1_CK_RSA_EXPORT1024_WITH_DES_CBC_SHA,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_EXPORT|SSL_EXP56,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        56,
-        56,
+                1,
+                TLS1_TXT_RSA_EXPORT1024_WITH_DES_CBC_SHA,
+                TLS1_CK_RSA_EXPORT1024_WITH_DES_CBC_SHA,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_EXPORT|SSL_EXP56,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                56,
+                56,
         },
 
         /* Cipher 63 */
         {
-        1,
-        TLS1_TXT_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
-        TLS1_CK_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
-        SSL_kEDH,
-        SSL_aDSS,
-        SSL_DES,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_EXPORT|SSL_EXP56,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        56,
-        56,
+                1,
+                TLS1_TXT_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
+                TLS1_CK_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
+                SSL_kEDH,
+                SSL_aDSS,
+                SSL_DES,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_EXPORT|SSL_EXP56,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                56,
+                56,
         },
 
         /* Cipher 64 */
         {
-        1,
-        TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_SHA,
-        TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_SHA,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_RC4,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_EXPORT|SSL_EXP56,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        56,
-        128,
+                1,
+                TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_SHA,
+                TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_SHA,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_RC4,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_EXPORT|SSL_EXP56,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                56,
+                128,
         },
 
         /* Cipher 65 */
         {
-        1,
-        TLS1_TXT_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA,
-        TLS1_CK_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA,
-        SSL_kEDH,
-        SSL_aDSS,
-        SSL_RC4,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_EXPORT|SSL_EXP56,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        56,
-        128,
+                1,
+                TLS1_TXT_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA,
+                TLS1_CK_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA,
+                SSL_kEDH,
+                SSL_aDSS,
+                SSL_RC4,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_EXPORT|SSL_EXP56,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                56,
+                128,
         },
 
         /* Cipher 66 */
         {
-        1,
-        TLS1_TXT_DHE_DSS_WITH_RC4_128_SHA,
-        TLS1_CK_DHE_DSS_WITH_RC4_128_SHA,
-        SSL_kEDH,
-        SSL_aDSS,
-        SSL_RC4,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_DHE_DSS_WITH_RC4_128_SHA,
+                TLS1_CK_DHE_DSS_WITH_RC4_128_SHA,
+                SSL_kEDH,
+                SSL_aDSS,
+                SSL_RC4,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 #endif
 
         /* TLS v1.2 ciphersuites */
         /* Cipher 67 */
         {
-        1,
-        TLS1_TXT_DHE_RSA_WITH_AES_128_SHA256,
-        TLS1_CK_DHE_RSA_WITH_AES_128_SHA256,
-        SSL_kEDH,
-        SSL_aRSA,
-        SSL_AES128,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_DHE_RSA_WITH_AES_128_SHA256,
+                TLS1_CK_DHE_RSA_WITH_AES_128_SHA256,
+                SSL_kEDH,
+                SSL_aRSA,
+                SSL_AES128,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 68 */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        TLS1_TXT_DH_DSS_WITH_AES_256_SHA256,
-        TLS1_CK_DH_DSS_WITH_AES_256_SHA256,
-        SSL_kDHd,
-        SSL_aDH,
-        SSL_AES256,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                0, /* not implemented (non-ephemeral DH) */
+                TLS1_TXT_DH_DSS_WITH_AES_256_SHA256,
+                TLS1_CK_DH_DSS_WITH_AES_256_SHA256,
+                SSL_kDHd,
+                SSL_aDH,
+                SSL_AES256,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher 69 */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        TLS1_TXT_DH_RSA_WITH_AES_256_SHA256,
-        TLS1_CK_DH_RSA_WITH_AES_256_SHA256,
-        SSL_kDHr,
-        SSL_aDH,
-        SSL_AES256,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                0, /* not implemented (non-ephemeral DH) */
+                TLS1_TXT_DH_RSA_WITH_AES_256_SHA256,
+                TLS1_CK_DH_RSA_WITH_AES_256_SHA256,
+                SSL_kDHr,
+                SSL_aDH,
+                SSL_AES256,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher 6A */
         {
-        1,
-        TLS1_TXT_DHE_DSS_WITH_AES_256_SHA256,
-        TLS1_CK_DHE_DSS_WITH_AES_256_SHA256,
-        SSL_kEDH,
-        SSL_aDSS,
-        SSL_AES256,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_DHE_DSS_WITH_AES_256_SHA256,
+                TLS1_CK_DHE_DSS_WITH_AES_256_SHA256,
+                SSL_kEDH,
+                SSL_aDSS,
+                SSL_AES256,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher 6B */
         {
-        1,
-        TLS1_TXT_DHE_RSA_WITH_AES_256_SHA256,
-        TLS1_CK_DHE_RSA_WITH_AES_256_SHA256,
-        SSL_kEDH,
-        SSL_aRSA,
-        SSL_AES256,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_DHE_RSA_WITH_AES_256_SHA256,
+                TLS1_CK_DHE_RSA_WITH_AES_256_SHA256,
+                SSL_kEDH,
+                SSL_aRSA,
+                SSL_AES256,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher 6C */
         {
-        1,
-        TLS1_TXT_ADH_WITH_AES_128_SHA256,
-        TLS1_CK_ADH_WITH_AES_128_SHA256,
-        SSL_kEDH,
-        SSL_aNULL,
-        SSL_AES128,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_ADH_WITH_AES_128_SHA256,
+                TLS1_CK_ADH_WITH_AES_128_SHA256,
+                SSL_kEDH,
+                SSL_aNULL,
+                SSL_AES128,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 6D */
         {
-        1,
-        TLS1_TXT_ADH_WITH_AES_256_SHA256,
-        TLS1_CK_ADH_WITH_AES_256_SHA256,
-        SSL_kEDH,
-        SSL_aNULL,
-        SSL_AES256,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_ADH_WITH_AES_256_SHA256,
+                TLS1_CK_ADH_WITH_AES_256_SHA256,
+                SSL_kEDH,
+                SSL_aNULL,
+                SSL_AES256,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* GOST Ciphersuites */
 
         {
-        1,
-        "GOST94-GOST89-GOST89",
-        0x3000080,
-        SSL_kGOST,
-        SSL_aGOST94,
-        SSL_eGOST2814789CNT,
-        SSL_GOST89MAC,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_GOST94|TLS1_PRF_GOST94|TLS1_STREAM_MAC,
-        256,
-        256
-        },
-        {
-        1,
-        "GOST2001-GOST89-GOST89",
-        0x3000081,
-        SSL_kGOST,
-        SSL_aGOST01,
-        SSL_eGOST2814789CNT,
-        SSL_GOST89MAC,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_GOST94|TLS1_PRF_GOST94|TLS1_STREAM_MAC,
-        256,
-        256
-        },
-        {
-        1,
-        "GOST94-NULL-GOST94",
-        0x3000082,
-        SSL_kGOST,
-        SSL_aGOST94,
-        SSL_eNULL,
-        SSL_GOST94,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_STRONG_NONE,
-        SSL_HANDSHAKE_MAC_GOST94|TLS1_PRF_GOST94,
-        0,
-        0
-        },
-        {
-        1,
-        "GOST2001-NULL-GOST94",
-        0x3000083,
-        SSL_kGOST,
-        SSL_aGOST01,
-        SSL_eNULL,
-        SSL_GOST94,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_STRONG_NONE,
-        SSL_HANDSHAKE_MAC_GOST94|TLS1_PRF_GOST94,
-        0,
-        0
+                1,
+                "GOST94-GOST89-GOST89",
+                0x3000080,
+                SSL_kGOST,
+                SSL_aGOST94,
+                SSL_eGOST2814789CNT,
+                SSL_GOST89MAC,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_GOST94|TLS1_PRF_GOST94|TLS1_STREAM_MAC,
+                256,
+                256
+        },
+        {
+                1,
+                "GOST2001-GOST89-GOST89",
+                0x3000081,
+                SSL_kGOST,
+                SSL_aGOST01,
+                SSL_eGOST2814789CNT,
+                SSL_GOST89MAC,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_GOST94|TLS1_PRF_GOST94|TLS1_STREAM_MAC,
+                256,
+                256
+        },
+        {
+                1,
+                "GOST94-NULL-GOST94",
+                0x3000082,
+                SSL_kGOST,
+                SSL_aGOST94,
+                SSL_eNULL,
+                SSL_GOST94,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_STRONG_NONE,
+                SSL_HANDSHAKE_MAC_GOST94|TLS1_PRF_GOST94,
+                0,
+                0
+        },
+        {
+                1,
+                "GOST2001-NULL-GOST94",
+                0x3000083,
+                SSL_kGOST,
+                SSL_aGOST01,
+                SSL_eNULL,
+                SSL_GOST94,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_STRONG_NONE,
+                SSL_HANDSHAKE_MAC_GOST94|TLS1_PRF_GOST94,
+                0,
+                0
         },
 
 #ifndef OPENSSL_NO_CAMELLIA
@@ -1562,163 +1562,163 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
         /* Cipher 84 */
         {
-        1,
-        TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA,
-        TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_CAMELLIA256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA,
+                TLS1_CK_RSA_WITH_CAMELLIA_256_CBC_SHA,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_CAMELLIA256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
         /* Cipher 85 */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        TLS1_TXT_DH_DSS_WITH_CAMELLIA_256_CBC_SHA,
-        TLS1_CK_DH_DSS_WITH_CAMELLIA_256_CBC_SHA,
-        SSL_kDHd,
-        SSL_aDH,
-        SSL_CAMELLIA256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                0, /* not implemented (non-ephemeral DH) */
+                TLS1_TXT_DH_DSS_WITH_CAMELLIA_256_CBC_SHA,
+                TLS1_CK_DH_DSS_WITH_CAMELLIA_256_CBC_SHA,
+                SSL_kDHd,
+                SSL_aDH,
+                SSL_CAMELLIA256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher 86 */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        TLS1_TXT_DH_RSA_WITH_CAMELLIA_256_CBC_SHA,
-        TLS1_CK_DH_RSA_WITH_CAMELLIA_256_CBC_SHA,
-        SSL_kDHr,
-        SSL_aDH,
-        SSL_CAMELLIA256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                0, /* not implemented (non-ephemeral DH) */
+                TLS1_TXT_DH_RSA_WITH_CAMELLIA_256_CBC_SHA,
+                TLS1_CK_DH_RSA_WITH_CAMELLIA_256_CBC_SHA,
+                SSL_kDHr,
+                SSL_aDH,
+                SSL_CAMELLIA256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher 87 */
         {
-        1,
-        TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA,
-        TLS1_CK_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA,
-        SSL_kEDH,
-        SSL_aDSS,
-        SSL_CAMELLIA256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA,
+                TLS1_CK_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA,
+                SSL_kEDH,
+                SSL_aDSS,
+                SSL_CAMELLIA256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher 88 */
         {
-        1,
-        TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
-        TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
-        SSL_kEDH,
-        SSL_aRSA,
-        SSL_CAMELLIA256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
+                TLS1_CK_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
+                SSL_kEDH,
+                SSL_aRSA,
+                SSL_CAMELLIA256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher 89 */
         {
-        1,
-        TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA,
-        TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA,
-        SSL_kEDH,
-        SSL_aNULL,
-        SSL_CAMELLIA256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_ADH_WITH_CAMELLIA_256_CBC_SHA,
+                TLS1_CK_ADH_WITH_CAMELLIA_256_CBC_SHA,
+                SSL_kEDH,
+                SSL_aNULL,
+                SSL_CAMELLIA256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 #endif /* OPENSSL_NO_CAMELLIA */
 
 #ifndef OPENSSL_NO_PSK
         /* Cipher 8A */
         {
-        1,
-        TLS1_TXT_PSK_WITH_RC4_128_SHA,
-        TLS1_CK_PSK_WITH_RC4_128_SHA,
-        SSL_kPSK,
-        SSL_aPSK,
-        SSL_RC4,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_PSK_WITH_RC4_128_SHA,
+                TLS1_CK_PSK_WITH_RC4_128_SHA,
+                SSL_kPSK,
+                SSL_aPSK,
+                SSL_RC4,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 8B */
         {
-        1,
-        TLS1_TXT_PSK_WITH_3DES_EDE_CBC_SHA,
-        TLS1_CK_PSK_WITH_3DES_EDE_CBC_SHA,
-        SSL_kPSK,
-        SSL_aPSK,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                1,
+                TLS1_TXT_PSK_WITH_3DES_EDE_CBC_SHA,
+                TLS1_CK_PSK_WITH_3DES_EDE_CBC_SHA,
+                SSL_kPSK,
+                SSL_aPSK,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
         /* Cipher 8C */
         {
-        1,
-        TLS1_TXT_PSK_WITH_AES_128_CBC_SHA,
-        TLS1_CK_PSK_WITH_AES_128_CBC_SHA,
-        SSL_kPSK,
-        SSL_aPSK,
-        SSL_AES128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_PSK_WITH_AES_128_CBC_SHA,
+                TLS1_CK_PSK_WITH_AES_128_CBC_SHA,
+                SSL_kPSK,
+                SSL_aPSK,
+                SSL_AES128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 8D */
         {
-        1,
-        TLS1_TXT_PSK_WITH_AES_256_CBC_SHA,
-        TLS1_CK_PSK_WITH_AES_256_CBC_SHA,
-        SSL_kPSK,
-        SSL_aPSK,
-        SSL_AES256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_PSK_WITH_AES_256_CBC_SHA,
+                TLS1_CK_PSK_WITH_AES_256_CBC_SHA,
+                SSL_kPSK,
+                SSL_aPSK,
+                SSL_AES256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 #endif  /* OPENSSL_NO_PSK */
 
@@ -1727,98 +1727,98 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
         /* Cipher 96 */
         {
-        1,
-        TLS1_TXT_RSA_WITH_SEED_SHA,
-        TLS1_CK_RSA_WITH_SEED_SHA,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_SEED,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_RSA_WITH_SEED_SHA,
+                TLS1_CK_RSA_WITH_SEED_SHA,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_SEED,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 97 */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        TLS1_TXT_DH_DSS_WITH_SEED_SHA,
-        TLS1_CK_DH_DSS_WITH_SEED_SHA,
-        SSL_kDHd,
-        SSL_aDH,
-        SSL_SEED,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                0, /* not implemented (non-ephemeral DH) */
+                TLS1_TXT_DH_DSS_WITH_SEED_SHA,
+                TLS1_CK_DH_DSS_WITH_SEED_SHA,
+                SSL_kDHd,
+                SSL_aDH,
+                SSL_SEED,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 98 */
         {
-        0, /* not implemented (non-ephemeral DH) */
-        TLS1_TXT_DH_RSA_WITH_SEED_SHA,
-        TLS1_CK_DH_RSA_WITH_SEED_SHA,
-        SSL_kDHr,
-        SSL_aDH,
-        SSL_SEED,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                0, /* not implemented (non-ephemeral DH) */
+                TLS1_TXT_DH_RSA_WITH_SEED_SHA,
+                TLS1_CK_DH_RSA_WITH_SEED_SHA,
+                SSL_kDHr,
+                SSL_aDH,
+                SSL_SEED,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 99 */
         {
-        1,
-        TLS1_TXT_DHE_DSS_WITH_SEED_SHA,
-        TLS1_CK_DHE_DSS_WITH_SEED_SHA,
-        SSL_kEDH,
-        SSL_aDSS,
-        SSL_SEED,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_DHE_DSS_WITH_SEED_SHA,
+                TLS1_CK_DHE_DSS_WITH_SEED_SHA,
+                SSL_kEDH,
+                SSL_aDSS,
+                SSL_SEED,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 9A */
         {
-        1,
-        TLS1_TXT_DHE_RSA_WITH_SEED_SHA,
-        TLS1_CK_DHE_RSA_WITH_SEED_SHA,
-        SSL_kEDH,
-        SSL_aRSA,
-        SSL_SEED,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_DHE_RSA_WITH_SEED_SHA,
+                TLS1_CK_DHE_RSA_WITH_SEED_SHA,
+                SSL_kEDH,
+                SSL_aRSA,
+                SSL_SEED,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher 9B */
         {
-        1,
-        TLS1_TXT_ADH_WITH_SEED_SHA,
-        TLS1_CK_ADH_WITH_SEED_SHA,
-        SSL_kEDH,
-        SSL_aNULL,
-        SSL_SEED,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_ADH_WITH_SEED_SHA,
+                TLS1_CK_ADH_WITH_SEED_SHA,
+                SSL_kEDH,
+                SSL_aNULL,
+                SSL_SEED,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
 #endif /* OPENSSL_NO_SEED */
@@ -1827,741 +1827,741 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
         /* Cipher 9C */
         {
-        1,
-        TLS1_TXT_RSA_WITH_AES_128_GCM_SHA256,
-        TLS1_CK_RSA_WITH_AES_128_GCM_SHA256,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_AES128GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
-        128,
-        128,
+                1,
+                TLS1_TXT_RSA_WITH_AES_128_GCM_SHA256,
+                TLS1_CK_RSA_WITH_AES_128_GCM_SHA256,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_AES128GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+                128,
+                128,
         },
 
         /* Cipher 9D */
         {
-        1,
-        TLS1_TXT_RSA_WITH_AES_256_GCM_SHA384,
-        TLS1_CK_RSA_WITH_AES_256_GCM_SHA384,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_AES256GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
-        256,
-        256,
+                1,
+                TLS1_TXT_RSA_WITH_AES_256_GCM_SHA384,
+                TLS1_CK_RSA_WITH_AES_256_GCM_SHA384,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_AES256GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
+                256,
+                256,
         },
 
         /* Cipher 9E */
         {
-        1,
-        TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256,
-        TLS1_CK_DHE_RSA_WITH_AES_128_GCM_SHA256,
-        SSL_kEDH,
-        SSL_aRSA,
-        SSL_AES128GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
-        128,
-        128,
+                1,
+                TLS1_TXT_DHE_RSA_WITH_AES_128_GCM_SHA256,
+                TLS1_CK_DHE_RSA_WITH_AES_128_GCM_SHA256,
+                SSL_kEDH,
+                SSL_aRSA,
+                SSL_AES128GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+                128,
+                128,
         },
 
         /* Cipher 9F */
         {
-        1,
-        TLS1_TXT_DHE_RSA_WITH_AES_256_GCM_SHA384,
-        TLS1_CK_DHE_RSA_WITH_AES_256_GCM_SHA384,
-        SSL_kEDH,
-        SSL_aRSA,
-        SSL_AES256GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
-        256,
-        256,
+                1,
+                TLS1_TXT_DHE_RSA_WITH_AES_256_GCM_SHA384,
+                TLS1_CK_DHE_RSA_WITH_AES_256_GCM_SHA384,
+                SSL_kEDH,
+                SSL_aRSA,
+                SSL_AES256GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
+                256,
+                256,
         },
 
         /* Cipher A0 */
         {
-        0,
-        TLS1_TXT_DH_RSA_WITH_AES_128_GCM_SHA256,
-        TLS1_CK_DH_RSA_WITH_AES_128_GCM_SHA256,
-        SSL_kDHr,
-        SSL_aDH,
-        SSL_AES128GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
-        128,
-        128,
+                0,
+                TLS1_TXT_DH_RSA_WITH_AES_128_GCM_SHA256,
+                TLS1_CK_DH_RSA_WITH_AES_128_GCM_SHA256,
+                SSL_kDHr,
+                SSL_aDH,
+                SSL_AES128GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+                128,
+                128,
         },
 
         /* Cipher A1 */
         {
-        0,
-        TLS1_TXT_DH_RSA_WITH_AES_256_GCM_SHA384,
-        TLS1_CK_DH_RSA_WITH_AES_256_GCM_SHA384,
-        SSL_kDHr,
-        SSL_aDH,
-        SSL_AES256GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
-        256,
-        256,
+                0,
+                TLS1_TXT_DH_RSA_WITH_AES_256_GCM_SHA384,
+                TLS1_CK_DH_RSA_WITH_AES_256_GCM_SHA384,
+                SSL_kDHr,
+                SSL_aDH,
+                SSL_AES256GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
+                256,
+                256,
         },
 
         /* Cipher A2 */
         {
-        1,
-        TLS1_TXT_DHE_DSS_WITH_AES_128_GCM_SHA256,
-        TLS1_CK_DHE_DSS_WITH_AES_128_GCM_SHA256,
-        SSL_kEDH,
-        SSL_aDSS,
-        SSL_AES128GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
-        128,
-        128,
+                1,
+                TLS1_TXT_DHE_DSS_WITH_AES_128_GCM_SHA256,
+                TLS1_CK_DHE_DSS_WITH_AES_128_GCM_SHA256,
+                SSL_kEDH,
+                SSL_aDSS,
+                SSL_AES128GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+                128,
+                128,
         },
 
         /* Cipher A3 */
         {
-        1,
-        TLS1_TXT_DHE_DSS_WITH_AES_256_GCM_SHA384,
-        TLS1_CK_DHE_DSS_WITH_AES_256_GCM_SHA384,
-        SSL_kEDH,
-        SSL_aDSS,
-        SSL_AES256GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
-        256,
-        256,
+                1,
+                TLS1_TXT_DHE_DSS_WITH_AES_256_GCM_SHA384,
+                TLS1_CK_DHE_DSS_WITH_AES_256_GCM_SHA384,
+                SSL_kEDH,
+                SSL_aDSS,
+                SSL_AES256GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
+                256,
+                256,
         },
 
         /* Cipher A4 */
         {
-        0,
-        TLS1_TXT_DH_DSS_WITH_AES_128_GCM_SHA256,
-        TLS1_CK_DH_DSS_WITH_AES_128_GCM_SHA256,
-        SSL_kDHd,
-        SSL_aDH,
-        SSL_AES128GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
-        128,
-        128,
+                0,
+                TLS1_TXT_DH_DSS_WITH_AES_128_GCM_SHA256,
+                TLS1_CK_DH_DSS_WITH_AES_128_GCM_SHA256,
+                SSL_kDHd,
+                SSL_aDH,
+                SSL_AES128GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+                128,
+                128,
         },
 
         /* Cipher A5 */
         {
-        0,
-        TLS1_TXT_DH_DSS_WITH_AES_256_GCM_SHA384,
-        TLS1_CK_DH_DSS_WITH_AES_256_GCM_SHA384,
-        SSL_kDHd,
-        SSL_aDH,
-        SSL_AES256GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
-        256,
-        256,
+                0,
+                TLS1_TXT_DH_DSS_WITH_AES_256_GCM_SHA384,
+                TLS1_CK_DH_DSS_WITH_AES_256_GCM_SHA384,
+                SSL_kDHd,
+                SSL_aDH,
+                SSL_AES256GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
+                256,
+                256,
         },
 
         /* Cipher A6 */
         {
-        1,
-        TLS1_TXT_ADH_WITH_AES_128_GCM_SHA256,
-        TLS1_CK_ADH_WITH_AES_128_GCM_SHA256,
-        SSL_kEDH,
-        SSL_aNULL,
-        SSL_AES128GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
-        128,
-        128,
+                1,
+                TLS1_TXT_ADH_WITH_AES_128_GCM_SHA256,
+                TLS1_CK_ADH_WITH_AES_128_GCM_SHA256,
+                SSL_kEDH,
+                SSL_aNULL,
+                SSL_AES128GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+                128,
+                128,
         },
 
         /* Cipher A7 */
         {
-        1,
-        TLS1_TXT_ADH_WITH_AES_256_GCM_SHA384,
-        TLS1_CK_ADH_WITH_AES_256_GCM_SHA384,
-        SSL_kEDH,
-        SSL_aNULL,
-        SSL_AES256GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
-        256,
-        256,
+                1,
+                TLS1_TXT_ADH_WITH_AES_256_GCM_SHA384,
+                TLS1_CK_ADH_WITH_AES_256_GCM_SHA384,
+                SSL_kEDH,
+                SSL_aNULL,
+                SSL_AES256GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
+                256,
+                256,
         },
 
 #ifndef OPENSSL_NO_ECDH
         /* Cipher C001 */
         {
-        1,
-        TLS1_TXT_ECDH_ECDSA_WITH_NULL_SHA,
-        TLS1_CK_ECDH_ECDSA_WITH_NULL_SHA,
-        SSL_kECDHe,
-        SSL_aECDH,
-        SSL_eNULL,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        0,
-        0,
+                1,
+                TLS1_TXT_ECDH_ECDSA_WITH_NULL_SHA,
+                TLS1_CK_ECDH_ECDSA_WITH_NULL_SHA,
+                SSL_kECDHe,
+                SSL_aECDH,
+                SSL_eNULL,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                0,
+                0,
         },
 
         /* Cipher C002 */
         {
-        1,
-        TLS1_TXT_ECDH_ECDSA_WITH_RC4_128_SHA,
-        TLS1_CK_ECDH_ECDSA_WITH_RC4_128_SHA,
-        SSL_kECDHe,
-        SSL_aECDH,
-        SSL_RC4,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDH_ECDSA_WITH_RC4_128_SHA,
+                TLS1_CK_ECDH_ECDSA_WITH_RC4_128_SHA,
+                SSL_kECDHe,
+                SSL_aECDH,
+                SSL_RC4,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher C003 */
         {
-        1,
-        TLS1_TXT_ECDH_ECDSA_WITH_DES_192_CBC3_SHA,
-        TLS1_CK_ECDH_ECDSA_WITH_DES_192_CBC3_SHA,
-        SSL_kECDHe,
-        SSL_aECDH,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                1,
+                TLS1_TXT_ECDH_ECDSA_WITH_DES_192_CBC3_SHA,
+                TLS1_CK_ECDH_ECDSA_WITH_DES_192_CBC3_SHA,
+                SSL_kECDHe,
+                SSL_aECDH,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
         /* Cipher C004 */
         {
-        1,
-        TLS1_TXT_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
-        TLS1_CK_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
-        SSL_kECDHe,
-        SSL_aECDH,
-        SSL_AES128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
+                TLS1_CK_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
+                SSL_kECDHe,
+                SSL_aECDH,
+                SSL_AES128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher C005 */
         {
-        1,
-        TLS1_TXT_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
-        TLS1_CK_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
-        SSL_kECDHe,
-        SSL_aECDH,
-        SSL_AES256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
+                TLS1_CK_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
+                SSL_kECDHe,
+                SSL_aECDH,
+                SSL_AES256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher C006 */
         {
-        1,
-        TLS1_TXT_ECDHE_ECDSA_WITH_NULL_SHA,
-        TLS1_CK_ECDHE_ECDSA_WITH_NULL_SHA,
-        SSL_kEECDH,
-        SSL_aECDSA,
-        SSL_eNULL,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        0,
-        0,
+                1,
+                TLS1_TXT_ECDHE_ECDSA_WITH_NULL_SHA,
+                TLS1_CK_ECDHE_ECDSA_WITH_NULL_SHA,
+                SSL_kEECDH,
+                SSL_aECDSA,
+                SSL_eNULL,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                0,
+                0,
         },
 
         /* Cipher C007 */
         {
-        1,
-        TLS1_TXT_ECDHE_ECDSA_WITH_RC4_128_SHA,
-        TLS1_CK_ECDHE_ECDSA_WITH_RC4_128_SHA,
-        SSL_kEECDH,
-        SSL_aECDSA,
-        SSL_RC4,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDHE_ECDSA_WITH_RC4_128_SHA,
+                TLS1_CK_ECDHE_ECDSA_WITH_RC4_128_SHA,
+                SSL_kEECDH,
+                SSL_aECDSA,
+                SSL_RC4,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher C008 */
         {
-        1,
-        TLS1_TXT_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA,
-        TLS1_CK_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA,
-        SSL_kEECDH,
-        SSL_aECDSA,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                1,
+                TLS1_TXT_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA,
+                TLS1_CK_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA,
+                SSL_kEECDH,
+                SSL_aECDSA,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
         /* Cipher C009 */
         {
-        1,
-        TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
-        TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
-        SSL_kEECDH,
-        SSL_aECDSA,
-        SSL_AES128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
+                TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
+                SSL_kEECDH,
+                SSL_aECDSA,
+                SSL_AES128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher C00A */
         {
-        1,
-        TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
-        TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
-        SSL_kEECDH,
-        SSL_aECDSA,
-        SSL_AES256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
+                TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
+                SSL_kEECDH,
+                SSL_aECDSA,
+                SSL_AES256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher C00B */
         {
-        1,
-        TLS1_TXT_ECDH_RSA_WITH_NULL_SHA,
-        TLS1_CK_ECDH_RSA_WITH_NULL_SHA,
-        SSL_kECDHr,
-        SSL_aECDH,
-        SSL_eNULL,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        0,
-        0,
+                1,
+                TLS1_TXT_ECDH_RSA_WITH_NULL_SHA,
+                TLS1_CK_ECDH_RSA_WITH_NULL_SHA,
+                SSL_kECDHr,
+                SSL_aECDH,
+                SSL_eNULL,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                0,
+                0,
         },
 
         /* Cipher C00C */
         {
-        1,
-        TLS1_TXT_ECDH_RSA_WITH_RC4_128_SHA,
-        TLS1_CK_ECDH_RSA_WITH_RC4_128_SHA,
-        SSL_kECDHr,
-        SSL_aECDH,
-        SSL_RC4,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDH_RSA_WITH_RC4_128_SHA,
+                TLS1_CK_ECDH_RSA_WITH_RC4_128_SHA,
+                SSL_kECDHr,
+                SSL_aECDH,
+                SSL_RC4,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher C00D */
         {
-        1,
-        TLS1_TXT_ECDH_RSA_WITH_DES_192_CBC3_SHA,
-        TLS1_CK_ECDH_RSA_WITH_DES_192_CBC3_SHA,
-        SSL_kECDHr,
-        SSL_aECDH,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                1,
+                TLS1_TXT_ECDH_RSA_WITH_DES_192_CBC3_SHA,
+                TLS1_CK_ECDH_RSA_WITH_DES_192_CBC3_SHA,
+                SSL_kECDHr,
+                SSL_aECDH,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
         /* Cipher C00E */
         {
-        1,
-        TLS1_TXT_ECDH_RSA_WITH_AES_128_CBC_SHA,
-        TLS1_CK_ECDH_RSA_WITH_AES_128_CBC_SHA,
-        SSL_kECDHr,
-        SSL_aECDH,
-        SSL_AES128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDH_RSA_WITH_AES_128_CBC_SHA,
+                TLS1_CK_ECDH_RSA_WITH_AES_128_CBC_SHA,
+                SSL_kECDHr,
+                SSL_aECDH,
+                SSL_AES128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher C00F */
         {
-        1,
-        TLS1_TXT_ECDH_RSA_WITH_AES_256_CBC_SHA,
-        TLS1_CK_ECDH_RSA_WITH_AES_256_CBC_SHA,
-        SSL_kECDHr,
-        SSL_aECDH,
-        SSL_AES256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_ECDH_RSA_WITH_AES_256_CBC_SHA,
+                TLS1_CK_ECDH_RSA_WITH_AES_256_CBC_SHA,
+                SSL_kECDHr,
+                SSL_aECDH,
+                SSL_AES256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher C010 */
         {
-        1,
-        TLS1_TXT_ECDHE_RSA_WITH_NULL_SHA,
-        TLS1_CK_ECDHE_RSA_WITH_NULL_SHA,
-        SSL_kEECDH,
-        SSL_aRSA,
-        SSL_eNULL,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        0,
-        0,
+                1,
+                TLS1_TXT_ECDHE_RSA_WITH_NULL_SHA,
+                TLS1_CK_ECDHE_RSA_WITH_NULL_SHA,
+                SSL_kEECDH,
+                SSL_aRSA,
+                SSL_eNULL,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                0,
+                0,
         },
 
         /* Cipher C011 */
         {
-        1,
-        TLS1_TXT_ECDHE_RSA_WITH_RC4_128_SHA,
-        TLS1_CK_ECDHE_RSA_WITH_RC4_128_SHA,
-        SSL_kEECDH,
-        SSL_aRSA,
-        SSL_RC4,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDHE_RSA_WITH_RC4_128_SHA,
+                TLS1_CK_ECDHE_RSA_WITH_RC4_128_SHA,
+                SSL_kEECDH,
+                SSL_aRSA,
+                SSL_RC4,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher C012 */
         {
-        1,
-        TLS1_TXT_ECDHE_RSA_WITH_DES_192_CBC3_SHA,
-        TLS1_CK_ECDHE_RSA_WITH_DES_192_CBC3_SHA,
-        SSL_kEECDH,
-        SSL_aRSA,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                1,
+                TLS1_TXT_ECDHE_RSA_WITH_DES_192_CBC3_SHA,
+                TLS1_CK_ECDHE_RSA_WITH_DES_192_CBC3_SHA,
+                SSL_kEECDH,
+                SSL_aRSA,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
         /* Cipher C013 */
         {
-        1,
-        TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA,
-        TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA,
-        SSL_kEECDH,
-        SSL_aRSA,
-        SSL_AES128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA,
+                TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA,
+                SSL_kEECDH,
+                SSL_aRSA,
+                SSL_AES128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher C014 */
         {
-        1,
-        TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA,
-        TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA,
-        SSL_kEECDH,
-        SSL_aRSA,
-        SSL_AES256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA,
+                TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA,
+                SSL_kEECDH,
+                SSL_aRSA,
+                SSL_AES256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher C015 */
         {
-        1,
-        TLS1_TXT_ECDH_anon_WITH_NULL_SHA,
-        TLS1_CK_ECDH_anon_WITH_NULL_SHA,
-        SSL_kEECDH,
-        SSL_aNULL,
-        SSL_eNULL,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        0,
-        0,
+                1,
+                TLS1_TXT_ECDH_anon_WITH_NULL_SHA,
+                TLS1_CK_ECDH_anon_WITH_NULL_SHA,
+                SSL_kEECDH,
+                SSL_aNULL,
+                SSL_eNULL,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_STRONG_NONE|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                0,
+                0,
         },
 
         /* Cipher C016 */
         {
-        1,
-        TLS1_TXT_ECDH_anon_WITH_RC4_128_SHA,
-        TLS1_CK_ECDH_anon_WITH_RC4_128_SHA,
-        SSL_kEECDH,
-        SSL_aNULL,
-        SSL_RC4,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_MEDIUM,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDH_anon_WITH_RC4_128_SHA,
+                TLS1_CK_ECDH_anon_WITH_RC4_128_SHA,
+                SSL_kEECDH,
+                SSL_aNULL,
+                SSL_RC4,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_MEDIUM,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher C017 */
         {
-        1,
-        TLS1_TXT_ECDH_anon_WITH_DES_192_CBC3_SHA,
-        TLS1_CK_ECDH_anon_WITH_DES_192_CBC3_SHA,
-        SSL_kEECDH,
-        SSL_aNULL,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                1,
+                TLS1_TXT_ECDH_anon_WITH_DES_192_CBC3_SHA,
+                TLS1_CK_ECDH_anon_WITH_DES_192_CBC3_SHA,
+                SSL_kEECDH,
+                SSL_aNULL,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
         /* Cipher C018 */
         {
-        1,
-        TLS1_TXT_ECDH_anon_WITH_AES_128_CBC_SHA,
-        TLS1_CK_ECDH_anon_WITH_AES_128_CBC_SHA,
-        SSL_kEECDH,
-        SSL_aNULL,
-        SSL_AES128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDH_anon_WITH_AES_128_CBC_SHA,
+                TLS1_CK_ECDH_anon_WITH_AES_128_CBC_SHA,
+                SSL_kEECDH,
+                SSL_aNULL,
+                SSL_AES128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher C019 */
         {
-        1,
-        TLS1_TXT_ECDH_anon_WITH_AES_256_CBC_SHA,
-        TLS1_CK_ECDH_anon_WITH_AES_256_CBC_SHA,
-        SSL_kEECDH,
-        SSL_aNULL,
-        SSL_AES256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_ECDH_anon_WITH_AES_256_CBC_SHA,
+                TLS1_CK_ECDH_anon_WITH_AES_256_CBC_SHA,
+                SSL_kEECDH,
+                SSL_aNULL,
+                SSL_AES256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 #endif  /* OPENSSL_NO_ECDH */
 
 #ifndef OPENSSL_NO_SRP
         /* Cipher C01A */
         {
-        1,
-        TLS1_TXT_SRP_SHA_WITH_3DES_EDE_CBC_SHA,
-        TLS1_CK_SRP_SHA_WITH_3DES_EDE_CBC_SHA,
-        SSL_kSRP,
-        SSL_aNULL,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                1,
+                TLS1_TXT_SRP_SHA_WITH_3DES_EDE_CBC_SHA,
+                TLS1_CK_SRP_SHA_WITH_3DES_EDE_CBC_SHA,
+                SSL_kSRP,
+                SSL_aNULL,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
         /* Cipher C01B */
         {
-        1,
-        TLS1_TXT_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA,
-        TLS1_CK_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA,
-        SSL_kSRP,
-        SSL_aRSA,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                1,
+                TLS1_TXT_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA,
+                TLS1_CK_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA,
+                SSL_kSRP,
+                SSL_aRSA,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
         /* Cipher C01C */
         {
-        1,
-        TLS1_TXT_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA,
-        TLS1_CK_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA,
-        SSL_kSRP,
-        SSL_aDSS,
-        SSL_3DES,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        168,
-        168,
+                1,
+                TLS1_TXT_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA,
+                TLS1_CK_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA,
+                SSL_kSRP,
+                SSL_aDSS,
+                SSL_3DES,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                168,
+                168,
         },
 
         /* Cipher C01D */
         {
-        1,
-        TLS1_TXT_SRP_SHA_WITH_AES_128_CBC_SHA,
-        TLS1_CK_SRP_SHA_WITH_AES_128_CBC_SHA,
-        SSL_kSRP,
-        SSL_aNULL,
-        SSL_AES128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_SRP_SHA_WITH_AES_128_CBC_SHA,
+                TLS1_CK_SRP_SHA_WITH_AES_128_CBC_SHA,
+                SSL_kSRP,
+                SSL_aNULL,
+                SSL_AES128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher C01E */
         {
-        1,
-        TLS1_TXT_SRP_SHA_RSA_WITH_AES_128_CBC_SHA,
-        TLS1_CK_SRP_SHA_RSA_WITH_AES_128_CBC_SHA,
-        SSL_kSRP,
-        SSL_aRSA,
-        SSL_AES128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_SRP_SHA_RSA_WITH_AES_128_CBC_SHA,
+                TLS1_CK_SRP_SHA_RSA_WITH_AES_128_CBC_SHA,
+                SSL_kSRP,
+                SSL_aRSA,
+                SSL_AES128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher C01F */
         {
-        1,
-        TLS1_TXT_SRP_SHA_DSS_WITH_AES_128_CBC_SHA,
-        TLS1_CK_SRP_SHA_DSS_WITH_AES_128_CBC_SHA,
-        SSL_kSRP,
-        SSL_aDSS,
-        SSL_AES128,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        128,
-        128,
+                1,
+                TLS1_TXT_SRP_SHA_DSS_WITH_AES_128_CBC_SHA,
+                TLS1_CK_SRP_SHA_DSS_WITH_AES_128_CBC_SHA,
+                SSL_kSRP,
+                SSL_aDSS,
+                SSL_AES128,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                128,
+                128,
         },
 
         /* Cipher C020 */
         {
-        1,
-        TLS1_TXT_SRP_SHA_WITH_AES_256_CBC_SHA,
-        TLS1_CK_SRP_SHA_WITH_AES_256_CBC_SHA,
-        SSL_kSRP,
-        SSL_aNULL,
-        SSL_AES256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_SRP_SHA_WITH_AES_256_CBC_SHA,
+                TLS1_CK_SRP_SHA_WITH_AES_256_CBC_SHA,
+                SSL_kSRP,
+                SSL_aNULL,
+                SSL_AES256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher C021 */
         {
-        1,
-        TLS1_TXT_SRP_SHA_RSA_WITH_AES_256_CBC_SHA,
-        TLS1_CK_SRP_SHA_RSA_WITH_AES_256_CBC_SHA,
-        SSL_kSRP,
-        SSL_aRSA,
-        SSL_AES256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_SRP_SHA_RSA_WITH_AES_256_CBC_SHA,
+                TLS1_CK_SRP_SHA_RSA_WITH_AES_256_CBC_SHA,
+                SSL_kSRP,
+                SSL_aRSA,
+                SSL_AES256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 
         /* Cipher C022 */
         {
-        1,
-        TLS1_TXT_SRP_SHA_DSS_WITH_AES_256_CBC_SHA,
-        TLS1_CK_SRP_SHA_DSS_WITH_AES_256_CBC_SHA,
-        SSL_kSRP,
-        SSL_aDSS,
-        SSL_AES256,
-        SSL_SHA1,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
+                1,
+                TLS1_TXT_SRP_SHA_DSS_WITH_AES_256_CBC_SHA,
+                TLS1_CK_SRP_SHA_DSS_WITH_AES_256_CBC_SHA,
+                SSL_kSRP,
+                SSL_aDSS,
+                SSL_AES256,
+                SSL_SHA1,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
         },
 #endif  /* OPENSSL_NO_SRP */
 #ifndef OPENSSL_NO_ECDH
@@ -2570,260 +2570,260 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 
         /* Cipher C023 */
         {
-        1,
-        TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_SHA256,
-        TLS1_CK_ECDHE_ECDSA_WITH_AES_128_SHA256,
-        SSL_kEECDH,
-        SSL_aECDSA,
-        SSL_AES128,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_SHA256,
+                TLS1_CK_ECDHE_ECDSA_WITH_AES_128_SHA256,
+                SSL_kEECDH,
+                SSL_aECDSA,
+                SSL_AES128,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+                128,
+                128,
         },
 
         /* Cipher C024 */
         {
-        1,
-        TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_SHA384,
-        TLS1_CK_ECDHE_ECDSA_WITH_AES_256_SHA384,
-        SSL_kEECDH,
-        SSL_aECDSA,
-        SSL_AES256,
-        SSL_SHA384,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
-        256,
-        256,
+                1,
+                TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_SHA384,
+                TLS1_CK_ECDHE_ECDSA_WITH_AES_256_SHA384,
+                SSL_kEECDH,
+                SSL_aECDSA,
+                SSL_AES256,
+                SSL_SHA384,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
+                256,
+                256,
         },
 
         /* Cipher C025 */
         {
-        1,
-        TLS1_TXT_ECDH_ECDSA_WITH_AES_128_SHA256,
-        TLS1_CK_ECDH_ECDSA_WITH_AES_128_SHA256,
-        SSL_kECDHe,
-        SSL_aECDH,
-        SSL_AES128,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDH_ECDSA_WITH_AES_128_SHA256,
+                TLS1_CK_ECDH_ECDSA_WITH_AES_128_SHA256,
+                SSL_kECDHe,
+                SSL_aECDH,
+                SSL_AES128,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+                128,
+                128,
         },
 
         /* Cipher C026 */
         {
-        1,
-        TLS1_TXT_ECDH_ECDSA_WITH_AES_256_SHA384,
-        TLS1_CK_ECDH_ECDSA_WITH_AES_256_SHA384,
-        SSL_kECDHe,
-        SSL_aECDH,
-        SSL_AES256,
-        SSL_SHA384,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
-        256,
-        256,
+                1,
+                TLS1_TXT_ECDH_ECDSA_WITH_AES_256_SHA384,
+                TLS1_CK_ECDH_ECDSA_WITH_AES_256_SHA384,
+                SSL_kECDHe,
+                SSL_aECDH,
+                SSL_AES256,
+                SSL_SHA384,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
+                256,
+                256,
         },
 
         /* Cipher C027 */
         {
-        1,
-        TLS1_TXT_ECDHE_RSA_WITH_AES_128_SHA256,
-        TLS1_CK_ECDHE_RSA_WITH_AES_128_SHA256,
-        SSL_kEECDH,
-        SSL_aRSA,
-        SSL_AES128,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDHE_RSA_WITH_AES_128_SHA256,
+                TLS1_CK_ECDHE_RSA_WITH_AES_128_SHA256,
+                SSL_kEECDH,
+                SSL_aRSA,
+                SSL_AES128,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+                128,
+                128,
         },
 
         /* Cipher C028 */
         {
-        1,
-        TLS1_TXT_ECDHE_RSA_WITH_AES_256_SHA384,
-        TLS1_CK_ECDHE_RSA_WITH_AES_256_SHA384,
-        SSL_kEECDH,
-        SSL_aRSA,
-        SSL_AES256,
-        SSL_SHA384,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
-        256,
-        256,
+                1,
+                TLS1_TXT_ECDHE_RSA_WITH_AES_256_SHA384,
+                TLS1_CK_ECDHE_RSA_WITH_AES_256_SHA384,
+                SSL_kEECDH,
+                SSL_aRSA,
+                SSL_AES256,
+                SSL_SHA384,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
+                256,
+                256,
         },
 
         /* Cipher C029 */
         {
-        1,
-        TLS1_TXT_ECDH_RSA_WITH_AES_128_SHA256,
-        TLS1_CK_ECDH_RSA_WITH_AES_128_SHA256,
-        SSL_kECDHr,
-        SSL_aECDH,
-        SSL_AES128,
-        SSL_SHA256,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDH_RSA_WITH_AES_128_SHA256,
+                TLS1_CK_ECDH_RSA_WITH_AES_128_SHA256,
+                SSL_kECDHr,
+                SSL_aECDH,
+                SSL_AES128,
+                SSL_SHA256,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+                128,
+                128,
         },
 
         /* Cipher C02A */
         {
-        1,
-        TLS1_TXT_ECDH_RSA_WITH_AES_256_SHA384,
-        TLS1_CK_ECDH_RSA_WITH_AES_256_SHA384,
-        SSL_kECDHr,
-        SSL_aECDH,
-        SSL_AES256,
-        SSL_SHA384,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
-        256,
-        256,
+                1,
+                TLS1_TXT_ECDH_RSA_WITH_AES_256_SHA384,
+                TLS1_CK_ECDH_RSA_WITH_AES_256_SHA384,
+                SSL_kECDHr,
+                SSL_aECDH,
+                SSL_AES256,
+                SSL_SHA384,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
+                256,
+                256,
         },
 
         /* GCM based TLS v1.2 ciphersuites from RFC5289 */
 
         /* Cipher C02B */
         {
-        1,
-        TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
-        TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
-        SSL_kEECDH,
-        SSL_aECDSA,
-        SSL_AES128GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+                TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+                SSL_kEECDH,
+                SSL_aECDSA,
+                SSL_AES128GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+                128,
+                128,
         },
 
         /* Cipher C02C */
         {
-        1,
-        TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-        TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-        SSL_kEECDH,
-        SSL_aECDSA,
-        SSL_AES256GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
-        256,
-        256,
+                1,
+                TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+                TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+                SSL_kEECDH,
+                SSL_aECDSA,
+                SSL_AES256GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
+                256,
+                256,
         },
 
         /* Cipher C02D */
         {
-        1,
-        TLS1_TXT_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,
-        TLS1_CK_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,
-        SSL_kECDHe,
-        SSL_aECDH,
-        SSL_AES128GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,
+                TLS1_CK_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,
+                SSL_kECDHe,
+                SSL_aECDH,
+                SSL_AES128GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+                128,
+                128,
         },
 
         /* Cipher C02E */
         {
-        1,
-        TLS1_TXT_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,
-        TLS1_CK_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,
-        SSL_kECDHe,
-        SSL_aECDH,
-        SSL_AES256GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
-        256,
-        256,
+                1,
+                TLS1_TXT_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,
+                TLS1_CK_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,
+                SSL_kECDHe,
+                SSL_aECDH,
+                SSL_AES256GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
+                256,
+                256,
         },
 
         /* Cipher C02F */
         {
-        1,
-        TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-        TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-        SSL_kEECDH,
-        SSL_aRSA,
-        SSL_AES128GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+                TLS1_CK_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+                SSL_kEECDH,
+                SSL_aRSA,
+                SSL_AES128GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+                128,
+                128,
         },
 
         /* Cipher C030 */
         {
-        1,
-        TLS1_TXT_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
-        TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
-        SSL_kEECDH,
-        SSL_aRSA,
-        SSL_AES256GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
-        256,
-        256,
+                1,
+                TLS1_TXT_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+                TLS1_CK_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+                SSL_kEECDH,
+                SSL_aRSA,
+                SSL_AES256GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
+                256,
+                256,
         },
 
         /* Cipher C031 */
         {
-        1,
-        TLS1_TXT_ECDH_RSA_WITH_AES_128_GCM_SHA256,
-        TLS1_CK_ECDH_RSA_WITH_AES_128_GCM_SHA256,
-        SSL_kECDHr,
-        SSL_aECDH,
-        SSL_AES128GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
-        128,
-        128,
+                1,
+                TLS1_TXT_ECDH_RSA_WITH_AES_128_GCM_SHA256,
+                TLS1_CK_ECDH_RSA_WITH_AES_128_GCM_SHA256,
+                SSL_kECDHr,
+                SSL_aECDH,
+                SSL_AES128GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA256|TLS1_PRF_SHA256,
+                128,
+                128,
         },
 
         /* Cipher C032 */
         {
-        1,
-        TLS1_TXT_ECDH_RSA_WITH_AES_256_GCM_SHA384,
-        TLS1_CK_ECDH_RSA_WITH_AES_256_GCM_SHA384,
-        SSL_kECDHr,
-        SSL_aECDH,
-        SSL_AES256GCM,
-        SSL_AEAD,
-        SSL_TLSV1_2,
-        SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
-        SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
-        256,
-        256,
+                1,
+                TLS1_TXT_ECDH_RSA_WITH_AES_256_GCM_SHA384,
+                TLS1_CK_ECDH_RSA_WITH_AES_256_GCM_SHA384,
+                SSL_kECDHr,
+                SSL_aECDH,
+                SSL_AES256GCM,
+                SSL_AEAD,
+                SSL_TLSV1_2,
+                SSL_NOT_EXP|SSL_HIGH|SSL_FIPS,
+                SSL_HANDSHAKE_MAC_SHA384|TLS1_PRF_SHA384,
+                256,
+                256,
         },
 
 #endif /* OPENSSL_NO_ECDH */
@@ -2832,135 +2832,141 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
 #ifdef TEMP_GOST_TLS
 /* Cipher FF00 */
         {
-        1,
-        "GOST-MD5",
-        0x0300ff00,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_eGOST2814789CNT,
-        SSL_MD5,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256,
-        },
-        {
-        1,
-        "GOST-GOST94",
-        0x0300ff01,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_eGOST2814789CNT,
-        SSL_GOST94,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256
-        },
-        {
-        1,
-        "GOST-GOST89MAC",
-        0x0300ff02,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_eGOST2814789CNT,
-        SSL_GOST89MAC,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
-        256,
-        256
-        },
-        {
-        1,
-        "GOST-GOST89STREAM",
-        0x0300ff03,
-        SSL_kRSA,
-        SSL_aRSA,
-        SSL_eGOST2814789CNT,
-        SSL_GOST89MAC,
-        SSL_TLSV1,
-        SSL_NOT_EXP|SSL_HIGH,
-        SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF|TLS1_STREAM_MAC,
-        256,
-        256
+                1,
+                "GOST-MD5",
+                0x0300ff00,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_eGOST2814789CNT,
+                SSL_MD5,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256,
+        },
+        {
+                1,
+                "GOST-GOST94",
+                0x0300ff01,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_eGOST2814789CNT,
+                SSL_GOST94,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256
+        },
+        {
+                1,
+                "GOST-GOST89MAC",
+                0x0300ff02,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_eGOST2814789CNT,
+                SSL_GOST89MAC,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+                256,
+                256
+        },
+        {
+                1,
+                "GOST-GOST89STREAM",
+                0x0300ff03,
+                SSL_kRSA,
+                SSL_aRSA,
+                SSL_eGOST2814789CNT,
+                SSL_GOST89MAC,
+                SSL_TLSV1,
+                SSL_NOT_EXP|SSL_HIGH,
+                SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF|TLS1_STREAM_MAC,
+                256,
+                256
         },
 #endif
 
 /* end of list */
-        };
+};
 
-SSL3_ENC_METHOD SSLv3_enc_data={
+SSL3_ENC_METHOD SSLv3_enc_data = {
         ssl3_enc,
         n_ssl3_mac,
         ssl3_setup_key_block,
         ssl3_generate_master_secret,
         ssl3_change_cipher_state,
         ssl3_final_finish_mac,
-        MD5_DIGEST_LENGTH+SHA_DIGEST_LENGTH,
+        MD5_DIGEST_LENGTH + SHA_DIGEST_LENGTH,
         ssl3_cert_verify_mac,
-        SSL3_MD_CLIENT_FINISHED_CONST,4,
-        SSL3_MD_SERVER_FINISHED_CONST,4,
+        SSL3_MD_CLIENT_FINISHED_CONST, 4,
+        SSL3_MD_SERVER_FINISHED_CONST, 4,
         ssl3_alert_code,
         (int (*)(SSL *, unsigned char *, size_t, const char *,
-                 size_t, const unsigned char *, size_t,
-                 int use_context))ssl_undefined_function,
-        };
+        size_t, const unsigned char *, size_t,
+        int use_context))ssl_undefined_function,
+};
 
-long ssl3_default_timeout(void)
-        {
+long
+ssl3_default_timeout(void)
+{
         /* 2 hours, the 24 hours mentioned in the SSLv3 spec
          * is way too long for http, the cache would over fill */
-        return(60*60*2);
-        }
-
-int ssl3_num_ciphers(void)
-        {
-        return(SSL3_NUM_CIPHERS);
-        }
-
-const SSL_CIPHER *ssl3_get_cipher(unsigned int u)
-        {
+        return (60*60*2);
+}
+
+int
+ssl3_num_ciphers(void)
+{
+        return (SSL3_NUM_CIPHERS);
+}
+
+const SSL_CIPHER
+*ssl3_get_cipher(unsigned int u)
+{
         if (u < SSL3_NUM_CIPHERS)
-                return(&(ssl3_ciphers[SSL3_NUM_CIPHERS-1-u]));
+                return (&(ssl3_ciphers[SSL3_NUM_CIPHERS - 1 - u]));
         else
-                return(NULL);
-        }
+                return (NULL);
+}
 
-int ssl3_pending(const SSL *s)
-        {
+int
+ssl3_pending(const SSL *s)
+{
         if (s->rstate == SSL_ST_READ_BODY)
                 return 0;
-        
+
         return (s->s3->rrec.type == SSL3_RT_APPLICATION_DATA) ? s->s3->rrec.length : 0;
-        }
+}
 
-int ssl3_new(SSL *s)
-        {
+int
+ssl3_new(SSL *s)
+{
         SSL3_STATE *s3;
 
-        if ((s3=OPENSSL_malloc(sizeof *s3)) == NULL) goto err;
-        memset(s3,0,sizeof *s3);
-        memset(s3->rrec.seq_num,0,sizeof(s3->rrec.seq_num));
-        memset(s3->wrec.seq_num,0,sizeof(s3->wrec.seq_num));
+        if ((s3 = OPENSSL_malloc(sizeof *s3)) == NULL) goto err;
+                memset(s3, 0, sizeof *s3);
+        memset(s3->rrec.seq_num, 0, sizeof(s3->rrec.seq_num));
+        memset(s3->wrec.seq_num, 0, sizeof(s3->wrec.seq_num));
 
-        s->s3=s3;
+        s->s3 = s3;
 
 #ifndef OPENSSL_NO_SRP
         SSL_SRP_CTX_init(s);
 #endif
         s->method->ssl_clear(s);
-        return(1);
+        return (1);
 err:
-        return(0);
-        }
+        return (0);
+}
 
-void ssl3_free(SSL *s)
-        {
-        if(s == NULL)
-            return;
+void
+ssl3_free(SSL *s)
+{
+        if (s == NULL)
+                return;
 
 #ifdef TLSEXT_TYPE_opaque_prf_input
         if (s->s3->client_opaque_prf_input != NULL)
@@ -2986,22 +2992,24 @@ void ssl3_free(SSL *s)
 #endif
 
         if (s->s3->tmp.ca_names != NULL)
-                sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free);
+                sk_X509_NAME_pop_free(s->s3->tmp.ca_names, X509_NAME_free);
         if (s->s3->handshake_buffer) {
                 BIO_free(s->s3->handshake_buffer);
         }
-        if (s->s3->handshake_dgst) ssl3_free_digest_list(s);
+        if (s->s3->handshake_dgst)
+                ssl3_free_digest_list(s);
 #ifndef OPENSSL_NO_SRP
         SSL_SRP_CTX_free(s);
 #endif
-        OPENSSL_cleanse(s->s3,sizeof *s->s3);
+        OPENSSL_cleanse(s->s3, sizeof *s->s3);
         OPENSSL_free(s->s3);
-        s->s3=NULL;
-        }
+        s->s3 = NULL;
+}
 
-void ssl3_clear(SSL *s)
-        {
-        unsigned char *rp,*wp;
+void
+ssl3_clear(SSL *s)
+{
+        unsigned char *rp, *wp;
         size_t rlen, wlen;
         int init_extra;
 
@@ -3016,26 +3024,23 @@ void ssl3_clear(SSL *s)
 
         ssl3_cleanup_key_block(s);
         if (s->s3->tmp.ca_names != NULL)
-                sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free);
+                sk_X509_NAME_pop_free(s->s3->tmp.ca_names, X509_NAME_free);
 
-        if (s->s3->rrec.comp != NULL)
-                {
+        if (s->s3->rrec.comp != NULL) {
                 OPENSSL_free(s->s3->rrec.comp);
-                s->s3->rrec.comp=NULL;
-                }
+                s->s3->rrec.comp = NULL;
+        }
 #ifndef OPENSSL_NO_DH
-        if (s->s3->tmp.dh != NULL)
-                {
+        if (s->s3->tmp.dh != NULL) {
                 DH_free(s->s3->tmp.dh);
                 s->s3->tmp.dh = NULL;
-                }
+        }
 #endif
 #ifndef OPENSSL_NO_ECDH
-        if (s->s3->tmp.ecdh != NULL)
-                {
+        if (s->s3->tmp.ecdh != NULL) {
                 EC_KEY_free(s->s3->tmp.ecdh);
                 s->s3->tmp.ecdh = NULL;
-                }
+        }
 #endif
 #ifndef OPENSSL_NO_TLSEXT
 #ifndef OPENSSL_NO_EC
@@ -3046,7 +3051,7 @@ void ssl3_clear(SSL *s)
         rp = s->s3->rbuf.buf;
         wp = s->s3->wbuf.buf;
         rlen = s->s3->rbuf.len;
-        wlen = s->s3->wbuf.len;
+        wlen = s->s3->wbuf.len;
         init_extra = s->s3->init_extra;
         if (s->s3->handshake_buffer) {
                 BIO_free(s->s3->handshake_buffer);
@@ -3054,104 +3059,100 @@ void ssl3_clear(SSL *s)
         }
         if (s->s3->handshake_dgst) {
                 ssl3_free_digest_list(s);
-        }       
-        memset(s->s3,0,sizeof *s->s3);
+        }
+        memset(s->s3, 0, sizeof *s->s3);
         s->s3->rbuf.buf = rp;
         s->s3->wbuf.buf = wp;
         s->s3->rbuf.len = rlen;
-        s->s3->wbuf.len = wlen;
+        s->s3->wbuf.len = wlen;
         s->s3->init_extra = init_extra;
 
         ssl_free_wbio_buffer(s);
 
-        s->packet_length=0;
-        s->s3->renegotiate=0;
-        s->s3->total_renegotiations=0;
-        s->s3->num_renegotiations=0;
-        s->s3->in_read_app_data=0;
-        s->version=SSL3_VERSION;
+        s->packet_length = 0;
+        s->s3->renegotiate = 0;
+        s->s3->total_renegotiations = 0;
+        s->s3->num_renegotiations = 0;
+        s->s3->in_read_app_data = 0;
+        s->version = SSL3_VERSION;
 
 #if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)
-        if (s->next_proto_negotiated)
-                {
+        if (s->next_proto_negotiated) {
                 OPENSSL_free(s->next_proto_negotiated);
                 s->next_proto_negotiated = NULL;
                 s->next_proto_negotiated_len = 0;
-                }
-#endif
         }
+#endif
+}
 
 #ifndef OPENSSL_NO_SRP
-static char * srp_password_from_info_cb(SSL *s, void *arg)
-        {
-        return BUF_strdup(s->srp_ctx.info) ;
-        }
+static char *
+srp_password_from_info_cb(SSL *s, void *arg)
+{
+        return BUF_strdup(s->srp_ctx.info);
+}
 #endif
 
-long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
-        {
-        int ret=0;
+long
+ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
+{
+        int ret = 0;
 
 #if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_RSA)
         if (
 #ifndef OPENSSL_NO_RSA
-            cmd == SSL_CTRL_SET_TMP_RSA ||
-            cmd == SSL_CTRL_SET_TMP_RSA_CB ||
+        cmd == SSL_CTRL_SET_TMP_RSA ||
+        cmd == SSL_CTRL_SET_TMP_RSA_CB ||
 #endif
 #ifndef OPENSSL_NO_DSA
-            cmd == SSL_CTRL_SET_TMP_DH ||
-            cmd == SSL_CTRL_SET_TMP_DH_CB ||
+        cmd == SSL_CTRL_SET_TMP_DH ||
+        cmd == SSL_CTRL_SET_TMP_DH_CB ||
 #endif
-                0)
-                {
-                if (!ssl_cert_inst(&s->cert))
-                        {
+        0) {
+                if (!ssl_cert_inst(&s->cert)) {
                         SSLerr(SSL_F_SSL3_CTRL, ERR_R_MALLOC_FAILURE);
-                        return(0);
-                        }
+                        return (0);
                 }
+        }
 #endif
 
-        switch (cmd)
-                {
+        switch (cmd) {
         case SSL_CTRL_GET_SESSION_REUSED:
-                ret=s->hit;
+                ret = s->hit;
                 break;
         case SSL_CTRL_GET_CLIENT_CERT_REQUEST:
                 break;
         case SSL_CTRL_GET_NUM_RENEGOTIATIONS:
-                ret=s->s3->num_renegotiations;
+                ret = s->s3->num_renegotiations;
                 break;
         case SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS:
-                ret=s->s3->num_renegotiations;
-                s->s3->num_renegotiations=0;
+                ret = s->s3->num_renegotiations;
+                s->s3->num_renegotiations = 0;
                 break;
         case SSL_CTRL_GET_TOTAL_RENEGOTIATIONS:
-                ret=s->s3->total_renegotiations;
+                ret = s->s3->total_renegotiations;
                 break;
         case SSL_CTRL_GET_FLAGS:
-                ret=(int)(s->s3->flags);
+                ret = (int)(s->s3->flags);
                 break;
 #ifndef OPENSSL_NO_RSA
         case SSL_CTRL_NEED_TMP_RSA:
                 if ((s->cert != NULL) && (s->cert->rsa_tmp == NULL) &&
-                    ((s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL) ||
-                     (EVP_PKEY_size(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey) > (512/8))))
+                   ((s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL) ||
+                   (EVP_PKEY_size(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey) > (512 / 8))))
                         ret = 1;
                 break;
         case SSL_CTRL_SET_TMP_RSA:
                 {
                         RSA *rsa = (RSA *)parg;
-                        if (rsa == NULL)
-                                {
+                        if (rsa == NULL) {
                                 SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER);
-                                return(ret);
-                                }
-                        if ((rsa = RSAPrivateKey_dup(rsa)) == NULL)
-                                {
+                                return (ret);
+                        }
+                        if ((rsa = RSAPrivateKey_dup(rsa)) == NULL) {
                                 SSLerr(SSL_F_SSL3_CTRL, ERR_R_RSA_LIB);
-                                return(ret);
-                                }
+                                return (ret);
+                        }
                         if (s->cert->rsa_tmp != NULL)
                                 RSA_free(s->cert->rsa_tmp);
                         s->cert->rsa_tmp = rsa;
@@ -3160,8 +3161,8 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
                 break;
         case SSL_CTRL_SET_TMP_RSA_CB:
                 {
-                SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-                return(ret);
+                        SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                        return (ret);
                 }
                 break;
 #endif
@@ -3169,25 +3170,21 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
         case SSL_CTRL_SET_TMP_DH:
                 {
                         DH *dh = (DH *)parg;
-                        if (dh == NULL)
-                                {
+                        if (dh == NULL) {
                                 SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER);
-                                return(ret);
-                                }
-                        if ((dh = DHparams_dup(dh)) == NULL)
-                                {
+                                return (ret);
+                        }
+                        if ((dh = DHparams_dup(dh)) == NULL) {
                                 SSLerr(SSL_F_SSL3_CTRL, ERR_R_DH_LIB);
-                                return(ret);
-                                }
-                        if (!(s->options & SSL_OP_SINGLE_DH_USE))
-                                {
-                                if (!DH_generate_key(dh))
-                                        {
+                                return (ret);
+                        }
+                        if (!(s->options & SSL_OP_SINGLE_DH_USE)) {
+                                if (!DH_generate_key(dh)) {
                                         DH_free(dh);
                                         SSLerr(SSL_F_SSL3_CTRL, ERR_R_DH_LIB);
-                                        return(ret);
-                                        }
+                                        return (ret);
                                 }
+                        }
                         if (s->cert->dh_tmp != NULL)
                                 DH_free(s->cert->dh_tmp);
                         s->cert->dh_tmp = dh;
@@ -3196,79 +3193,70 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
                 break;
         case SSL_CTRL_SET_TMP_DH_CB:
                 {
-                SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-                return(ret);
+                        SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                        return (ret);
                 }
                 break;
 #endif
 #ifndef OPENSSL_NO_ECDH
         case SSL_CTRL_SET_TMP_ECDH:
                 {
-                EC_KEY *ecdh = NULL;
-                        
-                if (parg == NULL)
-                        {
-                        SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER);
-                        return(ret);
+                        EC_KEY *ecdh = NULL;
+
+                        if (parg == NULL) {
+                                SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER);
+                                return (ret);
                         }
-                if (!EC_KEY_up_ref((EC_KEY *)parg))
-                        {
-                        SSLerr(SSL_F_SSL3_CTRL,ERR_R_ECDH_LIB);
-                        return(ret);
+                        if (!EC_KEY_up_ref((EC_KEY *)parg)) {
+                                SSLerr(SSL_F_SSL3_CTRL, ERR_R_ECDH_LIB);
+                                return (ret);
                         }
-                ecdh = (EC_KEY *)parg;
-                if (!(s->options & SSL_OP_SINGLE_ECDH_USE))
-                        {
-                        if (!EC_KEY_generate_key(ecdh))
-                                {
-                                EC_KEY_free(ecdh);
-                                SSLerr(SSL_F_SSL3_CTRL,ERR_R_ECDH_LIB);
-                                return(ret);
+                        ecdh = (EC_KEY *)parg;
+                        if (!(s->options & SSL_OP_SINGLE_ECDH_USE)) {
+                                if (!EC_KEY_generate_key(ecdh)) {
+                                        EC_KEY_free(ecdh);
+                                        SSLerr(SSL_F_SSL3_CTRL, ERR_R_ECDH_LIB);
+                                        return (ret);
                                 }
                         }
-                if (s->cert->ecdh_tmp != NULL)
-                        EC_KEY_free(s->cert->ecdh_tmp);
-                s->cert->ecdh_tmp = ecdh;
-                ret = 1;
+                        if (s->cert->ecdh_tmp != NULL)
+                                EC_KEY_free(s->cert->ecdh_tmp);
+                        s->cert->ecdh_tmp = ecdh;
+                        ret = 1;
                 }
                 break;
         case SSL_CTRL_SET_TMP_ECDH_CB:
                 {
-                SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-                return(ret);
+                        SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                        return (ret);
                 }
                 break;
 #endif /* !OPENSSL_NO_ECDH */
 #ifndef OPENSSL_NO_TLSEXT
         case SSL_CTRL_SET_TLSEXT_HOSTNAME:
-                if (larg == TLSEXT_NAMETYPE_host_name)
-                        {
-                        if (s->tlsext_hostname != NULL) 
+                if (larg == TLSEXT_NAMETYPE_host_name) {
+                        if (s->tlsext_hostname != NULL)
                                 OPENSSL_free(s->tlsext_hostname);
                         s->tlsext_hostname = NULL;
 
                         ret = 1;
-                        if (parg == NULL) 
+                        if (parg == NULL)
                                 break;
-                        if (strlen((char *)parg) > TLSEXT_MAXLEN_host_name)
-                                {
+                        if (strlen((char *)parg) > TLSEXT_MAXLEN_host_name) {
                                 SSLerr(SSL_F_SSL3_CTRL, SSL_R_SSL3_EXT_INVALID_SERVERNAME);
                                 return 0;
-                                }
-                        if ((s->tlsext_hostname = BUF_strdup((char *)parg)) == NULL)
-                                {
+                        }
+                        if ((s->tlsext_hostname = BUF_strdup((char *)parg)) == NULL) {
                                 SSLerr(SSL_F_SSL3_CTRL, ERR_R_INTERNAL_ERROR);
                                 return 0;
-                                }
                         }
-                else
-                        {
+                } else {
                         SSLerr(SSL_F_SSL3_CTRL, SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE);
                         return 0;
-                        }
-                break;
+                }
+                break;
         case SSL_CTRL_SET_TLSEXT_DEBUG_ARG:
-                s->tlsext_debug_arg=parg;
+                s->tlsext_debug_arg = parg;
                 ret = 1;
                 break;
 
@@ -3276,28 +3264,26 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
         case SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT:
                 if (larg > 12288) /* actual internal limit is 2^16 for the complete hello message
                                    * (including the cert chain and everything) */
-                        {
+                {
                         SSLerr(SSL_F_SSL3_CTRL, SSL_R_OPAQUE_PRF_INPUT_TOO_LONG);
                         break;
-                        }
+                }
                 if (s->tlsext_opaque_prf_input != NULL)
                         OPENSSL_free(s->tlsext_opaque_prf_input);
                 if ((size_t)larg == 0)
                         s->tlsext_opaque_prf_input = OPENSSL_malloc(1); /* dummy byte just to get non-NULL */
                 else
                         s->tlsext_opaque_prf_input = BUF_memdup(parg, (size_t)larg);
-                if (s->tlsext_opaque_prf_input != NULL)
-                        {
+                if (s->tlsext_opaque_prf_input != NULL) {
                         s->tlsext_opaque_prf_input_len = (size_t)larg;
                         ret = 1;
-                        }
-                else
+                } else
                         s->tlsext_opaque_prf_input_len = 0;
                 break;
 #endif
 
         case SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE:
-                s->tlsext_status_type=larg;
+                s->tlsext_status_type = larg;
                 ret = 1;
                 break;
 
@@ -3324,7 +3310,7 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
         case SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP:
                 *(unsigned char **)parg = s->tlsext_ocsp_resp;
                 return s->tlsext_ocsp_resplen;
-                
+
         case SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP:
                 if (s->tlsext_ocsp_resp)
                         OPENSSL_free(s->tlsext_ocsp_resp);
@@ -3357,222 +3343,204 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
 #endif /* !OPENSSL_NO_TLSEXT */
         default:
                 break;
-                }
-        return(ret);
         }
+        return (ret);
+}
 
-long ssl3_callback_ctrl(SSL *s, int cmd, void (*fp)(void))
-        {
-        int ret=0;
+long
+ssl3_callback_ctrl(SSL *s, int cmd, void (*fp)(void))
+{
+        int ret = 0;
 
 #if !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_RSA)
         if (
 #ifndef OPENSSL_NO_RSA
-            cmd == SSL_CTRL_SET_TMP_RSA_CB ||
+        cmd == SSL_CTRL_SET_TMP_RSA_CB ||
 #endif
 #ifndef OPENSSL_NO_DSA
-            cmd == SSL_CTRL_SET_TMP_DH_CB ||
+        cmd == SSL_CTRL_SET_TMP_DH_CB ||
 #endif
-                0)
-                {
-                if (!ssl_cert_inst(&s->cert))
-                        {
+        0) {
+                if (!ssl_cert_inst(&s->cert)) {
                         SSLerr(SSL_F_SSL3_CALLBACK_CTRL, ERR_R_MALLOC_FAILURE);
-                        return(0);
-                        }
+                        return (0);
                 }
+        }
 #endif
 
-        switch (cmd)
-                {
+        switch (cmd) {
 #ifndef OPENSSL_NO_RSA
         case SSL_CTRL_SET_TMP_RSA_CB:
                 {
-                s->cert->rsa_tmp_cb = (RSA *(*)(SSL *, int, int))fp;
+                        s->cert->rsa_tmp_cb = (RSA *(*)(SSL *, int, int))fp;
                 }
                 break;
 #endif
 #ifndef OPENSSL_NO_DH
         case SSL_CTRL_SET_TMP_DH_CB:
                 {
-                s->cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp;
+                        s->cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp;
                 }
                 break;
 #endif
 #ifndef OPENSSL_NO_ECDH
         case SSL_CTRL_SET_TMP_ECDH_CB:
                 {
-                s->cert->ecdh_tmp_cb = (EC_KEY *(*)(SSL *, int, int))fp;
+                        s->cert->ecdh_tmp_cb = (EC_KEY *(*)(SSL *, int, int))fp;
                 }
                 break;
 #endif
 #ifndef OPENSSL_NO_TLSEXT
         case SSL_CTRL_SET_TLSEXT_DEBUG_CB:
-                s->tlsext_debug_cb=(void (*)(SSL *,int ,int,
-                                        unsigned char *, int, void *))fp;
+                s->tlsext_debug_cb = (void (*)(SSL *, int , int,
+                unsigned char *, int, void *))fp;
                 break;
 #endif
         default:
                 break;
-                }
-        return(ret);
         }
+        return (ret);
+}
 
-long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
-        {
+long
+ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
+{
         CERT *cert;
 
-        cert=ctx->cert;
+        cert = ctx->cert;
 
-        switch (cmd)
-                {
+        switch (cmd) {
 #ifndef OPENSSL_NO_RSA
         case SSL_CTRL_NEED_TMP_RSA:
-                if (    (cert->rsa_tmp == NULL) &&
-                        ((cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL) ||
-                         (EVP_PKEY_size(cert->pkeys[SSL_PKEY_RSA_ENC].privatekey) > (512/8)))
-                        )
-                        return(1);
+                if ((cert->rsa_tmp == NULL) &&
+                    ((cert->pkeys[SSL_PKEY_RSA_ENC].privatekey == NULL) ||
+                    (EVP_PKEY_size(cert->pkeys[SSL_PKEY_RSA_ENC].privatekey) > (512 / 8)))
+                )
+                return (1);
                 else
-                        return(0);
+                        return (0);
                 /* break; */
         case SSL_CTRL_SET_TMP_RSA:
                 {
-                RSA *rsa;
-                int i;
+                        RSA *rsa;
+                        int i;
 
-                rsa=(RSA *)parg;
-                i=1;
-                if (rsa == NULL)
-                        i=0;
-                else
-                        {
-                        if ((rsa=RSAPrivateKey_dup(rsa)) == NULL)
-                                i=0;
+                        rsa = (RSA *)parg;
+                        i = 1;
+                        if (rsa == NULL)
+                                i = 0;
+                        else {
+                                if ((rsa = RSAPrivateKey_dup(rsa)) == NULL)
+                                        i = 0;
                         }
-                if (!i)
-                        {
-                        SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_RSA_LIB);
-                        return(0);
-                        }
-                else
-                        {
-                        if (cert->rsa_tmp != NULL)
-                                RSA_free(cert->rsa_tmp);
-                        cert->rsa_tmp=rsa;
-                        return(1);
+                        if (!i) {
+                                SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_RSA_LIB);
+                                return (0);
+                        } else {
+                                if (cert->rsa_tmp != NULL)
+                                        RSA_free(cert->rsa_tmp);
+                                cert->rsa_tmp = rsa;
+                                return (1);
                         }
                 }
                 /* break; */
         case SSL_CTRL_SET_TMP_RSA_CB:
                 {
-                SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-                return(0);
+                        SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                        return (0);
                 }
                 break;
 #endif
 #ifndef OPENSSL_NO_DH
         case SSL_CTRL_SET_TMP_DH:
                 {
-                DH *new=NULL,*dh;
+                        DH *new = NULL, *dh;
 
-                dh=(DH *)parg;
-                if ((new=DHparams_dup(dh)) == NULL)
-                        {
-                        SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_DH_LIB);
-                        return 0;
-                        }
-                if (!(ctx->options & SSL_OP_SINGLE_DH_USE))
-                        {
-                        if (!DH_generate_key(new))
-                                {
-                                SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_DH_LIB);
-                                DH_free(new);
+                        dh = (DH *)parg;
+                        if ((new = DHparams_dup(dh)) == NULL) {
+                                SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_DH_LIB);
                                 return 0;
+                        }
+                        if (!(ctx->options & SSL_OP_SINGLE_DH_USE)) {
+                                if (!DH_generate_key(new)) {
+                                        SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_DH_LIB);
+                                        DH_free(new);
+                                        return 0;
                                 }
                         }
-                if (cert->dh_tmp != NULL)
-                        DH_free(cert->dh_tmp);
-                cert->dh_tmp=new;
-                return 1;
+                        if (cert->dh_tmp != NULL)
+                                DH_free(cert->dh_tmp);
+                        cert->dh_tmp = new;
+                        return 1;
                 }
                 /*break; */
         case SSL_CTRL_SET_TMP_DH_CB:
                 {
-                SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-                return(0);
+                        SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                        return (0);
                 }
                 break;
 #endif
 #ifndef OPENSSL_NO_ECDH
         case SSL_CTRL_SET_TMP_ECDH:
                 {
-                EC_KEY *ecdh = NULL;
-                        
-                if (parg == NULL)
-                        {
-                        SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_ECDH_LIB);
-                        return 0;
-                        }
-                ecdh = EC_KEY_dup((EC_KEY *)parg);
-                if (ecdh == NULL)
-                        {
-                        SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_EC_LIB);
-                        return 0;
+                        EC_KEY *ecdh = NULL;
+
+                        if (parg == NULL) {
+                                SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_ECDH_LIB);
+                                return 0;
                         }
-                if (!(ctx->options & SSL_OP_SINGLE_ECDH_USE))
-                        {
-                        if (!EC_KEY_generate_key(ecdh))
-                                {
-                                EC_KEY_free(ecdh);
-                                SSLerr(SSL_F_SSL3_CTX_CTRL,ERR_R_ECDH_LIB);
+                        ecdh = EC_KEY_dup((EC_KEY *)parg);
+                        if (ecdh == NULL) {
+                                SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_EC_LIB);
                                 return 0;
+                        }
+                        if (!(ctx->options & SSL_OP_SINGLE_ECDH_USE)) {
+                                if (!EC_KEY_generate_key(ecdh)) {
+                                        EC_KEY_free(ecdh);
+                                        SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_ECDH_LIB);
+                                        return 0;
                                 }
                         }
 
-                if (cert->ecdh_tmp != NULL)
-                        {
-                        EC_KEY_free(cert->ecdh_tmp);
+                        if (cert->ecdh_tmp != NULL) {
+                                EC_KEY_free(cert->ecdh_tmp);
                         }
-                cert->ecdh_tmp = ecdh;
-                return 1;
+                        cert->ecdh_tmp = ecdh;
+                        return 1;
                 }
                 /* break; */
         case SSL_CTRL_SET_TMP_ECDH_CB:
                 {
-                SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-                return(0);
+                        SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
+                        return (0);
                 }
                 break;
 #endif /* !OPENSSL_NO_ECDH */
 #ifndef OPENSSL_NO_TLSEXT
         case SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG:
-                ctx->tlsext_servername_arg=parg;
+                ctx->tlsext_servername_arg = parg;
                 break;
         case SSL_CTRL_SET_TLSEXT_TICKET_KEYS:
         case SSL_CTRL_GET_TLSEXT_TICKET_KEYS:
                 {
-                unsigned char *keys = parg;
-                if (!keys)
-                        return 48;
-                if (larg != 48)
-                        {
-                        SSLerr(SSL_F_SSL3_CTX_CTRL, SSL_R_INVALID_TICKET_KEYS_LENGTH);
-                        return 0;
-                        }
-                if (cmd == SSL_CTRL_SET_TLSEXT_TICKET_KEYS)
-                        {
-                        memcpy(ctx->tlsext_tick_key_name, keys, 16);
-                        memcpy(ctx->tlsext_tick_hmac_key, keys + 16, 16);
-                        memcpy(ctx->tlsext_tick_aes_key, keys + 32, 16);
+                        unsigned char *keys = parg;
+                        if (!keys)
+                                return 48;
+                        if (larg != 48) {
+                                SSLerr(SSL_F_SSL3_CTX_CTRL, SSL_R_INVALID_TICKET_KEYS_LENGTH);
+                                return 0;
                         }
-                else
-                        {
-                        memcpy(keys, ctx->tlsext_tick_key_name, 16);
-                        memcpy(keys + 16, ctx->tlsext_tick_hmac_key, 16);
-                        memcpy(keys + 32, ctx->tlsext_tick_aes_key, 16);
+                        if (cmd == SSL_CTRL_SET_TLSEXT_TICKET_KEYS) {
+                                memcpy(ctx->tlsext_tick_key_name, keys, 16);
+                                memcpy(ctx->tlsext_tick_hmac_key, keys + 16, 16);
+                                memcpy(ctx->tlsext_tick_aes_key, keys + 32, 16);
+                        } else {
+                                memcpy(keys, ctx->tlsext_tick_key_name, 16);
+                                memcpy(keys + 16, ctx->tlsext_tick_hmac_key, 16);
+                                memcpy(keys + 32, ctx->tlsext_tick_aes_key, 16);
                         }
-                return 1;
+                        return 1;
                 }
 
 #ifdef TLSEXT_TYPE_opaque_prf_input
@@ -3582,7 +3550,7 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
 #endif
 
         case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG:
-                ctx->tlsext_status_arg=parg;
+                ctx->tlsext_status_arg = parg;
                 return 1;
                 break;
 
@@ -3594,182 +3562,182 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
                 ctx->srp_ctx.login = NULL;
                 if (parg == NULL)
                         break;
-                if (strlen((const char *)parg) > 255 || strlen((const char *)parg) < 1)
-                        {
+                if (strlen((const char *)parg) > 255 || strlen((const char *)parg) < 1) {
                         SSLerr(SSL_F_SSL3_CTX_CTRL, SSL_R_INVALID_SRP_USERNAME);
                         return 0;
-                        } 
-                if ((ctx->srp_ctx.login = BUF_strdup((char *)parg)) == NULL)
-                        {
+                }
+                if ((ctx->srp_ctx.login = BUF_strdup((char *)parg)) == NULL) {
                         SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_INTERNAL_ERROR);
                         return 0;
-                        }
+                }
                 break;
         case SSL_CTRL_SET_TLS_EXT_SRP_PASSWORD:
-                ctx->srp_ctx.SRP_give_srp_client_pwd_callback=srp_password_from_info_cb;
-                ctx->srp_ctx.info=parg;
+                ctx->srp_ctx.SRP_give_srp_client_pwd_callback = srp_password_from_info_cb;
+                ctx->srp_ctx.info = parg;
                 break;
         case SSL_CTRL_SET_SRP_ARG:
                 ctx->srp_ctx.srp_Mask|=SSL_kSRP;
-                ctx->srp_ctx.SRP_cb_arg=parg;
+                ctx->srp_ctx.SRP_cb_arg = parg;
                 break;
 
         case SSL_CTRL_SET_TLS_EXT_SRP_STRENGTH:
-                ctx->srp_ctx.strength=larg;
+                ctx->srp_ctx.strength = larg;
                 break;
 #endif
 #endif /* !OPENSSL_NO_TLSEXT */
 
-        /* A Thawte special :-) */
+                /* A Thawte special :-) */
         case SSL_CTRL_EXTRA_CHAIN_CERT:
-                if (ctx->extra_certs == NULL)
-                        {
-                        if ((ctx->extra_certs=sk_X509_new_null()) == NULL)
-                                return(0);
-                        }
+                if (ctx->extra_certs == NULL) {
+                        if ((ctx->extra_certs = sk_X509_new_null()) == NULL)
+                                return (0);
+                }
                 sk_X509_push(ctx->extra_certs,(X509 *)parg);
                 break;
 
         case SSL_CTRL_GET_EXTRA_CHAIN_CERTS:
-                *(STACK_OF(X509) **)parg =  ctx->extra_certs;
+                *(STACK_OF(X509) **)parg = ctx->extra_certs;
                 break;
 
         case SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS:
-                if (ctx->extra_certs)
-                        {
+                if (ctx->extra_certs) {
                         sk_X509_pop_free(ctx->extra_certs, X509_free);
                         ctx->extra_certs = NULL;
-                        }
+                }
                 break;
 
         default:
-                return(0);
-                }
-        return(1);
+                return (0);
         }
+        return (1);
+}
 
-long ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)(void))
-        {
+long
+ssl3_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)(void))
+{
         CERT *cert;
 
-        cert=ctx->cert;
+        cert = ctx->cert;
 
-        switch (cmd)
-                {
+        switch (cmd) {
 #ifndef OPENSSL_NO_RSA
         case SSL_CTRL_SET_TMP_RSA_CB:
                 {
-                cert->rsa_tmp_cb = (RSA *(*)(SSL *, int, int))fp;
+                        cert->rsa_tmp_cb = (RSA *(*)(SSL *, int, int))fp;
                 }
                 break;
 #endif
 #ifndef OPENSSL_NO_DH
         case SSL_CTRL_SET_TMP_DH_CB:
                 {
-                cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp;
+                        cert->dh_tmp_cb = (DH *(*)(SSL *, int, int))fp;
                 }
                 break;
 #endif
 #ifndef OPENSSL_NO_ECDH
         case SSL_CTRL_SET_TMP_ECDH_CB:
                 {
-                cert->ecdh_tmp_cb = (EC_KEY *(*)(SSL *, int, int))fp;
+                        cert->ecdh_tmp_cb = (EC_KEY *(*)(SSL *, int, int))fp;
                 }
                 break;
 #endif
 #ifndef OPENSSL_NO_TLSEXT
         case SSL_CTRL_SET_TLSEXT_SERVERNAME_CB:
-                ctx->tlsext_servername_callback=(int (*)(SSL *,int *,void *))fp;
+                ctx->tlsext_servername_callback = (int (*)(SSL *, int *, void *))fp;
                 break;
 
 #ifdef TLSEXT_TYPE_opaque_prf_input
         case SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT_CB:
-                ctx->tlsext_opaque_prf_input_callback = (int (*)(SSL *,void *, size_t, void *))fp;
+                ctx->tlsext_opaque_prf_input_callback = (int (*)(SSL *, void *, size_t, void *))fp;
                 break;
 #endif
 
         case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB:
-                ctx->tlsext_status_cb=(int (*)(SSL *,void *))fp;
+                ctx->tlsext_status_cb = (int (*)(SSL *, void *))fp;
                 break;
 
         case SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB:
-                ctx->tlsext_ticket_key_cb=(int (*)(SSL *,unsigned char  *,
-                                                unsigned char *,
-                                                EVP_CIPHER_CTX *,
-                                                HMAC_CTX *, int))fp;
+                ctx->tlsext_ticket_key_cb = (int (*)(SSL *, unsigned char  *,
+                    unsigned char *, EVP_CIPHER_CTX *, HMAC_CTX *, int))fp;
                 break;
 
 #ifndef OPENSSL_NO_SRP
         case SSL_CTRL_SET_SRP_VERIFY_PARAM_CB:
                 ctx->srp_ctx.srp_Mask|=SSL_kSRP;
-                ctx->srp_ctx.SRP_verify_param_callback=(int (*)(SSL *,void *))fp;
+                ctx->srp_ctx.SRP_verify_param_callback =
+                    (int (*)(SSL *, void *))fp;
                 break;
         case SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB:
                 ctx->srp_ctx.srp_Mask|=SSL_kSRP;
-                ctx->srp_ctx.TLS_ext_srp_username_callback=(int (*)(SSL *,int *,void *))fp;
+                ctx->srp_ctx.TLS_ext_srp_username_callback =
+                    (int (*)(SSL *, int *, void *))fp;
                 break;
         case SSL_CTRL_SET_SRP_GIVE_CLIENT_PWD_CB:
                 ctx->srp_ctx.srp_Mask|=SSL_kSRP;
-                ctx->srp_ctx.SRP_give_srp_client_pwd_callback=(char *(*)(SSL *,void *))fp;
+                ctx->srp_ctx.SRP_give_srp_client_pwd_callback =
+                    (char *(*)(SSL *, void *))fp;
                 break;
 #endif
 #endif
         default:
-                return(0);
-                }
-        return(1);
+                return (0);
         }
+        return (1);
+}
 
 /* This function needs to check if the ciphers required are actually
  * available */
-const SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p)
-        {
+const SSL_CIPHER
+*ssl3_get_cipher_by_char(const unsigned char *p)
+{
         SSL_CIPHER c;
         const SSL_CIPHER *cp;
         unsigned long id;
 
-        id=0x03000000L|((unsigned long)p[0]<<8L)|(unsigned long)p[1];
-        c.id=id;
+        id = 0x03000000L | ((unsigned long)p[0] << 8L) | (unsigned long)p[1];
+        c.id = id;
         cp = OBJ_bsearch_ssl_cipher_id(&c, ssl3_ciphers, SSL3_NUM_CIPHERS);
 #ifdef DEBUG_PRINT_UNKNOWN_CIPHERSUITES
-if (cp == NULL) fprintf(stderr, "Unknown cipher ID %x\n", (p[0] << 8) | p[1]);
+        if (cp == NULL)
+                fprintf(stderr, "Unknown cipher ID %x\n", (p[0] << 8) | p[1]);
 #endif
         if (cp == NULL || cp->valid == 0)
                 return NULL;
         else
                 return cp;
-        }
+}
 
-int ssl3_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p)
-        {
+int
+ssl3_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p)
+{
         long l;
 
-        if (p != NULL)
-                {
-                l=c->id;
-                if ((l & 0xff000000) != 0x03000000) return(0);
-                p[0]=((unsigned char)(l>> 8L))&0xFF;
-                p[1]=((unsigned char)(l     ))&0xFF;
-                }
-        return(2);
+        if (p != NULL) {
+                l = c->id;
+                if ((l & 0xff000000) != 0x03000000)
+                        return (0);
+                p[0] = ((unsigned char)(l >> 8L)) & 0xFF;
+                p[1] = ((unsigned char)(l)) & 0xFF;
         }
+        return (2);
+}
 
 SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
-             STACK_OF(SSL_CIPHER) *srvr)
-        {
-        SSL_CIPHER *c,*ret=NULL;
+    STACK_OF(SSL_CIPHER) *srvr)
+{
+        SSL_CIPHER *c, *ret = NULL;
         STACK_OF(SSL_CIPHER) *prio, *allow;
-        int i,ii,ok;
+        int i, ii, ok;
 #if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_EC)
         unsigned int j;
         int ec_ok, ec_nid;
         unsigned char ec_search1 = 0, ec_search2 = 0;
 #endif
         CERT *cert;
-        unsigned long alg_k,alg_a,mask_k,mask_a,emask_k,emask_a;
+        unsigned long alg_k, alg_a, mask_k, mask_a, emask_k, emask_a;
 
         /* Let's see which ciphers we can support */
-        cert=s->cert;
+        cert = s->cert;
 
 #if 0
         /* Do not set the compare functions, because this may lead to a
@@ -3783,62 +3751,55 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
 
 #ifdef CIPHER_DEBUG
         printf("Server has %d from %p:\n", sk_SSL_CIPHER_num(srvr), (void *)srvr);
-        for(i=0 ; i < sk_SSL_CIPHER_num(srvr) ; ++i)
-                {
-                c=sk_SSL_CIPHER_value(srvr,i);
-                printf("%p:%s\n",(void *)c,c->name);
-                }
+        for (i = 0; i < sk_SSL_CIPHER_num(srvr); ++i) {
+                c = sk_SSL_CIPHER_value(srvr, i);
+                printf("%p:%s\n",(void *)c, c->name);
+        }
         printf("Client sent %d from %p:\n", sk_SSL_CIPHER_num(clnt), (void *)clnt);
-        for(i=0 ; i < sk_SSL_CIPHER_num(clnt) ; ++i)
-            {
-            c=sk_SSL_CIPHER_value(clnt,i);
-            printf("%p:%s\n",(void *)c,c->name);
-            }
+        for (i = 0; i < sk_SSL_CIPHER_num(clnt); ++i) {
+                c = sk_SSL_CIPHER_value(clnt, i);
+                printf("%p:%s\n",(void *)c, c->name);
+        }
 #endif
 
-        if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE)
-                {
+        if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) {
                 prio = srvr;
                 allow = clnt;
-                }
-        else
-                {
+        } else {
                 prio = clnt;
                 allow = srvr;
-                }
+        }
 
-        for (i=0; i<sk_SSL_CIPHER_num(prio); i++)
-                {
-                c=sk_SSL_CIPHER_value(prio,i);
+        for (i = 0; i < sk_SSL_CIPHER_num(prio); i++) {
+                c = sk_SSL_CIPHER_value(prio, i);
 
                 /* Skip TLS v1.2 only ciphersuites if lower than v1.2 */
-                if ((c->algorithm_ssl & SSL_TLSV1_2) && 
-                        (TLS1_get_version(s) < TLS1_2_VERSION))
+                if ((c->algorithm_ssl & SSL_TLSV1_2) &&
+                    (TLS1_get_version(s) < TLS1_2_VERSION))
                         continue;
 
-                ssl_set_cert_masks(cert,c);
+                ssl_set_cert_masks(cert, c);
                 mask_k = cert->mask_k;
                 mask_a = cert->mask_a;
                 emask_k = cert->export_mask_k;
                 emask_a = cert->export_mask_a;
 #ifndef OPENSSL_NO_SRP
-                mask_k=cert->mask_k | s->srp_ctx.srp_Mask;
-                emask_k=cert->export_mask_k | s->srp_ctx.srp_Mask;
+                mask_k = cert->mask_k | s->srp_ctx.srp_Mask;
+                emask_k = cert->export_mask_k | s->srp_ctx.srp_Mask;
 #endif
-                        
+
 #ifdef KSSL_DEBUG
 /*              printf("ssl3_choose_cipher %d alg= %lx\n", i,c->algorithms);*/
 #endif    /* KSSL_DEBUG */
 
-                alg_k=c->algorithm_mkey;
-                alg_a=c->algorithm_auth;
+                alg_k = c->algorithm_mkey;
+                alg_a = c->algorithm_auth;
 
 #ifndef OPENSSL_NO_KRB5
-                if (alg_k & SSL_kKRB5)
-                        {
-                        if ( !kssl_keytab_is_available(s->kssl_ctx) )
-                            continue;
-                        }
+                if (alg_k & SSL_kKRB5) {
+                        if (!kssl_keytab_is_available(s->kssl_ctx) )
+                                continue;
+                }
 #endif /* OPENSSL_NO_KRB5 */
 #ifndef OPENSSL_NO_PSK
                 /* with PSK there must be server callback set */
@@ -3846,449 +3807,405 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
                         continue;
 #endif /* OPENSSL_NO_PSK */
 
-                if (SSL_C_IS_EXPORT(c))
-                        {
+                if (SSL_C_IS_EXPORT(c)) {
                         ok = (alg_k & emask_k) && (alg_a & emask_a);
 #ifdef CIPHER_DEBUG
-                        printf("%d:[%08lX:%08lX:%08lX:%08lX]%p:%s (export)\n",ok,alg_k,alg_a,emask_k,emask_a,
-                               (void *)c,c->name);
+                        printf("%d:[%08lX:%08lX:%08lX:%08lX]%p:%s (export)\n", ok, alg_k, alg_a, emask_k, emask_a,
+                        (void *)c, c->name);
 #endif
-                        }
-                else
-                        {
+                } else {
                         ok = (alg_k & mask_k) && (alg_a & mask_a);
 #ifdef CIPHER_DEBUG
-                        printf("%d:[%08lX:%08lX:%08lX:%08lX]%p:%s\n",ok,alg_k,alg_a,mask_k,mask_a,(void *)c,
-                               c->name);
+                        printf("%d:[%08lX:%08lX:%08lX:%08lX]%p:%s\n", ok, alg_k, alg_a, mask_k, mask_a,(void *)c,
+                        c->name);
 #endif
-                        }
+                }
 
 #ifndef OPENSSL_NO_TLSEXT
 #ifndef OPENSSL_NO_EC
                 if (
-                        /* if we are considering an ECC cipher suite that uses our certificate */
-                        (alg_a & SSL_aECDSA || alg_a & SSL_aECDH)
-                        /* and we have an ECC certificate */
-                        && (s->cert->pkeys[SSL_PKEY_ECC].x509 != NULL)
-                        /* and the client specified a Supported Point Formats extension */
-                        && ((s->session->tlsext_ecpointformatlist_length > 0) && (s->session->tlsext_ecpointformatlist != NULL))
-                        /* and our certificate's point is compressed */
-                        && (
-                                (s->cert->pkeys[SSL_PKEY_ECC].x509->cert_info != NULL)
-                                && (s->cert->pkeys[SSL_PKEY_ECC].x509->cert_info->key != NULL)
-                                && (s->cert->pkeys[SSL_PKEY_ECC].x509->cert_info->key->public_key != NULL)
-                                && (s->cert->pkeys[SSL_PKEY_ECC].x509->cert_info->key->public_key->data != NULL)
-                                && (
-                                        (*(s->cert->pkeys[SSL_PKEY_ECC].x509->cert_info->key->public_key->data) == POINT_CONVERSION_COMPRESSED)
-                                        || (*(s->cert->pkeys[SSL_PKEY_ECC].x509->cert_info->key->public_key->data) == POINT_CONVERSION_COMPRESSED + 1)
-                                        )
-                                )
+                /* if we are considering an ECC cipher suite that uses our certificate */
+                (alg_a & SSL_aECDSA || alg_a & SSL_aECDH)
+                /* and we have an ECC certificate */
+                && (s->cert->pkeys[SSL_PKEY_ECC].x509 != NULL)
+                /* and the client specified a Supported Point Formats extension */
+                && ((s->session->tlsext_ecpointformatlist_length > 0) && (s->session->tlsext_ecpointformatlist != NULL))
+                /* and our certificate's point is compressed */
+                && (
+                (s->cert->pkeys[SSL_PKEY_ECC].x509->cert_info != NULL)
+                && (s->cert->pkeys[SSL_PKEY_ECC].x509->cert_info->key != NULL)
+                && (s->cert->pkeys[SSL_PKEY_ECC].x509->cert_info->key->public_key != NULL)
+                && (s->cert->pkeys[SSL_PKEY_ECC].x509->cert_info->key->public_key->data != NULL)
+                && (
+                (*(s->cert->pkeys[SSL_PKEY_ECC].x509->cert_info->key->public_key->data) == POINT_CONVERSION_COMPRESSED)
+                || (*(s->cert->pkeys[SSL_PKEY_ECC].x509->cert_info->key->public_key->data) == POINT_CONVERSION_COMPRESSED + 1)
                 )
-                        {
+                )
+                ) {
                         ec_ok = 0;
                         /* if our certificate's curve is over a field type that the client does not support
                          * then do not allow this cipher suite to be negotiated */
                         if (
-                                (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec != NULL)
-                                && (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group != NULL)
-                                && (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group->meth != NULL)
-                                && (EC_METHOD_get_field_type(s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group->meth) == NID_X9_62_prime_field)
-                        )
-                                {
-                                for (j = 0; j < s->session->tlsext_ecpointformatlist_length; j++)
-                                        {
-                                        if (s->session->tlsext_ecpointformatlist[j] == TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime)
-                                                {
+                        (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec != NULL)
+                        && (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group != NULL)
+                        && (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group->meth != NULL)
+                        && (EC_METHOD_get_field_type(s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group->meth) == NID_X9_62_prime_field)
+                        ) {
+                                for (j = 0; j < s->session->tlsext_ecpointformatlist_length; j++) {
+                                        if (s->session->tlsext_ecpointformatlist[j] == TLSEXT_ECPOINTFORMAT_ansiX962_compressed_prime) {
                                                 ec_ok = 1;
                                                 break;
-                                                }
                                         }
                                 }
-                        else if (EC_METHOD_get_field_type(s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group->meth) == NID_X9_62_characteristic_two_field)
-                                {
-                                for (j = 0; j < s->session->tlsext_ecpointformatlist_length; j++)
-                                        {
-                                        if (s->session->tlsext_ecpointformatlist[j] == TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2)
-                                                {
+                        } else if (EC_METHOD_get_field_type(s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group->meth) == NID_X9_62_characteristic_two_field) {
+                                for (j = 0; j < s->session->tlsext_ecpointformatlist_length; j++) {
+                                        if (s->session->tlsext_ecpointformatlist[j] == TLSEXT_ECPOINTFORMAT_ansiX962_compressed_char2) {
                                                 ec_ok = 1;
                                                 break;
-                                                }
                                         }
                                 }
-                        ok = ok && ec_ok;
                         }
+                        ok = ok && ec_ok;
+                }
                 if (
-                        /* if we are considering an ECC cipher suite that uses our certificate */
-                        (alg_a & SSL_aECDSA || alg_a & SSL_aECDH)
-                        /* and we have an ECC certificate */
-                        && (s->cert->pkeys[SSL_PKEY_ECC].x509 != NULL)
-                        /* and the client specified an EllipticCurves extension */
-                        && ((s->session->tlsext_ellipticcurvelist_length > 0) && (s->session->tlsext_ellipticcurvelist != NULL))
-                )
-                        {
+                /* if we are considering an ECC cipher suite that uses our certificate */
+                (alg_a & SSL_aECDSA || alg_a & SSL_aECDH)
+                /* and we have an ECC certificate */
+                && (s->cert->pkeys[SSL_PKEY_ECC].x509 != NULL)
+                /* and the client specified an EllipticCurves extension */
+                && ((s->session->tlsext_ellipticcurvelist_length > 0) && (s->session->tlsext_ellipticcurvelist != NULL))
+                ) {
                         ec_ok = 0;
                         if (
-                                (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec != NULL)
-                                && (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group != NULL)
-                        )
-                                {
+                        (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec != NULL)
+                        && (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group != NULL)
+                        ) {
                                 ec_nid = EC_GROUP_get_curve_name(s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group);
                                 if ((ec_nid == 0)
-                                        && (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group->meth != NULL)
-                                )
-                                        {
-                                        if (EC_METHOD_get_field_type(s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group->meth) == NID_X9_62_prime_field)
-                                                {
+                                && (s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group->meth != NULL)
+                                ) {
+                                        if (EC_METHOD_get_field_type(s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group->meth) == NID_X9_62_prime_field) {
                                                 ec_search1 = 0xFF;
                                                 ec_search2 = 0x01;
-                                                }
-                                        else if (EC_METHOD_get_field_type(s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group->meth) == NID_X9_62_characteristic_two_field)
-                                                {
+                                        } else if (EC_METHOD_get_field_type(s->cert->pkeys[SSL_PKEY_ECC].privatekey->pkey.ec->group->meth) == NID_X9_62_characteristic_two_field) {
                                                 ec_search1 = 0xFF;
                                                 ec_search2 = 0x02;
-                                                }
                                         }
-                                else
-                                        {
+                                } else {
                                         ec_search1 = 0x00;
                                         ec_search2 = tls1_ec_nid2curve_id(ec_nid);
-                                        }
-                                if ((ec_search1 != 0) || (ec_search2 != 0))
-                                        {
-                                        for (j = 0; j < s->session->tlsext_ellipticcurvelist_length / 2; j++)
-                                                {
-                                                if ((s->session->tlsext_ellipticcurvelist[2*j] == ec_search1) && (s->session->tlsext_ellipticcurvelist[2*j+1] == ec_search2))
-                                                        {
+                                }
+                                if ((ec_search1 != 0) || (ec_search2 != 0)) {
+                                        for (j = 0; j < s->session->tlsext_ellipticcurvelist_length / 2; j++) {
+                                                if ((s->session->tlsext_ellipticcurvelist[2*j] == ec_search1) && (s->session->tlsext_ellipticcurvelist[2*j + 1] == ec_search2)) {
                                                         ec_ok = 1;
                                                         break;
-                                                        }
                                                 }
                                         }
                                 }
-                        ok = ok && ec_ok;
                         }
+                        ok = ok && ec_ok;
+                }
                 if (
-                        /* if we are considering an ECC cipher suite that uses an ephemeral EC key */
-                        (alg_k & SSL_kEECDH)
-                        /* and we have an ephemeral EC key */
-                        && (s->cert->ecdh_tmp != NULL)
-                        /* and the client specified an EllipticCurves extension */
-                        && ((s->session->tlsext_ellipticcurvelist_length > 0) && (s->session->tlsext_ellipticcurvelist != NULL))
-                )
-                        {
+                /* if we are considering an ECC cipher suite that uses an ephemeral EC key */
+                (alg_k & SSL_kEECDH)
+                /* and we have an ephemeral EC key */
+                && (s->cert->ecdh_tmp != NULL)
+                /* and the client specified an EllipticCurves extension */
+                && ((s->session->tlsext_ellipticcurvelist_length > 0) && (s->session->tlsext_ellipticcurvelist != NULL))
+                ) {
                         ec_ok = 0;
-                        if (s->cert->ecdh_tmp->group != NULL)
-                                {
+                        if (s->cert->ecdh_tmp->group != NULL) {
                                 ec_nid = EC_GROUP_get_curve_name(s->cert->ecdh_tmp->group);
                                 if ((ec_nid == 0)
-                                        && (s->cert->ecdh_tmp->group->meth != NULL)
-                                )
-                                        {
-                                        if (EC_METHOD_get_field_type(s->cert->ecdh_tmp->group->meth) == NID_X9_62_prime_field)
-                                                {
+                                && (s->cert->ecdh_tmp->group->meth != NULL)
+                                ) {
+                                        if (EC_METHOD_get_field_type(s->cert->ecdh_tmp->group->meth) == NID_X9_62_prime_field) {
                                                 ec_search1 = 0xFF;
                                                 ec_search2 = 0x01;
-                                                }
-                                        else if (EC_METHOD_get_field_type(s->cert->ecdh_tmp->group->meth) == NID_X9_62_characteristic_two_field)
-                                                {
+                                        } else if (EC_METHOD_get_field_type(s->cert->ecdh_tmp->group->meth) == NID_X9_62_characteristic_two_field) {
                                                 ec_search1 = 0xFF;
                                                 ec_search2 = 0x02;
-                                                }
                                         }
-                                else
-                                        {
+                                } else {
                                         ec_search1 = 0x00;
                                         ec_search2 = tls1_ec_nid2curve_id(ec_nid);
-                                        }
-                                if ((ec_search1 != 0) || (ec_search2 != 0))
-                                        {
-                                        for (j = 0; j < s->session->tlsext_ellipticcurvelist_length / 2; j++)
-                                                {
-                                                if ((s->session->tlsext_ellipticcurvelist[2*j] == ec_search1) && (s->session->tlsext_ellipticcurvelist[2*j+1] == ec_search2))
-                                                        {
+                                }
+                                if ((ec_search1 != 0) || (ec_search2 != 0)) {
+                                        for (j = 0; j < s->session->tlsext_ellipticcurvelist_length / 2; j++) {
+                                                if ((s->session->tlsext_ellipticcurvelist[2*j] == ec_search1) && (s->session->tlsext_ellipticcurvelist[2*j + 1] == ec_search2)) {
                                                         ec_ok = 1;
                                                         break;
-                                                        }
                                                 }
                                         }
                                 }
-                        ok = ok && ec_ok;
                         }
+                        ok = ok && ec_ok;
+                }
 #endif /* OPENSSL_NO_EC */
 #endif /* OPENSSL_NO_TLSEXT */
 
-                if (!ok) continue;
-                ii=sk_SSL_CIPHER_find(allow,c);
-                if (ii >= 0)
-                        {
+                if (!ok)
+                        continue;
+                ii = sk_SSL_CIPHER_find(allow, c);
+                if (ii >= 0) {
 #if !defined(OPENSSL_NO_EC) && !defined(OPENSSL_NO_TLSEXT)
-                        if ((alg_k & SSL_kEECDH) && (alg_a & SSL_aECDSA) && s->s3->is_probably_safari)
-                                {
-                                if (!ret) ret=sk_SSL_CIPHER_value(allow,ii);
+                        if ((alg_k & SSL_kEECDH) && (alg_a & SSL_aECDSA) && s->s3->is_probably_safari) {
+                                if (!ret)
+                                        ret = sk_SSL_CIPHER_value(allow, ii);
                                 continue;
-                                }
+                        }
 #endif
-                        ret=sk_SSL_CIPHER_value(allow,ii);
+                        ret = sk_SSL_CIPHER_value(allow, ii);
                         break;
-                        }
                 }
-        return(ret);
         }
+        return (ret);
+}
 
-int ssl3_get_req_cert_type(SSL *s, unsigned char *p)
-        {
-        int ret=0;
+int
+ssl3_get_req_cert_type(SSL *s, unsigned char *p)
+{
+        int ret = 0;
         unsigned long alg_k;
 
         alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
 
 #ifndef OPENSSL_NO_GOST
-        if (s->version >= TLS1_VERSION)
-                {
-                if (alg_k & SSL_kGOST)
-                        {
-                        p[ret++]=TLS_CT_GOST94_SIGN;
-                        p[ret++]=TLS_CT_GOST01_SIGN;
-                        return(ret);
-                        }
+        if (s->version >= TLS1_VERSION) {
+                if (alg_k & SSL_kGOST) {
+                        p[ret++] = TLS_CT_GOST94_SIGN;
+                        p[ret++] = TLS_CT_GOST01_SIGN;
+                        return (ret);
                 }
+        }
 #endif
 
 #ifndef OPENSSL_NO_DH
-        if (alg_k & (SSL_kDHr|SSL_kEDH))
-                {
+        if (alg_k & (SSL_kDHr|SSL_kEDH)) {
 #  ifndef OPENSSL_NO_RSA
-                p[ret++]=SSL3_CT_RSA_FIXED_DH;
+                p[ret++] = SSL3_CT_RSA_FIXED_DH;
 #  endif
 #  ifndef OPENSSL_NO_DSA
-                p[ret++]=SSL3_CT_DSS_FIXED_DH;
+                p[ret++] = SSL3_CT_DSS_FIXED_DH;
 #  endif
-                }
+        }
         if ((s->version == SSL3_VERSION) &&
-                (alg_k & (SSL_kEDH|SSL_kDHd|SSL_kDHr)))
-                {
+                (alg_k & (SSL_kEDH|SSL_kDHd|SSL_kDHr))) {
 #  ifndef OPENSSL_NO_RSA
-                p[ret++]=SSL3_CT_RSA_EPHEMERAL_DH;
+                p[ret++] = SSL3_CT_RSA_EPHEMERAL_DH;
 #  endif
 #  ifndef OPENSSL_NO_DSA
-                p[ret++]=SSL3_CT_DSS_EPHEMERAL_DH;
+                p[ret++] = SSL3_CT_DSS_EPHEMERAL_DH;
 #  endif
-                }
+        }
 #endif /* !OPENSSL_NO_DH */
 #ifndef OPENSSL_NO_RSA
-        p[ret++]=SSL3_CT_RSA_SIGN;
+        p[ret++] = SSL3_CT_RSA_SIGN;
 #endif
 #ifndef OPENSSL_NO_DSA
-        p[ret++]=SSL3_CT_DSS_SIGN;
+        p[ret++] = SSL3_CT_DSS_SIGN;
 #endif
 #ifndef OPENSSL_NO_ECDH
-        if ((alg_k & (SSL_kECDHr|SSL_kECDHe)) && (s->version >= TLS1_VERSION))
-                {
-                p[ret++]=TLS_CT_RSA_FIXED_ECDH;
-                p[ret++]=TLS_CT_ECDSA_FIXED_ECDH;
-                }
+        if ((alg_k & (SSL_kECDHr|SSL_kECDHe)) && (s->version >= TLS1_VERSION)) {
+                p[ret++] = TLS_CT_RSA_FIXED_ECDH;
+                p[ret++] = TLS_CT_ECDSA_FIXED_ECDH;
+        }
 #endif
 
 #ifndef OPENSSL_NO_ECDSA
         /* ECDSA certs can be used with RSA cipher suites as well 
          * so we don't need to check for SSL_kECDH or SSL_kEECDH
          */
-        if (s->version >= TLS1_VERSION)
-                {
-                p[ret++]=TLS_CT_ECDSA_SIGN;
-                }
-#endif  
-        return(ret);
+        if (s->version >= TLS1_VERSION) {
+                p[ret++] = TLS_CT_ECDSA_SIGN;
         }
+#endif  
+        return (ret);
+}
 
-int ssl3_shutdown(SSL *s)
-        {
+int
+ssl3_shutdown(SSL *s)
+{
         int ret;
 
         /* Don't do anything much if we have not done the handshake or
          * we don't want to send messages :-) */
-        if ((s->quiet_shutdown) || (s->state == SSL_ST_BEFORE))
-                {
-                s->shutdown=(SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
-                return(1);
-                }
+        if ((s->quiet_shutdown) || (s->state == SSL_ST_BEFORE)) {
+                s->shutdown = (SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN);
+                return (1);
+        }
 
-        if (!(s->shutdown & SSL_SENT_SHUTDOWN))
-                {
+        if (!(s->shutdown & SSL_SENT_SHUTDOWN)) {
                 s->shutdown|=SSL_SENT_SHUTDOWN;
 #if 1
-                ssl3_send_alert(s,SSL3_AL_WARNING,SSL_AD_CLOSE_NOTIFY);
+                ssl3_send_alert(s, SSL3_AL_WARNING, SSL_AD_CLOSE_NOTIFY);
 #endif
                 /* our shutdown alert has been sent now, and if it still needs
                  * to be written, s->s3->alert_dispatch will be true */
-                if (s->s3->alert_dispatch)
-                        return(-1);     /* return WANT_WRITE */
-                }
-        else if (s->s3->alert_dispatch)
-                {
+                if (s->s3->alert_dispatch)
+                        return(-1);     /* return WANT_WRITE */
+        } else if (s->s3->alert_dispatch) {
                 /* resend it if not sent */
 #if 1
-                ret=s->method->ssl_dispatch_alert(s);
-                if(ret == -1)
-                        {
+                ret = s->method->ssl_dispatch_alert(s);
+                if (ret == -1) {
                         /* we only get to return -1 here the 2nd/Nth
                          * invocation, we must  have already signalled
                          * return 0 upon a previous invoation,
                          * return WANT_WRITE */
-                        return(ret);
-                        }
-#endif
+                        return (ret);
                 }
-        else if (!(s->shutdown & SSL_RECEIVED_SHUTDOWN))
-                {
+#endif
+        } else if (!(s->shutdown & SSL_RECEIVED_SHUTDOWN)) {
                 /* If we are waiting for a close from our peer, we are closed */
-                s->method->ssl_read_bytes(s,0,NULL,0,0);
-                if(!(s->shutdown & SSL_RECEIVED_SHUTDOWN))
-                        {
+                s->method->ssl_read_bytes(s, 0, NULL, 0, 0);
+                if (!(s->shutdown & SSL_RECEIVED_SHUTDOWN)) {
                         return(-1);     /* return WANT_READ */
-                        }
                 }
+        }
 
         if ((s->shutdown == (SSL_SENT_SHUTDOWN|SSL_RECEIVED_SHUTDOWN)) &&
-                !s->s3->alert_dispatch)
-                return(1);
+            !s->s3->alert_dispatch)
+                return (1);
         else
-                return(0);
-        }
+                return (0);
+}
 
-int ssl3_write(SSL *s, const void *buf, int len)
-        {
-        int ret,n;
+int
+ssl3_write(SSL *s, const void *buf, int len)
+{
+        int ret, n;
 
 #if 0
-        if (s->shutdown & SSL_SEND_SHUTDOWN)
-                {
-                s->rwstate=SSL_NOTHING;
-                return(0);
-                }
+        if (s->shutdown & SSL_SEND_SHUTDOWN) {
+                s->rwstate = SSL_NOTHING;
+                return (0);
+        }
 #endif
         errno = 0;
-        if (s->s3->renegotiate) ssl3_renegotiate_check(s);
+        if (s->s3->renegotiate)
+                ssl3_renegotiate_check(s);
 
         /* This is an experimental flag that sends the
          * last handshake message in the same packet as the first
          * use data - used to see if it helps the TCP protocol during
          * session-id reuse */
         /* The second test is because the buffer may have been removed */
-        if ((s->s3->flags & SSL3_FLAGS_POP_BUFFER) && (s->wbio == s->bbio))
-                {
+        if ((s->s3->flags & SSL3_FLAGS_POP_BUFFER) && (s->wbio == s->bbio)) {
                 /* First time through, we write into the buffer */
-                if (s->s3->delay_buf_pop_ret == 0)
-                        {
-                        ret=ssl3_write_bytes(s,SSL3_RT_APPLICATION_DATA,
-                                             buf,len);
-                        if (ret <= 0) return(ret);
+                if (s->s3->delay_buf_pop_ret == 0) {
+                        ret = ssl3_write_bytes(s, SSL3_RT_APPLICATION_DATA,
+                        buf, len);
+                        if (ret <= 0)
+                                return (ret);
 
-                        s->s3->delay_buf_pop_ret=ret;
-                        }
+                        s->s3->delay_buf_pop_ret = ret;
+                }
 
-                s->rwstate=SSL_WRITING;
-                n=BIO_flush(s->wbio);
-                if (n <= 0) return(n);
-                s->rwstate=SSL_NOTHING;
+                s->rwstate = SSL_WRITING;
+                n = BIO_flush(s->wbio);
+                if (n <= 0)
+                        return (n);
+                s->rwstate = SSL_NOTHING;
 
                 /* We have flushed the buffer, so remove it */
                 ssl_free_wbio_buffer(s);
                 s->s3->flags&= ~SSL3_FLAGS_POP_BUFFER;
 
-                ret=s->s3->delay_buf_pop_ret;
-                s->s3->delay_buf_pop_ret=0;
-                }
-        else
-                {
-                ret=s->method->ssl_write_bytes(s,SSL3_RT_APPLICATION_DATA,
-                        buf,len);
-                if (ret <= 0) return(ret);
-                }
-
-        return(ret);
+                ret = s->s3->delay_buf_pop_ret;
+                s->s3->delay_buf_pop_ret = 0;
+        } else {
+                ret = s->method->ssl_write_bytes(s, SSL3_RT_APPLICATION_DATA,
+                buf, len);
+                if (ret <= 0)
+                        return (ret);
         }
 
-static int ssl3_read_internal(SSL *s, void *buf, int len, int peek)
-        {
+        return (ret);
+}
+
+static int
+ssl3_read_internal(SSL *s, void *buf, int len, int peek)
+{
         int ret;
-        
+
         errno = 0;
-        if (s->s3->renegotiate) ssl3_renegotiate_check(s);
-        s->s3->in_read_app_data=1;
-        ret=s->method->ssl_read_bytes(s,SSL3_RT_APPLICATION_DATA,buf,len,peek);
-        if ((ret == -1) && (s->s3->in_read_app_data == 2))
-                {
+        if (s->s3->renegotiate)
+                ssl3_renegotiate_check(s);
+        s->s3->in_read_app_data = 1;
+        ret = s->method->ssl_read_bytes(s, SSL3_RT_APPLICATION_DATA, buf, len, peek);
+        if ((ret == -1) && (s->s3->in_read_app_data == 2)) {
                 /* ssl3_read_bytes decided to call s->handshake_func, which
                  * called ssl3_read_bytes to read handshake data.
                  * However, ssl3_read_bytes actually found application data
                  * and thinks that application data makes sense here; so disable
                  * handshake processing and try to read application data again. */
                 s->in_handshake++;
-                ret=s->method->ssl_read_bytes(s,SSL3_RT_APPLICATION_DATA,buf,len,peek);
+                ret = s->method->ssl_read_bytes(s, SSL3_RT_APPLICATION_DATA, buf, len, peek);
                 s->in_handshake--;
-                }
-        else
-                s->s3->in_read_app_data=0;
+        } else
+                s->s3->in_read_app_data = 0;
 
-        return(ret);
-        }
+        return (ret);
+}
 
-int ssl3_read(SSL *s, void *buf, int len)
-        {
+int
+ssl3_read(SSL *s, void *buf, int len)
+{
         return ssl3_read_internal(s, buf, len, 0);
-        }
+}
 
-int ssl3_peek(SSL *s, void *buf, int len)
-        {
+int
+ssl3_peek(SSL *s, void *buf, int len)
+{
         return ssl3_read_internal(s, buf, len, 1);
-        }
+}
 
-int ssl3_renegotiate(SSL *s)
-        {
+int
+ssl3_renegotiate(SSL *s)
+{
         if (s->handshake_func == NULL)
-                return(1);
+                return (1);
 
         if (s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS)
-                return(0);
+                return (0);
 
-        s->s3->renegotiate=1;
-        return(1);
-        }
+        s->s3->renegotiate = 1;
+        return (1);
+}
 
-int ssl3_renegotiate_check(SSL *s)
-        {
-        int ret=0;
+int
+ssl3_renegotiate_check(SSL *s)
+{
+        int ret = 0;
 
-        if (s->s3->renegotiate)
-                {
-                if (    (s->s3->rbuf.left == 0) &&
-                        (s->s3->wbuf.left == 0) &&
-                        !SSL_in_init(s))
-                        {
+        if (s->s3->renegotiate) {
+                if ((s->s3->rbuf.left == 0) && (s->s3->wbuf.left == 0) &&
+                    !SSL_in_init(s)) {
 /*
 if we are the server, and we have sent a 'RENEGOTIATE' message, we
 need to go to SSL_ST_ACCEPT.
 */
                         /* SSL_ST_ACCEPT */
-                        s->state=SSL_ST_RENEGOTIATE;
-                        s->s3->renegotiate=0;
+                        s->state = SSL_ST_RENEGOTIATE;
+                        s->s3->renegotiate = 0;
                         s->s3->num_renegotiations++;
                         s->s3->total_renegotiations++;
-                        ret=1;
-                        }
+                        ret = 1;
                 }
-        return(ret);
         }
+        return (ret);
+}
 /* If we are using TLS v1.2 or later and default SHA1+MD5 algorithms switch
  * to new SHA256 PRF and handshake macs
  */
-long ssl_get_algorithm2(SSL *s)
-        {
+long
+ssl_get_algorithm2(SSL *s)
+{
         long alg2 = s->s3->tmp.new_cipher->algorithm2;
         if (s->method->version == TLS1_2_VERSION &&
-            alg2 == (SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF))
-                return SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256;
+                alg2 == (SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF))
+        return SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256;
         return alg2;
-        }
-                
+}
diff --git a/src/lib/libssl/src/ssl/s3_meth.c b/src/lib/libssl/src/ssl/s3_meth.c
index cdddb17b62..ff3b0d3303 100644
--- a/src/lib/libssl/src/ssl/s3_meth.c
+++ b/src/lib/libssl/src/ssl/s3_meth.c
@@ -61,17 +61,15 @@
 #include "ssl_locl.h"
 
 static const SSL_METHOD *ssl3_get_method(int ver);
-static const SSL_METHOD *ssl3_get_method(int ver)
-        {
+static const SSL_METHOD
+*ssl3_get_method(int ver)
+{
         if (ver == SSL3_VERSION)
-                return(SSLv3_method());
-        else 
-                return(NULL);
-        }
+                return (SSLv3_method());
+        else
+                return (NULL);
+}
 
 IMPLEMENT_ssl3_meth_func(SSLv3_method,
-                         ssl3_accept,
-                         ssl3_connect,
-                         ssl3_get_method)
-
+    ssl3_accept, ssl3_connect, ssl3_get_method)
 
diff --git a/src/lib/libssl/src/ssl/s3_pkt.c b/src/lib/libssl/src/ssl/s3_pkt.c
index 6b55d21a3e..6c677d9f6b 100644
--- a/src/lib/libssl/src/ssl/s3_pkt.c
+++ b/src/lib/libssl/src/ssl/s3_pkt.c
@@ -118,11 +118,12 @@
 #include <openssl/rand.h>
 
 static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
-                         unsigned int len, int create_empty_fragment);
+    unsigned int len, int create_empty_fragment);
 static int ssl3_get_record(SSL *s);
 
-int ssl3_read_n(SSL *s, int n, int max, int extend)
-        {
+int
+ssl3_read_n(SSL *s, int n, int max, int extend)
+{
         /* If extend == 0, obtain new n-byte packet; if extend == 1, increase
          * packet by another n bytes.
          * The packet will be in the sub-array of s->s3->rbuf.buf specified
@@ -130,37 +131,35 @@ int ssl3_read_n(SSL *s, int n, int max, int extend)
          * (If s->read_ahead is set, 'max' bytes may be stored in rbuf
          * [plus s->packet_length bytes if extend == 1].)
          */
-        int i,len,left;
-        long align=0;
+        int i, len, left;
+        long align = 0;
         unsigned char *pkt;
         SSL3_BUFFER *rb;
 
-        if (n <= 0) return n;
+        if (n <= 0)
+                return n;
 
-        rb    = &(s->s3->rbuf);
+        rb = &(s->s3->rbuf);
         if (rb->buf == NULL)
                 if (!ssl3_setup_read_buffer(s))
                         return -1;
 
-        left  = rb->left;
+        left = rb->left;
 #if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD!=0
         align = (long)rb->buf + SSL3_RT_HEADER_LENGTH;
-        align = (-align)&(SSL3_ALIGN_PAYLOAD-1);
+        align = (-align)&(SSL3_ALIGN_PAYLOAD - 1);
 #endif
 
-        if (!extend)
-                {
+        if (!extend) {
                 /* start with empty packet ... */
                 if (left == 0)
                         rb->offset = align;
-                else if (align != 0 && left >= SSL3_RT_HEADER_LENGTH)
-                        {
+                else if (align != 0 && left >= SSL3_RT_HEADER_LENGTH) {
                         /* check if next packet length is large
                          * enough to justify payload alignment... */
                         pkt = rb->buf + rb->offset;
                         if (pkt[0] == SSL3_RT_APPLICATION_DATA
-                            && (pkt[3]<<8|pkt[4]) >= 128)
-                                {
+                                && (pkt[3]<<8|pkt[4]) >= 128) {
                                 /* Note that even if packet is corrupted
                                  * and its length field is insane, we can
                                  * only be led to wrong decision about
@@ -168,109 +167,100 @@ int ssl3_read_n(SSL *s, int n, int max, int extend)
                                  * Header values has no effect on memmove
                                  * arguments and therefore no buffer
                                  * overrun can be triggered. */
-                                memmove (rb->buf+align,pkt,left);
+                                memmove (rb->buf + align, pkt, left);
                                 rb->offset = align;
-                                }
                         }
+                }
                 s->packet = rb->buf + rb->offset;
                 s->packet_length = 0;
                 /* ... now we can act as if 'extend' was set */
-                }
+        }
 
         /* For DTLS/UDP reads should not span multiple packets
          * because the read operation returns the whole packet
          * at once (as long as it fits into the buffer). */
-        if (SSL_version(s) == DTLS1_VERSION || SSL_version(s) == DTLS1_BAD_VER)
-                {
+        if (SSL_version(s) == DTLS1_VERSION || SSL_version(s) == DTLS1_BAD_VER) {
                 if (left > 0 && n > left)
                         n = left;
-                }
+        }
 
         /* if there is enough in the buffer from a previous read, take some */
-        if (left >= n)
-                {
-                s->packet_length+=n;
-                rb->left=left-n;
-                rb->offset+=n;
-                return(n);
-                }
+        if (left >= n) {
+                s->packet_length += n;
+                rb->left = left - n;
+                rb->offset += n;
+                return (n);
+        }
 
         /* else we need to read more data */
 
         len = s->packet_length;
-        pkt = rb->buf+align;
+        pkt = rb->buf + align;
         /* Move any available bytes to front of buffer:
          * 'len' bytes already pointed to by 'packet',
          * 'left' extra ones at the end */
         if (s->packet != pkt) /* len > 0 */
-                {
-                memmove(pkt, s->packet, len+left);
+        {
+                memmove(pkt, s->packet, len + left);
                 s->packet = pkt;
                 rb->offset = len + align;
-                }
+        }
 
         if (n > (int)(rb->len - rb->offset)) /* does not happen */
-                {
-                SSLerr(SSL_F_SSL3_READ_N,ERR_R_INTERNAL_ERROR);
+        {
+                SSLerr(SSL_F_SSL3_READ_N, ERR_R_INTERNAL_ERROR);
                 return -1;
-                }
+        }
 
         if (!s->read_ahead)
                 /* ignore max parameter */
                 max = n;
-        else
-                {
+        else {
                 if (max < n)
                         max = n;
                 if (max > (int)(rb->len - rb->offset))
                         max = rb->len - rb->offset;
-                }
+        }
 
-        while (left < n)
-                {
+        while (left < n) {
                 /* Now we have len+left bytes at the front of s->s3->rbuf.buf
                  * and need to read in more until we have len+n (up to
                  * len+max if possible) */
 
                 errno = 0;
-                if (s->rbio != NULL)
-                        {
-                        s->rwstate=SSL_READING;
-                        i=BIO_read(s->rbio,pkt+len+left, max-left);
-                        }
-                else
-                        {
-                        SSLerr(SSL_F_SSL3_READ_N,SSL_R_READ_BIO_NOT_SET);
+                if (s->rbio != NULL) {
+                        s->rwstate = SSL_READING;
+                        i = BIO_read(s->rbio, pkt + len + left, max - left);
+                } else {
+                        SSLerr(SSL_F_SSL3_READ_N, SSL_R_READ_BIO_NOT_SET);
                         i = -1;
-                        }
+                }
 
-                if (i <= 0)
-                        {
+                if (i <= 0) {
                         rb->left = left;
                         if (s->mode & SSL_MODE_RELEASE_BUFFERS &&
-                            SSL_version(s) != DTLS1_VERSION && SSL_version(s) != DTLS1_BAD_VER)
-                                if (len+left == 0)
-                                        ssl3_release_read_buffer(s);
-                        return(i);
-                        }
-                left+=i;
+                                SSL_version(s) != DTLS1_VERSION && SSL_version(s) != DTLS1_BAD_VER)
+                        if (len + left == 0)
+                                ssl3_release_read_buffer(s);
+                        return (i);
+                }
+                left += i;
                 /* reads should *never* span multiple packets for DTLS because
                  * the underlying transport protocol is message oriented as opposed
                  * to byte oriented as in the TLS case. */
-                if (SSL_version(s) == DTLS1_VERSION || SSL_version(s) == DTLS1_BAD_VER)
-                        {
+                if (SSL_version(s) == DTLS1_VERSION || SSL_version(s) == DTLS1_BAD_VER) {
                         if (n > left)
                                 n = left; /* makes the while condition false */
-                        }
                 }
+        }
 
         /* done reading, now the book-keeping */
         rb->offset += n;
         rb->left = left - n;
         s->packet_length += n;
-        s->rwstate=SSL_NOTHING;
-        return(n);
-        }
+        s->rwstate = SSL_NOTHING;
+        return (n);
+}
 
 /* Call this to get a new input record.
  * It will return <= 0 if more data is needed, normally due to an error
@@ -281,10 +271,11 @@ int ssl3_read_n(SSL *s, int n, int max, int extend)
  * ssl->s3->rrec.length, - number of bytes
  */
 /* used only by ssl3_read_bytes */
-static int ssl3_get_record(SSL *s)
-        {
-        int ssl_major,ssl_minor,al;
-        int enc_err,n,i,ret= -1;
+static int
+ssl3_get_record(SSL *s)
+{
+        int ssl_major, ssl_minor, al;
+        int enc_err, n, i, ret = -1;
         SSL3_RECORD *rr;
         SSL_SESSION *sess;
         unsigned char *p;
@@ -293,90 +284,83 @@ static int ssl3_get_record(SSL *s)
         unsigned mac_size, orig_len;
         size_t extra;
 
-        rr= &(s->s3->rrec);
-        sess=s->session;
+        rr = &(s->s3->rrec);
+        sess = s->session;
 
         if (s->options & SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER)
-                extra=SSL3_RT_MAX_EXTRA;
+                extra = SSL3_RT_MAX_EXTRA;
         else
-                extra=0;
-        if (extra && !s->s3->init_extra)
-                {
+                extra = 0;
+        if (extra && !s->s3->init_extra) {
                 /* An application error: SLS_OP_MICROSOFT_BIG_SSLV3_BUFFER
                  * set after ssl3_setup_buffers() was done */
                 SSLerr(SSL_F_SSL3_GET_RECORD, ERR_R_INTERNAL_ERROR);
                 return -1;
-                }
+        }
 
 again:
         /* check if we have the header */
-        if (    (s->rstate != SSL_ST_READ_BODY) ||
-                (s->packet_length < SSL3_RT_HEADER_LENGTH)) 
-                {
-                n=ssl3_read_n(s, SSL3_RT_HEADER_LENGTH, s->s3->rbuf.len, 0);
+        if ((s->rstate != SSL_ST_READ_BODY) ||
+            (s->packet_length < SSL3_RT_HEADER_LENGTH)) {
+                n = ssl3_read_n(s, SSL3_RT_HEADER_LENGTH, s->s3->rbuf.len, 0);
                 if (n <= 0) return(n); /* error or non-blocking */
-                s->rstate=SSL_ST_READ_BODY;
+                        s->rstate = SSL_ST_READ_BODY;
 
-                p=s->packet;
+                p = s->packet;
 
                 /* Pull apart the header into the SSL3_RECORD */
                 rr->type= *(p++);
                 ssl_major= *(p++);
                 ssl_minor= *(p++);
-                version=(ssl_major<<8)|ssl_minor;
-                n2s(p,rr->length);
+                version = (ssl_major << 8)|ssl_minor;
+                n2s(p, rr->length);
 #if 0
-fprintf(stderr, "Record type=%d, Length=%d\n", rr->type, rr->length);
+                fprintf(stderr, "Record type=%d, Length=%d\n", rr->type, rr->length);
 #endif
 
                 /* Lets check version */
-                if (!s->first_packet)
-                        {
-                        if (version != s->version)
-                                {
-                                SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_WRONG_VERSION_NUMBER);
-                                if ((s->version & 0xFF00) == (version & 0xFF00) && !s->enc_write_ctx && !s->write_hash)
-                                        /* Send back error using their minor version number :-) */
-                                        s->version = (unsigned short)version;
-                                al=SSL_AD_PROTOCOL_VERSION;
+                if (!s->first_packet) {
+                        if (version != s->version) {
+                                SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_WRONG_VERSION_NUMBER);
+                                if ((s->version & 0xFF00) == (version & 0xFF00) && !s->enc_write_ctx && !s->write_hash)
+                                        /* Send back error using their minor version number :-) */
+                                s->version = (unsigned short)version;
+                                al = SSL_AD_PROTOCOL_VERSION;
                                 goto f_err;
-                                }
                         }
+                }
 
-                if ((version>>8) != SSL3_VERSION_MAJOR)
-                        {
-                        SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_WRONG_VERSION_NUMBER);
+                if ((version >> 8) != SSL3_VERSION_MAJOR) {
+                        SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_WRONG_VERSION_NUMBER);
                         goto err;
-                        }
+                }
 
-                if (rr->length > s->s3->rbuf.len - SSL3_RT_HEADER_LENGTH)
-                        {
-                        al=SSL_AD_RECORD_OVERFLOW;
-                        SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_PACKET_LENGTH_TOO_LONG);
+                if (rr->length > s->s3->rbuf.len - SSL3_RT_HEADER_LENGTH) {
+                        al = SSL_AD_RECORD_OVERFLOW;
+                        SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_PACKET_LENGTH_TOO_LONG);
                         goto f_err;
-                        }
+                }
 
                 /* now s->rstate == SSL_ST_READ_BODY */
-                }
+        }
 
         /* s->rstate == SSL_ST_READ_BODY, get and decode the data */
 
-        if (rr->length > s->packet_length-SSL3_RT_HEADER_LENGTH)
-                {
+        if (rr->length > s->packet_length - SSL3_RT_HEADER_LENGTH) {
                 /* now s->packet_length == SSL3_RT_HEADER_LENGTH */
-                i=rr->length;
-                n=ssl3_read_n(s,i,i,1);
+                i = rr->length;
+                n = ssl3_read_n(s, i, i, 1);
                 if (n <= 0) return(n); /* error or non-blocking io */
                 /* now n == rr->length,
                  * and s->packet_length == SSL3_RT_HEADER_LENGTH + rr->length */
-                }
+        }
 
         s->rstate=SSL_ST_READ_HEADER; /* set state for later operations */
 
         /* At this point, s->packet_length == SSL3_RT_HEADER_LNGTH + rr->length,
          * and we have that many bytes in s->packet
          */
-        rr->input= &(s->packet[SSL3_RT_HEADER_LENGTH]);
+        rr->input = &(s->packet[SSL3_RT_HEADER_LENGTH]);
 
         /* ok, we can now read from 's->packet' data into 'rr'
          * rr->input points at rr->length bytes, which
@@ -389,47 +373,43 @@ fprintf(stderr, "Record type=%d, Length=%d\n", rr->type, rr->length);
          * rr->length bytes of encrypted compressed stuff. */
 
         /* check is not needed I believe */
-        if (rr->length > SSL3_RT_MAX_ENCRYPTED_LENGTH+extra)
-                {
-                al=SSL_AD_RECORD_OVERFLOW;
-                SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_ENCRYPTED_LENGTH_TOO_LONG);
+        if (rr->length > SSL3_RT_MAX_ENCRYPTED_LENGTH + extra) {
+                al = SSL_AD_RECORD_OVERFLOW;
+                SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_ENCRYPTED_LENGTH_TOO_LONG);
                 goto f_err;
-                }
+        }
 
         /* decrypt in place in 'rr->input' */
-        rr->data=rr->input;
+        rr->data = rr->input;
 
-        enc_err = s->method->ssl3_enc->enc(s,0);
+        enc_err = s->method->ssl3_enc->enc(s, 0);
         /* enc_err is:
          *    0: (in non-constant time) if the record is publically invalid.
          *    1: if the padding is valid
          *    -1: if the padding is invalid */
-        if (enc_err == 0)
-                {
-                al=SSL_AD_DECRYPTION_FAILED;
-                SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);
+        if (enc_err == 0) {
+                al = SSL_AD_DECRYPTION_FAILED;
+                SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);
                 goto f_err;
-                }
+        }
 
 #ifdef TLS_DEBUG
-printf("dec %d\n",rr->length);
-{ unsigned int z; for (z=0; z<rr->length; z++) printf("%02X%c",rr->data[z],((z+1)%16)?' ':'\n'); }
-printf("\n");
+        printf("dec %d\n", rr->length);
+        { unsigned int z; for (z = 0; z<rr->length; z++) printf("%02X%c", rr->data[z],((z+1)%16)?' ':'\n'); }
+        printf("\n");
 #endif
 
         /* r->length is now the compressed data plus mac */
-        if ((sess != NULL) &&
-            (s->enc_read_ctx != NULL) &&
-            (EVP_MD_CTX_md(s->read_hash) != NULL))
-                {
+        if ((sess != NULL) && (s->enc_read_ctx != NULL) &&
+            (EVP_MD_CTX_md(s->read_hash) != NULL)) {
                 /* s->read_hash != NULL => mac_size != -1 */
                 unsigned char *mac = NULL;
                 unsigned char mac_tmp[EVP_MAX_MD_SIZE];
-                mac_size=EVP_MD_CTX_size(s->read_hash);
+                mac_size = EVP_MD_CTX_size(s->read_hash);
                 OPENSSL_assert(mac_size <= EVP_MAX_MD_SIZE);
 
                 /* kludge: *_cbc_remove_padding passes padding length in rr->type */
-                orig_len = rr->length+((unsigned int)rr->type>>8);
+                orig_len = rr->length + ((unsigned int)rr->type >> 8);
 
                 /* orig_len is the length of the record before any padding was
                  * removed. This is public information, as is the MAC in use,
@@ -437,17 +417,15 @@ printf("\n");
                  * amount of time if it's too short to possibly contain a MAC.
                  */
                 if (orig_len < mac_size ||
-                    /* CBC records must have a padding length byte too. */
+                        /* CBC records must have a padding length byte too. */
                     (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE &&
-                     orig_len < mac_size+1))
-                        {
-                        al=SSL_AD_DECODE_ERROR;
-                        SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_LENGTH_TOO_SHORT);
+                    orig_len < mac_size + 1)) {
+                        al = SSL_AD_DECODE_ERROR;
+                        SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_LENGTH_TOO_SHORT);
                         goto f_err;
-                        }
+                }
 
-                if (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE)
-                        {
+                if (EVP_CIPHER_CTX_mode(s->enc_read_ctx) == EVP_CIPH_CBC_MODE) {
                         /* We update the length so that the TLS header bytes
                          * can be constructed correctly but we need to extract
                          * the MAC in constant time from within the record,
@@ -456,60 +434,53 @@ printf("\n");
                         mac = mac_tmp;
                         ssl3_cbc_copy_mac(mac_tmp, rr, mac_size, orig_len);
                         rr->length -= mac_size;
-                        }
-                else
-                        {
+                } else {
                         /* In this case there's no padding, so |orig_len|
                          * equals |rec->length| and we checked that there's
                          * enough bytes for |mac_size| above. */
                         rr->length -= mac_size;
                         mac = &rr->data[rr->length];
-                        }
+                }
 
                 i=s->method->ssl3_enc->mac(s,md,0 /* not send */);
                 if (i < 0 || mac == NULL || CRYPTO_memcmp(md, mac, (size_t)mac_size) != 0)
                         enc_err = -1;
-                if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+extra+mac_size)
+                if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH + extra + mac_size)
                         enc_err = -1;
-                }
+        }
 
-        if (enc_err < 0)
-                {
+        if (enc_err < 0) {
                 /* A separate 'decryption_failed' alert was introduced with TLS 1.0,
                  * SSL 3.0 only has 'bad_record_mac'.  But unless a decryption
                  * failure is directly visible from the ciphertext anyway,
                  * we should not reveal which kind of error occured -- this
                  * might become visible to an attacker (e.g. via a logfile) */
-                al=SSL_AD_BAD_RECORD_MAC;
-                SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);
+                al = SSL_AD_BAD_RECORD_MAC;
+                SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);
                 goto f_err;
-                }
+        }
 
         /* r->length is now just compressed */
-        if (s->expand != NULL)
-                {
-                if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH+extra)
-                        {
-                        al=SSL_AD_RECORD_OVERFLOW;
-                        SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_COMPRESSED_LENGTH_TOO_LONG);
+        if (s->expand != NULL) {
+                if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH + extra) {
+                        al = SSL_AD_RECORD_OVERFLOW;
+                        SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_COMPRESSED_LENGTH_TOO_LONG);
                         goto f_err;
-                        }
-                if (!ssl3_do_uncompress(s))
-                        {
-                        al=SSL_AD_DECOMPRESSION_FAILURE;
-                        SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_BAD_DECOMPRESSION);
+                }
+                if (!ssl3_do_uncompress(s)) {
+                        al = SSL_AD_DECOMPRESSION_FAILURE;
+                        SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_BAD_DECOMPRESSION);
                         goto f_err;
-                        }
                 }
+        }
 
-        if (rr->length > SSL3_RT_MAX_PLAIN_LENGTH+extra)
-                {
-                al=SSL_AD_RECORD_OVERFLOW;
-                SSLerr(SSL_F_SSL3_GET_RECORD,SSL_R_DATA_LENGTH_TOO_LONG);
+        if (rr->length > SSL3_RT_MAX_PLAIN_LENGTH + extra) {
+                al = SSL_AD_RECORD_OVERFLOW;
+                SSLerr(SSL_F_SSL3_GET_RECORD, SSL_R_DATA_LENGTH_TOO_LONG);
                 goto f_err;
-                }
+        }
 
-        rr->off=0;
+        rr->off = 0;
         /* So at this point the following is true
          * ssl->s3->rrec.type   is the type of record
          * ssl->s3->rrec.length == number of bytes in record
@@ -519,178 +490,171 @@ printf("\n");
          */
 
         /* we have pulled in a full packet so zero things */
-        s->packet_length=0;
+        s->packet_length = 0;
 
         /* just read a 0 length packet */
-        if (rr->length == 0) goto again;
+        if (rr->length == 0)
+                goto again;
 
 #if 0
-fprintf(stderr, "Ultimate Record type=%d, Length=%d\n", rr->type, rr->length);
+        fprintf(stderr, "Ultimate Record type=%d, Length=%d\n", rr->type, rr->length);
 #endif
 
-        return(1);
+        return (1);
 
 f_err:
-        ssl3_send_alert(s,SSL3_AL_FATAL,al);
+        ssl3_send_alert(s, SSL3_AL_FATAL, al);
 err:
-        return(ret);
-        }
+        return (ret);
+}
 
-int ssl3_do_uncompress(SSL *ssl)
-        {
+int
+ssl3_do_uncompress(SSL *ssl)
+{
 #ifndef OPENSSL_NO_COMP
         int i;
         SSL3_RECORD *rr;
 
-        rr= &(ssl->s3->rrec);
-        i=COMP_expand_block(ssl->expand,rr->comp,
-                SSL3_RT_MAX_PLAIN_LENGTH,rr->data,(int)rr->length);
+        rr = &(ssl->s3->rrec);
+        i = COMP_expand_block(ssl->expand, rr->comp,
+        SSL3_RT_MAX_PLAIN_LENGTH, rr->data,(int)rr->length);
         if (i < 0)
-                return(0);
+                return (0);
         else
-                rr->length=i;
-        rr->data=rr->comp;
+                rr->length = i;
+        rr->data = rr->comp;
 #endif
-        return(1);
-        }
+        return (1);
+}
 
-int ssl3_do_compress(SSL *ssl)
-        {
+int
+ssl3_do_compress(SSL *ssl)
+{
 #ifndef OPENSSL_NO_COMP
         int i;
         SSL3_RECORD *wr;
 
-        wr= &(ssl->s3->wrec);
-        i=COMP_compress_block(ssl->compress,wr->data,
-                SSL3_RT_MAX_COMPRESSED_LENGTH,
-                wr->input,(int)wr->length);
+        wr = &(ssl->s3->wrec);
+        i = COMP_compress_block(ssl->compress, wr->data,
+        SSL3_RT_MAX_COMPRESSED_LENGTH,
+        wr->input,(int)wr->length);
         if (i < 0)
-                return(0);
+                return (0);
         else
-                wr->length=i;
+                wr->length = i;
 
-        wr->input=wr->data;
+        wr->input = wr->data;
 #endif
-        return(1);
-        }
+        return (1);
+}
 
 /* Call this to write data in records of type 'type'
  * It will return <= 0 if not all data has been sent or non-blocking IO.
  */
-int ssl3_write_bytes(SSL *s, int type, const void *buf_, int len)
-        {
-        const unsigned char *buf=buf_;
-        unsigned int tot,n,nw;
+int
+ssl3_write_bytes(SSL *s, int type, const void *buf_, int len)
+{
+        const unsigned char *buf = buf_;
+        unsigned int tot, n, nw;
         int i;
 
-        s->rwstate=SSL_NOTHING;
-        tot=s->s3->wnum;
-        s->s3->wnum=0;
+        s->rwstate = SSL_NOTHING;
+        tot = s->s3->wnum;
+        s->s3->wnum = 0;
 
-        if (SSL_in_init(s) && !s->in_handshake)
-                {
-                i=s->handshake_func(s);
-                if (i < 0) return(i);
-                if (i == 0)
-                        {
-                        SSLerr(SSL_F_SSL3_WRITE_BYTES,SSL_R_SSL_HANDSHAKE_FAILURE);
+        if (SSL_in_init(s) && !s->in_handshake) {
+                i = s->handshake_func(s);
+                if (i < 0)
+                        return (i);
+                if (i == 0) {
+                        SSLerr(SSL_F_SSL3_WRITE_BYTES, SSL_R_SSL_HANDSHAKE_FAILURE);
                         return -1;
-                        }
                 }
+        }
 
-        n=(len-tot);
-        for (;;)
-                {
+        n = (len - tot);
+        for (;;) {
                 if (n > s->max_send_fragment)
-                        nw=s->max_send_fragment;
+                        nw = s->max_send_fragment;
                 else
-                        nw=n;
+                        nw = n;
 
-                i=do_ssl3_write(s, type, &(buf[tot]), nw, 0);
-                if (i <= 0)
-                        {
-                        s->s3->wnum=tot;
+                i = do_ssl3_write(s, type, &(buf[tot]), nw, 0);
+                if (i <= 0) {
+                        s->s3->wnum = tot;
                         return i;
-                        }
+                }
 
-                if ((i == (int)n) ||
-                        (type == SSL3_RT_APPLICATION_DATA &&
-                         (s->mode & SSL_MODE_ENABLE_PARTIAL_WRITE)))
-                        {
+                if ((i == (int)n) || (type == SSL3_RT_APPLICATION_DATA &&
+                    (s->mode & SSL_MODE_ENABLE_PARTIAL_WRITE))) {
                         /* next chunk of data should get another prepended empty fragment
                          * in ciphersuites with known-IV weakness: */
                         s->s3->empty_fragment_done = 0;
-                        
-                        return tot+i;
-                        }
 
-                n-=i;
-                tot+=i;
+                        return tot + i;
                 }
-        }
 
-static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
-                         unsigned int len, int create_empty_fragment)
-        {
-        unsigned char *p,*plen;
-        int i,mac_size,clear=0;
-        int prefix_len=0;
+                n -= i;
+                tot += i;
+        }
+}
+
+static int
+do_ssl3_write(SSL *s, int type, const unsigned char *buf,
+    unsigned int len, int create_empty_fragment)
+{
+        unsigned char *p, *plen;
+        int i, mac_size, clear = 0;
+        int prefix_len = 0;
         int eivlen;
-        long align=0;
+        long align = 0;
         SSL3_RECORD *wr;
-        SSL3_BUFFER *wb=&(s->s3->wbuf);
+        SSL3_BUFFER *wb = &(s->s3->wbuf);
         SSL_SESSION *sess;
 
-        if (wb->buf == NULL)
+        if (wb->buf == NULL)
                 if (!ssl3_setup_write_buffer(s))
                         return -1;
 
         /* first check if there is a SSL3_BUFFER still being written
          * out.  This will happen with non blocking IO */
         if (wb->left != 0)
-                return(ssl3_write_pending(s,type,buf,len));
+                return (ssl3_write_pending(s, type, buf, len));
 
         /* If we have an alert to send, lets send it */
-        if (s->s3->alert_dispatch)
-                {
-                i=s->method->ssl_dispatch_alert(s);
+        if (s->s3->alert_dispatch) {
+                i = s->method->ssl_dispatch_alert(s);
                 if (i <= 0)
-                        return(i);
+                        return (i);
                 /* if it went, fall through and send more stuff */
-                }
+        }
 
         if (len == 0 && !create_empty_fragment)
                 return 0;
 
-        wr= &(s->s3->wrec);
-        sess=s->session;
+        wr = &(s->s3->wrec);
+        sess = s->session;
 
-        if (    (sess == NULL) ||
-                (s->enc_write_ctx == NULL) ||
-                (EVP_MD_CTX_md(s->write_hash) == NULL))
-                {
+        if ((sess == NULL) || (s->enc_write_ctx == NULL) ||
+            (EVP_MD_CTX_md(s->write_hash) == NULL)) {
 #if 1
-                clear=s->enc_write_ctx?0:1;     /* must be AEAD cipher */
+                clear = s->enc_write_ctx ? 0 : 1; /* must be AEAD cipher */
 #else
-                clear=1;
+                clear = 1;
 #endif
-                mac_size=0;
-                }
-        else
-                {
-                mac_size=EVP_MD_CTX_size(s->write_hash);
+                mac_size = 0;
+        } else {
+                mac_size = EVP_MD_CTX_size(s->write_hash);
                 if (mac_size < 0)
                         goto err;
-                }
+        }
 
         /* 'create_empty_fragment' is true only when this function calls itself */
-        if (!clear && !create_empty_fragment && !s->s3->empty_fragment_done)
-                {
+        if (!clear && !create_empty_fragment && !s->s3->empty_fragment_done) {
                 /* countermeasure against known-IV weakness in CBC ciphersuites
                  * (see http://www.openssl.org/~bodo/tls-cbc.txt) */
 
-                if (s->s3->need_empty_fragments && type == SSL3_RT_APPLICATION_DATA)
-                        {
+                if (s->s3->need_empty_fragments && type == SSL3_RT_APPLICATION_DATA) {
                         /* recursive function call with 'create_empty_fragment' set;
                          * this prepares and buffers the data for an empty fragment
                          * (these 'prefix_len' bytes are sent out later
@@ -700,216 +664,195 @@ static int do_ssl3_write(SSL *s, int type, const unsigned char *buf,
                                 goto err;
 
                         if (prefix_len >
-                (SSL3_RT_HEADER_LENGTH + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD))
-                                {
+                                (SSL3_RT_HEADER_LENGTH + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD)) {
                                 /* insufficient space */
                                 SSLerr(SSL_F_DO_SSL3_WRITE, ERR_R_INTERNAL_ERROR);
                                 goto err;
-                                }
                         }
-                
-                s->s3->empty_fragment_done = 1;
                 }
 
-        if (create_empty_fragment)
-                {
+                s->s3->empty_fragment_done = 1;
+        }
+
+        if (create_empty_fragment) {
 #if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD!=0
                 /* extra fragment would be couple of cipher blocks,
                  * which would be multiple of SSL3_ALIGN_PAYLOAD, so
                  * if we want to align the real payload, then we can
                  * just pretent we simply have two headers. */
                 align = (long)wb->buf + 2*SSL3_RT_HEADER_LENGTH;
-                align = (-align)&(SSL3_ALIGN_PAYLOAD-1);
+                align = (-align)&(SSL3_ALIGN_PAYLOAD - 1);
 #endif
                 p = wb->buf + align;
-                wb->offset  = align;
-                }
-        else if (prefix_len)
-                {
+                wb->offset = align;
+        } else if (prefix_len) {
                 p = wb->buf + wb->offset + prefix_len;
-                }
-        else
-                {
+        } else {
 #if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD!=0
                 align = (long)wb->buf + SSL3_RT_HEADER_LENGTH;
-                align = (-align)&(SSL3_ALIGN_PAYLOAD-1);
+                align = (-align)&(SSL3_ALIGN_PAYLOAD - 1);
 #endif
                 p = wb->buf + align;
-                wb->offset  = align;
-                }
+                wb->offset = align;
+        }
 
         /* write the header */
 
-        *(p++)=type&0xff;
-        wr->type=type;
+        *(p++) = type&0xff;
+        wr->type = type;
 
-        *(p++)=(s->version>>8);
+        *(p++) = (s->version >> 8);
         /* Some servers hang if iniatial client hello is larger than 256
          * bytes and record version number > TLS 1.0
          */
-        if (s->state == SSL3_ST_CW_CLNT_HELLO_B
-                                && !s->renegotiate
-                                && TLS1_get_version(s) > TLS1_VERSION)
+        if (s->state == SSL3_ST_CW_CLNT_HELLO_B && !s->renegotiate &&
+            TLS1_get_version(s) > TLS1_VERSION)
                 *(p++) = 0x1;
         else
-                *(p++)=s->version&0xff;
+                *(p++) = s->version&0xff;
 
         /* field where we are to write out packet length */
-        plen=p; 
-        p+=2;
+        plen = p;
+
+        p += 2;
         /* Explicit IV length, block ciphers and TLS version 1.1 or later */
-        if (s->enc_write_ctx && s->version >= TLS1_1_VERSION)
-                {
+        if (s->enc_write_ctx && s->version >= TLS1_1_VERSION) {
                 int mode = EVP_CIPHER_CTX_mode(s->enc_write_ctx);
-                if (mode == EVP_CIPH_CBC_MODE)
-                        {
+                if (mode == EVP_CIPH_CBC_MODE) {
                         eivlen = EVP_CIPHER_CTX_iv_length(s->enc_write_ctx);
                         if (eivlen <= 1)
                                 eivlen = 0;
-                        }
+                }
                 /* Need explicit part of IV for GCM mode */
                 else if (mode == EVP_CIPH_GCM_MODE)
                         eivlen = EVP_GCM_TLS_EXPLICIT_IV_LEN;
                 else
                         eivlen = 0;
-                }
-        else 
+        } else
                 eivlen = 0;
 
         /* lets setup the record stuff. */
-        wr->data=p + eivlen;
-        wr->length=(int)len;
-        wr->input=(unsigned char *)buf;
+        wr->data = p + eivlen;
+        wr->length = (int)len;
+        wr->input = (unsigned char *)buf;
 
         /* we now 'read' from wr->input, wr->length bytes into
          * wr->data */
 
         /* first we compress */
-        if (s->compress != NULL)
-                {
-                if (!ssl3_do_compress(s))
-                        {
-                        SSLerr(SSL_F_DO_SSL3_WRITE,SSL_R_COMPRESSION_FAILURE);
+        if (s->compress != NULL) {
+                if (!ssl3_do_compress(s)) {
+                        SSLerr(SSL_F_DO_SSL3_WRITE, SSL_R_COMPRESSION_FAILURE);
                         goto err;
-                        }
-                }
-        else
-                {
-                memcpy(wr->data,wr->input,wr->length);
-                wr->input=wr->data;
                 }
+        } else {
+                memcpy(wr->data, wr->input, wr->length);
+                wr->input = wr->data;
+        }
 
         /* we should still have the output to wr->data and the input
          * from wr->input.  Length should be wr->length.
          * wr->data still points in the wb->buf */
 
-        if (mac_size != 0)
-                {
-                if (s->method->ssl3_enc->mac(s,&(p[wr->length + eivlen]),1) < 0)
+        if (mac_size != 0) {
+                if (s->method->ssl3_enc->mac(s, &(p[wr->length + eivlen]), 1) < 0)
                         goto err;
-                wr->length+=mac_size;
-                }
+                wr->length += mac_size;
+        }
 
-        wr->input=p;
-        wr->data=p;
+        wr->input = p;
+        wr->data = p;
 
-        if (eivlen)
-                {
+        if (eivlen) {
         /*      if (RAND_pseudo_bytes(p, eivlen) <= 0)
-                        goto err; */
+                        goto err;
+*/
                 wr->length += eivlen;
-                }
+        }
 
         /* ssl3_enc can only have an error on read */
-        s->method->ssl3_enc->enc(s,1);
+        s->method->ssl3_enc->enc(s, 1);
 
         /* record length after mac and block padding */
-        s2n(wr->length,plen);
+        s2n(wr->length, plen);
 
         /* we should now have
          * wr->data pointing to the encrypted data, which is
          * wr->length long */
         wr->type=type; /* not needed but helps for debugging */
-        wr->length+=SSL3_RT_HEADER_LENGTH;
+        wr->length += SSL3_RT_HEADER_LENGTH;
 
-        if (create_empty_fragment)
-                {
+        if (create_empty_fragment) {
                 /* we are in a recursive call;
                  * just return the length, don't write out anything here
                  */
                 return wr->length;
-                }
+        }
 
         /* now let's set up wb */
         wb->left = prefix_len + wr->length;
 
         /* memorize arguments so that ssl3_write_pending can detect bad write retries later */
-        s->s3->wpend_tot=len;
-        s->s3->wpend_buf=buf;
-        s->s3->wpend_type=type;
-        s->s3->wpend_ret=len;
+        s->s3->wpend_tot = len;
+        s->s3->wpend_buf = buf;
+        s->s3->wpend_type = type;
+        s->s3->wpend_ret = len;
 
         /* we now just need to write the buffer */
-        return ssl3_write_pending(s,type,buf,len);
+        return ssl3_write_pending(s, type, buf, len);
 err:
         return -1;
-        }
+}
 
 /* if s->s3->wbuf.left != 0, we need to call this */
-int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
-        unsigned int len)
-        {
+int
+ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
+    unsigned int len)
+{
         int i;
-        SSL3_BUFFER *wb=&(s->s3->wbuf);
+        SSL3_BUFFER *wb = &(s->s3->wbuf);
 
 /* XXXX */
-        if ((s->s3->wpend_tot > (int)len)
-                || ((s->s3->wpend_buf != buf) &&
-                        !(s->mode & SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER))
-                || (s->s3->wpend_type != type))
-                {
-                SSLerr(SSL_F_SSL3_WRITE_PENDING,SSL_R_BAD_WRITE_RETRY);
-                return(-1);
-                }
+        if ((s->s3->wpend_tot > (int)len) || ((s->s3->wpend_buf != buf) &&
+            !(s->mode & SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER)) ||
+            (s->s3->wpend_type != type)) {
+                SSLerr(SSL_F_SSL3_WRITE_PENDING, SSL_R_BAD_WRITE_RETRY);
+                return (-1);
+        }
 
-        for (;;)
-                {
+        for (;;) {
                 errno = 0;
-                if (s->wbio != NULL)
-                        {
-                        s->rwstate=SSL_WRITING;
-                        i=BIO_write(s->wbio,
-                                (char *)&(wb->buf[wb->offset]),
-                                (unsigned int)wb->left);
-                        }
-                else
-                        {
-                        SSLerr(SSL_F_SSL3_WRITE_PENDING,SSL_R_BIO_NOT_SET);
-                        i= -1;
-                        }
-                if (i == wb->left)
-                        {
-                        wb->left=0;
-                        wb->offset+=i;
+                if (s->wbio != NULL) {
+                        s->rwstate = SSL_WRITING;
+                        i = BIO_write(s->wbio,
+                        (char *)&(wb->buf[wb->offset]),
+                        (unsigned int)wb->left);
+                } else {
+                        SSLerr(SSL_F_SSL3_WRITE_PENDING, SSL_R_BIO_NOT_SET);
+                        i = -1;
+                }
+                if (i == wb->left) {
+                        wb->left = 0;
+                        wb->offset += i;
                         if (s->mode & SSL_MODE_RELEASE_BUFFERS &&
-                            SSL_version(s) != DTLS1_VERSION && SSL_version(s) != DTLS1_BAD_VER)
+                            SSL_version(s) != DTLS1_VERSION &&
+                            SSL_version(s) != DTLS1_BAD_VER)
                                 ssl3_release_write_buffer(s);
-                        s->rwstate=SSL_NOTHING;
-                        return(s->s3->wpend_ret);
-                        }
-                else if (i <= 0) {
+                        s->rwstate = SSL_NOTHING;
+                        return (s->s3->wpend_ret);
+                } else if (i <= 0) {
                         if (s->version == DTLS1_VERSION ||
                             s->version == DTLS1_BAD_VER) {
                                 /* For DTLS, just drop it. That's kind of the whole
                                    point in using a datagram service */
                                 wb->left = 0;
                         }
-                        return(i);
-                }
-                wb->offset+=i;
-                wb->left-=i;
+                        return (i);
                 }
+                wb->offset += i;
+                wb->left -= i;
         }
+}
 
 /* Return up to 'len' payload bytes received in 'type' records.
  * 'type' is one of the following:
@@ -938,39 +881,40 @@ int ssl3_write_pending(SSL *s, int type, const unsigned char *buf,
  *     Application data protocol
  *             none of our business
  */
-int ssl3_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek)
-        {
-        int al,i,j,ret;
+int
+ssl3_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek)
+{
+        int al, i, j, ret;
         unsigned int n;
         SSL3_RECORD *rr;
-        void (*cb)(const SSL *ssl,int type2,int val)=NULL;
+        void (*cb)(const SSL *ssl, int type2, int val) = NULL;
 
         if (s->s3->rbuf.buf == NULL) /* Not initialized yet */
                 if (!ssl3_setup_read_buffer(s))
-                        return(-1);
+                        return (-1);
 
-        if ((type && (type != SSL3_RT_APPLICATION_DATA) && (type != SSL3_RT_HANDSHAKE) && type) ||
-            (peek && (type != SSL3_RT_APPLICATION_DATA)))
-                {
+        if ((type && (type != SSL3_RT_APPLICATION_DATA) &&
+            (type != SSL3_RT_HANDSHAKE) && type) ||
+            (peek && (type != SSL3_RT_APPLICATION_DATA))) {
                 SSLerr(SSL_F_SSL3_READ_BYTES, ERR_R_INTERNAL_ERROR);
                 return -1;
-                }
+        }
 
         if ((type == SSL3_RT_HANDSHAKE) && (s->s3->handshake_fragment_len > 0))
                 /* (partially) satisfy request from storage */
-                {
+        {
                 unsigned char *src = s->s3->handshake_fragment;
                 unsigned char *dst = buf;
                 unsigned int k;
 
                 /* peek == 0 */
                 n = 0;
-                while ((len > 0) && (s->s3->handshake_fragment_len > 0))
-                        {
+                while ((len > 0) && (s->s3->handshake_fragment_len > 0)) {
                         *dst++ = *src++;
-                        len--; s->s3->handshake_fragment_len--;
+                        len--;
+                        s->s3->handshake_fragment_len--;
                         n++;
-                        }
+                }
                 /* move any remaining fragment bytes: */
                 for (k = 0; k < s->s3->handshake_fragment_len; k++)
                         s->s3->handshake_fragment[k] = *src++;
@@ -979,19 +923,18 @@ int ssl3_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek)
 
         /* Now s->s3->handshake_fragment_len == 0 if type == SSL3_RT_HANDSHAKE. */
 
-        if (!s->in_handshake && SSL_in_init(s))
-                {
+        if (!s->in_handshake && SSL_in_init(s)) {
                 /* type == SSL3_RT_APPLICATION_DATA */
-                i=s->handshake_func(s);
-                if (i < 0) return(i);
-                if (i == 0)
-                        {
-                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_SSL_HANDSHAKE_FAILURE);
-                        return(-1);
-                        }
+                i = s->handshake_func(s);
+                if (i < 0)
+                        return (i);
+                if (i == 0) {
+                        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_SSL_HANDSHAKE_FAILURE);
+                        return (-1);
                 }
+        }
 start:
-        s->rwstate=SSL_NOTHING;
+        s->rwstate = SSL_NOTHING;
 
         /* s->s3->rrec.type         - is the type of record
          * s->s3->rrec.data,    - data
@@ -1000,67 +943,63 @@ start:
         rr = &(s->s3->rrec);
 
         /* get new packet if necessary */
-        if ((rr->length == 0) || (s->rstate == SSL_ST_READ_BODY))
-                {
-                ret=ssl3_get_record(s);
-                if (ret <= 0) return(ret);
-                }
+        if ((rr->length == 0) || (s->rstate == SSL_ST_READ_BODY)) {
+                ret = ssl3_get_record(s);
+                if (ret <= 0)
+                        return (ret);
+        }
 
         /* we now have a packet which can be read and processed */
 
         if (s->s3->change_cipher_spec /* set when we receive ChangeCipherSpec,
                                        * reset by ssl3_get_finished */
-                && (rr->type != SSL3_RT_HANDSHAKE))
-                {
-                al=SSL_AD_UNEXPECTED_MESSAGE;
-                SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_DATA_BETWEEN_CCS_AND_FINISHED);
+            && (rr->type != SSL3_RT_HANDSHAKE)) {
+                al = SSL_AD_UNEXPECTED_MESSAGE;
+                SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_DATA_BETWEEN_CCS_AND_FINISHED);
                 goto f_err;
-                }
+        }
 
         /* If the other end has shut down, throw anything we read away
          * (even in 'peek' mode) */
-        if (s->shutdown & SSL_RECEIVED_SHUTDOWN)
-                {
-                rr->length=0;
-                s->rwstate=SSL_NOTHING;
-                return(0);
-                }
+        if (s->shutdown & SSL_RECEIVED_SHUTDOWN) {
+                rr->length = 0;
+                s->rwstate = SSL_NOTHING;
+                return (0);
+        }
 
 
         if (type == rr->type) /* SSL3_RT_APPLICATION_DATA or SSL3_RT_HANDSHAKE */
-                {
+        {
                 /* make sure that we are not getting application data when we
                  * are doing a handshake for the first time */
                 if (SSL_in_init(s) && (type == SSL3_RT_APPLICATION_DATA) &&
-                        (s->enc_read_ctx == NULL))
-                        {
-                        al=SSL_AD_UNEXPECTED_MESSAGE;
-                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_APP_DATA_IN_HANDSHAKE);
+                        (s->enc_read_ctx == NULL)) {
+                        al = SSL_AD_UNEXPECTED_MESSAGE;
+                        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_APP_DATA_IN_HANDSHAKE);
                         goto f_err;
-                        }
+                }
 
-                if (len <= 0) return(len);
+                if (len <= 0)
+                        return (len);
 
                 if ((unsigned int)len > rr->length)
                         n = rr->length;
                 else
                         n = (unsigned int)len;
 
-                memcpy(buf,&(rr->data[rr->off]),n);
-                if (!peek)
-                        {
-                        rr->length-=n;
-                        rr->off+=n;
-                        if (rr->length == 0)
-                                {
-                                s->rstate=SSL_ST_READ_HEADER;
-                                rr->off=0;
+                memcpy(buf, &(rr->data[rr->off]), n);
+                if (!peek) {
+                        rr->length -= n;
+                        rr->off += n;
+                        if (rr->length == 0) {
+                                s->rstate = SSL_ST_READ_HEADER;
+                                rr->off = 0;
                                 if (s->mode & SSL_MODE_RELEASE_BUFFERS)
                                         ssl3_release_read_buffer(s);
-                                }
                         }
-                return(n);
                 }
+                return (n);
+        }
 
 
         /* If we get here, then type != rr->type; if we have a handshake
@@ -1069,137 +1008,122 @@ start:
         /* In case of record types for which we have 'fragment' storage,
          * fill that so that we can process the data at a fixed place.
          */
-                {
+        {
                 unsigned int dest_maxlen = 0;
                 unsigned char *dest = NULL;
                 unsigned int *dest_len = NULL;
 
-                if (rr->type == SSL3_RT_HANDSHAKE)
-                        {
+                if (rr->type == SSL3_RT_HANDSHAKE) {
                         dest_maxlen = sizeof s->s3->handshake_fragment;
                         dest = s->s3->handshake_fragment;
                         dest_len = &s->s3->handshake_fragment_len;
-                        }
-                else if (rr->type == SSL3_RT_ALERT)
-                        {
+                } else if (rr->type == SSL3_RT_ALERT) {
                         dest_maxlen = sizeof s->s3->alert_fragment;
                         dest = s->s3->alert_fragment;
                         dest_len = &s->s3->alert_fragment_len;
-                        }
+                }
 #ifndef OPENSSL_NO_HEARTBEATS
-                else if (rr->type == TLS1_RT_HEARTBEAT)
-                        {
+                else if (rr->type == TLS1_RT_HEARTBEAT) {
                         tls1_process_heartbeat(s);
 
                         /* Exit and notify application to read again */
                         rr->length = 0;
-                        s->rwstate=SSL_READING;
+                        s->rwstate = SSL_READING;
                         BIO_clear_retry_flags(SSL_get_rbio(s));
                         BIO_set_retry_read(SSL_get_rbio(s));
-                        return(-1);
-                        }
+                        return (-1);
+                }
 #endif
 
-                if (dest_maxlen > 0)
-                        {
+                if (dest_maxlen > 0) {
                         n = dest_maxlen - *dest_len; /* available space in 'dest' */
                         if (rr->length < n)
                                 n = rr->length; /* available bytes */
 
                         /* now move 'n' bytes: */
-                        while (n-- > 0)
-                                {
+                        while (n-- > 0) {
                                 dest[(*dest_len)++] = rr->data[rr->off++];
                                 rr->length--;
-                                }
+                        }
 
                         if (*dest_len < dest_maxlen)
                                 goto start; /* fragment was too small */
-                        }
                 }
+        }
 
         /* s->s3->handshake_fragment_len == 4  iff  rr->type == SSL3_RT_HANDSHAKE;
          * s->s3->alert_fragment_len == 2      iff  rr->type == SSL3_RT_ALERT.
          * (Possibly rr is 'empty' now, i.e. rr->length may be 0.) */
 
         /* If we are a client, check for an incoming 'Hello Request': */
-        if ((!s->server) &&
-                (s->s3->handshake_fragment_len >= 4) &&
-                (s->s3->handshake_fragment[0] == SSL3_MT_HELLO_REQUEST) &&
-                (s->session != NULL) && (s->session->cipher != NULL))
-                {
+        if ((!s->server) && (s->s3->handshake_fragment_len >= 4) &&
+            (s->s3->handshake_fragment[0] == SSL3_MT_HELLO_REQUEST) &&
+            (s->session != NULL) && (s->session->cipher != NULL)) {
                 s->s3->handshake_fragment_len = 0;
 
                 if ((s->s3->handshake_fragment[1] != 0) ||
-                        (s->s3->handshake_fragment[2] != 0) ||
-                        (s->s3->handshake_fragment[3] != 0))
-                        {
-                        al=SSL_AD_DECODE_ERROR;
-                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_BAD_HELLO_REQUEST);
+                    (s->s3->handshake_fragment[2] != 0) ||
+                    (s->s3->handshake_fragment[3] != 0)) {
+                        al = SSL_AD_DECODE_ERROR;
+                        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_BAD_HELLO_REQUEST);
                         goto f_err;
-                        }
+                }
 
                 if (s->msg_callback)
                         s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, s->s3->handshake_fragment, 4, s, s->msg_callback_arg);
 
                 if (SSL_is_init_finished(s) &&
-                        !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS) &&
-                        !s->s3->renegotiate)
-                        {
+                    !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS) &&
+                    !s->s3->renegotiate) {
                         ssl3_renegotiate(s);
-                        if (ssl3_renegotiate_check(s))
-                                {
-                                i=s->handshake_func(s);
-                                if (i < 0) return(i);
-                                if (i == 0)
-                                        {
-                                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_SSL_HANDSHAKE_FAILURE);
-                                        return(-1);
-                                        }
+                        if (ssl3_renegotiate_check(s)) {
+                                i = s->handshake_func(s);
+                                if (i < 0)
+                                        return (i);
+                                if (i == 0) {
+                                        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_SSL_HANDSHAKE_FAILURE);
+                                        return (-1);
+                                }
 
-                                if (!(s->mode & SSL_MODE_AUTO_RETRY))
-                                        {
+                                if (!(s->mode & SSL_MODE_AUTO_RETRY)) {
                                         if (s->s3->rbuf.left == 0) /* no read-ahead left? */
-                                                {
+                                        {
                                                 BIO *bio;
                                                 /* In the case where we try to read application data,
                                                  * but we trigger an SSL handshake, we return -1 with
                                                  * the retry option set.  Otherwise renegotiation may
                                                  * cause nasty problems in the blocking world */
-                                                s->rwstate=SSL_READING;
-                                                bio=SSL_get_rbio(s);
+                                                s->rwstate = SSL_READING;
+                                                bio = SSL_get_rbio(s);
                                                 BIO_clear_retry_flags(bio);
                                                 BIO_set_retry_read(bio);
-                                                return(-1);
-                                                }
+                                                return (-1);
                                         }
                                 }
                         }
+                }
                 /* we either finished a handshake or ignored the request,
                  * now try again to obtain the (application) data we were asked for */
                 goto start;
-                }
+        }
         /* If we are a server and get a client hello when renegotiation isn't
          * allowed send back a no renegotiation alert and carry on.
          * WARNING: experimental code, needs reviewing (steve)
          */
         if (s->server &&
-                SSL_is_init_finished(s) &&
-                !s->s3->send_connection_binding &&
-                (s->version > SSL3_VERSION) &&
-                (s->s3->handshake_fragment_len >= 4) &&
-                (s->s3->handshake_fragment[0] == SSL3_MT_CLIENT_HELLO) &&
-                (s->session != NULL) && (s->session->cipher != NULL) &&
-                !(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
-                
-                {
+            SSL_is_init_finished(s) &&
+            !s->s3->send_connection_binding &&
+            (s->version > SSL3_VERSION) &&
+            (s->s3->handshake_fragment_len >= 4) &&
+            (s->s3->handshake_fragment[0] == SSL3_MT_CLIENT_HELLO) &&
+            (s->session != NULL) && (s->session->cipher != NULL) &&
+            !(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)) {
                 /*s->s3->handshake_fragment_len = 0;*/
                 rr->length = 0;
-                ssl3_send_alert(s,SSL3_AL_WARNING, SSL_AD_NO_RENEGOTIATION);
+                ssl3_send_alert(s, SSL3_AL_WARNING, SSL_AD_NO_RENEGOTIATION);
                 goto start;
-                }
-        if (s->s3->alert_fragment_len >= 2)
-                {
+        }
+        if (s->s3->alert_fragment_len >= 2) {
                 int alert_level = s->s3->alert_fragment[0];
                 int alert_descr = s->s3->alert_fragment[1];
 
@@ -1209,24 +1133,22 @@ start:
                         s->msg_callback(0, s->version, SSL3_RT_ALERT, s->s3->alert_fragment, 2, s, s->msg_callback_arg);
 
                 if (s->info_callback != NULL)
-                        cb=s->info_callback;
+                        cb = s->info_callback;
                 else if (s->ctx->info_callback != NULL)
-                        cb=s->ctx->info_callback;
+                        cb = s->ctx->info_callback;
 
-                if (cb != NULL)
-                        {
+                if (cb != NULL) {
                         j = (alert_level << 8) | alert_descr;
                         cb(s, SSL_CB_READ_ALERT, j);
-                        }
+                }
 
                 if (alert_level == 1) /* warning */
-                        {
+                {
                         s->s3->warn_alert = alert_descr;
-                        if (alert_descr == SSL_AD_CLOSE_NOTIFY)
-                                {
+                        if (alert_descr == SSL_AD_CLOSE_NOTIFY) {
                                 s->shutdown |= SSL_RECEIVED_SHUTDOWN;
-                                return(0);
-                                }
+                                return (0);
+                        }
                         /* This is a warning but we receive it if we requested
                          * renegotiation and the peer denied it. Terminate with
                          * a fatal alert because if application tried to
@@ -1236,139 +1158,126 @@ start:
                          * In future we might have a renegotiation where we
                          * don't care if the peer refused it where we carry on.
                          */
-                        else if (alert_descr == SSL_AD_NO_RENEGOTIATION)
-                                {
+                        else if (alert_descr == SSL_AD_NO_RENEGOTIATION) {
                                 al = SSL_AD_HANDSHAKE_FAILURE;
-                                SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_NO_RENEGOTIATION);
+                                SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_NO_RENEGOTIATION);
                                 goto f_err;
-                                }
+                        }
 #ifdef SSL_AD_MISSING_SRP_USERNAME
                         else if (alert_descr == SSL_AD_MISSING_SRP_USERNAME)
-                                return(0);
+                                return (0);
 #endif
-                        }
-                else if (alert_level == 2) /* fatal */
-                        {
+                } else if (alert_level == 2) /* fatal */
+                {
                         char tmp[16];
 
-                        s->rwstate=SSL_NOTHING;
+                        s->rwstate = SSL_NOTHING;
                         s->s3->fatal_alert = alert_descr;
                         SSLerr(SSL_F_SSL3_READ_BYTES, SSL_AD_REASON_OFFSET + alert_descr);
-                        BIO_snprintf(tmp,sizeof tmp,"%d",alert_descr);
-                        ERR_add_error_data(2,"SSL alert number ",tmp);
+                        BIO_snprintf(tmp, sizeof tmp, "%d", alert_descr);
+                        ERR_add_error_data(2, "SSL alert number ", tmp);
                         s->shutdown|=SSL_RECEIVED_SHUTDOWN;
-                        SSL_CTX_remove_session(s->ctx,s->session);
-                        return(0);
-                        }
-                else
-                        {
-                        al=SSL_AD_ILLEGAL_PARAMETER;
-                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_UNKNOWN_ALERT_TYPE);
+                        SSL_CTX_remove_session(s->ctx, s->session);
+                        return (0);
+                } else {
+                        al = SSL_AD_ILLEGAL_PARAMETER;
+                        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_UNKNOWN_ALERT_TYPE);
                         goto f_err;
-                        }
+                }
 
                 goto start;
-                }
+        }
 
         if (s->shutdown & SSL_SENT_SHUTDOWN) /* but we have not received a shutdown */
-                {
-                s->rwstate=SSL_NOTHING;
-                rr->length=0;
-                return(0);
-                }
+        {
+                s->rwstate = SSL_NOTHING;
+                rr->length = 0;
+                return (0);
+        }
 
-        if (rr->type == SSL3_RT_CHANGE_CIPHER_SPEC)
-                {
+        if (rr->type == SSL3_RT_CHANGE_CIPHER_SPEC) {
                 /* 'Change Cipher Spec' is just a single byte, so we know
                  * exactly what the record payload has to look like */
-                if (    (rr->length != 1) || (rr->off != 0) ||
-                        (rr->data[0] != SSL3_MT_CCS))
-                        {
-                        al=SSL_AD_ILLEGAL_PARAMETER;
-                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_BAD_CHANGE_CIPHER_SPEC);
+                if ((rr->length != 1) || (rr->off != 0) ||
+                        (rr->data[0] != SSL3_MT_CCS)) {
+                        al = SSL_AD_ILLEGAL_PARAMETER;
+                        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_BAD_CHANGE_CIPHER_SPEC);
                         goto f_err;
-                        }
+                }
 
                 /* Check we have a cipher to change to */
-                if (s->s3->tmp.new_cipher == NULL)
-                        {
-                        al=SSL_AD_UNEXPECTED_MESSAGE;
-                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_CCS_RECEIVED_EARLY);
+                if (s->s3->tmp.new_cipher == NULL) {
+                        al = SSL_AD_UNEXPECTED_MESSAGE;
+                        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_CCS_RECEIVED_EARLY);
                         goto f_err;
-                        }
+                }
 
-                rr->length=0;
+                rr->length = 0;
 
                 if (s->msg_callback)
                         s->msg_callback(0, s->version, SSL3_RT_CHANGE_CIPHER_SPEC, rr->data, 1, s, s->msg_callback_arg);
 
-                s->s3->change_cipher_spec=1;
+                s->s3->change_cipher_spec = 1;
                 if (!ssl3_do_change_cipher_spec(s))
                         goto err;
                 else
                         goto start;
-                }
+        }
 
         /* Unexpected handshake message (Client Hello, or protocol violation) */
-        if ((s->s3->handshake_fragment_len >= 4) &&     !s->in_handshake)
-                {
+        if ((s->s3->handshake_fragment_len >= 4) && !s->in_handshake) {
                 if (((s->state&SSL_ST_MASK) == SSL_ST_OK) &&
-                        !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS))
-                        {
+                    !(s->s3->flags & SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS)) {
 #if 0 /* worked only because C operator preferences are not as expected (and
-       * because this is not really needed for clients except for detecting
+                        * because this is not really needed for clients except for detecting
        * protocol violations): */
-                        s->state=SSL_ST_BEFORE|(s->server)
-                                ?SSL_ST_ACCEPT
-                                :SSL_ST_CONNECT;
+                        s->state = SSL_ST_BEFORE |
+                            (s->server) ? SSL_ST_ACCEPT : SSL_ST_CONNECT;
 #else
                         s->state = s->server ? SSL_ST_ACCEPT : SSL_ST_CONNECT;
 #endif
-                        s->renegotiate=1;
-                        s->new_session=1;
-                        }
-                i=s->handshake_func(s);
-                if (i < 0) return(i);
-                if (i == 0)
-                        {
-                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_SSL_HANDSHAKE_FAILURE);
-                        return(-1);
-                        }
+                        s->renegotiate = 1;
+                        s->new_session = 1;
+                }
+                i = s->handshake_func(s);
+                if (i < 0)
+                        return (i);
+                if (i == 0) {
+                        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_SSL_HANDSHAKE_FAILURE);
+                        return (-1);
+                }
 
-                if (!(s->mode & SSL_MODE_AUTO_RETRY))
-                        {
+                if (!(s->mode & SSL_MODE_AUTO_RETRY)) {
                         if (s->s3->rbuf.left == 0) /* no read-ahead left? */
-                                {
+                        {
                                 BIO *bio;
                                 /* In the case where we try to read application data,
                                  * but we trigger an SSL handshake, we return -1 with
                                  * the retry option set.  Otherwise renegotiation may
                                  * cause nasty problems in the blocking world */
-                                s->rwstate=SSL_READING;
-                                bio=SSL_get_rbio(s);
+                                s->rwstate = SSL_READING;
+                                bio = SSL_get_rbio(s);
                                 BIO_clear_retry_flags(bio);
                                 BIO_set_retry_read(bio);
-                                return(-1);
-                                }
+                                return (-1);
                         }
-                goto start;
                 }
+                goto start;
+        }
 
-        switch (rr->type)
-                {
+        switch (rr->type) {
         default:
 #ifndef OPENSSL_NO_TLS
                 /* TLS up to v1.1 just ignores unknown message types:
                  * TLS v1.2 give an unexpected message alert.
                  */
-                if (s->version >= TLS1_VERSION && s->version <= TLS1_1_VERSION)
-                        {
+                if (s->version >= TLS1_VERSION && s->version <= TLS1_1_VERSION) {
                         rr->length = 0;
                         goto start;
-                        }
+                }
 #endif
-                al=SSL_AD_UNEXPECTED_MESSAGE;
-                SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_UNEXPECTED_RECORD);
+                al = SSL_AD_UNEXPECTED_MESSAGE;
+                SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_UNEXPECTED_RECORD);
                 goto f_err;
         case SSL3_RT_CHANGE_CIPHER_SPEC:
         case SSL3_RT_ALERT:
@@ -1376,8 +1285,8 @@ start:
                 /* we already handled all of these, with the possible exception
                  * of SSL3_RT_HANDSHAKE when s->in_handshake is set, but that
                  * should not happen when type != rr->type */
-                al=SSL_AD_UNEXPECTED_MESSAGE;
-                SSLerr(SSL_F_SSL3_READ_BYTES,ERR_R_INTERNAL_ERROR);
+                al = SSL_AD_UNEXPECTED_MESSAGE;
+                SSLerr(SSL_F_SSL3_READ_BYTES, ERR_R_INTERNAL_ERROR);
                 goto f_err;
         case SSL3_RT_APPLICATION_DATA:
                 /* At this point, we were expecting handshake data,
@@ -1388,123 +1297,116 @@ start:
                  * we will indulge it.
                  */
                 if (s->s3->in_read_app_data &&
-                        (s->s3->total_renegotiations != 0) &&
-                        ((
-                                (s->state & SSL_ST_CONNECT) &&
-                                (s->state >= SSL3_ST_CW_CLNT_HELLO_A) &&
-                                (s->state <= SSL3_ST_CR_SRVR_HELLO_A)
-                                ) || (
-                                        (s->state & SSL_ST_ACCEPT) &&
-                                        (s->state <= SSL3_ST_SW_HELLO_REQ_A) &&
-                                        (s->state >= SSL3_ST_SR_CLNT_HELLO_A)
-                                        )
-                                ))
-                        {
-                        s->s3->in_read_app_data=2;
-                        return(-1);
-                        }
-                else
-                        {
-                        al=SSL_AD_UNEXPECTED_MESSAGE;
-                        SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_UNEXPECTED_RECORD);
+                    (s->s3->total_renegotiations != 0) &&
+                    ((
+                    (s->state & SSL_ST_CONNECT) &&
+                    (s->state >= SSL3_ST_CW_CLNT_HELLO_A) &&
+                    (s->state <= SSL3_ST_CR_SRVR_HELLO_A)
+                    ) || (
+                    (s->state & SSL_ST_ACCEPT) &&
+                    (s->state <= SSL3_ST_SW_HELLO_REQ_A) &&
+                    (s->state >= SSL3_ST_SR_CLNT_HELLO_A)
+                    )
+                    )) {
+                        s->s3->in_read_app_data = 2;
+                        return (-1);
+                } else {
+                        al = SSL_AD_UNEXPECTED_MESSAGE;
+                        SSLerr(SSL_F_SSL3_READ_BYTES, SSL_R_UNEXPECTED_RECORD);
                         goto f_err;
-                        }
                 }
+        }
         /* not reached */
 
 f_err:
-        ssl3_send_alert(s,SSL3_AL_FATAL,al);
+        ssl3_send_alert(s, SSL3_AL_FATAL, al);
 err:
-        return(-1);
-        }
+        return (-1);
+}
 
-int ssl3_do_change_cipher_spec(SSL *s)
-        {
+int
+ssl3_do_change_cipher_spec(SSL *s)
+{
         int i;
         const char *sender;
         int slen;
 
         if (s->state & SSL_ST_ACCEPT)
-                i=SSL3_CHANGE_CIPHER_SERVER_READ;
+                i = SSL3_CHANGE_CIPHER_SERVER_READ;
         else
-                i=SSL3_CHANGE_CIPHER_CLIENT_READ;
+                i = SSL3_CHANGE_CIPHER_CLIENT_READ;
 
-        if (s->s3->tmp.key_block == NULL)
-                {
-                if (s->session == NULL) 
-                        {
+        if (s->s3->tmp.key_block == NULL) {
+                if (s->session == NULL) {
                         /* might happen if dtls1_read_bytes() calls this */
-                        SSLerr(SSL_F_SSL3_DO_CHANGE_CIPHER_SPEC,SSL_R_CCS_RECEIVED_EARLY);
+                        SSLerr(SSL_F_SSL3_DO_CHANGE_CIPHER_SPEC, SSL_R_CCS_RECEIVED_EARLY);
                         return (0);
-                        }
-
-                s->session->cipher=s->s3->tmp.new_cipher;
-                if (!s->method->ssl3_enc->setup_key_block(s)) return(0);
                 }
 
-        if (!s->method->ssl3_enc->change_cipher_state(s,i))
-                return(0);
+                s->session->cipher = s->s3->tmp.new_cipher;
+                if (!s->method->ssl3_enc->setup_key_block(s))
+                        return (0);
+        }
+
+        if (!s->method->ssl3_enc->change_cipher_state(s, i))
+                return (0);
 
         /* we have to record the message digest at
          * this point so we can get it before we read
          * the finished message */
-        if (s->state & SSL_ST_CONNECT)
-                {
-                sender=s->method->ssl3_enc->server_finished_label;
-                slen=s->method->ssl3_enc->server_finished_label_len;
-                }
-        else
-                {
-                sender=s->method->ssl3_enc->client_finished_label;
-                slen=s->method->ssl3_enc->client_finished_label_len;
-                }
+        if (s->state & SSL_ST_CONNECT) {
+                sender = s->method->ssl3_enc->server_finished_label;
+                slen = s->method->ssl3_enc->server_finished_label_len;
+        } else {
+                sender = s->method->ssl3_enc->client_finished_label;
+                slen = s->method->ssl3_enc->client_finished_label_len;
+        }
 
         i = s->method->ssl3_enc->final_finish_mac(s,
-                sender,slen,s->s3->tmp.peer_finish_md);
-        if (i == 0)
-                {
+        sender, slen, s->s3->tmp.peer_finish_md);
+        if (i == 0) {
                 SSLerr(SSL_F_SSL3_DO_CHANGE_CIPHER_SPEC, ERR_R_INTERNAL_ERROR);
                 return 0;
-                }
+        }
         s->s3->tmp.peer_finish_md_len = i;
 
-        return(1);
-        }
+        return (1);
+}
 
-int ssl3_send_alert(SSL *s, int level, int desc)
-        {
+int
+ssl3_send_alert(SSL *s, int level, int desc)
+{
         /* Map tls/ssl alert value to correct one */
-        desc=s->method->ssl3_enc->alert_value(desc);
+        desc = s->method->ssl3_enc->alert_value(desc);
         if (s->version == SSL3_VERSION && desc == SSL_AD_PROTOCOL_VERSION)
                 desc = SSL_AD_HANDSHAKE_FAILURE; /* SSL 3.0 does not have protocol_version alerts */
-        if (desc < 0) return -1;
+        if (desc < 0)
+                return -1;
         /* If a fatal one, remove from cache */
         if ((level == 2) && (s->session != NULL))
-                SSL_CTX_remove_session(s->ctx,s->session);
+                SSL_CTX_remove_session(s->ctx, s->session);
 
-        s->s3->alert_dispatch=1;
-        s->s3->send_alert[0]=level;
-        s->s3->send_alert[1]=desc;
+        s->s3->alert_dispatch = 1;
+        s->s3->send_alert[0] = level;
+        s->s3->send_alert[1] = desc;
         if (s->s3->wbuf.left == 0) /* data still being written out? */
                 return s->method->ssl_dispatch_alert(s);
         /* else data is still being written out, we will get written
          * some time in the future */
         return -1;
-        }
+}
 
-int ssl3_dispatch_alert(SSL *s)
-        {
-        int i,j;
-        void (*cb)(const SSL *ssl,int type,int val)=NULL;
+int
+ssl3_dispatch_alert(SSL *s)
+{
+        int i, j;
+        void (*cb)(const SSL *ssl, int type, int val) = NULL;
 
-        s->s3->alert_dispatch=0;
+        s->s3->alert_dispatch = 0;
         i = do_ssl3_write(s, SSL3_RT_ALERT, &s->s3->send_alert[0], 2, 0);
-        if (i <= 0)
-                {
-                s->s3->alert_dispatch=1;
-                }
-        else
-                {
+        if (i <= 0) {
+                s->s3->alert_dispatch = 1;
+        } else {
                 /* Alert sent to BIO.  If it is important, flush it now.
                  * If the message does not get sent due to non-blocking IO,
                  * we will not worry too much. */
@@ -1515,15 +1417,14 @@ int ssl3_dispatch_alert(SSL *s)
                         s->msg_callback(1, s->version, SSL3_RT_ALERT, s->s3->send_alert, 2, s, s->msg_callback_arg);
 
                 if (s->info_callback != NULL)
-                        cb=s->info_callback;
+                        cb = s->info_callback;
                 else if (s->ctx->info_callback != NULL)
-                        cb=s->ctx->info_callback;
+                        cb = s->ctx->info_callback;
 
-                if (cb != NULL)
-                        {
-                        j=(s->s3->send_alert[0]<<8)|s->s3->send_alert[1];
-                        cb(s,SSL_CB_WRITE_ALERT,j);
-                        }
+                if (cb != NULL) {
+                        j = (s->s3->send_alert[0]<<8)|s->s3->send_alert[1];
+                        cb(s, SSL_CB_WRITE_ALERT, j);
                 }
-        return(i);
         }
+        return (i);
+}