KNF

author: miod <> 2014-07-09 13:26:47 +0000
committer: miod <> 2014-07-09 13:26:47 +0000
commit: 7b0280e96c976103d66ebabe5a23f4f9e18a88f1 (patch)
tree: efa6e3fe5e9cccf6532f4f9d3fd222d9fbb45764 /src
parent: 4b7ee752ce92891c2906d9e0a72e420564d3dfd1 (diff)
download: openbsd-7b0280e96c976103d66ebabe5a23f4f9e18a88f1.tar.gz
openbsd-7b0280e96c976103d66ebabe5a23f4f9e18a88f1.tar.bz2
openbsd-7b0280e96c976103d66ebabe5a23f4f9e18a88f1.zip
18 files changed, 1198 insertions, 1134 deletions
diff --git a/src/lib/libcrypto/dh/dh_ameth.c b/src/lib/libcrypto/dh/dh_ameth.c
index 88ef78d98d..9e911c8779 100644
--- a/src/lib/libcrypto/dh/dh_ameth.c
+++ b/src/lib/libcrypto/dh/dh_ameth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh_ameth.c,v 1.8 2014/06/30 14:15:34 tedu Exp $ */
+/* $OpenBSD: dh_ameth.c,v 1.9 2014/07/09 13:26:47 miod Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
 * project 2006.
 */
@@ -64,13 +64,15 @@
 #include <openssl/bn.h>
 #include "asn1_locl.h"
-static void int_dh_free(EVP_PKEY *pkey)
+static void
-        {
+int_dh_free(EVP_PKEY *pkey)
+{
        DH_free(pkey->pkey.dh);
-        }
+}
-static int dh_pub_decode(EVP_PKEY *pkey, X509_PUBKEY *pubkey)
+static int
-        {
+dh_pub_decode(EVP_PKEY *pkey, X509_PUBKEY *pubkey)
+{
        const unsigned char *p, *pm;
        int pklen, pmlen;
        int ptype;
@@ -78,57 +80,52 @@ static int dh_pub_decode(EVP_PKEY *pkey, X509_PUBKEY *pubkey)
        ASN1_STRING *pstr;
        X509_ALGOR *palg;
        ASN1_INTEGER *public_key = NULL;
        DH *dh = NULL;
        if (!X509_PUBKEY_get0_param(NULL, &p, &pklen, &palg, pubkey))
                return 0;
        X509_ALGOR_get0(NULL, &ptype, &pval, palg);
-        if (ptype != V_ASN1_SEQUENCE)
+        if (ptype != V_ASN1_SEQUENCE) {
-                {
                DHerr(DH_F_DH_PUB_DECODE, DH_R_PARAMETER_ENCODING_ERROR);
                goto err;
-                }
+        }
        pstr = pval;    
        pm = pstr->data;
        pmlen = pstr->length;
-        if (!(dh = d2i_DHparams(NULL, &pm, pmlen)))
+        if (!(dh = d2i_DHparams(NULL, &pm, pmlen))) {
-                {
                DHerr(DH_F_DH_PUB_DECODE, DH_R_DECODE_ERROR);
                goto err;
-                }
+        }
-        if (!(public_key=d2i_ASN1_INTEGER(NULL, &p, pklen)))
+        if (!(public_key=d2i_ASN1_INTEGER(NULL, &p, pklen))) {
-                {
                DHerr(DH_F_DH_PUB_DECODE, DH_R_DECODE_ERROR);
                goto err;
-                }
+        }
        /* We have parameters now set public key */
-        if (!(dh->pub_key = ASN1_INTEGER_to_BN(public_key, NULL)))
+        if (!(dh->pub_key = ASN1_INTEGER_to_BN(public_key, NULL))) {
-                {
                DHerr(DH_F_DH_PUB_DECODE, DH_R_BN_DECODE_ERROR);
                goto err;
-                }
+        }
        ASN1_INTEGER_free(public_key);
        EVP_PKEY_assign_DH(pkey, dh);
        return 1;
-        err:
+err:
        if (public_key)
                ASN1_INTEGER_free(public_key);
        if (dh)
                DH_free(dh);
        return 0;
+}
-        }
+static int
+dh_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey)
-static int dh_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey)
+{
-        {
        DH *dh;
        int ptype;
        unsigned char *penc = NULL;
@@ -145,11 +142,10 @@ static int dh_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey)
        }
        str->length = i2d_DHparams(dh, &str->data);
-        if (str->length <= 0)
+        if (str->length <= 0) {
-                {
                DHerr(DH_F_DH_PUB_ENCODE, ERR_R_MALLOC_FAILURE);
                goto err;
-                }
+        }
        ptype = V_ASN1_SEQUENCE;
        pub_key = BN_to_ASN1_INTEGER(dh->pub_key, NULL);
@@ -160,32 +156,32 @@ static int dh_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey)
        ASN1_INTEGER_free(pub_key);
-        if (penclen <= 0)
+        if (penclen <= 0) {
-                {
                DHerr(DH_F_DH_PUB_ENCODE, ERR_R_MALLOC_FAILURE);
                goto err;
                }
-        if (X509_PUBKEY_set0_param(pk, OBJ_nid2obj(EVP_PKEY_DH),
+        if (X509_PUBKEY_set0_param(pk, OBJ_nid2obj(EVP_PKEY_DH), ptype,
-                                ptype, (void *)str, penc, penclen))
+            (void *)str, penc, penclen))
                return 1;
-        err:
+err:
        free(penc);
        if (str)
                ASN1_STRING_free(str);
        return 0;
-        }
+}
-/* PKCS#8 DH is defined in PKCS#11 of all places. It is similar to DH in
+/*
+ * PKCS#8 DH is defined in PKCS#11 of all places. It is similar to DH in
 * that the AlgorithmIdentifier contains the paramaters, the private key
 * is explcitly included and the pubkey must be recalculated.
 */
        
-static int dh_priv_decode(EVP_PKEY *pkey, PKCS8_PRIV_KEY_INFO *p8)
+static int
-        {
+dh_priv_decode(EVP_PKEY *pkey, PKCS8_PRIV_KEY_INFO *p8)
+{
        const unsigned char *p, *pm;
        int pklen, pmlen;
        int ptype;
@@ -193,7 +189,6 @@ static int dh_priv_decode(EVP_PKEY *pkey, PKCS8_PRIV_KEY_INFO *p8)
        ASN1_STRING *pstr;
        X509_ALGOR *palg;
        ASN1_INTEGER *privkey = NULL;
        DH *dh = NULL;
        if (!PKCS8_pkey_get0(NULL, &p, &pklen, &palg, p8))
@@ -202,23 +197,21 @@ static int dh_priv_decode(EVP_PKEY *pkey, PKCS8_PRIV_KEY_INFO *p8)
        X509_ALGOR_get0(NULL, &ptype, &pval, palg);
        if (ptype != V_ASN1_SEQUENCE)
-                        goto decerr;
+                goto decerr;
        if (!(privkey=d2i_ASN1_INTEGER(NULL, &p, pklen)))
                goto decerr;
        pstr = pval;    
        pm = pstr->data;
        pmlen = pstr->length;
        if (!(dh = d2i_DHparams(NULL, &pm, pmlen)))
                goto decerr;
        /* We have parameters now set private key */
-        if (!(dh->priv_key = ASN1_INTEGER_to_BN(privkey, NULL)))
+        if (!(dh->priv_key = ASN1_INTEGER_to_BN(privkey, NULL))) {
-                {
+                DHerr(DH_F_DH_PRIV_DECODE, DH_R_BN_ERROR);
-                DHerr(DH_F_DH_PRIV_DECODE,DH_R_BN_ERROR);
                goto dherr;
-                }
+        }
        /* Calculate public key */
        if (!DH_generate_key(dh))
                goto dherr;
@@ -229,14 +222,15 @@ static int dh_priv_decode(EVP_PKEY *pkey, PKCS8_PRIV_KEY_INFO *p8)
        return 1;
-        decerr:
+decerr:
        DHerr(DH_F_DH_PRIV_DECODE, EVP_R_DECODE_ERROR);
-        dherr:
+dherr:
        DH_free(dh);
        return 0;
-        }
+}
-static int dh_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
+static int
+dh_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
 {
        ASN1_STRING *params = NULL;
        ASN1_INTEGER *prkey = NULL;
@@ -245,35 +239,32 @@ static int dh_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
        params = ASN1_STRING_new();
-        if (!params)
+        if (!params) {
-                {
+                DHerr(DH_F_DH_PRIV_ENCODE, ERR_R_MALLOC_FAILURE);
-                DHerr(DH_F_DH_PRIV_ENCODE,ERR_R_MALLOC_FAILURE);
                goto err;
-                }
+        }
        params->length = i2d_DHparams(pkey->pkey.dh, &params->data);
-        if (params->length <= 0)
+        if (params->length <= 0) {
-                {
                DHerr(DH_F_DH_PRIV_ENCODE,ERR_R_MALLOC_FAILURE);
                goto err;
-                }
+        }
        params->type = V_ASN1_SEQUENCE;
        /* Get private key into integer */
        prkey = BN_to_ASN1_INTEGER(pkey->pkey.dh->priv_key, NULL);
-        if (!prkey)
+        if (!prkey) {
-                {
+                DHerr(DH_F_DH_PRIV_ENCODE, DH_R_BN_ERROR);
-                DHerr(DH_F_DH_PRIV_ENCODE,DH_R_BN_ERROR);
                goto err;
-                }
+        }
        dplen = i2d_ASN1_INTEGER(prkey, &dp);
        ASN1_INTEGER_free(prkey);
        if (!PKCS8_pkey_set0(p8, OBJ_nid2obj(NID_dhKeyAgreement), 0,
-                                V_ASN1_SEQUENCE, params, dp, dplen))
+            V_ASN1_SEQUENCE, params, dp, dplen))
                goto err;
        return 1;
@@ -287,43 +278,43 @@ err:
        return 0;
 }
+static void
-static void update_buflen(const BIGNUM *b, size_t *pbuflen)
+update_buflen(const BIGNUM *b, size_t *pbuflen)
-        {
+{
        size_t i;
        if (!b)
                return;
        if (*pbuflen < (i = (size_t)BN_num_bytes(b)))
-                        *pbuflen = i;
+                *pbuflen = i;
-        }
+}
-static int dh_param_decode(EVP_PKEY *pkey,
+static int
-                                        const unsigned char **pder, int derlen)
+dh_param_decode(EVP_PKEY *pkey, const unsigned char **pder, int derlen)
-        {
+{
        DH *dh;
-        if (!(dh = d2i_DHparams(NULL, pder, derlen)))
-                {
+        if (!(dh = d2i_DHparams(NULL, pder, derlen))) {
                DHerr(DH_F_DH_PARAM_DECODE, ERR_R_DH_LIB);
                return 0;
-                }
+        }
        EVP_PKEY_assign_DH(pkey, dh);
        return 1;
-        }
+}
-static int dh_param_encode(const EVP_PKEY *pkey, unsigned char **pder)
+static int
-        {
+dh_param_encode(const EVP_PKEY *pkey, unsigned char **pder)
+{
        return i2d_DHparams(pkey->pkey.dh, pder);
-        }
+}
-static int do_dh_print(BIO *bp, const DH *x, int indent,
-                                                ASN1_PCTX *ctx, int ptype)
-        {
-        unsigned char *m=NULL;
-        int reason=ERR_R_BUF_LIB,ret=0;
-        size_t buf_len=0;
+static int
+do_dh_print(BIO *bp, const DH *x, int indent, ASN1_PCTX *ctx, int ptype)
+{
+        unsigned char *m = NULL;
+        int reason = ERR_R_BUF_LIB, ret = 0;
+        size_t buf_len = 0;
        const char *ktype = NULL;
        BIGNUM *priv_key, *pub_key;
        if (ptype == 2)
@@ -338,11 +329,10 @@ static int do_dh_print(BIO *bp, const DH *x, int indent,
        update_buflen(x->p, &buf_len);
-        if (buf_len == 0)
+        if (buf_len == 0) {
-                {
                reason = ERR_R_PASSED_NULL_PARAMETER;
                goto err;
-                }
+        }
        update_buflen(x->g, &buf_len);
        update_buflen(pub_key, &buf_len);
@@ -355,118 +345,126 @@ static int do_dh_print(BIO *bp, const DH *x, int indent,
        else
                ktype = "PKCS#3 DH Parameters";
-        m= malloc(buf_len+10);
+        m= malloc(buf_len + 10);
-        if (m == NULL)
+        if (m == NULL) {
-                {
+                reason = ERR_R_MALLOC_FAILURE;
-                reason=ERR_R_MALLOC_FAILURE;
                goto err;
-                }
+        }
        BIO_indent(bp, indent, 128);
-        if (BIO_printf(bp,"%s: (%d bit)\n", ktype, BN_num_bits(x->p)) <= 0)
+        if (BIO_printf(bp, "%s: (%d bit)\n", ktype, BN_num_bits(x->p)) <= 0)
                goto err;
        indent += 4;
-        if (!ASN1_bn_print(bp,"private-key:",priv_key,m,indent)) goto err;
+        if (!ASN1_bn_print(bp, "private-key:", priv_key, m, indent))
-        if (!ASN1_bn_print(bp,"public-key:",pub_key,m,indent)) goto err;
+                goto err;
+        if (!ASN1_bn_print(bp, "public-key:", pub_key, m, indent))
+                goto err;
-        if (!ASN1_bn_print(bp,"prime:",x->p,m,indent)) goto err;
+        if (!ASN1_bn_print(bp, "prime:", x->p, m, indent))
-        if (!ASN1_bn_print(bp,"generator:",x->g,m,indent)) goto err;
+                goto err;
-        if (x->length != 0)
+        if (!ASN1_bn_print(bp, "generator:", x->g, m, indent))
-                {
+                goto err;
+        if (x->length != 0) {
                BIO_indent(bp, indent, 128);
-                if (BIO_printf(bp,"recommended-private-length: %d bits\n",
+                if (BIO_printf(bp, "recommended-private-length: %d bits\n",
-                        (int)x->length) <= 0) goto err;
+                    (int)x->length) <= 0)
-                }
+                        goto err;
+        }
-        ret=1;
+        ret = 1;
-        if (0)
+        if (0) {
-                {
 err:
                DHerr(DH_F_DO_DH_PRINT,reason);
-                }
+        }
        free(m);
        return(ret);
-        }
+}
-static int int_dh_size(const EVP_PKEY *pkey)
+static int
-        {
+int_dh_size(const EVP_PKEY *pkey)
-        return(DH_size(pkey->pkey.dh));
+{
-        }
+        return DH_size(pkey->pkey.dh);
+}
-static int dh_bits(const EVP_PKEY *pkey)
+static int
-        {
+dh_bits(const EVP_PKEY *pkey)
+{
        return BN_num_bits(pkey->pkey.dh->p);
-        }
+}
-static int dh_cmp_parameters(const EVP_PKEY *a, const EVP_PKEY *b)
+static int
-        {
+dh_cmp_parameters(const EVP_PKEY *a, const EVP_PKEY *b)
-        if (    BN_cmp(a->pkey.dh->p,b->pkey.dh->p) ||
+{
-                BN_cmp(a->pkey.dh->g,b->pkey.dh->g))
+        if (BN_cmp(a->pkey.dh->p, b->pkey.dh->p) ||
+            BN_cmp(a->pkey.dh->g, b->pkey.dh->g))
                return 0;
        else
                return 1;
-        }
+}
-static int dh_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from)
+static int
-        {
+dh_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from)
+{
        BIGNUM *a;
-        if ((a=BN_dup(from->pkey.dh->p)) == NULL)
+        if ((a = BN_dup(from->pkey.dh->p)) == NULL)
                return 0;
        if (to->pkey.dh->p != NULL)
                BN_free(to->pkey.dh->p);
-        to->pkey.dh->p=a;
+        to->pkey.dh->p = a;
-        if ((a=BN_dup(from->pkey.dh->g)) == NULL)
+        if ((a = BN_dup(from->pkey.dh->g)) == NULL)
                return 0;
        if (to->pkey.dh->g != NULL)
                BN_free(to->pkey.dh->g);
-        to->pkey.dh->g=a;
+        to->pkey.dh->g = a;
        return 1;
-        }
+}
-static int dh_missing_parameters(const EVP_PKEY *a)
+static int
-        {
+dh_missing_parameters(const EVP_PKEY *a)
+{
        if (!a->pkey.dh->p || !a->pkey.dh->g)
                return 1;
        return 0;
-        }
+}
-static int dh_pub_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
+static int
-        {
+dh_pub_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
+{
        if (dh_cmp_parameters(a, b) == 0)
                return 0;
-        if (BN_cmp(b->pkey.dh->pub_key,a->pkey.dh->pub_key) != 0)
+        if (BN_cmp(b->pkey.dh->pub_key, a->pkey.dh->pub_key) != 0)
                return 0;
        else
                return 1;
-        }
+}
-static int dh_param_print(BIO *bp, const EVP_PKEY *pkey, int indent,
+static int
-                                                        ASN1_PCTX *ctx)
+dh_param_print(BIO *bp, const EVP_PKEY *pkey, int indent, ASN1_PCTX *ctx)
-        {
+{
        return do_dh_print(bp, pkey->pkey.dh, indent, ctx, 0);
-        }
+}
-static int dh_public_print(BIO *bp, const EVP_PKEY *pkey, int indent,
+static int
-                                                        ASN1_PCTX *ctx)
+dh_public_print(BIO *bp, const EVP_PKEY *pkey, int indent, ASN1_PCTX *ctx)
-        {
+{
        return do_dh_print(bp, pkey->pkey.dh, indent, ctx, 1);
-        }
+}
-static int dh_private_print(BIO *bp, const EVP_PKEY *pkey, int indent,
+static int
-                                                        ASN1_PCTX *ctx)
+dh_private_print(BIO *bp, const EVP_PKEY *pkey, int indent, ASN1_PCTX *ctx)
-        {
+{
        return do_dh_print(bp, pkey->pkey.dh, indent, ctx, 2);
-        }
+}
-int DHparams_print(BIO *bp, const DH *x)
+int
-        {
+DHparams_print(BIO *bp, const DH *x)
+{
        return do_dh_print(bp, x, 4, NULL, 0);
-        }
+}
 const EVP_PKEY_ASN1_METHOD dh_asn1_meth = {
        .pkey_id = EVP_PKEY_DH,
@@ -496,4 +494,3 @@ const EVP_PKEY_ASN1_METHOD dh_asn1_meth = {
        .pkey_free = int_dh_free,
 };
diff --git a/src/lib/libcrypto/dh/dh_asn1.c b/src/lib/libcrypto/dh/dh_asn1.c
index f1afe876ca..ed3a015279 100644
--- a/src/lib/libcrypto/dh/dh_asn1.c
+++ b/src/lib/libcrypto/dh/dh_asn1.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh_asn1.c,v 1.4 2014/06/12 15:49:28 deraadt Exp $ */
+/* $OpenBSD: dh_asn1.c,v 1.5 2014/07/09 13:26:47 miod Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
 * project 2000.
 */
@@ -64,14 +64,15 @@
 #include <openssl/asn1t.h>
 /* Override the default free and new methods */
-static int dh_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
+static int
-                                                void *exarg)
+dh_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it, void *exarg)
 {
-        if(operation == ASN1_OP_NEW_PRE) {
+        if (operation == ASN1_OP_NEW_PRE) {
                *pval = (ASN1_VALUE *)DH_new();
-                if(*pval) return 2;
+                if (*pval)
+                        return 2;
                return 0;
-        } else if(operation == ASN1_OP_FREE_PRE) {
+        } else if (operation == ASN1_OP_FREE_PRE) {
                DH_free((DH *)*pval);
                *pval = NULL;
                return 2;
@@ -87,7 +88,8 @@ ASN1_SEQUENCE_cb(DHparams, dh_cb) = {
 IMPLEMENT_ASN1_ENCODE_FUNCTIONS_const_fname(DH, DHparams, DHparams)
-DH *DHparams_dup(DH *dh)
+DH *
-        {
+DHparams_dup(DH *dh)
+{
        return ASN1_item_dup(ASN1_ITEM_rptr(DHparams), dh);
-        }
+}
diff --git a/src/lib/libcrypto/dh/dh_check.c b/src/lib/libcrypto/dh/dh_check.c
index 71ea9c1683..1df8f4cdc7 100644
--- a/src/lib/libcrypto/dh/dh_check.c
+++ b/src/lib/libcrypto/dh/dh_check.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh_check.c,v 1.10 2014/06/12 15:49:28 deraadt Exp $ */
+/* $OpenBSD: dh_check.c,v 1.11 2014/07/09 13:26:47 miod Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
 * All rights reserved.
 *
@@ -61,7 +61,8 @@
 #include <openssl/bn.h>
 #include <openssl/dh.h>
-/* Check that p is a safe prime and
+/*
+ * Check that p is a safe prime and
 * if g is 2, 3 or 5, check that it is a suitable generator
 * where
 * for 2, p mod 24 == 11
@@ -70,73 +71,77 @@
 * should hold.
 */
-int DH_check(const DH *dh, int *ret)
+int
-        {
+DH_check(const DH *dh, int *ret)
-        int ok=0;
+{
-        BN_CTX *ctx=NULL;
+        int ok = 0;
+        BN_CTX *ctx = NULL;
        BN_ULONG l;
-        BIGNUM *q=NULL;
+        BIGNUM *q = NULL;
-        *ret=0;
+        *ret = 0;
-        ctx=BN_CTX_new();
+        ctx = BN_CTX_new();
-        if (ctx == NULL) goto err;
+        if (ctx == NULL)
-        q=BN_new();
+                goto err;
-        if (q == NULL) goto err;
+        q = BN_new();
+        if (q == NULL)
+                goto err;
-        if (BN_is_word(dh->g,DH_GENERATOR_2))
+        if (BN_is_word(dh->g, DH_GENERATOR_2)) {
-                {
+                l = BN_mod_word(dh->p, 24);
-                l=BN_mod_word(dh->p,24);
+                if (l != 11)
-                if (l != 11) *ret|=DH_NOT_SUITABLE_GENERATOR;
+                        *ret |= DH_NOT_SUITABLE_GENERATOR;
-                }
 #if 0
-        else if (BN_is_word(dh->g,DH_GENERATOR_3))
+        } else if (BN_is_word(dh->g, DH_GENERATOR_3)) {
-                {
+                l = BN_mod_word(dh->p, 12);
-                l=BN_mod_word(dh->p,12);
+                if (l != 5)
-                if (l != 5) *ret|=DH_NOT_SUITABLE_GENERATOR;
+                        *ret |= DH_NOT_SUITABLE_GENERATOR;
-                }
 #endif
-        else if (BN_is_word(dh->g,DH_GENERATOR_5))
+        } else if (BN_is_word(dh->g, DH_GENERATOR_5)) {
-                {
+                l = BN_mod_word(dh->p, 10);
-                l=BN_mod_word(dh->p,10);
+                if (l != 3 && l != 7)
-                if ((l != 3) && (l != 7))
+                        *ret |= DH_NOT_SUITABLE_GENERATOR;
-                        *ret|=DH_NOT_SUITABLE_GENERATOR;
+        } else
-                }
+                *ret |= DH_UNABLE_TO_CHECK_GENERATOR;
-        else
-                *ret|=DH_UNABLE_TO_CHECK_GENERATOR;
-        if (!BN_is_prime_ex(dh->p,BN_prime_checks,ctx,NULL))
+        if (!BN_is_prime_ex(dh->p, BN_prime_checks, ctx, NULL))
-                *ret|=DH_CHECK_P_NOT_PRIME;
+                *ret |= DH_CHECK_P_NOT_PRIME;
-        else
+        else {
-                {
+                if (!BN_rshift1(q, dh->p))
-                if (!BN_rshift1(q,dh->p)) goto err;
+                        goto err;
-                if (!BN_is_prime_ex(q,BN_prime_checks,ctx,NULL))
+                if (!BN_is_prime_ex(q, BN_prime_checks, ctx, NULL))
-                        *ret|=DH_CHECK_P_NOT_SAFE_PRIME;
+                        *ret |= DH_CHECK_P_NOT_SAFE_PRIME;
-                }
-        ok=1;
-err:
-        if (ctx != NULL) BN_CTX_free(ctx);
-        if (q != NULL) BN_free(q);
-        return(ok);
        }
+        ok = 1;
+err:
+        if (ctx != NULL)
+                BN_CTX_free(ctx);
+        if (q != NULL)
+                BN_free(q);
+        return ok;
+}
-int DH_check_pub_key(const DH *dh, const BIGNUM *pub_key, int *ret)
+int
-        {
+DH_check_pub_key(const DH *dh, const BIGNUM *pub_key, int *ret)
-        int ok=0;
+{
-        BIGNUM *q=NULL;
+        int ok = 0;
+        BIGNUM *q = NULL;
-        *ret=0;
+        *ret = 0;
-        q=BN_new();
+        q = BN_new();
-        if (q == NULL) goto err;
+        if (q == NULL)
-        BN_set_word(q,1);
+                goto err;
-        if (BN_cmp(pub_key,q)<=0)
+        BN_set_word(q, 1);
-                *ret|=DH_CHECK_PUBKEY_TOO_SMALL;
+        if (BN_cmp(pub_key, q) <= 0)
-        BN_copy(q,dh->p);
+                *ret |= DH_CHECK_PUBKEY_TOO_SMALL;
-        BN_sub_word(q,1);
+        BN_copy(q, dh->p);
-        if (BN_cmp(pub_key,q)>=0)
+        BN_sub_word(q, 1);
-                *ret|=DH_CHECK_PUBKEY_TOO_LARGE;
+        if (BN_cmp(pub_key, q) >= 0)
+                *ret |= DH_CHECK_PUBKEY_TOO_LARGE;
        ok = 1;
 err:
-        if (q != NULL) BN_free(q);
+        if (q != NULL)
-        return(ok);
+                BN_free(q);
-        }
+        return ok;
+}
diff --git a/src/lib/libcrypto/dh/dh_depr.c b/src/lib/libcrypto/dh/dh_depr.c
index 61c0f35636..bc7ba16f2b 100644
--- a/src/lib/libcrypto/dh/dh_depr.c
+++ b/src/lib/libcrypto/dh/dh_depr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh_depr.c,v 1.3 2014/06/12 15:49:28 deraadt Exp $ */
+/* $OpenBSD: dh_depr.c,v 1.4 2014/07/09 13:26:47 miod Exp $ */
 /* ====================================================================
 * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
 *
@@ -62,20 +62,21 @@
 #include <openssl/dh.h>
 #ifndef OPENSSL_NO_DEPRECATED
-DH *DH_generate_parameters(int prime_len, int generator,
+DH *
-             void (*callback)(int,int,void *), void *cb_arg)
+DH_generate_parameters(int prime_len, int generator,
-        {
+    void (*callback)(int, int, void *), void *cb_arg)
+{
        BN_GENCB cb;
-        DH *ret=NULL;
+        DH *ret = NULL;
-        if((ret=DH_new()) == NULL)
+        if ((ret = DH_new()) == NULL)
                return NULL;
        BN_GENCB_set_old(&cb, callback, cb_arg);
-        if(DH_generate_parameters_ex(ret, prime_len, generator, &cb))
+        if (DH_generate_parameters_ex(ret, prime_len, generator, &cb))
                return ret;
        DH_free(ret);
        return NULL;
-        }
+}
 #endif
diff --git a/src/lib/libcrypto/dh/dh_gen.c b/src/lib/libcrypto/dh/dh_gen.c
index 67bdc5f769..453ea3e8e4 100644
--- a/src/lib/libcrypto/dh/dh_gen.c
+++ b/src/lib/libcrypto/dh/dh_gen.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh_gen.c,v 1.11 2014/06/12 15:49:28 deraadt Exp $ */
+/* $OpenBSD: dh_gen.c,v 1.12 2014/07/09 13:26:47 miod Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
 * All rights reserved.
 *
@@ -66,16 +66,19 @@
 #include <openssl/bn.h>
 #include <openssl/dh.h>
-static int dh_builtin_genparams(DH *ret, int prime_len, int generator, BN_GENCB *cb);
+static int dh_builtin_genparams(DH *ret, int prime_len, int generator,
+            BN_GENCB *cb);
-int DH_generate_parameters_ex(DH *ret, int prime_len, int generator, BN_GENCB *cb)
+int
-        {
+DH_generate_parameters_ex(DH *ret, int prime_len, int generator, BN_GENCB *cb)
-        if(ret->meth->generate_params)
+{
+        if (ret->meth->generate_params)
                return ret->meth->generate_params(ret, prime_len, generator, cb);
        return dh_builtin_genparams(ret, prime_len, generator, cb);
-        }
+}
-/* We generate DH parameters as follows
+/*
+ * We generate DH parameters as follows:
 * find a prime q which is prime_len/2 bits long.
 * p=(2*q)+1 or (p-1)/2 = q
 * For this case, g is a generator if
@@ -100,76 +103,84 @@ int DH_generate_parameters_ex(DH *ret, int prime_len, int generator, BN_GENCB *c
 * It's just as OK (and in some sense better) to use a generator of the
 * order-q subgroup.
 */
-static int dh_builtin_genparams(DH *ret, int prime_len, int generator, BN_GENCB *cb)
+static int
-        {
+dh_builtin_genparams(DH *ret, int prime_len, int generator, BN_GENCB *cb)
-        BIGNUM *t1,*t2;
+{
-        int g,ok= -1;
+        BIGNUM *t1, *t2;
-        BN_CTX *ctx=NULL;
+        int g, ok = -1;
+        BN_CTX *ctx = NULL;
-        ctx=BN_CTX_new();
+        ctx = BN_CTX_new();
-        if (ctx == NULL) goto err;
+        if (ctx == NULL)
+                goto err;
        BN_CTX_start(ctx);
        t1 = BN_CTX_get(ctx);
        t2 = BN_CTX_get(ctx);
-        if (t1 == NULL || t2 == NULL) goto err;
+        if (t1 == NULL || t2 == NULL)
+                goto err;
        /* Make sure 'ret' has the necessary elements */
-        if(!ret->p && ((ret->p = BN_new()) == NULL)) goto err;
+        if (!ret->p && ((ret->p = BN_new()) == NULL))
-        if(!ret->g && ((ret->g = BN_new()) == NULL)) goto err;
+                goto err;
+        if (!ret->g && ((ret->g = BN_new()) == NULL))
+                goto err;
        
-        if (generator <= 1)
+        if (generator <= 1) {
-                {
                DHerr(DH_F_DH_BUILTIN_GENPARAMS, DH_R_BAD_GENERATOR);
                goto err;
-                }
+        }
-        if (generator == DH_GENERATOR_2)
+        if (generator == DH_GENERATOR_2) {
-                {
+                if (!BN_set_word(t1, 24))
-                if (!BN_set_word(t1,24)) goto err;
+                        goto err;
-                if (!BN_set_word(t2,11)) goto err;
+                if (!BN_set_word(t2, 11))
-                g=2;
+                        goto err;
-                }
+                g = 2;
 #if 0 /* does not work for safe primes */
-        else if (generator == DH_GENERATOR_3)
+        } else if (generator == DH_GENERATOR_3) {
-                {
+                if (!BN_set_word(t1, 12))
-                if (!BN_set_word(t1,12)) goto err;
+                        goto err;
-                if (!BN_set_word(t2,5)) goto err;
+                if (!BN_set_word(t2, 5))
-                g=3;
+                        goto err;
-                }
+                g = 3;
 #endif
-        else if (generator == DH_GENERATOR_5)
+        } else if (generator == DH_GENERATOR_5) {
-                {
+                if (!BN_set_word(t1, 10))
-                if (!BN_set_word(t1,10)) goto err;
+                        goto err;
-                if (!BN_set_word(t2,3)) goto err;
+                if (!BN_set_word(t2, 3))
+                        goto err;
                /* BN_set_word(t3,7); just have to miss
                 * out on these ones :-( */
-                g=5;
+                g = 5;
-                }
+        } else {
-        else
+                /*
-                {
+                 * in the general case, don't worry if 'generator' is a
-                /* in the general case, don't worry if 'generator' is a
                 * generator or not: since we are using safe primes,
                 * it will generate either an order-q or an order-2q group,
-                 * which both is OK */
+                 * which both is OK
-                if (!BN_set_word(t1,2)) goto err;
+                 */
-                if (!BN_set_word(t2,1)) goto err;
+                if (!BN_set_word(t1, 2))
-                g=generator;
+                        goto err;
-                }
+                if (!BN_set_word(t2, 1))
+                        goto err;
+                g = generator;
+        }
        
-        if(!BN_generate_prime_ex(ret->p,prime_len,1,t1,t2,cb)) goto err;
+        if (!BN_generate_prime_ex(ret->p, prime_len, 1, t1, t2, cb))
-        if(!BN_GENCB_call(cb, 3, 0)) goto err;
+                goto err;
-        if (!BN_set_word(ret->g,g)) goto err;
+        if (!BN_GENCB_call(cb, 3, 0))
-        ok=1;
+                goto err;
+        if (!BN_set_word(ret->g, g))
+                goto err;
+        ok = 1;
 err:
-        if (ok == -1)
+        if (ok == -1) {
-                {
+                DHerr(DH_F_DH_BUILTIN_GENPARAMS, ERR_R_BN_LIB);
-                DHerr(DH_F_DH_BUILTIN_GENPARAMS,ERR_R_BN_LIB);
+                ok = 0;
-                ok=0;
+        }
-                }
-        if (ctx != NULL)
+        if (ctx != NULL) {
-                {
                BN_CTX_end(ctx);
                BN_CTX_free(ctx);
-                }
-        return ok;
        }
+        return ok;
+}
diff --git a/src/lib/libcrypto/dh/dh_key.c b/src/lib/libcrypto/dh/dh_key.c
index d35eb6e740..4fbedd8daa 100644
--- a/src/lib/libcrypto/dh/dh_key.c
+++ b/src/lib/libcrypto/dh/dh_key.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh_key.c,v 1.18 2014/06/12 15:49:28 deraadt Exp $ */
+/* $OpenBSD: dh_key.c,v 1.19 2014/07/09 13:26:47 miod Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
 * All rights reserved.
 *
@@ -64,22 +64,22 @@
 static int generate_key(DH *dh);
 static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh);
-static int dh_bn_mod_exp(const DH *dh, BIGNUM *r,
+static int dh_bn_mod_exp(const DH *dh, BIGNUM *r, const BIGNUM *a,
-                        const BIGNUM *a, const BIGNUM *p,
+            const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
-                        const BIGNUM *m, BN_CTX *ctx,
-                        BN_MONT_CTX *m_ctx);
 static int dh_init(DH *dh);
 static int dh_finish(DH *dh);
-int DH_generate_key(DH *dh)
+int
-        {
+DH_generate_key(DH *dh)
+{
        return dh->meth->generate_key(dh);
-        }
+}
-int DH_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
+int
-        {
+DH_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
+{
        return dh->meth->compute_key(key, pub_key, dh);
-        }
+}
 static DH_METHOD dh_ossl = {
        .name = "OpenSSL DH Method",
@@ -90,184 +90,176 @@ static DH_METHOD dh_ossl = {
        .finish = dh_finish,
 };
-const DH_METHOD *DH_OpenSSL(void)
+const DH_METHOD *
+DH_OpenSSL(void)
 {
        return &dh_ossl;
 }
-static int generate_key(DH *dh)
+static int
-        {
+generate_key(DH *dh)
-        int ok=0;
+{
-        int generate_new_key=0;
+        int ok = 0;
+        int generate_new_key = 0;
        unsigned l;
        BN_CTX *ctx;
-        BN_MONT_CTX *mont=NULL;
+        BN_MONT_CTX *mont = NULL;
-        BIGNUM *pub_key=NULL,*priv_key=NULL;
+        BIGNUM *pub_key = NULL, *priv_key = NULL;
        ctx = BN_CTX_new();
-        if (ctx == NULL) goto err;
+        if (ctx == NULL)
+                goto err;
-        if (dh->priv_key == NULL)
-                {
-                priv_key=BN_new();
-                if (priv_key == NULL) goto err;
-                generate_new_key=1;
-                }
-        else
-                priv_key=dh->priv_key;
-        if (dh->pub_key == NULL)
+        if (dh->priv_key == NULL) {
-                {
+                priv_key = BN_new();
-                pub_key=BN_new();
+                if (priv_key == NULL)
-                if (pub_key == NULL) goto err;
+                        goto err;
-                }
+                generate_new_key = 1;
-        else
+        } else
-                pub_key=dh->pub_key;
+                priv_key = dh->priv_key;
+        if (dh->pub_key == NULL) {
+                pub_key = BN_new();
+                if (pub_key == NULL)
+                        goto err;
+        } else
+                pub_key = dh->pub_key;
-        if (dh->flags & DH_FLAG_CACHE_MONT_P)
+        if (dh->flags & DH_FLAG_CACHE_MONT_P) {
-                {
                mont = BN_MONT_CTX_set_locked(&dh->method_mont_p,
-                                CRYPTO_LOCK_DH, dh->p, ctx);
+                    CRYPTO_LOCK_DH, dh->p, ctx);
                if (!mont)
                        goto err;
-                }
+        }
-        if (generate_new_key)
+        if (generate_new_key) {
-                {
+                if (dh->q) {
-                if (dh->q)
+                        do {
-                        {
-                        do
-                                {
                                if (!BN_rand_range(priv_key, dh->q))
                                        goto err;
-                                }
+                        } while (BN_is_zero(priv_key) || BN_is_one(priv_key));
-                        while (BN_is_zero(priv_key) || BN_is_one(priv_key));
+                } else {
-                        }
-                else
-                        {
                        /* secret exponent length */
-                        l = dh->length ? dh->length : BN_num_bits(dh->p)-1;
+                        l = dh->length ? dh->length : BN_num_bits(dh->p) - 1;
-                        if (!BN_rand(priv_key, l, 0, 0)) goto err;
+                        if (!BN_rand(priv_key, l, 0, 0))
-                        }
+                                goto err;
                }
+        }
        {
                BIGNUM local_prk;
                BIGNUM *prk;
-                if ((dh->flags & DH_FLAG_NO_EXP_CONSTTIME) == 0)
+                if ((dh->flags & DH_FLAG_NO_EXP_CONSTTIME) == 0) {
-                        {
                        BN_init(&local_prk);
                        prk = &local_prk;
                        BN_with_flags(prk, priv_key, BN_FLG_CONSTTIME);
-                        }
+                } else
-                else
                        prk = priv_key;
-                if (!dh->meth->bn_mod_exp(dh, pub_key, dh->g, prk, dh->p, ctx, mont)) goto err;
+                if (!dh->meth->bn_mod_exp(dh, pub_key, dh->g, prk, dh->p, ctx,
+                    mont))
+                        goto err;
        }
                
-        dh->pub_key=pub_key;
+        dh->pub_key = pub_key;
-        dh->priv_key=priv_key;
+        dh->priv_key = priv_key;
-        ok=1;
+        ok = 1;
 err:
        if (ok != 1)
-                DHerr(DH_F_GENERATE_KEY,ERR_R_BN_LIB);
+                DHerr(DH_F_GENERATE_KEY, ERR_R_BN_LIB);
-        if ((pub_key != NULL)  && (dh->pub_key == NULL))  BN_free(pub_key);
+        if (pub_key != NULL && dh->pub_key == NULL)
-        if ((priv_key != NULL) && (dh->priv_key == NULL)) BN_free(priv_key);
+                BN_free(pub_key);
+        if (priv_key != NULL && dh->priv_key == NULL)
+                BN_free(priv_key);
        BN_CTX_free(ctx);
-        return(ok);
+        return ok;
-        }
+}
-static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
+static int
-        {
+compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
-        BN_CTX *ctx=NULL;
+{
-        BN_MONT_CTX *mont=NULL;
+        BN_CTX *ctx = NULL;
+        BN_MONT_CTX *mont = NULL;
        BIGNUM *tmp;
-        int ret= -1;
+        int ret = -1;
        int check_result;
-        if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS)
+        if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS) {
-                {
+                DHerr(DH_F_COMPUTE_KEY, DH_R_MODULUS_TOO_LARGE);
-                DHerr(DH_F_COMPUTE_KEY,DH_R_MODULUS_TOO_LARGE);
                goto err;
-                }
+        }
        ctx = BN_CTX_new();
-        if (ctx == NULL) goto err;
+        if (ctx == NULL)
+                goto err;
        BN_CTX_start(ctx);
        tmp = BN_CTX_get(ctx);
        
-        if (dh->priv_key == NULL)
+        if (dh->priv_key == NULL) {
-                {
+                DHerr(DH_F_COMPUTE_KEY, DH_R_NO_PRIVATE_VALUE);
-                DHerr(DH_F_COMPUTE_KEY,DH_R_NO_PRIVATE_VALUE);
                goto err;
-                }
+        }
-        if (dh->flags & DH_FLAG_CACHE_MONT_P)
+        if (dh->flags & DH_FLAG_CACHE_MONT_P) {
-                {
                mont = BN_MONT_CTX_set_locked(&dh->method_mont_p,
-                                CRYPTO_LOCK_DH, dh->p, ctx);
+                    CRYPTO_LOCK_DH, dh->p, ctx);
-                if ((dh->flags & DH_FLAG_NO_EXP_CONSTTIME) == 0)
+                if ((dh->flags & DH_FLAG_NO_EXP_CONSTTIME) == 0) {
-                        {
                        /* XXX */
                        BN_set_flags(dh->priv_key, BN_FLG_CONSTTIME);
-                        }
+                }
                if (!mont)
                        goto err;
-                }
+        }
-        if (!DH_check_pub_key(dh, pub_key, &check_result) || check_result)
+        if (!DH_check_pub_key(dh, pub_key, &check_result) || check_result) {
-                {
+                DHerr(DH_F_COMPUTE_KEY, DH_R_INVALID_PUBKEY);
-                DHerr(DH_F_COMPUTE_KEY,DH_R_INVALID_PUBKEY);
                goto err;
-                }
+        }
-        if (!dh->meth->bn_mod_exp(dh, tmp, pub_key, dh->priv_key,dh->p,ctx,mont))
+        if (!dh->meth->bn_mod_exp(dh, tmp, pub_key, dh->priv_key, dh->p, ctx,
-                {
+            mont)) {
-                DHerr(DH_F_COMPUTE_KEY,ERR_R_BN_LIB);
+                DHerr(DH_F_COMPUTE_KEY, ERR_R_BN_LIB);
                goto err;
-                }
+        }
-        ret=BN_bn2bin(tmp,key);
+        ret = BN_bn2bin(tmp, key);
 err:
-        if (ctx != NULL)
+        if (ctx != NULL) {
-                {
                BN_CTX_end(ctx);
                BN_CTX_free(ctx);
-                }
-        return(ret);
        }
+        return ret;
+}
-static int dh_bn_mod_exp(const DH *dh, BIGNUM *r,
+static int
-                        const BIGNUM *a, const BIGNUM *p,
+dh_bn_mod_exp(const DH *dh, BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-                        const BIGNUM *m, BN_CTX *ctx,
+    const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
-                        BN_MONT_CTX *m_ctx)
+{
-        {
+        /*
-        /* If a is only one word long and constant time is false, use the faster
+         * If a is only one word long and constant time is false, use the faster
         * exponenentiation function.
         */
-        if (a->top == 1 && ((dh->flags & DH_FLAG_NO_EXP_CONSTTIME) != 0))
+        if (a->top == 1 && (dh->flags & DH_FLAG_NO_EXP_CONSTTIME) != 0) {
-                {
                BN_ULONG A = a->d[0];
-                return BN_mod_exp_mont_word(r,A,p,m,ctx,m_ctx);
-                }
-        else
-                return BN_mod_exp_mont(r,a,p,m,ctx,m_ctx);
-        }
+                return BN_mod_exp_mont_word(r, A, p, m, ctx, m_ctx);
+        } else
+                return BN_mod_exp_mont(r, a, p, m, ctx, m_ctx);
+}
-static int dh_init(DH *dh)
+static int
-        {
+dh_init(DH *dh)
+{
        dh->flags |= DH_FLAG_CACHE_MONT_P;
-        return(1);
+        return 1;
-        }
+}
-static int dh_finish(DH *dh)
+static int
-        {
+dh_finish(DH *dh)
-        if(dh->method_mont_p)
+{
+        if (dh->method_mont_p)
                BN_MONT_CTX_free(dh->method_mont_p);
-        return(1);
+        return 1;
-        }
+}
diff --git a/src/lib/libcrypto/dh/dh_lib.c b/src/lib/libcrypto/dh/dh_lib.c
index 793a8afdce..094a78041d 100644
--- a/src/lib/libcrypto/dh/dh_lib.c
+++ b/src/lib/libcrypto/dh/dh_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh_lib.c,v 1.16 2014/07/09 11:10:50 bcook Exp $ */
+/* $OpenBSD: dh_lib.c,v 1.17 2014/07/09 13:26:47 miod Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
 * All rights reserved.
 *
@@ -66,117 +66,121 @@
 static const DH_METHOD *default_DH_method = NULL;
-void DH_set_default_method(const DH_METHOD *meth)
+void
-        {
+DH_set_default_method(const DH_METHOD *meth)
+{
        default_DH_method = meth;
-        }
+}
-const DH_METHOD *DH_get_default_method(void)
+const DH_METHOD *
-        {
+DH_get_default_method(void)
-        if(!default_DH_method)
+{
-                {
+        if (!default_DH_method)
                default_DH_method = DH_OpenSSL();
-                }
        return default_DH_method;
-        }
+}
-int DH_set_method(DH *dh, const DH_METHOD *meth)
+int
-        {
+DH_set_method(DH *dh, const DH_METHOD *meth)
-        /* NB: The caller is specifically setting a method, so it's not up to us
+{
-         * to deal with which ENGINE it comes from. */
+        /*
+         * NB: The caller is specifically setting a method, so it's not up to us
+         * to deal with which ENGINE it comes from.
+         */
        const DH_METHOD *mtmp;
        mtmp = dh->meth;
-        if (mtmp->finish) mtmp->finish(dh);
+        if (mtmp->finish)
+                mtmp->finish(dh);
 #ifndef OPENSSL_NO_ENGINE
-        if (dh->engine)
+        if (dh->engine) {
-                {
                ENGINE_finish(dh->engine);
                dh->engine = NULL;
-                }
+        }
 #endif
        dh->meth = meth;
-        if (meth->init) meth->init(dh);
+        if (meth->init)
+                meth->init(dh);
        return 1;
-        }
+}
-DH *DH_new(void)
+DH *
-        {
+DH_new(void)
+{
        return DH_new_method(NULL);
-        }
+}
-DH *DH_new_method(ENGINE *engine)
+DH *
-        {
+DH_new_method(ENGINE *engine)
+{
        DH *ret;
        ret = malloc(sizeof(DH));
-        if (ret == NULL)
+        if (ret == NULL) {
-                {
+                DHerr(DH_F_DH_NEW_METHOD, ERR_R_MALLOC_FAILURE);
-                DHerr(DH_F_DH_NEW_METHOD,ERR_R_MALLOC_FAILURE);
+                return NULL;
-                return(NULL);
+        }
-                }
        ret->meth = DH_get_default_method();
 #ifndef OPENSSL_NO_ENGINE
-        if (engine)
+        if (engine) {
-                {
+                if (!ENGINE_init(engine)) {
-                if (!ENGINE_init(engine))
-                        {
                        DHerr(DH_F_DH_NEW_METHOD, ERR_R_ENGINE_LIB);
                        free(ret);
                        return NULL;
-                        }
-                ret->engine = engine;
                }
-        else
+                ret->engine = engine;
+        } else
                ret->engine = ENGINE_get_default_DH();
-        if(ret->engine)
+        if(ret->engine) {
-                {
                ret->meth = ENGINE_get_DH(ret->engine);
-                if(!ret->meth)
+                if (!ret->meth) {
-                        {
+                        DHerr(DH_F_DH_NEW_METHOD, ERR_R_ENGINE_LIB);
-                        DHerr(DH_F_DH_NEW_METHOD,ERR_R_ENGINE_LIB);
                        ENGINE_finish(ret->engine);
                        free(ret);
                        return NULL;
-                        }
                }
+        }
 #endif
-        ret->pad=0;
+        ret->pad = 0;
-        ret->version=0;
+        ret->version = 0;
-        ret->p=NULL;
+        ret->p = NULL;
-        ret->g=NULL;
+        ret->g = NULL;
-        ret->length=0;
+        ret->length = 0;
-        ret->pub_key=NULL;
+        ret->pub_key = NULL;
-        ret->priv_key=NULL;
+        ret->priv_key = NULL;
-        ret->q=NULL;
+        ret->q = NULL;
-        ret->j=NULL;
+        ret->j = NULL;
        ret->seed = NULL;
        ret->seedlen = 0;
        ret->counter = NULL;
        ret->method_mont_p=NULL;
        ret->references = 1;
-        ret->flags=ret->meth->flags & ~DH_FLAG_NON_FIPS_ALLOW;
+        ret->flags = ret->meth->flags & ~DH_FLAG_NON_FIPS_ALLOW;
        CRYPTO_new_ex_data(CRYPTO_EX_INDEX_DH, ret, &ret->ex_data);
-        if ((ret->meth->init != NULL) && !ret->meth->init(ret))
+        if (ret->meth->init != NULL && !ret->meth->init(ret)) {
-                {
 #ifndef OPENSSL_NO_ENGINE
                if (ret->engine)
                        ENGINE_finish(ret->engine);
 #endif
                CRYPTO_free_ex_data(CRYPTO_EX_INDEX_DH, ret, &ret->ex_data);
                free(ret);
-                ret=NULL;
+                ret = NULL;
-                }
-        return(ret);
        }
+        return ret;
+}
-void DH_free(DH *r)
+void
-        {
+DH_free(DH *r)
+{
        int i;
-        if(r == NULL) return;
+        if (r == NULL)
+                return;
        i = CRYPTO_add(&r->references, -1, CRYPTO_LOCK_DH);
-        if (i > 0) return;
+        if (i > 0)
+                return;
        if (r->meth->finish)
                r->meth->finish(r);
@@ -187,41 +191,54 @@ void DH_free(DH *r)
        CRYPTO_free_ex_data(CRYPTO_EX_INDEX_DH, r, &r->ex_data);
-        if (r->p != NULL) BN_clear_free(r->p);
+        if (r->p != NULL)
-        if (r->g != NULL) BN_clear_free(r->g);
+                BN_clear_free(r->p);
-        if (r->q != NULL) BN_clear_free(r->q);
+        if (r->g != NULL)
-        if (r->j != NULL) BN_clear_free(r->j);
+                BN_clear_free(r->g);
+        if (r->q != NULL)
+                BN_clear_free(r->q);
+        if (r->j != NULL)
+                BN_clear_free(r->j);
        free(r->seed);
-        if (r->counter != NULL) BN_clear_free(r->counter);
+        if (r->counter != NULL)
-        if (r->pub_key != NULL) BN_clear_free(r->pub_key);
+                BN_clear_free(r->counter);
-        if (r->priv_key != NULL) BN_clear_free(r->priv_key);
+        if (r->pub_key != NULL)
+                BN_clear_free(r->pub_key);
+        if (r->priv_key != NULL)
+                BN_clear_free(r->priv_key);
        free(r);
-        }
+}
-int DH_up_ref(DH *r)
+int
-        {
+DH_up_ref(DH *r)
+{
        int i = CRYPTO_add(&r->references, 1, CRYPTO_LOCK_DH);
-        return ((i > 1) ? 1 : 0);
-        }
-int DH_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+        return i > 1 ? 1 : 0;
-             CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
+}
-        {
-        return CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_DH, argl, argp,
+int
-                                new_func, dup_func, free_func);
+DH_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
-        }
+    CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
+{
-int DH_set_ex_data(DH *d, int idx, void *arg)
+        return CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_DH, argl, argp, new_func,
-        {
+            dup_func, free_func);
-        return(CRYPTO_set_ex_data(&d->ex_data,idx,arg));
+}
-        }
+int
-void *DH_get_ex_data(DH *d, int idx)
+DH_set_ex_data(DH *d, int idx, void *arg)
-        {
+{
-        return(CRYPTO_get_ex_data(&d->ex_data,idx));
+        return CRYPTO_set_ex_data(&d->ex_data, idx, arg);
-        }
+}
-int DH_size(const DH *dh)
+void *
-        {
+DH_get_ex_data(DH *d, int idx)
-        return(BN_num_bytes(dh->p));
+{
-        }
+        return CRYPTO_get_ex_data(&d->ex_data, idx);
+}
+int
+DH_size(const DH *dh)
+{
+        return BN_num_bytes(dh->p);
+}
diff --git a/src/lib/libcrypto/dh/dh_pmeth.c b/src/lib/libcrypto/dh/dh_pmeth.c
index cb424ac149..fb441b563b 100644
--- a/src/lib/libcrypto/dh/dh_pmeth.c
+++ b/src/lib/libcrypto/dh/dh_pmeth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh_pmeth.c,v 1.6 2014/06/12 20:40:57 deraadt Exp $ */
+/* $OpenBSD: dh_pmeth.c,v 1.7 2014/07/09 13:26:47 miod Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
 * project 2006.
 */
@@ -68,8 +68,7 @@
 /* DH pkey context structure */
-typedef struct
+typedef struct {
-        {
        /* Parameter gen parameters */
        int prime_len;
        int generator;
@@ -77,11 +76,13 @@ typedef struct
        /* Keygen callback info */
        int gentmp[2];
        /* message digest */
-        } DH_PKEY_CTX;
+} DH_PKEY_CTX;
-static int pkey_dh_init(EVP_PKEY_CTX *ctx)
+static int
-        {
+pkey_dh_init(EVP_PKEY_CTX *ctx)
+{
        DH_PKEY_CTX *dctx;
        dctx = malloc(sizeof(DH_PKEY_CTX));
        if (!dctx)
                return 0;
@@ -94,11 +95,13 @@ static int pkey_dh_init(EVP_PKEY_CTX *ctx)
        ctx->keygen_info_count = 2;
        
        return 1;
-        }
+}
-static int pkey_dh_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src)
+static int
-        {
+pkey_dh_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src)
+{
        DH_PKEY_CTX *dctx, *sctx;
        if (!pkey_dh_init(dst))
                return 0;
        sctx = src->data;
@@ -107,43 +110,44 @@ static int pkey_dh_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src)
        dctx->generator = sctx->generator;
        dctx->use_dsa = sctx->use_dsa;
        return 1;
-        }
+}
-static void pkey_dh_cleanup(EVP_PKEY_CTX *ctx)
+static void
-        {
+pkey_dh_cleanup(EVP_PKEY_CTX *ctx)
+{
        DH_PKEY_CTX *dctx = ctx->data;
        free(dctx);
-        }
+}
-static int pkey_dh_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
+static int
-        {
+pkey_dh_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
+{
        DH_PKEY_CTX *dctx = ctx->data;
-        switch (type)
-                {
+        switch (type) {
-                case EVP_PKEY_CTRL_DH_PARAMGEN_PRIME_LEN:
+        case EVP_PKEY_CTRL_DH_PARAMGEN_PRIME_LEN:
                if (p1 < 256)
                        return -2;
                dctx->prime_len = p1;
                return 1;
-                case EVP_PKEY_CTRL_DH_PARAMGEN_GENERATOR:
+        case EVP_PKEY_CTRL_DH_PARAMGEN_GENERATOR:
                dctx->generator = p1;
                return 1;
-                case EVP_PKEY_CTRL_PEER_KEY:
+        case EVP_PKEY_CTRL_PEER_KEY:
                /* Default behaviour is OK */
                return 1;
-                default:
+        default:
                return -2;
-                }
        }
+}
                        
-static int pkey_dh_ctrl_str(EVP_PKEY_CTX *ctx,
+static int
-                        const char *type, const char *value)
+pkey_dh_ctrl_str(EVP_PKEY_CTX *ctx, const char *type, const char *value)
-        {
+{
        long lval;
        char *ep;
        int len;
@@ -153,18 +157,19 @@ static int pkey_dh_ctrl_str(EVP_PKEY_CTX *ctx,
                lval = strtol(value, &ep, 10);
                if (value[0] == '\0' || *ep != '\0')
                        goto not_a_number;
-                if ((errno == ERANGE && (lval == LONG_MAX || lval == LONG_MIN)) ||
+                if ((errno == ERANGE &&
+                    (lval == LONG_MAX || lval == LONG_MIN)) ||
                    (lval > INT_MAX || lval < INT_MIN))
                        goto out_of_range;
                len = lval;
                return EVP_PKEY_CTX_set_dh_paramgen_prime_len(ctx, len);
-        }
+        } else if (!strcmp(type, "dh_paramgen_generator")) {
-        if (!strcmp(type, "dh_paramgen_generator")) {
                errno = 0;
                lval = strtol(value, &ep, 10);
                if (value[0] == '\0' || *ep != '\0')
                        goto not_a_number;
-                if ((errno == ERANGE && (lval == LONG_MAX || lval == LONG_MIN)) ||
+                if ((errno == ERANGE &&
+                    (lval == LONG_MAX || lval == LONG_MIN)) ||
                    (lval > INT_MAX || lval < INT_MIN))
                        goto out_of_range;
                len = lval;
@@ -176,39 +181,40 @@ out_of_range:
        return -2;
 }
-static int pkey_dh_paramgen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
+static int
-        {
+pkey_dh_paramgen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
+{
        DH *dh = NULL;
        DH_PKEY_CTX *dctx = ctx->data;
        BN_GENCB *pcb, cb;
        int ret;
-        if (ctx->pkey_gencb)
-                {
+        if (ctx->pkey_gencb) {
                pcb = &cb;
                evp_pkey_set_cb_translate(pcb, ctx);
-                }
+        } else
-        else
                pcb = NULL;
        dh = DH_new();
        if (!dh)
                return 0;
-        ret = DH_generate_parameters_ex(dh,
+        ret = DH_generate_parameters_ex(dh, dctx->prime_len, dctx->generator,
-                                        dctx->prime_len, dctx->generator, pcb);
+            pcb);
        if (ret)
                EVP_PKEY_assign_DH(pkey, dh);
        else
                DH_free(dh);
        return ret;
-        }
+}
-static int pkey_dh_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
+static int
-        {
+pkey_dh_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
+{
        DH *dh = NULL;
-        if (ctx->pkey == NULL)
-                {
+        if (ctx->pkey == NULL) {
                DHerr(DH_F_PKEY_DH_KEYGEN, DH_R_NO_PARAMETERS_SET);
                return 0;
-                }
+        }
        dh = DH_new();
        if (!dh)
                return 0;
@@ -217,23 +223,24 @@ static int pkey_dh_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
        if (!EVP_PKEY_copy_parameters(pkey, ctx->pkey))
                return 0;
        return DH_generate_key(pkey->pkey.dh);
-        }
+}
-static int pkey_dh_derive(EVP_PKEY_CTX *ctx, unsigned char *key, size_t *keylen)
+static int
-        {
+pkey_dh_derive(EVP_PKEY_CTX *ctx, unsigned char *key, size_t *keylen)
+{
        int ret;
-        if (!ctx->pkey || !ctx->peerkey)
-                {
+        if (!ctx->pkey || !ctx->peerkey) {
                DHerr(DH_F_PKEY_DH_DERIVE, DH_R_KEYS_NOT_SET);
                return 0;
-                }
+        }
        ret = DH_compute_key(key, ctx->peerkey->pkey.dh->pub_key,
-                                                        ctx->pkey->pkey.dh);
+            ctx->pkey->pkey.dh);
        if (ret < 0)
                return ret;
        *keylen = ret;
        return 1;
-        }
+}
 const EVP_PKEY_METHOD dh_pkey_meth = {
        .pkey_id = EVP_PKEY_DH,
diff --git a/src/lib/libcrypto/dh/dh_prn.c b/src/lib/libcrypto/dh/dh_prn.c
index a249b650f8..846419691e 100644
--- a/src/lib/libcrypto/dh/dh_prn.c
+++ b/src/lib/libcrypto/dh/dh_prn.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh_prn.c,v 1.3 2014/06/12 15:49:28 deraadt Exp $ */
+/* $OpenBSD: dh_prn.c,v 1.4 2014/07/09 13:26:47 miod Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
 * All rights reserved.
 *
@@ -61,18 +61,18 @@
 #include <openssl/evp.h>
 #include <openssl/dh.h>
-int DHparams_print_fp(FILE *fp, const DH *x)
+int
-        {
+DHparams_print_fp(FILE *fp, const DH *x)
+{
        BIO *b;
        int ret;
-        if ((b=BIO_new(BIO_s_file())) == NULL)
+        if ((b = BIO_new(BIO_s_file())) == NULL) {
-                {
+                DHerr(DH_F_DHPARAMS_PRINT_FP, ERR_R_BUF_LIB);
-                DHerr(DH_F_DHPARAMS_PRINT_FP,ERR_R_BUF_LIB);
+                return 0;
-                return(0);
+        }
-                }
        BIO_set_fp(b,fp,BIO_NOCLOSE);
-        ret=DHparams_print(b, x);
+        ret = DHparams_print(b, x);
        BIO_free(b);
-        return(ret);
+        return ret;
-        }
+}
diff --git a/src/lib/libssl/src/crypto/dh/dh_ameth.c b/src/lib/libssl/src/crypto/dh/dh_ameth.c
index 88ef78d98d..9e911c8779 100644
--- a/src/lib/libssl/src/crypto/dh/dh_ameth.c
+++ b/src/lib/libssl/src/crypto/dh/dh_ameth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh_ameth.c,v 1.8 2014/06/30 14:15:34 tedu Exp $ */
+/* $OpenBSD: dh_ameth.c,v 1.9 2014/07/09 13:26:47 miod Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
 * project 2006.
 */
@@ -64,13 +64,15 @@
 #include <openssl/bn.h>
 #include "asn1_locl.h"
-static void int_dh_free(EVP_PKEY *pkey)
+static void
-        {
+int_dh_free(EVP_PKEY *pkey)
+{
        DH_free(pkey->pkey.dh);
-        }
+}
-static int dh_pub_decode(EVP_PKEY *pkey, X509_PUBKEY *pubkey)
+static int
-        {
+dh_pub_decode(EVP_PKEY *pkey, X509_PUBKEY *pubkey)
+{
        const unsigned char *p, *pm;
        int pklen, pmlen;
        int ptype;
@@ -78,57 +80,52 @@ static int dh_pub_decode(EVP_PKEY *pkey, X509_PUBKEY *pubkey)
        ASN1_STRING *pstr;
        X509_ALGOR *palg;
        ASN1_INTEGER *public_key = NULL;
        DH *dh = NULL;
        if (!X509_PUBKEY_get0_param(NULL, &p, &pklen, &palg, pubkey))
                return 0;
        X509_ALGOR_get0(NULL, &ptype, &pval, palg);
-        if (ptype != V_ASN1_SEQUENCE)
+        if (ptype != V_ASN1_SEQUENCE) {
-                {
                DHerr(DH_F_DH_PUB_DECODE, DH_R_PARAMETER_ENCODING_ERROR);
                goto err;
-                }
+        }
        pstr = pval;    
        pm = pstr->data;
        pmlen = pstr->length;
-        if (!(dh = d2i_DHparams(NULL, &pm, pmlen)))
+        if (!(dh = d2i_DHparams(NULL, &pm, pmlen))) {
-                {
                DHerr(DH_F_DH_PUB_DECODE, DH_R_DECODE_ERROR);
                goto err;
-                }
+        }
-        if (!(public_key=d2i_ASN1_INTEGER(NULL, &p, pklen)))
+        if (!(public_key=d2i_ASN1_INTEGER(NULL, &p, pklen))) {
-                {
                DHerr(DH_F_DH_PUB_DECODE, DH_R_DECODE_ERROR);
                goto err;
-                }
+        }
        /* We have parameters now set public key */
-        if (!(dh->pub_key = ASN1_INTEGER_to_BN(public_key, NULL)))
+        if (!(dh->pub_key = ASN1_INTEGER_to_BN(public_key, NULL))) {
-                {
                DHerr(DH_F_DH_PUB_DECODE, DH_R_BN_DECODE_ERROR);
                goto err;
-                }
+        }
        ASN1_INTEGER_free(public_key);
        EVP_PKEY_assign_DH(pkey, dh);
        return 1;
-        err:
+err:
        if (public_key)
                ASN1_INTEGER_free(public_key);
        if (dh)
                DH_free(dh);
        return 0;
+}
-        }
+static int
+dh_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey)
-static int dh_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey)
+{
-        {
        DH *dh;
        int ptype;
        unsigned char *penc = NULL;
@@ -145,11 +142,10 @@ static int dh_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey)
        }
        str->length = i2d_DHparams(dh, &str->data);
-        if (str->length <= 0)
+        if (str->length <= 0) {
-                {
                DHerr(DH_F_DH_PUB_ENCODE, ERR_R_MALLOC_FAILURE);
                goto err;
-                }
+        }
        ptype = V_ASN1_SEQUENCE;
        pub_key = BN_to_ASN1_INTEGER(dh->pub_key, NULL);
@@ -160,32 +156,32 @@ static int dh_pub_encode(X509_PUBKEY *pk, const EVP_PKEY *pkey)
        ASN1_INTEGER_free(pub_key);
-        if (penclen <= 0)
+        if (penclen <= 0) {
-                {
                DHerr(DH_F_DH_PUB_ENCODE, ERR_R_MALLOC_FAILURE);
                goto err;
                }
-        if (X509_PUBKEY_set0_param(pk, OBJ_nid2obj(EVP_PKEY_DH),
+        if (X509_PUBKEY_set0_param(pk, OBJ_nid2obj(EVP_PKEY_DH), ptype,
-                                ptype, (void *)str, penc, penclen))
+            (void *)str, penc, penclen))
                return 1;
-        err:
+err:
        free(penc);
        if (str)
                ASN1_STRING_free(str);
        return 0;
-        }
+}
-/* PKCS#8 DH is defined in PKCS#11 of all places. It is similar to DH in
+/*
+ * PKCS#8 DH is defined in PKCS#11 of all places. It is similar to DH in
 * that the AlgorithmIdentifier contains the paramaters, the private key
 * is explcitly included and the pubkey must be recalculated.
 */
        
-static int dh_priv_decode(EVP_PKEY *pkey, PKCS8_PRIV_KEY_INFO *p8)
+static int
-        {
+dh_priv_decode(EVP_PKEY *pkey, PKCS8_PRIV_KEY_INFO *p8)
+{
        const unsigned char *p, *pm;
        int pklen, pmlen;
        int ptype;
@@ -193,7 +189,6 @@ static int dh_priv_decode(EVP_PKEY *pkey, PKCS8_PRIV_KEY_INFO *p8)
        ASN1_STRING *pstr;
        X509_ALGOR *palg;
        ASN1_INTEGER *privkey = NULL;
        DH *dh = NULL;
        if (!PKCS8_pkey_get0(NULL, &p, &pklen, &palg, p8))
@@ -202,23 +197,21 @@ static int dh_priv_decode(EVP_PKEY *pkey, PKCS8_PRIV_KEY_INFO *p8)
        X509_ALGOR_get0(NULL, &ptype, &pval, palg);
        if (ptype != V_ASN1_SEQUENCE)
-                        goto decerr;
+                goto decerr;
        if (!(privkey=d2i_ASN1_INTEGER(NULL, &p, pklen)))
                goto decerr;
        pstr = pval;    
        pm = pstr->data;
        pmlen = pstr->length;
        if (!(dh = d2i_DHparams(NULL, &pm, pmlen)))
                goto decerr;
        /* We have parameters now set private key */
-        if (!(dh->priv_key = ASN1_INTEGER_to_BN(privkey, NULL)))
+        if (!(dh->priv_key = ASN1_INTEGER_to_BN(privkey, NULL))) {
-                {
+                DHerr(DH_F_DH_PRIV_DECODE, DH_R_BN_ERROR);
-                DHerr(DH_F_DH_PRIV_DECODE,DH_R_BN_ERROR);
                goto dherr;
-                }
+        }
        /* Calculate public key */
        if (!DH_generate_key(dh))
                goto dherr;
@@ -229,14 +222,15 @@ static int dh_priv_decode(EVP_PKEY *pkey, PKCS8_PRIV_KEY_INFO *p8)
        return 1;
-        decerr:
+decerr:
        DHerr(DH_F_DH_PRIV_DECODE, EVP_R_DECODE_ERROR);
-        dherr:
+dherr:
        DH_free(dh);
        return 0;
-        }
+}
-static int dh_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
+static int
+dh_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
 {
        ASN1_STRING *params = NULL;
        ASN1_INTEGER *prkey = NULL;
@@ -245,35 +239,32 @@ static int dh_priv_encode(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pkey)
        params = ASN1_STRING_new();
-        if (!params)
+        if (!params) {
-                {
+                DHerr(DH_F_DH_PRIV_ENCODE, ERR_R_MALLOC_FAILURE);
-                DHerr(DH_F_DH_PRIV_ENCODE,ERR_R_MALLOC_FAILURE);
                goto err;
-                }
+        }
        params->length = i2d_DHparams(pkey->pkey.dh, &params->data);
-        if (params->length <= 0)
+        if (params->length <= 0) {
-                {
                DHerr(DH_F_DH_PRIV_ENCODE,ERR_R_MALLOC_FAILURE);
                goto err;
-                }
+        }
        params->type = V_ASN1_SEQUENCE;
        /* Get private key into integer */
        prkey = BN_to_ASN1_INTEGER(pkey->pkey.dh->priv_key, NULL);
-        if (!prkey)
+        if (!prkey) {
-                {
+                DHerr(DH_F_DH_PRIV_ENCODE, DH_R_BN_ERROR);
-                DHerr(DH_F_DH_PRIV_ENCODE,DH_R_BN_ERROR);
                goto err;
-                }
+        }
        dplen = i2d_ASN1_INTEGER(prkey, &dp);
        ASN1_INTEGER_free(prkey);
        if (!PKCS8_pkey_set0(p8, OBJ_nid2obj(NID_dhKeyAgreement), 0,
-                                V_ASN1_SEQUENCE, params, dp, dplen))
+            V_ASN1_SEQUENCE, params, dp, dplen))
                goto err;
        return 1;
@@ -287,43 +278,43 @@ err:
        return 0;
 }
+static void
-static void update_buflen(const BIGNUM *b, size_t *pbuflen)
+update_buflen(const BIGNUM *b, size_t *pbuflen)
-        {
+{
        size_t i;
        if (!b)
                return;
        if (*pbuflen < (i = (size_t)BN_num_bytes(b)))
-                        *pbuflen = i;
+                *pbuflen = i;
-        }
+}
-static int dh_param_decode(EVP_PKEY *pkey,
+static int
-                                        const unsigned char **pder, int derlen)
+dh_param_decode(EVP_PKEY *pkey, const unsigned char **pder, int derlen)
-        {
+{
        DH *dh;
-        if (!(dh = d2i_DHparams(NULL, pder, derlen)))
-                {
+        if (!(dh = d2i_DHparams(NULL, pder, derlen))) {
                DHerr(DH_F_DH_PARAM_DECODE, ERR_R_DH_LIB);
                return 0;
-                }
+        }
        EVP_PKEY_assign_DH(pkey, dh);
        return 1;
-        }
+}
-static int dh_param_encode(const EVP_PKEY *pkey, unsigned char **pder)
+static int
-        {
+dh_param_encode(const EVP_PKEY *pkey, unsigned char **pder)
+{
        return i2d_DHparams(pkey->pkey.dh, pder);
-        }
+}
-static int do_dh_print(BIO *bp, const DH *x, int indent,
-                                                ASN1_PCTX *ctx, int ptype)
-        {
-        unsigned char *m=NULL;
-        int reason=ERR_R_BUF_LIB,ret=0;
-        size_t buf_len=0;
+static int
+do_dh_print(BIO *bp, const DH *x, int indent, ASN1_PCTX *ctx, int ptype)
+{
+        unsigned char *m = NULL;
+        int reason = ERR_R_BUF_LIB, ret = 0;
+        size_t buf_len = 0;
        const char *ktype = NULL;
        BIGNUM *priv_key, *pub_key;
        if (ptype == 2)
@@ -338,11 +329,10 @@ static int do_dh_print(BIO *bp, const DH *x, int indent,
        update_buflen(x->p, &buf_len);
-        if (buf_len == 0)
+        if (buf_len == 0) {
-                {
                reason = ERR_R_PASSED_NULL_PARAMETER;
                goto err;
-                }
+        }
        update_buflen(x->g, &buf_len);
        update_buflen(pub_key, &buf_len);
@@ -355,118 +345,126 @@ static int do_dh_print(BIO *bp, const DH *x, int indent,
        else
                ktype = "PKCS#3 DH Parameters";
-        m= malloc(buf_len+10);
+        m= malloc(buf_len + 10);
-        if (m == NULL)
+        if (m == NULL) {
-                {
+                reason = ERR_R_MALLOC_FAILURE;
-                reason=ERR_R_MALLOC_FAILURE;
                goto err;
-                }
+        }
        BIO_indent(bp, indent, 128);
-        if (BIO_printf(bp,"%s: (%d bit)\n", ktype, BN_num_bits(x->p)) <= 0)
+        if (BIO_printf(bp, "%s: (%d bit)\n", ktype, BN_num_bits(x->p)) <= 0)
                goto err;
        indent += 4;
-        if (!ASN1_bn_print(bp,"private-key:",priv_key,m,indent)) goto err;
+        if (!ASN1_bn_print(bp, "private-key:", priv_key, m, indent))
-        if (!ASN1_bn_print(bp,"public-key:",pub_key,m,indent)) goto err;
+                goto err;
+        if (!ASN1_bn_print(bp, "public-key:", pub_key, m, indent))
+                goto err;
-        if (!ASN1_bn_print(bp,"prime:",x->p,m,indent)) goto err;
+        if (!ASN1_bn_print(bp, "prime:", x->p, m, indent))
-        if (!ASN1_bn_print(bp,"generator:",x->g,m,indent)) goto err;
+                goto err;
-        if (x->length != 0)
+        if (!ASN1_bn_print(bp, "generator:", x->g, m, indent))
-                {
+                goto err;
+        if (x->length != 0) {
                BIO_indent(bp, indent, 128);
-                if (BIO_printf(bp,"recommended-private-length: %d bits\n",
+                if (BIO_printf(bp, "recommended-private-length: %d bits\n",
-                        (int)x->length) <= 0) goto err;
+                    (int)x->length) <= 0)
-                }
+                        goto err;
+        }
-        ret=1;
+        ret = 1;
-        if (0)
+        if (0) {
-                {
 err:
                DHerr(DH_F_DO_DH_PRINT,reason);
-                }
+        }
        free(m);
        return(ret);
-        }
+}
-static int int_dh_size(const EVP_PKEY *pkey)
+static int
-        {
+int_dh_size(const EVP_PKEY *pkey)
-        return(DH_size(pkey->pkey.dh));
+{
-        }
+        return DH_size(pkey->pkey.dh);
+}
-static int dh_bits(const EVP_PKEY *pkey)
+static int
-        {
+dh_bits(const EVP_PKEY *pkey)
+{
        return BN_num_bits(pkey->pkey.dh->p);
-        }
+}
-static int dh_cmp_parameters(const EVP_PKEY *a, const EVP_PKEY *b)
+static int
-        {
+dh_cmp_parameters(const EVP_PKEY *a, const EVP_PKEY *b)
-        if (    BN_cmp(a->pkey.dh->p,b->pkey.dh->p) ||
+{
-                BN_cmp(a->pkey.dh->g,b->pkey.dh->g))
+        if (BN_cmp(a->pkey.dh->p, b->pkey.dh->p) ||
+            BN_cmp(a->pkey.dh->g, b->pkey.dh->g))
                return 0;
        else
                return 1;
-        }
+}
-static int dh_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from)
+static int
-        {
+dh_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from)
+{
        BIGNUM *a;
-        if ((a=BN_dup(from->pkey.dh->p)) == NULL)
+        if ((a = BN_dup(from->pkey.dh->p)) == NULL)
                return 0;
        if (to->pkey.dh->p != NULL)
                BN_free(to->pkey.dh->p);
-        to->pkey.dh->p=a;
+        to->pkey.dh->p = a;
-        if ((a=BN_dup(from->pkey.dh->g)) == NULL)
+        if ((a = BN_dup(from->pkey.dh->g)) == NULL)
                return 0;
        if (to->pkey.dh->g != NULL)
                BN_free(to->pkey.dh->g);
-        to->pkey.dh->g=a;
+        to->pkey.dh->g = a;
        return 1;
-        }
+}
-static int dh_missing_parameters(const EVP_PKEY *a)
+static int
-        {
+dh_missing_parameters(const EVP_PKEY *a)
+{
        if (!a->pkey.dh->p || !a->pkey.dh->g)
                return 1;
        return 0;
-        }
+}
-static int dh_pub_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
+static int
-        {
+dh_pub_cmp(const EVP_PKEY *a, const EVP_PKEY *b)
+{
        if (dh_cmp_parameters(a, b) == 0)
                return 0;
-        if (BN_cmp(b->pkey.dh->pub_key,a->pkey.dh->pub_key) != 0)
+        if (BN_cmp(b->pkey.dh->pub_key, a->pkey.dh->pub_key) != 0)
                return 0;
        else
                return 1;
-        }
+}
-static int dh_param_print(BIO *bp, const EVP_PKEY *pkey, int indent,
+static int
-                                                        ASN1_PCTX *ctx)
+dh_param_print(BIO *bp, const EVP_PKEY *pkey, int indent, ASN1_PCTX *ctx)
-        {
+{
        return do_dh_print(bp, pkey->pkey.dh, indent, ctx, 0);
-        }
+}
-static int dh_public_print(BIO *bp, const EVP_PKEY *pkey, int indent,
+static int
-                                                        ASN1_PCTX *ctx)
+dh_public_print(BIO *bp, const EVP_PKEY *pkey, int indent, ASN1_PCTX *ctx)
-        {
+{
        return do_dh_print(bp, pkey->pkey.dh, indent, ctx, 1);
-        }
+}
-static int dh_private_print(BIO *bp, const EVP_PKEY *pkey, int indent,
+static int
-                                                        ASN1_PCTX *ctx)
+dh_private_print(BIO *bp, const EVP_PKEY *pkey, int indent, ASN1_PCTX *ctx)
-        {
+{
        return do_dh_print(bp, pkey->pkey.dh, indent, ctx, 2);
-        }
+}
-int DHparams_print(BIO *bp, const DH *x)
+int
-        {
+DHparams_print(BIO *bp, const DH *x)
+{
        return do_dh_print(bp, x, 4, NULL, 0);
-        }
+}
 const EVP_PKEY_ASN1_METHOD dh_asn1_meth = {
        .pkey_id = EVP_PKEY_DH,
@@ -496,4 +494,3 @@ const EVP_PKEY_ASN1_METHOD dh_asn1_meth = {
        .pkey_free = int_dh_free,
 };
diff --git a/src/lib/libssl/src/crypto/dh/dh_asn1.c b/src/lib/libssl/src/crypto/dh/dh_asn1.c
index f1afe876ca..ed3a015279 100644
--- a/src/lib/libssl/src/crypto/dh/dh_asn1.c
+++ b/src/lib/libssl/src/crypto/dh/dh_asn1.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh_asn1.c,v 1.4 2014/06/12 15:49:28 deraadt Exp $ */
+/* $OpenBSD: dh_asn1.c,v 1.5 2014/07/09 13:26:47 miod Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
 * project 2000.
 */
@@ -64,14 +64,15 @@
 #include <openssl/asn1t.h>
 /* Override the default free and new methods */
-static int dh_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
+static int
-                                                void *exarg)
+dh_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it, void *exarg)
 {
-        if(operation == ASN1_OP_NEW_PRE) {
+        if (operation == ASN1_OP_NEW_PRE) {
                *pval = (ASN1_VALUE *)DH_new();
-                if(*pval) return 2;
+                if (*pval)
+                        return 2;
                return 0;
-        } else if(operation == ASN1_OP_FREE_PRE) {
+        } else if (operation == ASN1_OP_FREE_PRE) {
                DH_free((DH *)*pval);
                *pval = NULL;
                return 2;
@@ -87,7 +88,8 @@ ASN1_SEQUENCE_cb(DHparams, dh_cb) = {
 IMPLEMENT_ASN1_ENCODE_FUNCTIONS_const_fname(DH, DHparams, DHparams)
-DH *DHparams_dup(DH *dh)
+DH *
-        {
+DHparams_dup(DH *dh)
+{
        return ASN1_item_dup(ASN1_ITEM_rptr(DHparams), dh);
-        }
+}
diff --git a/src/lib/libssl/src/crypto/dh/dh_check.c b/src/lib/libssl/src/crypto/dh/dh_check.c
index 71ea9c1683..1df8f4cdc7 100644
--- a/src/lib/libssl/src/crypto/dh/dh_check.c
+++ b/src/lib/libssl/src/crypto/dh/dh_check.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh_check.c,v 1.10 2014/06/12 15:49:28 deraadt Exp $ */
+/* $OpenBSD: dh_check.c,v 1.11 2014/07/09 13:26:47 miod Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
 * All rights reserved.
 *
@@ -61,7 +61,8 @@
 #include <openssl/bn.h>
 #include <openssl/dh.h>
-/* Check that p is a safe prime and
+/*
+ * Check that p is a safe prime and
 * if g is 2, 3 or 5, check that it is a suitable generator
 * where
 * for 2, p mod 24 == 11
@@ -70,73 +71,77 @@
 * should hold.
 */
-int DH_check(const DH *dh, int *ret)
+int
-        {
+DH_check(const DH *dh, int *ret)
-        int ok=0;
+{
-        BN_CTX *ctx=NULL;
+        int ok = 0;
+        BN_CTX *ctx = NULL;
        BN_ULONG l;
-        BIGNUM *q=NULL;
+        BIGNUM *q = NULL;
-        *ret=0;
+        *ret = 0;
-        ctx=BN_CTX_new();
+        ctx = BN_CTX_new();
-        if (ctx == NULL) goto err;
+        if (ctx == NULL)
-        q=BN_new();
+                goto err;
-        if (q == NULL) goto err;
+        q = BN_new();
+        if (q == NULL)
+                goto err;
-        if (BN_is_word(dh->g,DH_GENERATOR_2))
+        if (BN_is_word(dh->g, DH_GENERATOR_2)) {
-                {
+                l = BN_mod_word(dh->p, 24);
-                l=BN_mod_word(dh->p,24);
+                if (l != 11)
-                if (l != 11) *ret|=DH_NOT_SUITABLE_GENERATOR;
+                        *ret |= DH_NOT_SUITABLE_GENERATOR;
-                }
 #if 0
-        else if (BN_is_word(dh->g,DH_GENERATOR_3))
+        } else if (BN_is_word(dh->g, DH_GENERATOR_3)) {
-                {
+                l = BN_mod_word(dh->p, 12);
-                l=BN_mod_word(dh->p,12);
+                if (l != 5)
-                if (l != 5) *ret|=DH_NOT_SUITABLE_GENERATOR;
+                        *ret |= DH_NOT_SUITABLE_GENERATOR;
-                }
 #endif
-        else if (BN_is_word(dh->g,DH_GENERATOR_5))
+        } else if (BN_is_word(dh->g, DH_GENERATOR_5)) {
-                {
+                l = BN_mod_word(dh->p, 10);
-                l=BN_mod_word(dh->p,10);
+                if (l != 3 && l != 7)
-                if ((l != 3) && (l != 7))
+                        *ret |= DH_NOT_SUITABLE_GENERATOR;
-                        *ret|=DH_NOT_SUITABLE_GENERATOR;
+        } else
-                }
+                *ret |= DH_UNABLE_TO_CHECK_GENERATOR;
-        else
-                *ret|=DH_UNABLE_TO_CHECK_GENERATOR;
-        if (!BN_is_prime_ex(dh->p,BN_prime_checks,ctx,NULL))
+        if (!BN_is_prime_ex(dh->p, BN_prime_checks, ctx, NULL))
-                *ret|=DH_CHECK_P_NOT_PRIME;
+                *ret |= DH_CHECK_P_NOT_PRIME;
-        else
+        else {
-                {
+                if (!BN_rshift1(q, dh->p))
-                if (!BN_rshift1(q,dh->p)) goto err;
+                        goto err;
-                if (!BN_is_prime_ex(q,BN_prime_checks,ctx,NULL))
+                if (!BN_is_prime_ex(q, BN_prime_checks, ctx, NULL))
-                        *ret|=DH_CHECK_P_NOT_SAFE_PRIME;
+                        *ret |= DH_CHECK_P_NOT_SAFE_PRIME;
-                }
-        ok=1;
-err:
-        if (ctx != NULL) BN_CTX_free(ctx);
-        if (q != NULL) BN_free(q);
-        return(ok);
        }
+        ok = 1;
+err:
+        if (ctx != NULL)
+                BN_CTX_free(ctx);
+        if (q != NULL)
+                BN_free(q);
+        return ok;
+}
-int DH_check_pub_key(const DH *dh, const BIGNUM *pub_key, int *ret)
+int
-        {
+DH_check_pub_key(const DH *dh, const BIGNUM *pub_key, int *ret)
-        int ok=0;
+{
-        BIGNUM *q=NULL;
+        int ok = 0;
+        BIGNUM *q = NULL;
-        *ret=0;
+        *ret = 0;
-        q=BN_new();
+        q = BN_new();
-        if (q == NULL) goto err;
+        if (q == NULL)
-        BN_set_word(q,1);
+                goto err;
-        if (BN_cmp(pub_key,q)<=0)
+        BN_set_word(q, 1);
-                *ret|=DH_CHECK_PUBKEY_TOO_SMALL;
+        if (BN_cmp(pub_key, q) <= 0)
-        BN_copy(q,dh->p);
+                *ret |= DH_CHECK_PUBKEY_TOO_SMALL;
-        BN_sub_word(q,1);
+        BN_copy(q, dh->p);
-        if (BN_cmp(pub_key,q)>=0)
+        BN_sub_word(q, 1);
-                *ret|=DH_CHECK_PUBKEY_TOO_LARGE;
+        if (BN_cmp(pub_key, q) >= 0)
+                *ret |= DH_CHECK_PUBKEY_TOO_LARGE;
        ok = 1;
 err:
-        if (q != NULL) BN_free(q);
+        if (q != NULL)
-        return(ok);
+                BN_free(q);
-        }
+        return ok;
+}
diff --git a/src/lib/libssl/src/crypto/dh/dh_depr.c b/src/lib/libssl/src/crypto/dh/dh_depr.c
index 61c0f35636..bc7ba16f2b 100644
--- a/src/lib/libssl/src/crypto/dh/dh_depr.c
+++ b/src/lib/libssl/src/crypto/dh/dh_depr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh_depr.c,v 1.3 2014/06/12 15:49:28 deraadt Exp $ */
+/* $OpenBSD: dh_depr.c,v 1.4 2014/07/09 13:26:47 miod Exp $ */
 /* ====================================================================
 * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
 *
@@ -62,20 +62,21 @@
 #include <openssl/dh.h>
 #ifndef OPENSSL_NO_DEPRECATED
-DH *DH_generate_parameters(int prime_len, int generator,
+DH *
-             void (*callback)(int,int,void *), void *cb_arg)
+DH_generate_parameters(int prime_len, int generator,
-        {
+    void (*callback)(int, int, void *), void *cb_arg)
+{
        BN_GENCB cb;
-        DH *ret=NULL;
+        DH *ret = NULL;
-        if((ret=DH_new()) == NULL)
+        if ((ret = DH_new()) == NULL)
                return NULL;
        BN_GENCB_set_old(&cb, callback, cb_arg);
-        if(DH_generate_parameters_ex(ret, prime_len, generator, &cb))
+        if (DH_generate_parameters_ex(ret, prime_len, generator, &cb))
                return ret;
        DH_free(ret);
        return NULL;
-        }
+}
 #endif
diff --git a/src/lib/libssl/src/crypto/dh/dh_gen.c b/src/lib/libssl/src/crypto/dh/dh_gen.c
index 67bdc5f769..453ea3e8e4 100644
--- a/src/lib/libssl/src/crypto/dh/dh_gen.c
+++ b/src/lib/libssl/src/crypto/dh/dh_gen.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh_gen.c,v 1.11 2014/06/12 15:49:28 deraadt Exp $ */
+/* $OpenBSD: dh_gen.c,v 1.12 2014/07/09 13:26:47 miod Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
 * All rights reserved.
 *
@@ -66,16 +66,19 @@
 #include <openssl/bn.h>
 #include <openssl/dh.h>
-static int dh_builtin_genparams(DH *ret, int prime_len, int generator, BN_GENCB *cb);
+static int dh_builtin_genparams(DH *ret, int prime_len, int generator,
+            BN_GENCB *cb);
-int DH_generate_parameters_ex(DH *ret, int prime_len, int generator, BN_GENCB *cb)
+int
-        {
+DH_generate_parameters_ex(DH *ret, int prime_len, int generator, BN_GENCB *cb)
-        if(ret->meth->generate_params)
+{
+        if (ret->meth->generate_params)
                return ret->meth->generate_params(ret, prime_len, generator, cb);
        return dh_builtin_genparams(ret, prime_len, generator, cb);
-        }
+}
-/* We generate DH parameters as follows
+/*
+ * We generate DH parameters as follows:
 * find a prime q which is prime_len/2 bits long.
 * p=(2*q)+1 or (p-1)/2 = q
 * For this case, g is a generator if
@@ -100,76 +103,84 @@ int DH_generate_parameters_ex(DH *ret, int prime_len, int generator, BN_GENCB *c
 * It's just as OK (and in some sense better) to use a generator of the
 * order-q subgroup.
 */
-static int dh_builtin_genparams(DH *ret, int prime_len, int generator, BN_GENCB *cb)
+static int
-        {
+dh_builtin_genparams(DH *ret, int prime_len, int generator, BN_GENCB *cb)
-        BIGNUM *t1,*t2;
+{
-        int g,ok= -1;
+        BIGNUM *t1, *t2;
-        BN_CTX *ctx=NULL;
+        int g, ok = -1;
+        BN_CTX *ctx = NULL;
-        ctx=BN_CTX_new();
+        ctx = BN_CTX_new();
-        if (ctx == NULL) goto err;
+        if (ctx == NULL)
+                goto err;
        BN_CTX_start(ctx);
        t1 = BN_CTX_get(ctx);
        t2 = BN_CTX_get(ctx);
-        if (t1 == NULL || t2 == NULL) goto err;
+        if (t1 == NULL || t2 == NULL)
+                goto err;
        /* Make sure 'ret' has the necessary elements */
-        if(!ret->p && ((ret->p = BN_new()) == NULL)) goto err;
+        if (!ret->p && ((ret->p = BN_new()) == NULL))
-        if(!ret->g && ((ret->g = BN_new()) == NULL)) goto err;
+                goto err;
+        if (!ret->g && ((ret->g = BN_new()) == NULL))
+                goto err;
        
-        if (generator <= 1)
+        if (generator <= 1) {
-                {
                DHerr(DH_F_DH_BUILTIN_GENPARAMS, DH_R_BAD_GENERATOR);
                goto err;
-                }
+        }
-        if (generator == DH_GENERATOR_2)
+        if (generator == DH_GENERATOR_2) {
-                {
+                if (!BN_set_word(t1, 24))
-                if (!BN_set_word(t1,24)) goto err;
+                        goto err;
-                if (!BN_set_word(t2,11)) goto err;
+                if (!BN_set_word(t2, 11))
-                g=2;
+                        goto err;
-                }
+                g = 2;
 #if 0 /* does not work for safe primes */
-        else if (generator == DH_GENERATOR_3)
+        } else if (generator == DH_GENERATOR_3) {
-                {
+                if (!BN_set_word(t1, 12))
-                if (!BN_set_word(t1,12)) goto err;
+                        goto err;
-                if (!BN_set_word(t2,5)) goto err;
+                if (!BN_set_word(t2, 5))
-                g=3;
+                        goto err;
-                }
+                g = 3;
 #endif
-        else if (generator == DH_GENERATOR_5)
+        } else if (generator == DH_GENERATOR_5) {
-                {
+                if (!BN_set_word(t1, 10))
-                if (!BN_set_word(t1,10)) goto err;
+                        goto err;
-                if (!BN_set_word(t2,3)) goto err;
+                if (!BN_set_word(t2, 3))
+                        goto err;
                /* BN_set_word(t3,7); just have to miss
                 * out on these ones :-( */
-                g=5;
+                g = 5;
-                }
+        } else {
-        else
+                /*
-                {
+                 * in the general case, don't worry if 'generator' is a
-                /* in the general case, don't worry if 'generator' is a
                 * generator or not: since we are using safe primes,
                 * it will generate either an order-q or an order-2q group,
-                 * which both is OK */
+                 * which both is OK
-                if (!BN_set_word(t1,2)) goto err;
+                 */
-                if (!BN_set_word(t2,1)) goto err;
+                if (!BN_set_word(t1, 2))
-                g=generator;
+                        goto err;
-                }
+                if (!BN_set_word(t2, 1))
+                        goto err;
+                g = generator;
+        }
        
-        if(!BN_generate_prime_ex(ret->p,prime_len,1,t1,t2,cb)) goto err;
+        if (!BN_generate_prime_ex(ret->p, prime_len, 1, t1, t2, cb))
-        if(!BN_GENCB_call(cb, 3, 0)) goto err;
+                goto err;
-        if (!BN_set_word(ret->g,g)) goto err;
+        if (!BN_GENCB_call(cb, 3, 0))
-        ok=1;
+                goto err;
+        if (!BN_set_word(ret->g, g))
+                goto err;
+        ok = 1;
 err:
-        if (ok == -1)
+        if (ok == -1) {
-                {
+                DHerr(DH_F_DH_BUILTIN_GENPARAMS, ERR_R_BN_LIB);
-                DHerr(DH_F_DH_BUILTIN_GENPARAMS,ERR_R_BN_LIB);
+                ok = 0;
-                ok=0;
+        }
-                }
-        if (ctx != NULL)
+        if (ctx != NULL) {
-                {
                BN_CTX_end(ctx);
                BN_CTX_free(ctx);
-                }
-        return ok;
        }
+        return ok;
+}
diff --git a/src/lib/libssl/src/crypto/dh/dh_key.c b/src/lib/libssl/src/crypto/dh/dh_key.c
index d35eb6e740..4fbedd8daa 100644
--- a/src/lib/libssl/src/crypto/dh/dh_key.c
+++ b/src/lib/libssl/src/crypto/dh/dh_key.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh_key.c,v 1.18 2014/06/12 15:49:28 deraadt Exp $ */
+/* $OpenBSD: dh_key.c,v 1.19 2014/07/09 13:26:47 miod Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
 * All rights reserved.
 *
@@ -64,22 +64,22 @@
 static int generate_key(DH *dh);
 static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh);
-static int dh_bn_mod_exp(const DH *dh, BIGNUM *r,
+static int dh_bn_mod_exp(const DH *dh, BIGNUM *r, const BIGNUM *a,
-                        const BIGNUM *a, const BIGNUM *p,
+            const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
-                        const BIGNUM *m, BN_CTX *ctx,
-                        BN_MONT_CTX *m_ctx);
 static int dh_init(DH *dh);
 static int dh_finish(DH *dh);
-int DH_generate_key(DH *dh)
+int
-        {
+DH_generate_key(DH *dh)
+{
        return dh->meth->generate_key(dh);
-        }
+}
-int DH_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
+int
-        {
+DH_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
+{
        return dh->meth->compute_key(key, pub_key, dh);
-        }
+}
 static DH_METHOD dh_ossl = {
        .name = "OpenSSL DH Method",
@@ -90,184 +90,176 @@ static DH_METHOD dh_ossl = {
        .finish = dh_finish,
 };
-const DH_METHOD *DH_OpenSSL(void)
+const DH_METHOD *
+DH_OpenSSL(void)
 {
        return &dh_ossl;
 }
-static int generate_key(DH *dh)
+static int
-        {
+generate_key(DH *dh)
-        int ok=0;
+{
-        int generate_new_key=0;
+        int ok = 0;
+        int generate_new_key = 0;
        unsigned l;
        BN_CTX *ctx;
-        BN_MONT_CTX *mont=NULL;
+        BN_MONT_CTX *mont = NULL;
-        BIGNUM *pub_key=NULL,*priv_key=NULL;
+        BIGNUM *pub_key = NULL, *priv_key = NULL;
        ctx = BN_CTX_new();
-        if (ctx == NULL) goto err;
+        if (ctx == NULL)
+                goto err;
-        if (dh->priv_key == NULL)
-                {
-                priv_key=BN_new();
-                if (priv_key == NULL) goto err;
-                generate_new_key=1;
-                }
-        else
-                priv_key=dh->priv_key;
-        if (dh->pub_key == NULL)
+        if (dh->priv_key == NULL) {
-                {
+                priv_key = BN_new();
-                pub_key=BN_new();
+                if (priv_key == NULL)
-                if (pub_key == NULL) goto err;
+                        goto err;
-                }
+                generate_new_key = 1;
-        else
+        } else
-                pub_key=dh->pub_key;
+                priv_key = dh->priv_key;
+        if (dh->pub_key == NULL) {
+                pub_key = BN_new();
+                if (pub_key == NULL)
+                        goto err;
+        } else
+                pub_key = dh->pub_key;
-        if (dh->flags & DH_FLAG_CACHE_MONT_P)
+        if (dh->flags & DH_FLAG_CACHE_MONT_P) {
-                {
                mont = BN_MONT_CTX_set_locked(&dh->method_mont_p,
-                                CRYPTO_LOCK_DH, dh->p, ctx);
+                    CRYPTO_LOCK_DH, dh->p, ctx);
                if (!mont)
                        goto err;
-                }
+        }
-        if (generate_new_key)
+        if (generate_new_key) {
-                {
+                if (dh->q) {
-                if (dh->q)
+                        do {
-                        {
-                        do
-                                {
                                if (!BN_rand_range(priv_key, dh->q))
                                        goto err;
-                                }
+                        } while (BN_is_zero(priv_key) || BN_is_one(priv_key));
-                        while (BN_is_zero(priv_key) || BN_is_one(priv_key));
+                } else {
-                        }
-                else
-                        {
                        /* secret exponent length */
-                        l = dh->length ? dh->length : BN_num_bits(dh->p)-1;
+                        l = dh->length ? dh->length : BN_num_bits(dh->p) - 1;
-                        if (!BN_rand(priv_key, l, 0, 0)) goto err;
+                        if (!BN_rand(priv_key, l, 0, 0))
-                        }
+                                goto err;
                }
+        }
        {
                BIGNUM local_prk;
                BIGNUM *prk;
-                if ((dh->flags & DH_FLAG_NO_EXP_CONSTTIME) == 0)
+                if ((dh->flags & DH_FLAG_NO_EXP_CONSTTIME) == 0) {
-                        {
                        BN_init(&local_prk);
                        prk = &local_prk;
                        BN_with_flags(prk, priv_key, BN_FLG_CONSTTIME);
-                        }
+                } else
-                else
                        prk = priv_key;
-                if (!dh->meth->bn_mod_exp(dh, pub_key, dh->g, prk, dh->p, ctx, mont)) goto err;
+                if (!dh->meth->bn_mod_exp(dh, pub_key, dh->g, prk, dh->p, ctx,
+                    mont))
+                        goto err;
        }
                
-        dh->pub_key=pub_key;
+        dh->pub_key = pub_key;
-        dh->priv_key=priv_key;
+        dh->priv_key = priv_key;
-        ok=1;
+        ok = 1;
 err:
        if (ok != 1)
-                DHerr(DH_F_GENERATE_KEY,ERR_R_BN_LIB);
+                DHerr(DH_F_GENERATE_KEY, ERR_R_BN_LIB);
-        if ((pub_key != NULL)  && (dh->pub_key == NULL))  BN_free(pub_key);
+        if (pub_key != NULL && dh->pub_key == NULL)
-        if ((priv_key != NULL) && (dh->priv_key == NULL)) BN_free(priv_key);
+                BN_free(pub_key);
+        if (priv_key != NULL && dh->priv_key == NULL)
+                BN_free(priv_key);
        BN_CTX_free(ctx);
-        return(ok);
+        return ok;
-        }
+}
-static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
+static int
-        {
+compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
-        BN_CTX *ctx=NULL;
+{
-        BN_MONT_CTX *mont=NULL;
+        BN_CTX *ctx = NULL;
+        BN_MONT_CTX *mont = NULL;
        BIGNUM *tmp;
-        int ret= -1;
+        int ret = -1;
        int check_result;
-        if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS)
+        if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS) {
-                {
+                DHerr(DH_F_COMPUTE_KEY, DH_R_MODULUS_TOO_LARGE);
-                DHerr(DH_F_COMPUTE_KEY,DH_R_MODULUS_TOO_LARGE);
                goto err;
-                }
+        }
        ctx = BN_CTX_new();
-        if (ctx == NULL) goto err;
+        if (ctx == NULL)
+                goto err;
        BN_CTX_start(ctx);
        tmp = BN_CTX_get(ctx);
        
-        if (dh->priv_key == NULL)
+        if (dh->priv_key == NULL) {
-                {
+                DHerr(DH_F_COMPUTE_KEY, DH_R_NO_PRIVATE_VALUE);
-                DHerr(DH_F_COMPUTE_KEY,DH_R_NO_PRIVATE_VALUE);
                goto err;
-                }
+        }
-        if (dh->flags & DH_FLAG_CACHE_MONT_P)
+        if (dh->flags & DH_FLAG_CACHE_MONT_P) {
-                {
                mont = BN_MONT_CTX_set_locked(&dh->method_mont_p,
-                                CRYPTO_LOCK_DH, dh->p, ctx);
+                    CRYPTO_LOCK_DH, dh->p, ctx);
-                if ((dh->flags & DH_FLAG_NO_EXP_CONSTTIME) == 0)
+                if ((dh->flags & DH_FLAG_NO_EXP_CONSTTIME) == 0) {
-                        {
                        /* XXX */
                        BN_set_flags(dh->priv_key, BN_FLG_CONSTTIME);
-                        }
+                }
                if (!mont)
                        goto err;
-                }
+        }
-        if (!DH_check_pub_key(dh, pub_key, &check_result) || check_result)
+        if (!DH_check_pub_key(dh, pub_key, &check_result) || check_result) {
-                {
+                DHerr(DH_F_COMPUTE_KEY, DH_R_INVALID_PUBKEY);
-                DHerr(DH_F_COMPUTE_KEY,DH_R_INVALID_PUBKEY);
                goto err;
-                }
+        }
-        if (!dh->meth->bn_mod_exp(dh, tmp, pub_key, dh->priv_key,dh->p,ctx,mont))
+        if (!dh->meth->bn_mod_exp(dh, tmp, pub_key, dh->priv_key, dh->p, ctx,
-                {
+            mont)) {
-                DHerr(DH_F_COMPUTE_KEY,ERR_R_BN_LIB);
+                DHerr(DH_F_COMPUTE_KEY, ERR_R_BN_LIB);
                goto err;
-                }
+        }
-        ret=BN_bn2bin(tmp,key);
+        ret = BN_bn2bin(tmp, key);
 err:
-        if (ctx != NULL)
+        if (ctx != NULL) {
-                {
                BN_CTX_end(ctx);
                BN_CTX_free(ctx);
-                }
-        return(ret);
        }
+        return ret;
+}
-static int dh_bn_mod_exp(const DH *dh, BIGNUM *r,
+static int
-                        const BIGNUM *a, const BIGNUM *p,
+dh_bn_mod_exp(const DH *dh, BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
-                        const BIGNUM *m, BN_CTX *ctx,
+    const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
-                        BN_MONT_CTX *m_ctx)
+{
-        {
+        /*
-        /* If a is only one word long and constant time is false, use the faster
+         * If a is only one word long and constant time is false, use the faster
         * exponenentiation function.
         */
-        if (a->top == 1 && ((dh->flags & DH_FLAG_NO_EXP_CONSTTIME) != 0))
+        if (a->top == 1 && (dh->flags & DH_FLAG_NO_EXP_CONSTTIME) != 0) {
-                {
                BN_ULONG A = a->d[0];
-                return BN_mod_exp_mont_word(r,A,p,m,ctx,m_ctx);
-                }
-        else
-                return BN_mod_exp_mont(r,a,p,m,ctx,m_ctx);
-        }
+                return BN_mod_exp_mont_word(r, A, p, m, ctx, m_ctx);
+        } else
+                return BN_mod_exp_mont(r, a, p, m, ctx, m_ctx);
+}
-static int dh_init(DH *dh)
+static int
-        {
+dh_init(DH *dh)
+{
        dh->flags |= DH_FLAG_CACHE_MONT_P;
-        return(1);
+        return 1;
-        }
+}
-static int dh_finish(DH *dh)
+static int
-        {
+dh_finish(DH *dh)
-        if(dh->method_mont_p)
+{
+        if (dh->method_mont_p)
                BN_MONT_CTX_free(dh->method_mont_p);
-        return(1);
+        return 1;
-        }
+}
diff --git a/src/lib/libssl/src/crypto/dh/dh_lib.c b/src/lib/libssl/src/crypto/dh/dh_lib.c
index 793a8afdce..094a78041d 100644
--- a/src/lib/libssl/src/crypto/dh/dh_lib.c
+++ b/src/lib/libssl/src/crypto/dh/dh_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh_lib.c,v 1.16 2014/07/09 11:10:50 bcook Exp $ */
+/* $OpenBSD: dh_lib.c,v 1.17 2014/07/09 13:26:47 miod Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
 * All rights reserved.
 *
@@ -66,117 +66,121 @@
 static const DH_METHOD *default_DH_method = NULL;
-void DH_set_default_method(const DH_METHOD *meth)
+void
-        {
+DH_set_default_method(const DH_METHOD *meth)
+{
        default_DH_method = meth;
-        }
+}
-const DH_METHOD *DH_get_default_method(void)
+const DH_METHOD *
-        {
+DH_get_default_method(void)
-        if(!default_DH_method)
+{
-                {
+        if (!default_DH_method)
                default_DH_method = DH_OpenSSL();
-                }
        return default_DH_method;
-        }
+}
-int DH_set_method(DH *dh, const DH_METHOD *meth)
+int
-        {
+DH_set_method(DH *dh, const DH_METHOD *meth)
-        /* NB: The caller is specifically setting a method, so it's not up to us
+{
-         * to deal with which ENGINE it comes from. */
+        /*
+         * NB: The caller is specifically setting a method, so it's not up to us
+         * to deal with which ENGINE it comes from.
+         */
        const DH_METHOD *mtmp;
        mtmp = dh->meth;
-        if (mtmp->finish) mtmp->finish(dh);
+        if (mtmp->finish)
+                mtmp->finish(dh);
 #ifndef OPENSSL_NO_ENGINE
-        if (dh->engine)
+        if (dh->engine) {
-                {
                ENGINE_finish(dh->engine);
                dh->engine = NULL;
-                }
+        }
 #endif
        dh->meth = meth;
-        if (meth->init) meth->init(dh);
+        if (meth->init)
+                meth->init(dh);
        return 1;
-        }
+}
-DH *DH_new(void)
+DH *
-        {
+DH_new(void)
+{
        return DH_new_method(NULL);
-        }
+}
-DH *DH_new_method(ENGINE *engine)
+DH *
-        {
+DH_new_method(ENGINE *engine)
+{
        DH *ret;
        ret = malloc(sizeof(DH));
-        if (ret == NULL)
+        if (ret == NULL) {
-                {
+                DHerr(DH_F_DH_NEW_METHOD, ERR_R_MALLOC_FAILURE);
-                DHerr(DH_F_DH_NEW_METHOD,ERR_R_MALLOC_FAILURE);
+                return NULL;
-                return(NULL);
+        }
-                }
        ret->meth = DH_get_default_method();
 #ifndef OPENSSL_NO_ENGINE
-        if (engine)
+        if (engine) {
-                {
+                if (!ENGINE_init(engine)) {
-                if (!ENGINE_init(engine))
-                        {
                        DHerr(DH_F_DH_NEW_METHOD, ERR_R_ENGINE_LIB);
                        free(ret);
                        return NULL;
-                        }
-                ret->engine = engine;
                }
-        else
+                ret->engine = engine;
+        } else
                ret->engine = ENGINE_get_default_DH();
-        if(ret->engine)
+        if(ret->engine) {
-                {
                ret->meth = ENGINE_get_DH(ret->engine);
-                if(!ret->meth)
+                if (!ret->meth) {
-                        {
+                        DHerr(DH_F_DH_NEW_METHOD, ERR_R_ENGINE_LIB);
-                        DHerr(DH_F_DH_NEW_METHOD,ERR_R_ENGINE_LIB);
                        ENGINE_finish(ret->engine);
                        free(ret);
                        return NULL;
-                        }
                }
+        }
 #endif
-        ret->pad=0;
+        ret->pad = 0;
-        ret->version=0;
+        ret->version = 0;
-        ret->p=NULL;
+        ret->p = NULL;
-        ret->g=NULL;
+        ret->g = NULL;
-        ret->length=0;
+        ret->length = 0;
-        ret->pub_key=NULL;
+        ret->pub_key = NULL;
-        ret->priv_key=NULL;
+        ret->priv_key = NULL;
-        ret->q=NULL;
+        ret->q = NULL;
-        ret->j=NULL;
+        ret->j = NULL;
        ret->seed = NULL;
        ret->seedlen = 0;
        ret->counter = NULL;
        ret->method_mont_p=NULL;
        ret->references = 1;
-        ret->flags=ret->meth->flags & ~DH_FLAG_NON_FIPS_ALLOW;
+        ret->flags = ret->meth->flags & ~DH_FLAG_NON_FIPS_ALLOW;
        CRYPTO_new_ex_data(CRYPTO_EX_INDEX_DH, ret, &ret->ex_data);
-        if ((ret->meth->init != NULL) && !ret->meth->init(ret))
+        if (ret->meth->init != NULL && !ret->meth->init(ret)) {
-                {
 #ifndef OPENSSL_NO_ENGINE
                if (ret->engine)
                        ENGINE_finish(ret->engine);
 #endif
                CRYPTO_free_ex_data(CRYPTO_EX_INDEX_DH, ret, &ret->ex_data);
                free(ret);
-                ret=NULL;
+                ret = NULL;
-                }
-        return(ret);
        }
+        return ret;
+}
-void DH_free(DH *r)
+void
-        {
+DH_free(DH *r)
+{
        int i;
-        if(r == NULL) return;
+        if (r == NULL)
+                return;
        i = CRYPTO_add(&r->references, -1, CRYPTO_LOCK_DH);
-        if (i > 0) return;
+        if (i > 0)
+                return;
        if (r->meth->finish)
                r->meth->finish(r);
@@ -187,41 +191,54 @@ void DH_free(DH *r)
        CRYPTO_free_ex_data(CRYPTO_EX_INDEX_DH, r, &r->ex_data);
-        if (r->p != NULL) BN_clear_free(r->p);
+        if (r->p != NULL)
-        if (r->g != NULL) BN_clear_free(r->g);
+                BN_clear_free(r->p);
-        if (r->q != NULL) BN_clear_free(r->q);
+        if (r->g != NULL)
-        if (r->j != NULL) BN_clear_free(r->j);
+                BN_clear_free(r->g);
+        if (r->q != NULL)
+                BN_clear_free(r->q);
+        if (r->j != NULL)
+                BN_clear_free(r->j);
        free(r->seed);
-        if (r->counter != NULL) BN_clear_free(r->counter);
+        if (r->counter != NULL)
-        if (r->pub_key != NULL) BN_clear_free(r->pub_key);
+                BN_clear_free(r->counter);
-        if (r->priv_key != NULL) BN_clear_free(r->priv_key);
+        if (r->pub_key != NULL)
+                BN_clear_free(r->pub_key);
+        if (r->priv_key != NULL)
+                BN_clear_free(r->priv_key);
        free(r);
-        }
+}
-int DH_up_ref(DH *r)
+int
-        {
+DH_up_ref(DH *r)
+{
        int i = CRYPTO_add(&r->references, 1, CRYPTO_LOCK_DH);
-        return ((i > 1) ? 1 : 0);
-        }
-int DH_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+        return i > 1 ? 1 : 0;
-             CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
+}
-        {
-        return CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_DH, argl, argp,
+int
-                                new_func, dup_func, free_func);
+DH_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
-        }
+    CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
+{
-int DH_set_ex_data(DH *d, int idx, void *arg)
+        return CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_DH, argl, argp, new_func,
-        {
+            dup_func, free_func);
-        return(CRYPTO_set_ex_data(&d->ex_data,idx,arg));
+}
-        }
+int
-void *DH_get_ex_data(DH *d, int idx)
+DH_set_ex_data(DH *d, int idx, void *arg)
-        {
+{
-        return(CRYPTO_get_ex_data(&d->ex_data,idx));
+        return CRYPTO_set_ex_data(&d->ex_data, idx, arg);
-        }
+}
-int DH_size(const DH *dh)
+void *
-        {
+DH_get_ex_data(DH *d, int idx)
-        return(BN_num_bytes(dh->p));
+{
-        }
+        return CRYPTO_get_ex_data(&d->ex_data, idx);
+}
+int
+DH_size(const DH *dh)
+{
+        return BN_num_bytes(dh->p);
+}
diff --git a/src/lib/libssl/src/crypto/dh/dh_pmeth.c b/src/lib/libssl/src/crypto/dh/dh_pmeth.c
index cb424ac149..fb441b563b 100644
--- a/src/lib/libssl/src/crypto/dh/dh_pmeth.c
+++ b/src/lib/libssl/src/crypto/dh/dh_pmeth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh_pmeth.c,v 1.6 2014/06/12 20:40:57 deraadt Exp $ */
+/* $OpenBSD: dh_pmeth.c,v 1.7 2014/07/09 13:26:47 miod Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
 * project 2006.
 */
@@ -68,8 +68,7 @@
 /* DH pkey context structure */
-typedef struct
+typedef struct {
-        {
        /* Parameter gen parameters */
        int prime_len;
        int generator;
@@ -77,11 +76,13 @@ typedef struct
        /* Keygen callback info */
        int gentmp[2];
        /* message digest */
-        } DH_PKEY_CTX;
+} DH_PKEY_CTX;
-static int pkey_dh_init(EVP_PKEY_CTX *ctx)
+static int
-        {
+pkey_dh_init(EVP_PKEY_CTX *ctx)
+{
        DH_PKEY_CTX *dctx;
        dctx = malloc(sizeof(DH_PKEY_CTX));
        if (!dctx)
                return 0;
@@ -94,11 +95,13 @@ static int pkey_dh_init(EVP_PKEY_CTX *ctx)
        ctx->keygen_info_count = 2;
        
        return 1;
-        }
+}
-static int pkey_dh_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src)
+static int
-        {
+pkey_dh_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src)
+{
        DH_PKEY_CTX *dctx, *sctx;
        if (!pkey_dh_init(dst))
                return 0;
        sctx = src->data;
@@ -107,43 +110,44 @@ static int pkey_dh_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src)
        dctx->generator = sctx->generator;
        dctx->use_dsa = sctx->use_dsa;
        return 1;
-        }
+}
-static void pkey_dh_cleanup(EVP_PKEY_CTX *ctx)
+static void
-        {
+pkey_dh_cleanup(EVP_PKEY_CTX *ctx)
+{
        DH_PKEY_CTX *dctx = ctx->data;
        free(dctx);
-        }
+}
-static int pkey_dh_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
+static int
-        {
+pkey_dh_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
+{
        DH_PKEY_CTX *dctx = ctx->data;
-        switch (type)
-                {
+        switch (type) {
-                case EVP_PKEY_CTRL_DH_PARAMGEN_PRIME_LEN:
+        case EVP_PKEY_CTRL_DH_PARAMGEN_PRIME_LEN:
                if (p1 < 256)
                        return -2;
                dctx->prime_len = p1;
                return 1;
-                case EVP_PKEY_CTRL_DH_PARAMGEN_GENERATOR:
+        case EVP_PKEY_CTRL_DH_PARAMGEN_GENERATOR:
                dctx->generator = p1;
                return 1;
-                case EVP_PKEY_CTRL_PEER_KEY:
+        case EVP_PKEY_CTRL_PEER_KEY:
                /* Default behaviour is OK */
                return 1;
-                default:
+        default:
                return -2;
-                }
        }
+}
                        
-static int pkey_dh_ctrl_str(EVP_PKEY_CTX *ctx,
+static int
-                        const char *type, const char *value)
+pkey_dh_ctrl_str(EVP_PKEY_CTX *ctx, const char *type, const char *value)
-        {
+{
        long lval;
        char *ep;
        int len;
@@ -153,18 +157,19 @@ static int pkey_dh_ctrl_str(EVP_PKEY_CTX *ctx,
                lval = strtol(value, &ep, 10);
                if (value[0] == '\0' || *ep != '\0')
                        goto not_a_number;
-                if ((errno == ERANGE && (lval == LONG_MAX || lval == LONG_MIN)) ||
+                if ((errno == ERANGE &&
+                    (lval == LONG_MAX || lval == LONG_MIN)) ||
                    (lval > INT_MAX || lval < INT_MIN))
                        goto out_of_range;
                len = lval;
                return EVP_PKEY_CTX_set_dh_paramgen_prime_len(ctx, len);
-        }
+        } else if (!strcmp(type, "dh_paramgen_generator")) {
-        if (!strcmp(type, "dh_paramgen_generator")) {
                errno = 0;
                lval = strtol(value, &ep, 10);
                if (value[0] == '\0' || *ep != '\0')
                        goto not_a_number;
-                if ((errno == ERANGE && (lval == LONG_MAX || lval == LONG_MIN)) ||
+                if ((errno == ERANGE &&
+                    (lval == LONG_MAX || lval == LONG_MIN)) ||
                    (lval > INT_MAX || lval < INT_MIN))
                        goto out_of_range;
                len = lval;
@@ -176,39 +181,40 @@ out_of_range:
        return -2;
 }
-static int pkey_dh_paramgen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
+static int
-        {
+pkey_dh_paramgen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
+{
        DH *dh = NULL;
        DH_PKEY_CTX *dctx = ctx->data;
        BN_GENCB *pcb, cb;
        int ret;
-        if (ctx->pkey_gencb)
-                {
+        if (ctx->pkey_gencb) {
                pcb = &cb;
                evp_pkey_set_cb_translate(pcb, ctx);
-                }
+        } else
-        else
                pcb = NULL;
        dh = DH_new();
        if (!dh)
                return 0;
-        ret = DH_generate_parameters_ex(dh,
+        ret = DH_generate_parameters_ex(dh, dctx->prime_len, dctx->generator,
-                                        dctx->prime_len, dctx->generator, pcb);
+            pcb);
        if (ret)
                EVP_PKEY_assign_DH(pkey, dh);
        else
                DH_free(dh);
        return ret;
-        }
+}
-static int pkey_dh_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
+static int
-        {
+pkey_dh_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
+{
        DH *dh = NULL;
-        if (ctx->pkey == NULL)
-                {
+        if (ctx->pkey == NULL) {
                DHerr(DH_F_PKEY_DH_KEYGEN, DH_R_NO_PARAMETERS_SET);
                return 0;
-                }
+        }
        dh = DH_new();
        if (!dh)
                return 0;
@@ -217,23 +223,24 @@ static int pkey_dh_keygen(EVP_PKEY_CTX *ctx, EVP_PKEY *pkey)
        if (!EVP_PKEY_copy_parameters(pkey, ctx->pkey))
                return 0;
        return DH_generate_key(pkey->pkey.dh);
-        }
+}
-static int pkey_dh_derive(EVP_PKEY_CTX *ctx, unsigned char *key, size_t *keylen)
+static int
-        {
+pkey_dh_derive(EVP_PKEY_CTX *ctx, unsigned char *key, size_t *keylen)
+{
        int ret;
-        if (!ctx->pkey || !ctx->peerkey)
-                {
+        if (!ctx->pkey || !ctx->peerkey) {
                DHerr(DH_F_PKEY_DH_DERIVE, DH_R_KEYS_NOT_SET);
                return 0;
-                }
+        }
        ret = DH_compute_key(key, ctx->peerkey->pkey.dh->pub_key,
-                                                        ctx->pkey->pkey.dh);
+            ctx->pkey->pkey.dh);
        if (ret < 0)
                return ret;
        *keylen = ret;
        return 1;
-        }
+}
 const EVP_PKEY_METHOD dh_pkey_meth = {
        .pkey_id = EVP_PKEY_DH,
diff --git a/src/lib/libssl/src/crypto/dh/dh_prn.c b/src/lib/libssl/src/crypto/dh/dh_prn.c
index a249b650f8..846419691e 100644
--- a/src/lib/libssl/src/crypto/dh/dh_prn.c
+++ b/src/lib/libssl/src/crypto/dh/dh_prn.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh_prn.c,v 1.3 2014/06/12 15:49:28 deraadt Exp $ */
+/* $OpenBSD: dh_prn.c,v 1.4 2014/07/09 13:26:47 miod Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
 * All rights reserved.
 *
@@ -61,18 +61,18 @@
 #include <openssl/evp.h>
 #include <openssl/dh.h>
-int DHparams_print_fp(FILE *fp, const DH *x)
+int
-        {
+DHparams_print_fp(FILE *fp, const DH *x)
+{
        BIO *b;
        int ret;
-        if ((b=BIO_new(BIO_s_file())) == NULL)
+        if ((b = BIO_new(BIO_s_file())) == NULL) {
-                {
+                DHerr(DH_F_DHPARAMS_PRINT_FP, ERR_R_BUF_LIB);
-                DHerr(DH_F_DHPARAMS_PRINT_FP,ERR_R_BUF_LIB);
+                return 0;
-                return(0);
+        }
-                }
        BIO_set_fp(b,fp,BIO_NOCLOSE);
-        ret=DHparams_print(b, x);
+        ret = DHparams_print(b, x);
        BIO_free(b);
-        return(ret);
+        return ret;
-        }
+}
author	miod <>	2014-07-09 13:26:47 +0000
committer	miod <>	2014-07-09 13:26:47 +0000
commit	7b0280e96c976103d66ebabe5a23f4f9e18a88f1 (patch)
tree	efa6e3fe5e9cccf6532f4f9d3fd222d9fbb45764 /src
parent	4b7ee752ce92891c2906d9e0a72e420564d3dfd1 (diff)
download	openbsd-7b0280e96c976103d66ebabe5a23f4f9e18a88f1.tar.gz openbsd-7b0280e96c976103d66ebabe5a23f4f9e18a88f1.tar.bz2 openbsd-7b0280e96c976103d66ebabe5a23f4f9e18a88f1.zip