Update ssl code to support digests other than MD5+SHA1 in handshake.

[openssl.git] / ssl / s3_lib.c

diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index d438cbb10d0114a7cb05c78d6382da7abe4146bc..b2d1fefc315ead6f8d64c3dfb5dfd982f6609e84 100644 (file)
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -181,7 +181,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_MD5,
        SSL_SSLV3,
        SSL_NOT_EXP|SSL_STRONG_NONE,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        0,
        0,
        },
@@ -197,7 +197,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_NOT_EXP|SSL_STRONG_NONE,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        0,
        0,
        },
@@ -213,7 +213,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_MD5,
        SSL_SSLV3,
        SSL_EXPORT|SSL_EXP40,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        40,
        128,
        },
@@ -229,7 +229,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_MD5,
        SSL_SSLV3,
        SSL_NOT_EXP|SSL_MEDIUM,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -245,7 +245,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_NOT_EXP|SSL_MEDIUM,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -261,7 +261,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_MD5,
        SSL_SSLV3,
        SSL_EXPORT|SSL_EXP40,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        40,
        128,
        },
@@ -278,7 +278,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_NOT_EXP|SSL_MEDIUM,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -295,7 +295,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_EXPORT|SSL_EXP40,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        40,
        56,
        },
@@ -311,7 +311,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_NOT_EXP|SSL_LOW,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        56,
        56,
        },
@@ -327,7 +327,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        168,
        168,
        },
@@ -344,7 +344,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_EXPORT|SSL_EXP40,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        40,
        56,
        },
@@ -360,7 +360,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_NOT_EXP|SSL_LOW,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        56,
        56,
        },
@@ -376,7 +376,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        168,
        168,
        },
@@ -392,7 +392,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_EXPORT|SSL_EXP40,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        40,
        56,
        },
@@ -408,7 +408,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_NOT_EXP|SSL_LOW,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        56,
        56,
        },
@@ -424,7 +424,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        168,
        168,
        },
@@ -441,7 +441,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_EXPORT|SSL_EXP40,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        40,
        56,
        },
@@ -457,7 +457,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_NOT_EXP|SSL_LOW,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        56,
        56,
        },
@@ -473,7 +473,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        168,
        168,
        },
@@ -489,7 +489,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_EXPORT|SSL_EXP40,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        40,
        56,
        },
@@ -505,7 +505,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_NOT_EXP|SSL_LOW,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        56,
        56,
        },
@@ -521,7 +521,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        168,
        168,
        },
@@ -537,7 +537,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_MD5,
        SSL_SSLV3,
        SSL_EXPORT|SSL_EXP40,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        40,
        128,
        },
@@ -553,7 +553,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_MD5,
        SSL_SSLV3,
        SSL_NOT_EXP|SSL_MEDIUM,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -569,7 +569,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_EXPORT|SSL_EXP40,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        40,
        128,
        },
@@ -585,7 +585,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_NOT_EXP|SSL_LOW,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        56,
        56,
        },
@@ -601,7 +601,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        168,
        168,
        },
@@ -619,7 +619,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_NOT_EXP|SSL_STRONG_NONE,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        0,
        0,
        },
@@ -635,7 +635,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_NOT_EXP|SSL_STRONG_NONE,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        0,
        0,
        },
@@ -651,17 +651,14 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_NOT_EXP|SSL_MEDIUM,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
 #endif
 
 #ifndef OPENSSL_NO_KRB5
-/* The Kerberos ciphers
-** 20000107 VRS: And the first shall be last,
-** in hopes of avoiding the lynx ssl renegotiation problem.
-*/
+/* The Kerberos ciphers*/
 /* Cipher 1E */
        {
        1,
@@ -673,7 +670,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_NOT_EXP|SSL_LOW,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        56,
        56,
        },
@@ -689,7 +686,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        168,
        168,
        },
@@ -705,7 +702,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_NOT_EXP|SSL_MEDIUM,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -721,7 +718,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_NOT_EXP|SSL_MEDIUM,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -737,7 +734,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_MD5,
        SSL_SSLV3,
        SSL_NOT_EXP|SSL_LOW,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        56,
        56,
        },
@@ -753,7 +750,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_MD5,
        SSL_SSLV3,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        168,
        168,
        },
@@ -769,7 +766,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_MD5,
        SSL_SSLV3,
        SSL_NOT_EXP|SSL_MEDIUM,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -785,7 +782,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_MD5,
        SSL_SSLV3,
        SSL_NOT_EXP|SSL_MEDIUM,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -801,7 +798,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_EXPORT|SSL_EXP40,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        40,
        56,
        },
@@ -817,7 +814,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_EXPORT|SSL_EXP40,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        40,
        128,
        },
@@ -833,7 +830,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_SSLV3,
        SSL_EXPORT|SSL_EXP40,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        40,
        128,
        },
@@ -849,7 +846,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_MD5,
        SSL_SSLV3,
        SSL_EXPORT|SSL_EXP40,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        40,
        56,
        },
@@ -865,7 +862,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_MD5,
        SSL_SSLV3,
        SSL_EXPORT|SSL_EXP40,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        40,
        128,
        },
@@ -881,7 +878,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_MD5,
        SSL_SSLV3,
        SSL_EXPORT|SSL_EXP40,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        40,
        128,
        },
@@ -899,7 +896,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -914,7 +911,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -929,7 +926,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -944,7 +941,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -959,7 +956,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -974,7 +971,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -990,7 +987,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        256,
        256,
        },
@@ -1005,7 +1002,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        256,
        256,
        },
@@ -1021,7 +1018,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        256,
        256,
        },
@@ -1037,7 +1034,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        256,
        256,
        },
@@ -1053,7 +1050,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        256,
        256,
        },
@@ -1069,7 +1066,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        256,
        256,
        },
@@ -1088,7 +1085,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -1104,7 +1101,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -1120,7 +1117,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -1136,7 +1133,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -1152,7 +1149,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -1168,7 +1165,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -1188,7 +1185,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_MD5,
        SSL_TLSV1,
        SSL_EXPORT|SSL_EXP56,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        56,
        128,
        },
@@ -1204,7 +1201,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_MD5,
        SSL_TLSV1,
        SSL_EXPORT|SSL_EXP56,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        56,
        128,
        },
@@ -1221,7 +1218,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_EXPORT|SSL_EXP56,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        56,
        56,
        },
@@ -1237,7 +1234,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_EXPORT|SSL_EXP56,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        56,
        56,
        },
@@ -1253,7 +1250,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_EXPORT|SSL_EXP56,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        56,
        128,
        },
@@ -1269,7 +1266,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_EXPORT|SSL_EXP56,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        56,
        128,
        },
@@ -1285,7 +1282,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_MEDIUM,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -1305,7 +1302,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        256,
        256,
        },
@@ -1320,7 +1317,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        256,
        256,
        },
@@ -1336,7 +1333,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        256,
        256,
        },
@@ -1352,7 +1349,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        256,
        256,
        },
@@ -1368,7 +1365,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        256,
        256,
        },
@@ -1384,7 +1381,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        256,
        256,
        },
@@ -1402,7 +1399,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_MEDIUM,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -1418,7 +1415,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        168,
        168,
        },
@@ -1434,7 +1431,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -1450,12 +1447,113 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        256,
        256,
        },
 #endif  /* OPENSSL_NO_PSK */
 
+#ifndef OPENSSL_NO_SEED
+       /* SEED ciphersuites from RFC4162 */
+
+       /* Cipher 96 */
+       {
+       1,
+       TLS1_TXT_RSA_WITH_SEED_SHA,
+       TLS1_CK_RSA_WITH_SEED_SHA,
+       SSL_kRSA,
+       SSL_aRSA,
+       SSL_SEED,
+       SSL_SHA1,
+       SSL_TLSV1,
+       SSL_NOT_EXP|SSL_MEDIUM,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+       128,
+       128,
+       },
+
+       /* Cipher 97 */
+       {
+       0, /* not implemented (non-ephemeral DH) */
+       TLS1_TXT_DH_DSS_WITH_SEED_SHA,
+       TLS1_CK_DH_DSS_WITH_SEED_SHA,
+       SSL_kDHd,
+       SSL_aDH,
+       SSL_SEED,
+       SSL_SHA1,
+       SSL_TLSV1,
+       SSL_NOT_EXP|SSL_MEDIUM,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+       128,
+       128,
+       },
+
+       /* Cipher 98 */
+       {
+       0, /* not implemented (non-ephemeral DH) */
+       TLS1_TXT_DH_RSA_WITH_SEED_SHA,
+       TLS1_CK_DH_RSA_WITH_SEED_SHA,
+       SSL_kDHr,
+       SSL_aDH,
+       SSL_SEED,
+       SSL_SHA1,
+       SSL_TLSV1,
+       SSL_NOT_EXP|SSL_MEDIUM,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+       128,
+       128,
+       },
+
+       /* Cipher 99 */
+       {
+       1,
+       TLS1_TXT_DHE_DSS_WITH_SEED_SHA,
+       TLS1_CK_DHE_DSS_WITH_SEED_SHA,
+       SSL_kEDH,
+       SSL_aDSS,
+       SSL_SEED,
+       SSL_SHA1,
+       SSL_TLSV1,
+       SSL_NOT_EXP|SSL_MEDIUM,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+       128,
+       128,
+       },
+
+       /* Cipher 9A */
+       {
+       1,
+       TLS1_TXT_DHE_RSA_WITH_SEED_SHA,
+       TLS1_CK_DHE_RSA_WITH_SEED_SHA,
+       SSL_kEDH,
+       SSL_aRSA,
+       SSL_SEED,
+       SSL_SHA1,
+       SSL_TLSV1,
+       SSL_NOT_EXP|SSL_MEDIUM,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+       128,
+       128,
+       },
+
+       /* Cipher 9B */
+       {
+       1,
+       TLS1_TXT_ADH_WITH_SEED_SHA,
+       TLS1_CK_ADH_WITH_SEED_SHA,
+       SSL_kEDH,
+       SSL_aNULL,
+       SSL_SEED,
+       SSL_SHA1,
+       SSL_TLSV1,
+       SSL_NOT_EXP|SSL_MEDIUM,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+       128,
+       128,
+       },
+
+#endif /* OPENSSL_NO_SEED */
+
 #ifndef OPENSSL_NO_ECDH
        /* Cipher C001 */
        {
@@ -1467,8 +1565,8 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_eNULL,
        SSL_SHA1,
        SSL_TLSV1,
-       SSL_NOT_EXP,
-       0,
+       SSL_NOT_EXP|SSL_STRONG_NONE,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        0,
        0,
        },
@@ -1483,8 +1581,8 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_RC4,
        SSL_SHA1,
        SSL_TLSV1,
-       SSL_NOT_EXP,
-       0,
+       SSL_NOT_EXP|SSL_MEDIUM,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -1500,7 +1598,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        168,
        168,
        },
@@ -1516,7 +1614,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -1532,7 +1630,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        256,
        256,
        },
@@ -1547,8 +1645,8 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_eNULL,
        SSL_SHA1,
        SSL_TLSV1,
-       SSL_NOT_EXP,
-       0,
+       SSL_NOT_EXP|SSL_STRONG_NONE,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        0,
        0,
        },
@@ -1563,8 +1661,8 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_RC4,
        SSL_SHA1,
        SSL_TLSV1,
-       SSL_NOT_EXP,
-       0,
+       SSL_NOT_EXP|SSL_MEDIUM,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -1580,7 +1678,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        168,
        168,
        },
@@ -1596,7 +1694,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -1612,7 +1710,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        256,
        256,
        },
@@ -1627,8 +1725,8 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_eNULL,
        SSL_SHA1,
        SSL_TLSV1,
-       SSL_NOT_EXP,
-       0,
+       SSL_NOT_EXP|SSL_STRONG_NONE,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        0,
        0,
        },
@@ -1643,8 +1741,8 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_RC4,
        SSL_SHA1,
        SSL_TLSV1,
-       SSL_NOT_EXP,
-       0,
+       SSL_NOT_EXP|SSL_MEDIUM,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -1660,7 +1758,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        168,
        168,
        },
@@ -1676,7 +1774,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -1692,7 +1790,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        256,
        256,
        },
@@ -1707,8 +1805,8 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_eNULL,
        SSL_SHA1,
        SSL_TLSV1,
-       SSL_NOT_EXP,
-       0,
+       SSL_NOT_EXP|SSL_STRONG_NONE,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        0,
        0,
        },
@@ -1723,8 +1821,8 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_RC4,
        SSL_SHA1,
        SSL_TLSV1,
-       SSL_NOT_EXP,
-       0,
+       SSL_NOT_EXP|SSL_MEDIUM,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -1740,7 +1838,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        168,
        168,
        },
@@ -1756,7 +1854,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -1772,7 +1870,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        256,
        256,
        },
@@ -1787,8 +1885,8 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_eNULL,
        SSL_SHA1,
        SSL_TLSV1,
-       SSL_NOT_EXP,
-       0,
+       SSL_NOT_EXP|SSL_STRONG_NONE,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        0,
        0,
        },
@@ -1803,8 +1901,8 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_RC4,
        SSL_SHA1,
        SSL_TLSV1,
-       SSL_NOT_EXP,
-       0,
+       SSL_NOT_EXP|SSL_MEDIUM,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -1820,7 +1918,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        168,
        168,
        },
@@ -1836,7 +1934,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        128,
        128,
        },
@@ -1852,12 +1950,72 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
        SSL_SHA1,
        SSL_TLSV1,
        SSL_NOT_EXP|SSL_HIGH,
-       0,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
        256,
        256,
        },
 #endif /* OPENSSL_NO_ECDH */
 
+#ifdef TEMP_GOST_TLS
+/* Cipher FF00 */
+       {
+       1,
+       "GOST-MD5",
+       0x0300ff00,
+       SSL_kRSA,
+       SSL_aRSA,
+       SSL_eGOST2814789CNT,
+       SSL_MD5,
+       SSL_TLSV1,
+       SSL_NOT_EXP|SSL_HIGH,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+       256,
+       256,
+       },
+       {
+       1,
+       "GOST-GOST94",
+       0x0300ff01,
+       SSL_kRSA,
+       SSL_aRSA,
+       SSL_eGOST2814789CNT,
+       SSL_GOST94,
+       SSL_TLSV1,
+       SSL_NOT_EXP|SSL_HIGH,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+       256,
+       256
+       },
+       {
+       1,
+       "GOST-GOST89MAC",
+       0x0300ff02,
+       SSL_kRSA,
+       SSL_aRSA,
+       SSL_eGOST2814789CNT,
+       SSL_GOST89MAC,
+       SSL_TLSV1,
+       SSL_NOT_EXP|SSL_HIGH,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF,
+       256,
+       256
+       },
+       {
+       1,
+       "GOST-GOST89STREAM",
+       0x0300ff03,
+       SSL_kRSA,
+       SSL_aRSA,
+       SSL_eGOST2814789CNT,
+       SSL_GOST89MAC,
+       SSL_TLSV1,
+       SSL_NOT_EXP|SSL_HIGH,
+       SSL_HANDSHAKE_MAC_DEFAULT|TLS1_PRF|TLS1_STREAM_MAC,
+       256,
+       256
+       },
+#endif
+
 /* end of list */
        };
 
@@ -1909,8 +2067,6 @@ int ssl3_new(SSL *s)
 
        if ((s3=OPENSSL_malloc(sizeof *s3)) == NULL) goto err;
        memset(s3,0,sizeof *s3);
-       EVP_MD_CTX_init(&s3->finish_dgst1);
-       EVP_MD_CTX_init(&s3->finish_dgst2);
        memset(s3->rrec.seq_num,0,sizeof(s3->rrec.seq_num));
        memset(s3->wrec.seq_num,0,sizeof(s3->wrec.seq_num));
 
@@ -1945,9 +2101,10 @@ void ssl3_free(SSL *s)
 
        if (s->s3->tmp.ca_names != NULL)
                sk_X509_NAME_pop_free(s->s3->tmp.ca_names,X509_NAME_free);
-       EVP_MD_CTX_cleanup(&s->s3->finish_dgst1);
-       EVP_MD_CTX_cleanup(&s->s3->finish_dgst2);
-
+       if (s->s3->handshake_buffer) {
+               BIO_free(s->s3->handshake_buffer);
+       }
+       if (s->s3->handshake_dgst) ssl3_free_digest_list(s);
        OPENSSL_cleanse(s->s3,sizeof *s->s3);
        OPENSSL_free(s->s3);
        s->s3=NULL;
@@ -1980,10 +2137,12 @@ void ssl3_clear(SSL *s)
        wp = s->s3->wbuf.buf;
        rlen = s->s3->rbuf.len;
        wlen = s->s3->wbuf.len;
-
-       EVP_MD_CTX_cleanup(&s->s3->finish_dgst1);
-       EVP_MD_CTX_cleanup(&s->s3->finish_dgst2);
-
+       if (s->s3->handshake_buffer) {
+               BIO_free(s->s3->handshake_buffer);
+       }
+       if (s->s3->handshake_dgst) {
+               ssl3_free_digest_list(s);
+       }       
        memset(s->s3,0,sizeof *s->s3);
        s->s3->rbuf.buf = rp;
        s->s3->wbuf.buf = wp;
@@ -2180,6 +2339,9 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
                        }
                s->options |= SSL_OP_NO_SSLv2; /* can't use extension w/ SSL 2.0 format */
                break;
+       case SSL_CTRL_SET_TLSEXT_DEBUG_ARG:
+               s->tlsext_debug_arg=parg;
+               break;
 #endif /* !OPENSSL_NO_TLSEXT */
        default:
                break;
@@ -2231,6 +2393,12 @@ long ssl3_callback_ctrl(SSL *s, int cmd, void (*fp)(void))
                s->cert->ecdh_tmp_cb = (EC_KEY *(*)(SSL *, int, int))fp;
                }
                break;
+#endif
+#ifndef OPENSSL_NO_TLSEXT
+       case SSL_CTRL_SET_TLSEXT_DEBUG_CB:
+               s->tlsext_debug_cb=(void (*)(SSL *,int ,int,
+                                       unsigned char *, int, void *))fp;
+               break;
 #endif
        default:
                break;
@@ -2369,6 +2537,31 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
        case SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG:
                ctx->tlsext_servername_arg=parg;
                break;
+       case SSL_CTRL_SET_TLSEXT_TICKET_KEYS:
+       case SSL_CTRL_GET_TLSEXT_TICKET_KEYS:
+               {
+               unsigned char *keys = parg;
+               if (!keys)
+                       return 48;
+               if (larg != 48)
+                       {
+                       SSLerr(SSL_F_SSL3_CTX_CTRL, SSL_R_INVALID_TICKET_KEYS_LENGTH);
+                       return 0;
+                       }
+               if (cmd == SSL_CTRL_SET_TLSEXT_TICKET_KEYS)
+                       {
+                       memcpy(ctx->tlsext_tick_key_name, keys, 16);
+                       memcpy(ctx->tlsext_tick_hmac_key, keys + 16, 16);
+                       memcpy(ctx->tlsext_tick_aes_key, keys + 32, 16);
+                       }
+               else
+                       {
+                       memcpy(keys, ctx->tlsext_tick_key_name, 16);
+                       memcpy(keys + 16, ctx->tlsext_tick_hmac_key, 16);
+                       memcpy(keys + 32, ctx->tlsext_tick_aes_key, 16);
+                       }
+               return 1;
+               }
 #endif /* !OPENSSL_NO_TLSEXT */
        /* A Thawte special :-) */
        case SSL_CTRL_EXTRA_CHAIN_CERT:
@@ -2465,8 +2658,8 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
        SSL_CIPHER *c,*ret=NULL;
        STACK_OF(SSL_CIPHER) *prio, *allow;
        int i,ii,ok;
-       unsigned int j;
 #ifndef OPENSSL_NO_TLSEXT
+       unsigned int j;
 #ifndef OPENSSL_NO_EC
        int ec_ok, ec_nid;
        unsigned char ec_search1 = 0, ec_search2 = 0;
@@ -2489,30 +2682,30 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
 #endif
 
 #ifdef CIPHER_DEBUG
-        printf("Server has %d from %p:\n", sk_SSL_CIPHER_num(srvr), srvr);
-        for(i=0 ; i < sk_SSL_CIPHER_num(srvr) ; ++i)
-           {
-           c=sk_SSL_CIPHER_value(srvr,i);
-           printf("%p:%s\n",c,c->name);
-           }
-        printf("Client sent %d from %p:\n", sk_SSL_CIPHER_num(clnt), clnt);
-        for(i=0 ; i < sk_SSL_CIPHER_num(clnt) ; ++i)
+       printf("Server has %d from %p:\n", sk_SSL_CIPHER_num(srvr), (void *)srvr);
+       for(i=0 ; i < sk_SSL_CIPHER_num(srvr) ; ++i)
+               {
+               c=sk_SSL_CIPHER_value(srvr,i);
+               printf("%p:%s\n",(void *)c,c->name);
+               }
+       printf("Client sent %d from %p:\n", sk_SSL_CIPHER_num(clnt), (void *)clnt);
+       for(i=0 ; i < sk_SSL_CIPHER_num(clnt) ; ++i)
            {
            c=sk_SSL_CIPHER_value(clnt,i);
-           printf("%p:%s\n",c,c->name);
+           printf("%p:%s\n",(void *)c,c->name);
            }
 #endif
 
        if (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE)
-           {
-           prio = srvr;
-           allow = clnt;
-           }
+               {
+               prio = srvr;
+               allow = clnt;
+               }
        else
-           {
-           prio = clnt;
-           allow = srvr;
-           }
+               {
+               prio = clnt;
+               allow = srvr;
+               }
 
        for (i=0; i<sk_SSL_CIPHER_num(prio); i++)
                {
@@ -2532,11 +2725,11 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
                alg_a=c->algorithm_auth;
 
 #ifndef OPENSSL_NO_KRB5
-                if (alg_k & SSL_kKRB5)
-                        {
-                        if ( !kssl_keytab_is_available(s->kssl_ctx) )
-                            continue;
-                        }
+               if (alg_k & SSL_kKRB5)
+                       {
+                       if ( !kssl_keytab_is_available(s->kssl_ctx) )
+                           continue;
+                       }
 #endif /* OPENSSL_NO_KRB5 */
 #ifndef OPENSSL_NO_PSK
                /* with PSK there must be server callback set */
@@ -2549,14 +2742,14 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
                        ok = (alg_k & emask_k) && (alg_a & emask_a);
 #ifdef CIPHER_DEBUG
                        printf("%d:[%08lX:%08lX:%08lX:%08lX]%p:%s (export)\n",ok,alg_k,alg_a,emask_k,emask_a,
-                              c,c->name);
+                              (void *)c,c->name);
 #endif
                        }
                else
                        {
                        ok = (alg_k & mask_k) && (alg_a & mask_a);
 #ifdef CIPHER_DEBUG
-                       printf("%d:[%08lX:%08lX:%08lX:%08lX]%p:%s\n",ok,alg_k,alg_a,mask_k,mask_a,c,
+                       printf("%d:[%08lX:%08lX:%08lX:%08lX]%p:%s\n",ok,alg_k,alg_a,mask_k,mask_a,(void *)c,
                               c->name);
 #endif
                        }