IDEA is not supported in TLS 1.2

[openssl.git] / ssl / s3_lib.c

diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index 8f6eda2c719ad31335045b4182099687cbdf5f9e..c779ea76c312d197b5ff36a0f2e89a8844fda1bc 100644 (file)
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -171,8 +171,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_eNULL,
      SSL_MD5,
-     SSL_SSLV3,
-     SSL_NOT_DEFAULT | SSL_STRONG_NONE,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_STRONG_NONE,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      0,
      0,
@@ -187,14 +188,16 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_eNULL,
      SSL_SHA1,
-     SSL_SSLV3,
-     SSL_NOT_DEFAULT | SSL_STRONG_NONE | SSL_FIPS,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_STRONG_NONE | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      0,
      0,
      },
 
 /* Cipher 04 */
+#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
     {
      1,
      SSL3_TXT_RSA_RC4_128_MD5,
@@ -203,7 +206,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_RC4,
      SSL_MD5,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_NOT_DEFAULT | SSL_MEDIUM,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
@@ -219,12 +223,14 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_RC4,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_NOT_DEFAULT | SSL_MEDIUM,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
      128,
      },
+#endif
 
 /* Cipher 07 */
 #ifndef OPENSSL_NO_IDEA
@@ -236,8 +242,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_IDEA,
      SSL_SHA1,
-     SSL_SSLV3,
-     SSL_MEDIUM,
+     SSL3_VERSION, TLS1_1_VERSION,
+     DTLS1_VERSION, DTLS1_VERSION,
+     SSL_NOT_DEFAULT | SSL_MEDIUM,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
      128,
@@ -253,7 +260,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_3DES,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      112,
@@ -269,8 +277,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aDSS,
      SSL_3DES,
      SSL_SHA1,
-     SSL_SSLV3,
-     SSL_HIGH | SSL_FIPS,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      112,
      168,
@@ -285,7 +294,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_3DES,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      112,
@@ -293,6 +303,7 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      },
 
 /* Cipher 18 */
+#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
     {
      1,
      SSL3_TXT_ADH_RC4_128_MD5,
@@ -301,12 +312,14 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aNULL,
      SSL_RC4,
      SSL_MD5,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_NOT_DEFAULT | SSL_MEDIUM,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
      128,
      },
+#endif
 
 /* Cipher 1B */
     {
@@ -317,7 +330,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aNULL,
      SSL_3DES,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      112,
@@ -333,8 +347,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_eNULL,
      SSL_SHA1,
-     SSL_SSLV3,
-     SSL_NOT_DEFAULT | SSL_STRONG_NONE | SSL_FIPS,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_STRONG_NONE | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      0,
      0,
@@ -348,8 +363,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_eNULL,
      SSL_SHA1,
-     SSL_SSLV3,
-     SSL_NOT_DEFAULT | SSL_STRONG_NONE | SSL_FIPS,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_STRONG_NONE | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      0,
      0,
@@ -363,8 +379,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_eNULL,
      SSL_SHA1,
-     SSL_SSLV3,
-     SSL_NOT_DEFAULT | SSL_STRONG_NONE | SSL_FIPS,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_STRONG_NONE | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      0,
      0,
@@ -381,7 +398,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES128,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
@@ -396,8 +414,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aDSS,
      SSL_AES128,
      SSL_SHA1,
-     SSL_SSLV3,
-     SSL_HIGH | SSL_FIPS,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
      128,
@@ -411,7 +430,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES128,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
@@ -426,7 +446,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aNULL,
      SSL_AES128,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
@@ -442,7 +463,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES256,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      256,
@@ -458,8 +480,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aDSS,
      SSL_AES256,
      SSL_SHA1,
-     SSL_SSLV3,
-     SSL_HIGH | SSL_FIPS,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      256,
      256,
@@ -474,7 +497,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES256,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      256,
@@ -490,7 +514,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aNULL,
      SSL_AES256,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      256,
@@ -507,8 +532,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_eNULL,
      SSL_SHA256,
-     SSL_TLSV1_2,
-     SSL_NOT_DEFAULT | SSL_STRONG_NONE | SSL_FIPS,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_STRONG_NONE | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      0,
      0,
@@ -523,7 +549,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES128,
      SSL_SHA256,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
@@ -539,7 +566,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES256,
      SSL_SHA256,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      256,
@@ -555,8 +583,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aDSS,
      SSL_AES128,
      SSL_SHA256,
-     SSL_TLSV1_2,
-     SSL_HIGH | SSL_FIPS,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
      128,
@@ -574,8 +603,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_CAMELLIA128,
      SSL_SHA1,
-     SSL_SSLV3,
-     SSL_HIGH,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
      128,
@@ -590,8 +620,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aDSS,
      SSL_CAMELLIA128,
      SSL_SHA1,
-     SSL_SSLV3,
-     SSL_HIGH,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
      128,
@@ -606,8 +637,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_CAMELLIA128,
      SSL_SHA1,
-     SSL_SSLV3,
-     SSL_HIGH,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
      128,
@@ -622,7 +654,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aNULL,
      SSL_CAMELLIA128,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
@@ -640,7 +673,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES128,
      SSL_SHA256,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
@@ -656,8 +690,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aDSS,
      SSL_AES256,
      SSL_SHA256,
-     SSL_TLSV1_2,
-     SSL_HIGH | SSL_FIPS,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      256,
      256,
@@ -672,7 +707,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES256,
      SSL_SHA256,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      256,
@@ -688,7 +724,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aNULL,
      SSL_AES128,
      SSL_SHA256,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
@@ -704,7 +741,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aNULL,
      SSL_AES256,
      SSL_SHA256,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      256,
@@ -721,7 +759,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aGOST01,
      SSL_eGOST2814789CNT,
      SSL_GOST89MAC,
-     SSL_TLSV1,
+     TLS1_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH,
      SSL_HANDSHAKE_MAC_GOST94 | TLS1_PRF_GOST94 | TLS1_STREAM_MAC,
      256,
@@ -735,8 +774,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aGOST01,
      SSL_eNULL,
      SSL_GOST94,
-     SSL_TLSV1,
-     SSL_NOT_DEFAULT | SSL_STRONG_NONE,
+     TLS1_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_STRONG_NONE,
      SSL_HANDSHAKE_MAC_GOST94 | TLS1_PRF_GOST94,
      0,
      0
@@ -754,8 +794,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_CAMELLIA256,
      SSL_SHA1,
-     SSL_SSLV3,
-     SSL_HIGH,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      256,
      256,
@@ -770,8 +811,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aDSS,
      SSL_CAMELLIA256,
      SSL_SHA1,
-     SSL_SSLV3,
-     SSL_HIGH,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      256,
      256,
@@ -786,8 +828,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_CAMELLIA256,
      SSL_SHA1,
-     SSL_SSLV3,
-     SSL_HIGH,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      256,
      256,
@@ -802,7 +845,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aNULL,
      SSL_CAMELLIA256,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      256,
@@ -813,6 +857,7 @@ static const SSL_CIPHER ssl3_ciphers[] = {
 #ifndef OPENSSL_NO_PSK
     /* PSK ciphersuites from RFC 4279 */
     /* Cipher 8A */
+#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
     {
      1,
      TLS1_TXT_PSK_WITH_RC4_128_SHA,
@@ -821,12 +866,14 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_RC4,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_NOT_DEFAULT | SSL_MEDIUM,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
      128,
      },
+#endif
 
     /* Cipher 8B */
     {
@@ -837,7 +884,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_3DES,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      112,
@@ -853,7 +901,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_AES128,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
@@ -869,7 +918,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_AES256,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      256,
@@ -877,6 +927,7 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      },
 
     /* Cipher 8E */
+#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
     {
      1,
      TLS1_TXT_DHE_PSK_WITH_RC4_128_SHA,
@@ -885,12 +936,14 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_RC4,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_NOT_DEFAULT | SSL_MEDIUM,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
      128,
      },
+#endif
 
     /* Cipher 8F */
     {
@@ -901,7 +954,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_3DES,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      112,
@@ -917,7 +971,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_AES128,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
@@ -933,7 +988,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_AES256,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      256,
@@ -941,6 +997,7 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      },
 
     /* Cipher 92 */
+#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
     {
      1,
      TLS1_TXT_RSA_PSK_WITH_RC4_128_SHA,
@@ -949,12 +1006,14 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_RC4,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_NOT_DEFAULT | SSL_MEDIUM,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
      128,
      },
+#endif
 
     /* Cipher 93 */
     {
@@ -965,7 +1024,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_3DES,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      112,
@@ -981,7 +1041,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES128,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
@@ -997,7 +1058,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES256,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      256,
@@ -1017,8 +1079,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_SEED,
      SSL_SHA1,
-     SSL_SSLV3,
-     SSL_MEDIUM,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_MEDIUM,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
      128,
@@ -1033,8 +1096,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aDSS,
      SSL_SEED,
      SSL_SHA1,
-     SSL_SSLV3,
-     SSL_MEDIUM,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_MEDIUM,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
      128,
@@ -1049,8 +1113,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_SEED,
      SSL_SHA1,
-     SSL_SSLV3,
-     SSL_MEDIUM,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_MEDIUM,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
      128,
@@ -1065,7 +1130,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aNULL,
      SSL_SEED,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_NOT_DEFAULT | SSL_MEDIUM,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
@@ -1085,7 +1151,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES128GCM,
      SSL_AEAD,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      128,
@@ -1101,7 +1168,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES256GCM,
      SSL_AEAD,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
      256,
@@ -1117,7 +1185,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES128GCM,
      SSL_AEAD,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      128,
@@ -1133,7 +1202,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES256GCM,
      SSL_AEAD,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
      256,
@@ -1149,8 +1219,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aDSS,
      SSL_AES128GCM,
      SSL_AEAD,
-     SSL_TLSV1_2,
-     SSL_HIGH | SSL_FIPS,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      128,
      128,
@@ -1165,8 +1236,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aDSS,
      SSL_AES256GCM,
      SSL_AEAD,
-     SSL_TLSV1_2,
-     SSL_HIGH | SSL_FIPS,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
      256,
      256,
@@ -1181,7 +1253,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aNULL,
      SSL_AES128GCM,
      SSL_AEAD,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      128,
@@ -1197,7 +1270,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aNULL,
      SSL_AES256GCM,
      SSL_AEAD,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
      256,
@@ -1215,7 +1289,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_AES128GCM,
      SSL_AEAD,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      128,
@@ -1231,7 +1306,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_AES256GCM,
      SSL_AEAD,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
      256,
@@ -1247,7 +1323,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_AES128GCM,
      SSL_AEAD,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      128,
@@ -1263,7 +1340,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_AES256GCM,
      SSL_AEAD,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
      256,
@@ -1279,7 +1357,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES128GCM,
      SSL_AEAD,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      128,
@@ -1295,7 +1374,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES256GCM,
      SSL_AEAD,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
      256,
@@ -1311,7 +1391,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_AES128,
      SSL_SHA256,
-     SSL_TLSV1,
+     TLS1_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
@@ -1327,7 +1408,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_AES256,
      SSL_SHA384,
-     SSL_TLSV1,
+     TLS1_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
      256,
@@ -1343,8 +1425,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_eNULL,
      SSL_SHA256,
-     SSL_TLSV1,
-     SSL_NOT_DEFAULT | SSL_STRONG_NONE | SSL_FIPS,
+     TLS1_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_STRONG_NONE | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      0,
      0,
@@ -1359,8 +1442,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_eNULL,
      SSL_SHA384,
-     SSL_TLSV1,
-     SSL_NOT_DEFAULT | SSL_STRONG_NONE | SSL_FIPS,
+     TLS1_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_STRONG_NONE | SSL_FIPS,
      SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
      0,
      0,
@@ -1375,7 +1459,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_AES128,
      SSL_SHA256,
-     SSL_TLSV1,
+     TLS1_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
@@ -1391,7 +1476,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_AES256,
      SSL_SHA384,
-     SSL_TLSV1,
+     TLS1_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
      256,
@@ -1407,8 +1493,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_eNULL,
      SSL_SHA256,
-     SSL_TLSV1,
-     SSL_NOT_DEFAULT | SSL_STRONG_NONE | SSL_FIPS,
+     TLS1_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_STRONG_NONE | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      0,
      0,
@@ -1423,8 +1510,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_eNULL,
      SSL_SHA384,
-     SSL_TLSV1,
-     SSL_NOT_DEFAULT | SSL_STRONG_NONE | SSL_FIPS,
+     TLS1_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_STRONG_NONE | SSL_FIPS,
      SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
      0,
      0,
@@ -1439,7 +1527,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES128,
      SSL_SHA256,
-     SSL_TLSV1,
+     TLS1_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
@@ -1455,7 +1544,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES256,
      SSL_SHA384,
-     SSL_TLSV1,
+     TLS1_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
      256,
@@ -1471,8 +1561,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_eNULL,
      SSL_SHA256,
-     SSL_TLSV1,
-     SSL_NOT_DEFAULT | SSL_STRONG_NONE | SSL_FIPS,
+     TLS1_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_STRONG_NONE | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      0,
      0,
@@ -1487,8 +1578,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_eNULL,
      SSL_SHA384,
-     SSL_TLSV1,
-     SSL_NOT_DEFAULT | SSL_STRONG_NONE | SSL_FIPS,
+     TLS1_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_STRONG_NONE | SSL_FIPS,
      SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
      0,
      0,
@@ -1507,8 +1599,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_CAMELLIA128,
      SSL_SHA256,
-     SSL_TLSV1_2,
-     SSL_HIGH,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      128,
      128,
@@ -1523,8 +1616,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aDSS,
      SSL_CAMELLIA128,
      SSL_SHA256,
-     SSL_TLSV1_2,
-     SSL_HIGH,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      128,
      128,
@@ -1539,8 +1633,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_CAMELLIA128,
      SSL_SHA256,
-     SSL_TLSV1_2,
-     SSL_HIGH,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      128,
      128,
@@ -1555,7 +1650,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aNULL,
      SSL_CAMELLIA128,
      SSL_SHA256,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      128,
@@ -1571,8 +1667,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_CAMELLIA256,
      SSL_SHA256,
-     SSL_TLSV1_2,
-     SSL_HIGH,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      256,
      256,
@@ -1587,8 +1684,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aDSS,
      SSL_CAMELLIA256,
      SSL_SHA256,
-     SSL_TLSV1_2,
-     SSL_HIGH,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      256,
      256,
@@ -1603,8 +1701,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_CAMELLIA256,
      SSL_SHA256,
-     SSL_TLSV1_2,
-     SSL_HIGH,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      256,
      256,
@@ -1619,7 +1718,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aNULL,
      SSL_CAMELLIA256,
      SSL_SHA256,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      256,
@@ -1627,23 +1727,6 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      },
 #endif
 
-#ifdef OPENSSL_SSL_DEBUG_BROKEN_PROTOCOL
-    /* Cipher FF */
-    {
-     1,
-     "SCSV",
-     SSL3_CK_SCSV,
-     0,
-     0,
-     0,
-     0,
-     0,
-     0,
-     0,
-     0,
-     0},
-#endif
-
 #ifndef OPENSSL_NO_EC
 
     /* Cipher C006 */
@@ -1655,14 +1738,16 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aECDSA,
      SSL_eNULL,
      SSL_SHA1,
-     SSL_SSLV3,
-     SSL_NOT_DEFAULT | SSL_STRONG_NONE | SSL_FIPS,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_STRONG_NONE | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      0,
      0,
      },
 
     /* Cipher C007 */
+#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
     {
      1,
      TLS1_TXT_ECDHE_ECDSA_WITH_RC4_128_SHA,
@@ -1671,12 +1756,14 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aECDSA,
      SSL_RC4,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_NOT_DEFAULT | SSL_MEDIUM,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
      128,
      },
+#endif
 
     /* Cipher C008 */
     {
@@ -1687,7 +1774,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aECDSA,
      SSL_3DES,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      112,
@@ -1703,7 +1791,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aECDSA,
      SSL_AES128,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
@@ -1719,7 +1808,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aECDSA,
      SSL_AES256,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      256,
@@ -1735,14 +1825,16 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_eNULL,
      SSL_SHA1,
-     SSL_SSLV3,
-     SSL_NOT_DEFAULT | SSL_STRONG_NONE | SSL_FIPS,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_STRONG_NONE | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      0,
      0,
      },
 
     /* Cipher C011 */
+#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
     {
      1,
      TLS1_TXT_ECDHE_RSA_WITH_RC4_128_SHA,
@@ -1751,12 +1843,14 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_RC4,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_NOT_DEFAULT | SSL_MEDIUM,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
      128,
      },
+#endif
 
     /* Cipher C012 */
     {
@@ -1767,7 +1861,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_3DES,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      112,
@@ -1783,7 +1878,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES128,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
@@ -1799,7 +1895,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES256,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      256,
@@ -1815,14 +1912,16 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aNULL,
      SSL_eNULL,
      SSL_SHA1,
-     SSL_SSLV3,
-     SSL_NOT_DEFAULT | SSL_STRONG_NONE | SSL_FIPS,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_STRONG_NONE | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      0,
      0,
      },
 
     /* Cipher C016 */
+#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
     {
      1,
      TLS1_TXT_ECDH_anon_WITH_RC4_128_SHA,
@@ -1831,12 +1930,14 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aNULL,
      SSL_RC4,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_NOT_DEFAULT | SSL_MEDIUM,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
      128,
      },
+#endif
 
     /* Cipher C017 */
     {
@@ -1847,7 +1948,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aNULL,
      SSL_3DES,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      112,
@@ -1863,7 +1965,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aNULL,
      SSL_AES128,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
@@ -1879,7 +1982,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aNULL,
      SSL_AES256,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_NOT_DEFAULT | SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      256,
@@ -1897,7 +2001,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aSRP,
      SSL_3DES,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      112,
@@ -1913,7 +2018,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_3DES,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      112,
@@ -1929,8 +2035,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aDSS,
      SSL_3DES,
      SSL_SHA1,
-     SSL_SSLV3,
-     SSL_HIGH,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      112,
      168,
@@ -1945,7 +2052,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aSRP,
      SSL_AES128,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
@@ -1961,7 +2069,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES128,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
@@ -1977,8 +2086,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aDSS,
      SSL_AES128,
      SSL_SHA1,
-     SSL_SSLV3,
-     SSL_HIGH,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
      128,
@@ -1993,7 +2103,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aSRP,
      SSL_AES256,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      256,
@@ -2009,7 +2120,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES256,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      256,
@@ -2025,8 +2137,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aDSS,
      SSL_AES256,
      SSL_SHA1,
-     SSL_SSLV3,
-     SSL_HIGH,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      256,
      256,
@@ -2045,7 +2158,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aECDSA,
      SSL_AES128,
      SSL_SHA256,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      128,
@@ -2061,7 +2175,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aECDSA,
      SSL_AES256,
      SSL_SHA384,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
      256,
@@ -2078,7 +2193,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES128,
      SSL_SHA256,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      128,
@@ -2094,7 +2210,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES256,
      SSL_SHA384,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
      256,
@@ -2112,7 +2229,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aECDSA,
      SSL_AES128GCM,
      SSL_AEAD,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      128,
@@ -2128,7 +2246,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aECDSA,
      SSL_AES256GCM,
      SSL_AEAD,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
      256,
@@ -2144,7 +2263,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES128GCM,
      SSL_AEAD,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      128,
@@ -2160,7 +2280,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES256GCM,
      SSL_AEAD,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
      256,
@@ -2169,6 +2290,7 @@ static const SSL_CIPHER ssl3_ciphers[] = {
 
     /* PSK ciphersuites from RFC 5489 */
     /* Cipher C033 */
+#ifndef OPENSSL_NO_WEAK_SSL_CIPHERS
     {
      1,
      TLS1_TXT_ECDHE_PSK_WITH_RC4_128_SHA,
@@ -2177,12 +2299,14 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_RC4,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_NOT_DEFAULT | SSL_MEDIUM,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
      128,
      },
+#endif
 
     /* Cipher C034 */
     {
@@ -2193,7 +2317,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_3DES,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      112,
@@ -2209,7 +2334,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_AES128,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
@@ -2225,7 +2351,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_AES256,
      SSL_SHA1,
-     SSL_SSLV3,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      256,
@@ -2241,7 +2368,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_AES128,
      SSL_SHA256,
-     SSL_TLSV1,
+     TLS1_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
@@ -2257,7 +2385,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_AES256,
      SSL_SHA384,
-     SSL_TLSV1,
+     TLS1_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH | SSL_FIPS,
      SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
      256,
@@ -2273,8 +2402,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_eNULL,
      SSL_SHA1,
-     SSL_SSLV3,
-     SSL_NOT_DEFAULT | SSL_STRONG_NONE | SSL_FIPS,
+     SSL3_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_STRONG_NONE | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      0,
      0,
@@ -2289,8 +2419,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_eNULL,
      SSL_SHA256,
-     SSL_TLSV1,
-     SSL_NOT_DEFAULT | SSL_STRONG_NONE | SSL_FIPS,
+     TLS1_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_STRONG_NONE | SSL_FIPS,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      0,
      0,
@@ -2305,8 +2436,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_eNULL,
      SSL_SHA384,
-     SSL_TLSV1,
-     SSL_NOT_DEFAULT | SSL_STRONG_NONE | SSL_FIPS,
+     TLS1_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_STRONG_NONE | SSL_FIPS,
      SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
      0,
      0,
@@ -2321,8 +2453,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aECDSA,
      SSL_CAMELLIA128,
      SSL_SHA256,
-     SSL_TLSV1_2,
-     SSL_HIGH,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      128,
      128},
@@ -2335,8 +2468,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aECDSA,
      SSL_CAMELLIA256,
      SSL_SHA384,
-     SSL_TLSV1_2,
-     SSL_HIGH,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
      256,
      256},
@@ -2349,8 +2483,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_CAMELLIA128,
      SSL_SHA256,
-     SSL_TLSV1_2,
-     SSL_HIGH,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      128,
      128},
@@ -2363,8 +2498,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_CAMELLIA256,
      SSL_SHA384,
-     SSL_TLSV1_2,
-     SSL_HIGH,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
      256,
      256},
@@ -2381,8 +2517,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_CAMELLIA128,
      SSL_SHA256,
-     SSL_TLSV1,
-     SSL_HIGH,
+     TLS1_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
      128},
@@ -2395,8 +2532,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_CAMELLIA256,
      SSL_SHA384,
-     SSL_TLSV1,
-     SSL_HIGH,
+     TLS1_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
      256,
      256},
@@ -2409,8 +2547,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_CAMELLIA128,
      SSL_SHA256,
-     SSL_TLSV1,
-     SSL_HIGH,
+     TLS1_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
      128},
@@ -2423,8 +2562,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_CAMELLIA256,
      SSL_SHA384,
-     SSL_TLSV1,
-     SSL_HIGH,
+     TLS1_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
      256,
      256},
@@ -2437,8 +2577,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_CAMELLIA128,
      SSL_SHA256,
-     SSL_TLSV1,
-     SSL_HIGH,
+     TLS1_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
      128},
@@ -2451,8 +2592,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_CAMELLIA256,
      SSL_SHA384,
-     SSL_TLSV1,
-     SSL_HIGH,
+     TLS1_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
      256,
      256},
@@ -2465,8 +2607,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_CAMELLIA128,
      SSL_SHA256,
-     SSL_TLSV1,
-     SSL_HIGH,
+     TLS1_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_DEFAULT | TLS1_PRF,
      128,
      128},
@@ -2479,8 +2622,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_CAMELLIA256,
      SSL_SHA384,
-     SSL_TLSV1,
-     SSL_HIGH,
+     TLS1_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA384 | TLS1_PRF_SHA384,
      256,
      256},
@@ -2495,8 +2639,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES128CCM,
      SSL_AEAD,
-     SSL_TLSV1_2,
-     SSL_HIGH,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      128,
      128,
@@ -2511,8 +2656,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES256CCM,
      SSL_AEAD,
-     SSL_TLSV1_2,
-     SSL_HIGH,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      256,
      256,
@@ -2527,8 +2673,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES128CCM,
      SSL_AEAD,
-     SSL_TLSV1_2,
-     SSL_HIGH,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      128,
      128,
@@ -2543,8 +2690,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES256CCM,
      SSL_AEAD,
-     SSL_TLSV1_2,
-     SSL_HIGH,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      256,
      256,
@@ -2559,8 +2707,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES128CCM8,
      SSL_AEAD,
-     SSL_TLSV1_2,
-     SSL_HIGH,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      128,
      128,
@@ -2575,8 +2724,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES256CCM8,
      SSL_AEAD,
-     SSL_TLSV1_2,
-     SSL_HIGH,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      256,
      256,
@@ -2591,8 +2741,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES128CCM8,
      SSL_AEAD,
-     SSL_TLSV1_2,
-     SSL_HIGH,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      128,
      128,
@@ -2607,8 +2758,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_AES256CCM8,
      SSL_AEAD,
-     SSL_TLSV1_2,
-     SSL_HIGH,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      256,
      256,
@@ -2623,8 +2775,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_AES128CCM,
      SSL_AEAD,
-     SSL_TLSV1_2,
-     SSL_HIGH,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      128,
      128,
@@ -2639,8 +2792,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_AES256CCM,
      SSL_AEAD,
-     SSL_TLSV1_2,
-     SSL_HIGH,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      256,
      256,
@@ -2655,8 +2809,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_AES128CCM,
      SSL_AEAD,
-     SSL_TLSV1_2,
-     SSL_HIGH,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      128,
      128,
@@ -2671,8 +2826,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_AES256CCM,
      SSL_AEAD,
-     SSL_TLSV1_2,
-     SSL_HIGH,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      256,
      256,
@@ -2687,8 +2843,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_AES128CCM8,
      SSL_AEAD,
-     SSL_TLSV1_2,
-     SSL_HIGH,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      128,
      128,
@@ -2703,8 +2860,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_AES256CCM8,
      SSL_AEAD,
-     SSL_TLSV1_2,
-     SSL_HIGH,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      256,
      256,
@@ -2719,8 +2877,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_AES128CCM8,
      SSL_AEAD,
-     SSL_TLSV1_2,
-     SSL_HIGH,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      128,
      128,
@@ -2735,8 +2894,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_AES256CCM8,
      SSL_AEAD,
-     SSL_TLSV1_2,
-     SSL_HIGH,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      256,
      256,
@@ -2751,8 +2911,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aECDSA,
      SSL_AES128CCM,
      SSL_AEAD,
-     SSL_TLSV1_2,
-     SSL_HIGH,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      128,
      128,
@@ -2767,8 +2928,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aECDSA,
      SSL_AES256CCM,
      SSL_AEAD,
-     SSL_TLSV1_2,
-     SSL_HIGH,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      256,
      256,
@@ -2783,8 +2945,9 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aECDSA,
      SSL_AES128CCM8,
      SSL_AEAD,
-     SSL_TLSV1_2,
-     SSL_HIGH,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      128,
      128,
@@ -2799,15 +2962,16 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aECDSA,
      SSL_AES256CCM8,
      SSL_AEAD,
-     SSL_TLSV1_2,
-     SSL_HIGH,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
+     SSL_NOT_DEFAULT | SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      256,
      256,
      },
 #if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305)
 # ifndef OPENSSL_NO_EC
-    /* Cipher CCA8 as per draft-ietf-tls-chacha20-poly1305-03 */
+    /* Cipher CCA8 */
     {
      1,
      TLS1_TXT_ECDHE_RSA_WITH_CHACHA20_POLY1305,
@@ -2816,7 +2980,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_CHACHA20POLY1305,
      SSL_AEAD,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      256,
@@ -2831,7 +2996,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aECDSA,
      SSL_CHACHA20POLY1305,
      SSL_AEAD,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      256,
@@ -2848,7 +3014,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_CHACHA20POLY1305,
      SSL_AEAD,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      256,
@@ -2865,7 +3032,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_CHACHA20POLY1305,
      SSL_AEAD,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      256,
@@ -2880,7 +3048,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_CHACHA20POLY1305,
      SSL_AEAD,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      256,
@@ -2895,7 +3064,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aPSK,
      SSL_CHACHA20POLY1305,
      SSL_AEAD,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      256,
@@ -2910,7 +3080,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aRSA,
      SSL_CHACHA20POLY1305,
      SSL_AEAD,
-     SSL_TLSV1_2,
+     TLS1_2_VERSION, TLS1_2_VERSION,
+     DTLS1_2_VERSION, DTLS1_2_VERSION,
      SSL_HIGH,
      SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
      256,
@@ -2927,7 +3098,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aGOST12 | SSL_aGOST01,
      SSL_eGOST2814789CNT12,
      SSL_GOST89MAC12,
-     SSL_TLSV1,
+     TLS1_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_HIGH,
      SSL_HANDSHAKE_MAC_GOST12_256 | TLS1_PRF_GOST12_256 | TLS1_STREAM_MAC,
      256,
@@ -2940,7 +3112,8 @@ static const SSL_CIPHER ssl3_ciphers[] = {
      SSL_aGOST12 | SSL_aGOST01,
      SSL_eNULL,
      SSL_GOST12_256,
-     SSL_TLSV1,
+     TLS1_VERSION, TLS1_2_VERSION,
+     DTLS1_VERSION, DTLS1_2_VERSION,
      SSL_STRONG_NONE,
      SSL_HANDSHAKE_MAC_GOST12_256 | TLS1_PRF_GOST12_256 | TLS1_STREAM_MAC,
      0,
@@ -3046,6 +3219,7 @@ void ssl3_free(SSL *s)
     OPENSSL_free(s->s3->tmp.peer_sigalgs);
     ssl3_free_digest_list(s);
     OPENSSL_free(s->s3->alpn_selected);
+    OPENSSL_free(s->s3->alpn_proposed);
 
 #ifndef OPENSSL_NO_SRP
     SSL_SRP_CTX_free(s);
@@ -3059,37 +3233,24 @@ void ssl3_clear(SSL *s)
     ssl3_cleanup_key_block(s);
     sk_X509_NAME_pop_free(s->s3->tmp.ca_names, X509_NAME_free);
     OPENSSL_free(s->s3->tmp.ciphers_raw);
-    s->s3->tmp.ciphers_raw = NULL;
     OPENSSL_clear_free(s->s3->tmp.pms, s->s3->tmp.pmslen);
-    s->s3->tmp.pms = NULL;
     OPENSSL_free(s->s3->tmp.peer_sigalgs);
-    s->s3->tmp.peer_sigalgs = NULL;
 
-#ifndef OPENSSL_NO_EC
-    s->s3->is_probably_safari = 0;
-#endif
 #if !defined(OPENSSL_NO_EC) || !defined(OPENSSL_NO_DH)
     EVP_PKEY_free(s->s3->tmp.pkey);
-    s->s3->tmp.pkey = NULL;
     EVP_PKEY_free(s->s3->peer_tmp);
-    s->s3->peer_tmp = NULL;
 #endif                         /* !OPENSSL_NO_EC */
 
     ssl3_free_digest_list(s);
 
-    if (s->s3->alpn_selected) {
-        OPENSSL_free(s->s3->alpn_selected);
-        s->s3->alpn_selected = NULL;
-    }
+    OPENSSL_free(s->s3->alpn_selected);
+    OPENSSL_free(s->s3->alpn_proposed);
 
+    /* NULL/zero-out everything in the s3 struct */
     memset(s->s3, 0, sizeof(*s->s3));
 
     ssl_free_wbio_buffer(s);
 
-    s->s3->renegotiate = 0;
-    s->s3->total_renegotiations = 0;
-    s->s3->num_renegotiations = 0;
-    s->s3->in_read_app_data = 0;
     s->version = SSL3_VERSION;
 
 #if !defined(OPENSSL_NO_NEXTPROTONEG)
@@ -3743,10 +3904,6 @@ const SSL_CIPHER *ssl3_get_cipher_by_char(const unsigned char *p)
     id = 0x03000000 | ((uint32_t)p[0] << 8L) | (uint32_t)p[1];
     c.id = id;
     cp = OBJ_bsearch_ssl_cipher_id(&c, ssl3_ciphers, SSL3_NUM_CIPHERS);
-#ifdef DEBUG_PRINT_UNKNOWN_CIPHERSUITES
-    if (cp == NULL)
-        fprintf(stderr, "Unknown cipher ID %x\n", (p[0] << 8) | p[1]);
-#endif
     return cp;
 }
 
@@ -3764,6 +3921,14 @@ int ssl3_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p)
     return (2);
 }
 
+/*
+ * ssl3_choose_cipher - choose a cipher from those offered by the client
+ * @s: SSL connection
+ * @clnt: ciphers offered by the client
+ * @srvr: ciphers enabled on the server?
+ *
+ * Returns the selected cipher or NULL when no common ciphers.
+ */
 const SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
                                STACK_OF(SSL_CIPHER) *srvr)
 {
@@ -3809,18 +3974,20 @@ const SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
     }
 
     tls1_set_cert_validity(s);
+    ssl_set_masks(s);
 
     for (i = 0; i < sk_SSL_CIPHER_num(prio); i++) {
         c = sk_SSL_CIPHER_value(prio, i);
 
-        /* Skip TLS v1.2 only ciphersuites if not supported */
-        if ((c->algorithm_ssl & SSL_TLSV1_2) && !SSL_USE_TLS1_2_CIPHERS(s))
+        /* Skip ciphers not supported by the protocol version */
+        if (!SSL_IS_DTLS(s) &&
+                ((s->version < c->min_tls) || (s->version > c->max_tls)))
             continue;
-        /* Skip TLS v1.0 ciphersuites if SSLv3 */
-        if ((c->algorithm_ssl & SSL_TLSV1) && s->version == SSL3_VERSION)
+        if (SSL_IS_DTLS(s) &&
+                (DTLS_VERSION_LT(s->version, c->min_dtls) ||
+                DTLS_VERSION_GT(s->version, c->max_dtls)))
             continue;
 
-        ssl_set_masks(s, c);
         mask_k = s->s3->tmp.mask_k;
         mask_a = s->s3->tmp.mask_a;
 #ifndef OPENSSL_NO_SRP