no status is notified even if no server extensions are present.

(which are pointless, but still might occur)

(draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and
bugfixes on the way.  In particular, this fixes the buffer bounds
checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext().

Note that the opaque PRF Input TLS extension is not compiled by default;
see CHANGES.

for OpenSSL.

This change resolves a number of problems and obviates multiple kludges.
A new feature is that you can now say "AES256" or "AES128" (not just
"AES", which enables both).

In some cases the ciphersuite list generated from a given string is
affected by this change.  I hope this is just in those cases where the
previous behaviour did not make sense.

Submitted by: Peter Sylvester

Submitted by: Peter Sylvester
Reviewed by: Bodo Moeller

Submitted by: Kaspar Brand, Peter Sylvester

Submitted by: Douglas Stebila

PR: 1293

than zero will only result in pissing of some compilers...

unsigned...

Submitted by: Douglas Stebila

Submitted by: Douglas Stebila

Submitted by: Peter Sylvester

Submitted by: Peter Sylvester

Submitted by: Peter Sylvester

 - fix indentation
 - rename some functions and macros
 - fix up confusion between SSL_ERROR_... and SSL_AD_... values

Submitted by: Peter Sylvester

for locking code. The CRYPTO_LOCK_SSL_METHOD lock is now no longer used.

designed for that.  This removes the potential error to mix data and
function pointers.

Please note that I'm a little unsure how incorrect calls to the old
ctrl functions should be handled, in som cases.  I currently return 0
and that's it, but it may be more correct to generate a genuine error
in those cases.

eliminate some of the -Wcast-qual warnings (debug-ben-strict target)