no status is notified even if no server extensions are present.

(which are pointless, but still might occur)

(draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and
bugfixes on the way.  In particular, this fixes the buffer bounds
checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext().

Note that the opaque PRF Input TLS extension is not compiled by default;
see CHANGES.

(engines/ccgost/ remains utter chaos, though; "make errors" is not happy.)

Fix additional gcc 4.2 value not used warnings.

and cast from pointer to int of different size (linux-x86_64 and align).

Submitted by: Victor B. Wagner <vitus@cryptocom.ru>

reuse the same tickets.

for OpenSSL.

PR: 1503
Submitted by: KISA
Reviewed by: Bodo Moeller

Submitted by: ran@cryptocom.ru
Reviewed by: steve@openssl.org

selection remodeling

Submitted by: Victor Duchovni

Change ssl_create_cipher_list() to prefer ephemeral ECDH over
ephemeral DH.

ciphersuite string such as "DEFAULT:RSA" cannot enable
authentication-only ciphersuites.

Also, change ssl_create_cipher_list() so that it no longer
starts with an arbitrary ciphersuite ordering, but instead
uses the logic that we previously had in SSL_DEFEAULT_CIPHER_LIST.
SSL_DEFAULT_CIPHER_LIST simplifies into just "ALL:!aNULL:!eNULL".