(draft-rescorla-tls-opaque-prf-input-00.txt), and do some cleanups and
bugfixes on the way.  In particular, this fixes the buffer bounds
checks in ssl_add_clienthello_tlsext() and in ssl_add_serverhello_tlsext().

Note that the opaque PRF Input TLS extension is not compiled by default;
see CHANGES.

for OpenSSL.

on failure. Keep output format consistent with previous versions.

Also flush stdout after printing ACCEPT in s_server.

Revert change in 1516 because it breaks Windows build. Use a modified version
of the headers from s_client.c which has used similar functionality without
any problems.

Only use streaming when appropriate for detached data in smime utility.

PR: 1503
Submitted by: KISA
Reviewed by: Bodo Moeller

options. Add new streaming i2d (though strictly speaking it is BER format
when streaming) and PEM functions.

These all process content on the fly without storing it all in memory.

terms of new API.

Submitted by Corinna Vinschen <vinschen@redhat.com>

Submitted by: ran@cryptocom.ru
Reviewed by: steve@openssl.org

BIO and BIO_gets().

EHLO or CAPABILITY handshake before sending STARTTLS

Submitted by: Goetz Babin-Ebell <goetz@shomitefo.de>

Submitted by Kees Cook <kees@outflux.net>