1 files changed, 320 insertions, 329 deletions

diff --git a/lib/libssl/ssl_cert.c b/lib/libssl/ssl_cert.c
index 1aaddc351f8..79eb4ee0313 100644
--- a/lib/libssl/ssl_cert.c
+++ b/lib/libssl/ssl_cert.c
@@ -132,36 +132,36 @@
 #include <openssl/bn.h>
 #include "ssl_locl.h"
 
-int SSL_get_ex_data_X509_STORE_CTX_idx(void)
-	{
-	static volatile int ssl_x509_store_ctx_idx= -1;
+int
+SSL_get_ex_data_X509_STORE_CTX_idx(void)
+{
+	static volatile int ssl_x509_store_ctx_idx = -1;
 	int got_write_lock = 0;
 
 	CRYPTO_r_lock(CRYPTO_LOCK_SSL_CTX);
 
-	if (ssl_x509_store_ctx_idx < 0)
-		{
+	if (ssl_x509_store_ctx_idx < 0) {
 		CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
 		CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
 		got_write_lock = 1;
-		
-		if (ssl_x509_store_ctx_idx < 0)
-			{
-			ssl_x509_store_ctx_idx=X509_STORE_CTX_get_ex_new_index(
-				0,"SSL for verify callback",NULL,NULL,NULL);
-			}
+
+		if (ssl_x509_store_ctx_idx < 0) {
+			ssl_x509_store_ctx_idx = X509_STORE_CTX_get_ex_new_index(
+			0, "SSL for verify callback", NULL, NULL, NULL);
 		}
+	}
 
 	if (got_write_lock)
 		CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
 	else
 		CRYPTO_r_unlock(CRYPTO_LOCK_SSL_CTX);
-	
+
 	return ssl_x509_store_ctx_idx;
-	}
+}
 
-static void ssl_cert_set_default_md(CERT *cert)
-	{
+static void
+ssl_cert_set_default_md(CERT *cert)
+{
 	/* Set digest values to defaults */
 #ifndef OPENSSL_NO_DSA
 	cert->pkeys[SSL_PKEY_DSA_SIGN].digest = EVP_sha1();
@@ -173,37 +173,37 @@ static void ssl_cert_set_default_md(CERT *cert)
 #ifndef OPENSSL_NO_ECDSA
 	cert->pkeys[SSL_PKEY_ECC].digest = EVP_sha1();
 #endif
-	}
+}
 
-CERT *ssl_cert_new(void)
-	{
+CERT
+*ssl_cert_new(void)
+{
 	CERT *ret;
 
-	ret=(CERT *)OPENSSL_malloc(sizeof(CERT));
-	if (ret == NULL)
-		{
-		SSLerr(SSL_F_SSL_CERT_NEW,ERR_R_MALLOC_FAILURE);
-		return(NULL);
-		}
-	memset(ret,0,sizeof(CERT));
+	ret = (CERT *)OPENSSL_malloc(sizeof(CERT));
+	if (ret == NULL) {
+		SSLerr(SSL_F_SSL_CERT_NEW, ERR_R_MALLOC_FAILURE);
+		return (NULL);
+	}
+	memset(ret, 0, sizeof(CERT));
 
-	ret->key= &(ret->pkeys[SSL_PKEY_RSA_ENC]);
-	ret->references=1;
+	ret->key = &(ret->pkeys[SSL_PKEY_RSA_ENC]);
+	ret->references = 1;
 	ssl_cert_set_default_md(ret);
-	return(ret);
-	}
+	return (ret);
+}
 
-CERT *ssl_cert_dup(CERT *cert)
-	{
+CERT
+*ssl_cert_dup(CERT *cert)
+{
 	CERT *ret;
 	int i;
 
 	ret = (CERT *)OPENSSL_malloc(sizeof(CERT));
-	if (ret == NULL)
-		{
+	if (ret == NULL) {
 		SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_MALLOC_FAILURE);
-		return(NULL);
-		}
+		return (NULL);
+	}
 
 	memset(ret, 0, sizeof(CERT));
 
@@ -218,77 +218,64 @@ CERT *ssl_cert_dup(CERT *cert)
 	ret->export_mask_a = cert->export_mask_a;
 
 #ifndef OPENSSL_NO_RSA
-	if (cert->rsa_tmp != NULL)
-		{
+	if (cert->rsa_tmp != NULL) {
 		RSA_up_ref(cert->rsa_tmp);
 		ret->rsa_tmp = cert->rsa_tmp;
-		}
+	}
 	ret->rsa_tmp_cb = cert->rsa_tmp_cb;
 #endif
 
 #ifndef OPENSSL_NO_DH
-	if (cert->dh_tmp != NULL)
-		{
+	if (cert->dh_tmp != NULL) {
 		ret->dh_tmp = DHparams_dup(cert->dh_tmp);
-		if (ret->dh_tmp == NULL)
-			{
+		if (ret->dh_tmp == NULL) {
 			SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_DH_LIB);
 			goto err;
-			}
-		if (cert->dh_tmp->priv_key)
-			{
+		}
+		if (cert->dh_tmp->priv_key) {
 			BIGNUM *b = BN_dup(cert->dh_tmp->priv_key);
-			if (!b)
-				{
+			if (!b) {
 				SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_BN_LIB);
 				goto err;
-				}
-			ret->dh_tmp->priv_key = b;
 			}
-		if (cert->dh_tmp->pub_key)
-			{
+			ret->dh_tmp->priv_key = b;
+		}
+		if (cert->dh_tmp->pub_key) {
 			BIGNUM *b = BN_dup(cert->dh_tmp->pub_key);
-			if (!b)
-				{
+			if (!b) {
 				SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_BN_LIB);
 				goto err;
-				}
-			ret->dh_tmp->pub_key = b;
 			}
+			ret->dh_tmp->pub_key = b;
 		}
+	}
 	ret->dh_tmp_cb = cert->dh_tmp_cb;
 #endif
 
 #ifndef OPENSSL_NO_ECDH
-	if (cert->ecdh_tmp)
-		{
+	if (cert->ecdh_tmp) {
 		ret->ecdh_tmp = EC_KEY_dup(cert->ecdh_tmp);
-		if (ret->ecdh_tmp == NULL)
-			{
+		if (ret->ecdh_tmp == NULL) {
 			SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_EC_LIB);
 			goto err;
-			}
 		}
+	}
 	ret->ecdh_tmp_cb = cert->ecdh_tmp_cb;
 #endif
 
-	for (i = 0; i < SSL_PKEY_NUM; i++)
-		{
-		if (cert->pkeys[i].x509 != NULL)
-			{
+	for (i = 0; i < SSL_PKEY_NUM; i++) {
+		if (cert->pkeys[i].x509 != NULL) {
 			ret->pkeys[i].x509 = cert->pkeys[i].x509;
 			CRYPTO_add(&ret->pkeys[i].x509->references, 1,
-				CRYPTO_LOCK_X509);
-			}
-		
-		if (cert->pkeys[i].privatekey != NULL)
-			{
+			CRYPTO_LOCK_X509);
+		}
+
+		if (cert->pkeys[i].privatekey != NULL) {
 			ret->pkeys[i].privatekey = cert->pkeys[i].privatekey;
 			CRYPTO_add(&ret->pkeys[i].privatekey->references, 1,
-				CRYPTO_LOCK_EVP_PKEY);
+			CRYPTO_LOCK_EVP_PKEY);
 
-			switch(i) 
-				{
+			switch (i) {
 				/* If there was anything special to do for
 				 * certain types of keys, we'd do it here.
 				 * (Nothing at the moment, I think.) */
@@ -297,11 +284,11 @@ CERT *ssl_cert_dup(CERT *cert)
 			case SSL_PKEY_RSA_SIGN:
 				/* We have an RSA key. */
 				break;
-				
+
 			case SSL_PKEY_DSA_SIGN:
 				/* We have a DSA key. */
 				break;
-				
+
 			case SSL_PKEY_DH_RSA:
 			case SSL_PKEY_DH_DSA:
 				/* We have a DH key. */
@@ -314,21 +301,21 @@ CERT *ssl_cert_dup(CERT *cert)
 			default:
 				/* Can't happen. */
 				SSLerr(SSL_F_SSL_CERT_DUP, SSL_R_LIBRARY_BUG);
-				}
 			}
 		}
-	
+	}
+
 	/* ret->extra_certs *should* exist, but currently the own certificate
 	 * chain is held inside SSL_CTX */
 
-	ret->references=1;
+	ret->references = 1;
 	/* Set digests to defaults. NB: we don't copy existing values as they
 	 * will be set during handshake.
 	 */
 	ssl_cert_set_default_md(ret);
 
-	return(ret);
-	
+	return (ret);
+
 #if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_ECDH)
 err:
 #endif
@@ -345,50 +332,52 @@ err:
 		EC_KEY_free(ret->ecdh_tmp);
 #endif
 
-	for (i = 0; i < SSL_PKEY_NUM; i++)
-		{
+	for (i = 0; i < SSL_PKEY_NUM; i++) {
 		if (ret->pkeys[i].x509 != NULL)
 			X509_free(ret->pkeys[i].x509);
 		if (ret->pkeys[i].privatekey != NULL)
 			EVP_PKEY_free(ret->pkeys[i].privatekey);
-		}
+	}
 
 	return NULL;
-	}
+}
 
 
-void ssl_cert_free(CERT *c)
-	{
+void
+ssl_cert_free(CERT *c)
+{
 	int i;
 
-	if(c == NULL)
-	    return;
+	if (c == NULL)
+		return;
 
-	i=CRYPTO_add(&c->references,-1,CRYPTO_LOCK_SSL_CERT);
+	i = CRYPTO_add(&c->references, -1, CRYPTO_LOCK_SSL_CERT);
 #ifdef REF_PRINT
-	REF_PRINT("CERT",c);
+	REF_PRINT("CERT", c);
 #endif
-	if (i > 0) return;
+	if (i > 0)
+		return;
 #ifdef REF_CHECK
-	if (i < 0)
-		{
-		fprintf(stderr,"ssl_cert_free, bad reference count\n");
+	if (i < 0) {
+		fprintf(stderr, "ssl_cert_free, bad reference count\n");
 		abort(); /* ok */
-		}
+	}
 #endif
 
 #ifndef OPENSSL_NO_RSA
-	if (c->rsa_tmp) RSA_free(c->rsa_tmp);
+	if (c->rsa_tmp)
+		RSA_free(c->rsa_tmp);
 #endif
 #ifndef OPENSSL_NO_DH
-	if (c->dh_tmp) DH_free(c->dh_tmp);
+	if (c->dh_tmp)
+		DH_free(c->dh_tmp);
 #endif
 #ifndef OPENSSL_NO_ECDH
-	if (c->ecdh_tmp) EC_KEY_free(c->ecdh_tmp);
+	if (c->ecdh_tmp)
+		EC_KEY_free(c->ecdh_tmp);
 #endif
 
-	for (i=0; i<SSL_PKEY_NUM; i++)
-		{
+	for (i = 0; i < SSL_PKEY_NUM; i++) {
 		if (c->pkeys[i].x509 != NULL)
 			X509_free(c->pkeys[i].x509);
 		if (c->pkeys[i].privatekey != NULL)
@@ -397,12 +386,13 @@ void ssl_cert_free(CERT *c)
 		if (c->pkeys[i].publickey != NULL)
 			EVP_PKEY_free(c->pkeys[i].publickey);
 #endif
-		}
-	OPENSSL_free(c);
 	}
+	OPENSSL_free(c);
+}
 
-int ssl_cert_inst(CERT **o)
-	{
+int
+ssl_cert_inst(CERT **o)
+{
 	/* Create a CERT if there isn't already one
 	 * (which cannot really happen, as it is initially created in
 	 * SSL_CTX_new; but the earlier code usually allows for that one
@@ -412,44 +402,42 @@ int ssl_cert_inst(CERT **o)
 	 * s->cert being NULL, otherwise we could do without the
 	 * initialization in SSL_CTX_new).
 	 */
-	
-	if (o == NULL) 
-		{
+
+	if (o == NULL) {
 		SSLerr(SSL_F_SSL_CERT_INST, ERR_R_PASSED_NULL_PARAMETER);
-		return(0);
-		}
-	if (*o == NULL)
-		{
-		if ((*o = ssl_cert_new()) == NULL)
-			{
+		return (0);
+	}
+	if (*o == NULL) {
+		if ((*o = ssl_cert_new()) == NULL) {
 			SSLerr(SSL_F_SSL_CERT_INST, ERR_R_MALLOC_FAILURE);
-			return(0);
-			}
+			return (0);
 		}
-	return(1);
 	}
+	return (1);
+}
 
 
-SESS_CERT *ssl_sess_cert_new(void)
-	{
+SESS_CERT
+*ssl_sess_cert_new(void)
+{
 	SESS_CERT *ret;
 
 	ret = OPENSSL_malloc(sizeof *ret);
-	if (ret == NULL)
-		{
+	if (ret == NULL) {
 		SSLerr(SSL_F_SSL_SESS_CERT_NEW, ERR_R_MALLOC_FAILURE);
 		return NULL;
-		}
+	}
 
-	memset(ret, 0 ,sizeof *ret);
+	memset(ret, 0 , sizeof *ret);
 	ret->peer_key = &(ret->peer_pkeys[SSL_PKEY_RSA_ENC]);
 	ret->references = 1;
 
 	return ret;
-	}
+}
 
-void ssl_sess_cert_free(SESS_CERT *sc)
-	{
+void
+ssl_sess_cert_free(SESS_CERT *sc)
+{
 	int i;
 
 	if (sc == NULL)
@@ -462,27 +450,25 @@ void ssl_sess_cert_free(SESS_CERT *sc)
 	if (i > 0)
 		return;
 #ifdef REF_CHECK
-	if (i < 0)
-		{
-		fprintf(stderr,"ssl_sess_cert_free, bad reference count\n");
+	if (i < 0) {
+		fprintf(stderr, "ssl_sess_cert_free, bad reference count\n");
 		abort(); /* ok */
-		}
+	}
 #endif
 
 	/* i == 0 */
 	if (sc->cert_chain != NULL)
 		sk_X509_pop_free(sc->cert_chain, X509_free);
-	for (i = 0; i < SSL_PKEY_NUM; i++)
-		{
+	for (i = 0; i < SSL_PKEY_NUM; i++) {
 		if (sc->peer_pkeys[i].x509 != NULL)
 			X509_free(sc->peer_pkeys[i].x509);
 #if 0 /* We don't have the peer's private key.  These lines are just
-	   * here as a reminder that we're still using a not-quite-appropriate
-	   * data structure. */
+       * here as a reminder that we're still using a not-quite-appropriate
+       * data structure. */
 		if (sc->peer_pkeys[i].privatekey != NULL)
 			EVP_PKEY_free(sc->peer_pkeys[i].privatekey);
 #endif
-		}
+	}
 
 #ifndef OPENSSL_NO_RSA
 	if (sc->peer_rsa_tmp != NULL)
@@ -498,34 +484,35 @@ void ssl_sess_cert_free(SESS_CERT *sc)
 #endif
 
 	OPENSSL_free(sc);
-	}
+}
 
-int ssl_set_peer_cert_type(SESS_CERT *sc,int type)
-	{
+int
+ssl_set_peer_cert_type(SESS_CERT *sc, int type)
+{
 	sc->peer_cert_type = type;
-	return(1);
-	}
+	return (1);
+}
 
-int ssl_verify_cert_chain(SSL *s,STACK_OF(X509) *sk)
-	{
+int
+ssl_verify_cert_chain(SSL *s, STACK_OF(X509) *sk)
+{
 	X509 *x;
 	int i;
 	X509_STORE_CTX ctx;
 
 	if ((sk == NULL) || (sk_X509_num(sk) == 0))
-		return(0);
+		return (0);
 
-	x=sk_X509_value(sk,0);
-	if(!X509_STORE_CTX_init(&ctx,s->ctx->cert_store,x,sk))
-		{
-		SSLerr(SSL_F_SSL_VERIFY_CERT_CHAIN,ERR_R_X509_LIB);
-		return(0);
-		}
+	x = sk_X509_value(sk, 0);
+	if (!X509_STORE_CTX_init(&ctx, s->ctx->cert_store, x, sk)) {
+		SSLerr(SSL_F_SSL_VERIFY_CERT_CHAIN, ERR_R_X509_LIB);
+		return (0);
+	}
 #if 0
 	if (SSL_get_verify_depth(s) >= 0)
 		X509_STORE_CTX_set_depth(&ctx, SSL_get_verify_depth(s));
 #endif
-	X509_STORE_CTX_set_ex_data(&ctx,SSL_get_ex_data_X509_STORE_CTX_idx(),s);
+	X509_STORE_CTX_set_ex_data(&ctx, SSL_get_ex_data_X509_STORE_CTX_idx(), s);
 
 	/* We need to inherit the verify parameters. These can be determined by
 	 * the context: if its a server it will verify SSL client certificates
@@ -533,7 +520,7 @@ int ssl_verify_cert_chain(SSL *s,STACK_OF(X509) *sk)
 	 */
 
 	X509_STORE_CTX_set_default(&ctx,
-				s->server ? "ssl_client" : "ssl_server");
+	s->server ? "ssl_client" : "ssl_server");
 	/* Anything non-default in "param" should overwrite anything in the
 	 * ctx.
 	 */
@@ -544,121 +531,127 @@ int ssl_verify_cert_chain(SSL *s,STACK_OF(X509) *sk)
 
 	if (s->ctx->app_verify_callback != NULL)
 #if 1 /* new with OpenSSL 0.9.7 */
-		i=s->ctx->app_verify_callback(&ctx, s->ctx->app_verify_arg); 
+	i = s->ctx->app_verify_callback(&ctx, s->ctx->app_verify_arg);
+
 #else
-		i=s->ctx->app_verify_callback(&ctx); /* should pass app_verify_arg */
+	i=s->ctx->app_verify_callback(&ctx); /* should pass app_verify_arg */
 #endif
-	else
-		{
+	else {
 #ifndef OPENSSL_NO_X509_VERIFY
-		i=X509_verify_cert(&ctx);
+		i = X509_verify_cert(&ctx);
 #else
-		i=0;
-		ctx.error=X509_V_ERR_APPLICATION_VERIFICATION;
-		SSLerr(SSL_F_SSL_VERIFY_CERT_CHAIN,SSL_R_NO_VERIFY_CALLBACK);
+		i = 0;
+		ctx.error = X509_V_ERR_APPLICATION_VERIFICATION;
+		SSLerr(SSL_F_SSL_VERIFY_CERT_CHAIN, SSL_R_NO_VERIFY_CALLBACK);
 #endif
-		}
+	}
 
-	s->verify_result=ctx.error;
+	s->verify_result = ctx.error;
 	X509_STORE_CTX_cleanup(&ctx);
 
-	return(i);
-	}
+	return (i);
+}
 
-static void set_client_CA_list(STACK_OF(X509_NAME) **ca_list,STACK_OF(X509_NAME) *name_list)
-	{
+static void
+set_client_CA_list(STACK_OF(X509_NAME) **ca_list, STACK_OF(X509_NAME) *name_list)
+{
 	if (*ca_list != NULL)
-		sk_X509_NAME_pop_free(*ca_list,X509_NAME_free);
+		sk_X509_NAME_pop_free(*ca_list, X509_NAME_free);
 
-	*ca_list=name_list;
-	}
+	*ca_list = name_list;
+}
 
-STACK_OF(X509_NAME) *SSL_dup_CA_list(STACK_OF(X509_NAME) *sk)
-	{
+STACK_OF(X509_NAME)
+*SSL_dup_CA_list(STACK_OF(X509_NAME) *sk)
+{
 	int i;
 	STACK_OF(X509_NAME) *ret;
 	X509_NAME *name;
 
-	ret=sk_X509_NAME_new_null();
-	for (i=0; i<sk_X509_NAME_num(sk); i++)
-		{
-		name=X509_NAME_dup(sk_X509_NAME_value(sk,i));
-		if ((name == NULL) || !sk_X509_NAME_push(ret,name))
-			{
-			sk_X509_NAME_pop_free(ret,X509_NAME_free);
-			return(NULL);
-			}
+	ret = sk_X509_NAME_new_null();
+	for (i = 0; i < sk_X509_NAME_num(sk); i++) {
+		name = X509_NAME_dup(sk_X509_NAME_value(sk, i));
+		if ((name == NULL) || !sk_X509_NAME_push(ret, name)) {
+			sk_X509_NAME_pop_free(ret, X509_NAME_free);
+			return (NULL);
 		}
-	return(ret);
 	}
-
-void SSL_set_client_CA_list(SSL *s,STACK_OF(X509_NAME) *name_list)
-	{
-	set_client_CA_list(&(s->client_CA),name_list);
-	}
-
-void SSL_CTX_set_client_CA_list(SSL_CTX *ctx,STACK_OF(X509_NAME) *name_list)
-	{
-	set_client_CA_list(&(ctx->client_CA),name_list);
-	}
-
-STACK_OF(X509_NAME) *SSL_CTX_get_client_CA_list(const SSL_CTX *ctx)
-	{
-	return(ctx->client_CA);
-	}
-
-STACK_OF(X509_NAME) *SSL_get_client_CA_list(const SSL *s)
-	{
+	return (ret);
+}
+
+void
+SSL_set_client_CA_list(SSL *s, STACK_OF(X509_NAME) *name_list)
+{
+	set_client_CA_list(&(s->client_CA), name_list);
+}
+
+void
+SSL_CTX_set_client_CA_list(SSL_CTX *ctx, STACK_OF(X509_NAME) *name_list)
+{
+	set_client_CA_list(&(ctx->client_CA), name_list);
+}
+
+STACK_OF(X509_NAME)
+*SSL_CTX_get_client_CA_list(const SSL_CTX *ctx)
+{
+	return (ctx->client_CA);
+}
+
+STACK_OF(X509_NAME)
+*SSL_get_client_CA_list(const SSL *s)
+{
 	if (s->type == SSL_ST_CONNECT)
-		{ /* we are in the client */
-		if (((s->version>>8) == SSL3_VERSION_MAJOR) &&
+			{ /* we are in the client */
+		if (((s->version >> 8) == SSL3_VERSION_MAJOR) &&
 			(s->s3 != NULL))
-			return(s->s3->tmp.ca_names);
+		return (s->s3->tmp.ca_names);
 		else
-			return(NULL);
-		}
-	else
-		{
+			return (NULL);
+	} else {
 		if (s->client_CA != NULL)
-			return(s->client_CA);
+			return (s->client_CA);
 		else
-			return(s->ctx->client_CA);
-		}
+			return (s->ctx->client_CA);
 	}
+}
 
-static int add_client_CA(STACK_OF(X509_NAME) **sk,X509 *x)
-	{
+static int
+add_client_CA(STACK_OF(X509_NAME) **sk, X509 *x)
+{
 	X509_NAME *name;
 
-	if (x == NULL) return(0);
-	if ((*sk == NULL) && ((*sk=sk_X509_NAME_new_null()) == NULL))
-		return(0);
-		
-	if ((name=X509_NAME_dup(X509_get_subject_name(x))) == NULL)
-		return(0);
-
-	if (!sk_X509_NAME_push(*sk,name))
-		{
-		X509_NAME_free(name);
-		return(0);
-		}
-	return(1);
-	}
+	if (x == NULL)
+		return (0);
+	if ((*sk == NULL) && ((*sk = sk_X509_NAME_new_null()) == NULL))
+		return (0);
 
-int SSL_add_client_CA(SSL *ssl,X509 *x)
-	{
-	return(add_client_CA(&(ssl->client_CA),x));
-	}
+	if ((name = X509_NAME_dup(X509_get_subject_name(x))) == NULL)
+		return (0);
 
-int SSL_CTX_add_client_CA(SSL_CTX *ctx,X509 *x)
-	{
-	return(add_client_CA(&(ctx->client_CA),x));
-	}
-
-static int xname_cmp(const X509_NAME * const *a, const X509_NAME * const *b)
-	{
-	return(X509_NAME_cmp(*a,*b));
+	if (!sk_X509_NAME_push(*sk, name)) {
+		X509_NAME_free(name);
+		return (0);
 	}
+	return (1);
+}
+
+int
+SSL_add_client_CA(SSL *ssl, X509 *x)
+{
+	return (add_client_CA(&(ssl->client_CA), x));
+}
+
+int
+SSL_CTX_add_client_CA(SSL_CTX *ctx, X509 *x)
+{
+	return (add_client_CA(&(ctx->client_CA), x));
+}
+
+static int
+xname_cmp(const X509_NAME * const *a, const X509_NAME * const *b)
+{
+	return (X509_NAME_cmp(*a, *b));
+}
 
 #ifndef OPENSSL_NO_STDIO
 /*!
@@ -669,65 +662,65 @@ static int xname_cmp(const X509_NAME * const *a, const X509_NAME * const *b)
  * \param file the file containing one or more certs.
  * \return a ::STACK containing the certs.
  */
-STACK_OF(X509_NAME) *SSL_load_client_CA_file(const char *file)
-	{
+STACK_OF(X509_NAME)
+*SSL_load_client_CA_file(const char *file)
+{
 	BIO *in;
-	X509 *x=NULL;
-	X509_NAME *xn=NULL;
-	STACK_OF(X509_NAME) *ret = NULL,*sk;
+	X509 *x = NULL;
+	X509_NAME *xn = NULL;
+	STACK_OF(X509_NAME) *ret = NULL, *sk;
 
-	sk=sk_X509_NAME_new(xname_cmp);
+	sk = sk_X509_NAME_new(xname_cmp);
 
-	in=BIO_new(BIO_s_file_internal());
+	in = BIO_new(BIO_s_file_internal());
 
-	if ((sk == NULL) || (in == NULL))
-		{
-		SSLerr(SSL_F_SSL_LOAD_CLIENT_CA_FILE,ERR_R_MALLOC_FAILURE);
+	if ((sk == NULL) || (in == NULL)) {
+		SSLerr(SSL_F_SSL_LOAD_CLIENT_CA_FILE, ERR_R_MALLOC_FAILURE);
 		goto err;
-		}
-	
-	if (!BIO_read_filename(in,file))
+	}
+
+	if (!BIO_read_filename(in, file))
 		goto err;
 
-	for (;;)
-		{
-		if (PEM_read_bio_X509(in,&x,NULL,NULL) == NULL)
+	for (;;) {
+		if (PEM_read_bio_X509(in, &x, NULL, NULL) == NULL)
 			break;
-		if (ret == NULL)
-			{
+		if (ret == NULL) {
 			ret = sk_X509_NAME_new_null();
-			if (ret == NULL)
-				{
-				SSLerr(SSL_F_SSL_LOAD_CLIENT_CA_FILE,ERR_R_MALLOC_FAILURE);
+			if (ret == NULL) {
+				SSLerr(SSL_F_SSL_LOAD_CLIENT_CA_FILE, ERR_R_MALLOC_FAILURE);
 				goto err;
-				}
 			}
-		if ((xn=X509_get_subject_name(x)) == NULL) goto err;
-		/* check for duplicates */
-		xn=X509_NAME_dup(xn);
-		if (xn == NULL) goto err;
-		if (sk_X509_NAME_find(sk,xn) >= 0)
+		}
+		if ((xn = X509_get_subject_name(x)) == NULL) goto err;
+			/* check for duplicates */
+		xn = X509_NAME_dup(xn);
+		if (xn == NULL)
+			goto err;
+		if (sk_X509_NAME_find(sk, xn) >= 0)
 			X509_NAME_free(xn);
-		else
-			{
-			sk_X509_NAME_push(sk,xn);
-			sk_X509_NAME_push(ret,xn);
-			}
+		else {
+			sk_X509_NAME_push(sk, xn);
+			sk_X509_NAME_push(ret, xn);
 		}
+	}
 
-	if (0)
-		{
+	if (0) {
 err:
-		if (ret != NULL) sk_X509_NAME_pop_free(ret,X509_NAME_free);
-		ret=NULL;
-		}
-	if (sk != NULL) sk_X509_NAME_free(sk);
-	if (in != NULL) BIO_free(in);
-	if (x != NULL) X509_free(x);
+		if (ret != NULL)
+			sk_X509_NAME_pop_free(ret, X509_NAME_free);
+		ret = NULL;
+	}
+	if (sk != NULL)
+		sk_X509_NAME_free(sk);
+	if (in != NULL)
+		BIO_free(in);
+	if (x != NULL)
+		X509_free(x);
 	if (ret != NULL)
 		ERR_clear_error();
-	return(ret);
-	}
+	return (ret);
+}
 #endif
 
 /*!
@@ -739,57 +732,56 @@ err:
  * certs may have been added to \c stack.
  */
 
-int SSL_add_file_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
-					const char *file)
-	{
+int
+SSL_add_file_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
+    const char *file)
+{
 	BIO *in;
-	X509 *x=NULL;
-	X509_NAME *xn=NULL;
-	int ret=1;
+	X509 *x = NULL;
+	X509_NAME *xn = NULL;
+	int ret = 1;
 	int (*oldcmp)(const X509_NAME * const *a, const X509_NAME * const *b);
-	
-	oldcmp=sk_X509_NAME_set_cmp_func(stack,xname_cmp);
-	
-	in=BIO_new(BIO_s_file_internal());
-	
-	if (in == NULL)
-		{
-		SSLerr(SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK,ERR_R_MALLOC_FAILURE);
+
+	oldcmp = sk_X509_NAME_set_cmp_func(stack, xname_cmp);
+
+	in = BIO_new(BIO_s_file_internal());
+
+	if (in == NULL) {
+		SSLerr(SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK, ERR_R_MALLOC_FAILURE);
 		goto err;
-		}
-	
-	if (!BIO_read_filename(in,file))
+	}
+
+	if (!BIO_read_filename(in, file))
 		goto err;
-	
-	for (;;)
-		{
-		if (PEM_read_bio_X509(in,&x,NULL,NULL) == NULL)
+
+	for (;;) {
+		if (PEM_read_bio_X509(in, &x, NULL, NULL) == NULL)
 			break;
-		if ((xn=X509_get_subject_name(x)) == NULL) goto err;
-		xn=X509_NAME_dup(xn);
-		if (xn == NULL) goto err;
-		if (sk_X509_NAME_find(stack,xn) >= 0)
+		if ((xn = X509_get_subject_name(x)) == NULL) goto err;
+			xn = X509_NAME_dup(xn);
+		if (xn == NULL)
+			goto err;
+		if (sk_X509_NAME_find(stack, xn) >= 0)
 			X509_NAME_free(xn);
 		else
-			sk_X509_NAME_push(stack,xn);
-		}
+			sk_X509_NAME_push(stack, xn);
+	}
 
 	ERR_clear_error();
 
-	if (0)
-		{
+	if (0) {
 err:
-		ret=0;
-		}
-	if(in != NULL)
+		ret = 0;
+	}
+	if (in != NULL)
 		BIO_free(in);
-	if(x != NULL)
+	if (x != NULL)
 		X509_free(x);
-	
-	(void)sk_X509_NAME_set_cmp_func(stack,oldcmp);
+
+	(void)sk_X509_NAME_set_cmp_func(stack, oldcmp);
 
 	return ret;
-	}
+}
 
 /*!
  * Add a directory of certs to a stack.
@@ -802,9 +794,10 @@ err:
  * certs may have been added to \c stack.
  */
 
-int SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
-				       const char *dir)
-	{
+int
+SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
+    const char *dir)
+{
 	OPENSSL_DIR_CTX *d = NULL;
 	const char *filename;
 	int ret = 0;
@@ -813,36 +806,34 @@ int SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
 
 	/* Note that a side effect is that the CAs will be sorted by name */
 
-	while((filename = OPENSSL_DIR_read(&d, dir)))
-		{
+	while ((filename = OPENSSL_DIR_read(&d, dir))) {
 		char buf[1024];
 		int r;
 
-		if(strlen(dir)+strlen(filename)+2 > sizeof buf)
-			{
-			SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK,SSL_R_PATH_TOO_LONG);
+		if (strlen(dir) + strlen(filename) + 2 > sizeof buf) {
+			SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK, SSL_R_PATH_TOO_LONG);
 			goto err;
-			}
-		r = BIO_snprintf(buf,sizeof buf,"%s/%s",dir,filename);
+		}
+		r = BIO_snprintf(buf, sizeof buf, "%s/%s", dir, filename);
 		if (r <= 0 || r >= (int)sizeof(buf))
 			goto err;
-		if(!SSL_add_file_cert_subjects_to_stack(stack,buf))
+		if (!SSL_add_file_cert_subjects_to_stack(stack, buf))
 			goto err;
-		}
+	}
 
-	if (errno)
-		{
+	if (errno) {
 		SYSerr(SYS_F_OPENDIR, errno);
 		ERR_add_error_data(3, "OPENSSL_DIR_read(&ctx, '", dir, "')");
 		SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK, ERR_R_SYS_LIB);
 		goto err;
-		}
+	}
 
 	ret = 1;
 
 err:
-	if (d) OPENSSL_DIR_end(&d);
+	if (d)
+		OPENSSL_DIR_end(&d);
 	CRYPTO_w_unlock(CRYPTO_LOCK_READDIR);
 	return ret;
-	}
+}