More KNF.

1 files changed, 122 insertions, 103 deletions

diff --git a/lib/libssl/d1_clnt.c b/lib/libssl/d1_clnt.c
index fe5f1aa200f..ef4a74e0af3 100644
--- a/lib/libssl/d1_clnt.c
+++ b/lib/libssl/d1_clnt.c
@@ -1,7 +1,7 @@
 /* ssl/d1_clnt.c */
-/* 
+/*
  * DTLS implementation written by Nagendra Modadugu
- * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.  
+ * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
  */
 /* ====================================================================
  * Copyright (c) 1999-2007 The OpenSSL Project.  All rights reserved.
@@ -11,7 +11,7 @@
  * are met:
  *
  * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer. 
+ *    notice, this list of conditions and the following disclaimer.
  *
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in
@@ -62,21 +62,21 @@
  * This package is an SSL implementation written
  * by Eric Young (eay@cryptsoft.com).
  * The implementation was written so as to conform with Netscapes SSL.
- * 
+ *
  * This library is free for commercial and non-commercial use as long as
  * the following conditions are aheared to.  The following conditions
  * apply to all code found in this distribution, be it the RC4, RSA,
  * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
  * included with this distribution is covered by the same copyright terms
  * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- * 
+ *
  * Copyright remains Eric Young's, and as such any Copyright notices in
  * the code are not to be removed.
  * If this package is used in a product, Eric Young should be given attribution
  * as the author of the parts of the library used.
  * This can be in the form of a textual message at program startup or
  * in documentation (online or textual) provided with the package.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -91,10 +91,10 @@
  *     Eric Young (eay@cryptsoft.com)"
  *    The word 'cryptographic' can be left out if the rouines from the library
  *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from 
+ * 4. If you include any Windows specific code (or a derivative thereof) from
  *    the apps directory (application code) you must include an acknowledgement:
  *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -106,7 +106,7 @@
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
- * 
+ *
  * The licence and distribution terms for any publically available version or
  * derivative of this code cannot be changed.  i.e. this code cannot simply be
  * copied and put under another distribution licence
@@ -225,7 +225,8 @@ dtls1_connect(SSL *s)
 
 			if ((s->version & 0xff00 ) != (DTLS1_VERSION & 0xff00) &&
 			    (s->version & 0xff00 ) != (DTLS1_BAD_VER & 0xff00)) {
-				SSLerr(SSL_F_DTLS1_CONNECT, ERR_R_INTERNAL_ERROR);
+				SSLerr(SSL_F_DTLS1_CONNECT,
+				    ERR_R_INTERNAL_ERROR);
 				ret = -1;
 				goto end;
 			}
@@ -263,7 +264,8 @@ dtls1_connect(SSL *s)
 			s->ctx->stats.sess_connect++;
 			s->init_num = 0;
 			/* mark client_random uninitialized */
-			memset(s->s3->client_random, 0, sizeof(s->s3->client_random));
+			memset(s->s3->client_random, 0,
+			    sizeof(s->s3->client_random));
 			s->d1->send_cookie = 0;
 			s->hit = 0;
 			break;
@@ -334,7 +336,6 @@ dtls1_connect(SSL *s)
 #ifndef OPENSSL_NO_SCTP
 			}
 #endif
-
 			break;
 
 		case SSL3_ST_CR_SRVR_HELLO_A:
@@ -349,14 +350,14 @@ dtls1_connect(SSL *s)
 					 * will be ignored if no SCTP used.
 					 */
 					snprintf((char*) labelbuffer, sizeof(DTLS1_SCTP_AUTH_LABEL),
-					DTLS1_SCTP_AUTH_LABEL);
+					    DTLS1_SCTP_AUTH_LABEL);
 
 					SSL_export_keying_material(s, sctpauthkey,
-					sizeof(sctpauthkey), labelbuffer,
-					sizeof(labelbuffer), NULL, 0, 0);
+					    sizeof(sctpauthkey), labelbuffer,
+					    sizeof(labelbuffer), NULL, 0, 0);
 
 					BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_ADD_AUTH_KEY,
-					sizeof(sctpauthkey), sctpauthkey);
+					    sizeof(sctpauthkey), sctpauthkey);
 #endif
 
 					s->state = SSL3_ST_CR_FINISHED_A;
@@ -448,12 +449,12 @@ dtls1_connect(SSL *s)
 				s->s3->tmp.next_state = SSL3_ST_CW_KEY_EXCH_A;
 			s->init_num = 0;
 
-#ifndef OPENSSL_NO_SCTP			
+#ifndef OPENSSL_NO_SCTP
 			if (BIO_dgram_is_sctp(SSL_get_wbio(s)) &&
 			    state == SSL_ST_RENEGOTIATE)
 				s->state = DTLS1_SCTP_ST_CR_READ_SOCK;
 			else
-#endif			
+#endif
 				s->state = s->s3->tmp.next_state;
 			break;
 
@@ -535,7 +536,7 @@ dtls1_connect(SSL *s)
 			if (!s->hit)
 				dtls1_start_timer(s);
 			ret = dtls1_send_change_cipher_spec(s,
-			SSL3_ST_CW_CHANGE_A, SSL3_ST_CW_CHANGE_B);
+			    SSL3_ST_CW_CHANGE_A, SSL3_ST_CW_CHANGE_B);
 			if (ret <= 0)
 				goto end;
 
@@ -581,9 +582,9 @@ dtls1_connect(SSL *s)
 			if (!s->hit)
 				dtls1_start_timer(s);
 			ret = dtls1_send_finished(s,
-			SSL3_ST_CW_FINISHED_A, SSL3_ST_CW_FINISHED_B,
-			s->method->ssl3_enc->client_finished_label,
-			s->method->ssl3_enc->client_finished_label_len);
+			    SSL3_ST_CW_FINISHED_A, SSL3_ST_CW_FINISHED_B,
+			    s->method->ssl3_enc->client_finished_label,
+			    s->method->ssl3_enc->client_finished_label_len);
 			if (ret <= 0)
 				goto end;
 			s->state = SSL3_ST_CW_FLUSH;
@@ -606,7 +607,7 @@ dtls1_connect(SSL *s)
 						s->state = DTLS1_SCTP_ST_CW_WRITE_SOCK;
 					}
 #endif
-					s->s3->flags|=SSL3_FLAGS_POP_BUFFER;
+					s->s3->flags |= SSL3_FLAGS_POP_BUFFER;
 					s->s3->delay_buf_pop_ret = 0;
 				}
 			} else {
@@ -614,15 +615,17 @@ dtls1_connect(SSL *s)
 				/* Change to new shared key of SCTP-Auth,
 				 * will be ignored if no SCTP used.
 				 */
-				BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 0, NULL);
+				BIO_ctrl(SSL_get_wbio(s),
+				    BIO_CTRL_DGRAM_SCTP_NEXT_AUTH_KEY, 0, NULL);
 #endif
 
 				/* Allow NewSessionTicket if ticket expected */
 				if (s->tlsext_ticket_expected)
-					s->s3->tmp.next_state = SSL3_ST_CR_SESSION_TICKET_A;
+					s->s3->tmp.next_state =
+					    SSL3_ST_CR_SESSION_TICKET_A;
 				else
-
-					s->s3->tmp.next_state = SSL3_ST_CR_FINISHED_A;
+					s->s3->tmp.next_state =
+					    SSL3_ST_CR_FINISHED_A;
 			}
 			s->init_num = 0;
 			break;
@@ -661,7 +664,7 @@ dtls1_connect(SSL *s)
 
 #ifndef OPENSSL_NO_SCTP
 			if (BIO_dgram_is_sctp(SSL_get_wbio(s)) &&
-				state == SSL_ST_RENEGOTIATE) {
+			    state == SSL_ST_RENEGOTIATE) {
 				s->d1->next_state = s->state;
 				s->state = DTLS1_SCTP_ST_CW_WRITE_SOCK;
 			}
@@ -786,7 +789,7 @@ dtls1_client_hello(SSL *s)
 		/* if client_random is initialized, reuse it, we are
 		 * required to use same upon reply to HelloVerify */
 		for (i = 0; p[i]=='\0' && i < sizeof(s->s3->client_random); i++)
-;
+			;
 		if (i == sizeof(s->s3->client_random))
 			ssl_fill_hello_random(s, 0, p,
 			    sizeof(s->s3->client_random));
@@ -810,7 +813,8 @@ dtls1_client_hello(SSL *s)
 		*(p++) = i;
 		if (i != 0) {
 			if (i > sizeof s->session->session_id) {
-				SSLerr(SSL_F_DTLS1_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
+				SSLerr(SSL_F_DTLS1_CLIENT_HELLO,
+				    ERR_R_INTERNAL_ERROR);
 				goto err;
 			}
 			memcpy(p, s->session->session_id, i);
@@ -829,7 +833,8 @@ dtls1_client_hello(SSL *s)
 		/* Ciphers supported */
 		i = ssl_cipher_list_to_bytes(s, SSL_get_ciphers(s), &(p[2]), 0);
 		if (i == 0) {
-			SSLerr(SSL_F_DTLS1_CLIENT_HELLO, SSL_R_NO_CIPHERS_AVAILABLE);
+			SSLerr(SSL_F_DTLS1_CLIENT_HELLO,
+			    SSL_R_NO_CIPHERS_AVAILABLE);
 			goto err;
 		}
 		s2n(i, p);
@@ -847,7 +852,8 @@ dtls1_client_hello(SSL *s)
 		}
 		*(p++) = 0; /* Add the NULL method */
 
-		if ((p = ssl_add_clienthello_tlsext(s, p, buf + SSL3_RT_MAX_PLAIN_LENGTH)) == NULL) {
+		if ((p = ssl_add_clienthello_tlsext(s, p,
+		    buf + SSL3_RT_MAX_PLAIN_LENGTH)) == NULL) {
 			SSLerr(SSL_F_DTLS1_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
 			goto err;
 		}
@@ -855,7 +861,8 @@ dtls1_client_hello(SSL *s)
 		l = (p - d);
 		d = buf;
 
-		d = dtls1_set_message_header(s, d, SSL3_MT_CLIENT_HELLO, l, 0, l);
+		d = dtls1_set_message_header(s, d, SSL3_MT_CLIENT_HELLO,
+		    l, 0, l);
 
 		s->state = SSL3_ST_CW_CLNT_HELLO_B;
 		/* number of bytes to write */
@@ -879,12 +886,8 @@ dtls1_get_hello_verify(SSL *s)
 	unsigned char *data;
 	unsigned int cookie_len;
 
-	n = s->method->ssl_get_message(s,
-	DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A,
-	DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B,
-	-1,
-	s->max_cert_list,
-	&ok);
+	n = s->method->ssl_get_message(s, DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A,
+	    DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B, -1, s->max_cert_list, &ok);
 
 	if (!ok)
 		return ((int)n);
@@ -954,7 +957,8 @@ dtls1_send_client_key_exchange(SSL *s)
 				if ((pkey == NULL) ||
 				    (pkey->type != EVP_PKEY_RSA) ||
 				    (pkey->pkey.rsa == NULL)) {
-					SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
+					SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+					    ERR_R_INTERNAL_ERROR);
 					goto err;
 				}
 				rsa = pkey->pkey.rsa;
@@ -973,9 +977,10 @@ dtls1_send_client_key_exchange(SSL *s)
 			if (s->version > SSL3_VERSION)
 				p += 2;
 			n = RSA_public_encrypt(sizeof tmp_buf,
-			tmp_buf, p, rsa, RSA_PKCS1_PADDING);
+			    tmp_buf, p, rsa, RSA_PKCS1_PADDING);
 			if (n <= 0) {
-				SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, SSL_R_BAD_RSA_ENCRYPT);
+				SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+				    SSL_R_BAD_RSA_ENCRYPT);
 				goto err;
 			}
 
@@ -986,30 +991,33 @@ dtls1_send_client_key_exchange(SSL *s)
 			}
 
 			s->session->master_key_length =
-			s->method->ssl3_enc->generate_master_secret(s,
-			s->session->master_key,
-			tmp_buf, sizeof tmp_buf);
+			    s->method->ssl3_enc->generate_master_secret(s,
+			    s->session->master_key,
+			    tmp_buf, sizeof tmp_buf);
 			OPENSSL_cleanse(tmp_buf, sizeof tmp_buf);
-		}
-		else if (alg_k & (SSL_kEDH|SSL_kDHr|SSL_kDHd)) {
+		} else if (alg_k & (SSL_kEDH|SSL_kDHr|SSL_kDHd)) {
 			DH *dh_srvr, *dh_clnt;
 
 			if (s->session->sess_cert->peer_dh_tmp != NULL)
 				dh_srvr = s->session->sess_cert->peer_dh_tmp;
 			else {
 				/* we get them from the cert */
-				ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
-				SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, SSL_R_UNABLE_TO_FIND_DH_PARAMETERS);
+				ssl3_send_alert(s, SSL3_AL_FATAL,
+				    SSL_AD_HANDSHAKE_FAILURE);
+				SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+				    SSL_R_UNABLE_TO_FIND_DH_PARAMETERS);
 				goto err;
 			}
 
 			/* generate a new random key */
 			if ((dh_clnt = DHparams_dup(dh_srvr)) == NULL) {
-				SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_DH_LIB);
+				SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+				    ERR_R_DH_LIB);
 				goto err;
 			}
 			if (!DH_generate_key(dh_clnt)) {
-				SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_DH_LIB);
+				SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+				    ERR_R_DH_LIB);
 				goto err;
 			}
 
@@ -1019,14 +1027,15 @@ dtls1_send_client_key_exchange(SSL *s)
 			n = DH_compute_key(p, dh_srvr->pub_key, dh_clnt);
 
 			if (n <= 0) {
-				SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_DH_LIB);
+				SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+				    ERR_R_DH_LIB);
 				goto err;
 			}
 
 			/* generate master key from the result */
 			s->session->master_key_length =
-			    s->method->ssl3_enc->generate_master_secret(s,
-			        s->session->master_key, p, n);
+			    s->method->ssl3_enc->generate_master_secret(
+				s, s->session->master_key, p, n);
 			/* clean up */
 			memset(p, 0, n);
 
@@ -1039,8 +1048,7 @@ dtls1_send_client_key_exchange(SSL *s)
 			DH_free(dh_clnt);
 
 			/* perhaps clean things up a bit EAY EAY EAY EAY*/
-		}
-		else if (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) {
+		} else if (alg_k & (SSL_kEECDH|SSL_kECDHr|SSL_kECDHe)) {
 			const EC_GROUP *srvr_group = NULL;
 			EC_KEY *tkey;
 			int ecdh_clnt_cert = 0;
@@ -1051,11 +1059,12 @@ dtls1_send_client_key_exchange(SSL *s)
 			 * computation as part of client certificate?
 			 * If so, set ecdh_clnt_cert to 1.
 			 */
-			if ((alg_k & (SSL_kECDHr|SSL_kECDHe)) && (s->cert != NULL)) {
+			if ((alg_k & (SSL_kECDHr|SSL_kECDHe)) &&
+			    (s->cert != NULL)) {
 				/* XXX: For now, we do not support client
 				 * authentication using ECDH certificates.
 				 * To add such support, one needs to add
-				 * code that checks for appropriate 
+				 * code that checks for appropriate
 				 * conditions and sets ecdh_clnt_cert to 1.
 				 * For example, the cert have an ECC
 				 * key on the same curve as the server's
@@ -1083,7 +1092,7 @@ dtls1_send_client_key_exchange(SSL *s)
 				    (srvr_pub_pkey->type != EVP_PKEY_EC) ||
 				    (srvr_pub_pkey->pkey.ec == NULL)) {
 					SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
-					ERR_R_INTERNAL_ERROR);
+					    ERR_R_INTERNAL_ERROR);
 					goto err;
 				}
 
@@ -1095,17 +1104,19 @@ dtls1_send_client_key_exchange(SSL *s)
 
 			if ((srvr_group == NULL) || (srvr_ecpoint == NULL)) {
 				SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
-				ERR_R_INTERNAL_ERROR);
+				    ERR_R_INTERNAL_ERROR);
 				goto err;
 			}
 
 			if ((clnt_ecdh = EC_KEY_new()) == NULL) {
-				SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE);
+				SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+				    ERR_R_MALLOC_FAILURE);
 				goto err;
 			}
 
 			if (!EC_KEY_set_group(clnt_ecdh, srvr_group)) {
-				SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_EC_LIB);
+				SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+				    ERR_R_EC_LIB);
 				goto err;
 			}
 			if (ecdh_clnt_cert) {
@@ -1117,17 +1128,20 @@ dtls1_send_client_key_exchange(SSL *s)
 				tkey = s->cert->key->privatekey->pkey.ec;
 				priv_key = EC_KEY_get0_private_key(tkey);
 				if (priv_key == NULL) {
-					SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE);
+					SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+					    ERR_R_MALLOC_FAILURE);
 					goto err;
 				}
 				if (!EC_KEY_set_private_key(clnt_ecdh, priv_key)) {
-					SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_EC_LIB);
+					SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+					    ERR_R_EC_LIB);
 					goto err;
 				}
 			} else {
 				/* Generate a new ECDH key pair */
 				if (!(EC_KEY_generate_key(clnt_ecdh))) {
-					SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_ECDH_LIB);
+					SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+					    ERR_R_ECDH_LIB);
 					goto err;
 				}
 			}
@@ -1139,22 +1153,20 @@ dtls1_send_client_key_exchange(SSL *s)
 			field_size = EC_GROUP_get_degree(srvr_group);
 			if (field_size <= 0) {
 				SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
-				ERR_R_ECDH_LIB);
+				    ERR_R_ECDH_LIB);
 				goto err;
 			}
 			n = ECDH_compute_key(p, (field_size + 7)/8, srvr_ecpoint, clnt_ecdh, NULL);
 			if (n <= 0) {
 				SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
-				ERR_R_ECDH_LIB);
+				    ERR_R_ECDH_LIB);
 				goto err;
 			}
 
 			/* generate master key from the result */
-			s->session->master_key_length = s->method->ssl3_enc \
-			    -> generate_master_secret(s, 
-			s->session->master_key,
-			p, n);
-
+			s->session->master_key_length =
+			    s->method->ssl3_enc->generate_master_secret(
+				s, s->session->master_key, p, n);
 			memset(p, 0, n); /* clean up */
 
 			if (ecdh_clnt_cert) {
@@ -1164,26 +1176,26 @@ dtls1_send_client_key_exchange(SSL *s)
 				/* First check the size of encoding and
 				 * allocate memory accordingly.
 				 */
-				encoded_pt_len =
-				    EC_POINT_point2oct(srvr_group,
-				        EC_KEY_get0_public_key(clnt_ecdh),
-				        POINT_CONVERSION_UNCOMPRESSED,
-				        NULL, 0, NULL);
+				encoded_pt_len = EC_POINT_point2oct(srvr_group,
+				    EC_KEY_get0_public_key(clnt_ecdh),
+				    POINT_CONVERSION_UNCOMPRESSED,
+				    NULL, 0, NULL);
 
 				encodedPoint = malloc(encoded_pt_len);
 
 				bn_ctx = BN_CTX_new();
 				if ((encodedPoint == NULL) ||
 				    (bn_ctx == NULL)) {
-					SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_MALLOC_FAILURE);
+					SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+					    ERR_R_MALLOC_FAILURE);
 					goto err;
 				}
 
 				/* Encode the public key */
 				n = EC_POINT_point2oct(srvr_group,
 				    EC_KEY_get0_public_key(clnt_ecdh),
-				        POINT_CONVERSION_UNCOMPRESSED,
-				        encodedPoint, encoded_pt_len, bn_ctx);
+				    POINT_CONVERSION_UNCOMPRESSED,
+				    encodedPoint, encoded_pt_len, bn_ctx);
 
 				*p = n; /* length of encoded point */
 				/* Encoded point will be copied here */
@@ -1215,7 +1227,7 @@ dtls1_send_client_key_exchange(SSL *s)
 			n = 0;
 			if (s->psk_client_callback == NULL) {
 				SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
-				SSL_R_PSK_NO_CLIENT_CB);
+				    SSL_R_PSK_NO_CLIENT_CB);
 				goto err;
 			}
 
@@ -1236,7 +1248,8 @@ dtls1_send_client_key_exchange(SSL *s)
 			/* create PSK pre_master_secret */
 			pre_ms_len = 2 + psk_len + 2 + psk_len;
 			t = psk_or_pre_ms;
-			memmove(psk_or_pre_ms + psk_len + 4, psk_or_pre_ms, psk_len);
+			memmove(psk_or_pre_ms + psk_len + 4,
+			    psk_or_pre_ms, psk_len);
 			s2n(psk_len, t);
 			memset(t, 0, psk_len);
 			t += psk_len;
@@ -1246,9 +1259,9 @@ dtls1_send_client_key_exchange(SSL *s)
 			s->session->psk_identity_hint =
 			    BUF_strdup(s->ctx->psk_identity_hint);
 			if (s->ctx->psk_identity_hint != NULL &&
-				s->session->psk_identity_hint == NULL) {
+			    s->session->psk_identity_hint == NULL) {
 				SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
-				ERR_R_MALLOC_FAILURE);
+				    ERR_R_MALLOC_FAILURE);
 				goto psk_err;
 			}
 
@@ -1256,14 +1269,14 @@ dtls1_send_client_key_exchange(SSL *s)
 			s->session->psk_identity = BUF_strdup(identity);
 			if (s->session->psk_identity == NULL) {
 				SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
-				ERR_R_MALLOC_FAILURE);
+				    ERR_R_MALLOC_FAILURE);
 				goto psk_err;
 			}
 
 			s->session->master_key_length =
 			    s->method->ssl3_enc->generate_master_secret(s,
-			        s->session->master_key,
-			        psk_or_pre_ms, pre_ms_len);
+			    s->session->master_key,
+			    psk_or_pre_ms, pre_ms_len);
 
 			n = strlen(identity);
 			s2n(n, p);
@@ -1274,14 +1287,17 @@ psk_err:
 			OPENSSL_cleanse(identity, PSK_MAX_IDENTITY_LEN);
 			OPENSSL_cleanse(psk_or_pre_ms, sizeof(psk_or_pre_ms));
 			if (psk_err != 0) {
-				ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
+				ssl3_send_alert(s, SSL3_AL_FATAL,
+				    SSL_AD_HANDSHAKE_FAILURE);
 				goto err;
 			}
 		}
 #endif
 		else {
-			ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
-			SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
+			ssl3_send_alert(s, SSL3_AL_FATAL,
+			    SSL_AD_HANDSHAKE_FAILURE);
+			SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,
+			    ERR_R_INTERNAL_ERROR);
 			goto err;
 		}
 
@@ -1338,42 +1354,42 @@ dtls1_send_client_verify(SSL *s)
 			if (RSA_sign(NID_md5_sha1, data,
 			    MD5_DIGEST_LENGTH + SHA_DIGEST_LENGTH,
 			    &(p[2]), &u, pkey->pkey.rsa) <= 0 ) {
-				SSLerr(SSL_F_DTLS1_SEND_CLIENT_VERIFY, ERR_R_RSA_LIB);
+				SSLerr(SSL_F_DTLS1_SEND_CLIENT_VERIFY,
+				    ERR_R_RSA_LIB);
 				goto err;
 			}
 			s2n(u, p);
 			n = u + 2;
-		} else
-		if (pkey->type == EVP_PKEY_DSA) {
+		} else if (pkey->type == EVP_PKEY_DSA) {
 			if (!DSA_sign(pkey->save_type,
 			    &(data[MD5_DIGEST_LENGTH]),
 			    SHA_DIGEST_LENGTH, &(p[2]),
 			    (unsigned int *)&j, pkey->pkey.dsa)) {
-				SSLerr(SSL_F_DTLS1_SEND_CLIENT_VERIFY, ERR_R_DSA_LIB);
+				SSLerr(SSL_F_DTLS1_SEND_CLIENT_VERIFY,
+				    ERR_R_DSA_LIB);
 				goto err;
 			}
 			s2n(j, p);
 			n = j + 2;
-		} else
-		if (pkey->type == EVP_PKEY_EC) {
+		} else if (pkey->type == EVP_PKEY_EC) {
 			if (!ECDSA_sign(pkey->save_type,
 			    &(data[MD5_DIGEST_LENGTH]),
 			    SHA_DIGEST_LENGTH, &(p[2]),
 			    (unsigned int *)&j, pkey->pkey.ec)) {
 				SSLerr(SSL_F_DTLS1_SEND_CLIENT_VERIFY,
-				ERR_R_ECDSA_LIB);
+				    ERR_R_ECDSA_LIB);
 				goto err;
 			}
 			s2n(j, p);
 			n = j + 2;
-		} else
-		{
-			SSLerr(SSL_F_DTLS1_SEND_CLIENT_VERIFY, ERR_R_INTERNAL_ERROR);
+		} else {
+			SSLerr(SSL_F_DTLS1_SEND_CLIENT_VERIFY,
+			    ERR_R_INTERNAL_ERROR);
 			goto err;
 		}
 
 		d = dtls1_set_message_header(s, d,
-		SSL3_MT_CERTIFICATE_VERIFY, n, 0, n);
+		    SSL3_MT_CERTIFICATE_VERIFY, n, 0, n);
 
 		s->init_num = (int)n + DTLS1_HM_HEADER_LENGTH;
 		s->init_off = 0;
@@ -1425,7 +1441,8 @@ dtls1_send_client_certificate(SSL *s)
 				i = 0;
 		} else if (i == 1) {
 			i = 0;
-			SSLerr(SSL_F_DTLS1_SEND_CLIENT_CERTIFICATE, SSL_R_BAD_DATA_RETURNED_BY_CALLBACK);
+			SSLerr(SSL_F_DTLS1_SEND_CLIENT_CERTIFICATE,
+			    SSL_R_BAD_DATA_RETURNED_BY_CALLBACK);
 		}
 
 		if (x509 != NULL)
@@ -1435,7 +1452,8 @@ dtls1_send_client_certificate(SSL *s)
 		if (i == 0) {
 			if (s->version == SSL3_VERSION) {
 				s->s3->tmp.cert_req = 0;
-				ssl3_send_alert(s, SSL3_AL_WARNING, SSL_AD_NO_CERTIFICATE);
+				ssl3_send_alert(s, SSL3_AL_WARNING,
+				    SSL_AD_NO_CERTIFICATE);
 				return (1);
 			} else {
 				s->s3->tmp.cert_req = 2;
@@ -1458,6 +1476,7 @@ dtls1_send_client_certificate(SSL *s)
 		/* buffer the message to handle re-xmits */
 		dtls1_buffer_message(s, 0);
 	}
+
 	/* SSL3_ST_CW_CERT_D */
 	return (dtls1_do_write(s, SSL3_RT_HANDSHAKE));
 }