static void doall_util_fn(OPENSSL_LHASH *lh, int use_arg,
                          OPENSSL_LH_DOALL_FUNC func,
                          OPENSSL_LH_DOALL_FUNCARG func_arg, void *arg)
{
    int i;
    OPENSSL_LH_NODE *a, *n;
    if (lh == NULL)
        return;
    for (i = lh->num_nodes - 1; i >= 0; i--) {
        a = lh->b[i];
        while (a != NULL) {
            n = a->next;
            if (use_arg)
                func_arg(a->data, arg);
            else
                func(a->data);
            a = n;
        }
    }
}
['int s_client_main(int argc, char **argv)\n{\n    BIO *sbio;\n    EVP_PKEY *key = NULL;\n    SSL *con = NULL;\n    SSL_CTX *ctx = NULL;\n    STACK_OF(X509) *chain = NULL;\n    X509 *cert = NULL;\n    X509_VERIFY_PARAM *vpm = NULL;\n    SSL_EXCERT *exc = NULL;\n    SSL_CONF_CTX *cctx = NULL;\n    STACK_OF(OPENSSL_STRING) *ssl_args = NULL;\n    char *dane_tlsa_domain = NULL;\n    STACK_OF(OPENSSL_STRING) *dane_tlsa_rrset = NULL;\n    STACK_OF(X509_CRL) *crls = NULL;\n    const SSL_METHOD *meth = TLS_client_method();\n    char *CApath = NULL, *CAfile = NULL, *cbuf = NULL, *sbuf = NULL;\n    char *mbuf = NULL, *proxystr = NULL, *connectstr = NULL;\n    char *cert_file = NULL, *key_file = NULL, *chain_file = NULL;\n    char *chCApath = NULL, *chCAfile = NULL, *host = NULL;\n    char *port = BUF_strdup(PORT);\n    char *inrand = NULL;\n    char *passarg = NULL, *pass = NULL, *vfyCApath = NULL, *vfyCAfile = NULL;\n    char *sess_in = NULL, *sess_out = NULL, *crl_file = NULL, *p;\n    char *xmpphost = NULL;\n    const char *ehlo = "mail.example.com";\n    struct timeval timeout, *timeoutp;\n    fd_set readfds, writefds;\n    int noCApath = 0, noCAfile = 0;\n    int build_chain = 0, cbuf_len, cbuf_off, cert_format = FORMAT_PEM;\n    int key_format = FORMAT_PEM, crlf = 0, full_log = 1, mbuf_len = 0;\n    int prexit = 0;\n    int sdebug = 0;\n    int reconnect = 0, verify = SSL_VERIFY_NONE, vpmtouched = 0;\n    int ret = 1, in_init = 1, i, nbio_test = 0, s = -1, k, width, state = 0;\n    int sbuf_len, sbuf_off, cmdletters = 1;\n    int socket_family = AF_UNSPEC, socket_type = SOCK_STREAM;\n    int starttls_proto = PROTO_OFF, crl_format = FORMAT_PEM, crl_download = 0;\n    int write_tty, read_tty, write_ssl, read_ssl, tty_on, ssl_pending;\n    int read_buf_len = 0;\n    int fallback_scsv = 0;\n    long randamt = 0;\n    OPTION_CHOICE o;\n#ifndef OPENSSL_NO_DTLS\n    int enable_timeouts = 0;\n    long socket_mtu = 0;\n#endif\n#ifndef OPENSSL_NO_ENGINE\n    ENGINE *ssl_client_engine = NULL;\n#endif\n    ENGINE *e = NULL;\n#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS)\n    struct timeval tv;\n#endif\n    char *servername = NULL;\n    const char *alpn_in = NULL;\n    tlsextctx tlsextcbp = { NULL, 0 };\n    const char *ssl_config = NULL;\n#define MAX_SI_TYPES 100\n    unsigned short serverinfo_types[MAX_SI_TYPES];\n    int serverinfo_count = 0, start = 0, len;\n#ifndef OPENSSL_NO_NEXTPROTONEG\n    const char *next_proto_neg_in = NULL;\n#endif\n#ifndef OPENSSL_NO_SRP\n    char *srppass = NULL;\n    int srp_lateuser = 0;\n    SRP_ARG srp_arg = { NULL, NULL, 0, 0, 0, 1024 };\n#endif\n#ifndef OPENSSL_NO_CT\n    char *ctlog_file = NULL;\n    int ct_validation = 0;\n#endif\n    int min_version = 0, max_version = 0;\n    int async = 0;\n    unsigned int split_send_fragment = 0;\n    unsigned int max_pipelines = 0;\n    FD_ZERO(&readfds);\n    FD_ZERO(&writefds);\n#if defined(__has_feature)\n# if __has_feature(memory_sanitizer)\n    __msan_unpoison(&readfds, sizeof(readfds));\n    __msan_unpoison(&writefds, sizeof(writefds));\n# endif\n#endif\n    prog = opt_progname(argv[0]);\n    c_quiet = 0;\n    c_ign_eof = 0;\n    c_debug = 0;\n    c_msg = 0;\n    c_showcerts = 0;\n    c_nbio = 0;\n    verify_depth = 0;\n    verify_error = X509_V_OK;\n    vpm = X509_VERIFY_PARAM_new();\n    cbuf = app_malloc(BUFSIZZ, "cbuf");\n    sbuf = app_malloc(BUFSIZZ, "sbuf");\n    mbuf = app_malloc(BUFSIZZ, "mbuf");\n    cctx = SSL_CONF_CTX_new();\n    if (vpm == NULL || cctx == NULL) {\n        BIO_printf(bio_err, "%s: out of memory\\n", prog);\n        goto end;\n    }\n    SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_CLIENT | SSL_CONF_FLAG_CMDLINE);\n    prog = opt_init(argc, argv, s_client_options);\n    while ((o = opt_next()) != OPT_EOF) {\n        switch (o) {\n        case OPT_EOF:\n        case OPT_ERR:\n opthelp:\n            BIO_printf(bio_err, "%s: Use -help for summary.\\n", prog);\n            goto end;\n        case OPT_HELP:\n            opt_help(s_client_options);\n            ret = 0;\n            goto end;\n        case OPT_4:\n#ifdef AF_UNIX\n            if (socket_family == AF_UNIX) {\n                OPENSSL_free(host); host = NULL;\n                OPENSSL_free(port); port = NULL;\n            }\n#endif\n            socket_family = AF_INET;\n            break;\n        case OPT_6:\n            if (1) {\n#ifdef AF_INET6\n#ifdef AF_UNIX\n                if (socket_family == AF_UNIX) {\n                    OPENSSL_free(host); host = NULL;\n                    OPENSSL_free(port); port = NULL;\n                }\n#endif\n                socket_family = AF_INET6;\n            } else {\n#endif\n                BIO_printf(bio_err, "%s: IPv6 domain sockets unsupported\\n", prog);\n                goto end;\n            }\n            break;\n        case OPT_HOST:\n#ifdef AF_UNIX\n            if (socket_family == AF_UNIX) {\n                OPENSSL_free(host); host = NULL;\n                OPENSSL_free(port); port = NULL;\n                socket_family = AF_UNSPEC;\n            }\n#endif\n            OPENSSL_free(host); host = BUF_strdup(opt_arg());\n            break;\n        case OPT_PORT:\n#ifdef AF_UNIX\n            if (socket_family == AF_UNIX) {\n                OPENSSL_free(host); host = NULL;\n                OPENSSL_free(port); port = NULL;\n                socket_family = AF_UNSPEC;\n            }\n#endif\n            OPENSSL_free(port); port = BUF_strdup(opt_arg());\n            break;\n        case OPT_CONNECT:\n#ifdef AF_UNIX\n            if (socket_family == AF_UNIX) {\n                socket_family = AF_UNSPEC;\n            }\n#endif\n            OPENSSL_free(host); host = NULL;\n            OPENSSL_free(port); port = NULL;\n            connectstr = opt_arg();\n            break;\n        case OPT_PROXY:\n            proxystr = opt_arg();\n            starttls_proto = PROTO_CONNECT;\n            break;\n#ifdef AF_UNIX\n        case OPT_UNIX:\n            socket_family = AF_UNIX;\n            OPENSSL_free(host); host = BUF_strdup(opt_arg());\n            OPENSSL_free(port); port = NULL;\n            break;\n#endif\n        case OPT_XMPPHOST:\n            xmpphost = opt_arg();\n            break;\n        case OPT_SMTPHOST:\n            ehlo = opt_arg();\n            break;\n        case OPT_VERIFY:\n            verify = SSL_VERIFY_PEER;\n            verify_depth = atoi(opt_arg());\n            if (!c_quiet)\n                BIO_printf(bio_err, "verify depth is %d\\n", verify_depth);\n            break;\n        case OPT_CERT:\n            cert_file = opt_arg();\n            break;\n        case OPT_CRL:\n            crl_file = opt_arg();\n            break;\n        case OPT_CRL_DOWNLOAD:\n            crl_download = 1;\n            break;\n        case OPT_SESS_OUT:\n            sess_out = opt_arg();\n            break;\n        case OPT_SESS_IN:\n            sess_in = opt_arg();\n            break;\n        case OPT_CERTFORM:\n            if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &cert_format))\n                goto opthelp;\n            break;\n        case OPT_CRLFORM:\n            if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &crl_format))\n                goto opthelp;\n            break;\n        case OPT_VERIFY_RET_ERROR:\n            verify_return_error = 1;\n            break;\n        case OPT_VERIFY_QUIET:\n            verify_quiet = 1;\n            break;\n        case OPT_BRIEF:\n            c_brief = verify_quiet = c_quiet = 1;\n            break;\n        case OPT_S_CASES:\n            if (ssl_args == NULL)\n                ssl_args = sk_OPENSSL_STRING_new_null();\n            if (ssl_args == NULL\n                || !sk_OPENSSL_STRING_push(ssl_args, opt_flag())\n                || !sk_OPENSSL_STRING_push(ssl_args, opt_arg())) {\n                BIO_printf(bio_err, "%s: Memory allocation failure\\n", prog);\n                goto end;\n            }\n            break;\n        case OPT_V_CASES:\n            if (!opt_verify(o, vpm))\n                goto end;\n            vpmtouched++;\n            break;\n        case OPT_X_CASES:\n            if (!args_excert(o, &exc))\n                goto end;\n            break;\n        case OPT_PREXIT:\n            prexit = 1;\n            break;\n        case OPT_CRLF:\n            crlf = 1;\n            break;\n        case OPT_QUIET:\n            c_quiet = c_ign_eof = 1;\n            break;\n        case OPT_NBIO:\n            c_nbio = 1;\n            break;\n        case OPT_NOCMDS:\n            cmdletters = 0;\n            break;\n        case OPT_ENGINE:\n            e = setup_engine(opt_arg(), 1);\n            break;\n        case OPT_SSL_CLIENT_ENGINE:\n#ifndef OPENSSL_NO_ENGINE\n            ssl_client_engine = ENGINE_by_id(opt_arg());\n            if (ssl_client_engine == NULL) {\n                BIO_printf(bio_err, "Error getting client auth engine\\n");\n                goto opthelp;\n            }\n#endif\n            break;\n        case OPT_RAND:\n            inrand = opt_arg();\n            break;\n        case OPT_IGN_EOF:\n            c_ign_eof = 1;\n            break;\n        case OPT_NO_IGN_EOF:\n            c_ign_eof = 0;\n            break;\n        case OPT_DEBUG:\n            c_debug = 1;\n            break;\n        case OPT_TLSEXTDEBUG:\n            c_tlsextdebug = 1;\n            break;\n        case OPT_STATUS:\n            c_status_req = 1;\n            break;\n        case OPT_WDEBUG:\n#ifdef WATT32\n            dbug_init();\n#endif\n            break;\n        case OPT_MSG:\n            c_msg = 1;\n            break;\n        case OPT_MSGFILE:\n            bio_c_msg = BIO_new_file(opt_arg(), "w");\n            break;\n        case OPT_TRACE:\n#ifndef OPENSSL_NO_SSL_TRACE\n            c_msg = 2;\n#endif\n            break;\n        case OPT_SECURITY_DEBUG:\n            sdebug = 1;\n            break;\n        case OPT_SECURITY_DEBUG_VERBOSE:\n            sdebug = 2;\n            break;\n        case OPT_SHOWCERTS:\n            c_showcerts = 1;\n            break;\n        case OPT_NBIO_TEST:\n            nbio_test = 1;\n            break;\n        case OPT_STATE:\n            state = 1;\n            break;\n#ifndef OPENSSL_NO_PSK\n        case OPT_PSK_IDENTITY:\n            psk_identity = opt_arg();\n            break;\n        case OPT_PSK:\n            for (p = psk_key = opt_arg(); *p; p++) {\n                if (isxdigit(_UC(*p)))\n                    continue;\n                BIO_printf(bio_err, "Not a hex number \'%s\'\\n", psk_key);\n                goto end;\n            }\n            break;\n#endif\n#ifndef OPENSSL_NO_SRP\n        case OPT_SRPUSER:\n            srp_arg.srplogin = opt_arg();\n            if (min_version < TLS1_VERSION)\n                min_version = TLS1_VERSION;\n            break;\n        case OPT_SRPPASS:\n            srppass = opt_arg();\n            if (min_version < TLS1_VERSION)\n                min_version = TLS1_VERSION;\n            break;\n        case OPT_SRP_STRENGTH:\n            srp_arg.strength = atoi(opt_arg());\n            BIO_printf(bio_err, "SRP minimal length for N is %d\\n",\n                       srp_arg.strength);\n            if (min_version < TLS1_VERSION)\n                min_version = TLS1_VERSION;\n            break;\n        case OPT_SRP_LATEUSER:\n            srp_lateuser = 1;\n            if (min_version < TLS1_VERSION)\n                min_version = TLS1_VERSION;\n            break;\n        case OPT_SRP_MOREGROUPS:\n            srp_arg.amp = 1;\n            if (min_version < TLS1_VERSION)\n                min_version = TLS1_VERSION;\n            break;\n#endif\n        case OPT_SSL_CONFIG:\n            ssl_config = opt_arg();\n            break;\n        case OPT_SSL3:\n            min_version = SSL3_VERSION;\n            max_version = SSL3_VERSION;\n            break;\n        case OPT_TLS1_2:\n            min_version = TLS1_2_VERSION;\n            max_version = TLS1_2_VERSION;\n            break;\n        case OPT_TLS1_1:\n            min_version = TLS1_1_VERSION;\n            max_version = TLS1_1_VERSION;\n            break;\n        case OPT_TLS1:\n            min_version = TLS1_VERSION;\n            max_version = TLS1_VERSION;\n            break;\n        case OPT_DTLS:\n#ifndef OPENSSL_NO_DTLS\n            meth = DTLS_client_method();\n            socket_type = SOCK_DGRAM;\n#endif\n            break;\n        case OPT_DTLS1:\n#ifndef OPENSSL_NO_DTLS1\n            meth = DTLS_client_method();\n            min_version = DTLS1_VERSION;\n            max_version = DTLS1_VERSION;\n            socket_type = SOCK_DGRAM;\n#endif\n            break;\n        case OPT_DTLS1_2:\n#ifndef OPENSSL_NO_DTLS1_2\n            meth = DTLS_client_method();\n            min_version = DTLS1_2_VERSION;\n            max_version = DTLS1_2_VERSION;\n            socket_type = SOCK_DGRAM;\n#endif\n            break;\n        case OPT_TIMEOUT:\n#ifndef OPENSSL_NO_DTLS\n            enable_timeouts = 1;\n#endif\n            break;\n        case OPT_MTU:\n#ifndef OPENSSL_NO_DTLS\n            socket_mtu = atol(opt_arg());\n#endif\n            break;\n        case OPT_FALLBACKSCSV:\n            fallback_scsv = 1;\n            break;\n        case OPT_KEYFORM:\n            if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &key_format))\n                goto opthelp;\n            break;\n        case OPT_PASS:\n            passarg = opt_arg();\n            break;\n        case OPT_CERT_CHAIN:\n            chain_file = opt_arg();\n            break;\n        case OPT_KEY:\n            key_file = opt_arg();\n            break;\n        case OPT_RECONNECT:\n            reconnect = 5;\n            break;\n        case OPT_CAPATH:\n            CApath = opt_arg();\n            break;\n        case OPT_NOCAPATH:\n            noCApath = 1;\n            break;\n        case OPT_CHAINCAPATH:\n            chCApath = opt_arg();\n            break;\n        case OPT_VERIFYCAPATH:\n            vfyCApath = opt_arg();\n            break;\n        case OPT_BUILD_CHAIN:\n            build_chain = 1;\n            break;\n        case OPT_CAFILE:\n            CAfile = opt_arg();\n            break;\n        case OPT_NOCAFILE:\n            noCAfile = 1;\n            break;\n#ifndef OPENSSL_NO_CT\n        case OPT_NOCT:\n            ct_validation = 0;\n            break;\n        case OPT_CT:\n            ct_validation = 1;\n            break;\n        case OPT_CTLOG_FILE:\n            ctlog_file = opt_arg();\n            break;\n#endif\n        case OPT_CHAINCAFILE:\n            chCAfile = opt_arg();\n            break;\n        case OPT_VERIFYCAFILE:\n            vfyCAfile = opt_arg();\n            break;\n        case OPT_DANE_TLSA_DOMAIN:\n            dane_tlsa_domain = opt_arg();\n            break;\n        case OPT_DANE_TLSA_RRDATA:\n            if (dane_tlsa_rrset == NULL)\n                dane_tlsa_rrset = sk_OPENSSL_STRING_new_null();\n            if (dane_tlsa_rrset == NULL ||\n                !sk_OPENSSL_STRING_push(dane_tlsa_rrset, opt_arg())) {\n                BIO_printf(bio_err, "%s: Memory allocation failure\\n", prog);\n                goto end;\n            }\n            break;\n        case OPT_NEXTPROTONEG:\n#ifndef OPENSSL_NO_NEXTPROTONEG\n            next_proto_neg_in = opt_arg();\n#endif\n            break;\n        case OPT_ALPN:\n            alpn_in = opt_arg();\n            break;\n        case OPT_SERVERINFO:\n            p = opt_arg();\n            len = strlen(p);\n            for (start = 0, i = 0; i <= len; ++i) {\n                if (i == len || p[i] == \',\') {\n                    serverinfo_types[serverinfo_count] = atoi(p + start);\n                    if (++serverinfo_count == MAX_SI_TYPES)\n                        break;\n                    start = i + 1;\n                }\n            }\n            break;\n        case OPT_STARTTLS:\n            if (!opt_pair(opt_arg(), services, &starttls_proto))\n                goto end;\n            break;\n        case OPT_SERVERNAME:\n            servername = opt_arg();\n            break;\n        case OPT_USE_SRTP:\n            srtp_profiles = opt_arg();\n            break;\n        case OPT_KEYMATEXPORT:\n            keymatexportlabel = opt_arg();\n            break;\n        case OPT_KEYMATEXPORTLEN:\n            keymatexportlen = atoi(opt_arg());\n            break;\n        case OPT_ASYNC:\n            async = 1;\n            break;\n        case OPT_SPLIT_SEND_FRAG:\n            split_send_fragment = atoi(opt_arg());\n            if (split_send_fragment == 0) {\n                split_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH + 1;\n            }\n            break;\n        case OPT_MAX_PIPELINES:\n            max_pipelines = atoi(opt_arg());\n            break;\n        case OPT_READ_BUF:\n            read_buf_len = atoi(opt_arg());\n            break;\n        }\n    }\n    argc = opt_num_rest();\n    if (argc != 0)\n        goto opthelp;\n    if (proxystr) {\n        int res;\n        char *tmp_host = host, *tmp_port = port;\n        if (connectstr == NULL) {\n            BIO_printf(bio_err, "%s: -proxy requires use of -connect\\n", prog);\n            goto opthelp;\n        }\n        res = BIO_parse_hostserv(proxystr, &host, &port, BIO_PARSE_PRIO_HOST);\n        if (tmp_host != host)\n            OPENSSL_free(tmp_host);\n        if (tmp_port != port)\n            OPENSSL_free(tmp_port);\n        if (!res) {\n            BIO_printf(bio_err, "%s: -proxy argument malformed or ambiguous\\n",\n                       prog);\n            goto end;\n        }\n    } else {\n        int res = 1;\n        char *tmp_host = host, *tmp_port = port;\n        if (connectstr != NULL)\n            res = BIO_parse_hostserv(connectstr, &host, &port,\n                                     BIO_PARSE_PRIO_HOST);\n        if (tmp_host != host)\n            OPENSSL_free(tmp_host);\n        if (tmp_port != port)\n            OPENSSL_free(tmp_port);\n        if (!res) {\n            BIO_printf(bio_err,\n                       "%s: -connect argument malformed or ambiguous\\n",\n                       prog);\n            goto end;\n        }\n    }\n    if (socket_family == AF_UNIX && socket_type != SOCK_STREAM) {\n        BIO_printf(bio_err,\n                   "Can\'t use unix sockets and datagrams together\\n");\n        goto end;\n    }\n    if (split_send_fragment > SSL3_RT_MAX_PLAIN_LENGTH) {\n        BIO_printf(bio_err, "Bad split send fragment size\\n");\n        goto end;\n    }\n    if (max_pipelines > SSL_MAX_PIPELINES) {\n        BIO_printf(bio_err, "Bad max pipelines value\\n");\n        goto end;\n    }\n#if !defined(OPENSSL_NO_NEXTPROTONEG)\n    next_proto.status = -1;\n    if (next_proto_neg_in) {\n        next_proto.data =\n            next_protos_parse(&next_proto.len, next_proto_neg_in);\n        if (next_proto.data == NULL) {\n            BIO_printf(bio_err, "Error parsing -nextprotoneg argument\\n");\n            goto end;\n        }\n    } else\n        next_proto.data = NULL;\n#endif\n    if (!app_passwd(passarg, NULL, &pass, NULL)) {\n        BIO_printf(bio_err, "Error getting password\\n");\n        goto end;\n    }\n    if (key_file == NULL)\n        key_file = cert_file;\n    if (key_file) {\n        key = load_key(key_file, key_format, 0, pass, e,\n                       "client certificate private key file");\n        if (key == NULL) {\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n    }\n    if (cert_file) {\n        cert = load_cert(cert_file, cert_format, "client certificate file");\n        if (cert == NULL) {\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n    }\n    if (chain_file) {\n        if (!load_certs(chain_file, &chain, FORMAT_PEM, NULL,\n                        "client certificate chain"))\n            goto end;\n    }\n    if (crl_file) {\n        X509_CRL *crl;\n        crl = load_crl(crl_file, crl_format);\n        if (crl == NULL) {\n            BIO_puts(bio_err, "Error loading CRL\\n");\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n        crls = sk_X509_CRL_new_null();\n        if (crls == NULL || !sk_X509_CRL_push(crls, crl)) {\n            BIO_puts(bio_err, "Error adding CRL\\n");\n            ERR_print_errors(bio_err);\n            X509_CRL_free(crl);\n            goto end;\n        }\n    }\n    if (!load_excert(&exc))\n        goto end;\n    if (!app_RAND_load_file(NULL, 1) && inrand == NULL\n        && !RAND_status()) {\n        BIO_printf(bio_err,\n                   "warning, not much extra random data, consider using the -rand option\\n");\n    }\n    if (inrand != NULL) {\n        randamt = app_RAND_load_files(inrand);\n        BIO_printf(bio_err, "%ld semi-random bytes loaded\\n", randamt);\n    }\n    if (bio_c_out == NULL) {\n        if (c_quiet && !c_debug) {\n            bio_c_out = BIO_new(BIO_s_null());\n            if (c_msg && !bio_c_msg)\n                bio_c_msg = dup_bio_out(FORMAT_TEXT);\n        } else if (bio_c_out == NULL)\n            bio_c_out = dup_bio_out(FORMAT_TEXT);\n    }\n#ifndef OPENSSL_NO_SRP\n    if (!app_passwd(srppass, NULL, &srp_arg.srppassin, NULL)) {\n        BIO_printf(bio_err, "Error getting password\\n");\n        goto end;\n    }\n#endif\n    ctx = SSL_CTX_new(meth);\n    if (ctx == NULL) {\n        ERR_print_errors(bio_err);\n        goto end;\n    }\n    if (sdebug)\n        ssl_ctx_security_debug(ctx, sdebug);\n    if (ssl_config) {\n        if (SSL_CTX_config(ctx, ssl_config) == 0) {\n            BIO_printf(bio_err, "Error using configuration \\"%s\\"\\n",\n                       ssl_config);\n        ERR_print_errors(bio_err);\n        goto end;\n        }\n    }\n    if (SSL_CTX_set_min_proto_version(ctx, min_version) == 0)\n        goto end;\n    if (SSL_CTX_set_max_proto_version(ctx, max_version) == 0)\n        goto end;\n    if (vpmtouched && !SSL_CTX_set1_param(ctx, vpm)) {\n        BIO_printf(bio_err, "Error setting verify params\\n");\n        ERR_print_errors(bio_err);\n        goto end;\n    }\n    if (async) {\n        SSL_CTX_set_mode(ctx, SSL_MODE_ASYNC);\n    }\n    if (split_send_fragment > 0) {\n        SSL_CTX_set_split_send_fragment(ctx, split_send_fragment);\n    }\n    if (max_pipelines > 0) {\n        SSL_CTX_set_max_pipelines(ctx, max_pipelines);\n    }\n    if (read_buf_len > 0) {\n        SSL_CTX_set_default_read_buffer_len(ctx, read_buf_len);\n    }\n    if (!config_ctx(cctx, ssl_args, ctx))\n        goto end;\n    if (!ssl_load_stores(ctx, vfyCApath, vfyCAfile, chCApath, chCAfile,\n                         crls, crl_download)) {\n        BIO_printf(bio_err, "Error loading store locations\\n");\n        ERR_print_errors(bio_err);\n        goto end;\n    }\n#ifndef OPENSSL_NO_ENGINE\n    if (ssl_client_engine) {\n        if (!SSL_CTX_set_client_cert_engine(ctx, ssl_client_engine)) {\n            BIO_puts(bio_err, "Error setting client auth engine\\n");\n            ERR_print_errors(bio_err);\n            ENGINE_free(ssl_client_engine);\n            goto end;\n        }\n        ENGINE_free(ssl_client_engine);\n    }\n#endif\n#ifndef OPENSSL_NO_PSK\n    if (psk_key != NULL) {\n        if (c_debug)\n            BIO_printf(bio_c_out,\n                       "PSK key given, setting client callback\\n");\n        SSL_CTX_set_psk_client_callback(ctx, psk_client_cb);\n    }\n#endif\n#ifndef OPENSSL_NO_SRTP\n    if (srtp_profiles != NULL) {\n        if (SSL_CTX_set_tlsext_use_srtp(ctx, srtp_profiles) != 0) {\n            BIO_printf(bio_err, "Error setting SRTP profile\\n");\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n    }\n#endif\n    if (exc)\n        ssl_ctx_set_excert(ctx, exc);\n#if !defined(OPENSSL_NO_NEXTPROTONEG)\n    if (next_proto.data)\n        SSL_CTX_set_next_proto_select_cb(ctx, next_proto_cb, &next_proto);\n#endif\n    if (alpn_in) {\n        size_t alpn_len;\n        unsigned char *alpn = next_protos_parse(&alpn_len, alpn_in);\n        if (alpn == NULL) {\n            BIO_printf(bio_err, "Error parsing -alpn argument\\n");\n            goto end;\n        }\n        if (SSL_CTX_set_alpn_protos(ctx, alpn, alpn_len) != 0) {\n           BIO_printf(bio_err, "Error setting ALPN\\n");\n            goto end;\n        }\n        OPENSSL_free(alpn);\n    }\n    for (i = 0; i < serverinfo_count; i++) {\n        if (!SSL_CTX_add_client_custom_ext(ctx,\n                                           serverinfo_types[i],\n                                           NULL, NULL, NULL,\n                                           serverinfo_cli_parse_cb, NULL)) {\n            BIO_printf(bio_err,\n                    "Warning: Unable to add custom extension %u, skipping\\n",\n                    serverinfo_types[i]);\n        }\n    }\n    if (state)\n        SSL_CTX_set_info_callback(ctx, apps_ssl_info_callback);\n#ifndef OPENSSL_NO_CT\n    if (ct_validation &&\n        !SSL_CTX_enable_ct(ctx, SSL_CT_VALIDATION_PERMISSIVE)) {\n        ERR_print_errors(bio_err);\n        goto end;\n    }\n    if (!ctx_set_ctlog_list_file(ctx, ctlog_file)) {\n        if (ct_validation) {\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n        ERR_clear_error();\n    }\n#endif\n    SSL_CTX_set_verify(ctx, verify, verify_callback);\n    if (!ctx_set_verify_locations(ctx, CAfile, CApath, noCAfile, noCApath)) {\n        ERR_print_errors(bio_err);\n        goto end;\n    }\n    ssl_ctx_add_crls(ctx, crls, crl_download);\n    if (!set_cert_key_stuff(ctx, cert, key, chain, build_chain))\n        goto end;\n    if (servername != NULL) {\n        tlsextcbp.biodebug = bio_err;\n        SSL_CTX_set_tlsext_servername_callback(ctx, ssl_servername_cb);\n        SSL_CTX_set_tlsext_servername_arg(ctx, &tlsextcbp);\n    }\n# ifndef OPENSSL_NO_SRP\n    if (srp_arg.srplogin) {\n        if (!srp_lateuser && !SSL_CTX_set_srp_username(ctx, srp_arg.srplogin)) {\n            BIO_printf(bio_err, "Unable to set SRP username\\n");\n            goto end;\n        }\n        srp_arg.msg = c_msg;\n        srp_arg.debug = c_debug;\n        SSL_CTX_set_srp_cb_arg(ctx, &srp_arg);\n        SSL_CTX_set_srp_client_pwd_callback(ctx, ssl_give_srp_client_pwd_cb);\n        SSL_CTX_set_srp_strength(ctx, srp_arg.strength);\n        if (c_msg || c_debug || srp_arg.amp == 0)\n            SSL_CTX_set_srp_verify_param_callback(ctx,\n                                                  ssl_srp_verify_param_cb);\n    }\n# endif\n    if (dane_tlsa_domain != NULL) {\n        if (SSL_CTX_dane_enable(ctx) <= 0) {\n            BIO_printf(bio_err,\n                       "%s: Error enabling DANE TLSA authentication.\\n", prog);\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n    }\n    con = SSL_new(ctx);\n    if (sess_in) {\n        SSL_SESSION *sess;\n        BIO *stmp = BIO_new_file(sess_in, "r");\n        if (!stmp) {\n            BIO_printf(bio_err, "Can\'t open session file %s\\n", sess_in);\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n        sess = PEM_read_bio_SSL_SESSION(stmp, NULL, 0, NULL);\n        BIO_free(stmp);\n        if (!sess) {\n            BIO_printf(bio_err, "Can\'t open session file %s\\n", sess_in);\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n        if (!SSL_set_session(con, sess)) {\n            BIO_printf(bio_err, "Can\'t set session\\n");\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n        SSL_SESSION_free(sess);\n    }\n    if (fallback_scsv)\n        SSL_set_mode(con, SSL_MODE_SEND_FALLBACK_SCSV);\n    if (servername != NULL) {\n        if (!SSL_set_tlsext_host_name(con, servername)) {\n            BIO_printf(bio_err, "Unable to set TLS servername extension.\\n");\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n    }\n    if (dane_tlsa_domain != NULL) {\n        if (SSL_dane_enable(con, dane_tlsa_domain) <= 0) {\n            BIO_printf(bio_err, "%s: Error enabling DANE TLSA "\n                       "authentication.\\n", prog);\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n        if (dane_tlsa_rrset == NULL) {\n            BIO_printf(bio_err, "%s: DANE TLSA authentication requires at "\n                       "least one -dane_tlsa_rrset option.\\n", prog);\n            goto end;\n        }\n        if (tlsa_import_rrset(con, dane_tlsa_rrset) <= 0) {\n            BIO_printf(bio_err, "%s: Failed to import any TLSA "\n                       "records.\\n", prog);\n            goto end;\n        }\n    } else if (dane_tlsa_rrset != NULL) {\n        BIO_printf(bio_err, "%s: DANE TLSA authentication requires the "\n                   "-dane_tlsa_domain option.\\n", prog);\n        goto end;\n    }\n re_start:\n    if (init_client(&s, host, port, socket_family, socket_type) == 0)\n    {\n        BIO_printf(bio_err, "connect:errno=%d\\n", get_last_socket_error());\n        BIO_closesocket(s);\n        goto end;\n    }\n    BIO_printf(bio_c_out, "CONNECTED(%08X)\\n", s);\n    if (c_nbio) {\n        if (!BIO_socket_nbio(s, 1)) {\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n        BIO_printf(bio_c_out, "Turned on non blocking io\\n");\n    }\n#ifndef OPENSSL_NO_DTLS\n    if (socket_type == SOCK_DGRAM) {\n        struct sockaddr peer;\n        int peerlen = sizeof peer;\n        sbio = BIO_new_dgram(s, BIO_NOCLOSE);\n        if (getsockname(s, &peer, (void *)&peerlen) < 0) {\n            BIO_printf(bio_err, "getsockname:errno=%d\\n",\n                       get_last_socket_error());\n            BIO_closesocket(s);\n            goto end;\n        }\n        (void)BIO_ctrl_set_connected(sbio, &peer);\n        if (enable_timeouts) {\n            timeout.tv_sec = 0;\n            timeout.tv_usec = DGRAM_RCV_TIMEOUT;\n            BIO_ctrl(sbio, BIO_CTRL_DGRAM_SET_RECV_TIMEOUT, 0, &timeout);\n            timeout.tv_sec = 0;\n            timeout.tv_usec = DGRAM_SND_TIMEOUT;\n            BIO_ctrl(sbio, BIO_CTRL_DGRAM_SET_SEND_TIMEOUT, 0, &timeout);\n        }\n        if (socket_mtu) {\n            if (socket_mtu < DTLS_get_link_min_mtu(con)) {\n                BIO_printf(bio_err, "MTU too small. Must be at least %ld\\n",\n                           DTLS_get_link_min_mtu(con));\n                BIO_free(sbio);\n                goto shut;\n            }\n            SSL_set_options(con, SSL_OP_NO_QUERY_MTU);\n            if (!DTLS_set_link_mtu(con, socket_mtu)) {\n                BIO_printf(bio_err, "Failed to set MTU\\n");\n                BIO_free(sbio);\n                goto shut;\n            }\n        } else\n            BIO_ctrl(sbio, BIO_CTRL_DGRAM_MTU_DISCOVER, 0, NULL);\n    } else\n#endif\n        sbio = BIO_new_socket(s, BIO_NOCLOSE);\n    if (nbio_test) {\n        BIO *test;\n        test = BIO_new(BIO_f_nbio_test());\n        sbio = BIO_push(test, sbio);\n    }\n    if (c_debug) {\n        BIO_set_callback(sbio, bio_dump_callback);\n        BIO_set_callback_arg(sbio, (char *)bio_c_out);\n    }\n    if (c_msg) {\n#ifndef OPENSSL_NO_SSL_TRACE\n        if (c_msg == 2)\n            SSL_set_msg_callback(con, SSL_trace);\n        else\n#endif\n            SSL_set_msg_callback(con, msg_cb);\n        SSL_set_msg_callback_arg(con, bio_c_msg ? bio_c_msg : bio_c_out);\n    }\n    if (c_tlsextdebug) {\n        SSL_set_tlsext_debug_callback(con, tlsext_cb);\n        SSL_set_tlsext_debug_arg(con, bio_c_out);\n    }\n#ifndef OPENSSL_NO_OCSP\n    if (c_status_req) {\n        SSL_set_tlsext_status_type(con, TLSEXT_STATUSTYPE_ocsp);\n        SSL_CTX_set_tlsext_status_cb(ctx, ocsp_resp_cb);\n        SSL_CTX_set_tlsext_status_arg(ctx, bio_c_out);\n    }\n#endif\n    SSL_set_bio(con, sbio, sbio);\n    SSL_set_connect_state(con);\n    width = SSL_get_fd(con) + 1;\n    read_tty = 1;\n    write_tty = 0;\n    tty_on = 0;\n    read_ssl = 1;\n    write_ssl = 1;\n    cbuf_len = 0;\n    cbuf_off = 0;\n    sbuf_len = 0;\n    sbuf_off = 0;\n    switch ((PROTOCOL_CHOICE) starttls_proto) {\n    case PROTO_OFF:\n        break;\n    case PROTO_SMTP:\n        {\n            int foundit = 0;\n            BIO *fbio = BIO_new(BIO_f_buffer());\n            BIO_push(fbio, sbio);\n            do {\n                mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);\n            }\n            while (mbuf_len > 3 && mbuf[3] == \'-\');\n            BIO_printf(fbio, "EHLO %s\\r\\n", ehlo);\n            (void)BIO_flush(fbio);\n            do {\n                mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);\n                if (strstr(mbuf, "STARTTLS"))\n                    foundit = 1;\n            }\n            while (mbuf_len > 3 && mbuf[3] == \'-\');\n            (void)BIO_flush(fbio);\n            BIO_pop(fbio);\n            BIO_free(fbio);\n            if (!foundit)\n                BIO_printf(bio_err,\n                           "didn\'t find starttls in server response,"\n                           " trying anyway...\\n");\n            BIO_printf(sbio, "STARTTLS\\r\\n");\n            BIO_read(sbio, sbuf, BUFSIZZ);\n        }\n        break;\n    case PROTO_POP3:\n        {\n            BIO_read(sbio, mbuf, BUFSIZZ);\n            BIO_printf(sbio, "STLS\\r\\n");\n            mbuf_len = BIO_read(sbio, sbuf, BUFSIZZ);\n            if (mbuf_len < 0) {\n                BIO_printf(bio_err, "BIO_read failed\\n");\n                goto end;\n            }\n        }\n        break;\n    case PROTO_IMAP:\n        {\n            int foundit = 0;\n            BIO *fbio = BIO_new(BIO_f_buffer());\n            BIO_push(fbio, sbio);\n            BIO_gets(fbio, mbuf, BUFSIZZ);\n            BIO_printf(fbio, ". CAPABILITY\\r\\n");\n            (void)BIO_flush(fbio);\n            do {\n                mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);\n                if (strstr(mbuf, "STARTTLS"))\n                    foundit = 1;\n            }\n            while (mbuf_len > 3 && mbuf[0] != \'.\');\n            (void)BIO_flush(fbio);\n            BIO_pop(fbio);\n            BIO_free(fbio);\n            if (!foundit)\n                BIO_printf(bio_err,\n                           "didn\'t find STARTTLS in server response,"\n                           " trying anyway...\\n");\n            BIO_printf(sbio, ". STARTTLS\\r\\n");\n            BIO_read(sbio, sbuf, BUFSIZZ);\n        }\n        break;\n    case PROTO_FTP:\n        {\n            BIO *fbio = BIO_new(BIO_f_buffer());\n            BIO_push(fbio, sbio);\n            do {\n                mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);\n            }\n            while (mbuf_len > 3 && mbuf[3] == \'-\');\n            (void)BIO_flush(fbio);\n            BIO_pop(fbio);\n            BIO_free(fbio);\n            BIO_printf(sbio, "AUTH TLS\\r\\n");\n            BIO_read(sbio, sbuf, BUFSIZZ);\n        }\n        break;\n    case PROTO_XMPP:\n    case PROTO_XMPP_SERVER:\n        {\n            int seen = 0;\n            BIO_printf(sbio, "<stream:stream "\n                       "xmlns:stream=\'http://etherx.jabber.org/streams\' "\n                       "xmlns=\'jabber:%s\' to=\'%s\' version=\'1.0\'>",\n                       starttls_proto == PROTO_XMPP ? "client" : "server",\n                       xmpphost ? xmpphost : host);\n            seen = BIO_read(sbio, mbuf, BUFSIZZ);\n            mbuf[seen] = 0;\n            while (!strstr\n                   (mbuf, "<starttls xmlns=\'urn:ietf:params:xml:ns:xmpp-tls\'")\n                   && !strstr(mbuf,\n                              "<starttls xmlns=\\"urn:ietf:params:xml:ns:xmpp-tls\\""))\n            {\n                seen = BIO_read(sbio, mbuf, BUFSIZZ);\n                if (seen <= 0)\n                    goto shut;\n                mbuf[seen] = 0;\n            }\n            BIO_printf(sbio,\n                       "<starttls xmlns=\'urn:ietf:params:xml:ns:xmpp-tls\'/>");\n            seen = BIO_read(sbio, sbuf, BUFSIZZ);\n            sbuf[seen] = 0;\n            if (!strstr(sbuf, "<proceed"))\n                goto shut;\n            mbuf[0] = 0;\n        }\n        break;\n    case PROTO_TELNET:\n        {\n            static const unsigned char tls_do[] = {\n                   255,   253, 46\n            };\n            static const unsigned char tls_will[] = {\n                   255, 251, 46\n            };\n            static const unsigned char tls_follows[] = {\n                   255, 250, 46,       1,      255, 240\n            };\n            int bytes;\n            bytes = BIO_read(sbio, mbuf, BUFSIZZ);\n            if (bytes != 3 || memcmp(mbuf, tls_do, 3) != 0)\n                goto shut;\n            BIO_write(sbio, tls_will, 3);\n            BIO_write(sbio, tls_follows, 6);\n            (void)BIO_flush(sbio);\n            bytes = BIO_read(sbio, mbuf, BUFSIZZ);\n            if (bytes != 6 || memcmp(mbuf, tls_follows, 6) != 0)\n                goto shut;\n        }\n        break;\n    case PROTO_CONNECT:\n        {\n            int foundit = 0;\n            BIO *fbio = BIO_new(BIO_f_buffer());\n            BIO_push(fbio, sbio);\n            BIO_printf(fbio, "CONNECT %s HTTP/1.0\\r\\n\\r\\n", connectstr);\n            (void)BIO_flush(fbio);\n            do {\n                mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);\n                if (strstr(mbuf, "200") != NULL\n                    && strstr(mbuf, "established") != NULL)\n                    foundit++;\n            } while (mbuf_len > 3 && foundit == 0);\n            (void)BIO_flush(fbio);\n            BIO_pop(fbio);\n            BIO_free(fbio);\n            if (!foundit) {\n                BIO_printf(bio_err, "%s: HTTP CONNECT failed\\n", prog);\n                goto shut;\n            }\n        }\n        break;\n    case PROTO_IRC:\n        {\n            int numeric;\n            BIO *fbio = BIO_new(BIO_f_buffer());\n            BIO_push(fbio, sbio);\n            BIO_printf(fbio, "STARTTLS\\r\\n");\n            (void)BIO_flush(fbio);\n            width = SSL_get_fd(con) + 1;\n            do {\n                numeric = 0;\n                FD_ZERO(&readfds);\n                openssl_fdset(SSL_get_fd(con), &readfds);\n                timeout.tv_sec = S_CLIENT_IRC_READ_TIMEOUT;\n                timeout.tv_usec = 0;\n                if (!BIO_get_buffer_num_lines(fbio)\n                    && !BIO_pending(fbio)\n                    && !BIO_pending(sbio)\n                    && select(width, (void *)&readfds, NULL, NULL,\n                              &timeout) < 1) {\n                    BIO_printf(bio_err,\n                               "Timeout waiting for response (%d seconds).\\n",\n                               S_CLIENT_IRC_READ_TIMEOUT);\n                    break;\n                }\n                mbuf_len = BIO_gets(fbio, mbuf, BUFSIZZ);\n                if (mbuf_len < 1 || sscanf(mbuf, "%*s %d", &numeric) != 1)\n                    break;\n                if ((numeric == 451 || numeric == 421)\n                    && strstr(mbuf, "STARTTLS") != NULL) {\n                    BIO_printf(bio_err, "STARTTLS not supported: %s", mbuf);\n                    break;\n                }\n                if (numeric == 691) {\n                    BIO_printf(bio_err, "STARTTLS negotiation failed: ");\n                    ERR_print_errors(bio_err);\n                    break;\n                }\n            } while (numeric != 670);\n            (void)BIO_flush(fbio);\n            BIO_pop(fbio);\n            BIO_free(fbio);\n            if (numeric != 670) {\n                BIO_printf(bio_err, "Server does not support STARTTLS.\\n");\n                ret = 1;\n                goto shut;\n            }\n        }\n    }\n    for (;;) {\n        FD_ZERO(&readfds);\n        FD_ZERO(&writefds);\n        if ((SSL_version(con) == DTLS1_VERSION) &&\n            DTLSv1_get_timeout(con, &timeout))\n            timeoutp = &timeout;\n        else\n            timeoutp = NULL;\n        if (SSL_in_init(con) && !SSL_total_renegotiations(con)) {\n            in_init = 1;\n            tty_on = 0;\n        } else {\n            tty_on = 1;\n            if (in_init) {\n                in_init = 0;\n                if (servername != NULL && !SSL_session_reused(con)) {\n                    BIO_printf(bio_c_out,\n                               "Server did %sacknowledge servername extension.\\n",\n                               tlsextcbp.ack ? "" : "not ");\n                }\n                if (sess_out) {\n                    BIO *stmp = BIO_new_file(sess_out, "w");\n                    if (stmp) {\n                        PEM_write_bio_SSL_SESSION(stmp, SSL_get_session(con));\n                        BIO_free(stmp);\n                    } else\n                        BIO_printf(bio_err, "Error writing session file %s\\n",\n                                   sess_out);\n                }\n                if (c_brief) {\n                    BIO_puts(bio_err, "CONNECTION ESTABLISHED\\n");\n                    print_ssl_summary(con);\n                }\n                print_stuff(bio_c_out, con, full_log);\n                if (full_log > 0)\n                    full_log--;\n                if (starttls_proto) {\n                    BIO_write(bio_err, mbuf, mbuf_len);\n                    if (!reconnect)\n                        starttls_proto = PROTO_OFF;\n                }\n                if (reconnect) {\n                    reconnect--;\n                    BIO_printf(bio_c_out,\n                               "drop connection and then reconnect\\n");\n                    do_ssl_shutdown(con);\n                    SSL_set_connect_state(con);\n                    BIO_closesocket(SSL_get_fd(con));\n                    goto re_start;\n                }\n            }\n        }\n        ssl_pending = read_ssl && SSL_has_pending(con);\n        if (!ssl_pending) {\n#if !defined(OPENSSL_SYS_WINDOWS) && !defined(OPENSSL_SYS_MSDOS)\n            if (tty_on) {\n                if (read_tty)\n                    openssl_fdset(fileno(stdin), &readfds);\n                if (write_tty)\n                    openssl_fdset(fileno(stdout), &writefds);\n            }\n            if (read_ssl)\n                openssl_fdset(SSL_get_fd(con), &readfds);\n            if (write_ssl)\n                openssl_fdset(SSL_get_fd(con), &writefds);\n#else\n            if (!tty_on || !write_tty) {\n                if (read_ssl)\n                    openssl_fdset(SSL_get_fd(con), &readfds);\n                if (write_ssl)\n                    openssl_fdset(SSL_get_fd(con), &writefds);\n            }\n#endif\n#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS)\n            i = 0;\n            if (!write_tty) {\n                if (read_tty) {\n                    tv.tv_sec = 1;\n                    tv.tv_usec = 0;\n                    i = select(width, (void *)&readfds, (void *)&writefds,\n                               NULL, &tv);\n                    if (!i && (!has_stdin_waiting() || !read_tty))\n                        continue;\n                } else\n                    i = select(width, (void *)&readfds, (void *)&writefds,\n                               NULL, timeoutp);\n            }\n#else\n            i = select(width, (void *)&readfds, (void *)&writefds,\n                       NULL, timeoutp);\n#endif\n            if (i < 0) {\n                BIO_printf(bio_err, "bad select %d\\n",\n                           get_last_socket_error());\n                goto shut;\n            }\n        }\n        if ((SSL_version(con) == DTLS1_VERSION)\n            && DTLSv1_handle_timeout(con) > 0) {\n            BIO_printf(bio_err, "TIMEOUT occurred\\n");\n        }\n        if (!ssl_pending && FD_ISSET(SSL_get_fd(con), &writefds)) {\n            k = SSL_write(con, &(cbuf[cbuf_off]), (unsigned int)cbuf_len);\n            switch (SSL_get_error(con, k)) {\n            case SSL_ERROR_NONE:\n                cbuf_off += k;\n                cbuf_len -= k;\n                if (k <= 0)\n                    goto end;\n                if (cbuf_len <= 0) {\n                    read_tty = 1;\n                    write_ssl = 0;\n                } else {\n                    read_tty = 0;\n                    write_ssl = 1;\n                }\n                break;\n            case SSL_ERROR_WANT_WRITE:\n                BIO_printf(bio_c_out, "write W BLOCK\\n");\n                write_ssl = 1;\n                read_tty = 0;\n                break;\n            case SSL_ERROR_WANT_ASYNC:\n                BIO_printf(bio_c_out, "write A BLOCK\\n");\n                wait_for_async(con);\n                write_ssl = 1;\n                read_tty = 0;\n                break;\n            case SSL_ERROR_WANT_READ:\n                BIO_printf(bio_c_out, "write R BLOCK\\n");\n                write_tty = 0;\n                read_ssl = 1;\n                write_ssl = 0;\n                break;\n            case SSL_ERROR_WANT_X509_LOOKUP:\n                BIO_printf(bio_c_out, "write X BLOCK\\n");\n                break;\n            case SSL_ERROR_ZERO_RETURN:\n                if (cbuf_len != 0) {\n                    BIO_printf(bio_c_out, "shutdown\\n");\n                    ret = 0;\n                    goto shut;\n                } else {\n                    read_tty = 1;\n                    write_ssl = 0;\n                    break;\n                }\n            case SSL_ERROR_SYSCALL:\n                if ((k != 0) || (cbuf_len != 0)) {\n                    BIO_printf(bio_err, "write:errno=%d\\n",\n                               get_last_socket_error());\n                    goto shut;\n                } else {\n                    read_tty = 1;\n                    write_ssl = 0;\n                }\n                break;\n            case SSL_ERROR_WANT_ASYNC_JOB:\n            case SSL_ERROR_SSL:\n                ERR_print_errors(bio_err);\n                goto shut;\n            }\n        }\n#if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS)\n        else if (!ssl_pending && write_tty)\n#else\n        else if (!ssl_pending && FD_ISSET(fileno(stdout), &writefds))\n#endif\n        {\n#ifdef CHARSET_EBCDIC\n            ascii2ebcdic(&(sbuf[sbuf_off]), &(sbuf[sbuf_off]), sbuf_len);\n#endif\n            i = raw_write_stdout(&(sbuf[sbuf_off]), sbuf_len);\n            if (i <= 0) {\n                BIO_printf(bio_c_out, "DONE\\n");\n                ret = 0;\n                goto shut;\n            }\n            sbuf_len -= i;;\n            sbuf_off += i;\n            if (sbuf_len <= 0) {\n                read_ssl = 1;\n                write_tty = 0;\n            }\n        } else if (ssl_pending || FD_ISSET(SSL_get_fd(con), &readfds)) {\n#ifdef RENEG\n            {\n                static int iiii;\n                if (++iiii == 52) {\n                    SSL_renegotiate(con);\n                    iiii = 0;\n                }\n            }\n#endif\n            k = SSL_read(con, sbuf, 1024   );\n            switch (SSL_get_error(con, k)) {\n            case SSL_ERROR_NONE:\n                if (k <= 0)\n                    goto end;\n                sbuf_off = 0;\n                sbuf_len = k;\n                read_ssl = 0;\n                write_tty = 1;\n                break;\n            case SSL_ERROR_WANT_ASYNC:\n                BIO_printf(bio_c_out, "read A BLOCK\\n");\n                wait_for_async(con);\n                write_tty = 0;\n                read_ssl = 1;\n                if ((read_tty == 0) && (write_ssl == 0))\n                    write_ssl = 1;\n                break;\n            case SSL_ERROR_WANT_WRITE:\n                BIO_printf(bio_c_out, "read W BLOCK\\n");\n                write_ssl = 1;\n                read_tty = 0;\n                break;\n            case SSL_ERROR_WANT_READ:\n                BIO_printf(bio_c_out, "read R BLOCK\\n");\n                write_tty = 0;\n                read_ssl = 1;\n                if ((read_tty == 0) && (write_ssl == 0))\n                    write_ssl = 1;\n                break;\n            case SSL_ERROR_WANT_X509_LOOKUP:\n                BIO_printf(bio_c_out, "read X BLOCK\\n");\n                break;\n            case SSL_ERROR_SYSCALL:\n                ret = get_last_socket_error();\n                if (c_brief)\n                    BIO_puts(bio_err, "CONNECTION CLOSED BY SERVER\\n");\n                else\n                    BIO_printf(bio_err, "read:errno=%d\\n", ret);\n                goto shut;\n            case SSL_ERROR_ZERO_RETURN:\n                BIO_printf(bio_c_out, "closed\\n");\n                ret = 0;\n                goto shut;\n            case SSL_ERROR_WANT_ASYNC_JOB:\n            case SSL_ERROR_SSL:\n                ERR_print_errors(bio_err);\n                goto shut;\n            }\n        }\n#if defined(OPENSSL_SYS_MSDOS)\n        else if (has_stdin_waiting())\n#else\n        else if (FD_ISSET(fileno(stdin), &readfds))\n#endif\n        {\n            if (crlf) {\n                int j, lf_num;\n                i = raw_read_stdin(cbuf, BUFSIZZ / 2);\n                lf_num = 0;\n                for (j = 0; j < i; j++)\n                    if (cbuf[j] == \'\\n\')\n                        lf_num++;\n                for (j = i - 1; j >= 0; j--) {\n                    cbuf[j + lf_num] = cbuf[j];\n                    if (cbuf[j] == \'\\n\') {\n                        lf_num--;\n                        i++;\n                        cbuf[j + lf_num] = \'\\r\';\n                    }\n                }\n                assert(lf_num == 0);\n            } else\n                i = raw_read_stdin(cbuf, BUFSIZZ);\n            if ((!c_ign_eof) && ((i <= 0) || (cbuf[0] == \'Q\' && cmdletters))) {\n                BIO_printf(bio_err, "DONE\\n");\n                ret = 0;\n                goto shut;\n            }\n            if ((!c_ign_eof) && (cbuf[0] == \'R\' && cmdletters)) {\n                BIO_printf(bio_err, "RENEGOTIATING\\n");\n                SSL_renegotiate(con);\n                cbuf_len = 0;\n            }\n#ifndef OPENSSL_NO_HEARTBEATS\n            else if ((!c_ign_eof) && (cbuf[0] == \'B\' && cmdletters)) {\n                BIO_printf(bio_err, "HEARTBEATING\\n");\n                SSL_heartbeat(con);\n                cbuf_len = 0;\n            }\n#endif\n            else {\n                cbuf_len = i;\n                cbuf_off = 0;\n#ifdef CHARSET_EBCDIC\n                ebcdic2ascii(cbuf, cbuf, i);\n#endif\n            }\n            write_ssl = 1;\n            read_tty = 0;\n        }\n    }\n    ret = 0;\n shut:\n    if (in_init)\n        print_stuff(bio_c_out, con, full_log);\n    do_ssl_shutdown(con);\n#if defined(OPENSSL_SYS_WINDOWS)\n    Sleep(50);\n#endif\n    BIO_closesocket(SSL_get_fd(con));\n end:\n    if (con != NULL) {\n        if (prexit != 0)\n            print_stuff(bio_c_out, con, 1);\n        SSL_free(con);\n    }\n#if !defined(OPENSSL_NO_NEXTPROTONEG)\n    OPENSSL_free(next_proto.data);\n#endif\n    SSL_CTX_free(ctx);\n    X509_free(cert);\n    sk_X509_CRL_pop_free(crls, X509_CRL_free);\n    EVP_PKEY_free(key);\n    sk_X509_pop_free(chain, X509_free);\n    OPENSSL_free(pass);\n#ifndef OPENSSL_NO_SRP\n    OPENSSL_free(srp_arg.srppassin);\n#endif\n    OPENSSL_free(host);\n    OPENSSL_free(port);\n    X509_VERIFY_PARAM_free(vpm);\n    ssl_excert_free(exc);\n    sk_OPENSSL_STRING_free(ssl_args);\n    sk_OPENSSL_STRING_free(dane_tlsa_rrset);\n    SSL_CONF_CTX_free(cctx);\n    OPENSSL_clear_free(cbuf, BUFSIZZ);\n    OPENSSL_clear_free(sbuf, BUFSIZZ);\n    OPENSSL_clear_free(mbuf, BUFSIZZ);\n    BIO_free(bio_c_out);\n    bio_c_out = NULL;\n    BIO_free(bio_c_msg);\n    bio_c_msg = NULL;\n    return (ret);\n}', 'SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth)\n{\n    SSL_CTX *ret = NULL;\n    if (meth == NULL) {\n        SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_NULL_SSL_METHOD_PASSED);\n        return (NULL);\n    }\n    if (!OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL))\n        return NULL;\n    if (FIPS_mode() && (meth->version < TLS1_VERSION)) {\n        SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_AT_LEAST_TLS_1_0_NEEDED_IN_FIPS_MODE);\n        return NULL;\n    }\n    if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0) {\n        SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_X509_VERIFICATION_SETUP_PROBLEMS);\n        goto err;\n    }\n    ret = OPENSSL_zalloc(sizeof(*ret));\n    if (ret == NULL)\n        goto err;\n    ret->method = meth;\n    ret->min_proto_version = 0;\n    ret->max_proto_version = 0;\n    ret->session_cache_mode = SSL_SESS_CACHE_SERVER;\n    ret->session_cache_size = SSL_SESSION_CACHE_MAX_SIZE_DEFAULT;\n    ret->session_timeout = meth->get_timeout();\n    ret->references = 1;\n    ret->lock = CRYPTO_THREAD_lock_new();\n    if (ret->lock == NULL) {\n        SSLerr(SSL_F_SSL_CTX_NEW, ERR_R_MALLOC_FAILURE);\n        OPENSSL_free(ret);\n        return NULL;\n    }\n    ret->max_cert_list = SSL_MAX_CERT_LIST_DEFAULT;\n    ret->verify_mode = SSL_VERIFY_NONE;\n    if ((ret->cert = ssl_cert_new()) == NULL)\n        goto err;\n    ret->sessions = lh_SSL_SESSION_new(ssl_session_hash, ssl_session_cmp);\n    if (ret->sessions == NULL)\n        goto err;\n    ret->cert_store = X509_STORE_new();\n    if (ret->cert_store == NULL)\n        goto err;\n#ifndef OPENSSL_NO_CT\n    ret->ctlog_store = CTLOG_STORE_new();\n    if (ret->ctlog_store == NULL)\n        goto err;\n#endif\n    if (!ssl_create_cipher_list(ret->method,\n                           &ret->cipher_list, &ret->cipher_list_by_id,\n                           SSL_DEFAULT_CIPHER_LIST, ret->cert)\n       || sk_SSL_CIPHER_num(ret->cipher_list) <= 0) {\n        SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_LIBRARY_HAS_NO_CIPHERS);\n        goto err2;\n    }\n    ret->param = X509_VERIFY_PARAM_new();\n    if (ret->param == NULL)\n        goto err;\n    if ((ret->md5 = EVP_get_digestbyname("ssl3-md5")) == NULL) {\n        SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES);\n        goto err2;\n    }\n    if ((ret->sha1 = EVP_get_digestbyname("ssl3-sha1")) == NULL) {\n        SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES);\n        goto err2;\n    }\n    if ((ret->client_CA = sk_X509_NAME_new_null()) == NULL)\n        goto err;\n    if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_CTX, ret, &ret->ex_data))\n        goto err;\n    if (!(meth->ssl3_enc->enc_flags & SSL_ENC_FLAG_DTLS))\n        ret->comp_methods = SSL_COMP_get_compression_methods();\n    ret->max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH;\n    ret->split_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH;\n    if ((RAND_bytes(ret->tlsext_tick_key_name, sizeof(ret->tlsext_tick_key_name)) <= 0)\n        || (RAND_bytes(ret->tlsext_tick_hmac_key, sizeof(ret->tlsext_tick_hmac_key)) <= 0)\n        || (RAND_bytes(ret->tlsext_tick_aes_key, sizeof(ret->tlsext_tick_aes_key)) <= 0))\n        ret->options |= SSL_OP_NO_TICKET;\n#ifndef OPENSSL_NO_SRP\n    if (!SSL_CTX_SRP_CTX_init(ret))\n        goto err;\n#endif\n#ifndef OPENSSL_NO_ENGINE\n# ifdef OPENSSL_SSL_CLIENT_ENGINE_AUTO\n#  define eng_strx(x)     #x\n#  define eng_str(x)      eng_strx(x)\n    {\n        ENGINE *eng;\n        eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO));\n        if (!eng) {\n            ERR_clear_error();\n            ENGINE_load_builtin_engines();\n            eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO));\n        }\n        if (!eng || !SSL_CTX_set_client_cert_engine(ret, eng))\n            ERR_clear_error();\n    }\n# endif\n#endif\n    ret->options |= SSL_OP_LEGACY_SERVER_CONNECT;\n    ret->options |= SSL_OP_NO_COMPRESSION;\n    ret->tlsext_status_type = -1;\n    return ret;\n err:\n    SSLerr(SSL_F_SSL_CTX_NEW, ERR_R_MALLOC_FAILURE);\n err2:\n    SSL_CTX_free(ret);\n    return NULL;\n}', 'DEFINE_LHASH_OF(SSL_SESSION)', 'OPENSSL_LHASH *OPENSSL_LH_new(OPENSSL_LH_HASHFUNC h, OPENSSL_LH_COMPFUNC c)\n{\n    OPENSSL_LHASH *ret;\n    if ((ret = OPENSSL_zalloc(sizeof(*ret))) == NULL)\n        goto err0;\n    if ((ret->b = OPENSSL_zalloc(sizeof(*ret->b) * MIN_NODES)) == NULL)\n        goto err1;\n    ret->comp = ((c == NULL) ? (OPENSSL_LH_COMPFUNC)strcmp : c);\n    ret->hash = ((h == NULL) ? (OPENSSL_LH_HASHFUNC)OPENSSL_LH_strhash : h);\n    ret->num_nodes = MIN_NODES / 2;\n    ret->num_alloc_nodes = MIN_NODES;\n    ret->pmax = MIN_NODES / 2;\n    ret->up_load = UP_LOAD;\n    ret->down_load = DOWN_LOAD;\n    return (ret);\n err1:\n    OPENSSL_free(ret);\n err0:\n    return (NULL);\n}', 'void SSL_free(SSL *s)\n{\n    int i;\n    if (s == NULL)\n        return;\n    CRYPTO_atomic_add(&s->references, -1, &i, s->lock);\n    REF_PRINT_COUNT("SSL", s);\n    if (i > 0)\n        return;\n    REF_ASSERT_ISNT(i < 0);\n    X509_VERIFY_PARAM_free(s->param);\n    dane_final(&s->dane);\n    CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data);\n    if (s->bbio != NULL) {\n        if (s->bbio == s->wbio) {\n            s->wbio = BIO_pop(s->wbio);\n        }\n        BIO_free(s->bbio);\n        s->bbio = NULL;\n    }\n    BIO_free_all(s->rbio);\n    if (s->wbio != s->rbio)\n        BIO_free_all(s->wbio);\n    BUF_MEM_free(s->init_buf);\n    sk_SSL_CIPHER_free(s->cipher_list);\n    sk_SSL_CIPHER_free(s->cipher_list_by_id);\n    if (s->session != NULL) {\n        ssl_clear_bad_session(s);\n        SSL_SESSION_free(s->session);\n    }\n    clear_ciphers(s);\n    ssl_cert_free(s->cert);\n    OPENSSL_free(s->tlsext_hostname);\n    SSL_CTX_free(s->initial_ctx);\n#ifndef OPENSSL_NO_EC\n    OPENSSL_free(s->tlsext_ecpointformatlist);\n    OPENSSL_free(s->tlsext_ellipticcurvelist);\n#endif\n    sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts, X509_EXTENSION_free);\n#ifndef OPENSSL_NO_OCSP\n    sk_OCSP_RESPID_pop_free(s->tlsext_ocsp_ids, OCSP_RESPID_free);\n#endif\n#ifndef OPENSSL_NO_CT\n    SCT_LIST_free(s->scts);\n    OPENSSL_free(s->tlsext_scts);\n#endif\n    OPENSSL_free(s->tlsext_ocsp_resp);\n    OPENSSL_free(s->alpn_client_proto_list);\n    sk_X509_NAME_pop_free(s->client_CA, X509_NAME_free);\n    sk_X509_pop_free(s->verified_chain, X509_free);\n    if (s->method != NULL)\n        s->method->ssl_free(s);\n    RECORD_LAYER_release(&s->rlayer);\n    SSL_CTX_free(s->ctx);\n    ASYNC_WAIT_CTX_free(s->waitctx);\n#if !defined(OPENSSL_NO_NEXTPROTONEG)\n    OPENSSL_free(s->next_proto_negotiated);\n#endif\n#ifndef OPENSSL_NO_SRTP\n    sk_SRTP_PROTECTION_PROFILE_free(s->srtp_profiles);\n#endif\n    CRYPTO_THREAD_lock_free(s->lock);\n    OPENSSL_free(s);\n}', 'void SSL_CTX_free(SSL_CTX *a)\n{\n    int i;\n    if (a == NULL)\n        return;\n    CRYPTO_atomic_add(&a->references, -1, &i, a->lock);\n    REF_PRINT_COUNT("SSL_CTX", a);\n    if (i > 0)\n        return;\n    REF_ASSERT_ISNT(i < 0);\n    X509_VERIFY_PARAM_free(a->param);\n    dane_ctx_final(&a->dane);\n    if (a->sessions != NULL)\n        SSL_CTX_flush_sessions(a, 0);\n    CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);\n    lh_SSL_SESSION_free(a->sessions);\n    X509_STORE_free(a->cert_store);\n#ifndef OPENSSL_NO_CT\n    CTLOG_STORE_free(a->ctlog_store);\n#endif\n    sk_SSL_CIPHER_free(a->cipher_list);\n    sk_SSL_CIPHER_free(a->cipher_list_by_id);\n    ssl_cert_free(a->cert);\n    sk_X509_NAME_pop_free(a->client_CA, X509_NAME_free);\n    sk_X509_pop_free(a->extra_certs, X509_free);\n    a->comp_methods = NULL;\n#ifndef OPENSSL_NO_SRTP\n    sk_SRTP_PROTECTION_PROFILE_free(a->srtp_profiles);\n#endif\n#ifndef OPENSSL_NO_SRP\n    SSL_CTX_SRP_CTX_free(a);\n#endif\n#ifndef OPENSSL_NO_ENGINE\n    ENGINE_finish(a->client_cert_engine);\n#endif\n#ifndef OPENSSL_NO_EC\n    OPENSSL_free(a->tlsext_ecpointformatlist);\n    OPENSSL_free(a->tlsext_ellipticcurvelist);\n#endif\n    OPENSSL_free(a->alpn_client_proto_list);\n    CRYPTO_THREAD_lock_free(a->lock);\n    OPENSSL_free(a);\n}', 'void SSL_CTX_flush_sessions(SSL_CTX *s, long t)\n{\n    unsigned long i;\n    TIMEOUT_PARAM tp;\n    tp.ctx = s;\n    tp.cache = s->sessions;\n    if (tp.cache == NULL)\n        return;\n    tp.time = t;\n    CRYPTO_THREAD_write_lock(s->lock);\n    i = lh_SSL_SESSION_get_down_load(s->sessions);\n    lh_SSL_SESSION_set_down_load(s->sessions, 0);\n    lh_SSL_SESSION_doall_TIMEOUT_PARAM(tp.cache, timeout_cb, &tp);\n    lh_SSL_SESSION_set_down_load(s->sessions, i);\n    CRYPTO_THREAD_unlock(s->lock);\n}', 'IMPLEMENT_LHASH_DOALL_ARG(SSL_SESSION, TIMEOUT_PARAM)', 'void OPENSSL_LH_doall_arg(OPENSSL_LHASH *lh, OPENSSL_LH_DOALL_FUNCARG func, void *arg)\n{\n    doall_util_fn(lh, 1, (OPENSSL_LH_DOALL_FUNC)0, func, arg);\n}', 'static void doall_util_fn(OPENSSL_LHASH *lh, int use_arg,\n                          OPENSSL_LH_DOALL_FUNC func,\n                          OPENSSL_LH_DOALL_FUNCARG func_arg, void *arg)\n{\n    int i;\n    OPENSSL_LH_NODE *a, *n;\n    if (lh == NULL)\n        return;\n    for (i = lh->num_nodes - 1; i >= 0; i--) {\n        a = lh->b[i];\n        while (a != NULL) {\n            n = a->next;\n            if (use_arg)\n                func_arg(a->data, arg);\n            else\n                func(a->data);\n            a = n;\n        }\n    }\n}']