STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method, STACK_OF(SSL_CIPHER)
                                             **cipher_list, STACK_OF(SSL_CIPHER)
                                             **cipher_list_by_id,
                                             const char *rule_str, CERT *c)
{
    int ok, num_of_ciphers, num_of_alias_max, num_of_group_aliases;
    uint32_t disabled_mkey, disabled_auth, disabled_enc, disabled_mac;
    STACK_OF(SSL_CIPHER) *cipherstack, *tmp_cipher_list;
    const char *rule_p;
    CIPHER_ORDER *co_list = NULL, *head = NULL, *tail = NULL, *curr;
    const SSL_CIPHER **ca_list = NULL;
    if (rule_str == NULL || cipher_list == NULL || cipher_list_by_id == NULL)
        return NULL;
#ifndef OPENSSL_NO_EC
    if (!check_suiteb_cipher_list(ssl_method, c, &rule_str))
        return NULL;
#endif
    disabled_mkey = disabled_mkey_mask;
    disabled_auth = disabled_auth_mask;
    disabled_enc = disabled_enc_mask;
    disabled_mac = disabled_mac_mask;
    num_of_ciphers = ssl_method->num_ciphers();
    co_list = OPENSSL_malloc(sizeof(*co_list) * num_of_ciphers);
    if (co_list == NULL) {
        SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST, ERR_R_MALLOC_FAILURE);
        return (NULL);
    }
    ssl_cipher_collect_ciphers(ssl_method, num_of_ciphers,
                               disabled_mkey, disabled_auth, disabled_enc,
                               disabled_mac, co_list, &head, &tail);
    ssl_cipher_apply_rule(0, SSL_kECDHE, SSL_aECDSA, 0, 0, 0, 0, CIPHER_ADD,
                          -1, &head, &tail);
    ssl_cipher_apply_rule(0, SSL_kECDHE, 0, 0, 0, 0, 0, CIPHER_ADD, -1, &head,
                          &tail);
    ssl_cipher_apply_rule(0, SSL_kECDHE, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head,
                          &tail);
    ssl_cipher_apply_rule(0, 0, 0, SSL_AESGCM, 0, 0, 0, CIPHER_ADD, -1,
                          &head, &tail);
    ssl_cipher_apply_rule(0, 0, 0, SSL_CHACHA20, 0, 0, 0, CIPHER_ADD, -1,
                          &head, &tail);
    ssl_cipher_apply_rule(0, 0, 0, SSL_AES ^ SSL_AESGCM, 0, 0, 0, CIPHER_ADD,
                          -1, &head, &tail);
    ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_ADD, -1, &head, &tail);
    ssl_cipher_apply_rule(0, 0, 0, 0, SSL_MD5, 0, 0, CIPHER_ORD, -1, &head,
                          &tail);
    ssl_cipher_apply_rule(0, 0, SSL_aNULL, 0, 0, 0, 0, CIPHER_ORD, -1, &head,
                          &tail);
    ssl_cipher_apply_rule(0, SSL_kRSA, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head,
                          &tail);
    ssl_cipher_apply_rule(0, SSL_kPSK, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head,
                          &tail);
    ssl_cipher_apply_rule(0, 0, 0, SSL_RC4, 0, 0, 0, CIPHER_ORD, -1, &head,
                          &tail);
    if (!ssl_cipher_strength_sort(&head, &tail)) {
        OPENSSL_free(co_list);
        return NULL;
    }
    ssl_cipher_apply_rule(0, 0, 0, 0, 0, TLS1_2_VERSION, 0, CIPHER_BUMP, -1,
                          &head, &tail);
    ssl_cipher_apply_rule(0, 0, 0, 0, SSL_AEAD, 0, 0, CIPHER_BUMP, -1,
                          &head, &tail);
    ssl_cipher_apply_rule(0, SSL_kDHE | SSL_kECDHE, 0, 0, 0, 0, 0,
                          CIPHER_BUMP, -1, &head, &tail);
    ssl_cipher_apply_rule(0, SSL_kDHE | SSL_kECDHE, 0, 0, SSL_AEAD, 0, 0,
                          CIPHER_BUMP, -1, &head, &tail);
    ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head, &tail);
    num_of_group_aliases = OSSL_NELEM(cipher_aliases);
    num_of_alias_max = num_of_ciphers + num_of_group_aliases + 1;
    ca_list = OPENSSL_malloc(sizeof(*ca_list) * num_of_alias_max);
    if (ca_list == NULL) {
        OPENSSL_free(co_list);
        SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST, ERR_R_MALLOC_FAILURE);
        return (NULL);
    }
    ssl_cipher_collect_aliases(ca_list, num_of_group_aliases,
                               disabled_mkey, disabled_auth, disabled_enc,
                               disabled_mac, head);
    ok = 1;
    rule_p = rule_str;
    if (strncmp(rule_str, "DEFAULT", 7) == 0) {
        ok = ssl_cipher_process_rulestr(SSL_DEFAULT_CIPHER_LIST,
                                        &head, &tail, ca_list, c);
        rule_p += 7;
        if (*rule_p == ':')
            rule_p++;
    }
    if (ok && (strlen(rule_p) > 0))
        ok = ssl_cipher_process_rulestr(rule_p, &head, &tail, ca_list, c);
    OPENSSL_free(ca_list);
    if (!ok) {
        OPENSSL_free(co_list);
        return (NULL);
    }
    if ((cipherstack = sk_SSL_CIPHER_new_null()) == NULL) {
        OPENSSL_free(co_list);
        return (NULL);
    }
    for (curr = head; curr != NULL; curr = curr->next) {
        if (curr->active
            && (!FIPS_mode() || curr->cipher->algo_strength & SSL_FIPS)) {
            if (!sk_SSL_CIPHER_push(cipherstack, curr->cipher)) {
                OPENSSL_free(co_list);
                sk_SSL_CIPHER_free(cipherstack);
                return NULL;
            }
#ifdef CIPHER_DEBUG
            fprintf(stderr, "<%s>\n", curr->cipher->name);
#endif
        }
    }
    OPENSSL_free(co_list);
    tmp_cipher_list = sk_SSL_CIPHER_dup(cipherstack);
    if (tmp_cipher_list == NULL) {
        sk_SSL_CIPHER_free(cipherstack);
        return NULL;
    }
    sk_SSL_CIPHER_free(*cipher_list);
    *cipher_list = cipherstack;
    if (*cipher_list_by_id != NULL)
        sk_SSL_CIPHER_free(*cipher_list_by_id);
    *cipher_list_by_id = tmp_cipher_list;
    (void)sk_SSL_CIPHER_set_cmp_func(*cipher_list_by_id, ssl_cipher_ptr_id_cmp);
    sk_SSL_CIPHER_sort(*cipher_list_by_id);
    return (cipherstack);
}
['static int test_keylog(void) {\n    SSL_CTX *cctx = NULL, *sctx = NULL;\n    SSL *clientssl = NULL, *serverssl = NULL;\n    int testresult = 0;\n    int rc;\n    memset(client_log_buffer, 0, LOG_BUFFER_SIZE + 1);\n    memset(server_log_buffer, 0, LOG_BUFFER_SIZE + 1);\n    client_log_buffer_index = 0;\n    server_log_buffer_index = 0;\n    error_writing_log = 0;\n    if (!create_ssl_ctx_pair(TLS_server_method(), TLS_client_method(), &sctx,\n                             &cctx, cert, privkey)) {\n        printf("Unable to create SSL_CTX pair\\n");\n        return 0;\n    }\n    SSL_CTX_set_options(cctx, SSL_OP_NO_TLSv1_3);\n    SSL_CTX_set_options(sctx, SSL_OP_NO_TLSv1_3);\n    rc = SSL_CTX_set_cipher_list(cctx, "RSA");\n    if (rc == 0) {\n        printf("Unable to restrict to RSA key exchange.\\n");\n        goto end;\n    }\n    if (SSL_CTX_get_keylog_callback(cctx)) {\n        printf("Unexpected initial value for client "\n               "SSL_CTX_get_keylog_callback()\\n");\n        goto end;\n    }\n    if (SSL_CTX_get_keylog_callback(sctx)) {\n        printf("Unexpected initial value for server "\n               "SSL_CTX_get_keylog_callback()\\n");\n        goto end;\n    }\n    SSL_CTX_set_keylog_callback(cctx, client_keylog_callback);\n    SSL_CTX_set_keylog_callback(sctx, server_keylog_callback);\n    if (SSL_CTX_get_keylog_callback(cctx) != client_keylog_callback) {\n        printf("Unexpected set value for client "\n               "SSL_CTX_get_keylog_callback()\\n");\n    }\n    if (SSL_CTX_get_keylog_callback(sctx) != server_keylog_callback) {\n        printf("Unexpected set value for server "\n               "SSL_CTX_get_keylog_callback()\\n");\n    }\n    if (!create_ssl_objects(sctx, cctx, &serverssl, &clientssl, NULL, NULL)) {\n        printf("Unable to create SSL objects\\n");\n        goto end;\n    }\n    if (!create_ssl_connection(serverssl, clientssl)) {\n        printf("Unable to create SSL connection\\n");\n        goto end;\n    }\n    if (error_writing_log) {\n        printf("Error encountered while logging\\n");\n        goto end;\n    }\n    if ((client_log_buffer_index == 0) || (server_log_buffer_index == 0)) {\n        printf("No logs written\\n");\n        goto end;\n    }\n    if (test_keylog_output(client_log_buffer, clientssl,\n                           SSL_get_session(clientssl)) != 1) {\n        printf("Error encountered in client log buffer\\n");\n        goto end;\n    }\n    if (test_keylog_output(server_log_buffer, serverssl,\n                           SSL_get_session(serverssl)) != 1) {\n        printf("Error encountered in server log buffer\\n");\n        goto end;\n    }\n    testresult = 1;\nend:\n    SSL_free(serverssl);\n    SSL_free(clientssl);\n    SSL_CTX_free(sctx);\n    SSL_CTX_free(cctx);\n    return testresult;\n}', 'int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str)\n{\n    STACK_OF(SSL_CIPHER) *sk;\n    sk = ssl_create_cipher_list(ctx->method, &ctx->cipher_list,\n                                &ctx->cipher_list_by_id, str, ctx->cert);\n    if (sk == NULL)\n        return 0;\n    else if (sk_SSL_CIPHER_num(sk) == 0) {\n        SSLerr(SSL_F_SSL_CTX_SET_CIPHER_LIST, SSL_R_NO_CIPHER_MATCH);\n        return 0;\n    }\n    return 1;\n}', 'STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method, STACK_OF(SSL_CIPHER)\n                                             **cipher_list, STACK_OF(SSL_CIPHER)\n                                             **cipher_list_by_id,\n                                             const char *rule_str, CERT *c)\n{\n    int ok, num_of_ciphers, num_of_alias_max, num_of_group_aliases;\n    uint32_t disabled_mkey, disabled_auth, disabled_enc, disabled_mac;\n    STACK_OF(SSL_CIPHER) *cipherstack, *tmp_cipher_list;\n    const char *rule_p;\n    CIPHER_ORDER *co_list = NULL, *head = NULL, *tail = NULL, *curr;\n    const SSL_CIPHER **ca_list = NULL;\n    if (rule_str == NULL || cipher_list == NULL || cipher_list_by_id == NULL)\n        return NULL;\n#ifndef OPENSSL_NO_EC\n    if (!check_suiteb_cipher_list(ssl_method, c, &rule_str))\n        return NULL;\n#endif\n    disabled_mkey = disabled_mkey_mask;\n    disabled_auth = disabled_auth_mask;\n    disabled_enc = disabled_enc_mask;\n    disabled_mac = disabled_mac_mask;\n    num_of_ciphers = ssl_method->num_ciphers();\n    co_list = OPENSSL_malloc(sizeof(*co_list) * num_of_ciphers);\n    if (co_list == NULL) {\n        SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST, ERR_R_MALLOC_FAILURE);\n        return (NULL);\n    }\n    ssl_cipher_collect_ciphers(ssl_method, num_of_ciphers,\n                               disabled_mkey, disabled_auth, disabled_enc,\n                               disabled_mac, co_list, &head, &tail);\n    ssl_cipher_apply_rule(0, SSL_kECDHE, SSL_aECDSA, 0, 0, 0, 0, CIPHER_ADD,\n                          -1, &head, &tail);\n    ssl_cipher_apply_rule(0, SSL_kECDHE, 0, 0, 0, 0, 0, CIPHER_ADD, -1, &head,\n                          &tail);\n    ssl_cipher_apply_rule(0, SSL_kECDHE, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head,\n                          &tail);\n    ssl_cipher_apply_rule(0, 0, 0, SSL_AESGCM, 0, 0, 0, CIPHER_ADD, -1,\n                          &head, &tail);\n    ssl_cipher_apply_rule(0, 0, 0, SSL_CHACHA20, 0, 0, 0, CIPHER_ADD, -1,\n                          &head, &tail);\n    ssl_cipher_apply_rule(0, 0, 0, SSL_AES ^ SSL_AESGCM, 0, 0, 0, CIPHER_ADD,\n                          -1, &head, &tail);\n    ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_ADD, -1, &head, &tail);\n    ssl_cipher_apply_rule(0, 0, 0, 0, SSL_MD5, 0, 0, CIPHER_ORD, -1, &head,\n                          &tail);\n    ssl_cipher_apply_rule(0, 0, SSL_aNULL, 0, 0, 0, 0, CIPHER_ORD, -1, &head,\n                          &tail);\n    ssl_cipher_apply_rule(0, SSL_kRSA, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head,\n                          &tail);\n    ssl_cipher_apply_rule(0, SSL_kPSK, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head,\n                          &tail);\n    ssl_cipher_apply_rule(0, 0, 0, SSL_RC4, 0, 0, 0, CIPHER_ORD, -1, &head,\n                          &tail);\n    if (!ssl_cipher_strength_sort(&head, &tail)) {\n        OPENSSL_free(co_list);\n        return NULL;\n    }\n    ssl_cipher_apply_rule(0, 0, 0, 0, 0, TLS1_2_VERSION, 0, CIPHER_BUMP, -1,\n                          &head, &tail);\n    ssl_cipher_apply_rule(0, 0, 0, 0, SSL_AEAD, 0, 0, CIPHER_BUMP, -1,\n                          &head, &tail);\n    ssl_cipher_apply_rule(0, SSL_kDHE | SSL_kECDHE, 0, 0, 0, 0, 0,\n                          CIPHER_BUMP, -1, &head, &tail);\n    ssl_cipher_apply_rule(0, SSL_kDHE | SSL_kECDHE, 0, 0, SSL_AEAD, 0, 0,\n                          CIPHER_BUMP, -1, &head, &tail);\n    ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head, &tail);\n    num_of_group_aliases = OSSL_NELEM(cipher_aliases);\n    num_of_alias_max = num_of_ciphers + num_of_group_aliases + 1;\n    ca_list = OPENSSL_malloc(sizeof(*ca_list) * num_of_alias_max);\n    if (ca_list == NULL) {\n        OPENSSL_free(co_list);\n        SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST, ERR_R_MALLOC_FAILURE);\n        return (NULL);\n    }\n    ssl_cipher_collect_aliases(ca_list, num_of_group_aliases,\n                               disabled_mkey, disabled_auth, disabled_enc,\n                               disabled_mac, head);\n    ok = 1;\n    rule_p = rule_str;\n    if (strncmp(rule_str, "DEFAULT", 7) == 0) {\n        ok = ssl_cipher_process_rulestr(SSL_DEFAULT_CIPHER_LIST,\n                                        &head, &tail, ca_list, c);\n        rule_p += 7;\n        if (*rule_p == \':\')\n            rule_p++;\n    }\n    if (ok && (strlen(rule_p) > 0))\n        ok = ssl_cipher_process_rulestr(rule_p, &head, &tail, ca_list, c);\n    OPENSSL_free(ca_list);\n    if (!ok) {\n        OPENSSL_free(co_list);\n        return (NULL);\n    }\n    if ((cipherstack = sk_SSL_CIPHER_new_null()) == NULL) {\n        OPENSSL_free(co_list);\n        return (NULL);\n    }\n    for (curr = head; curr != NULL; curr = curr->next) {\n        if (curr->active\n            && (!FIPS_mode() || curr->cipher->algo_strength & SSL_FIPS)) {\n            if (!sk_SSL_CIPHER_push(cipherstack, curr->cipher)) {\n                OPENSSL_free(co_list);\n                sk_SSL_CIPHER_free(cipherstack);\n                return NULL;\n            }\n#ifdef CIPHER_DEBUG\n            fprintf(stderr, "<%s>\\n", curr->cipher->name);\n#endif\n        }\n    }\n    OPENSSL_free(co_list);\n    tmp_cipher_list = sk_SSL_CIPHER_dup(cipherstack);\n    if (tmp_cipher_list == NULL) {\n        sk_SSL_CIPHER_free(cipherstack);\n        return NULL;\n    }\n    sk_SSL_CIPHER_free(*cipher_list);\n    *cipher_list = cipherstack;\n    if (*cipher_list_by_id != NULL)\n        sk_SSL_CIPHER_free(*cipher_list_by_id);\n    *cipher_list_by_id = tmp_cipher_list;\n    (void)sk_SSL_CIPHER_set_cmp_func(*cipher_list_by_id, ssl_cipher_ptr_id_cmp);\n    sk_SSL_CIPHER_sort(*cipher_list_by_id);\n    return (cipherstack);\n}', 'static int check_suiteb_cipher_list(const SSL_METHOD *meth, CERT *c,\n                                    const char **prule_str)\n{\n    unsigned int suiteb_flags = 0, suiteb_comb2 = 0;\n    if (strncmp(*prule_str, "SUITEB128ONLY", 13) == 0) {\n        suiteb_flags = SSL_CERT_FLAG_SUITEB_128_LOS_ONLY;\n    } else if (strncmp(*prule_str, "SUITEB128C2", 11) == 0) {\n        suiteb_comb2 = 1;\n        suiteb_flags = SSL_CERT_FLAG_SUITEB_128_LOS;\n    } else if (strncmp(*prule_str, "SUITEB128", 9) == 0) {\n        suiteb_flags = SSL_CERT_FLAG_SUITEB_128_LOS;\n    } else if (strncmp(*prule_str, "SUITEB192", 9) == 0) {\n        suiteb_flags = SSL_CERT_FLAG_SUITEB_192_LOS;\n    }\n    if (suiteb_flags) {\n        c->cert_flags &= ~SSL_CERT_FLAG_SUITEB_128_LOS;\n        c->cert_flags |= suiteb_flags;\n    } else\n        suiteb_flags = c->cert_flags & SSL_CERT_FLAG_SUITEB_128_LOS;\n    if (!suiteb_flags)\n        return 1;\n    if (!(meth->ssl3_enc->enc_flags & SSL_ENC_FLAG_TLS1_2_CIPHERS)) {\n        SSLerr(SSL_F_CHECK_SUITEB_CIPHER_LIST,\n               SSL_R_AT_LEAST_TLS_1_2_NEEDED_IN_SUITEB_MODE);\n        return 0;\n    }\n# ifndef OPENSSL_NO_EC\n    switch (suiteb_flags) {\n    case SSL_CERT_FLAG_SUITEB_128_LOS:\n        if (suiteb_comb2)\n            *prule_str = "ECDHE-ECDSA-AES256-GCM-SHA384";\n        else\n            *prule_str =\n                "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384";\n        break;\n    case SSL_CERT_FLAG_SUITEB_128_LOS_ONLY:\n        *prule_str = "ECDHE-ECDSA-AES128-GCM-SHA256";\n        break;\n    case SSL_CERT_FLAG_SUITEB_192_LOS:\n        *prule_str = "ECDHE-ECDSA-AES256-GCM-SHA384";\n        break;\n    }\n    return 1;\n# else\n    SSLerr(SSL_F_CHECK_SUITEB_CIPHER_LIST, SSL_R_ECDH_REQUIRED_FOR_SUITEB_MODE);\n    return 0;\n# endif\n}']