static int ssl_cipher_process_rulestr(const char *rule_str,
                CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p,
                const SSL_CIPHER **ca_list, CERT *c)
	{
	unsigned long alg_mkey, alg_auth, alg_enc, alg_mac, alg_ssl, algo_strength;
	const char *l, *buf;
	int j, multi, found, rule, retval, ok, buflen;
	unsigned long cipher_id = 0;
	char ch;
	retval = 1;
	l = rule_str;
	for (;;)
		{
		ch = *l;
		if (ch == '\0')
			break;
		if (ch == '-')
			{ rule = CIPHER_DEL; l++; }
		else if (ch == '+')
			{ rule = CIPHER_ORD; l++; }
		else if (ch == '!')
			{ rule = CIPHER_KILL; l++; }
		else if (ch == '@')
			{ rule = CIPHER_SPECIAL; l++; }
		else
			{ rule = CIPHER_ADD; }
		if (ITEM_SEP(ch))
			{
			l++;
			continue;
			}
		alg_mkey = 0;
		alg_auth = 0;
		alg_enc = 0;
		alg_mac = 0;
		alg_ssl = 0;
		algo_strength = 0;
		for (;;)
			{
			ch = *l;
			buf = l;
			buflen = 0;
#ifndef CHARSET_EBCDIC
			while (	((ch >= 'A') && (ch <= 'Z')) ||
				((ch >= '0') && (ch <= '9')) ||
				((ch >= 'a') && (ch <= 'z')) ||
				 (ch == '-') || (ch == '.')  ||
				 (ch == '='))
#else
			while (	isalnum(ch) || (ch == '-') || (ch == '.') ||
				(ch == '='))
#endif
				 {
				 ch = *(++l);
				 buflen++;
				 }
			if (buflen == 0)
				{
				SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR,
				       SSL_R_INVALID_COMMAND);
				retval = found = 0;
				l++;
				break;
				}
			if (rule == CIPHER_SPECIAL)
				{
				found = 0;
				break;
				}
			if (ch == '+')
				{
				multi=1;
				l++;
				}
			else
				multi=0;
			j = found = 0;
			cipher_id = 0;
			while (ca_list[j])
				{
				if (!strncmp(buf, ca_list[j]->name, buflen) &&
				    (ca_list[j]->name[buflen] == '\0'))
					{
					found = 1;
					break;
					}
				else
					j++;
				}
			if (!found)
				break;
			if (ca_list[j]->algorithm_mkey)
				{
				if (alg_mkey)
					{
					alg_mkey &= ca_list[j]->algorithm_mkey;
					if (!alg_mkey) { found = 0; break; }
					}
				else
					alg_mkey = ca_list[j]->algorithm_mkey;
				}
			if (ca_list[j]->algorithm_auth)
				{
				if (alg_auth)
					{
					alg_auth &= ca_list[j]->algorithm_auth;
					if (!alg_auth) { found = 0; break; }
					}
				else
					alg_auth = ca_list[j]->algorithm_auth;
				}
			if (ca_list[j]->algorithm_enc)
				{
				if (alg_enc)
					{
					alg_enc &= ca_list[j]->algorithm_enc;
					if (!alg_enc) { found = 0; break; }
					}
				else
					alg_enc = ca_list[j]->algorithm_enc;
				}
			if (ca_list[j]->algorithm_mac)
				{
				if (alg_mac)
					{
					alg_mac &= ca_list[j]->algorithm_mac;
					if (!alg_mac) { found = 0; break; }
					}
				else
					alg_mac = ca_list[j]->algorithm_mac;
				}
			if (ca_list[j]->algo_strength & SSL_EXP_MASK)
				{
				if (algo_strength & SSL_EXP_MASK)
					{
					algo_strength &= (ca_list[j]->algo_strength & SSL_EXP_MASK) | ~SSL_EXP_MASK;
					if (!(algo_strength & SSL_EXP_MASK)) { found = 0; break; }
					}
				else
					algo_strength |= ca_list[j]->algo_strength & SSL_EXP_MASK;
				}
			if (ca_list[j]->algo_strength & SSL_STRONG_MASK)
				{
				if (algo_strength & SSL_STRONG_MASK)
					{
					algo_strength &= (ca_list[j]->algo_strength & SSL_STRONG_MASK) | ~SSL_STRONG_MASK;
					if (!(algo_strength & SSL_STRONG_MASK)) { found = 0; break; }
					}
				else
					algo_strength |= ca_list[j]->algo_strength & SSL_STRONG_MASK;
				}
			if (ca_list[j]->valid)
				{
				cipher_id = ca_list[j]->id;
				}
			else
				{
				if (ca_list[j]->algorithm_ssl)
					{
					if (alg_ssl)
						{
						alg_ssl &= ca_list[j]->algorithm_ssl;
						if (!alg_ssl) { found = 0; break; }
						}
					else
						alg_ssl = ca_list[j]->algorithm_ssl;
					}
				}
			if (!multi) break;
			}
		if (rule == CIPHER_SPECIAL)
			{
			ok = 0;
			if ((buflen == 8) &&
				!strncmp(buf, "STRENGTH", 8))
				ok = ssl_cipher_strength_sort(head_p, tail_p);
			else if (buflen == 10 && !strncmp(buf, "SECLEVEL=", 9))
				{
				int level = buf[9] - '0';
				if (level < 0 || level > 5)
					{
					SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR,
						SSL_R_INVALID_COMMAND);
					}
				else
					{
					c->sec_level = level;
					ok = 1;
					}
				}
			else
				SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR,
					SSL_R_INVALID_COMMAND);
			if (ok == 0)
				retval = 0;
			while ((*l != '\0') && !ITEM_SEP(*l))
				l++;
			}
		else if (found)
			{
			ssl_cipher_apply_rule(cipher_id,
				alg_mkey, alg_auth, alg_enc, alg_mac, alg_ssl, algo_strength,
				rule, -1, head_p, tail_p);
			}
		else
			{
			while ((*l != '\0') && !ITEM_SEP(*l))
				l++;
			}
		if (*l == '\0') break;
		}
	return(retval);
	}
['SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth)\n\t{\n\tSSL_CTX *ret=NULL;\n\tif (meth == NULL)\n\t\t{\n\t\tSSLerr(SSL_F_SSL_CTX_NEW,SSL_R_NULL_SSL_METHOD_PASSED);\n\t\treturn(NULL);\n\t\t}\n#ifdef OPENSSL_FIPS\n\tif (FIPS_mode() && (meth->version < TLS1_VERSION))\n\t\t{\n\t\tSSLerr(SSL_F_SSL_CTX_NEW, SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);\n\t\treturn NULL;\n\t\t}\n#endif\n\tif (SSL_get_ex_data_X509_STORE_CTX_idx() < 0)\n\t\t{\n\t\tSSLerr(SSL_F_SSL_CTX_NEW,SSL_R_X509_VERIFICATION_SETUP_PROBLEMS);\n\t\tgoto err;\n\t\t}\n\tret=(SSL_CTX *)OPENSSL_malloc(sizeof(SSL_CTX));\n\tif (ret == NULL)\n\t\tgoto err;\n\tmemset(ret,0,sizeof(SSL_CTX));\n\tret->method=meth;\n\tret->cert_store=NULL;\n\tret->session_cache_mode=SSL_SESS_CACHE_SERVER;\n\tret->session_cache_size=SSL_SESSION_CACHE_MAX_SIZE_DEFAULT;\n\tret->session_cache_head=NULL;\n\tret->session_cache_tail=NULL;\n\tret->session_timeout=meth->get_timeout();\n\tret->new_session_cb=0;\n\tret->remove_session_cb=0;\n\tret->get_session_cb=0;\n\tret->generate_session_id=0;\n\tmemset((char *)&ret->stats,0,sizeof(ret->stats));\n\tret->references=1;\n\tret->quiet_shutdown=0;\n\tret->info_callback=NULL;\n\tret->app_verify_callback=0;\n\tret->app_verify_arg=NULL;\n\tret->max_cert_list=SSL_MAX_CERT_LIST_DEFAULT;\n\tret->read_ahead=0;\n\tret->msg_callback=0;\n\tret->msg_callback_arg=NULL;\n\tret->verify_mode=SSL_VERIFY_NONE;\n#if 0\n\tret->verify_depth=-1;\n#endif\n\tret->sid_ctx_length=0;\n\tret->default_verify_callback=NULL;\n\tif ((ret->cert=ssl_cert_new()) == NULL)\n\t\tgoto err;\n\tret->default_passwd_callback=0;\n\tret->default_passwd_callback_userdata=NULL;\n\tret->client_cert_cb=0;\n\tret->app_gen_cookie_cb=0;\n\tret->app_verify_cookie_cb=0;\n\tret->sessions=lh_SSL_SESSION_new();\n\tif (ret->sessions == NULL) goto err;\n\tret->cert_store=X509_STORE_new();\n\tif (ret->cert_store == NULL) goto err;\n\tssl_create_cipher_list(ret->method,\n\t\t&ret->cipher_list,&ret->cipher_list_by_id,\n\t\tmeth->version == SSL2_VERSION ? "SSLv2" : SSL_DEFAULT_CIPHER_LIST, ret->cert);\n\tif (ret->cipher_list == NULL\n\t    || sk_SSL_CIPHER_num(ret->cipher_list) <= 0)\n\t\t{\n\t\tSSLerr(SSL_F_SSL_CTX_NEW,SSL_R_LIBRARY_HAS_NO_CIPHERS);\n\t\tgoto err2;\n\t\t}\n\tret->param = X509_VERIFY_PARAM_new();\n\tif (!ret->param)\n\t\tgoto err;\n\tif ((ret->rsa_md5=EVP_get_digestbyname("ssl2-md5")) == NULL)\n\t\t{\n\t\tSSLerr(SSL_F_SSL_CTX_NEW,SSL_R_UNABLE_TO_LOAD_SSL2_MD5_ROUTINES);\n\t\tgoto err2;\n\t\t}\n\tif ((ret->md5=EVP_get_digestbyname("ssl3-md5")) == NULL)\n\t\t{\n\t\tSSLerr(SSL_F_SSL_CTX_NEW,SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES);\n\t\tgoto err2;\n\t\t}\n\tif ((ret->sha1=EVP_get_digestbyname("ssl3-sha1")) == NULL)\n\t\t{\n\t\tSSLerr(SSL_F_SSL_CTX_NEW,SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES);\n\t\tgoto err2;\n\t\t}\n\tif ((ret->client_CA=sk_X509_NAME_new_null()) == NULL)\n\t\tgoto err;\n\tCRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_CTX, ret, &ret->ex_data);\n\tret->extra_certs=NULL;\n\tif (!(meth->ssl3_enc->enc_flags & SSL_ENC_FLAG_DTLS))\n\t\tret->comp_methods=SSL_COMP_get_compression_methods();\n\tret->max_send_fragment = SSL3_RT_MAX_PLAIN_LENGTH;\n#ifndef OPENSSL_NO_TLSEXT\n\tret->tlsext_servername_callback = 0;\n\tret->tlsext_servername_arg = NULL;\n\tif ((RAND_pseudo_bytes(ret->tlsext_tick_key_name, 16) <= 0)\n\t\t|| (RAND_bytes(ret->tlsext_tick_hmac_key, 16) <= 0)\n\t\t|| (RAND_bytes(ret->tlsext_tick_aes_key, 16) <= 0))\n\t\tret->options |= SSL_OP_NO_TICKET;\n\tret->tlsext_status_cb = 0;\n\tret->tlsext_status_arg = NULL;\n# ifndef OPENSSL_NO_NEXTPROTONEG\n\tret->next_protos_advertised_cb = 0;\n\tret->next_proto_select_cb = 0;\n# endif\n#endif\n#ifndef OPENSSL_NO_PSK\n\tret->psk_identity_hint=NULL;\n\tret->psk_client_callback=NULL;\n\tret->psk_server_callback=NULL;\n#endif\n#ifndef OPENSSL_NO_SRP\n\tSSL_CTX_SRP_CTX_init(ret);\n#endif\n\tret->custom_cli_ext_records = NULL;\n\tret->custom_cli_ext_records_count = 0;\n\tret->custom_srv_ext_records = NULL;\n\tret->custom_srv_ext_records_count = 0;\n\tret->cli_supp_data_records = NULL;\n\tret->cli_supp_data_records_count = 0;\n\tret->srv_supp_data_records = NULL;\n\tret->srv_supp_data_records_count = 0;\n#ifndef OPENSSL_NO_BUF_FREELISTS\n\tret->freelist_max_len = SSL_MAX_BUF_FREELIST_LEN_DEFAULT;\n\tret->rbuf_freelist = OPENSSL_malloc(sizeof(SSL3_BUF_FREELIST));\n\tif (!ret->rbuf_freelist)\n\t\tgoto err;\n\tret->rbuf_freelist->chunklen = 0;\n\tret->rbuf_freelist->len = 0;\n\tret->rbuf_freelist->head = NULL;\n\tret->wbuf_freelist = OPENSSL_malloc(sizeof(SSL3_BUF_FREELIST));\n\tif (!ret->wbuf_freelist)\n\t\t{\n\t\tOPENSSL_free(ret->rbuf_freelist);\n\t\tgoto err;\n\t\t}\n\tret->wbuf_freelist->chunklen = 0;\n\tret->wbuf_freelist->len = 0;\n\tret->wbuf_freelist->head = NULL;\n#endif\n#ifndef OPENSSL_NO_ENGINE\n\tret->client_cert_engine = NULL;\n#ifdef OPENSSL_SSL_CLIENT_ENGINE_AUTO\n#define eng_strx(x)\t#x\n#define eng_str(x)\teng_strx(x)\n\t{\n\tENGINE *eng;\n\teng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO));\n\tif (!eng)\n\t\t{\n\t\tERR_clear_error();\n\t\tENGINE_load_builtin_engines();\n\t\teng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO));\n\t\t}\n\tif (!eng || !SSL_CTX_set_client_cert_engine(ret, eng))\n\t\tERR_clear_error();\n\t}\n#endif\n#endif\n\tret->options |= SSL_OP_LEGACY_SERVER_CONNECT;\n\treturn(ret);\nerr:\n\tSSLerr(SSL_F_SSL_CTX_NEW,ERR_R_MALLOC_FAILURE);\nerr2:\n\tif (ret != NULL) SSL_CTX_free(ret);\n\treturn(NULL);\n\t}', 'STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,\n\t\tSTACK_OF(SSL_CIPHER) **cipher_list,\n\t\tSTACK_OF(SSL_CIPHER) **cipher_list_by_id,\n\t\tconst char *rule_str, CERT *c)\n\t{\n\tint ok, num_of_ciphers, num_of_alias_max, num_of_group_aliases;\n\tunsigned long disabled_mkey, disabled_auth, disabled_enc, disabled_mac, disabled_ssl;\n\tSTACK_OF(SSL_CIPHER) *cipherstack, *tmp_cipher_list;\n\tconst char *rule_p;\n\tCIPHER_ORDER *co_list = NULL, *head = NULL, *tail = NULL, *curr;\n\tconst SSL_CIPHER **ca_list = NULL;\n\tif (rule_str == NULL || cipher_list == NULL || cipher_list_by_id == NULL)\n\t\treturn NULL;\n#ifndef OPENSSL_NO_EC\n\tif (!check_suiteb_cipher_list(ssl_method, c, &rule_str))\n\t\treturn NULL;\n#endif\n\tssl_cipher_get_disabled(&disabled_mkey, &disabled_auth, &disabled_enc, &disabled_mac, &disabled_ssl);\n\tnum_of_ciphers = ssl_method->num_ciphers();\n#ifdef KSSL_DEBUG\n\tprintf("ssl_create_cipher_list() for %d ciphers\\n", num_of_ciphers);\n#endif\n\tco_list = (CIPHER_ORDER *)OPENSSL_malloc(sizeof(CIPHER_ORDER) * num_of_ciphers);\n\tif (co_list == NULL)\n\t\t{\n\t\tSSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE);\n\t\treturn(NULL);\n\t\t}\n\tssl_cipher_collect_ciphers(ssl_method, num_of_ciphers,\n\t                           disabled_mkey, disabled_auth, disabled_enc, disabled_mac, disabled_ssl,\n\t                           co_list, &head, &tail);\n\tssl_cipher_apply_rule(0, SSL_kECDHE, 0, 0, 0, 0, 0, CIPHER_ADD, -1, &head, &tail);\n\tssl_cipher_apply_rule(0, SSL_kECDHE, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head, &tail);\n\tssl_cipher_apply_rule(0, 0, 0, SSL_AES, 0, 0, 0, CIPHER_ADD, -1, &head, &tail);\n\tssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_ADD, -1, &head, &tail);\n\tssl_cipher_apply_rule(0, 0, 0, 0, SSL_MD5, 0, 0, CIPHER_ORD, -1, &head, &tail);\n\tssl_cipher_apply_rule(0, 0, SSL_aNULL, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);\n\tssl_cipher_apply_rule(0, 0, SSL_aECDH, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);\n\tssl_cipher_apply_rule(0, SSL_kRSA, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);\n\tssl_cipher_apply_rule(0, SSL_kPSK, 0,0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);\n\tssl_cipher_apply_rule(0, SSL_kKRB5, 0,0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);\n\tssl_cipher_apply_rule(0, 0, 0, SSL_RC4, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);\n\tif (!ssl_cipher_strength_sort(&head, &tail))\n\t\t{\n\t\tOPENSSL_free(co_list);\n\t\treturn NULL;\n\t\t}\n\tssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head, &tail);\n\tnum_of_group_aliases = sizeof(cipher_aliases) / sizeof(SSL_CIPHER);\n\tnum_of_alias_max = num_of_ciphers + num_of_group_aliases + 1;\n\tca_list = OPENSSL_malloc(sizeof(SSL_CIPHER *) * num_of_alias_max);\n\tif (ca_list == NULL)\n\t\t{\n\t\tOPENSSL_free(co_list);\n\t\tSSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE);\n\t\treturn(NULL);\n\t\t}\n\tssl_cipher_collect_aliases(ca_list, num_of_group_aliases,\n\t                           disabled_mkey, disabled_auth, disabled_enc,\n\t\t\t\t   disabled_mac, disabled_ssl, head);\n\tok = 1;\n\trule_p = rule_str;\n\tif (strncmp(rule_str,"DEFAULT",7) == 0)\n\t\t{\n\t\tok = ssl_cipher_process_rulestr(SSL_DEFAULT_CIPHER_LIST,\n\t\t\t&head, &tail, ca_list, c);\n\t\trule_p += 7;\n\t\tif (*rule_p == \':\')\n\t\t\trule_p++;\n\t\t}\n\tif (ok && (strlen(rule_p) > 0))\n\t\tok = ssl_cipher_process_rulestr(rule_p, &head, &tail, ca_list, c);\n\tOPENSSL_free((void *)ca_list);\n\tif (!ok)\n\t\t{\n\t\tOPENSSL_free(co_list);\n\t\treturn(NULL);\n\t\t}\n\tif ((cipherstack = sk_SSL_CIPHER_new_null()) == NULL)\n\t\t{\n\t\tOPENSSL_free(co_list);\n\t\treturn(NULL);\n\t\t}\n\tfor (curr = head; curr != NULL; curr = curr->next)\n\t\t{\n#ifdef OPENSSL_FIPS\n\t\tif (curr->active && (!FIPS_mode() || curr->cipher->algo_strength & SSL_FIPS))\n#else\n\t\tif (curr->active)\n#endif\n\t\t\t{\n\t\t\tsk_SSL_CIPHER_push(cipherstack, curr->cipher);\n#ifdef CIPHER_DEBUG\n\t\t\tprintf("<%s>\\n",curr->cipher->name);\n#endif\n\t\t\t}\n\t\t}\n\tOPENSSL_free(co_list);\n\ttmp_cipher_list = sk_SSL_CIPHER_dup(cipherstack);\n\tif (tmp_cipher_list == NULL)\n\t\t{\n\t\tsk_SSL_CIPHER_free(cipherstack);\n\t\treturn NULL;\n\t\t}\n\tif (*cipher_list != NULL)\n\t\tsk_SSL_CIPHER_free(*cipher_list);\n\t*cipher_list = cipherstack;\n\tif (*cipher_list_by_id != NULL)\n\t\tsk_SSL_CIPHER_free(*cipher_list_by_id);\n\t*cipher_list_by_id = tmp_cipher_list;\n\t(void)sk_SSL_CIPHER_set_cmp_func(*cipher_list_by_id,ssl_cipher_ptr_id_cmp);\n\tsk_SSL_CIPHER_sort(*cipher_list_by_id);\n\treturn(cipherstack);\n\t}', 'static int check_suiteb_cipher_list(const SSL_METHOD *meth, CERT *c,\n\t\t\t\t\tconst char **prule_str)\n\t{\n\tunsigned int suiteb_flags = 0, suiteb_comb2 = 0;\n\tif (!strcmp(*prule_str, "SUITEB128"))\n\t\tsuiteb_flags = SSL_CERT_FLAG_SUITEB_128_LOS;\n\telse if (!strcmp(*prule_str, "SUITEB128ONLY"))\n\t\tsuiteb_flags = SSL_CERT_FLAG_SUITEB_128_LOS_ONLY;\n\telse if (!strcmp(*prule_str, "SUITEB128C2"))\n\t\t{\n\t\tsuiteb_comb2 = 1;\n\t\tsuiteb_flags = SSL_CERT_FLAG_SUITEB_128_LOS;\n\t\t}\n\telse if (!strcmp(*prule_str, "SUITEB192"))\n\t\tsuiteb_flags = SSL_CERT_FLAG_SUITEB_192_LOS;\n\tif (suiteb_flags)\n\t\t{\n\t\tc->cert_flags &= ~SSL_CERT_FLAG_SUITEB_128_LOS;\n\t\tc->cert_flags |= suiteb_flags;\n\t\t}\n\telse\n\t\tsuiteb_flags = c->cert_flags & SSL_CERT_FLAG_SUITEB_128_LOS;\n\tif (!suiteb_flags)\n\t\treturn 1;\n\tif (!(meth->ssl3_enc->enc_flags & SSL_ENC_FLAG_TLS1_2_CIPHERS))\n\t\t{\n\t\tif (meth->ssl3_enc->enc_flags & SSL_ENC_FLAG_DTLS)\n\t\t\tSSLerr(SSL_F_CHECK_SUITEB_CIPHER_LIST,\n\t\t\t\tSSL_R_ONLY_DTLS_1_2_ALLOWED_IN_SUITEB_MODE);\n\t\telse\n\t\t\tSSLerr(SSL_F_CHECK_SUITEB_CIPHER_LIST,\n\t\t\t\tSSL_R_ONLY_TLS_1_2_ALLOWED_IN_SUITEB_MODE);\n\t\treturn 0;\n\t\t}\n\tswitch(suiteb_flags)\n\t\t{\n\tcase SSL_CERT_FLAG_SUITEB_128_LOS:\n\t\tif (suiteb_comb2)\n\t\t\t*prule_str = "ECDHE-ECDSA-AES256-GCM-SHA384";\n\t\telse\n\t\t\t*prule_str = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384";\n\t\tbreak;\n\tcase SSL_CERT_FLAG_SUITEB_128_LOS_ONLY:\n\t\t*prule_str = "ECDHE-ECDSA-AES128-GCM-SHA256";\n\t\tbreak;\n\tcase SSL_CERT_FLAG_SUITEB_192_LOS:\n\t\t*prule_str = "ECDHE-ECDSA-AES256-GCM-SHA384";\n\t\tbreak;\n\t\t}\n\tc->ecdh_tmp_auto = 1;\n\treturn 1;\n\t}', 'static int ssl_cipher_process_rulestr(const char *rule_str,\n                CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p,\n                const SSL_CIPHER **ca_list, CERT *c)\n\t{\n\tunsigned long alg_mkey, alg_auth, alg_enc, alg_mac, alg_ssl, algo_strength;\n\tconst char *l, *buf;\n\tint j, multi, found, rule, retval, ok, buflen;\n\tunsigned long cipher_id = 0;\n\tchar ch;\n\tretval = 1;\n\tl = rule_str;\n\tfor (;;)\n\t\t{\n\t\tch = *l;\n\t\tif (ch == \'\\0\')\n\t\t\tbreak;\n\t\tif (ch == \'-\')\n\t\t\t{ rule = CIPHER_DEL; l++; }\n\t\telse if (ch == \'+\')\n\t\t\t{ rule = CIPHER_ORD; l++; }\n\t\telse if (ch == \'!\')\n\t\t\t{ rule = CIPHER_KILL; l++; }\n\t\telse if (ch == \'@\')\n\t\t\t{ rule = CIPHER_SPECIAL; l++; }\n\t\telse\n\t\t\t{ rule = CIPHER_ADD; }\n\t\tif (ITEM_SEP(ch))\n\t\t\t{\n\t\t\tl++;\n\t\t\tcontinue;\n\t\t\t}\n\t\talg_mkey = 0;\n\t\talg_auth = 0;\n\t\talg_enc = 0;\n\t\talg_mac = 0;\n\t\talg_ssl = 0;\n\t\talgo_strength = 0;\n\t\tfor (;;)\n\t\t\t{\n\t\t\tch = *l;\n\t\t\tbuf = l;\n\t\t\tbuflen = 0;\n#ifndef CHARSET_EBCDIC\n\t\t\twhile (\t((ch >= \'A\') && (ch <= \'Z\')) ||\n\t\t\t\t((ch >= \'0\') && (ch <= \'9\')) ||\n\t\t\t\t((ch >= \'a\') && (ch <= \'z\')) ||\n\t\t\t\t (ch == \'-\') || (ch == \'.\')  ||\n\t\t\t\t (ch == \'=\'))\n#else\n\t\t\twhile (\tisalnum(ch) || (ch == \'-\') || (ch == \'.\') ||\n\t\t\t\t(ch == \'=\'))\n#endif\n\t\t\t\t {\n\t\t\t\t ch = *(++l);\n\t\t\t\t buflen++;\n\t\t\t\t }\n\t\t\tif (buflen == 0)\n\t\t\t\t{\n\t\t\t\tSSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR,\n\t\t\t\t       SSL_R_INVALID_COMMAND);\n\t\t\t\tretval = found = 0;\n\t\t\t\tl++;\n\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\tif (rule == CIPHER_SPECIAL)\n\t\t\t\t{\n\t\t\t\tfound = 0;\n\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\tif (ch == \'+\')\n\t\t\t\t{\n\t\t\t\tmulti=1;\n\t\t\t\tl++;\n\t\t\t\t}\n\t\t\telse\n\t\t\t\tmulti=0;\n\t\t\tj = found = 0;\n\t\t\tcipher_id = 0;\n\t\t\twhile (ca_list[j])\n\t\t\t\t{\n\t\t\t\tif (!strncmp(buf, ca_list[j]->name, buflen) &&\n\t\t\t\t    (ca_list[j]->name[buflen] == \'\\0\'))\n\t\t\t\t\t{\n\t\t\t\t\tfound = 1;\n\t\t\t\t\tbreak;\n\t\t\t\t\t}\n\t\t\t\telse\n\t\t\t\t\tj++;\n\t\t\t\t}\n\t\t\tif (!found)\n\t\t\t\tbreak;\n\t\t\tif (ca_list[j]->algorithm_mkey)\n\t\t\t\t{\n\t\t\t\tif (alg_mkey)\n\t\t\t\t\t{\n\t\t\t\t\talg_mkey &= ca_list[j]->algorithm_mkey;\n\t\t\t\t\tif (!alg_mkey) { found = 0; break; }\n\t\t\t\t\t}\n\t\t\t\telse\n\t\t\t\t\talg_mkey = ca_list[j]->algorithm_mkey;\n\t\t\t\t}\n\t\t\tif (ca_list[j]->algorithm_auth)\n\t\t\t\t{\n\t\t\t\tif (alg_auth)\n\t\t\t\t\t{\n\t\t\t\t\talg_auth &= ca_list[j]->algorithm_auth;\n\t\t\t\t\tif (!alg_auth) { found = 0; break; }\n\t\t\t\t\t}\n\t\t\t\telse\n\t\t\t\t\talg_auth = ca_list[j]->algorithm_auth;\n\t\t\t\t}\n\t\t\tif (ca_list[j]->algorithm_enc)\n\t\t\t\t{\n\t\t\t\tif (alg_enc)\n\t\t\t\t\t{\n\t\t\t\t\talg_enc &= ca_list[j]->algorithm_enc;\n\t\t\t\t\tif (!alg_enc) { found = 0; break; }\n\t\t\t\t\t}\n\t\t\t\telse\n\t\t\t\t\talg_enc = ca_list[j]->algorithm_enc;\n\t\t\t\t}\n\t\t\tif (ca_list[j]->algorithm_mac)\n\t\t\t\t{\n\t\t\t\tif (alg_mac)\n\t\t\t\t\t{\n\t\t\t\t\talg_mac &= ca_list[j]->algorithm_mac;\n\t\t\t\t\tif (!alg_mac) { found = 0; break; }\n\t\t\t\t\t}\n\t\t\t\telse\n\t\t\t\t\talg_mac = ca_list[j]->algorithm_mac;\n\t\t\t\t}\n\t\t\tif (ca_list[j]->algo_strength & SSL_EXP_MASK)\n\t\t\t\t{\n\t\t\t\tif (algo_strength & SSL_EXP_MASK)\n\t\t\t\t\t{\n\t\t\t\t\talgo_strength &= (ca_list[j]->algo_strength & SSL_EXP_MASK) | ~SSL_EXP_MASK;\n\t\t\t\t\tif (!(algo_strength & SSL_EXP_MASK)) { found = 0; break; }\n\t\t\t\t\t}\n\t\t\t\telse\n\t\t\t\t\talgo_strength |= ca_list[j]->algo_strength & SSL_EXP_MASK;\n\t\t\t\t}\n\t\t\tif (ca_list[j]->algo_strength & SSL_STRONG_MASK)\n\t\t\t\t{\n\t\t\t\tif (algo_strength & SSL_STRONG_MASK)\n\t\t\t\t\t{\n\t\t\t\t\talgo_strength &= (ca_list[j]->algo_strength & SSL_STRONG_MASK) | ~SSL_STRONG_MASK;\n\t\t\t\t\tif (!(algo_strength & SSL_STRONG_MASK)) { found = 0; break; }\n\t\t\t\t\t}\n\t\t\t\telse\n\t\t\t\t\talgo_strength |= ca_list[j]->algo_strength & SSL_STRONG_MASK;\n\t\t\t\t}\n\t\t\tif (ca_list[j]->valid)\n\t\t\t\t{\n\t\t\t\tcipher_id = ca_list[j]->id;\n\t\t\t\t}\n\t\t\telse\n\t\t\t\t{\n\t\t\t\tif (ca_list[j]->algorithm_ssl)\n\t\t\t\t\t{\n\t\t\t\t\tif (alg_ssl)\n\t\t\t\t\t\t{\n\t\t\t\t\t\talg_ssl &= ca_list[j]->algorithm_ssl;\n\t\t\t\t\t\tif (!alg_ssl) { found = 0; break; }\n\t\t\t\t\t\t}\n\t\t\t\t\telse\n\t\t\t\t\t\talg_ssl = ca_list[j]->algorithm_ssl;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\tif (!multi) break;\n\t\t\t}\n\t\tif (rule == CIPHER_SPECIAL)\n\t\t\t{\n\t\t\tok = 0;\n\t\t\tif ((buflen == 8) &&\n\t\t\t\t!strncmp(buf, "STRENGTH", 8))\n\t\t\t\tok = ssl_cipher_strength_sort(head_p, tail_p);\n\t\t\telse if (buflen == 10 && !strncmp(buf, "SECLEVEL=", 9))\n\t\t\t\t{\n\t\t\t\tint level = buf[9] - \'0\';\n\t\t\t\tif (level < 0 || level > 5)\n\t\t\t\t\t{\n\t\t\t\t\tSSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR,\n\t\t\t\t\t\tSSL_R_INVALID_COMMAND);\n\t\t\t\t\t}\n\t\t\t\telse\n\t\t\t\t\t{\n\t\t\t\t\tc->sec_level = level;\n\t\t\t\t\tok = 1;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\telse\n\t\t\t\tSSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR,\n\t\t\t\t\tSSL_R_INVALID_COMMAND);\n\t\t\tif (ok == 0)\n\t\t\t\tretval = 0;\n\t\t\twhile ((*l != \'\\0\') && !ITEM_SEP(*l))\n\t\t\t\tl++;\n\t\t\t}\n\t\telse if (found)\n\t\t\t{\n\t\t\tssl_cipher_apply_rule(cipher_id,\n\t\t\t\talg_mkey, alg_auth, alg_enc, alg_mac, alg_ssl, algo_strength,\n\t\t\t\trule, -1, head_p, tail_p);\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\twhile ((*l != \'\\0\') && !ITEM_SEP(*l))\n\t\t\t\tl++;\n\t\t\t}\n\t\tif (*l == \'\\0\') break;\n\t\t}\n\treturn(retval);\n\t}']