Restoring authorship annotation for <orivej@yandex-team.ru>. Commit 1 of 2.

13 files changed, 360 insertions, 360 deletions

diff --git a/contrib/libs/openssl/ssl/d1_msg.c b/contrib/libs/openssl/ssl/d1_msg.c
index 8a31064ae1..e6111c41b6 100644
--- a/contrib/libs/openssl/ssl/d1_msg.c
+++ b/contrib/libs/openssl/ssl/d1_msg.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2005-2019 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2005-2019 The OpenSSL Project Authors. All Rights Reserved. 
  *
  * Licensed under the OpenSSL license (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -52,7 +52,7 @@ int dtls1_dispatch_alert(SSL *s)
         s->s3->alert_dispatch = 1;
         /* fprintf( stderr, "not done with alert\n" ); */
     } else {
-        (void)BIO_flush(s->wbio);
+        (void)BIO_flush(s->wbio); 
 
         if (s->msg_callback)
             s->msg_callback(1, s->version, SSL3_RT_ALERT, s->s3->send_alert,
diff --git a/contrib/libs/openssl/ssl/record/rec_layer_s3.c b/contrib/libs/openssl/ssl/record/rec_layer_s3.c
index 8249b4ace9..b0fd3b35ba 100644
--- a/contrib/libs/openssl/ssl/record/rec_layer_s3.c
+++ b/contrib/libs/openssl/ssl/record/rec_layer_s3.c
@@ -374,13 +374,13 @@ int ssl3_write_bytes(SSL *s, int type, const void *buf_, size_t len,
     s->rlayer.wnum = 0;
 
     /*
-     * If we are supposed to be sending a KeyUpdate then go into init unless we
-     * have writes pending - in which case we should finish doing that first.
-     */
-    if (wb->left == 0 && s->key_update != SSL_KEY_UPDATE_NONE)
-        ossl_statem_set_in_init(s, 1);
-
-    /*
+     * If we are supposed to be sending a KeyUpdate then go into init unless we 
+     * have writes pending - in which case we should finish doing that first. 
+     */ 
+    if (wb->left == 0 && s->key_update != SSL_KEY_UPDATE_NONE) 
+        ossl_statem_set_in_init(s, 1); 
+ 
+    /* 
      * When writing early data on the server side we could be "in_init" in
      * between receiving the EoED and the CF - but we don't want to handle those
      * messages yet.
@@ -635,9 +635,9 @@ int ssl3_write_bytes(SSL *s, int type, const void *buf_, size_t len,
              */
             s->s3->empty_fragment_done = 0;
 
-            if (tmpwrit == n
-                    && (s->mode & SSL_MODE_RELEASE_BUFFERS) != 0
-                    && !SSL_IS_DTLS(s))
+            if (tmpwrit == n 
+                    && (s->mode & SSL_MODE_RELEASE_BUFFERS) != 0 
+                    && !SSL_IS_DTLS(s)) 
                 ssl3_release_write_buffer(s);
 
             *written = tot + tmpwrit;
diff --git a/contrib/libs/openssl/ssl/s3_lib.c b/contrib/libs/openssl/ssl/s3_lib.c
index b256a4b935..3a6c11bcf7 100644
--- a/contrib/libs/openssl/ssl/s3_lib.c
+++ b/contrib/libs/openssl/ssl/s3_lib.c
@@ -3567,7 +3567,7 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
 
     case SSL_CTRL_GET_CHAIN_CERTS:
         *(STACK_OF(X509) **)parg = s->cert->key->chain;
-        ret = 1;
+        ret = 1; 
         break;
 
     case SSL_CTRL_SELECT_CURRENT_CERT:
@@ -3602,8 +3602,8 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
 
             if (!s->session)
                 return 0;
-            clist = s->ext.peer_supportedgroups;
-            clistlen = s->ext.peer_supportedgroups_len;
+            clist = s->ext.peer_supportedgroups; 
+            clistlen = s->ext.peer_supportedgroups_len; 
             if (parg) {
                 size_t i;
                 int *cptr = parg;
@@ -3719,10 +3719,10 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
         {
             const unsigned char **pformat = parg;
 
-            if (s->ext.peer_ecpointformats == NULL)
+            if (s->ext.peer_ecpointformats == NULL) 
                 return 0;
-            *pformat = s->ext.peer_ecpointformats;
-            return (int)s->ext.peer_ecpointformats_len;
+            *pformat = s->ext.peer_ecpointformats; 
+            return (int)s->ext.peer_ecpointformats_len; 
         }
 #endif
 
diff --git a/contrib/libs/openssl/ssl/ssl_ciph.c b/contrib/libs/openssl/ssl/ssl_ciph.c
index 735a483c64..3496716654 100644
--- a/contrib/libs/openssl/ssl/ssl_ciph.c
+++ b/contrib/libs/openssl/ssl/ssl_ciph.c
@@ -1377,7 +1377,7 @@ int SSL_CTX_set_ciphersuites(SSL_CTX *ctx, const char *str)
 {
     int ret = set_ciphersuites(&(ctx->tls13_ciphersuites), str);
 
-    if (ret && ctx->cipher_list != NULL)
+    if (ret && ctx->cipher_list != NULL) 
         return update_cipher_list(&ctx->cipher_list, &ctx->cipher_list_by_id,
                                   ctx->tls13_ciphersuites);
 
@@ -1386,14 +1386,14 @@ int SSL_CTX_set_ciphersuites(SSL_CTX *ctx, const char *str)
 
 int SSL_set_ciphersuites(SSL *s, const char *str)
 {
-    STACK_OF(SSL_CIPHER) *cipher_list;
+    STACK_OF(SSL_CIPHER) *cipher_list; 
     int ret = set_ciphersuites(&(s->tls13_ciphersuites), str);
 
-    if (s->cipher_list == NULL) {
-        if ((cipher_list = SSL_get_ciphers(s)) != NULL)
-            s->cipher_list = sk_SSL_CIPHER_dup(cipher_list);
-    }
-    if (ret && s->cipher_list != NULL)
+    if (s->cipher_list == NULL) { 
+        if ((cipher_list = SSL_get_ciphers(s)) != NULL) 
+            s->cipher_list = sk_SSL_CIPHER_dup(cipher_list); 
+    } 
+    if (ret && s->cipher_list != NULL) 
         return update_cipher_list(&s->cipher_list, &s->cipher_list_by_id,
                                   s->tls13_ciphersuites);
 
diff --git a/contrib/libs/openssl/ssl/ssl_lib.c b/contrib/libs/openssl/ssl/ssl_lib.c
index ffd0a0bc6d..61fd4b8155 100644
--- a/contrib/libs/openssl/ssl/ssl_lib.c
+++ b/contrib/libs/openssl/ssl/ssl_lib.c
@@ -628,11 +628,11 @@ int SSL_clear(SSL *s)
     /* Clear the verification result peername */
     X509_VERIFY_PARAM_move_peername(s->param, NULL);
 
-    /* Clear any shared connection state */
-    OPENSSL_free(s->shared_sigalgs);
-    s->shared_sigalgs = NULL;
-    s->shared_sigalgslen = 0;
-
+    /* Clear any shared connection state */ 
+    OPENSSL_free(s->shared_sigalgs); 
+    s->shared_sigalgs = NULL; 
+    s->shared_sigalgslen = 0; 
+ 
     /*
      * Check to see if we were changed into a different method, if so, revert
      * back.
@@ -878,7 +878,7 @@ int SSL_up_ref(SSL *s)
 int SSL_CTX_set_session_id_context(SSL_CTX *ctx, const unsigned char *sid_ctx,
                                    unsigned int sid_ctx_len)
 {
-    if (sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) {
+    if (sid_ctx_len > SSL_MAX_SID_CTX_LENGTH) { 
         SSLerr(SSL_F_SSL_CTX_SET_SESSION_ID_CONTEXT,
                SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG);
         return 0;
@@ -1171,7 +1171,7 @@ void SSL_free(SSL *s)
     sk_SSL_CIPHER_free(s->cipher_list);
     sk_SSL_CIPHER_free(s->cipher_list_by_id);
     sk_SSL_CIPHER_free(s->tls13_ciphersuites);
-    sk_SSL_CIPHER_free(s->peer_ciphers);
+    sk_SSL_CIPHER_free(s->peer_ciphers); 
 
     /* Make the next call work :-) */
     if (s->session != NULL) {
@@ -1184,16 +1184,16 @@ void SSL_free(SSL *s)
     clear_ciphers(s);
 
     ssl_cert_free(s->cert);
-    OPENSSL_free(s->shared_sigalgs);
+    OPENSSL_free(s->shared_sigalgs); 
     /* Free up if allocated */
 
     OPENSSL_free(s->ext.hostname);
     SSL_CTX_free(s->session_ctx);
 #ifndef OPENSSL_NO_EC
     OPENSSL_free(s->ext.ecpointformats);
-    OPENSSL_free(s->ext.peer_ecpointformats);
+    OPENSSL_free(s->ext.peer_ecpointformats); 
     OPENSSL_free(s->ext.supportedgroups);
-    OPENSSL_free(s->ext.peer_supportedgroups);
+    OPENSSL_free(s->ext.peer_supportedgroups); 
 #endif                          /* OPENSSL_NO_EC */
     sk_X509_EXTENSION_pop_free(s->ext.ocsp.exts, X509_EXTENSION_free);
 #ifndef OPENSSL_NO_OCSP
@@ -2459,9 +2459,9 @@ STACK_OF(SSL_CIPHER) *SSL_get_ciphers(const SSL *s)
 
 STACK_OF(SSL_CIPHER) *SSL_get_client_ciphers(const SSL *s)
 {
-    if ((s == NULL) || !s->server)
+    if ((s == NULL) || !s->server) 
         return NULL;
-    return s->peer_ciphers;
+    return s->peer_ciphers; 
 }
 
 STACK_OF(SSL_CIPHER) *SSL_get1_supported_ciphers(SSL *s)
@@ -2600,12 +2600,12 @@ char *SSL_get_shared_ciphers(const SSL *s, char *buf, int size)
     int i;
 
     if (!s->server
-            || s->peer_ciphers == NULL
+            || s->peer_ciphers == NULL 
             || size < 2)
         return NULL;
 
     p = buf;
-    clntsk = s->peer_ciphers;
+    clntsk = s->peer_ciphers; 
     srvrsk = SSL_get_ciphers(s);
     if (clntsk == NULL || srvrsk == NULL)
         return NULL;
@@ -4583,7 +4583,7 @@ int ssl_handshake_hash(SSL *s, unsigned char *out, size_t outlen,
     return ret;
 }
 
-int SSL_session_reused(const SSL *s)
+int SSL_session_reused(const SSL *s) 
 {
     return s->hit;
 }
@@ -5175,11 +5175,11 @@ int SSL_client_hello_get1_extensions_present(SSL *s, int **out, size_t *outlen)
         if (ext->present)
             num++;
     }
-    if (num == 0) {
-        *out = NULL;
-        *outlen = 0;
-        return 1;
-    }
+    if (num == 0) { 
+        *out = NULL; 
+        *outlen = 0; 
+        return 1; 
+    } 
     if ((present = OPENSSL_malloc(sizeof(*present) * num)) == NULL) {
         SSLerr(SSL_F_SSL_CLIENT_HELLO_GET1_EXTENSIONS_PRESENT,
                ERR_R_MALLOC_FAILURE);
diff --git a/contrib/libs/openssl/ssl/statem/extensions.c b/contrib/libs/openssl/ssl/statem/extensions.c
index 0f39275baa..de5434b142 100644
--- a/contrib/libs/openssl/ssl/statem/extensions.c
+++ b/contrib/libs/openssl/ssl/statem/extensions.c
@@ -1054,18 +1054,18 @@ static int final_ec_pt_formats(SSL *s, unsigned int context, int sent)
      */
     if (s->ext.ecpointformats != NULL
             && s->ext.ecpointformats_len > 0
-            && s->ext.peer_ecpointformats != NULL
-            && s->ext.peer_ecpointformats_len > 0
+            && s->ext.peer_ecpointformats != NULL 
+            && s->ext.peer_ecpointformats_len > 0 
             && ((alg_k & SSL_kECDHE) || (alg_a & SSL_aECDSA))) {
         /* we are using an ECC cipher */
         size_t i;
-        unsigned char *list = s->ext.peer_ecpointformats;
+        unsigned char *list = s->ext.peer_ecpointformats; 
 
-        for (i = 0; i < s->ext.peer_ecpointformats_len; i++) {
+        for (i = 0; i < s->ext.peer_ecpointformats_len; i++) { 
             if (*list++ == TLSEXT_ECPOINTFORMAT_uncompressed)
                 break;
         }
-        if (i == s->ext.peer_ecpointformats_len) {
+        if (i == s->ext.peer_ecpointformats_len) { 
             SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_FINAL_EC_PT_FORMATS,
                      SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST);
             return 0;
@@ -1476,13 +1476,13 @@ int tls_psk_do_binder(SSL *s, const EVP_MD *md, const unsigned char *msgstart,
     unsigned char hash[EVP_MAX_MD_SIZE], binderkey[EVP_MAX_MD_SIZE];
     unsigned char finishedkey[EVP_MAX_MD_SIZE], tmpbinder[EVP_MAX_MD_SIZE];
     unsigned char *early_secret;
-#ifdef CHARSET_EBCDIC
+#ifdef CHARSET_EBCDIC 
     static const unsigned char resumption_label[] = { 0x72, 0x65, 0x73, 0x20, 0x62, 0x69, 0x6E, 0x64, 0x65, 0x72, 0x00 };
-    static const unsigned char external_label[]   = { 0x65, 0x78, 0x74, 0x20, 0x62, 0x69, 0x6E, 0x64, 0x65, 0x72, 0x00 };
-#else
+    static const unsigned char external_label[]   = { 0x65, 0x78, 0x74, 0x20, 0x62, 0x69, 0x6E, 0x64, 0x65, 0x72, 0x00 }; 
+#else 
     static const unsigned char resumption_label[] = "res binder";
     static const unsigned char external_label[] = "ext binder";
-#endif
+#endif 
     const unsigned char *label;
     size_t bindersize, labelsize, hashsize;
     int hashsizei = EVP_MD_size(md);
@@ -1681,9 +1681,9 @@ static int final_early_data(SSL *s, unsigned int context, int sent)
             || s->early_data_state != SSL_EARLY_DATA_ACCEPTING
             || !s->ext.early_data_ok
             || s->hello_retry_request != SSL_HRR_NONE
-            || (s->allow_early_data_cb != NULL
-                && !s->allow_early_data_cb(s,
-                                         s->allow_early_data_cb_data))) {
+            || (s->allow_early_data_cb != NULL 
+                && !s->allow_early_data_cb(s, 
+                                         s->allow_early_data_cb_data))) { 
         s->ext.early_data = SSL_EARLY_DATA_REJECTED;
     } else {
         s->ext.early_data = SSL_EARLY_DATA_ACCEPTED;
diff --git a/contrib/libs/openssl/ssl/statem/extensions_clnt.c b/contrib/libs/openssl/ssl/statem/extensions_clnt.c
index ce8a75794c..f57548985e 100644
--- a/contrib/libs/openssl/ssl/statem/extensions_clnt.c
+++ b/contrib/libs/openssl/ssl/statem/extensions_clnt.c
@@ -994,7 +994,7 @@ EXT_RETURN tls_construct_ctos_psk(SSL *s, WPACKET *pkt, unsigned int context,
     const EVP_MD *handmd = NULL, *mdres = NULL, *mdpsk = NULL;
     int dores = 0;
 
-    s->ext.tick_identity = 0;
+    s->ext.tick_identity = 0; 
 
     /*
      * Note: At this stage of the code we only support adding a single
@@ -1084,7 +1084,7 @@ EXT_RETURN tls_construct_ctos_psk(SSL *s, WPACKET *pkt, unsigned int context,
         agems += s->session->ext.tick_age_add;
 
         reshashsize = EVP_MD_size(mdres);
-        s->ext.tick_identity++;
+        s->ext.tick_identity++; 
         dores = 1;
     }
 
@@ -1144,7 +1144,7 @@ EXT_RETURN tls_construct_ctos_psk(SSL *s, WPACKET *pkt, unsigned int context,
                      ERR_R_INTERNAL_ERROR);
             return EXT_RETURN_FAIL;
         }
-        s->ext.tick_identity++;
+        s->ext.tick_identity++; 
     }
 
     if (!WPACKET_close(pkt)
@@ -1372,20 +1372,20 @@ int tls_parse_stoc_ec_pt_formats(SSL *s, PACKET *pkt, unsigned int context,
             return 0;
         }
 
-        s->ext.peer_ecpointformats_len = 0;
-        OPENSSL_free(s->ext.peer_ecpointformats);
-        s->ext.peer_ecpointformats = OPENSSL_malloc(ecpointformats_len);
-        if (s->ext.peer_ecpointformats == NULL) {
+        s->ext.peer_ecpointformats_len = 0; 
+        OPENSSL_free(s->ext.peer_ecpointformats); 
+        s->ext.peer_ecpointformats = OPENSSL_malloc(ecpointformats_len); 
+        if (s->ext.peer_ecpointformats == NULL) { 
             s->ext.peer_ecpointformats_len = 0;
             SSLfatal(s, SSL_AD_INTERNAL_ERROR,
                      SSL_F_TLS_PARSE_STOC_EC_PT_FORMATS, ERR_R_INTERNAL_ERROR);
             return 0;
         }
 
-        s->ext.peer_ecpointformats_len = ecpointformats_len;
+        s->ext.peer_ecpointformats_len = ecpointformats_len; 
 
         if (!PACKET_copy_bytes(&ecptformatlist,
-                               s->ext.peer_ecpointformats,
+                               s->ext.peer_ecpointformats, 
                                ecpointformats_len)) {
             SSLfatal(s, SSL_AD_INTERNAL_ERROR,
                      SSL_F_TLS_PARSE_STOC_EC_PT_FORMATS, ERR_R_INTERNAL_ERROR);
@@ -1868,8 +1868,8 @@ int tls_parse_stoc_key_share(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
         return 0;
     }
 
-    skey = EVP_PKEY_new();
-    if (skey == NULL || EVP_PKEY_copy_parameters(skey, ckey) <= 0) {
+    skey = EVP_PKEY_new(); 
+    if (skey == NULL || EVP_PKEY_copy_parameters(skey, ckey) <= 0) { 
         SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_KEY_SHARE,
                  ERR_R_MALLOC_FAILURE);
         return 0;
@@ -1934,7 +1934,7 @@ int tls_parse_stoc_early_data(SSL *s, PACKET *pkt, unsigned int context,
     }
 
     if (!s->ext.early_data_ok
-            || !s->hit) {
+            || !s->hit) { 
         /*
          * If we get here then we didn't send early data, or we didn't resume
          * using the first identity, or the SNI/ALPN is not consistent so the
@@ -1962,28 +1962,28 @@ int tls_parse_stoc_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
         return 0;
     }
 
-    if (identity >= (unsigned int)s->ext.tick_identity) {
-        SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_PSK,
-                 SSL_R_BAD_PSK_IDENTITY);
-        return 0;
-    }
-
-    /*
-     * Session resumption tickets are always sent before PSK tickets. If the
-     * ticket index is 0 then it must be for a session resumption ticket if we
-     * sent two tickets, or if we didn't send a PSK ticket.
-     */
-    if (identity == 0 && (s->psksession == NULL || s->ext.tick_identity == 2)) {
+    if (identity >= (unsigned int)s->ext.tick_identity) { 
+        SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_STOC_PSK, 
+                 SSL_R_BAD_PSK_IDENTITY); 
+        return 0; 
+    } 
+ 
+    /* 
+     * Session resumption tickets are always sent before PSK tickets. If the 
+     * ticket index is 0 then it must be for a session resumption ticket if we 
+     * sent two tickets, or if we didn't send a PSK ticket. 
+     */ 
+    if (identity == 0 && (s->psksession == NULL || s->ext.tick_identity == 2)) { 
         s->hit = 1;
         SSL_SESSION_free(s->psksession);
         s->psksession = NULL;
         return 1;
     }
 
-    if (s->psksession == NULL) {
-        /* Should never happen */
-        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_PSK,
-                 ERR_R_INTERNAL_ERROR);
+    if (s->psksession == NULL) { 
+        /* Should never happen */ 
+        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PARSE_STOC_PSK, 
+                 ERR_R_INTERNAL_ERROR); 
         return 0;
     }
 
@@ -2002,9 +2002,9 @@ int tls_parse_stoc_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
     s->session = s->psksession;
     s->psksession = NULL;
     s->hit = 1;
-    /* Early data is only allowed if we used the first ticket */
-    if (identity != 0)
-        s->ext.early_data_ok = 0;
+    /* Early data is only allowed if we used the first ticket */ 
+    if (identity != 0) 
+        s->ext.early_data_ok = 0; 
 #endif
 
     return 1;
diff --git a/contrib/libs/openssl/ssl/statem/extensions_srvr.c b/contrib/libs/openssl/ssl/statem/extensions_srvr.c
index 04f64f8106..5655567d09 100644
--- a/contrib/libs/openssl/ssl/statem/extensions_srvr.c
+++ b/contrib/libs/openssl/ssl/statem/extensions_srvr.c
@@ -259,8 +259,8 @@ int tls_parse_ctos_ec_pt_formats(SSL *s, PACKET *pkt, unsigned int context,
 
     if (!s->hit) {
         if (!PACKET_memdup(&ec_point_format_list,
-                           &s->ext.peer_ecpointformats,
-                           &s->ext.peer_ecpointformats_len)) {
+                           &s->ext.peer_ecpointformats, 
+                           &s->ext.peer_ecpointformats_len)) { 
             SSLfatal(s, SSL_AD_INTERNAL_ERROR,
                      SSL_F_TLS_PARSE_CTOS_EC_PT_FORMATS, ERR_R_INTERNAL_ERROR);
             return 0;
@@ -967,12 +967,12 @@ int tls_parse_ctos_supported_groups(SSL *s, PACKET *pkt, unsigned int context,
     }
 
     if (!s->hit || SSL_IS_TLS13(s)) {
-        OPENSSL_free(s->ext.peer_supportedgroups);
-        s->ext.peer_supportedgroups = NULL;
-        s->ext.peer_supportedgroups_len = 0;
+        OPENSSL_free(s->ext.peer_supportedgroups); 
+        s->ext.peer_supportedgroups = NULL; 
+        s->ext.peer_supportedgroups_len = 0; 
         if (!tls1_save_u16(&supported_groups_list,
-                           &s->ext.peer_supportedgroups,
-                           &s->ext.peer_supportedgroups_len)) {
+                           &s->ext.peer_supportedgroups, 
+                           &s->ext.peer_supportedgroups_len)) { 
             SSLfatal(s, SSL_AD_INTERNAL_ERROR,
                      SSL_F_TLS_PARSE_CTOS_SUPPORTED_GROUPS,
                      ERR_R_INTERNAL_ERROR);
@@ -1279,7 +1279,7 @@ int tls_parse_ctos_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
         goto err;
     }
 
-    s->ext.tick_identity = id;
+    s->ext.tick_identity = id; 
 
     SSL_SESSION_free(s->session);
     s->session = sess;
@@ -1387,7 +1387,7 @@ EXT_RETURN tls_construct_stoc_ec_pt_formats(SSL *s, WPACKET *pkt,
     unsigned long alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
     unsigned long alg_a = s->s3->tmp.new_cipher->algorithm_auth;
     int using_ecc = ((alg_k & SSL_kECDHE) || (alg_a & SSL_aECDSA))
-                    && (s->ext.peer_ecpointformats != NULL);
+                    && (s->ext.peer_ecpointformats != NULL); 
     const unsigned char *plist;
     size_t plistlen;
 
@@ -1498,10 +1498,10 @@ EXT_RETURN tls_construct_stoc_status_request(SSL *s, WPACKET *pkt,
                                              unsigned int context, X509 *x,
                                              size_t chainidx)
 {
-    /* We don't currently support this extension inside a CertificateRequest */
-    if (context == SSL_EXT_TLS1_3_CERTIFICATE_REQUEST)
-        return EXT_RETURN_NOT_SENT;
-
+    /* We don't currently support this extension inside a CertificateRequest */ 
+    if (context == SSL_EXT_TLS1_3_CERTIFICATE_REQUEST) 
+        return EXT_RETURN_NOT_SENT; 
+ 
     if (!s->ext.status_expected)
         return EXT_RETURN_NOT_SENT;
 
@@ -1970,7 +1970,7 @@ EXT_RETURN tls_construct_stoc_psk(SSL *s, WPACKET *pkt, unsigned int context,
 
     if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_psk)
             || !WPACKET_start_sub_packet_u16(pkt)
-            || !WPACKET_put_bytes_u16(pkt, s->ext.tick_identity)
+            || !WPACKET_put_bytes_u16(pkt, s->ext.tick_identity) 
             || !WPACKET_close(pkt)) {
         SSLfatal(s, SSL_AD_INTERNAL_ERROR,
                  SSL_F_TLS_CONSTRUCT_STOC_PSK, ERR_R_INTERNAL_ERROR);
diff --git a/contrib/libs/openssl/ssl/statem/statem_clnt.c b/contrib/libs/openssl/ssl/statem/statem_clnt.c
index d1a3969812..705b4a77ac 100644
--- a/contrib/libs/openssl/ssl/statem/statem_clnt.c
+++ b/contrib/libs/openssl/ssl/statem/statem_clnt.c
@@ -1608,7 +1608,7 @@ MSG_PROCESS_RETURN tls_process_server_hello(SSL *s, PACKET *pkt)
          * so the PAC-based session secret is always preserved. It'll be
          * overwritten if the server refuses resumption.
          */
-        if (s->session->session_id_length > 0) {
+        if (s->session->session_id_length > 0) { 
             tsan_counter(&s->session_ctx->stats.sess_miss);
             if (!ssl_get_new_session(s, 0)) {
                 /* SSLfatal() already called */
diff --git a/contrib/libs/openssl/ssl/statem/statem_lib.c b/contrib/libs/openssl/ssl/statem/statem_lib.c
index c3b6f8f456..3a1897edf1 100644
--- a/contrib/libs/openssl/ssl/statem/statem_lib.c
+++ b/contrib/libs/openssl/ssl/statem/statem_lib.c
@@ -168,19 +168,19 @@ int tls_setup_handshake(SSL *s)
 static int get_cert_verify_tbs_data(SSL *s, unsigned char *tls13tbs,
                                     void **hdata, size_t *hdatalen)
 {
-#ifdef CHARSET_EBCDIC
+#ifdef CHARSET_EBCDIC 
     static const char servercontext[] = { 0x54, 0x4c, 0x53, 0x20, 0x31, 0x2e,
-     0x33, 0x2c, 0x20, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x43, 0x65,
-     0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x56, 0x65, 0x72,
-     0x69, 0x66, 0x79, 0x00 };
+     0x33, 0x2c, 0x20, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x43, 0x65, 
+     0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x56, 0x65, 0x72, 
+     0x69, 0x66, 0x79, 0x00 }; 
     static const char clientcontext[] = { 0x54, 0x4c, 0x53, 0x20, 0x31, 0x2e,
-     0x33, 0x2c, 0x20, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x20, 0x43, 0x65,
-     0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x56, 0x65, 0x72,
-     0x69, 0x66, 0x79, 0x00 };
-#else
+     0x33, 0x2c, 0x20, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x20, 0x43, 0x65, 
+     0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x56, 0x65, 0x72, 
+     0x69, 0x66, 0x79, 0x00 }; 
+#else 
     static const char servercontext[] = "TLS 1.3, server CertificateVerify";
     static const char clientcontext[] = "TLS 1.3, client CertificateVerify";
-#endif
+#endif 
     if (SSL_IS_TLS13(s)) {
         size_t hashlen;
 
@@ -655,9 +655,9 @@ MSG_PROCESS_RETURN tls_process_key_update(SSL *s, PACKET *pkt)
     /*
      * If we get a request for us to update our sending keys too then, we need
      * to additionally send a KeyUpdate message. However that message should
-     * not also request an update (otherwise we get into an infinite loop).
+     * not also request an update (otherwise we get into an infinite loop). 
      */
-    if (updatetype == SSL_KEY_UPDATE_REQUESTED)
+    if (updatetype == SSL_KEY_UPDATE_REQUESTED) 
         s->key_update = SSL_KEY_UPDATE_NOT_REQUESTED;
 
     if (!tls13_update_key(s, 0)) {
diff --git a/contrib/libs/openssl/ssl/statem/statem_srvr.c b/contrib/libs/openssl/ssl/statem/statem_srvr.c
index d701c46b43..911d9f8d80 100644
--- a/contrib/libs/openssl/ssl/statem/statem_srvr.c
+++ b/contrib/libs/openssl/ssl/statem/statem_srvr.c
@@ -792,10 +792,10 @@ static ossl_inline int conn_is_closed(void)
     case ECONNRESET:
         return 1;
 #endif
-#if defined(WSAECONNRESET)
-    case WSAECONNRESET:
-        return 1;
-#endif
+#if defined(WSAECONNRESET) 
+    case WSAECONNRESET: 
+        return 1; 
+#endif 
     default:
         return 0;
     }
@@ -1946,14 +1946,14 @@ static int tls_early_post_process_client_hello(SSL *s)
                 && master_key_length > 0) {
             s->session->master_key_length = master_key_length;
             s->hit = 1;
-            s->peer_ciphers = ciphers;
+            s->peer_ciphers = ciphers; 
             s->session->verify_result = X509_V_OK;
 
             ciphers = NULL;
 
             /* check if some cipher was preferred by call back */
             if (pref_cipher == NULL)
-                pref_cipher = ssl3_choose_cipher(s, s->peer_ciphers,
+                pref_cipher = ssl3_choose_cipher(s, s->peer_ciphers, 
                                                  SSL_get_ciphers(s));
             if (pref_cipher == NULL) {
                 SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
@@ -1964,9 +1964,9 @@ static int tls_early_post_process_client_hello(SSL *s)
 
             s->session->cipher = pref_cipher;
             sk_SSL_CIPHER_free(s->cipher_list);
-            s->cipher_list = sk_SSL_CIPHER_dup(s->peer_ciphers);
+            s->cipher_list = sk_SSL_CIPHER_dup(s->peer_ciphers); 
             sk_SSL_CIPHER_free(s->cipher_list_by_id);
-            s->cipher_list_by_id = sk_SSL_CIPHER_dup(s->peer_ciphers);
+            s->cipher_list_by_id = sk_SSL_CIPHER_dup(s->peer_ciphers); 
         }
     }
 
@@ -2066,12 +2066,12 @@ static int tls_early_post_process_client_hello(SSL *s)
 #endif
 
     /*
-     * Given s->peer_ciphers and SSL_get_ciphers, we must pick a cipher
+     * Given s->peer_ciphers and SSL_get_ciphers, we must pick a cipher 
      */
 
     if (!s->hit || SSL_IS_TLS13(s)) {
-        sk_SSL_CIPHER_free(s->peer_ciphers);
-        s->peer_ciphers = ciphers;
+        sk_SSL_CIPHER_free(s->peer_ciphers); 
+        s->peer_ciphers = ciphers; 
         if (ciphers == NULL) {
             SSLfatal(s, SSL_AD_INTERNAL_ERROR,
                      SSL_F_TLS_EARLY_POST_PROCESS_CLIENT_HELLO,
@@ -2087,10 +2087,10 @@ static int tls_early_post_process_client_hello(SSL *s)
 #else
         s->session->compress_meth = (comp == NULL) ? 0 : comp->id;
 #endif
-        if (!tls1_set_server_sigalgs(s)) {
-            /* SSLfatal() already called */
-            goto err;
-        }
+        if (!tls1_set_server_sigalgs(s)) { 
+            /* SSLfatal() already called */ 
+            goto err; 
+        } 
     }
 
     sk_SSL_CIPHER_free(ciphers);
@@ -2259,25 +2259,25 @@ WORK_STATE tls_post_process_client_hello(SSL *s, WORK_STATE wst)
     if (wst == WORK_MORE_B) {
         if (!s->hit || SSL_IS_TLS13(s)) {
             /* Let cert callback update server certificates if required */
-            if (!s->hit && s->cert->cert_cb != NULL) {
-                int rv = s->cert->cert_cb(s, s->cert->cert_cb_arg);
-                if (rv == 0) {
-                    SSLfatal(s, SSL_AD_INTERNAL_ERROR,
-                             SSL_F_TLS_POST_PROCESS_CLIENT_HELLO,
-                             SSL_R_CERT_CB_ERROR);
+            if (!s->hit && s->cert->cert_cb != NULL) { 
+                int rv = s->cert->cert_cb(s, s->cert->cert_cb_arg); 
+                if (rv == 0) { 
+                    SSLfatal(s, SSL_AD_INTERNAL_ERROR, 
+                             SSL_F_TLS_POST_PROCESS_CLIENT_HELLO, 
+                             SSL_R_CERT_CB_ERROR); 
                     goto err;
                 }
-                if (rv < 0) {
-                    s->rwstate = SSL_X509_LOOKUP;
-                    return WORK_MORE_B;
-                }
-                s->rwstate = SSL_NOTHING;
+                if (rv < 0) { 
+                    s->rwstate = SSL_X509_LOOKUP; 
+                    return WORK_MORE_B; 
+                } 
+                s->rwstate = SSL_NOTHING; 
             }
 
             /* In TLSv1.3 we selected the ciphersuite before resumption */
             if (!SSL_IS_TLS13(s)) {
                 cipher =
-                    ssl3_choose_cipher(s, s->peer_ciphers, SSL_get_ciphers(s));
+                    ssl3_choose_cipher(s, s->peer_ciphers, SSL_get_ciphers(s)); 
 
                 if (cipher == NULL) {
                     SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
diff --git a/contrib/libs/openssl/ssl/t1_lib.c b/contrib/libs/openssl/ssl/t1_lib.c
index b1d3add187..4f313e3859 100644
--- a/contrib/libs/openssl/ssl/t1_lib.c
+++ b/contrib/libs/openssl/ssl/t1_lib.c
@@ -21,9 +21,9 @@
 #include "ssl_local.h"
 #include <openssl/ct.h>
 
-static const SIGALG_LOOKUP *find_sig_alg(SSL *s, X509 *x, EVP_PKEY *pkey);
+static const SIGALG_LOOKUP *find_sig_alg(SSL *s, X509 *x, EVP_PKEY *pkey); 
 static int tls12_sigalg_allowed(const SSL *s, int op, const SIGALG_LOOKUP *lu);
-
+ 
 SSL3_ENC_METHOD const TLSv1_enc_data = {
     tls1_enc,
     tls1_mac,
@@ -468,11 +468,11 @@ static int tls1_check_pkey_comp(SSL *s, EVP_PKEY *pkey)
      * If point formats extension present check it, otherwise everything is
      * supported (see RFC4492).
      */
-    if (s->ext.peer_ecpointformats == NULL)
+    if (s->ext.peer_ecpointformats == NULL) 
         return 1;
 
-    for (i = 0; i < s->ext.peer_ecpointformats_len; i++) {
-        if (s->ext.peer_ecpointformats[i] == comp_id)
+    for (i = 0; i < s->ext.peer_ecpointformats_len; i++) { 
+        if (s->ext.peer_ecpointformats[i] == comp_id) 
             return 1;
     }
     return 0;
@@ -589,8 +589,8 @@ static int tls1_check_cert_param(SSL *s, X509 *x, int check_ee_md)
             check_md = NID_ecdsa_with_SHA384;
         else
             return 0;           /* Should never happen */
-        for (i = 0; i < s->shared_sigalgslen; i++) {
-            if (check_md == s->shared_sigalgs[i]->sigandhash)
+        for (i = 0; i < s->shared_sigalgslen; i++) { 
+            if (check_md == s->shared_sigalgs[i]->sigandhash) 
                 return 1;;
         }
         return 0;
@@ -1250,9 +1250,9 @@ int tls1_set_server_sigalgs(SSL *s)
     size_t i;
 
     /* Clear any shared signature algorithms */
-    OPENSSL_free(s->shared_sigalgs);
-    s->shared_sigalgs = NULL;
-    s->shared_sigalgslen = 0;
+    OPENSSL_free(s->shared_sigalgs); 
+    s->shared_sigalgs = NULL; 
+    s->shared_sigalgslen = 0; 
     /* Clear certificate validity flags */
     for (i = 0; i < SSL_PKEY_NUM; i++)
         s->s3->tmp.valid_flags[i] = 0;
@@ -1287,7 +1287,7 @@ int tls1_set_server_sigalgs(SSL *s)
                  SSL_F_TLS1_SET_SERVER_SIGALGS, ERR_R_INTERNAL_ERROR);
         return 0;
     }
-    if (s->shared_sigalgs != NULL)
+    if (s->shared_sigalgs != NULL) 
         return 1;
 
     /* Fatal error if no shared signature algorithms */
@@ -1756,9 +1756,9 @@ static int tls1_set_shared_sigalgs(SSL *s)
     CERT *c = s->cert;
     unsigned int is_suiteb = tls1_suiteb(s);
 
-    OPENSSL_free(s->shared_sigalgs);
-    s->shared_sigalgs = NULL;
-    s->shared_sigalgslen = 0;
+    OPENSSL_free(s->shared_sigalgs); 
+    s->shared_sigalgs = NULL; 
+    s->shared_sigalgslen = 0; 
     /* If client use client signature algorithms if not NULL */
     if (!s->server && c->client_sigalgs && !is_suiteb) {
         conf = c->client_sigalgs;
@@ -1789,8 +1789,8 @@ static int tls1_set_shared_sigalgs(SSL *s)
     } else {
         salgs = NULL;
     }
-    s->shared_sigalgs = salgs;
-    s->shared_sigalgslen = nmatch;
+    s->shared_sigalgs = salgs; 
+    s->shared_sigalgslen = nmatch; 
     return 1;
 }
 
@@ -1858,8 +1858,8 @@ int tls1_process_sigalgs(SSL *s)
     for (i = 0; i < SSL_PKEY_NUM; i++)
         pvalid[i] = 0;
 
-    for (i = 0; i < s->shared_sigalgslen; i++) {
-        const SIGALG_LOOKUP *sigptr = s->shared_sigalgs[i];
+    for (i = 0; i < s->shared_sigalgslen; i++) { 
+        const SIGALG_LOOKUP *sigptr = s->shared_sigalgs[i]; 
         int idx = sigptr->sig_idx;
 
         /* Ignore PKCS1 based sig algs in TLSv1.3 */
@@ -1906,12 +1906,12 @@ int SSL_get_shared_sigalgs(SSL *s, int idx,
                            unsigned char *rsig, unsigned char *rhash)
 {
     const SIGALG_LOOKUP *shsigalgs;
-    if (s->shared_sigalgs == NULL
+    if (s->shared_sigalgs == NULL 
         || idx < 0
-        || idx >= (int)s->shared_sigalgslen
-        || s->shared_sigalgslen > INT_MAX)
+        || idx >= (int)s->shared_sigalgslen 
+        || s->shared_sigalgslen > INT_MAX) 
         return 0;
-    shsigalgs = s->shared_sigalgs[idx];
+    shsigalgs = s->shared_sigalgs[idx]; 
     if (phash != NULL)
         *phash = shsigalgs->hash;
     if (psign != NULL)
@@ -1922,7 +1922,7 @@ int SSL_get_shared_sigalgs(SSL *s, int idx,
         *rsig = (unsigned char)(shsigalgs->sigalg & 0xff);
     if (rhash != NULL)
         *rhash = (unsigned char)((shsigalgs->sigalg >> 8) & 0xff);
-    return (int)s->shared_sigalgslen;
+    return (int)s->shared_sigalgslen; 
 }
 
 /* Maximum possible number of unique entries in sigalgs array */
@@ -2103,36 +2103,36 @@ int tls1_set_sigalgs(CERT *c, const int *psig_nids, size_t salglen, int client)
     return 0;
 }
 
-static int tls1_check_sig_alg(SSL *s, X509 *x, int default_nid)
+static int tls1_check_sig_alg(SSL *s, X509 *x, int default_nid) 
 {
-    int sig_nid, use_pc_sigalgs = 0;
+    int sig_nid, use_pc_sigalgs = 0; 
     size_t i;
-    const SIGALG_LOOKUP *sigalg;
-    size_t sigalgslen;
+    const SIGALG_LOOKUP *sigalg; 
+    size_t sigalgslen; 
     if (default_nid == -1)
         return 1;
     sig_nid = X509_get_signature_nid(x);
     if (default_nid)
         return sig_nid == default_nid ? 1 : 0;
-
-    if (SSL_IS_TLS13(s) && s->s3->tmp.peer_cert_sigalgs != NULL) {
-        /*
-         * If we're in TLSv1.3 then we only get here if we're checking the
-         * chain. If the peer has specified peer_cert_sigalgs then we use them
-         * otherwise we default to normal sigalgs.
-         */
-        sigalgslen = s->s3->tmp.peer_cert_sigalgslen;
-        use_pc_sigalgs = 1;
-    } else {
-        sigalgslen = s->shared_sigalgslen;
-    }
-    for (i = 0; i < sigalgslen; i++) {
-        sigalg = use_pc_sigalgs
-                 ? tls1_lookup_sigalg(s->s3->tmp.peer_cert_sigalgs[i])
-                 : s->shared_sigalgs[i];
+ 
+    if (SSL_IS_TLS13(s) && s->s3->tmp.peer_cert_sigalgs != NULL) { 
+        /* 
+         * If we're in TLSv1.3 then we only get here if we're checking the 
+         * chain. If the peer has specified peer_cert_sigalgs then we use them 
+         * otherwise we default to normal sigalgs. 
+         */ 
+        sigalgslen = s->s3->tmp.peer_cert_sigalgslen; 
+        use_pc_sigalgs = 1; 
+    } else { 
+        sigalgslen = s->shared_sigalgslen; 
+    } 
+    for (i = 0; i < sigalgslen; i++) { 
+        sigalg = use_pc_sigalgs 
+                 ? tls1_lookup_sigalg(s->s3->tmp.peer_cert_sigalgs[i]) 
+                 : s->shared_sigalgs[i]; 
         if (sigalg != NULL && sig_nid == sigalg->sigandhash)
             return 1;
-    }
+    } 
     return 0;
 }
 
@@ -2289,21 +2289,21 @@ int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
             }
         }
         /* Check signature algorithm of each cert in chain */
-        if (SSL_IS_TLS13(s)) {
-            /*
-             * We only get here if the application has called SSL_check_chain(),
-             * so check_flags is always set.
-             */
-            if (find_sig_alg(s, x, pk) != NULL)
-                rv |= CERT_PKEY_EE_SIGNATURE;
-        } else if (!tls1_check_sig_alg(s, x, default_nid)) {
+        if (SSL_IS_TLS13(s)) { 
+            /* 
+             * We only get here if the application has called SSL_check_chain(), 
+             * so check_flags is always set. 
+             */ 
+            if (find_sig_alg(s, x, pk) != NULL) 
+                rv |= CERT_PKEY_EE_SIGNATURE; 
+        } else if (!tls1_check_sig_alg(s, x, default_nid)) { 
             if (!check_flags)
                 goto end;
         } else
             rv |= CERT_PKEY_EE_SIGNATURE;
         rv |= CERT_PKEY_CA_SIGNATURE;
         for (i = 0; i < sk_X509_num(chain); i++) {
-            if (!tls1_check_sig_alg(s, sk_X509_value(chain, i), default_nid)) {
+            if (!tls1_check_sig_alg(s, sk_X509_value(chain, i), default_nid)) { 
                 if (check_flags) {
                     rv &= ~CERT_PKEY_CA_SIGNATURE;
                     break;
@@ -2593,13 +2593,13 @@ static int tls12_get_cert_sigalg_idx(const SSL *s, const SIGALG_LOOKUP *lu)
 }
 
 /*
- * Checks the given cert against signature_algorithm_cert restrictions sent by
- * the peer (if any) as well as whether the hash from the sigalg is usable with
- * the key.
- * Returns true if the cert is usable and false otherwise.
+ * Checks the given cert against signature_algorithm_cert restrictions sent by 
+ * the peer (if any) as well as whether the hash from the sigalg is usable with 
+ * the key. 
+ * Returns true if the cert is usable and false otherwise. 
  */
-static int check_cert_usable(SSL *s, const SIGALG_LOOKUP *sig, X509 *x,
-                             EVP_PKEY *pkey)
+static int check_cert_usable(SSL *s, const SIGALG_LOOKUP *sig, X509 *x, 
+                             EVP_PKEY *pkey) 
 {
     const SIGALG_LOOKUP *lu;
     int mdnid, pknid, default_mdnid;
@@ -2607,19 +2607,19 @@ static int check_cert_usable(SSL *s, const SIGALG_LOOKUP *sig, X509 *x,
 
     /* If the EVP_PKEY reports a mandatory digest, allow nothing else. */
     ERR_set_mark();
-    if (EVP_PKEY_get_default_digest_nid(pkey, &default_mdnid) == 2 &&
-        sig->hash != default_mdnid)
-            return 0;
-
-    /* If it didn't report a mandatory NID, for whatever reasons,
-     * just clear the error and allow all hashes to be used. */
-    ERR_pop_to_mark();
-
+    if (EVP_PKEY_get_default_digest_nid(pkey, &default_mdnid) == 2 && 
+        sig->hash != default_mdnid) 
+            return 0; 
+ 
+    /* If it didn't report a mandatory NID, for whatever reasons, 
+     * just clear the error and allow all hashes to be used. */ 
+    ERR_pop_to_mark(); 
+ 
     if (s->s3->tmp.peer_cert_sigalgs != NULL) {
         for (i = 0; i < s->s3->tmp.peer_cert_sigalgslen; i++) {
             lu = tls1_lookup_sigalg(s->s3->tmp.peer_cert_sigalgs[i]);
             if (lu == NULL
-                || !X509_get_signature_info(x, &mdnid, &pknid, NULL, NULL))
+                || !X509_get_signature_info(x, &mdnid, &pknid, NULL, NULL)) 
                 continue;
             /*
              * TODO this does not differentiate between the
@@ -2632,107 +2632,107 @@ static int check_cert_usable(SSL *s, const SIGALG_LOOKUP *sig, X509 *x,
         }
         return 0;
     }
-    return 1;
-}
-
-/*
- * Returns true if |s| has a usable certificate configured for use
- * with signature scheme |sig|.
- * "Usable" includes a check for presence as well as applying
- * the signature_algorithm_cert restrictions sent by the peer (if any).
- * Returns false if no usable certificate is found.
- */
-static int has_usable_cert(SSL *s, const SIGALG_LOOKUP *sig, int idx)
-{
-    /* TLS 1.2 callers can override sig->sig_idx, but not TLS 1.3 callers. */
-    if (idx == -1)
-        idx = sig->sig_idx;
-    if (!ssl_has_cert(s, idx))
-        return 0;
-
-    return check_cert_usable(s, sig, s->cert->pkeys[idx].x509,
-                             s->cert->pkeys[idx].privatekey);
-}
-
-/*
- * Returns true if the supplied cert |x| and key |pkey| is usable with the
- * specified signature scheme |sig|, or false otherwise.
- */
-static int is_cert_usable(SSL *s, const SIGALG_LOOKUP *sig, X509 *x,
-                          EVP_PKEY *pkey)
-{
-    size_t idx;
-
-    if (ssl_cert_lookup_by_pkey(pkey, &idx) == NULL)
-        return 0;
-
-    /* Check the key is consistent with the sig alg */
-    if ((int)idx != sig->sig_idx)
-        return 0;
-
-    return check_cert_usable(s, sig, x, pkey);
-}
-
-/*
- * Find a signature scheme that works with the supplied certificate |x| and key
- * |pkey|. |x| and |pkey| may be NULL in which case we additionally look at our
- * available certs/keys to find one that works.
- */
-static const SIGALG_LOOKUP *find_sig_alg(SSL *s, X509 *x, EVP_PKEY *pkey)
-{
-    const SIGALG_LOOKUP *lu = NULL;
-    size_t i;
-#ifndef OPENSSL_NO_EC
-    int curve = -1;
-#endif
-    EVP_PKEY *tmppkey;
-
-    /* Look for a shared sigalgs matching possible certificates */
-    for (i = 0; i < s->shared_sigalgslen; i++) {
-        lu = s->shared_sigalgs[i];
-
-        /* Skip SHA1, SHA224, DSA and RSA if not PSS */
-        if (lu->hash == NID_sha1
-            || lu->hash == NID_sha224
-            || lu->sig == EVP_PKEY_DSA
-            || lu->sig == EVP_PKEY_RSA)
-            continue;
-        /* Check that we have a cert, and signature_algorithms_cert */
-        if (!tls1_lookup_md(lu, NULL))
-            continue;
-        if ((pkey == NULL && !has_usable_cert(s, lu, -1))
-                || (pkey != NULL && !is_cert_usable(s, lu, x, pkey)))
-            continue;
-
-        tmppkey = (pkey != NULL) ? pkey
-                                 : s->cert->pkeys[lu->sig_idx].privatekey;
-
-        if (lu->sig == EVP_PKEY_EC) {
-#ifndef OPENSSL_NO_EC
-            if (curve == -1) {
-                EC_KEY *ec = EVP_PKEY_get0_EC_KEY(tmppkey);
-                curve = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec));
-            }
-            if (lu->curve != NID_undef && curve != lu->curve)
-                continue;
-#else
-            continue;
-#endif
-        } else if (lu->sig == EVP_PKEY_RSA_PSS) {
-            /* validate that key is large enough for the signature algorithm */
-            if (!rsa_pss_check_min_key_size(EVP_PKEY_get0(tmppkey), lu))
-                continue;
-        }
-        break;
-    }
-
-    if (i == s->shared_sigalgslen)
-        return NULL;
-
-    return lu;
+    return 1; 
 }
 
 /*
+ * Returns true if |s| has a usable certificate configured for use 
+ * with signature scheme |sig|. 
+ * "Usable" includes a check for presence as well as applying 
+ * the signature_algorithm_cert restrictions sent by the peer (if any). 
+ * Returns false if no usable certificate is found. 
+ */ 
+static int has_usable_cert(SSL *s, const SIGALG_LOOKUP *sig, int idx) 
+{ 
+    /* TLS 1.2 callers can override sig->sig_idx, but not TLS 1.3 callers. */ 
+    if (idx == -1) 
+        idx = sig->sig_idx; 
+    if (!ssl_has_cert(s, idx)) 
+        return 0; 
+ 
+    return check_cert_usable(s, sig, s->cert->pkeys[idx].x509, 
+                             s->cert->pkeys[idx].privatekey); 
+} 
+ 
+/* 
+ * Returns true if the supplied cert |x| and key |pkey| is usable with the 
+ * specified signature scheme |sig|, or false otherwise. 
+ */ 
+static int is_cert_usable(SSL *s, const SIGALG_LOOKUP *sig, X509 *x, 
+                          EVP_PKEY *pkey) 
+{ 
+    size_t idx; 
+ 
+    if (ssl_cert_lookup_by_pkey(pkey, &idx) == NULL) 
+        return 0; 
+ 
+    /* Check the key is consistent with the sig alg */ 
+    if ((int)idx != sig->sig_idx) 
+        return 0; 
+ 
+    return check_cert_usable(s, sig, x, pkey); 
+} 
+ 
+/* 
+ * Find a signature scheme that works with the supplied certificate |x| and key 
+ * |pkey|. |x| and |pkey| may be NULL in which case we additionally look at our 
+ * available certs/keys to find one that works. 
+ */ 
+static const SIGALG_LOOKUP *find_sig_alg(SSL *s, X509 *x, EVP_PKEY *pkey) 
+{ 
+    const SIGALG_LOOKUP *lu = NULL; 
+    size_t i; 
+#ifndef OPENSSL_NO_EC 
+    int curve = -1; 
+#endif 
+    EVP_PKEY *tmppkey; 
+ 
+    /* Look for a shared sigalgs matching possible certificates */ 
+    for (i = 0; i < s->shared_sigalgslen; i++) { 
+        lu = s->shared_sigalgs[i]; 
+ 
+        /* Skip SHA1, SHA224, DSA and RSA if not PSS */ 
+        if (lu->hash == NID_sha1 
+            || lu->hash == NID_sha224 
+            || lu->sig == EVP_PKEY_DSA 
+            || lu->sig == EVP_PKEY_RSA) 
+            continue; 
+        /* Check that we have a cert, and signature_algorithms_cert */ 
+        if (!tls1_lookup_md(lu, NULL)) 
+            continue; 
+        if ((pkey == NULL && !has_usable_cert(s, lu, -1)) 
+                || (pkey != NULL && !is_cert_usable(s, lu, x, pkey))) 
+            continue; 
+ 
+        tmppkey = (pkey != NULL) ? pkey 
+                                 : s->cert->pkeys[lu->sig_idx].privatekey; 
+ 
+        if (lu->sig == EVP_PKEY_EC) { 
+#ifndef OPENSSL_NO_EC 
+            if (curve == -1) { 
+                EC_KEY *ec = EVP_PKEY_get0_EC_KEY(tmppkey); 
+                curve = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec)); 
+            } 
+            if (lu->curve != NID_undef && curve != lu->curve) 
+                continue; 
+#else 
+            continue; 
+#endif 
+        } else if (lu->sig == EVP_PKEY_RSA_PSS) { 
+            /* validate that key is large enough for the signature algorithm */ 
+            if (!rsa_pss_check_min_key_size(EVP_PKEY_get0(tmppkey), lu)) 
+                continue; 
+        } 
+        break; 
+    } 
+ 
+    if (i == s->shared_sigalgslen) 
+        return NULL; 
+ 
+    return lu; 
+} 
+ 
+/* 
  * Choose an appropriate signature algorithm based on available certificates
  * Sets chosen certificate and signature algorithm.
  *
@@ -2752,8 +2752,8 @@ int tls_choose_sigalg(SSL *s, int fatalerrs)
     s->s3->tmp.sigalg = NULL;
 
     if (SSL_IS_TLS13(s)) {
-        lu = find_sig_alg(s, NULL, NULL);
-        if (lu == NULL) {
+        lu = find_sig_alg(s, NULL, NULL); 
+        if (lu == NULL) { 
             if (!fatalerrs)
                 return 1;
             SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE, SSL_F_TLS_CHOOSE_SIGALG,
@@ -2786,8 +2786,8 @@ int tls_choose_sigalg(SSL *s, int fatalerrs)
                  * Find highest preference signature algorithm matching
                  * cert type
                  */
-                for (i = 0; i < s->shared_sigalgslen; i++) {
-                    lu = s->shared_sigalgs[i];
+                for (i = 0; i < s->shared_sigalgslen; i++) { 
+                    lu = s->shared_sigalgs[i]; 
 
                     if (s->server) {
                         if ((sig_idx = tls12_get_cert_sigalg_idx(s, lu)) == -1)
@@ -2834,7 +2834,7 @@ int tls_choose_sigalg(SSL *s, int fatalerrs)
                   }
                 }
 #endif
-                if (i == s->shared_sigalgslen) {
+                if (i == s->shared_sigalgslen) { 
                     if (!fatalerrs)
                         return 1;
                     SSLfatal(s, SSL_AD_HANDSHAKE_FAILURE,
diff --git a/contrib/libs/openssl/ssl/tls13_enc.c b/contrib/libs/openssl/ssl/tls13_enc.c
index b8fb07f210..f971eb669a 100644
--- a/contrib/libs/openssl/ssl/tls13_enc.c
+++ b/contrib/libs/openssl/ssl/tls13_enc.c
@@ -30,11 +30,11 @@ int tls13_hkdf_expand(SSL *s, const EVP_MD *md, const unsigned char *secret,
                              const unsigned char *data, size_t datalen,
                              unsigned char *out, size_t outlen, int fatal)
 {
-#ifdef CHARSET_EBCDIC
-    static const unsigned char label_prefix[] = { 0x74, 0x6C, 0x73, 0x31, 0x33, 0x20, 0x00 };
-#else
+#ifdef CHARSET_EBCDIC 
+    static const unsigned char label_prefix[] = { 0x74, 0x6C, 0x73, 0x31, 0x33, 0x20, 0x00 }; 
+#else 
     static const unsigned char label_prefix[] = "tls13 ";
-#endif
+#endif 
     EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_HKDF, NULL);
     int ret;
     size_t hkdflabellen;
@@ -116,11 +116,11 @@ int tls13_hkdf_expand(SSL *s, const EVP_MD *md, const unsigned char *secret,
 int tls13_derive_key(SSL *s, const EVP_MD *md, const unsigned char *secret,
                      unsigned char *key, size_t keylen)
 {
-#ifdef CHARSET_EBCDIC
-  static const unsigned char keylabel[] ={ 0x6B, 0x65, 0x79, 0x00 };
-#else
-  static const unsigned char keylabel[] = "key";
-#endif
+#ifdef CHARSET_EBCDIC 
+  static const unsigned char keylabel[] ={ 0x6B, 0x65, 0x79, 0x00 }; 
+#else 
+  static const unsigned char keylabel[] = "key"; 
+#endif 
 
     return tls13_hkdf_expand(s, md, secret, keylabel, sizeof(keylabel) - 1,
                              NULL, 0, key, keylen, 1);
@@ -133,11 +133,11 @@ int tls13_derive_key(SSL *s, const EVP_MD *md, const unsigned char *secret,
 int tls13_derive_iv(SSL *s, const EVP_MD *md, const unsigned char *secret,
                     unsigned char *iv, size_t ivlen)
 {
-#ifdef CHARSET_EBCDIC
-  static const unsigned char ivlabel[] = { 0x69, 0x76, 0x00 };
-#else
-  static const unsigned char ivlabel[] = "iv";
-#endif
+#ifdef CHARSET_EBCDIC 
+  static const unsigned char ivlabel[] = { 0x69, 0x76, 0x00 }; 
+#else 
+  static const unsigned char ivlabel[] = "iv"; 
+#endif 
 
     return tls13_hkdf_expand(s, md, secret, ivlabel, sizeof(ivlabel) - 1,
                              NULL, 0, iv, ivlen, 1);
@@ -147,11 +147,11 @@ int tls13_derive_finishedkey(SSL *s, const EVP_MD *md,
                              const unsigned char *secret,
                              unsigned char *fin, size_t finlen)
 {
-#ifdef CHARSET_EBCDIC
-  static const unsigned char finishedlabel[] = { 0x66, 0x69, 0x6E, 0x69, 0x73, 0x68, 0x65, 0x64, 0x00 };
-#else
-  static const unsigned char finishedlabel[] = "finished";
-#endif
+#ifdef CHARSET_EBCDIC 
+  static const unsigned char finishedlabel[] = { 0x66, 0x69, 0x6E, 0x69, 0x73, 0x68, 0x65, 0x64, 0x00 }; 
+#else 
+  static const unsigned char finishedlabel[] = "finished"; 
+#endif 
 
     return tls13_hkdf_expand(s, md, secret, finishedlabel,
                              sizeof(finishedlabel) - 1, NULL, 0, fin, finlen, 1);
@@ -172,11 +172,11 @@ int tls13_generate_secret(SSL *s, const EVP_MD *md,
     int mdleni;
     int ret;
     EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_HKDF, NULL);
-#ifdef CHARSET_EBCDIC
-    static const char derived_secret_label[] = { 0x64, 0x65, 0x72, 0x69, 0x76, 0x65, 0x64, 0x00 };
-#else
+#ifdef CHARSET_EBCDIC 
+    static const char derived_secret_label[] = { 0x64, 0x65, 0x72, 0x69, 0x76, 0x65, 0x64, 0x00 }; 
+#else 
     static const char derived_secret_label[] = "derived";
-#endif
+#endif 
     unsigned char preextractsec[EVP_MAX_MD_SIZE];
 
     if (pctx == NULL) {
@@ -436,16 +436,16 @@ static int derive_secret_key_and_iv(SSL *s, int sending, const EVP_MD *md,
 
 int tls13_change_cipher_state(SSL *s, int which)
 {
-#ifdef CHARSET_EBCDIC
-  static const unsigned char client_early_traffic[]       = {0x63, 0x20, 0x65, 0x20,       /*traffic*/0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x00};
-  static const unsigned char client_handshake_traffic[]   = {0x63, 0x20, 0x68, 0x73, 0x20, /*traffic*/0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x00};
-  static const unsigned char client_application_traffic[] = {0x63, 0x20, 0x61, 0x70, 0x20, /*traffic*/0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x00};
-  static const unsigned char server_handshake_traffic[]   = {0x73, 0x20, 0x68, 0x73, 0x20, /*traffic*/0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x00};
-  static const unsigned char server_application_traffic[] = {0x73, 0x20, 0x61, 0x70, 0x20, /*traffic*/0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x00};
-  static const unsigned char exporter_master_secret[] = {0x65, 0x78, 0x70, 0x20,                    /* master*/  0x6D, 0x61, 0x73, 0x74, 0x65, 0x72, 0x00};
-  static const unsigned char resumption_master_secret[] = {0x72, 0x65, 0x73, 0x20,                  /* master*/  0x6D, 0x61, 0x73, 0x74, 0x65, 0x72, 0x00};
-  static const unsigned char early_exporter_master_secret[] = {0x65, 0x20, 0x65, 0x78, 0x70, 0x20,  /* master*/  0x6D, 0x61, 0x73, 0x74, 0x65, 0x72, 0x00};
-#else
+#ifdef CHARSET_EBCDIC 
+  static const unsigned char client_early_traffic[]       = {0x63, 0x20, 0x65, 0x20,       /*traffic*/0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x00}; 
+  static const unsigned char client_handshake_traffic[]   = {0x63, 0x20, 0x68, 0x73, 0x20, /*traffic*/0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x00}; 
+  static const unsigned char client_application_traffic[] = {0x63, 0x20, 0x61, 0x70, 0x20, /*traffic*/0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x00}; 
+  static const unsigned char server_handshake_traffic[]   = {0x73, 0x20, 0x68, 0x73, 0x20, /*traffic*/0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x00}; 
+  static const unsigned char server_application_traffic[] = {0x73, 0x20, 0x61, 0x70, 0x20, /*traffic*/0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x00}; 
+  static const unsigned char exporter_master_secret[] = {0x65, 0x78, 0x70, 0x20,                    /* master*/  0x6D, 0x61, 0x73, 0x74, 0x65, 0x72, 0x00}; 
+  static const unsigned char resumption_master_secret[] = {0x72, 0x65, 0x73, 0x20,                  /* master*/  0x6D, 0x61, 0x73, 0x74, 0x65, 0x72, 0x00}; 
+  static const unsigned char early_exporter_master_secret[] = {0x65, 0x20, 0x65, 0x78, 0x70, 0x20,  /* master*/  0x6D, 0x61, 0x73, 0x74, 0x65, 0x72, 0x00}; 
+#else 
     static const unsigned char client_early_traffic[] = "c e traffic";
     static const unsigned char client_handshake_traffic[] = "c hs traffic";
     static const unsigned char client_application_traffic[] = "c ap traffic";
@@ -454,7 +454,7 @@ int tls13_change_cipher_state(SSL *s, int which)
     static const unsigned char exporter_master_secret[] = "exp master";
     static const unsigned char resumption_master_secret[] = "res master";
     static const unsigned char early_exporter_master_secret[] = "e exp master";
-#endif
+#endif 
     unsigned char *iv;
     unsigned char secret[EVP_MAX_MD_SIZE];
     unsigned char hashval[EVP_MAX_MD_SIZE];
@@ -722,11 +722,11 @@ int tls13_change_cipher_state(SSL *s, int which)
 
 int tls13_update_key(SSL *s, int sending)
 {
-#ifdef CHARSET_EBCDIC
-  static const unsigned char application_traffic[] = { 0x74, 0x72 ,0x61 ,0x66 ,0x66 ,0x69 ,0x63 ,0x20 ,0x75 ,0x70 ,0x64, 0x00};
-#else
-  static const unsigned char application_traffic[] = "traffic upd";
-#endif
+#ifdef CHARSET_EBCDIC 
+  static const unsigned char application_traffic[] = { 0x74, 0x72 ,0x61 ,0x66 ,0x66 ,0x69 ,0x63 ,0x20 ,0x75 ,0x70 ,0x64, 0x00}; 
+#else 
+  static const unsigned char application_traffic[] = "traffic upd"; 
+#endif 
     const EVP_MD *md = ssl_handshake_md(s);
     size_t hashlen = EVP_MD_size(md);
     unsigned char *insecret, *iv;
@@ -783,11 +783,11 @@ int tls13_export_keying_material(SSL *s, unsigned char *out, size_t olen,
                                  size_t contextlen, int use_context)
 {
     unsigned char exportsecret[EVP_MAX_MD_SIZE];
-#ifdef CHARSET_EBCDIC
-    static const unsigned char exporterlabel[] = {0x65, 0x78, 0x70, 0x6F, 0x72, 0x74, 0x65, 0x72, 0x00};
-#else
+#ifdef CHARSET_EBCDIC 
+    static const unsigned char exporterlabel[] = {0x65, 0x78, 0x70, 0x6F, 0x72, 0x74, 0x65, 0x72, 0x00}; 
+#else 
     static const unsigned char exporterlabel[] = "exporter";
-#endif
+#endif 
     unsigned char hash[EVP_MAX_MD_SIZE], data[EVP_MAX_MD_SIZE];
     const EVP_MD *md = ssl_handshake_md(s);
     EVP_MD_CTX *ctx = EVP_MD_CTX_new();
@@ -824,11 +824,11 @@ int tls13_export_keying_material_early(SSL *s, unsigned char *out, size_t olen,
                                        const unsigned char *context,
                                        size_t contextlen)
 {
-#ifdef CHARSET_EBCDIC
-  static const unsigned char exporterlabel[] = {0x65, 0x78, 0x70, 0x6F, 0x72, 0x74, 0x65, 0x72, 0x00};
-#else
-  static const unsigned char exporterlabel[] = "exporter";
-#endif
+#ifdef CHARSET_EBCDIC 
+  static const unsigned char exporterlabel[] = {0x65, 0x78, 0x70, 0x6F, 0x72, 0x74, 0x65, 0x72, 0x00}; 
+#else 
+  static const unsigned char exporterlabel[] = "exporter"; 
+#endif 
     unsigned char exportsecret[EVP_MAX_MD_SIZE];
     unsigned char hash[EVP_MAX_MD_SIZE], data[EVP_MAX_MD_SIZE];
     const EVP_MD *md;