remove obfuscating parens. man operator is your friend.
Add CHACHA20 as a cipher symmetric encryption alias.

From Ming <gzchenym at 126.com>
Fix a memory leak in the error path in ASN1_mbstring_ncopy().
Replace an if() posse with a switch() statement in traverse_string().
Remove unnecessary casts in cpy_*(),

with tweaks from guenther@; ok bcook@ jsing@ guenther@
a_enum.c used to be a copy of a_int.c with s/INTEGER/ENUMERATED/g , but
some changes an a_int.c did not get applied to a_enum.c; despite style
changes, make sure BN_to_ASN1_ENUMERATED() correctly handles a zero value
the same way BN_to_ASN1_INTEGER() does.

ok bcook@ beck@ jsing@
Move the TLS padding extension under an SSL_OP_TLSEXT_PADDING option, which
is off by default (instead of being enabled unconditionally).

The TLS padding extension was added as a workaround for a bug in F5 SSL
terminators, however appears to trigger bugs in IronPort SMTP appliances.
Now the SSL client gets to choose which of these devices it wants to
trigger bugs in...

Ported from OpenSSL.

Discussed with many.

ok miod@
Document SSL_OP_TLSEXT_PADDING.

From OpenSSL.
It is possible (although unlikely in practice) for peer_finish_md_len to
end up with a value of zero, primarily since ssl3_take_mac() fails to check
the return value from the final_finish_mac() call. This would then mean that
an SSL finished message with a zero-byte payload would successfully match
against the calculated finish MAC.

Avoid this by checking the length of peer_finish_md_len and the SSL
finished message payload, against the known length already stored in
the SSL3_ENC_METHOD finish_mac_length field (making use of a previously
unused field).

ok miod@ (a little while back)
Also check the result from final_finish_mac() against finish_mac_length in
ssl3_send_finished(). While this previously checked against a zero return
value (which could occur on failure), we may as well test against the
expected length, since we already know what that is.
Refactor and simplify the ECC extension handling. The existing code
effectively built two "static" data structures - instead of doing this,
just use static data structures to start with.

From OpenSSL (part of a larger commit).

ok miod@
Fix regression introduced in revision 1.15 by using strndup() instead of
strdup() to allocated directory list components.

ok jsing@
Now that we have a static version of the default EC formats, also use it
for the server hello.

From OpenSSL.

ok miod@
X509at_add1_attr(): do not free stuff we did not allocate in the error path.
ok tedu@
X509_issuer_and_serial_hash(): do not leak memory if an error occurs during
the first EVP block.

ok tedu@
X509_STORE_new(): do not leak memory upon error.
X509_STORE_get1_certs(), X509_STORE_get1_crls(): check the result of
allocations.

ok tedu@
Check that the specified curve is one of the client preferences.

Based on OpenSSL.

ok miod@
There is not much point checking ecdhp is not NULL... twice.

ok miod@
Doh, rev 1.4 had left out one routine with both 32-bit and 64-bit code, where
the 64-bit code has to be disabled under OpenBSD/hppa.
Someone (TM) thought it was smart to save memory by using malloc(1) and
manual field fiddling to create an ASN1_INTEGER object, instead of using
M_ASN1_INTEGER_new() which will allocate sizeof(long) bytes.
That person had probably never looked into malloc(3) and never heard of
allocation size rounding.

Thus, replace the obfuscated code with M_ASN1_INTEGER_new() followed by
ASN1_INTEGER_set(), to achieve a similar result, without the need for
/* version == 0 */ comments.

ok bcook@
X509_TRUST_add(): check X509_TRUST_get0() return value before dereferencing it,
for it may be NULL. Do not leak memory upon error.

ok bcook@
X509v3_add_ext(): do not free stuff we did not allocate in the error path.
ok bcook@