external/boringssl: Sync to 8ca0b41.

This includes the following changes:

https://boringssl.googlesource.com/boringssl/+log/9d908ba519f2cfe5e21561bdee3e224b94d14a89..8ca0b4127da11d766067ea6ec4122017ba0edb0e

Change-Id: I732653bc8fcba70707c615f8731ca75397a08736
diff --git a/src/include/openssl/base64.h b/src/include/openssl/base64.h
index f28e7dd..4bf3888 100644
--- a/src/include/openssl/base64.h
+++ b/src/include/openssl/base64.h
@@ -87,15 +87,16 @@
 
 /* Decoding */
 
-/* EVP_DecodedLength sets |*out_len| to the maximum number of bytes
- * that will be needed to call |EVP_DecodeBase64| on an input of
- * length |len|. */
+/* EVP_DecodedLength sets |*out_len| to the maximum number of bytes that will
+ * be needed to call |EVP_DecodeBase64| on an input of length |len|. It returns
+ * one on success or zero if |len| is not a valid length for a base64-encoded
+ * string. */
 OPENSSL_EXPORT int EVP_DecodedLength(size_t *out_len, size_t len);
 
 /* EVP_DecodeBase64 decodes |in_len| bytes from base64 and writes
  * |*out_len| bytes to |out|. |max_out| is the size of the output
  * buffer. If it is not enough for the maximum output size, the
- * operation fails. */
+ * operation fails. It returns one on success or zero on error. */
 OPENSSL_EXPORT int EVP_DecodeBase64(uint8_t *out, size_t *out_len,
                                     size_t max_out, const uint8_t *in,
                                     size_t in_len);
@@ -105,9 +106,7 @@
  *
  * OpenSSL provides a streaming base64 implementation, however its behavior is
  * very specific to PEM. It is also very lenient of invalid input. Use of any of
- * these functions is thus deprecated.
- *
- * TODO(davidben): Import upstream's rewrite that rejects the invalid input. */
+ * these functions is thus deprecated. */
 
 /* EVP_EncodeInit initialises |*ctx|, which is typically stack
  * allocated, for an encoding operation.
@@ -159,21 +158,25 @@
  *
  * WARNING: EVP_DecodeBlock's return value does not take padding into
  * account. It also strips leading whitespace and trailing
- * whitespace. */
+ * whitespace and minuses. */
 OPENSSL_EXPORT int EVP_DecodeBlock(uint8_t *dst, const uint8_t *src,
                                    size_t src_len);
 
 
 struct evp_encode_ctx_st {
-  unsigned num;    /* number saved in a partial encode/decode */
-  unsigned length; /* The length is either the output line length
-               * (in input bytes) or the shortest input line
-               * length that is ok.  Once decoding begins,
-               * the length is adjusted up each time a longer
-               * line is decoded */
-  uint8_t enc_data[80]; /* data to encode */
-  unsigned line_num;    /* number read on current line */
-  int expect_nl;
+  /* data_used indicates the number of bytes of |data| that are valid. When
+   * encoding, |data| will be filled and encoded as a lump. When decoding, only
+   * the first four bytes of |data| will be used. */
+  unsigned data_used;
+  uint8_t data[48];
+
+  /* eof_seen indicates that the end of the base64 data has been seen when
+   * decoding. Only whitespace can follow. */
+  char eof_seen;
+
+  /* error_encountered indicates that invalid base64 data was found. This will
+   * cause all future calls to fail. */
+  char error_encountered;
 };
 
 
diff --git a/src/include/openssl/bio.h b/src/include/openssl/bio.h
index a7fe261..3e547ac 100644
--- a/src/include/openssl/bio.h
+++ b/src/include/openssl/bio.h
@@ -362,8 +362,6 @@
  *
  * Memory BIOs support |BIO_gets| and |BIO_puts|.
  *
- * |BIO_eof| is true if no data is in the BIO.
- *
  * |BIO_ctrl_pending| returns the number of bytes currently stored. */
 
 /* BIO_s_mem returns a |BIO_METHOD| that uses a in-memory buffer. */
@@ -420,12 +418,7 @@
  * underlying file descriptor when the BIO is freed.
  *
  * |BIO_reset| attempts to seek the file pointer to the start of file using
- * |lseek|.
- *
- * |BIO_seek| sets the file pointer to position |off| from start of file using
- * |lseek|.
- *
- * |BIO_tell| returns the current file position. */
+ * |lseek|. */
 
 /* BIO_s_fd returns a |BIO_METHOD| for file descriptor fds. */
 OPENSSL_EXPORT const BIO_METHOD *BIO_s_fd(void);
@@ -460,11 +453,6 @@
  * |BIO_reset| attempts to seek the file pointer to the start of file using
  * |fseek|.
  *
- * |BIO_seek| sets the file pointer to the given position from the start of
- * file using |fseek|.
- *
- * |BIO_eof| calls |feof|.
- *
  * Setting the close flag causes |fclose| to be called on the stream when the
  * BIO is freed. */
 
diff --git a/src/include/openssl/bn.h b/src/include/openssl/bn.h
index c66f887..e9be0f5 100644
--- a/src/include/openssl/bn.h
+++ b/src/include/openssl/bn.h
@@ -802,14 +802,6 @@
                                              BN_CTX *ctx,
                                              const BN_MONT_CTX *mont);
 
-OPENSSL_EXPORT int BN_mod_exp_mont_word(BIGNUM *r, BN_ULONG a, const BIGNUM *p,
-                                        const BIGNUM *m, BN_CTX *ctx,
-                                        const BN_MONT_CTX *mont);
-OPENSSL_EXPORT int BN_mod_exp2_mont(BIGNUM *r, const BIGNUM *a1,
-                                    const BIGNUM *p1, const BIGNUM *a2,
-                                    const BIGNUM *p2, const BIGNUM *m,
-                                    BN_CTX *ctx, const BN_MONT_CTX *mont);
-
 
 /* Deprecated functions */
 
@@ -829,6 +821,20 @@
  * is updated. */
 OPENSSL_EXPORT BIGNUM *BN_mpi2bn(const uint8_t *in, size_t len, BIGNUM *out);
 
+/* BN_mod_exp_mont_word is like |BN_mod_exp_mont| except that the base |a| is
+ * given as a |BN_ULONG| instead of a |BIGNUM *|. It returns one on success
+ * or zero otherwise. */
+OPENSSL_EXPORT int BN_mod_exp_mont_word(BIGNUM *r, BN_ULONG a, const BIGNUM *p,
+                                        const BIGNUM *m, BN_CTX *ctx,
+                                        const BN_MONT_CTX *mont);
+
+/* BN_mod_exp2_mont calculates (a1^p1) * (a2^p2) mod m. It returns 1 on success
+ * or zero otherwise. */
+OPENSSL_EXPORT int BN_mod_exp2_mont(BIGNUM *r, const BIGNUM *a1,
+                                    const BIGNUM *p1, const BIGNUM *a2,
+                                    const BIGNUM *p2, const BIGNUM *m,
+                                    BN_CTX *ctx, const BN_MONT_CTX *mont);
+
 
 /* Private functions */
 
diff --git a/src/include/openssl/buf.h b/src/include/openssl/buf.h
index f4e315c..8ae856b 100644
--- a/src/include/openssl/buf.h
+++ b/src/include/openssl/buf.h
@@ -80,6 +80,10 @@
 /* BUF_MEM_free frees |buf->data| if needed and then frees |buf| itself. */
 OPENSSL_EXPORT void BUF_MEM_free(BUF_MEM *buf);
 
+/* BUF_MEM_reserve ensures |buf| has capacity |cap| and allocates memory if
+ * needed. It returns one on success and zero on error. */
+OPENSSL_EXPORT int BUF_MEM_reserve(BUF_MEM *buf, size_t cap);
+
 /* BUF_MEM_grow ensures that |buf| has length |len| and allocates memory if
  * needed. If the length of |buf| increased, the new bytes are filled with
  * zeros. It returns the length of |buf|, or zero if there's an error. */
diff --git a/src/include/openssl/crypto.h b/src/include/openssl/crypto.h
index 3fd299f..80d7196 100644
--- a/src/include/openssl/crypto.h
+++ b/src/include/openssl/crypto.h
@@ -50,6 +50,10 @@
  * internal version of BoringSSL. */
 OPENSSL_EXPORT int CRYPTO_is_confidential_build(void);
 
+/* CRYPTO_has_asm returns one unless BoringSSL was built with OPENSSL_NO_ASM,
+ * in which case it returns zero. */
+OPENSSL_EXPORT int CRYPTO_has_asm(void);
+
 
 /* Deprecated functions. */
 
diff --git a/src/include/openssl/dh.h b/src/include/openssl/dh.h
index 5cdeb86..a087651 100644
--- a/src/include/openssl/dh.h
+++ b/src/include/openssl/dh.h
@@ -174,22 +174,15 @@
 
 /* ASN.1 functions. */
 
-/* d2i_DHparams parses an ASN.1, DER encoded Diffie-Hellman parameters
- * structure from |len| bytes at |*inp|. If |ret| is not NULL then, on exit, a
- * pointer to the result is in |*ret|. If |*ret| is already non-NULL on entry
- * then the result is written directly into |*ret|, otherwise a fresh |DH| is
- * allocated. However, one should not depend on writing into |*ret| because
- * this behaviour is likely to change in the future.
- *
- * On successful exit, |*inp| is advanced past the DER structure. It
- * returns the result or NULL on error. */
-OPENSSL_EXPORT DH *d2i_DHparams(DH **ret, const unsigned char **inp, long len);
+/* DH_parse_parameters decodes a DER-encoded DHParameter structure (PKCS #3)
+ * from |cbs| and advances |cbs|. It returns a newly-allocated |DH| or NULL on
+ * error. */
+OPENSSL_EXPORT DH *DH_parse_parameters(CBS *cbs);
 
-/* i2d_DHparams marshals |in| to an ASN.1, DER structure. If |outp| is not NULL
- * then the result is written to |*outp| and |*outp| is advanced just past the
- * output. It returns the number of bytes in the result, whether written or
- * not, or a negative value on error. */
-OPENSSL_EXPORT int i2d_DHparams(const DH *in, unsigned char **outp);
+/* DH_marshal_parameters marshals |dh| as a DER-encoded DHParameter structure
+ * (PKCS #3) and appends the result to |cbb|. It returns one on success and zero
+ * on error. */
+OPENSSL_EXPORT int DH_marshal_parameters(CBB *cbb, const DH *dh);
 
 
 /* ex_data functions.
@@ -213,6 +206,26 @@
                                           void (*callback)(int, int, void *),
                                           void *cb_arg);
 
+/* d2i_DHparams parses an ASN.1, DER encoded Diffie-Hellman parameters structure
+ * from |len| bytes at |*inp|. If |ret| is not NULL then, on exit, a pointer to
+ * the result is in |*ret|. Note that, even if |*ret| is already non-NULL on
+ * entry, it will not be written to. Rather, a fresh |DH| is allocated and the
+ * previous one is freed.
+ *
+ * On successful exit, |*inp| is advanced past the DER structure. It
+ * returns the result or NULL on error.
+ *
+ * Use |DH_parse_parameters| instead. */
+OPENSSL_EXPORT DH *d2i_DHparams(DH **ret, const unsigned char **inp, long len);
+
+/* i2d_DHparams marshals |in| to an ASN.1, DER structure. If |outp| is not NULL
+ * then the result is written to |*outp| and |*outp| is advanced just past the
+ * output. It returns the number of bytes in the result, whether written or
+ * not, or a negative value on error.
+ *
+ * Use |DH_marshal_parameters| instead. */
+OPENSSL_EXPORT int i2d_DHparams(const DH *in, unsigned char **outp);
+
 
 struct dh_st {
   BIGNUM *p;
@@ -248,5 +261,7 @@
 #define DH_R_INVALID_PUBKEY 101
 #define DH_R_MODULUS_TOO_LARGE 102
 #define DH_R_NO_PRIVATE_VALUE 103
+#define DH_R_DECODE_ERROR 104
+#define DH_R_ENCODE_ERROR 105
 
 #endif  /* OPENSSL_HEADER_DH_H */
diff --git a/src/include/openssl/digest.h b/src/include/openssl/digest.h
index db3ead7..07ea07a 100644
--- a/src/include/openssl/digest.h
+++ b/src/include/openssl/digest.h
@@ -212,6 +212,12 @@
  * |name|, or NULL if the name is unknown. */
 OPENSSL_EXPORT const EVP_MD *EVP_get_digestbyname(const char *);
 
+/* EVP_dss1 returns the value of EVP_sha1(). This was provided by OpenSSL to
+ * specifiy the original DSA signatures, which were fixed to use SHA-1. Note,
+ * however, that attempting to sign or verify DSA signatures with the EVP
+ * interface will always fail. */
+OPENSSL_EXPORT const EVP_MD *EVP_dss1(void);
+
 
 /* Digest operation accessors. */
 
diff --git a/src/include/openssl/hkdf.h b/src/include/openssl/hkdf.h
index 8c96c4c..a484a30 100644
--- a/src/include/openssl/hkdf.h
+++ b/src/include/openssl/hkdf.h
@@ -37,6 +37,23 @@
                         const uint8_t *salt, size_t salt_len,
                         const uint8_t *info, size_t info_len);
 
+/* HKDF_extract computes a HKDF PRK (as specified by RFC 5869) from initial
+ * keying material |secret| and salt |salt| using |digest|, and outputs
+ * |out_len| bytes to |out_key|. The maximum output size is |EVP_MAX_MD_SIZE|.
+ * It returns one on success and zero on error. */
+OPENSSL_EXPORT int HKDF_extract(uint8_t *out_key, size_t *out_len,
+                                const EVP_MD *digest, const uint8_t *secret,
+                                size_t secret_len, const uint8_t *salt,
+                                size_t salt_len);
+
+/* HKDF_expand computes a HKDF OKM (as specified by RFC 5869) of length
+ * |out_len| from the PRK |prk| and info |info| using |digest|, and outputs
+ * the result to |out_key|. It returns one on success and zero on error. */
+OPENSSL_EXPORT int HKDF_expand(uint8_t *out_key, size_t out_len,
+                               const EVP_MD *digest, uint8_t *prk,
+                               size_t prk_len, const uint8_t *info,
+                               size_t info_len);
+
 
 #if defined(__cplusplus)
 }  /* extern C */
diff --git a/src/include/openssl/newhope.h b/src/include/openssl/newhope.h
index af573ba..31d559f 100644
--- a/src/include/openssl/newhope.h
+++ b/src/include/openssl/newhope.h
@@ -38,37 +38,92 @@
 /* NEWHOPE_POLY_free frees |p|. */
 OPENSSL_EXPORT void NEWHOPE_POLY_free(NEWHOPE_POLY *p);
 
-/* NEWHOPE_SERVERMSG_LENGTH is the length of the server's message to the
- * client. */
-#define NEWHOPE_SERVERMSG_LENGTH (((1024 * 14) / 8) + 32)
+/* NEWHOPE_POLY_LENGTH is the size in bytes of the packed representation of a
+ * polynomial, encoded with 14 bits per coefficient. */
+#define NEWHOPE_POLY_LENGTH ((1024 * 14) / 8)
 
-/* NEWHOPE_CLIENTMSG_LENGTH is the length of the client's message to the
- * server. */
-#define NEWHOPE_CLIENTMSG_LENGTH (((1024 * 14) / 8) + 1024 / 4)
+/* NEWHOPE_RECONCILIATION_LENGTH is the size in bytes of the packed
+ * representation of the reconciliation data, encoded as 2 bits per
+ * coefficient. */
+#define NEWHOPE_RECONCILIATION_LENGTH ((1024 * 2) / 8)
 
-/* NEWHOPE_keygen initializes |out_msg| and |out_sk| for a new key
- * exchange. |msg| must have room for |NEWHOPE_SERVERMSG_LENGTH| bytes. Neither
+/* NEWHOPE_OFFERMSG_LENGTH is the length of the offering party's message to the
+ * accepting party. */
+#define NEWHOPE_OFFERMSG_LENGTH (NEWHOPE_POLY_LENGTH + 32)
+
+/* NEWHOPE_ACCEPTMSG_LENGTH is the length of the accepting party's message to
+ * the offering party. */
+#define NEWHOPE_ACCEPTMSG_LENGTH \
+  (NEWHOPE_POLY_LENGTH + NEWHOPE_RECONCILIATION_LENGTH)
+
+/* NEWHOPE_KEY_LENGTH is the size of the result of the key agreement. This
+ * result is not exposed to callers: instead, it is whitened with SHA-256, whose
+ * output happens to be the same size. */
+#define NEWHOPE_KEY_LENGTH 32
+
+/* NEWHOPE_offer initializes |out_msg| and |out_sk| for a new key
+ * exchange. |msg| must have room for |NEWHOPE_OFFERMSG_LENGTH| bytes. Neither
  * output may be cached. */
-OPENSSL_EXPORT void NEWHOPE_keygen(uint8_t out_msg[NEWHOPE_SERVERMSG_LENGTH],
-                                   NEWHOPE_POLY *out_sk);
+OPENSSL_EXPORT void NEWHOPE_offer(uint8_t out_msg[NEWHOPE_OFFERMSG_LENGTH],
+                                  NEWHOPE_POLY *out_sk);
 
-/* NEWHOPE_server_compute_key completes a key exchange given a client message
- * |msg| and the previously generated server secret |sk|. The result of the
- * key exchange is written to |out_key|, which must have space for
+/* NEWHOPE_accept completes a key exchange given an offer message |msg|. The
+ * result of the key exchange is written to |out_key|, which must have space for
+ * |SHA256_DIGEST_LENGTH| bytes. The message to be send to the offering party is
+ * written to |out_msg|, which must have room for |NEWHOPE_ACCEPTMSG_LENGTH|
+ * bytes. Returns 1 on success and 0 on error. */
+OPENSSL_EXPORT int NEWHOPE_accept(uint8_t out_key[SHA256_DIGEST_LENGTH],
+                                  uint8_t out_msg[NEWHOPE_ACCEPTMSG_LENGTH],
+                                  const uint8_t msg[NEWHOPE_OFFERMSG_LENGTH],
+                                  size_t msg_len);
+
+/* NEWHOPE_finish completes a key exchange for the offering party, given an
+ * accept message |msg| and the previously generated secret |sk|. The result of
+ * the key exchange is written to |out_key|, which must have space for
  * |SHA256_DIGEST_LENGTH| bytes. Returns 1 on success and 0 on error. */
-OPENSSL_EXPORT int NEWHOPE_server_compute_key(
-    uint8_t out_key[SHA256_DIGEST_LENGTH], const NEWHOPE_POLY *sk,
-    const uint8_t msg[NEWHOPE_CLIENTMSG_LENGTH], size_t msg_len);
+OPENSSL_EXPORT int NEWHOPE_finish(uint8_t out_key[SHA256_DIGEST_LENGTH],
+                                  const NEWHOPE_POLY *sk,
+                                  const uint8_t msg[NEWHOPE_ACCEPTMSG_LENGTH],
+                                  size_t msg_len);
 
-/* NEWHOPE_client_compute_key completes a key exchange given a server message
- * |msg|. The result of the key exchange is written to |out_key|, which must
- * have space for |SHA256_DIGEST_LENGTH| bytes. The message to be send to the
- * client is written to |out_msg|, which must have room for
- * |NEWHOPE_CLIENTMSG_LENGTH| bytes. Returns 1 on success and 0 on error. */
-OPENSSL_EXPORT int NEWHOPE_client_compute_key(
-    uint8_t out_key[SHA256_DIGEST_LENGTH],
-    uint8_t out_msg[NEWHOPE_CLIENTMSG_LENGTH],
-    const uint8_t msg[NEWHOPE_SERVERMSG_LENGTH], size_t msg_len);
+
+/* Lower-level functions. */
+
+/* NEWHOPE_offer_computation is the work of |NEWHOPE_offer|, less the encoding
+ * parts.  The inputs are the noise polynomials |s| and |e|, and random
+ * polynomial |a|. The output is the polynomial |pk|. */
+OPENSSL_EXPORT void NEWHOPE_offer_computation(
+    NEWHOPE_POLY *out_pk,
+    const NEWHOPE_POLY *s, const NEWHOPE_POLY *e, const NEWHOPE_POLY *a);
+
+/* NEWHOPE_accept_computation is the work of |NEWHOPE_accept|, less the encoding
+ * parts. The inputs from the peer are |pk| and |a|. The locally-generated
+ * inputs are the noise polynomials |sp|, |ep|, and |epp|, and the random bytes
+ * |rand|. The outputs are |out_bp| and |out_reconciliation|, and the result of
+ * key agreement |key|. Returns 1 on success and 0 on failure. */
+OPENSSL_EXPORT void NEWHOPE_accept_computation(
+    uint8_t out_key[NEWHOPE_KEY_LENGTH], NEWHOPE_POLY *out_bp,
+    NEWHOPE_POLY *out_reconciliation,
+    const NEWHOPE_POLY *sp, const NEWHOPE_POLY *ep, const NEWHOPE_POLY *epp,
+    const uint8_t rand[32],
+    const NEWHOPE_POLY *pk, const NEWHOPE_POLY *a);
+
+/* NEWHOPE_finish_computation is the work of |NEWHOPE_finish|, less the encoding
+ * parts. Given the peer's |bp| and |reconciliation|, and locally-generated
+ * noise |noise|, the result of the key agreement is written to out_key.
+ * Returns 1 on success and 0 on failure. */
+OPENSSL_EXPORT void NEWHOPE_finish_computation(
+    uint8_t out_key[NEWHOPE_KEY_LENGTH], const NEWHOPE_POLY *noise,
+    const NEWHOPE_POLY *bp, const NEWHOPE_POLY *reconciliation);
+
+/* NEWHOPE_POLY_frombytes decodes |a| into |r|. */
+OPENSSL_EXPORT void NEWHOPE_POLY_frombytes(
+    NEWHOPE_POLY *r, const uint8_t a[NEWHOPE_POLY_LENGTH]);
+
+/* NEWHOPE_POLY_tobytes packs the polynomial |p| into the compact representation
+ * |r|. */
+OPENSSL_EXPORT void NEWHOPE_POLY_tobytes(uint8_t r[NEWHOPE_POLY_LENGTH],
+                                         const NEWHOPE_POLY* p);
 
 
 #if defined(__cplusplus)
diff --git a/src/include/openssl/nid.h b/src/include/openssl/nid.h
index d51a67c..5ed44ee 100644
--- a/src/include/openssl/nid.h
+++ b/src/include/openssl/nid.h
@@ -4159,5 +4159,8 @@
 #define SN_X25519 "X25519"
 #define NID_X25519 948
 
+#define SN_cecpq1 "cecpq1"
+#define NID_cecpq1 949
+
 
 #endif  /* OPENSSL_HEADER_NID_H */
diff --git a/src/include/openssl/pem.h b/src/include/openssl/pem.h
index b899d9f..58aecaf 100644
--- a/src/include/openssl/pem.h
+++ b/src/include/openssl/pem.h
@@ -65,6 +65,10 @@
 #include <openssl/stack.h>
 #include <openssl/x509.h>
 
+/* For compatibility with open-iscsi, which assumes that it can get
+ * |OPENSSL_malloc| from pem.h or err.h */
+#include <openssl/crypto.h>
+
 #ifdef  __cplusplus
 extern "C" {
 #endif
diff --git a/src/include/openssl/ssl.h b/src/include/openssl/ssl.h
index 1d0b486..3770c6e 100644
--- a/src/include/openssl/ssl.h
+++ b/src/include/openssl/ssl.h
@@ -487,6 +487,16 @@
  * and zero on failure. */
 OPENSSL_EXPORT int SSL_set_mtu(SSL *ssl, unsigned mtu);
 
+/* DTLSv1_set_initial_timeout_duration sets the initial duration for a DTLS
+ * handshake timeout.
+ *
+ * This duration overrides the default of 1 second, which is the strong
+ * recommendation of RFC 6347 (see section 4.2.4.1). However, there may exist
+ * situations where a shorter timeout would be beneficial, such as for
+ * time-sensitive applications. */
+OPENSSL_EXPORT void DTLSv1_set_initial_timeout_duration(SSL *ssl,
+                                                        unsigned duration_ms);
+
 /* DTLSv1_get_timeout queries the next DTLS handshake timeout. If there is a
  * timeout in progress, it sets |*out| to the time remaining and returns one.
  * Otherwise, it returns zero.
@@ -527,6 +537,7 @@
 #define TLS1_VERSION 0x0301
 #define TLS1_1_VERSION 0x0302
 #define TLS1_2_VERSION 0x0303
+#define TLS1_3_VERSION 0x0304
 
 #define DTLS1_VERSION 0xfeff
 #define DTLS1_2_VERSION 0xfefd
@@ -1087,6 +1098,9 @@
 /* SSL_CIPHER_is_ECDHE returns one if |cipher| uses ECDHE. */
 OPENSSL_EXPORT int SSL_CIPHER_is_ECDHE(const SSL_CIPHER *cipher);
 
+/* SSL_CIPHER_is_CECPQ1 returns one if |cipher| uses CECPQ1. */
+OPENSSL_EXPORT int SSL_CIPHER_is_CECPQ1(const SSL_CIPHER *cipher);
+
 /* SSL_CIPHER_get_min_version returns the minimum protocol version required
  * for |cipher|. */
 OPENSSL_EXPORT uint16_t SSL_CIPHER_get_min_version(const SSL_CIPHER *cipher);
@@ -1829,9 +1843,9 @@
 OPENSSL_EXPORT int SSL_set1_curves(SSL *ssl, const int *curves,
                                    size_t curves_len);
 
-/* SSL_get_curve_name returns a human-readable name for the elliptic curve
- * specified by the given TLS curve id, or NULL if the curve if unknown. */
-OPENSSL_EXPORT const char *SSL_get_curve_name(uint16_t curve_id);
+/* SSL_get_curve_name returns a human-readable name for the group specified by
+ * the given TLS group id, or NULL if the group is unknown. */
+OPENSSL_EXPORT const char *SSL_get_curve_name(uint16_t group_id);
 
 
 /* Multiplicative Diffie-Hellman.
@@ -3220,6 +3234,7 @@
 #define SSL_OP_NO_TLSv1 0x04000000L
 #define SSL_OP_NO_TLSv1_2 0x08000000L
 #define SSL_OP_NO_TLSv1_1 0x10000000L
+#define SSL_OP_NO_TLSv1_3 0x20000000L
 #define SSL_OP_NO_DTLSv1 SSL_OP_NO_TLSv1
 #define SSL_OP_NO_DTLSv1_2 SSL_OP_NO_TLSv1_2
 
@@ -3346,6 +3361,7 @@
 #define SSL_TXT_kDHE "kDHE"
 #define SSL_TXT_kEDH "kEDH"
 #define SSL_TXT_kECDHE "kECDHE"
+#define SSL_TXT_kCECPQ1 "kCECPQ1"
 #define SSL_TXT_kEECDH "kEECDH"
 #define SSL_TXT_kPSK "kPSK"
 #define SSL_TXT_aRSA "aRSA"
@@ -3376,6 +3392,7 @@
 #define SSL_TXT_TLSV1 "TLSv1"
 #define SSL_TXT_TLSV1_1 "TLSv1.1"
 #define SSL_TXT_TLSV1_2 "TLSv1.2"
+#define SSL_TXT_TLSV1_3 "TLSv1.3"
 #define SSL_TXT_ALL "ALL"
 #define SSL_TXT_CMPDEF "COMPLEMENTOFDEFAULT"
 
@@ -3785,9 +3802,9 @@
   /* SRTP profiles we are willing to do from RFC 5764 */
   STACK_OF(SRTP_PROTECTION_PROFILE) *srtp_profiles;
 
-  /* EC extension values inherited by SSL structure */
-  size_t tlsext_ellipticcurvelist_length;
-  uint16_t *tlsext_ellipticcurvelist;
+  /* Supported group values inherited by SSL structure */
+  size_t supported_group_list_len;
+  uint16_t *supported_group_list;
 
   /* The client's Channel ID private key. */
   EVP_PKEY *tlsext_channel_id_private;
@@ -3853,7 +3870,9 @@
   BIO *wbio; /* used by SSL_write */
 
   /* bbio, if non-NULL, is a buffer placed in front of |wbio| to pack handshake
-   * messages within one flight into a single |BIO_write|.
+   * messages within one flight into a single |BIO_write|. In this case, |wbio|
+   * and |bbio| are equal and the true caller-configured BIO is
+   * |bbio->next_bio|.
    *
    * TODO(davidben): This does not work right for DTLS. It assumes the MTU is
    * smaller than the buffer size so that the buffer's internal flushing never
@@ -3869,8 +3888,6 @@
    * handshake_func is == 0 until then, we use this test instead of an "init"
    * member. */
 
-  int shutdown; /* we have shut things down, 0x01 sent, 0x02
-                 * for received */
   int state;    /* where we are */
 
   BUF_MEM *init_buf; /* buffer used during init */
@@ -3882,6 +3899,10 @@
   struct ssl3_state_st *s3;  /* SSLv3 variables */
   struct dtls1_state_st *d1; /* DTLSv1 variables */
 
+  /* initial_timeout_duration_ms is the default DTLS timeout duration in
+   * milliseconds. It's used to initialize the timer any time it's restarted. */
+  unsigned initial_timeout_duration_ms;
+
   /* callback that allows applications to peek at protocol messages */
   void (*msg_callback)(int write_p, int version, int content_type,
                        const void *buf, size_t len, SSL *ssl, void *arg);
@@ -3946,8 +3967,8 @@
   char *tlsext_hostname;
   /* RFC4507 session ticket expected to be received or sent */
   int tlsext_ticket_expected;
-  size_t tlsext_ellipticcurvelist_length;
-  uint16_t *tlsext_ellipticcurvelist; /* our list */
+  size_t supported_group_list_len;
+  uint16_t *supported_group_list; /* our list */
 
   SSL_CTX *initial_ctx; /* initial ctx, used to store sessions */
 
@@ -4027,6 +4048,14 @@
   uint16_t cap;
 } SSL3_BUFFER;
 
+/* An ssl_shutdown_t describes the shutdown state of one end of the connection,
+ * whether it is alive or has been shutdown via close_notify or fatal alert. */
+enum ssl_shutdown_t {
+  ssl_shutdown_none = 0,
+  ssl_shutdown_close_notify = 1,
+  ssl_shutdown_fatal_alert = 2,
+};
+
 typedef struct ssl3_state_st {
   uint8_t read_sequence[8];
   uint8_t write_sequence[8];
@@ -4069,12 +4098,13 @@
    * the handshake hash for TLS 1.1 and below. */
   EVP_MD_CTX handshake_md5;
 
-  /* clean_shutdown is one if the connection was cleanly shutdown with a
-   * close_notify and zero otherwise. */
-  char clean_shutdown;
+  /* recv_shutdown is the shutdown state for the receive half of the
+   * connection. */
+  enum ssl_shutdown_t recv_shutdown;
 
-  /* we allow one fatal and one warning alert to be outstanding, send close
-   * alert via the warning alert */
+  /* recv_shutdown is the shutdown state for the send half of the connection. */
+  enum ssl_shutdown_t send_shutdown;
+
   int alert_dispatch;
   uint8_t send_alert[2];
 
@@ -4108,9 +4138,12 @@
     uint8_t peer_finish_md[EVP_MAX_MD_SIZE];
     int peer_finish_md_len;
 
-    unsigned long message_size;
     int message_type;
 
+    /* message_complete is one if the current message is complete and zero
+     * otherwise. */
+    unsigned message_complete:1;
+
     /* used to hold the new cipher we are going to use */
     const SSL_CIPHER *new_cipher;
 
@@ -4181,11 +4214,11 @@
     /* ocsp_stapling_requested is true if a client requested OCSP stapling. */
     unsigned ocsp_stapling_requested:1;
 
-    /* Server-only: peer_ellipticcurvelist contains the EC curve IDs advertised
-     * by the peer. This is only set on the server's end. The server does not
-     * advertise this extension to the client. */
-    uint16_t *peer_ellipticcurvelist;
-    size_t peer_ellipticcurvelist_length;
+    /* Server-only: peer_supported_group_list contains the supported group IDs
+     * advertised by the peer. This is only set on the server's end. The server
+     * does not advertise this extension to the client. */
+    uint16_t *peer_supported_group_list;
+    size_t peer_supported_group_list_len;
 
     /* extended_master_secret indicates whether the extended master secret
      * computation is used in this handshake. Note that this is different from
diff --git a/src/include/openssl/ssl3.h b/src/include/openssl/ssl3.h
index 957b740..64e1d31 100644
--- a/src/include/openssl/ssl3.h
+++ b/src/include/openssl/ssl3.h
@@ -312,17 +312,12 @@
 #define SSL3_ST_CW_CLNT_HELLO_B (0x111 | SSL_ST_CONNECT)
 /* read from server */
 #define SSL3_ST_CR_SRVR_HELLO_A (0x120 | SSL_ST_CONNECT)
-#define SSL3_ST_CR_SRVR_HELLO_B (0x121 | SSL_ST_CONNECT)
 #define DTLS1_ST_CR_HELLO_VERIFY_REQUEST_A (0x126 | SSL_ST_CONNECT)
-#define DTLS1_ST_CR_HELLO_VERIFY_REQUEST_B (0x127 | SSL_ST_CONNECT)
 #define SSL3_ST_CR_CERT_A (0x130 | SSL_ST_CONNECT)
-#define SSL3_ST_CR_CERT_B (0x131 | SSL_ST_CONNECT)
 #define SSL3_ST_CR_KEY_EXCH_A (0x140 | SSL_ST_CONNECT)
 #define SSL3_ST_CR_KEY_EXCH_B (0x141 | SSL_ST_CONNECT)
 #define SSL3_ST_CR_CERT_REQ_A (0x150 | SSL_ST_CONNECT)
-#define SSL3_ST_CR_CERT_REQ_B (0x151 | SSL_ST_CONNECT)
 #define SSL3_ST_CR_SRVR_DONE_A (0x160 | SSL_ST_CONNECT)
-#define SSL3_ST_CR_SRVR_DONE_B (0x161 | SSL_ST_CONNECT)
 /* write to server */
 #define SSL3_ST_CW_CERT_A (0x170 | SSL_ST_CONNECT)
 #define SSL3_ST_CW_CERT_B (0x171 | SSL_ST_CONNECT)
@@ -344,11 +339,12 @@
 /* read from server */
 #define SSL3_ST_CR_CHANGE (0x1C0 | SSL_ST_CONNECT)
 #define SSL3_ST_CR_FINISHED_A (0x1D0 | SSL_ST_CONNECT)
-#define SSL3_ST_CR_FINISHED_B (0x1D1 | SSL_ST_CONNECT)
 #define SSL3_ST_CR_SESSION_TICKET_A (0x1E0 | SSL_ST_CONNECT)
-#define SSL3_ST_CR_SESSION_TICKET_B (0x1E1 | SSL_ST_CONNECT)
 #define SSL3_ST_CR_CERT_STATUS_A (0x1F0 | SSL_ST_CONNECT)
-#define SSL3_ST_CR_CERT_STATUS_B (0x1F1 | SSL_ST_CONNECT)
+
+/* SSL3_ST_CR_SRVR_HELLO_B is a legacy alias for |SSL3_ST_CR_SRVR_HELLO_A| used
+ * by some consumers which check |SSL_state|. */
+#define SSL3_ST_CR_SRVR_HELLO_B SSL3_ST_CR_SRVR_HELLO_A
 
 /* server */
 /* extra state */
@@ -359,7 +355,6 @@
 #define SSL3_ST_SR_CLNT_HELLO_A (0x110 | SSL_ST_ACCEPT)
 #define SSL3_ST_SR_CLNT_HELLO_B (0x111 | SSL_ST_ACCEPT)
 #define SSL3_ST_SR_CLNT_HELLO_C (0x112 | SSL_ST_ACCEPT)
-#define SSL3_ST_SR_CLNT_HELLO_D (0x115 | SSL_ST_ACCEPT)
 /* write to client */
 #define SSL3_ST_SW_HELLO_REQ_A (0x120 | SSL_ST_ACCEPT)
 #define SSL3_ST_SW_HELLO_REQ_B (0x121 | SSL_ST_ACCEPT)
@@ -377,19 +372,13 @@
 #define SSL3_ST_SW_SRVR_DONE_B (0x171 | SSL_ST_ACCEPT)
 /* read from client */
 #define SSL3_ST_SR_CERT_A (0x180 | SSL_ST_ACCEPT)
-#define SSL3_ST_SR_CERT_B (0x181 | SSL_ST_ACCEPT)
 #define SSL3_ST_SR_KEY_EXCH_A (0x190 | SSL_ST_ACCEPT)
 #define SSL3_ST_SR_KEY_EXCH_B (0x191 | SSL_ST_ACCEPT)
-#define SSL3_ST_SR_KEY_EXCH_C (0x192 | SSL_ST_ACCEPT)
 #define SSL3_ST_SR_CERT_VRFY_A (0x1A0 | SSL_ST_ACCEPT)
-#define SSL3_ST_SR_CERT_VRFY_B (0x1A1 | SSL_ST_ACCEPT)
 #define SSL3_ST_SR_CHANGE (0x1B0 | SSL_ST_ACCEPT)
 #define SSL3_ST_SR_NEXT_PROTO_A (0x210 | SSL_ST_ACCEPT)
-#define SSL3_ST_SR_NEXT_PROTO_B (0x211 | SSL_ST_ACCEPT)
 #define SSL3_ST_SR_CHANNEL_ID_A (0x230 | SSL_ST_ACCEPT)
-#define SSL3_ST_SR_CHANNEL_ID_B (0x231 | SSL_ST_ACCEPT)
 #define SSL3_ST_SR_FINISHED_A (0x1C0 | SSL_ST_ACCEPT)
-#define SSL3_ST_SR_FINISHED_B (0x1C1 | SSL_ST_ACCEPT)
 
 /* write to client */
 #define SSL3_ST_SW_CHANGE_A (0x1D0 | SSL_ST_ACCEPT)
@@ -406,7 +395,7 @@
 #define SSL3_MT_HELLO_REQUEST 0
 #define SSL3_MT_CLIENT_HELLO 1
 #define SSL3_MT_SERVER_HELLO 2
-#define SSL3_MT_NEWSESSION_TICKET 4
+#define SSL3_MT_NEW_SESSION_TICKET 4
 #define SSL3_MT_CERTIFICATE 11
 #define SSL3_MT_SERVER_KEY_EXCHANGE 12
 #define SSL3_MT_CERTIFICATE_REQUEST 13
@@ -417,9 +406,13 @@
 #define SSL3_MT_CERTIFICATE_STATUS 22
 #define SSL3_MT_SUPPLEMENTAL_DATA 23
 #define SSL3_MT_NEXT_PROTO 67
-#define SSL3_MT_ENCRYPTED_EXTENSIONS 203
+#define SSL3_MT_CHANNEL_ID_ENCRYPTED_EXTENSIONS 203
 #define DTLS1_MT_HELLO_VERIFY_REQUEST 3
 
+/* SSL3_MT_NEWSESSION_TICKET is a legacy alias for |SSL3_MT_NEW_SESSION_TICKET|
+ * for consumers which use |SSL_CTX_set_msg_callback|. */
+#define SSL3_MT_NEWSESSION_TICKET SSL3_MT_NEW_SESSION_TICKET
+
 
 #define SSL3_MT_CCS 1
 
diff --git a/src/include/openssl/stack_macros.h b/src/include/openssl/stack_macros.h
index 809424c..2a60b8f 100644
--- a/src/include/openssl/stack_macros.h
+++ b/src/include/openssl/stack_macros.h
@@ -27,14 +27,15 @@
   ((STACK_OF(ACCESS_DESCRIPTION) *)sk_new_null())
 
 #define sk_ACCESS_DESCRIPTION_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(ACCESS_DESCRIPTION) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(ACCESS_DESCRIPTION) *, sk))
 
 #define sk_ACCESS_DESCRIPTION_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(ACCESS_DESCRIPTION) *, sk));
 
-#define sk_ACCESS_DESCRIPTION_value(sk, i) \
-  ((ACCESS_DESCRIPTION *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(ACCESS_DESCRIPTION) *, sk), (i)))
+#define sk_ACCESS_DESCRIPTION_value(sk, i)                                    \
+  ((ACCESS_DESCRIPTION *)sk_value(                                            \
+      CHECKED_CAST(const _STACK *, const STACK_OF(ACCESS_DESCRIPTION) *, sk), \
+      (i)))
 
 #define sk_ACCESS_DESCRIPTION_set(sk, i, p)                            \
   ((ACCESS_DESCRIPTION *)sk_set(                                       \
@@ -80,13 +81,14 @@
 
 #define sk_ACCESS_DESCRIPTION_dup(sk)      \
   ((STACK_OF(ACCESS_DESCRIPTION) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(ACCESS_DESCRIPTION) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(ACCESS_DESCRIPTION) *, sk)))
 
 #define sk_ACCESS_DESCRIPTION_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(ACCESS_DESCRIPTION) *, sk))
 
 #define sk_ACCESS_DESCRIPTION_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(ACCESS_DESCRIPTION) *, sk))
+  sk_is_sorted(                             \
+      CHECKED_CAST(const _STACK *, const STACK_OF(ACCESS_DESCRIPTION) *, sk))
 
 #define sk_ACCESS_DESCRIPTION_set_cmp_func(sk, comp)                           \
   ((int (*)(const ACCESS_DESCRIPTION **a, const ACCESS_DESCRIPTION **b))       \
@@ -113,14 +115,15 @@
 #define sk_ASN1_ADB_TABLE_new_null() ((STACK_OF(ASN1_ADB_TABLE) *)sk_new_null())
 
 #define sk_ASN1_ADB_TABLE_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(ASN1_ADB_TABLE) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(ASN1_ADB_TABLE) *, sk))
 
 #define sk_ASN1_ADB_TABLE_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(ASN1_ADB_TABLE) *, sk));
 
-#define sk_ASN1_ADB_TABLE_value(sk, i) \
-  ((ASN1_ADB_TABLE *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(ASN1_ADB_TABLE) *, sk), (i)))
+#define sk_ASN1_ADB_TABLE_value(sk, i)                                    \
+  ((ASN1_ADB_TABLE *)sk_value(                                            \
+      CHECKED_CAST(const _STACK *, const STACK_OF(ASN1_ADB_TABLE) *, sk), \
+      (i)))
 
 #define sk_ASN1_ADB_TABLE_set(sk, i, p)                            \
   ((ASN1_ADB_TABLE *)sk_set(                                       \
@@ -166,13 +169,14 @@
 
 #define sk_ASN1_ADB_TABLE_dup(sk)      \
   ((STACK_OF(ASN1_ADB_TABLE) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(ASN1_ADB_TABLE) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(ASN1_ADB_TABLE) *, sk)))
 
 #define sk_ASN1_ADB_TABLE_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(ASN1_ADB_TABLE) *, sk))
 
 #define sk_ASN1_ADB_TABLE_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(ASN1_ADB_TABLE) *, sk))
+  sk_is_sorted(                         \
+      CHECKED_CAST(const _STACK *, const STACK_OF(ASN1_ADB_TABLE) *, sk))
 
 #define sk_ASN1_ADB_TABLE_set_cmp_func(sk, comp)                           \
   ((int (*)(const ASN1_ADB_TABLE **a, const ASN1_ADB_TABLE **b))           \
@@ -200,14 +204,15 @@
   ((STACK_OF(ASN1_GENERALSTRING) *)sk_new_null())
 
 #define sk_ASN1_GENERALSTRING_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(ASN1_GENERALSTRING) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(ASN1_GENERALSTRING) *, sk))
 
 #define sk_ASN1_GENERALSTRING_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(ASN1_GENERALSTRING) *, sk));
 
-#define sk_ASN1_GENERALSTRING_value(sk, i) \
-  ((ASN1_GENERALSTRING *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(ASN1_GENERALSTRING) *, sk), (i)))
+#define sk_ASN1_GENERALSTRING_value(sk, i)                                    \
+  ((ASN1_GENERALSTRING *)sk_value(                                            \
+      CHECKED_CAST(const _STACK *, const STACK_OF(ASN1_GENERALSTRING) *, sk), \
+      (i)))
 
 #define sk_ASN1_GENERALSTRING_set(sk, i, p)                            \
   ((ASN1_GENERALSTRING *)sk_set(                                       \
@@ -253,13 +258,14 @@
 
 #define sk_ASN1_GENERALSTRING_dup(sk)      \
   ((STACK_OF(ASN1_GENERALSTRING) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(ASN1_GENERALSTRING) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(ASN1_GENERALSTRING) *, sk)))
 
 #define sk_ASN1_GENERALSTRING_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(ASN1_GENERALSTRING) *, sk))
 
 #define sk_ASN1_GENERALSTRING_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(ASN1_GENERALSTRING) *, sk))
+  sk_is_sorted(                             \
+      CHECKED_CAST(const _STACK *, const STACK_OF(ASN1_GENERALSTRING) *, sk))
 
 #define sk_ASN1_GENERALSTRING_set_cmp_func(sk, comp)                           \
   ((int (*)(const ASN1_GENERALSTRING **a, const ASN1_GENERALSTRING **b))       \
@@ -286,14 +292,14 @@
 #define sk_ASN1_INTEGER_new_null() ((STACK_OF(ASN1_INTEGER) *)sk_new_null())
 
 #define sk_ASN1_INTEGER_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(ASN1_INTEGER) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(ASN1_INTEGER) *, sk))
 
 #define sk_ASN1_INTEGER_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(ASN1_INTEGER) *, sk));
 
 #define sk_ASN1_INTEGER_value(sk, i) \
   ((ASN1_INTEGER *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(ASN1_INTEGER) *, sk), (i)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(ASN1_INTEGER) *, sk), (i)))
 
 #define sk_ASN1_INTEGER_set(sk, i, p)                            \
   ((ASN1_INTEGER *)sk_set(                                       \
@@ -338,13 +344,13 @@
 
 #define sk_ASN1_INTEGER_dup(sk)      \
   ((STACK_OF(ASN1_INTEGER) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(ASN1_INTEGER) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(ASN1_INTEGER) *, sk)))
 
 #define sk_ASN1_INTEGER_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(ASN1_INTEGER) *, sk))
 
 #define sk_ASN1_INTEGER_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(ASN1_INTEGER) *, sk))
+  sk_is_sorted(CHECKED_CAST(const _STACK *, const STACK_OF(ASN1_INTEGER) *, sk))
 
 #define sk_ASN1_INTEGER_set_cmp_func(sk, comp)                               \
   ((int (*)(const ASN1_INTEGER **a, const ASN1_INTEGER **b))sk_set_cmp_func( \
@@ -369,14 +375,14 @@
 #define sk_ASN1_OBJECT_new_null() ((STACK_OF(ASN1_OBJECT) *)sk_new_null())
 
 #define sk_ASN1_OBJECT_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(ASN1_OBJECT) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(ASN1_OBJECT) *, sk))
 
 #define sk_ASN1_OBJECT_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(ASN1_OBJECT) *, sk));
 
 #define sk_ASN1_OBJECT_value(sk, i) \
   ((ASN1_OBJECT *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(ASN1_OBJECT) *, sk), (i)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(ASN1_OBJECT) *, sk), (i)))
 
 #define sk_ASN1_OBJECT_set(sk, i, p)                                          \
   ((ASN1_OBJECT *)sk_set(CHECKED_CAST(_STACK *, STACK_OF(ASN1_OBJECT) *, sk), \
@@ -419,13 +425,13 @@
 
 #define sk_ASN1_OBJECT_dup(sk)      \
   ((STACK_OF(ASN1_OBJECT) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(ASN1_OBJECT) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(ASN1_OBJECT) *, sk)))
 
 #define sk_ASN1_OBJECT_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(ASN1_OBJECT) *, sk))
 
 #define sk_ASN1_OBJECT_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(ASN1_OBJECT) *, sk))
+  sk_is_sorted(CHECKED_CAST(const _STACK *, const STACK_OF(ASN1_OBJECT) *, sk))
 
 #define sk_ASN1_OBJECT_set_cmp_func(sk, comp)                              \
   ((int (*)(const ASN1_OBJECT **a, const ASN1_OBJECT **b))sk_set_cmp_func( \
@@ -452,14 +458,15 @@
   ((STACK_OF(ASN1_STRING_TABLE) *)sk_new_null())
 
 #define sk_ASN1_STRING_TABLE_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(ASN1_STRING_TABLE) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(ASN1_STRING_TABLE) *, sk))
 
 #define sk_ASN1_STRING_TABLE_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(ASN1_STRING_TABLE) *, sk));
 
-#define sk_ASN1_STRING_TABLE_value(sk, i) \
-  ((ASN1_STRING_TABLE *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(ASN1_STRING_TABLE) *, sk), (i)))
+#define sk_ASN1_STRING_TABLE_value(sk, i)                                    \
+  ((ASN1_STRING_TABLE *)sk_value(                                            \
+      CHECKED_CAST(const _STACK *, const STACK_OF(ASN1_STRING_TABLE) *, sk), \
+      (i)))
 
 #define sk_ASN1_STRING_TABLE_set(sk, i, p)                            \
   ((ASN1_STRING_TABLE *)sk_set(                                       \
@@ -505,13 +512,14 @@
 
 #define sk_ASN1_STRING_TABLE_dup(sk)      \
   ((STACK_OF(ASN1_STRING_TABLE) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(ASN1_STRING_TABLE) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(ASN1_STRING_TABLE) *, sk)))
 
 #define sk_ASN1_STRING_TABLE_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(ASN1_STRING_TABLE) *, sk))
 
 #define sk_ASN1_STRING_TABLE_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(ASN1_STRING_TABLE) *, sk))
+  sk_is_sorted(                            \
+      CHECKED_CAST(const _STACK *, const STACK_OF(ASN1_STRING_TABLE) *, sk))
 
 #define sk_ASN1_STRING_TABLE_set_cmp_func(sk, comp)                           \
   ((int (*)(const ASN1_STRING_TABLE **a, const ASN1_STRING_TABLE **b))        \
@@ -538,14 +546,14 @@
 #define sk_ASN1_TYPE_new_null() ((STACK_OF(ASN1_TYPE) *)sk_new_null())
 
 #define sk_ASN1_TYPE_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(ASN1_TYPE) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(ASN1_TYPE) *, sk))
 
 #define sk_ASN1_TYPE_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(ASN1_TYPE) *, sk));
 
 #define sk_ASN1_TYPE_value(sk, i) \
   ((ASN1_TYPE *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(ASN1_TYPE) *, sk), (i)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(ASN1_TYPE) *, sk), (i)))
 
 #define sk_ASN1_TYPE_set(sk, i, p)                                             \
   ((ASN1_TYPE *)sk_set(CHECKED_CAST(_STACK *, STACK_OF(ASN1_TYPE) *, sk), (i), \
@@ -588,13 +596,13 @@
 
 #define sk_ASN1_TYPE_dup(sk)      \
   ((STACK_OF(ASN1_TYPE) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(ASN1_TYPE) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(ASN1_TYPE) *, sk)))
 
 #define sk_ASN1_TYPE_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(ASN1_TYPE) *, sk))
 
 #define sk_ASN1_TYPE_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(ASN1_TYPE) *, sk))
+  sk_is_sorted(CHECKED_CAST(const _STACK *, const STACK_OF(ASN1_TYPE) *, sk))
 
 #define sk_ASN1_TYPE_set_cmp_func(sk, comp)                            \
   ((int (*)(const ASN1_TYPE **a, const ASN1_TYPE **b))sk_set_cmp_func( \
@@ -617,14 +625,14 @@
 #define sk_ASN1_VALUE_new_null() ((STACK_OF(ASN1_VALUE) *)sk_new_null())
 
 #define sk_ASN1_VALUE_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(ASN1_VALUE) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(ASN1_VALUE) *, sk))
 
 #define sk_ASN1_VALUE_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(ASN1_VALUE) *, sk));
 
 #define sk_ASN1_VALUE_value(sk, i) \
   ((ASN1_VALUE *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(ASN1_VALUE) *, sk), (i)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(ASN1_VALUE) *, sk), (i)))
 
 #define sk_ASN1_VALUE_set(sk, i, p)                                         \
   ((ASN1_VALUE *)sk_set(CHECKED_CAST(_STACK *, STACK_OF(ASN1_VALUE) *, sk), \
@@ -667,13 +675,13 @@
 
 #define sk_ASN1_VALUE_dup(sk)      \
   ((STACK_OF(ASN1_VALUE) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(ASN1_VALUE) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(ASN1_VALUE) *, sk)))
 
 #define sk_ASN1_VALUE_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(ASN1_VALUE) *, sk))
 
 #define sk_ASN1_VALUE_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(ASN1_VALUE) *, sk))
+  sk_is_sorted(CHECKED_CAST(const _STACK *, const STACK_OF(ASN1_VALUE) *, sk))
 
 #define sk_ASN1_VALUE_set_cmp_func(sk, comp)                             \
   ((int (*)(const ASN1_VALUE **a, const ASN1_VALUE **b))sk_set_cmp_func( \
@@ -696,12 +704,14 @@
 
 #define sk_BIO_new_null() ((STACK_OF(BIO) *)sk_new_null())
 
-#define sk_BIO_num(sk) sk_num(CHECKED_CAST(_STACK *, STACK_OF(BIO) *, sk))
+#define sk_BIO_num(sk) \
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(BIO) *, sk))
 
 #define sk_BIO_zero(sk) sk_zero(CHECKED_CAST(_STACK *, STACK_OF(BIO) *, sk));
 
-#define sk_BIO_value(sk, i) \
-  ((BIO *)sk_value(CHECKED_CAST(_STACK *, const STACK_OF(BIO) *, sk), (i)))
+#define sk_BIO_value(sk, i)                                                 \
+  ((BIO *)sk_value(CHECKED_CAST(const _STACK *, const STACK_OF(BIO) *, sk), \
+                   (i)))
 
 #define sk_BIO_set(sk, i, p)                                       \
   ((BIO *)sk_set(CHECKED_CAST(_STACK *, STACK_OF(BIO) *, sk), (i), \
@@ -738,13 +748,14 @@
 #define sk_BIO_pop(sk) \
   ((BIO *)sk_pop(CHECKED_CAST(_STACK *, STACK_OF(BIO) *, sk)))
 
-#define sk_BIO_dup(sk) \
-  ((STACK_OF(BIO) *)sk_dup(CHECKED_CAST(_STACK *, const STACK_OF(BIO) *, sk)))
+#define sk_BIO_dup(sk)      \
+  ((STACK_OF(BIO) *)sk_dup( \
+      CHECKED_CAST(const _STACK *, const STACK_OF(BIO) *, sk)))
 
 #define sk_BIO_sort(sk) sk_sort(CHECKED_CAST(_STACK *, STACK_OF(BIO) *, sk))
 
 #define sk_BIO_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(BIO) *, sk))
+  sk_is_sorted(CHECKED_CAST(const _STACK *, const STACK_OF(BIO) *, sk))
 
 #define sk_BIO_set_cmp_func(sk, comp)                                     \
   ((int (*)(const BIO **a, const BIO **b))sk_set_cmp_func(                \
@@ -767,14 +778,14 @@
 #define sk_BY_DIR_ENTRY_new_null() ((STACK_OF(BY_DIR_ENTRY) *)sk_new_null())
 
 #define sk_BY_DIR_ENTRY_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(BY_DIR_ENTRY) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(BY_DIR_ENTRY) *, sk))
 
 #define sk_BY_DIR_ENTRY_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(BY_DIR_ENTRY) *, sk));
 
 #define sk_BY_DIR_ENTRY_value(sk, i) \
   ((BY_DIR_ENTRY *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(BY_DIR_ENTRY) *, sk), (i)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(BY_DIR_ENTRY) *, sk), (i)))
 
 #define sk_BY_DIR_ENTRY_set(sk, i, p)                            \
   ((BY_DIR_ENTRY *)sk_set(                                       \
@@ -819,13 +830,13 @@
 
 #define sk_BY_DIR_ENTRY_dup(sk)      \
   ((STACK_OF(BY_DIR_ENTRY) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(BY_DIR_ENTRY) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(BY_DIR_ENTRY) *, sk)))
 
 #define sk_BY_DIR_ENTRY_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(BY_DIR_ENTRY) *, sk))
 
 #define sk_BY_DIR_ENTRY_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(BY_DIR_ENTRY) *, sk))
+  sk_is_sorted(CHECKED_CAST(const _STACK *, const STACK_OF(BY_DIR_ENTRY) *, sk))
 
 #define sk_BY_DIR_ENTRY_set_cmp_func(sk, comp)                               \
   ((int (*)(const BY_DIR_ENTRY **a, const BY_DIR_ENTRY **b))sk_set_cmp_func( \
@@ -850,14 +861,14 @@
 #define sk_BY_DIR_HASH_new_null() ((STACK_OF(BY_DIR_HASH) *)sk_new_null())
 
 #define sk_BY_DIR_HASH_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(BY_DIR_HASH) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(BY_DIR_HASH) *, sk))
 
 #define sk_BY_DIR_HASH_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(BY_DIR_HASH) *, sk));
 
 #define sk_BY_DIR_HASH_value(sk, i) \
   ((BY_DIR_HASH *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(BY_DIR_HASH) *, sk), (i)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(BY_DIR_HASH) *, sk), (i)))
 
 #define sk_BY_DIR_HASH_set(sk, i, p)                                          \
   ((BY_DIR_HASH *)sk_set(CHECKED_CAST(_STACK *, STACK_OF(BY_DIR_HASH) *, sk), \
@@ -900,13 +911,13 @@
 
 #define sk_BY_DIR_HASH_dup(sk)      \
   ((STACK_OF(BY_DIR_HASH) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(BY_DIR_HASH) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(BY_DIR_HASH) *, sk)))
 
 #define sk_BY_DIR_HASH_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(BY_DIR_HASH) *, sk))
 
 #define sk_BY_DIR_HASH_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(BY_DIR_HASH) *, sk))
+  sk_is_sorted(CHECKED_CAST(const _STACK *, const STACK_OF(BY_DIR_HASH) *, sk))
 
 #define sk_BY_DIR_HASH_set_cmp_func(sk, comp)                              \
   ((int (*)(const BY_DIR_HASH **a, const BY_DIR_HASH **b))sk_set_cmp_func( \
@@ -931,14 +942,14 @@
 #define sk_CONF_VALUE_new_null() ((STACK_OF(CONF_VALUE) *)sk_new_null())
 
 #define sk_CONF_VALUE_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(CONF_VALUE) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(CONF_VALUE) *, sk))
 
 #define sk_CONF_VALUE_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(CONF_VALUE) *, sk));
 
 #define sk_CONF_VALUE_value(sk, i) \
   ((CONF_VALUE *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(CONF_VALUE) *, sk), (i)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(CONF_VALUE) *, sk), (i)))
 
 #define sk_CONF_VALUE_set(sk, i, p)                                         \
   ((CONF_VALUE *)sk_set(CHECKED_CAST(_STACK *, STACK_OF(CONF_VALUE) *, sk), \
@@ -981,13 +992,13 @@
 
 #define sk_CONF_VALUE_dup(sk)      \
   ((STACK_OF(CONF_VALUE) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(CONF_VALUE) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(CONF_VALUE) *, sk)))
 
 #define sk_CONF_VALUE_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(CONF_VALUE) *, sk))
 
 #define sk_CONF_VALUE_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(CONF_VALUE) *, sk))
+  sk_is_sorted(CHECKED_CAST(const _STACK *, const STACK_OF(CONF_VALUE) *, sk))
 
 #define sk_CONF_VALUE_set_cmp_func(sk, comp)                             \
   ((int (*)(const CONF_VALUE **a, const CONF_VALUE **b))sk_set_cmp_func( \
@@ -1013,15 +1024,17 @@
 #define sk_CRYPTO_EX_DATA_FUNCS_new_null() \
   ((STACK_OF(CRYPTO_EX_DATA_FUNCS) *)sk_new_null())
 
-#define sk_CRYPTO_EX_DATA_FUNCS_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(CRYPTO_EX_DATA_FUNCS) *, sk))
+#define sk_CRYPTO_EX_DATA_FUNCS_num(sk)                                       \
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(CRYPTO_EX_DATA_FUNCS) *, \
+                      sk))
 
 #define sk_CRYPTO_EX_DATA_FUNCS_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(CRYPTO_EX_DATA_FUNCS) *, sk));
 
-#define sk_CRYPTO_EX_DATA_FUNCS_value(sk, i)                              \
-  ((CRYPTO_EX_DATA_FUNCS *)sk_value(                                      \
-      CHECKED_CAST(_STACK *, const STACK_OF(CRYPTO_EX_DATA_FUNCS) *, sk), \
+#define sk_CRYPTO_EX_DATA_FUNCS_value(sk, i)                               \
+  ((CRYPTO_EX_DATA_FUNCS *)sk_value(                                       \
+      CHECKED_CAST(const _STACK *, const STACK_OF(CRYPTO_EX_DATA_FUNCS) *, \
+                   sk),                                                    \
       (i)))
 
 #define sk_CRYPTO_EX_DATA_FUNCS_set(sk, i, p)                            \
@@ -1066,16 +1079,16 @@
   ((CRYPTO_EX_DATA_FUNCS *)sk_pop(      \
       CHECKED_CAST(_STACK *, STACK_OF(CRYPTO_EX_DATA_FUNCS) *, sk)))
 
-#define sk_CRYPTO_EX_DATA_FUNCS_dup(sk)      \
-  ((STACK_OF(CRYPTO_EX_DATA_FUNCS) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(CRYPTO_EX_DATA_FUNCS) *, sk)))
+#define sk_CRYPTO_EX_DATA_FUNCS_dup(sk)                   \
+  ((STACK_OF(CRYPTO_EX_DATA_FUNCS) *)sk_dup(CHECKED_CAST( \
+      const _STACK *, const STACK_OF(CRYPTO_EX_DATA_FUNCS) *, sk)))
 
 #define sk_CRYPTO_EX_DATA_FUNCS_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(CRYPTO_EX_DATA_FUNCS) *, sk))
 
 #define sk_CRYPTO_EX_DATA_FUNCS_is_sorted(sk) \
-  sk_is_sorted(                               \
-      CHECKED_CAST(_STACK *, const STACK_OF(CRYPTO_EX_DATA_FUNCS) *, sk))
+  sk_is_sorted(CHECKED_CAST(const _STACK *,   \
+                            const STACK_OF(CRYPTO_EX_DATA_FUNCS) *, sk))
 
 #define sk_CRYPTO_EX_DATA_FUNCS_set_cmp_func(sk, comp)                       \
   ((int (*)(const CRYPTO_EX_DATA_FUNCS **a, const CRYPTO_EX_DATA_FUNCS **b)) \
@@ -1105,14 +1118,14 @@
 #define sk_DIST_POINT_new_null() ((STACK_OF(DIST_POINT) *)sk_new_null())
 
 #define sk_DIST_POINT_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(DIST_POINT) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(DIST_POINT) *, sk))
 
 #define sk_DIST_POINT_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(DIST_POINT) *, sk));
 
 #define sk_DIST_POINT_value(sk, i) \
   ((DIST_POINT *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(DIST_POINT) *, sk), (i)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(DIST_POINT) *, sk), (i)))
 
 #define sk_DIST_POINT_set(sk, i, p)                                         \
   ((DIST_POINT *)sk_set(CHECKED_CAST(_STACK *, STACK_OF(DIST_POINT) *, sk), \
@@ -1155,13 +1168,13 @@
 
 #define sk_DIST_POINT_dup(sk)      \
   ((STACK_OF(DIST_POINT) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(DIST_POINT) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(DIST_POINT) *, sk)))
 
 #define sk_DIST_POINT_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(DIST_POINT) *, sk))
 
 #define sk_DIST_POINT_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(DIST_POINT) *, sk))
+  sk_is_sorted(CHECKED_CAST(const _STACK *, const STACK_OF(DIST_POINT) *, sk))
 
 #define sk_DIST_POINT_set_cmp_func(sk, comp)                             \
   ((int (*)(const DIST_POINT **a, const DIST_POINT **b))sk_set_cmp_func( \
@@ -1186,14 +1199,14 @@
 #define sk_GENERAL_NAME_new_null() ((STACK_OF(GENERAL_NAME) *)sk_new_null())
 
 #define sk_GENERAL_NAME_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(GENERAL_NAME) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(GENERAL_NAME) *, sk))
 
 #define sk_GENERAL_NAME_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(GENERAL_NAME) *, sk));
 
 #define sk_GENERAL_NAME_value(sk, i) \
   ((GENERAL_NAME *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(GENERAL_NAME) *, sk), (i)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(GENERAL_NAME) *, sk), (i)))
 
 #define sk_GENERAL_NAME_set(sk, i, p)                            \
   ((GENERAL_NAME *)sk_set(                                       \
@@ -1238,13 +1251,13 @@
 
 #define sk_GENERAL_NAME_dup(sk)      \
   ((STACK_OF(GENERAL_NAME) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(GENERAL_NAME) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(GENERAL_NAME) *, sk)))
 
 #define sk_GENERAL_NAME_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(GENERAL_NAME) *, sk))
 
 #define sk_GENERAL_NAME_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(GENERAL_NAME) *, sk))
+  sk_is_sorted(CHECKED_CAST(const _STACK *, const STACK_OF(GENERAL_NAME) *, sk))
 
 #define sk_GENERAL_NAME_set_cmp_func(sk, comp)                               \
   ((int (*)(const GENERAL_NAME **a, const GENERAL_NAME **b))sk_set_cmp_func( \
@@ -1269,14 +1282,14 @@
 #define sk_GENERAL_NAMES_new_null() ((STACK_OF(GENERAL_NAMES) *)sk_new_null())
 
 #define sk_GENERAL_NAMES_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(GENERAL_NAMES) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(GENERAL_NAMES) *, sk))
 
 #define sk_GENERAL_NAMES_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(GENERAL_NAMES) *, sk));
 
 #define sk_GENERAL_NAMES_value(sk, i) \
   ((GENERAL_NAMES *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(GENERAL_NAMES) *, sk), (i)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(GENERAL_NAMES) *, sk), (i)))
 
 #define sk_GENERAL_NAMES_set(sk, i, p)                            \
   ((GENERAL_NAMES *)sk_set(                                       \
@@ -1322,13 +1335,14 @@
 
 #define sk_GENERAL_NAMES_dup(sk)      \
   ((STACK_OF(GENERAL_NAMES) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(GENERAL_NAMES) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(GENERAL_NAMES) *, sk)))
 
 #define sk_GENERAL_NAMES_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(GENERAL_NAMES) *, sk))
 
 #define sk_GENERAL_NAMES_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(GENERAL_NAMES) *, sk))
+  sk_is_sorted(                        \
+      CHECKED_CAST(const _STACK *, const STACK_OF(GENERAL_NAMES) *, sk))
 
 #define sk_GENERAL_NAMES_set_cmp_func(sk, comp)                                \
   ((int (*)(const GENERAL_NAMES **a, const GENERAL_NAMES **b))sk_set_cmp_func( \
@@ -1354,14 +1368,15 @@
   ((STACK_OF(GENERAL_SUBTREE) *)sk_new_null())
 
 #define sk_GENERAL_SUBTREE_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(GENERAL_SUBTREE) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(GENERAL_SUBTREE) *, sk))
 
 #define sk_GENERAL_SUBTREE_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(GENERAL_SUBTREE) *, sk));
 
-#define sk_GENERAL_SUBTREE_value(sk, i) \
-  ((GENERAL_SUBTREE *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(GENERAL_SUBTREE) *, sk), (i)))
+#define sk_GENERAL_SUBTREE_value(sk, i)                                    \
+  ((GENERAL_SUBTREE *)sk_value(                                            \
+      CHECKED_CAST(const _STACK *, const STACK_OF(GENERAL_SUBTREE) *, sk), \
+      (i)))
 
 #define sk_GENERAL_SUBTREE_set(sk, i, p)                            \
   ((GENERAL_SUBTREE *)sk_set(                                       \
@@ -1407,13 +1422,14 @@
 
 #define sk_GENERAL_SUBTREE_dup(sk)      \
   ((STACK_OF(GENERAL_SUBTREE) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(GENERAL_SUBTREE) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(GENERAL_SUBTREE) *, sk)))
 
 #define sk_GENERAL_SUBTREE_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(GENERAL_SUBTREE) *, sk))
 
 #define sk_GENERAL_SUBTREE_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(GENERAL_SUBTREE) *, sk))
+  sk_is_sorted(                          \
+      CHECKED_CAST(const _STACK *, const STACK_OF(GENERAL_SUBTREE) *, sk))
 
 #define sk_GENERAL_SUBTREE_set_cmp_func(sk, comp)                           \
   ((int (*)(const GENERAL_SUBTREE **a, const GENERAL_SUBTREE **b))          \
@@ -1439,14 +1455,14 @@
 #define sk_POLICYINFO_new_null() ((STACK_OF(POLICYINFO) *)sk_new_null())
 
 #define sk_POLICYINFO_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(POLICYINFO) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(POLICYINFO) *, sk))
 
 #define sk_POLICYINFO_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(POLICYINFO) *, sk));
 
 #define sk_POLICYINFO_value(sk, i) \
   ((POLICYINFO *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(POLICYINFO) *, sk), (i)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(POLICYINFO) *, sk), (i)))
 
 #define sk_POLICYINFO_set(sk, i, p)                                         \
   ((POLICYINFO *)sk_set(CHECKED_CAST(_STACK *, STACK_OF(POLICYINFO) *, sk), \
@@ -1489,13 +1505,13 @@
 
 #define sk_POLICYINFO_dup(sk)      \
   ((STACK_OF(POLICYINFO) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(POLICYINFO) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(POLICYINFO) *, sk)))
 
 #define sk_POLICYINFO_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(POLICYINFO) *, sk))
 
 #define sk_POLICYINFO_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(POLICYINFO) *, sk))
+  sk_is_sorted(CHECKED_CAST(const _STACK *, const STACK_OF(POLICYINFO) *, sk))
 
 #define sk_POLICYINFO_set_cmp_func(sk, comp)                             \
   ((int (*)(const POLICYINFO **a, const POLICYINFO **b))sk_set_cmp_func( \
@@ -1520,14 +1536,15 @@
 #define sk_POLICYQUALINFO_new_null() ((STACK_OF(POLICYQUALINFO) *)sk_new_null())
 
 #define sk_POLICYQUALINFO_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(POLICYQUALINFO) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(POLICYQUALINFO) *, sk))
 
 #define sk_POLICYQUALINFO_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(POLICYQUALINFO) *, sk));
 
-#define sk_POLICYQUALINFO_value(sk, i) \
-  ((POLICYQUALINFO *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(POLICYQUALINFO) *, sk), (i)))
+#define sk_POLICYQUALINFO_value(sk, i)                                    \
+  ((POLICYQUALINFO *)sk_value(                                            \
+      CHECKED_CAST(const _STACK *, const STACK_OF(POLICYQUALINFO) *, sk), \
+      (i)))
 
 #define sk_POLICYQUALINFO_set(sk, i, p)                            \
   ((POLICYQUALINFO *)sk_set(                                       \
@@ -1573,13 +1590,14 @@
 
 #define sk_POLICYQUALINFO_dup(sk)      \
   ((STACK_OF(POLICYQUALINFO) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(POLICYQUALINFO) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(POLICYQUALINFO) *, sk)))
 
 #define sk_POLICYQUALINFO_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(POLICYQUALINFO) *, sk))
 
 #define sk_POLICYQUALINFO_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(POLICYQUALINFO) *, sk))
+  sk_is_sorted(                         \
+      CHECKED_CAST(const _STACK *, const STACK_OF(POLICYQUALINFO) *, sk))
 
 #define sk_POLICYQUALINFO_set_cmp_func(sk, comp)                           \
   ((int (*)(const POLICYQUALINFO **a, const POLICYQUALINFO **b))           \
@@ -1605,14 +1623,15 @@
 #define sk_POLICY_MAPPING_new_null() ((STACK_OF(POLICY_MAPPING) *)sk_new_null())
 
 #define sk_POLICY_MAPPING_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(POLICY_MAPPING) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(POLICY_MAPPING) *, sk))
 
 #define sk_POLICY_MAPPING_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(POLICY_MAPPING) *, sk));
 
-#define sk_POLICY_MAPPING_value(sk, i) \
-  ((POLICY_MAPPING *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(POLICY_MAPPING) *, sk), (i)))
+#define sk_POLICY_MAPPING_value(sk, i)                                    \
+  ((POLICY_MAPPING *)sk_value(                                            \
+      CHECKED_CAST(const _STACK *, const STACK_OF(POLICY_MAPPING) *, sk), \
+      (i)))
 
 #define sk_POLICY_MAPPING_set(sk, i, p)                            \
   ((POLICY_MAPPING *)sk_set(                                       \
@@ -1658,13 +1677,14 @@
 
 #define sk_POLICY_MAPPING_dup(sk)      \
   ((STACK_OF(POLICY_MAPPING) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(POLICY_MAPPING) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(POLICY_MAPPING) *, sk)))
 
 #define sk_POLICY_MAPPING_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(POLICY_MAPPING) *, sk))
 
 #define sk_POLICY_MAPPING_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(POLICY_MAPPING) *, sk))
+  sk_is_sorted(                         \
+      CHECKED_CAST(const _STACK *, const STACK_OF(POLICY_MAPPING) *, sk))
 
 #define sk_POLICY_MAPPING_set_cmp_func(sk, comp)                           \
   ((int (*)(const POLICY_MAPPING **a, const POLICY_MAPPING **b))           \
@@ -1691,15 +1711,17 @@
 #define sk_RSA_additional_prime_new_null() \
   ((STACK_OF(RSA_additional_prime) *)sk_new_null())
 
-#define sk_RSA_additional_prime_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(RSA_additional_prime) *, sk))
+#define sk_RSA_additional_prime_num(sk)                                       \
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(RSA_additional_prime) *, \
+                      sk))
 
 #define sk_RSA_additional_prime_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(RSA_additional_prime) *, sk));
 
-#define sk_RSA_additional_prime_value(sk, i)                              \
-  ((RSA_additional_prime *)sk_value(                                      \
-      CHECKED_CAST(_STACK *, const STACK_OF(RSA_additional_prime) *, sk), \
+#define sk_RSA_additional_prime_value(sk, i)                               \
+  ((RSA_additional_prime *)sk_value(                                       \
+      CHECKED_CAST(const _STACK *, const STACK_OF(RSA_additional_prime) *, \
+                   sk),                                                    \
       (i)))
 
 #define sk_RSA_additional_prime_set(sk, i, p)                            \
@@ -1744,16 +1766,16 @@
   ((RSA_additional_prime *)sk_pop(      \
       CHECKED_CAST(_STACK *, STACK_OF(RSA_additional_prime) *, sk)))
 
-#define sk_RSA_additional_prime_dup(sk)      \
-  ((STACK_OF(RSA_additional_prime) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(RSA_additional_prime) *, sk)))
+#define sk_RSA_additional_prime_dup(sk)                   \
+  ((STACK_OF(RSA_additional_prime) *)sk_dup(CHECKED_CAST( \
+      const _STACK *, const STACK_OF(RSA_additional_prime) *, sk)))
 
 #define sk_RSA_additional_prime_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(RSA_additional_prime) *, sk))
 
 #define sk_RSA_additional_prime_is_sorted(sk) \
-  sk_is_sorted(                               \
-      CHECKED_CAST(_STACK *, const STACK_OF(RSA_additional_prime) *, sk))
+  sk_is_sorted(CHECKED_CAST(const _STACK *,   \
+                            const STACK_OF(RSA_additional_prime) *, sk))
 
 #define sk_RSA_additional_prime_set_cmp_func(sk, comp)                       \
   ((int (*)(const RSA_additional_prime **a, const RSA_additional_prime **b)) \
@@ -1782,14 +1804,14 @@
 #define sk_SSL_COMP_new_null() ((STACK_OF(SSL_COMP) *)sk_new_null())
 
 #define sk_SSL_COMP_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(SSL_COMP) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(SSL_COMP) *, sk))
 
 #define sk_SSL_COMP_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(SSL_COMP) *, sk));
 
 #define sk_SSL_COMP_value(sk, i) \
   ((SSL_COMP *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(SSL_COMP) *, sk), (i)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(SSL_COMP) *, sk), (i)))
 
 #define sk_SSL_COMP_set(sk, i, p)                                            \
   ((SSL_COMP *)sk_set(CHECKED_CAST(_STACK *, STACK_OF(SSL_COMP) *, sk), (i), \
@@ -1830,13 +1852,13 @@
 
 #define sk_SSL_COMP_dup(sk)      \
   ((STACK_OF(SSL_COMP) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(SSL_COMP) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(SSL_COMP) *, sk)))
 
 #define sk_SSL_COMP_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(SSL_COMP) *, sk))
 
 #define sk_SSL_COMP_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(SSL_COMP) *, sk))
+  sk_is_sorted(CHECKED_CAST(const _STACK *, const STACK_OF(SSL_COMP) *, sk))
 
 #define sk_SSL_COMP_set_cmp_func(sk, comp)                           \
   ((int (*)(const SSL_COMP **a, const SSL_COMP **b))sk_set_cmp_func( \
@@ -1860,15 +1882,17 @@
 #define sk_SSL_CUSTOM_EXTENSION_new_null() \
   ((STACK_OF(SSL_CUSTOM_EXTENSION) *)sk_new_null())
 
-#define sk_SSL_CUSTOM_EXTENSION_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(SSL_CUSTOM_EXTENSION) *, sk))
+#define sk_SSL_CUSTOM_EXTENSION_num(sk)                                       \
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(SSL_CUSTOM_EXTENSION) *, \
+                      sk))
 
 #define sk_SSL_CUSTOM_EXTENSION_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(SSL_CUSTOM_EXTENSION) *, sk));
 
-#define sk_SSL_CUSTOM_EXTENSION_value(sk, i)                              \
-  ((SSL_CUSTOM_EXTENSION *)sk_value(                                      \
-      CHECKED_CAST(_STACK *, const STACK_OF(SSL_CUSTOM_EXTENSION) *, sk), \
+#define sk_SSL_CUSTOM_EXTENSION_value(sk, i)                               \
+  ((SSL_CUSTOM_EXTENSION *)sk_value(                                       \
+      CHECKED_CAST(const _STACK *, const STACK_OF(SSL_CUSTOM_EXTENSION) *, \
+                   sk),                                                    \
       (i)))
 
 #define sk_SSL_CUSTOM_EXTENSION_set(sk, i, p)                            \
@@ -1913,16 +1937,16 @@
   ((SSL_CUSTOM_EXTENSION *)sk_pop(      \
       CHECKED_CAST(_STACK *, STACK_OF(SSL_CUSTOM_EXTENSION) *, sk)))
 
-#define sk_SSL_CUSTOM_EXTENSION_dup(sk)      \
-  ((STACK_OF(SSL_CUSTOM_EXTENSION) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(SSL_CUSTOM_EXTENSION) *, sk)))
+#define sk_SSL_CUSTOM_EXTENSION_dup(sk)                   \
+  ((STACK_OF(SSL_CUSTOM_EXTENSION) *)sk_dup(CHECKED_CAST( \
+      const _STACK *, const STACK_OF(SSL_CUSTOM_EXTENSION) *, sk)))
 
 #define sk_SSL_CUSTOM_EXTENSION_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(SSL_CUSTOM_EXTENSION) *, sk))
 
 #define sk_SSL_CUSTOM_EXTENSION_is_sorted(sk) \
-  sk_is_sorted(                               \
-      CHECKED_CAST(_STACK *, const STACK_OF(SSL_CUSTOM_EXTENSION) *, sk))
+  sk_is_sorted(CHECKED_CAST(const _STACK *,   \
+                            const STACK_OF(SSL_CUSTOM_EXTENSION) *, sk))
 
 #define sk_SSL_CUSTOM_EXTENSION_set_cmp_func(sk, comp)                       \
   ((int (*)(const SSL_CUSTOM_EXTENSION **a, const SSL_CUSTOM_EXTENSION **b)) \
@@ -1954,14 +1978,16 @@
   ((STACK_OF(STACK_OF_X509_NAME_ENTRY) *)sk_new_null())
 
 #define sk_STACK_OF_X509_NAME_ENTRY_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(STACK_OF_X509_NAME_ENTRY) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *,       \
+                      const STACK_OF(STACK_OF_X509_NAME_ENTRY) *, sk))
 
 #define sk_STACK_OF_X509_NAME_ENTRY_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(STACK_OF_X509_NAME_ENTRY) *, sk));
 
-#define sk_STACK_OF_X509_NAME_ENTRY_value(sk, i)                              \
-  ((STACK_OF_X509_NAME_ENTRY *)sk_value(                                      \
-      CHECKED_CAST(_STACK *, const STACK_OF(STACK_OF_X509_NAME_ENTRY) *, sk), \
+#define sk_STACK_OF_X509_NAME_ENTRY_value(sk, i)                               \
+  ((STACK_OF_X509_NAME_ENTRY *)sk_value(                                       \
+      CHECKED_CAST(const _STACK *, const STACK_OF(STACK_OF_X509_NAME_ENTRY) *, \
+                   sk),                                                        \
       (i)))
 
 #define sk_STACK_OF_X509_NAME_ENTRY_set(sk, i, p)                            \
@@ -2008,16 +2034,16 @@
   ((STACK_OF_X509_NAME_ENTRY *)sk_pop(      \
       CHECKED_CAST(_STACK *, STACK_OF(STACK_OF_X509_NAME_ENTRY) *, sk)))
 
-#define sk_STACK_OF_X509_NAME_ENTRY_dup(sk)      \
-  ((STACK_OF(STACK_OF_X509_NAME_ENTRY) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(STACK_OF_X509_NAME_ENTRY) *, sk)))
+#define sk_STACK_OF_X509_NAME_ENTRY_dup(sk)                   \
+  ((STACK_OF(STACK_OF_X509_NAME_ENTRY) *)sk_dup(CHECKED_CAST( \
+      const _STACK *, const STACK_OF(STACK_OF_X509_NAME_ENTRY) *, sk)))
 
 #define sk_STACK_OF_X509_NAME_ENTRY_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(STACK_OF_X509_NAME_ENTRY) *, sk))
 
 #define sk_STACK_OF_X509_NAME_ENTRY_is_sorted(sk) \
-  sk_is_sorted(                                   \
-      CHECKED_CAST(_STACK *, const STACK_OF(STACK_OF_X509_NAME_ENTRY) *, sk))
+  sk_is_sorted(CHECKED_CAST(const _STACK *,       \
+                            const STACK_OF(STACK_OF_X509_NAME_ENTRY) *, sk))
 
 #define sk_STACK_OF_X509_NAME_ENTRY_set_cmp_func(sk, comp)                   \
   ((int (*)(const STACK_OF_X509_NAME_ENTRY **a,                              \
@@ -2047,14 +2073,14 @@
 #define sk_SXNETID_new_null() ((STACK_OF(SXNETID) *)sk_new_null())
 
 #define sk_SXNETID_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(SXNETID) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(SXNETID) *, sk))
 
 #define sk_SXNETID_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(SXNETID) *, sk));
 
-#define sk_SXNETID_value(sk, i)                                               \
-  ((SXNETID *)sk_value(CHECKED_CAST(_STACK *, const STACK_OF(SXNETID) *, sk), \
-                       (i)))
+#define sk_SXNETID_value(sk, i) \
+  ((SXNETID *)sk_value(         \
+      CHECKED_CAST(const _STACK *, const STACK_OF(SXNETID) *, sk), (i)))
 
 #define sk_SXNETID_set(sk, i, p)                                           \
   ((SXNETID *)sk_set(CHECKED_CAST(_STACK *, STACK_OF(SXNETID) *, sk), (i), \
@@ -2095,13 +2121,13 @@
 
 #define sk_SXNETID_dup(sk)      \
   ((STACK_OF(SXNETID) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(SXNETID) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(SXNETID) *, sk)))
 
 #define sk_SXNETID_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(SXNETID) *, sk))
 
 #define sk_SXNETID_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(SXNETID) *, sk))
+  sk_is_sorted(CHECKED_CAST(const _STACK *, const STACK_OF(SXNETID) *, sk))
 
 #define sk_SXNETID_set_cmp_func(sk, comp)                          \
   ((int (*)(const SXNETID **a, const SXNETID **b))sk_set_cmp_func( \
@@ -2122,12 +2148,14 @@
 
 #define sk_X509_new_null() ((STACK_OF(X509) *)sk_new_null())
 
-#define sk_X509_num(sk) sk_num(CHECKED_CAST(_STACK *, STACK_OF(X509) *, sk))
+#define sk_X509_num(sk) \
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(X509) *, sk))
 
 #define sk_X509_zero(sk) sk_zero(CHECKED_CAST(_STACK *, STACK_OF(X509) *, sk));
 
-#define sk_X509_value(sk, i) \
-  ((X509 *)sk_value(CHECKED_CAST(_STACK *, const STACK_OF(X509) *, sk), (i)))
+#define sk_X509_value(sk, i)                                                  \
+  ((X509 *)sk_value(CHECKED_CAST(const _STACK *, const STACK_OF(X509) *, sk), \
+                    (i)))
 
 #define sk_X509_set(sk, i, p)                                        \
   ((X509 *)sk_set(CHECKED_CAST(_STACK *, STACK_OF(X509) *, sk), (i), \
@@ -2164,13 +2192,14 @@
 #define sk_X509_pop(sk) \
   ((X509 *)sk_pop(CHECKED_CAST(_STACK *, STACK_OF(X509) *, sk)))
 
-#define sk_X509_dup(sk) \
-  ((STACK_OF(X509) *)sk_dup(CHECKED_CAST(_STACK *, const STACK_OF(X509) *, sk)))
+#define sk_X509_dup(sk)      \
+  ((STACK_OF(X509) *)sk_dup( \
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509) *, sk)))
 
 #define sk_X509_sort(sk) sk_sort(CHECKED_CAST(_STACK *, STACK_OF(X509) *, sk))
 
 #define sk_X509_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(X509) *, sk))
+  sk_is_sorted(CHECKED_CAST(const _STACK *, const STACK_OF(X509) *, sk))
 
 #define sk_X509_set_cmp_func(sk, comp)                                      \
   ((int (*)(const X509 **a, const X509 **b))sk_set_cmp_func(                \
@@ -2195,14 +2224,15 @@
   ((STACK_OF(X509V3_EXT_METHOD) *)sk_new_null())
 
 #define sk_X509V3_EXT_METHOD_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(X509V3_EXT_METHOD) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(X509V3_EXT_METHOD) *, sk))
 
 #define sk_X509V3_EXT_METHOD_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(X509V3_EXT_METHOD) *, sk));
 
-#define sk_X509V3_EXT_METHOD_value(sk, i) \
-  ((X509V3_EXT_METHOD *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509V3_EXT_METHOD) *, sk), (i)))
+#define sk_X509V3_EXT_METHOD_value(sk, i)                                    \
+  ((X509V3_EXT_METHOD *)sk_value(                                            \
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509V3_EXT_METHOD) *, sk), \
+      (i)))
 
 #define sk_X509V3_EXT_METHOD_set(sk, i, p)                            \
   ((X509V3_EXT_METHOD *)sk_set(                                       \
@@ -2248,13 +2278,14 @@
 
 #define sk_X509V3_EXT_METHOD_dup(sk)      \
   ((STACK_OF(X509V3_EXT_METHOD) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509V3_EXT_METHOD) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509V3_EXT_METHOD) *, sk)))
 
 #define sk_X509V3_EXT_METHOD_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(X509V3_EXT_METHOD) *, sk))
 
 #define sk_X509V3_EXT_METHOD_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(X509V3_EXT_METHOD) *, sk))
+  sk_is_sorted(                            \
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509V3_EXT_METHOD) *, sk))
 
 #define sk_X509V3_EXT_METHOD_set_cmp_func(sk, comp)                           \
   ((int (*)(const X509V3_EXT_METHOD **a, const X509V3_EXT_METHOD **b))        \
@@ -2281,14 +2312,14 @@
 #define sk_X509_ALGOR_new_null() ((STACK_OF(X509_ALGOR) *)sk_new_null())
 
 #define sk_X509_ALGOR_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(X509_ALGOR) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(X509_ALGOR) *, sk))
 
 #define sk_X509_ALGOR_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(X509_ALGOR) *, sk));
 
 #define sk_X509_ALGOR_value(sk, i) \
   ((X509_ALGOR *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509_ALGOR) *, sk), (i)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_ALGOR) *, sk), (i)))
 
 #define sk_X509_ALGOR_set(sk, i, p)                                         \
   ((X509_ALGOR *)sk_set(CHECKED_CAST(_STACK *, STACK_OF(X509_ALGOR) *, sk), \
@@ -2331,13 +2362,13 @@
 
 #define sk_X509_ALGOR_dup(sk)      \
   ((STACK_OF(X509_ALGOR) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509_ALGOR) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_ALGOR) *, sk)))
 
 #define sk_X509_ALGOR_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(X509_ALGOR) *, sk))
 
 #define sk_X509_ALGOR_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(X509_ALGOR) *, sk))
+  sk_is_sorted(CHECKED_CAST(const _STACK *, const STACK_OF(X509_ALGOR) *, sk))
 
 #define sk_X509_ALGOR_set_cmp_func(sk, comp)                             \
   ((int (*)(const X509_ALGOR **a, const X509_ALGOR **b))sk_set_cmp_func( \
@@ -2362,14 +2393,15 @@
 #define sk_X509_ATTRIBUTE_new_null() ((STACK_OF(X509_ATTRIBUTE) *)sk_new_null())
 
 #define sk_X509_ATTRIBUTE_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(X509_ATTRIBUTE) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(X509_ATTRIBUTE) *, sk))
 
 #define sk_X509_ATTRIBUTE_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(X509_ATTRIBUTE) *, sk));
 
-#define sk_X509_ATTRIBUTE_value(sk, i) \
-  ((X509_ATTRIBUTE *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509_ATTRIBUTE) *, sk), (i)))
+#define sk_X509_ATTRIBUTE_value(sk, i)                                    \
+  ((X509_ATTRIBUTE *)sk_value(                                            \
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_ATTRIBUTE) *, sk), \
+      (i)))
 
 #define sk_X509_ATTRIBUTE_set(sk, i, p)                            \
   ((X509_ATTRIBUTE *)sk_set(                                       \
@@ -2415,13 +2447,14 @@
 
 #define sk_X509_ATTRIBUTE_dup(sk)      \
   ((STACK_OF(X509_ATTRIBUTE) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509_ATTRIBUTE) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_ATTRIBUTE) *, sk)))
 
 #define sk_X509_ATTRIBUTE_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(X509_ATTRIBUTE) *, sk))
 
 #define sk_X509_ATTRIBUTE_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(X509_ATTRIBUTE) *, sk))
+  sk_is_sorted(                         \
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_ATTRIBUTE) *, sk))
 
 #define sk_X509_ATTRIBUTE_set_cmp_func(sk, comp)                           \
   ((int (*)(const X509_ATTRIBUTE **a, const X509_ATTRIBUTE **b))           \
@@ -2446,14 +2479,14 @@
 #define sk_X509_CRL_new_null() ((STACK_OF(X509_CRL) *)sk_new_null())
 
 #define sk_X509_CRL_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(X509_CRL) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(X509_CRL) *, sk))
 
 #define sk_X509_CRL_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(X509_CRL) *, sk));
 
 #define sk_X509_CRL_value(sk, i) \
   ((X509_CRL *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509_CRL) *, sk), (i)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_CRL) *, sk), (i)))
 
 #define sk_X509_CRL_set(sk, i, p)                                            \
   ((X509_CRL *)sk_set(CHECKED_CAST(_STACK *, STACK_OF(X509_CRL) *, sk), (i), \
@@ -2494,13 +2527,13 @@
 
 #define sk_X509_CRL_dup(sk)      \
   ((STACK_OF(X509_CRL) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509_CRL) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_CRL) *, sk)))
 
 #define sk_X509_CRL_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(X509_CRL) *, sk))
 
 #define sk_X509_CRL_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(X509_CRL) *, sk))
+  sk_is_sorted(CHECKED_CAST(const _STACK *, const STACK_OF(X509_CRL) *, sk))
 
 #define sk_X509_CRL_set_cmp_func(sk, comp)                           \
   ((int (*)(const X509_CRL **a, const X509_CRL **b))sk_set_cmp_func( \
@@ -2523,14 +2556,15 @@
 #define sk_X509_EXTENSION_new_null() ((STACK_OF(X509_EXTENSION) *)sk_new_null())
 
 #define sk_X509_EXTENSION_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(X509_EXTENSION) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(X509_EXTENSION) *, sk))
 
 #define sk_X509_EXTENSION_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(X509_EXTENSION) *, sk));
 
-#define sk_X509_EXTENSION_value(sk, i) \
-  ((X509_EXTENSION *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509_EXTENSION) *, sk), (i)))
+#define sk_X509_EXTENSION_value(sk, i)                                    \
+  ((X509_EXTENSION *)sk_value(                                            \
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_EXTENSION) *, sk), \
+      (i)))
 
 #define sk_X509_EXTENSION_set(sk, i, p)                            \
   ((X509_EXTENSION *)sk_set(                                       \
@@ -2576,13 +2610,14 @@
 
 #define sk_X509_EXTENSION_dup(sk)      \
   ((STACK_OF(X509_EXTENSION) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509_EXTENSION) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_EXTENSION) *, sk)))
 
 #define sk_X509_EXTENSION_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(X509_EXTENSION) *, sk))
 
 #define sk_X509_EXTENSION_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(X509_EXTENSION) *, sk))
+  sk_is_sorted(                         \
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_EXTENSION) *, sk))
 
 #define sk_X509_EXTENSION_set_cmp_func(sk, comp)                           \
   ((int (*)(const X509_EXTENSION **a, const X509_EXTENSION **b))           \
@@ -2608,14 +2643,14 @@
 #define sk_X509_INFO_new_null() ((STACK_OF(X509_INFO) *)sk_new_null())
 
 #define sk_X509_INFO_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(X509_INFO) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(X509_INFO) *, sk))
 
 #define sk_X509_INFO_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(X509_INFO) *, sk));
 
 #define sk_X509_INFO_value(sk, i) \
   ((X509_INFO *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509_INFO) *, sk), (i)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_INFO) *, sk), (i)))
 
 #define sk_X509_INFO_set(sk, i, p)                                             \
   ((X509_INFO *)sk_set(CHECKED_CAST(_STACK *, STACK_OF(X509_INFO) *, sk), (i), \
@@ -2658,13 +2693,13 @@
 
 #define sk_X509_INFO_dup(sk)      \
   ((STACK_OF(X509_INFO) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509_INFO) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_INFO) *, sk)))
 
 #define sk_X509_INFO_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(X509_INFO) *, sk))
 
 #define sk_X509_INFO_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(X509_INFO) *, sk))
+  sk_is_sorted(CHECKED_CAST(const _STACK *, const STACK_OF(X509_INFO) *, sk))
 
 #define sk_X509_INFO_set_cmp_func(sk, comp)                            \
   ((int (*)(const X509_INFO **a, const X509_INFO **b))sk_set_cmp_func( \
@@ -2687,14 +2722,14 @@
 #define sk_X509_LOOKUP_new_null() ((STACK_OF(X509_LOOKUP) *)sk_new_null())
 
 #define sk_X509_LOOKUP_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(X509_LOOKUP) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(X509_LOOKUP) *, sk))
 
 #define sk_X509_LOOKUP_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(X509_LOOKUP) *, sk));
 
 #define sk_X509_LOOKUP_value(sk, i) \
   ((X509_LOOKUP *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509_LOOKUP) *, sk), (i)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_LOOKUP) *, sk), (i)))
 
 #define sk_X509_LOOKUP_set(sk, i, p)                                          \
   ((X509_LOOKUP *)sk_set(CHECKED_CAST(_STACK *, STACK_OF(X509_LOOKUP) *, sk), \
@@ -2737,13 +2772,13 @@
 
 #define sk_X509_LOOKUP_dup(sk)      \
   ((STACK_OF(X509_LOOKUP) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509_LOOKUP) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_LOOKUP) *, sk)))
 
 #define sk_X509_LOOKUP_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(X509_LOOKUP) *, sk))
 
 #define sk_X509_LOOKUP_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(X509_LOOKUP) *, sk))
+  sk_is_sorted(CHECKED_CAST(const _STACK *, const STACK_OF(X509_LOOKUP) *, sk))
 
 #define sk_X509_LOOKUP_set_cmp_func(sk, comp)                              \
   ((int (*)(const X509_LOOKUP **a, const X509_LOOKUP **b))sk_set_cmp_func( \
@@ -2768,14 +2803,14 @@
 #define sk_X509_NAME_new_null() ((STACK_OF(X509_NAME) *)sk_new_null())
 
 #define sk_X509_NAME_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(X509_NAME) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(X509_NAME) *, sk))
 
 #define sk_X509_NAME_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(X509_NAME) *, sk));
 
 #define sk_X509_NAME_value(sk, i) \
   ((X509_NAME *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509_NAME) *, sk), (i)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_NAME) *, sk), (i)))
 
 #define sk_X509_NAME_set(sk, i, p)                                             \
   ((X509_NAME *)sk_set(CHECKED_CAST(_STACK *, STACK_OF(X509_NAME) *, sk), (i), \
@@ -2818,13 +2853,13 @@
 
 #define sk_X509_NAME_dup(sk)      \
   ((STACK_OF(X509_NAME) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509_NAME) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_NAME) *, sk)))
 
 #define sk_X509_NAME_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(X509_NAME) *, sk))
 
 #define sk_X509_NAME_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(X509_NAME) *, sk))
+  sk_is_sorted(CHECKED_CAST(const _STACK *, const STACK_OF(X509_NAME) *, sk))
 
 #define sk_X509_NAME_set_cmp_func(sk, comp)                            \
   ((int (*)(const X509_NAME **a, const X509_NAME **b))sk_set_cmp_func( \
@@ -2848,14 +2883,15 @@
   ((STACK_OF(X509_NAME_ENTRY) *)sk_new_null())
 
 #define sk_X509_NAME_ENTRY_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(X509_NAME_ENTRY) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(X509_NAME_ENTRY) *, sk))
 
 #define sk_X509_NAME_ENTRY_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(X509_NAME_ENTRY) *, sk));
 
-#define sk_X509_NAME_ENTRY_value(sk, i) \
-  ((X509_NAME_ENTRY *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509_NAME_ENTRY) *, sk), (i)))
+#define sk_X509_NAME_ENTRY_value(sk, i)                                    \
+  ((X509_NAME_ENTRY *)sk_value(                                            \
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_NAME_ENTRY) *, sk), \
+      (i)))
 
 #define sk_X509_NAME_ENTRY_set(sk, i, p)                            \
   ((X509_NAME_ENTRY *)sk_set(                                       \
@@ -2901,13 +2937,14 @@
 
 #define sk_X509_NAME_ENTRY_dup(sk)      \
   ((STACK_OF(X509_NAME_ENTRY) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509_NAME_ENTRY) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_NAME_ENTRY) *, sk)))
 
 #define sk_X509_NAME_ENTRY_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(X509_NAME_ENTRY) *, sk))
 
 #define sk_X509_NAME_ENTRY_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(X509_NAME_ENTRY) *, sk))
+  sk_is_sorted(                          \
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_NAME_ENTRY) *, sk))
 
 #define sk_X509_NAME_ENTRY_set_cmp_func(sk, comp)                           \
   ((int (*)(const X509_NAME_ENTRY **a, const X509_NAME_ENTRY **b))          \
@@ -2933,14 +2970,14 @@
 #define sk_X509_OBJECT_new_null() ((STACK_OF(X509_OBJECT) *)sk_new_null())
 
 #define sk_X509_OBJECT_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(X509_OBJECT) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(X509_OBJECT) *, sk))
 
 #define sk_X509_OBJECT_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(X509_OBJECT) *, sk));
 
 #define sk_X509_OBJECT_value(sk, i) \
   ((X509_OBJECT *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509_OBJECT) *, sk), (i)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_OBJECT) *, sk), (i)))
 
 #define sk_X509_OBJECT_set(sk, i, p)                                          \
   ((X509_OBJECT *)sk_set(CHECKED_CAST(_STACK *, STACK_OF(X509_OBJECT) *, sk), \
@@ -2983,13 +3020,13 @@
 
 #define sk_X509_OBJECT_dup(sk)      \
   ((STACK_OF(X509_OBJECT) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509_OBJECT) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_OBJECT) *, sk)))
 
 #define sk_X509_OBJECT_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(X509_OBJECT) *, sk))
 
 #define sk_X509_OBJECT_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(X509_OBJECT) *, sk))
+  sk_is_sorted(CHECKED_CAST(const _STACK *, const STACK_OF(X509_OBJECT) *, sk))
 
 #define sk_X509_OBJECT_set_cmp_func(sk, comp)                              \
   ((int (*)(const X509_OBJECT **a, const X509_OBJECT **b))sk_set_cmp_func( \
@@ -3015,14 +3052,15 @@
   ((STACK_OF(X509_POLICY_DATA) *)sk_new_null())
 
 #define sk_X509_POLICY_DATA_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(X509_POLICY_DATA) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(X509_POLICY_DATA) *, sk))
 
 #define sk_X509_POLICY_DATA_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(X509_POLICY_DATA) *, sk));
 
-#define sk_X509_POLICY_DATA_value(sk, i) \
-  ((X509_POLICY_DATA *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509_POLICY_DATA) *, sk), (i)))
+#define sk_X509_POLICY_DATA_value(sk, i)                                    \
+  ((X509_POLICY_DATA *)sk_value(                                            \
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_POLICY_DATA) *, sk), \
+      (i)))
 
 #define sk_X509_POLICY_DATA_set(sk, i, p)                            \
   ((X509_POLICY_DATA *)sk_set(                                       \
@@ -3068,13 +3106,14 @@
 
 #define sk_X509_POLICY_DATA_dup(sk)      \
   ((STACK_OF(X509_POLICY_DATA) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509_POLICY_DATA) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_POLICY_DATA) *, sk)))
 
 #define sk_X509_POLICY_DATA_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(X509_POLICY_DATA) *, sk))
 
 #define sk_X509_POLICY_DATA_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(X509_POLICY_DATA) *, sk))
+  sk_is_sorted(                           \
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_POLICY_DATA) *, sk))
 
 #define sk_X509_POLICY_DATA_set_cmp_func(sk, comp)                           \
   ((int (*)(const X509_POLICY_DATA **a, const X509_POLICY_DATA **b))         \
@@ -3102,14 +3141,15 @@
   ((STACK_OF(X509_POLICY_NODE) *)sk_new_null())
 
 #define sk_X509_POLICY_NODE_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(X509_POLICY_NODE) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(X509_POLICY_NODE) *, sk))
 
 #define sk_X509_POLICY_NODE_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(X509_POLICY_NODE) *, sk));
 
-#define sk_X509_POLICY_NODE_value(sk, i) \
-  ((X509_POLICY_NODE *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509_POLICY_NODE) *, sk), (i)))
+#define sk_X509_POLICY_NODE_value(sk, i)                                    \
+  ((X509_POLICY_NODE *)sk_value(                                            \
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_POLICY_NODE) *, sk), \
+      (i)))
 
 #define sk_X509_POLICY_NODE_set(sk, i, p)                            \
   ((X509_POLICY_NODE *)sk_set(                                       \
@@ -3155,13 +3195,14 @@
 
 #define sk_X509_POLICY_NODE_dup(sk)      \
   ((STACK_OF(X509_POLICY_NODE) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509_POLICY_NODE) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_POLICY_NODE) *, sk)))
 
 #define sk_X509_POLICY_NODE_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(X509_POLICY_NODE) *, sk))
 
 #define sk_X509_POLICY_NODE_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(X509_POLICY_NODE) *, sk))
+  sk_is_sorted(                           \
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_POLICY_NODE) *, sk))
 
 #define sk_X509_POLICY_NODE_set_cmp_func(sk, comp)                           \
   ((int (*)(const X509_POLICY_NODE **a, const X509_POLICY_NODE **b))         \
@@ -3188,14 +3229,14 @@
 #define sk_X509_PURPOSE_new_null() ((STACK_OF(X509_PURPOSE) *)sk_new_null())
 
 #define sk_X509_PURPOSE_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(X509_PURPOSE) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(X509_PURPOSE) *, sk))
 
 #define sk_X509_PURPOSE_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(X509_PURPOSE) *, sk));
 
 #define sk_X509_PURPOSE_value(sk, i) \
   ((X509_PURPOSE *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509_PURPOSE) *, sk), (i)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_PURPOSE) *, sk), (i)))
 
 #define sk_X509_PURPOSE_set(sk, i, p)                            \
   ((X509_PURPOSE *)sk_set(                                       \
@@ -3240,13 +3281,13 @@
 
 #define sk_X509_PURPOSE_dup(sk)      \
   ((STACK_OF(X509_PURPOSE) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509_PURPOSE) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_PURPOSE) *, sk)))
 
 #define sk_X509_PURPOSE_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(X509_PURPOSE) *, sk))
 
 #define sk_X509_PURPOSE_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(X509_PURPOSE) *, sk))
+  sk_is_sorted(CHECKED_CAST(const _STACK *, const STACK_OF(X509_PURPOSE) *, sk))
 
 #define sk_X509_PURPOSE_set_cmp_func(sk, comp)                               \
   ((int (*)(const X509_PURPOSE **a, const X509_PURPOSE **b))sk_set_cmp_func( \
@@ -3271,14 +3312,14 @@
 #define sk_X509_REVOKED_new_null() ((STACK_OF(X509_REVOKED) *)sk_new_null())
 
 #define sk_X509_REVOKED_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(X509_REVOKED) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(X509_REVOKED) *, sk))
 
 #define sk_X509_REVOKED_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(X509_REVOKED) *, sk));
 
 #define sk_X509_REVOKED_value(sk, i) \
   ((X509_REVOKED *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509_REVOKED) *, sk), (i)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_REVOKED) *, sk), (i)))
 
 #define sk_X509_REVOKED_set(sk, i, p)                            \
   ((X509_REVOKED *)sk_set(                                       \
@@ -3323,13 +3364,13 @@
 
 #define sk_X509_REVOKED_dup(sk)      \
   ((STACK_OF(X509_REVOKED) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509_REVOKED) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_REVOKED) *, sk)))
 
 #define sk_X509_REVOKED_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(X509_REVOKED) *, sk))
 
 #define sk_X509_REVOKED_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(X509_REVOKED) *, sk))
+  sk_is_sorted(CHECKED_CAST(const _STACK *, const STACK_OF(X509_REVOKED) *, sk))
 
 #define sk_X509_REVOKED_set_cmp_func(sk, comp)                               \
   ((int (*)(const X509_REVOKED **a, const X509_REVOKED **b))sk_set_cmp_func( \
@@ -3354,14 +3395,14 @@
 #define sk_X509_TRUST_new_null() ((STACK_OF(X509_TRUST) *)sk_new_null())
 
 #define sk_X509_TRUST_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(X509_TRUST) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(X509_TRUST) *, sk))
 
 #define sk_X509_TRUST_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(X509_TRUST) *, sk));
 
 #define sk_X509_TRUST_value(sk, i) \
   ((X509_TRUST *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509_TRUST) *, sk), (i)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_TRUST) *, sk), (i)))
 
 #define sk_X509_TRUST_set(sk, i, p)                                         \
   ((X509_TRUST *)sk_set(CHECKED_CAST(_STACK *, STACK_OF(X509_TRUST) *, sk), \
@@ -3404,13 +3445,13 @@
 
 #define sk_X509_TRUST_dup(sk)      \
   ((STACK_OF(X509_TRUST) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509_TRUST) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_TRUST) *, sk)))
 
 #define sk_X509_TRUST_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(X509_TRUST) *, sk))
 
 #define sk_X509_TRUST_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(X509_TRUST) *, sk))
+  sk_is_sorted(CHECKED_CAST(const _STACK *, const STACK_OF(X509_TRUST) *, sk))
 
 #define sk_X509_TRUST_set_cmp_func(sk, comp)                             \
   ((int (*)(const X509_TRUST **a, const X509_TRUST **b))sk_set_cmp_func( \
@@ -3437,14 +3478,15 @@
   ((STACK_OF(X509_VERIFY_PARAM) *)sk_new_null())
 
 #define sk_X509_VERIFY_PARAM_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(X509_VERIFY_PARAM) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(X509_VERIFY_PARAM) *, sk))
 
 #define sk_X509_VERIFY_PARAM_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(X509_VERIFY_PARAM) *, sk));
 
-#define sk_X509_VERIFY_PARAM_value(sk, i) \
-  ((X509_VERIFY_PARAM *)sk_value(         \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509_VERIFY_PARAM) *, sk), (i)))
+#define sk_X509_VERIFY_PARAM_value(sk, i)                                    \
+  ((X509_VERIFY_PARAM *)sk_value(                                            \
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_VERIFY_PARAM) *, sk), \
+      (i)))
 
 #define sk_X509_VERIFY_PARAM_set(sk, i, p)                            \
   ((X509_VERIFY_PARAM *)sk_set(                                       \
@@ -3490,13 +3532,14 @@
 
 #define sk_X509_VERIFY_PARAM_dup(sk)      \
   ((STACK_OF(X509_VERIFY_PARAM) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(X509_VERIFY_PARAM) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_VERIFY_PARAM) *, sk)))
 
 #define sk_X509_VERIFY_PARAM_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(X509_VERIFY_PARAM) *, sk))
 
 #define sk_X509_VERIFY_PARAM_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(X509_VERIFY_PARAM) *, sk))
+  sk_is_sorted(                            \
+      CHECKED_CAST(const _STACK *, const STACK_OF(X509_VERIFY_PARAM) *, sk))
 
 #define sk_X509_VERIFY_PARAM_set_cmp_func(sk, comp)                           \
   ((int (*)(const X509_VERIFY_PARAM **a, const X509_VERIFY_PARAM **b))        \
@@ -3515,21 +3558,23 @@
                    free_func)))
 
 /* void */
-#define sk_void_new(comp)                \
-  ((STACK_OF(void)*)sk_new(CHECKED_CAST( \
+#define sk_void_new(comp)                 \
+  ((STACK_OF(void) *)sk_new(CHECKED_CAST( \
       stack_cmp_func, int (*)(const void **a, const void **b), comp)))
 
-#define sk_void_new_null() ((STACK_OF(void)*)sk_new_null())
+#define sk_void_new_null() ((STACK_OF(void) *)sk_new_null())
 
-#define sk_void_num(sk) sk_num(CHECKED_CAST(_STACK *, STACK_OF(void) *, sk))
+#define sk_void_num(sk) \
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(void) *, sk))
 
 #define sk_void_zero(sk) sk_zero(CHECKED_CAST(_STACK *, STACK_OF(void) *, sk));
 
-#define sk_void_value(sk, i) \
-  ((void *)sk_value(CHECKED_CAST(_STACK *, const STACK_OF(void) *, sk), (i)))
+#define sk_void_value(sk, i)                                                  \
+  ((void *)sk_value(CHECKED_CAST(const _STACK *, const STACK_OF(void) *, sk), \
+                    (i)))
 
-#define sk_void_set(sk, i, p)                                       \
-  ((void *)sk_set(CHECKED_CAST(_STACK *, STACK_OF(void)*, sk), (i), \
+#define sk_void_set(sk, i, p)                                        \
+  ((void *)sk_set(CHECKED_CAST(_STACK *, STACK_OF(void) *, sk), (i), \
                   CHECKED_CAST(void *, void *, p)))
 
 #define sk_void_free(sk) sk_free(CHECKED_CAST(_STACK *, STACK_OF(void) *, sk))
@@ -3543,10 +3588,10 @@
             CHECKED_CAST(void *, void *, p), (where))
 
 #define sk_void_delete(sk, where) \
-  ((void *)sk_delete(CHECKED_CAST(_STACK *, STACK_OF(void)*, sk), (where)))
+  ((void *)sk_delete(CHECKED_CAST(_STACK *, STACK_OF(void) *, sk), (where)))
 
-#define sk_void_delete_ptr(sk, p)                                     \
-  ((void *)sk_delete_ptr(CHECKED_CAST(_STACK *, STACK_OF(void)*, sk), \
+#define sk_void_delete_ptr(sk, p)                                      \
+  ((void *)sk_delete_ptr(CHECKED_CAST(_STACK *, STACK_OF(void) *, sk), \
                          CHECKED_CAST(void *, void *, p)))
 
 #define sk_void_find(sk, out_index, p)                               \
@@ -3554,31 +3599,32 @@
           CHECKED_CAST(void *, void *, p))
 
 #define sk_void_shift(sk) \
-  ((void *)sk_shift(CHECKED_CAST(_STACK *, STACK_OF(void)*, sk)))
+  ((void *)sk_shift(CHECKED_CAST(_STACK *, STACK_OF(void) *, sk)))
 
 #define sk_void_push(sk, p)                             \
   sk_push(CHECKED_CAST(_STACK *, STACK_OF(void) *, sk), \
           CHECKED_CAST(void *, void *, p))
 
 #define sk_void_pop(sk) \
-  ((void *)sk_pop(CHECKED_CAST(_STACK *, STACK_OF(void)*, sk)))
+  ((void *)sk_pop(CHECKED_CAST(_STACK *, STACK_OF(void) *, sk)))
 
-#define sk_void_dup(sk) \
-  ((STACK_OF(void)*)sk_dup(CHECKED_CAST(_STACK *, const STACK_OF(void) *, sk)))
+#define sk_void_dup(sk)      \
+  ((STACK_OF(void) *)sk_dup( \
+      CHECKED_CAST(const _STACK *, const STACK_OF(void) *, sk)))
 
 #define sk_void_sort(sk) sk_sort(CHECKED_CAST(_STACK *, STACK_OF(void) *, sk))
 
 #define sk_void_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(void) *, sk))
+  sk_is_sorted(CHECKED_CAST(const _STACK *, const STACK_OF(void) *, sk))
 
 #define sk_void_set_cmp_func(sk, comp)                                      \
   ((int (*)(const void **a, const void **b))sk_set_cmp_func(                \
-      CHECKED_CAST(_STACK *, STACK_OF(void)*, sk),                          \
+      CHECKED_CAST(_STACK *, STACK_OF(void) *, sk),                         \
       CHECKED_CAST(stack_cmp_func, int (*)(const void **a, const void **b), \
                    comp)))
 
 #define sk_void_deep_copy(sk, copy_func, free_func)                  \
-  ((STACK_OF(void)*)sk_deep_copy(                                    \
+  ((STACK_OF(void) *)sk_deep_copy(                                   \
       CHECKED_CAST(const _STACK *, const STACK_OF(void) *, sk),      \
       CHECKED_CAST(void *(*)(void *), void *(*)(void *), copy_func), \
       CHECKED_CAST(void (*)(void *), void (*)(void *), free_func)))
@@ -3594,14 +3640,16 @@
   ((STACK_OF(SRTP_PROTECTION_PROFILE) *)sk_new_null())
 
 #define sk_SRTP_PROTECTION_PROFILE_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(SRTP_PROTECTION_PROFILE) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *,      \
+                      const STACK_OF(SRTP_PROTECTION_PROFILE) *, sk))
 
 #define sk_SRTP_PROTECTION_PROFILE_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(SRTP_PROTECTION_PROFILE) *, sk));
 
-#define sk_SRTP_PROTECTION_PROFILE_value(sk, i)                              \
-  ((const SRTP_PROTECTION_PROFILE *)sk_value(                                \
-      CHECKED_CAST(_STACK *, const STACK_OF(SRTP_PROTECTION_PROFILE) *, sk), \
+#define sk_SRTP_PROTECTION_PROFILE_value(sk, i)                               \
+  ((const SRTP_PROTECTION_PROFILE *)sk_value(                                 \
+      CHECKED_CAST(const _STACK *, const STACK_OF(SRTP_PROTECTION_PROFILE) *, \
+                   sk),                                                       \
       (i)))
 
 #define sk_SRTP_PROTECTION_PROFILE_set(sk, i, p)                            \
@@ -3649,16 +3697,16 @@
   ((const SRTP_PROTECTION_PROFILE *)sk_pop( \
       CHECKED_CAST(_STACK *, STACK_OF(SRTP_PROTECTION_PROFILE) *, sk)))
 
-#define sk_SRTP_PROTECTION_PROFILE_dup(sk)      \
-  ((STACK_OF(SRTP_PROTECTION_PROFILE) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(SRTP_PROTECTION_PROFILE) *, sk)))
+#define sk_SRTP_PROTECTION_PROFILE_dup(sk)                   \
+  ((STACK_OF(SRTP_PROTECTION_PROFILE) *)sk_dup(CHECKED_CAST( \
+      const _STACK *, const STACK_OF(SRTP_PROTECTION_PROFILE) *, sk)))
 
 #define sk_SRTP_PROTECTION_PROFILE_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(SRTP_PROTECTION_PROFILE) *, sk))
 
 #define sk_SRTP_PROTECTION_PROFILE_is_sorted(sk) \
-  sk_is_sorted(                                  \
-      CHECKED_CAST(_STACK *, const STACK_OF(SRTP_PROTECTION_PROFILE) *, sk))
+  sk_is_sorted(CHECKED_CAST(const _STACK *,      \
+                            const STACK_OF(SRTP_PROTECTION_PROFILE) *, sk))
 
 #define sk_SRTP_PROTECTION_PROFILE_set_cmp_func(sk, comp)                   \
   ((int (*)(const SRTP_PROTECTION_PROFILE **a,                              \
@@ -3670,14 +3718,15 @@
                                 const SRTP_PROTECTION_PROFILE **b),         \
                         comp)))
 
-#define sk_SRTP_PROTECTION_PROFILE_deep_copy(sk, copy_func, free_func)        \
-  ((STACK_OF(SRTP_PROTECTION_PROFILE) *)sk_deep_copy(                         \
-      CHECKED_CAST(const _STACK *, const STACK_OF(SRTP_PROTECTION_PROFILE) *, \
-                   sk),                                                       \
-      CHECKED_CAST(void *(*)(void *), const SRTP_PROTECTION_PROFILE *(*)(     \
-                                          const SRTP_PROTECTION_PROFILE *),   \
-                   copy_func),                                                \
-      CHECKED_CAST(void (*)(void *),                                          \
+#define sk_SRTP_PROTECTION_PROFILE_deep_copy(sk, copy_func, free_func)         \
+  ((STACK_OF(SRTP_PROTECTION_PROFILE) *)sk_deep_copy(                          \
+      CHECKED_CAST(const _STACK *, const STACK_OF(SRTP_PROTECTION_PROFILE) *,  \
+                   sk),                                                        \
+      CHECKED_CAST(                                                            \
+          void *(*)(void *),                                                   \
+          const SRTP_PROTECTION_PROFILE *(*)(const SRTP_PROTECTION_PROFILE *), \
+          copy_func),                                                          \
+      CHECKED_CAST(void (*)(void *),                                           \
                    void (*)(const SRTP_PROTECTION_PROFILE *), free_func)))
 
 /* SSL_CIPHER */
@@ -3689,14 +3738,14 @@
 #define sk_SSL_CIPHER_new_null() ((STACK_OF(SSL_CIPHER) *)sk_new_null())
 
 #define sk_SSL_CIPHER_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(SSL_CIPHER) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(SSL_CIPHER) *, sk))
 
 #define sk_SSL_CIPHER_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(SSL_CIPHER) *, sk));
 
 #define sk_SSL_CIPHER_value(sk, i) \
   ((const SSL_CIPHER *)sk_value(   \
-      CHECKED_CAST(_STACK *, const STACK_OF(SSL_CIPHER) *, sk), (i)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(SSL_CIPHER) *, sk), (i)))
 
 #define sk_SSL_CIPHER_set(sk, i, p)                            \
   ((const SSL_CIPHER *)sk_set(                                 \
@@ -3742,13 +3791,13 @@
 
 #define sk_SSL_CIPHER_dup(sk)      \
   ((STACK_OF(SSL_CIPHER) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(SSL_CIPHER) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(SSL_CIPHER) *, sk)))
 
 #define sk_SSL_CIPHER_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(SSL_CIPHER) *, sk))
 
 #define sk_SSL_CIPHER_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(SSL_CIPHER) *, sk))
+  sk_is_sorted(CHECKED_CAST(const _STACK *, const STACK_OF(SSL_CIPHER) *, sk))
 
 #define sk_SSL_CIPHER_set_cmp_func(sk, comp)                             \
   ((int (*)(const SSL_CIPHER **a, const SSL_CIPHER **b))sk_set_cmp_func( \
@@ -3774,14 +3823,15 @@
 #define sk_OPENSSL_STRING_new_null() ((STACK_OF(OPENSSL_STRING) *)sk_new_null())
 
 #define sk_OPENSSL_STRING_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(OPENSSL_STRING) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(OPENSSL_STRING) *, sk))
 
 #define sk_OPENSSL_STRING_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(OPENSSL_STRING) *, sk));
 
-#define sk_OPENSSL_STRING_value(sk, i) \
-  ((OPENSSL_STRING)sk_value(           \
-      CHECKED_CAST(_STACK *, const STACK_OF(OPENSSL_STRING) *, sk), (i)))
+#define sk_OPENSSL_STRING_value(sk, i)                                    \
+  ((OPENSSL_STRING)sk_value(                                              \
+      CHECKED_CAST(const _STACK *, const STACK_OF(OPENSSL_STRING) *, sk), \
+      (i)))
 
 #define sk_OPENSSL_STRING_set(sk, i, p)                            \
   ((OPENSSL_STRING)sk_set(                                         \
@@ -3827,13 +3877,14 @@
 
 #define sk_OPENSSL_STRING_dup(sk)      \
   ((STACK_OF(OPENSSL_STRING) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(OPENSSL_STRING) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(OPENSSL_STRING) *, sk)))
 
 #define sk_OPENSSL_STRING_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(OPENSSL_STRING) *, sk))
 
 #define sk_OPENSSL_STRING_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(OPENSSL_STRING) *, sk))
+  sk_is_sorted(                         \
+      CHECKED_CAST(const _STACK *, const STACK_OF(OPENSSL_STRING) *, sk))
 
 #define sk_OPENSSL_STRING_set_cmp_func(sk, comp)                           \
   ((int (*)(const OPENSSL_STRING **a, const OPENSSL_STRING **b))           \
@@ -3859,14 +3910,14 @@
 #define sk_OPENSSL_BLOCK_new_null() ((STACK_OF(OPENSSL_BLOCK) *)sk_new_null())
 
 #define sk_OPENSSL_BLOCK_num(sk) \
-  sk_num(CHECKED_CAST(_STACK *, STACK_OF(OPENSSL_BLOCK) *, sk))
+  sk_num(CHECKED_CAST(const _STACK *, const STACK_OF(OPENSSL_BLOCK) *, sk))
 
 #define sk_OPENSSL_BLOCK_zero(sk) \
   sk_zero(CHECKED_CAST(_STACK *, STACK_OF(OPENSSL_BLOCK) *, sk));
 
 #define sk_OPENSSL_BLOCK_value(sk, i) \
   ((OPENSSL_BLOCK)sk_value(           \
-      CHECKED_CAST(_STACK *, const STACK_OF(OPENSSL_BLOCK) *, sk), (i)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(OPENSSL_BLOCK) *, sk), (i)))
 
 #define sk_OPENSSL_BLOCK_set(sk, i, p)                            \
   ((OPENSSL_BLOCK)sk_set(                                         \
@@ -3911,13 +3962,14 @@
 
 #define sk_OPENSSL_BLOCK_dup(sk)      \
   ((STACK_OF(OPENSSL_BLOCK) *)sk_dup( \
-      CHECKED_CAST(_STACK *, const STACK_OF(OPENSSL_BLOCK) *, sk)))
+      CHECKED_CAST(const _STACK *, const STACK_OF(OPENSSL_BLOCK) *, sk)))
 
 #define sk_OPENSSL_BLOCK_sort(sk) \
   sk_sort(CHECKED_CAST(_STACK *, STACK_OF(OPENSSL_BLOCK) *, sk))
 
 #define sk_OPENSSL_BLOCK_is_sorted(sk) \
-  sk_is_sorted(CHECKED_CAST(_STACK *, const STACK_OF(OPENSSL_BLOCK) *, sk))
+  sk_is_sorted(                        \
+      CHECKED_CAST(const _STACK *, const STACK_OF(OPENSSL_BLOCK) *, sk))
 
 #define sk_OPENSSL_BLOCK_set_cmp_func(sk, comp)                                \
   ((int (*)(const OPENSSL_BLOCK **a, const OPENSSL_BLOCK **b))sk_set_cmp_func( \
diff --git a/src/include/openssl/thread.h b/src/include/openssl/thread.h
index ac4ced0..02539e8 100644
--- a/src/include/openssl/thread.h
+++ b/src/include/openssl/thread.h
@@ -73,10 +73,9 @@
 #elif defined(OPENSSL_WINDOWS)
 /* CRYPTO_MUTEX can appear in public header files so we really don't want to
  * pull in windows.h. It's statically asserted that this structure is large
- * enough to contain a Windows CRITICAL_SECTION by thread_win.c. */
+ * enough to contain a Windows SRWLOCK by thread_win.c. */
 typedef union crypto_mutex_st {
-  double alignment;
-  uint8_t padding[4*sizeof(void*) + 2*sizeof(int)];
+  void *handle;
 } CRYPTO_MUTEX;
 #elif defined(__MACH__) && defined(__APPLE__)
 typedef pthread_rwlock_t CRYPTO_MUTEX;
diff --git a/src/include/openssl/tls1.h b/src/include/openssl/tls1.h
index e0f1399..6ed9fa9 100644
--- a/src/include/openssl/tls1.h
+++ b/src/include/openssl/tls1.h
@@ -196,8 +196,10 @@
 /* ExtensionType values from RFC6091 */
 #define TLSEXT_TYPE_cert_type 9
 
+/* ExtensionType values from draft-ietf-tls-tls13-latest */
+#define TLSEXT_TYPE_supported_groups 10
+
 /* ExtensionType values from RFC4492 */
-#define TLSEXT_TYPE_elliptic_curves 10
 #define TLSEXT_TYPE_ec_point_formats 11
 
 /* ExtensionType value from RFC5054 */
@@ -439,6 +441,12 @@
 #define TLS1_CK_ECDHE_RSA_CHACHA20_POLY1305 \
   TLS1_CK_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
 
+/* CECPQ1 ciphersuites.  These are specific to BoringSSL and not standard. */
+#define TLS1_CK_CECPQ1_RSA_WITH_CHACHA20_POLY1305_SHA256 0x030016B7
+#define TLS1_CK_CECPQ1_ECDSA_WITH_CHACHA20_POLY1305_SHA256 0x030016B8
+#define TLS1_CK_CECPQ1_RSA_WITH_AES_256_GCM_SHA384 0x030016B9
+#define TLS1_CK_CECPQ1_ECDSA_WITH_AES_256_GCM_SHA384 0x030016BA
+
 /* XXX
  * Inconsistency alert:
  * The OpenSSL names of ciphers with ephemeral DH here include the string
@@ -619,6 +627,17 @@
 #define TLS1_TXT_ECDHE_RSA_WITH_CHACHA20_POLY1305 \
   TLS1_TXT_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
 
+/* CECPQ1 ciphersuites.  These are specific to BoringSSL and not standard. */
+#define TLS1_TXT_CECPQ1_RSA_WITH_CHACHA20_POLY1305_SHA256 \
+  "CECPQ1-RSA-CHACHA20-POLY1305-SHA256"
+#define TLS1_TXT_CECPQ1_ECDSA_WITH_CHACHA20_POLY1305_SHA256 \
+  "CECPQ1-ECDSA-CHACHA20-POLY1305-SHA256"
+#define TLS1_TXT_CECPQ1_RSA_WITH_AES_256_GCM_SHA384 \
+  "CECPQ1-RSA-AES256-GCM-SHA384"
+#define TLS1_TXT_CECPQ1_ECDSA_WITH_AES_256_GCM_SHA384 \
+  "CECPQ1-ECDSA-AES256-GCM-SHA384"
+
+
 #define TLS_CT_RSA_SIGN 1
 #define TLS_CT_DSS_SIGN 2
 #define TLS_CT_RSA_FIXED_DH 3