Delete a lot of #if 0 code in libressl.

There are a few instances where #if 1 is removed but the code remains.

Based on the following OpenSSL commits.  Some of the commits weren't
strictly deletions so they are going to be split up into separate commits.

6f91b017bbb7140f816721141ac156d1b828a6b3
3d47c1d331fdc7574d2275cda1a630ccdb624b08
dfb56425b68314b2b57e17c82c1df42e7a015132
c8fa2356a00cbaada8963f739e5570298311a060
f16a64d11f55c01f56baa62ebf1dec7f8fe718cb
9ccc00ef6ea65567622e40c49aca43f2c6d79cdb
02a938c953b3e1ced71d9a832de1618f907eb96d
75d0ebef2aef7a2c77b27575b8da898e22f3ccd5
d6fbb194095312f4722c81c9362dbd0de66cb656
6f1a93ad111c7dfe36a09a976c4c009079b19ea1
1a5adcfb5edfe23908b350f8757df405b0f5f71f
8de24b792743d11e1d5a0dcd336a49368750c577
a2b18e657ea1a932d125154f4e13ab2258796d90
8e964419603d2478dfb391c66e7ccb2dcc9776b4
32dfde107636ac9bc62a5b3233fe2a54dbc27008

input + ok jsing@, miod@, tedu@

90 files changed, 110 insertions, 1346 deletions

diff --git a/src/lib/libcrypto/asn1/a_gentm.c b/src/lib/libcrypto/asn1/a_gentm.c
index c658b1ea35..bc3453f410 100644
--- a/src/lib/libcrypto/asn1/a_gentm.c
+++ b/src/lib/libcrypto/asn1/a_gentm.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: a_gentm.c,v 1.22 2014/07/11 08:44:47 jsing Exp $ */
+/* $OpenBSD: a_gentm.c,v 1.23 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -67,43 +67,6 @@
 
 #include "o_time.h"
 
-#if 0
-
-int
-i2d_ASN1_GENERALIZEDTIME(ASN1_GENERALIZEDTIME *a, unsigned char **pp)
-{
-        return(i2d_ASN1_bytes((ASN1_STRING *)a, pp,
-            V_ASN1_GENERALIZEDTIME, V_ASN1_UNIVERSAL));
-}
-
-
-ASN1_GENERALIZEDTIME *
-d2i_ASN1_GENERALIZEDTIME(ASN1_GENERALIZEDTIME **a, unsigned char **pp,
-    long length)
-{
-        ASN1_GENERALIZEDTIME *ret = NULL;
-
-        ret = (ASN1_GENERALIZEDTIME *)d2i_ASN1_bytes((ASN1_STRING **)a, pp, length,
-            V_ASN1_GENERALIZEDTIME, V_ASN1_UNIVERSAL);
-        if (ret == NULL) {
-                ASN1err(ASN1_F_D2I_ASN1_GENERALIZEDTIME, ERR_R_NESTED_ASN1_ERROR);
-                return (NULL);
-        }
-        if (!ASN1_GENERALIZEDTIME_check(ret)) {
-                ASN1err(ASN1_F_D2I_ASN1_GENERALIZEDTIME, ASN1_R_INVALID_TIME_FORMAT);
-                goto err;
-        }
-
-        return (ret);
-
-err:
-        if ((ret != NULL) && ((a == NULL) || (*a != ret)))
-                M_ASN1_GENERALIZEDTIME_free(ret);
-        return (NULL);
-}
-
-#endif
-
 int
 ASN1_GENERALIZEDTIME_check(ASN1_GENERALIZEDTIME *d)
 {
diff --git a/src/lib/libcrypto/asn1/a_strex.c b/src/lib/libcrypto/asn1/a_strex.c
index b592c0e18a..f60a70d94d 100644
--- a/src/lib/libcrypto/asn1/a_strex.c
+++ b/src/lib/libcrypto/asn1/a_strex.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: a_strex.c,v 1.24 2014/07/11 08:44:47 jsing Exp $ */
+/* $OpenBSD: a_strex.c,v 1.25 2015/02/07 13:19:15 doug Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -84,20 +84,6 @@
 /* Three IO functions for sending data to memory, a BIO and
  * and a FILE pointer.
  */
-#if 0                           /* never used */
-static int
-send_mem_chars(void *arg, const void *buf, int len)
-{
-        unsigned char **out = arg;
-
-        if (!out)
-                return 1;
-        memcpy(*out, buf, len);
-        *out += len;
-        return 1;
-}
-#endif
-
 static int
 send_bio_chars(void *arg, const void *buf, int len)
 {
diff --git a/src/lib/libcrypto/asn1/a_time.c b/src/lib/libcrypto/asn1/a_time.c
index 94e249960a..c5e882a4f6 100644
--- a/src/lib/libcrypto/asn1/a_time.c
+++ b/src/lib/libcrypto/asn1/a_time.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: a_time.c,v 1.21 2014/07/11 08:44:47 jsing Exp $ */
+/* $OpenBSD: a_time.c,v 1.22 2015/02/07 13:19:15 doug Exp $ */
 /* ====================================================================
  * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
  *
@@ -73,18 +73,6 @@ IMPLEMENT_ASN1_MSTRING(ASN1_TIME, B_ASN1_TIME)
 
 IMPLEMENT_ASN1_FUNCTIONS(ASN1_TIME)
 
-#if 0
-int
-i2d_ASN1_TIME(ASN1_TIME *a, unsigned char **pp)
-{
-        if (a->type == V_ASN1_UTCTIME || a->type == V_ASN1_GENERALIZEDTIME)
-                return(i2d_ASN1_bytes((ASN1_STRING *)a, pp,
-                    a->type, V_ASN1_UNIVERSAL));
-        ASN1err(ASN1_F_I2D_ASN1_TIME, ASN1_R_EXPECTING_A_TIME);
-        return -1;
-}
-#endif
-
 ASN1_TIME *
 ASN1_TIME_set(ASN1_TIME *s, time_t t)
 {
diff --git a/src/lib/libcrypto/asn1/asn1_lib.c b/src/lib/libcrypto/asn1/asn1_lib.c
index 2b952abae6..46de52a050 100644
--- a/src/lib/libcrypto/asn1/asn1_lib.c
+++ b/src/lib/libcrypto/asn1/asn1_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: asn1_lib.c,v 1.32 2014/07/11 14:49:12 miod Exp $ */
+/* $OpenBSD: asn1_lib.c,v 1.33 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -140,12 +140,6 @@ ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
         if (inf && !(ret & V_ASN1_CONSTRUCTED))
                 goto err;
 
-#if 0
-        fprintf(stderr, "p=%d + *plength=%ld > omax=%ld + *pp=%d  (%d > %d)\n",
-            (int)p, *plength, omax, (int)*pp, (int)(p+ *plength),
-            (int)(omax+ *pp));
-
-#endif
         if (*plength > (omax - (p - *pp))) {
                 ASN1err(ASN1_F_ASN1_GET_OBJECT, ASN1_R_TOO_LONG);
                 /* Set this so that even if things are not long enough
diff --git a/src/lib/libcrypto/asn1/asn1_par.c b/src/lib/libcrypto/asn1/asn1_par.c
index 2c8062bb8a..b5742fe97d 100644
--- a/src/lib/libcrypto/asn1/asn1_par.c
+++ b/src/lib/libcrypto/asn1/asn1_par.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: asn1_par.c,v 1.21 2014/10/03 06:02:38 doug Exp $ */
+/* $OpenBSD: asn1_par.c,v 1.22 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -126,11 +126,7 @@ asn1_parse2(BIO *bp, const unsigned char **pp, long length, int offset,
         /* ASN1_BMPSTRING *bmp=NULL;*/
         int dump_indent;
 
-#if 0
-        dump_indent = indent;
-#else
         dump_indent = 6;        /* Because we know BIO_dump_indent() */
-#endif
         p = *pp;
         tot = p + length;
         op = p - 1;
diff --git a/src/lib/libcrypto/asn1/t_x509.c b/src/lib/libcrypto/asn1/t_x509.c
index f4872d8b24..1c83fc5608 100644
--- a/src/lib/libcrypto/asn1/t_x509.c
+++ b/src/lib/libcrypto/asn1/t_x509.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: t_x509.c,v 1.25 2014/07/12 16:33:25 miod Exp $ */
+/* $OpenBSD: t_x509.c,v 1.26 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -172,14 +172,6 @@ X509_print_ex(BIO *bp, X509 *x, unsigned long nmflags, unsigned long cflag)
         if (!(cflag & X509_FLAG_NO_SIGNAME)) {
                 if (X509_signature_print(bp, x->sig_alg, NULL) <= 0)
                         goto err;
-#if 0
-                if (BIO_printf(bp, "%8sSignature Algorithm: ", "") <= 0)
-                        goto err;
-                if (i2a_ASN1_OBJECT(bp, ci->signature->algorithm) <= 0)
-                        goto err;
-                if (BIO_puts(bp, "\n") <= 0)
-                        goto err;
-#endif
         }
 
         if (!(cflag & X509_FLAG_NO_ISSUER)) {
diff --git a/src/lib/libcrypto/asn1/tasn_prn.c b/src/lib/libcrypto/asn1/tasn_prn.c
index 9383750a82..844960fc77 100644
--- a/src/lib/libcrypto/asn1/tasn_prn.c
+++ b/src/lib/libcrypto/asn1/tasn_prn.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tasn_prn.c,v 1.11 2014/07/11 08:44:47 jsing Exp $ */
+/* $OpenBSD: tasn_prn.c,v 1.12 2015/02/07 13:19:15 doug Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -260,11 +260,6 @@ asn1_item_print_ctx(BIO *out, ASN1_VALUE **fld, int indent, const ASN1_ITEM *it,
                 break;
 
         case ASN1_ITYPE_CHOICE:
-#if 0
-                if (!nohdr &&
-                    !asn1_print_fsname(out, indent, fname, sname, pctx))
-                        return 0;
-#endif
                 /* CHOICE type, get selector */
                 i = asn1_get_choice_selector(fld, it);
                 /* This should never happen... */
@@ -395,11 +390,6 @@ asn1_print_fsname(BIO *out, int indent, const char *fname, const char *sname,
         static char spaces[] = "                    ";
         const int nspaces = sizeof(spaces) - 1;
 
-#if 0
-        if (!sname && !fname)
-                return 1;
-#endif
-
         while (indent > nspaces) {
                 if (BIO_write(out, spaces, nspaces) != nspaces)
                         return 0;
diff --git a/src/lib/libcrypto/bio/bf_nbio.c b/src/lib/libcrypto/bio/bf_nbio.c
index a86feb49c2..24e2e7e8b9 100644
--- a/src/lib/libcrypto/bio/bf_nbio.c
+++ b/src/lib/libcrypto/bio/bf_nbio.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: bf_nbio.c,v 1.18 2014/10/22 13:02:03 jsing Exp $ */
+/* $OpenBSD: bf_nbio.c,v 1.19 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -130,10 +130,8 @@ static int
 nbiof_read(BIO *b, char *out, int outl)
 {
         int ret = 0;
-#if 1
         int num;
         unsigned char n;
-#endif
 
         if (out == NULL)
                 return (0);
@@ -141,7 +139,7 @@ nbiof_read(BIO *b, char *out, int outl)
                 return (0);
 
         BIO_clear_retry_flags(b);
-#if 1
+
         arc4random_buf(&n, 1);
         num = (n & 0x07);
 
@@ -151,9 +149,7 @@ nbiof_read(BIO *b, char *out, int outl)
         if (num == 0) {
                 ret = -1;
                 BIO_set_retry_read(b);
-        } else
-#endif
-        {
+        } else {
                 ret = BIO_read(b->next_bio, out, outl);
                 if (ret < 0)
                         BIO_copy_next_retry(b);
@@ -177,7 +173,6 @@ nbiof_write(BIO *b, const char *in, int inl)
 
         BIO_clear_retry_flags(b);
 
-#if 1
         if (nt->lwn > 0) {
                 num = nt->lwn;
                 nt->lwn = 0;
@@ -192,9 +187,7 @@ nbiof_write(BIO *b, const char *in, int inl)
         if (num == 0) {
                 ret = -1;
                 BIO_set_retry_write(b);
-        } else
-#endif
-        {
+        } else {
                 ret = BIO_write(b->next_bio, in, inl);
                 if (ret < 0) {
                         BIO_copy_next_retry(b);
diff --git a/src/lib/libcrypto/bn/bn.h b/src/lib/libcrypto/bn/bn.h
index 10414dc339..d93c9fc059 100644
--- a/src/lib/libcrypto/bn/bn.h
+++ b/src/lib/libcrypto/bn/bn.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: bn.h,v 1.25 2014/10/22 13:02:04 jsing Exp $ */
+/* $OpenBSD: bn.h,v 1.26 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1997 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -241,17 +241,6 @@ extern "C" {
                                                  |  BN_FLG_STATIC_DATA \
                                                  |  (n)))
 
-/* Already declared in ossl_typ.h */
-#if 0
-typedef struct bignum_st BIGNUM;
-/* Used for temp variables (declaration hidden in bn_lcl.h) */
-typedef struct bignum_ctx BN_CTX;
-typedef struct bn_blinding_st BN_BLINDING;
-typedef struct bn_mont_ctx_st BN_MONT_CTX;
-typedef struct bn_recp_ctx_st BN_RECP_CTX;
-typedef struct bn_gencb_st BN_GENCB;
-#endif
-
 struct bignum_st {
         BN_ULONG *d;    /* Pointer to an array of 'BN_BITS2' bit chunks. */
         int top;        /* Index of last used d +1. */
diff --git a/src/lib/libcrypto/conf/conf.h b/src/lib/libcrypto/conf/conf.h
index ba7fb69794..095066d31b 100644
--- a/src/lib/libcrypto/conf/conf.h
+++ b/src/lib/libcrypto/conf/conf.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: conf.h,v 1.13 2014/06/12 15:49:28 deraadt Exp $ */
+/* $OpenBSD: conf.h,v 1.14 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -149,9 +149,6 @@ struct conf_st {
 CONF *NCONF_new(CONF_METHOD *meth);
 CONF_METHOD *NCONF_default(void);
 CONF_METHOD *NCONF_WIN32(void);
-#if 0 /* Just to give you an idea of what I have in mind */
-CONF_METHOD *NCONF_XML(void);
-#endif
 void NCONF_free(CONF *conf);
 void NCONF_free_data(CONF *conf);
 
@@ -165,12 +162,7 @@ int NCONF_get_number_e(const CONF *conf, const char *group, const char *name,
 int NCONF_dump_fp(const CONF *conf, FILE *out);
 int NCONF_dump_bio(const CONF *conf, BIO *out);
 
-#if 0 /* The following function has no error checking,
-         and should therefore be avoided */
-long NCONF_get_number(CONF *conf, char *group, char *name);
-#else
 #define NCONF_get_number(c,g,n,r) NCONF_get_number_e(c,g,n,r)
-#endif
 
 /* Module functions */
 
diff --git a/src/lib/libcrypto/conf/conf_api.c b/src/lib/libcrypto/conf/conf_api.c
index 7480dda3d5..56a4f249ad 100644
--- a/src/lib/libcrypto/conf/conf_api.c
+++ b/src/lib/libcrypto/conf/conf_api.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: conf_api.c,v 1.11 2014/06/23 22:19:02 deraadt Exp $ */
+/* $OpenBSD: conf_api.c,v 1.12 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -165,28 +165,6 @@ _CONF_get_string(const CONF *conf, const char *section, const char *name)
         }
 }
 
-#if 0 /* There's no way to provide error checking with this function, so
-         force implementors of the higher levels to get a string and read
-         the number themselves. */
-long
-_CONF_get_number(CONF *conf, char *section, char *name)
-{
-        char *str;
-        long ret = 0;
-
-        str = _CONF_get_string(conf, section, name);
-        if (str == NULL)
-                return (0);
-        for (;;) {
-                if (conf->meth->is_number(conf, *str))
-                        ret = ret * 10 + conf->meth->to_int(conf, *str);
-                else
-                        return (ret);
-                str++;
-        }
-}
-#endif
-
 static unsigned long
 conf_value_hash(const CONF_VALUE *v)
 {
diff --git a/src/lib/libcrypto/conf/conf_def.c b/src/lib/libcrypto/conf/conf_def.c
index c437aeb457..e608e5fe9d 100644
--- a/src/lib/libcrypto/conf/conf_def.c
+++ b/src/lib/libcrypto/conf/conf_def.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: conf_def.c,v 1.28 2014/07/11 15:38:03 miod Exp $ */
+/* $OpenBSD: conf_def.c,v 1.29 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -388,27 +388,12 @@ again:
                                 }
                         } else
                                 tv = sv;
-#if 1
+
                         if (_CONF_add_string(conf, tv, v) == 0) {
                                 CONFerr(CONF_F_DEF_LOAD_BIO,
                                     ERR_R_MALLOC_FAILURE);
                                 goto err;
                         }
-#else
-                        v->section = tv->section;
-                        if (!sk_CONF_VALUE_push(ts, v)) {
-                                CONFerr(CONF_F_DEF_LOAD_BIO,
-                                    ERR_R_MALLOC_FAILURE);
-                                goto err;
-                        }
-                        vv = (CONF_VALUE *)lh_insert(conf->data, v);
-                        if (vv != NULL) {
-                                sk_CONF_VALUE_delete_ptr(ts, vv);
-                                free(vv->name);
-                                free(vv->value);
-                                free(vv);
-                        }
-#endif
                         v = NULL;
                 }
         }
diff --git a/src/lib/libcrypto/conf/conf_lib.c b/src/lib/libcrypto/conf/conf_lib.c
index 2119eb6219..a7c8be7c0d 100644
--- a/src/lib/libcrypto/conf/conf_lib.c
+++ b/src/lib/libcrypto/conf/conf_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: conf_lib.c,v 1.12 2014/07/09 11:10:50 bcook Exp $ */
+/* $OpenBSD: conf_lib.c,v 1.13 2015/02/07 13:19:15 doug Exp $ */
 /* Written by Richard Levitte (richard@levitte.org) for the OpenSSL
  * project 2000.
  */
@@ -373,21 +373,3 @@ NCONF_dump_bio(const CONF *conf, BIO *out)
 
         return conf->meth->dump(conf, out);
 }
-
-
-/* This function should be avoided */
-#if 0
-long
-NCONF_get_number(CONF *conf, char *group, char *name)
-{
-        int status;
-        long ret = 0;
-
-        status = NCONF_get_number_e(conf, group, name, &ret);
-        if (status == 0) {
-                /* This function does not believe in errors... */
-                ERR_get_error();
-        }
-        return ret;
-}
-#endif
diff --git a/src/lib/libcrypto/crypto.h b/src/lib/libcrypto/crypto.h
index 5cb1dda021..27b7f3fe02 100644
--- a/src/lib/libcrypto/crypto.h
+++ b/src/lib/libcrypto/crypto.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: crypto.h,v 1.32 2014/07/10 22:45:56 jsing Exp $ */
+/* $OpenBSD: crypto.h,v 1.33 2015/02/07 13:19:15 doug Exp $ */
 /* ====================================================================
  * Copyright (c) 1998-2006 The OpenSSL Project.  All rights reserved.
  *
@@ -142,20 +142,6 @@ extern "C" {
 #define SSLEAY_PLATFORM         4
 #define SSLEAY_DIR              5
 
-/* Already declared in ossl_typ.h */
-#if 0
-typedef struct crypto_ex_data_st CRYPTO_EX_DATA;
-/* Called when a new object is created */
-typedef int CRYPTO_EX_new(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
-    int idx, long argl, void *argp);
-/* Called when an object is free()ed */
-typedef void CRYPTO_EX_free(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
-    int idx, long argl, void *argp);
-/* Called when we need to dup an object */
-typedef int CRYPTO_EX_dup(CRYPTO_EX_DATA *to, CRYPTO_EX_DATA *from,
-    void *from_d, int idx, long argl, void *argp);
-#endif
-
 /* A generic structure to pass assorted data in a expandable way */
 typedef struct openssl_item_st {
         int code;
diff --git a/src/lib/libcrypto/des/cfb64ede.c b/src/lib/libcrypto/des/cfb64ede.c
index 0b5c7d6249..6d4d287775 100644
--- a/src/lib/libcrypto/des/cfb64ede.c
+++ b/src/lib/libcrypto/des/cfb64ede.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cfb64ede.c,v 1.8 2014/10/28 07:35:58 jsg Exp $ */
+/* $OpenBSD: cfb64ede.c,v 1.9 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -132,15 +132,6 @@ void DES_ede3_cfb64_encrypt(const unsigned char *in, unsigned char *out,
         *num=n;
         }
 
-#ifdef undef /* MACRO */
-void DES_ede2_cfb64_encrypt(unsigned char *in, unsigned char *out, long length,
-             DES_key_schedule ks1, DES_key_schedule ks2, DES_cblock (*ivec),
-             int *num, int enc)
-        {
-        DES_ede3_cfb64_encrypt(in,out,length,ks1,ks2,ks1,ivec,num,enc);
-        }
-#endif
-
 /* This is compatible with the single key CFB-r for DES, even thought that's
  * not what EVP needs.
  */
diff --git a/src/lib/libcrypto/des/des.h b/src/lib/libcrypto/des/des.h
index e7585bc3d9..e1331d3fa2 100644
--- a/src/lib/libcrypto/des/des.h
+++ b/src/lib/libcrypto/des/des.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: des.h,v 1.18 2014/06/12 15:49:28 deraadt Exp $ */
+/* $OpenBSD: des.h,v 1.19 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1997 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -178,11 +178,6 @@ void DES_ede3_ofb64_encrypt(const unsigned char *in,unsigned char *out,
                             long length,DES_key_schedule *ks1,
                             DES_key_schedule *ks2,DES_key_schedule *ks3,
                             DES_cblock *ivec,int *num);
-#if 0
-void DES_xwhite_in2out(const_DES_cblock *DES_key,const_DES_cblock *in_white,
-                       DES_cblock *out_white);
-#endif
-
 int DES_enc_read(int fd,void *buf,int len,DES_key_schedule *sched,
                  DES_cblock *iv);
 int DES_enc_write(int fd,const void *buf,int len,DES_key_schedule *sched,
diff --git a/src/lib/libcrypto/des/ofb64ede.c b/src/lib/libcrypto/des/ofb64ede.c
index 1d916e9305..474d38caaf 100644
--- a/src/lib/libcrypto/des/ofb64ede.c
+++ b/src/lib/libcrypto/des/ofb64ede.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ofb64ede.c,v 1.5 2014/10/28 07:35:58 jsg Exp $ */
+/* $OpenBSD: ofb64ede.c,v 1.6 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -105,8 +105,6 @@ void DES_ede3_ofb64_encrypt(const unsigned char *in,
                 }
         if (save)
                 {
-/*              v0=ti[0];
-                v1=ti[1];*/
                 iv = &(*ivec)[0];
                 l2c(v0,iv);
                 l2c(v1,iv);
@@ -114,12 +112,3 @@ void DES_ede3_ofb64_encrypt(const unsigned char *in,
         v0=v1=ti[0]=ti[1]=0;
         *num=n;
         }
-
-#ifdef undef /* MACRO */
-void DES_ede2_ofb64_encrypt(unsigned char *in,
-             unsigned char *out, long length, DES_key_schedule k1,
-             DES_key_schedule k2, DES_cblock (*ivec), int *num)
-        {
-        DES_ede3_ofb64_encrypt(in, out, length, k1,k2,k1, ivec, num);
-        }
-#endif
diff --git a/src/lib/libcrypto/des/xcbc_enc.c b/src/lib/libcrypto/des/xcbc_enc.c
index dc4607e8aa..4f7a070103 100644
--- a/src/lib/libcrypto/des/xcbc_enc.c
+++ b/src/lib/libcrypto/des/xcbc_enc.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: xcbc_enc.c,v 1.8 2014/10/28 07:35:58 jsg Exp $ */
+/* $OpenBSD: xcbc_enc.c,v 1.9 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -60,55 +60,6 @@
 
 /* RSA's DESX */
 
-#if 0 /* broken code, preserved just in case anyone specifically looks for this */
-static const unsigned char desx_white_in2out[256]={
-0xBD,0x56,0xEA,0xF2,0xA2,0xF1,0xAC,0x2A,0xB0,0x93,0xD1,0x9C,0x1B,0x33,0xFD,0xD0,
-0x30,0x04,0xB6,0xDC,0x7D,0xDF,0x32,0x4B,0xF7,0xCB,0x45,0x9B,0x31,0xBB,0x21,0x5A,
-0x41,0x9F,0xE1,0xD9,0x4A,0x4D,0x9E,0xDA,0xA0,0x68,0x2C,0xC3,0x27,0x5F,0x80,0x36,
-0x3E,0xEE,0xFB,0x95,0x1A,0xFE,0xCE,0xA8,0x34,0xA9,0x13,0xF0,0xA6,0x3F,0xD8,0x0C,
-0x78,0x24,0xAF,0x23,0x52,0xC1,0x67,0x17,0xF5,0x66,0x90,0xE7,0xE8,0x07,0xB8,0x60,
-0x48,0xE6,0x1E,0x53,0xF3,0x92,0xA4,0x72,0x8C,0x08,0x15,0x6E,0x86,0x00,0x84,0xFA,
-0xF4,0x7F,0x8A,0x42,0x19,0xF6,0xDB,0xCD,0x14,0x8D,0x50,0x12,0xBA,0x3C,0x06,0x4E,
-0xEC,0xB3,0x35,0x11,0xA1,0x88,0x8E,0x2B,0x94,0x99,0xB7,0x71,0x74,0xD3,0xE4,0xBF,
-0x3A,0xDE,0x96,0x0E,0xBC,0x0A,0xED,0x77,0xFC,0x37,0x6B,0x03,0x79,0x89,0x62,0xC6,
-0xD7,0xC0,0xD2,0x7C,0x6A,0x8B,0x22,0xA3,0x5B,0x05,0x5D,0x02,0x75,0xD5,0x61,0xE3,
-0x18,0x8F,0x55,0x51,0xAD,0x1F,0x0B,0x5E,0x85,0xE5,0xC2,0x57,0x63,0xCA,0x3D,0x6C,
-0xB4,0xC5,0xCC,0x70,0xB2,0x91,0x59,0x0D,0x47,0x20,0xC8,0x4F,0x58,0xE0,0x01,0xE2,
-0x16,0x38,0xC4,0x6F,0x3B,0x0F,0x65,0x46,0xBE,0x7E,0x2D,0x7B,0x82,0xF9,0x40,0xB5,
-0x1D,0x73,0xF8,0xEB,0x26,0xC7,0x87,0x97,0x25,0x54,0xB1,0x28,0xAA,0x98,0x9D,0xA5,
-0x64,0x6D,0x7A,0xD4,0x10,0x81,0x44,0xEF,0x49,0xD6,0xAE,0x2E,0xDD,0x76,0x5C,0x2F,
-0xA7,0x1C,0xC9,0x09,0x69,0x9A,0x83,0xCF,0x29,0x39,0xB9,0xE9,0x4C,0xFF,0x43,0xAB,
-        };
-
-void DES_xwhite_in2out(const_DES_cblock *des_key, const_DES_cblock *in_white,
-             DES_cblock *out_white)
-        {
-        int out0,out1;
-        int i;
-        const unsigned char *key = &(*des_key)[0];
-        const unsigned char *in = &(*in_white)[0];
-        unsigned char *out = &(*out_white)[0];
-
-        out[0]=out[1]=out[2]=out[3]=out[4]=out[5]=out[6]=out[7]=0;
-        out0=out1=0;
-        for (i=0; i<8; i++)
-                {
-                out[i]=key[i]^desx_white_in2out[out0^out1];
-                out0=out1;
-                out1=(int)out[i&0x07];
-                }
-
-        out0=out[0];
-        out1=out[i]; /* BUG: out-of-bounds read */
-        for (i=0; i<8; i++)
-                {
-                out[i]=in[i]^desx_white_in2out[out0^out1];
-                out0=out1;
-                out1=(int)out[i&0x07];
-                }
-        }
-#endif
-
 void DES_xcbc_encrypt(const unsigned char *in, unsigned char *out,
                       long length, DES_key_schedule *schedule,
                       DES_cblock *ivec, const_DES_cblock *inw,
diff --git a/src/lib/libcrypto/dh/dh_check.c b/src/lib/libcrypto/dh/dh_check.c
index 0f6c50b055..93e1003bd6 100644
--- a/src/lib/libcrypto/dh/dh_check.c
+++ b/src/lib/libcrypto/dh/dh_check.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh_check.c,v 1.14 2014/07/12 16:03:37 miod Exp $ */
+/* $OpenBSD: dh_check.c,v 1.15 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -91,12 +91,6 @@ DH_check(const DH *dh, int *ret)
                 l = BN_mod_word(dh->p, 24);
                 if (l != 11)
                         *ret |= DH_NOT_SUITABLE_GENERATOR;
-#if 0
-        } else if (BN_is_word(dh->g, DH_GENERATOR_3)) {
-                l = BN_mod_word(dh->p, 12);
-                if (l != 5)
-                        *ret |= DH_NOT_SUITABLE_GENERATOR;
-#endif
         } else if (BN_is_word(dh->g, DH_GENERATOR_5)) {
                 l = BN_mod_word(dh->p, 10);
                 if (l != 3 && l != 7)
diff --git a/src/lib/libcrypto/dh/dh_gen.c b/src/lib/libcrypto/dh/dh_gen.c
index 6a884eff9e..1bc37b987e 100644
--- a/src/lib/libcrypto/dh/dh_gen.c
+++ b/src/lib/libcrypto/dh/dh_gen.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh_gen.c,v 1.13 2014/07/11 08:44:48 jsing Exp $ */
+/* $OpenBSD: dh_gen.c,v 1.14 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -136,14 +136,6 @@ dh_builtin_genparams(DH *ret, int prime_len, int generator, BN_GENCB *cb)
                 if (!BN_set_word(t2, 11))
                         goto err;
                 g = 2;
-#if 0 /* does not work for safe primes */
-        } else if (generator == DH_GENERATOR_3) {
-                if (!BN_set_word(t1, 12))
-                        goto err;
-                if (!BN_set_word(t2, 5))
-                        goto err;
-                g = 3;
-#endif
         } else if (generator == DH_GENERATOR_5) {
                 if (!BN_set_word(t1, 10))
                         goto err;
diff --git a/src/lib/libcrypto/dso/dso.h b/src/lib/libcrypto/dso/dso.h
index 52d391c0a4..42de08089e 100644
--- a/src/lib/libcrypto/dso/dso.h
+++ b/src/lib/libcrypto/dso/dso.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: dso.h,v 1.10 2014/08/14 17:55:28 tobias Exp $ */
+/* $OpenBSD: dso.h,v 1.11 2015/02/07 13:19:15 doug Exp $ */
 /* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
  * project 2000.
  */
@@ -149,13 +149,6 @@ typedef struct dso_meth_st {
          * alone a DSO_METHOD implemented for them. */
         DSO_FUNC_TYPE (*dso_bind_func)(DSO *dso, const char *symname);
 
-/* I don't think this would actually be used in any circumstances. */
-#if 0
-        /* Unbinds a variable */
-        int (*dso_unbind_var)(DSO *dso, char *symname, void *symptr);
-        /* Unbinds a function */
-        int (*dso_unbind_func)(DSO *dso, char *symname, DSO_FUNC_TYPE symptr);
-#endif
         /* The generic (yuck) "ctrl()" function. NB: Negative return
          * values (rather than zero) indicate errors. */
         long (*dso_ctrl)(DSO *dso, int cmd, long larg, void *parg);
@@ -309,9 +302,6 @@ int DSO_pathbyaddr(void *addr, char *path, int sz);
  * itself or libsocket. */
 void *DSO_global_lookup(const char *name);
 
-/* If BeOS is defined, use shared images. If not, return NULL. */
-DSO_METHOD *DSO_METHOD_beos(void);
-
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
  * made after this point may be overwritten when the script is next run.
diff --git a/src/lib/libcrypto/dso/dso_dlfcn.c b/src/lib/libcrypto/dso/dso_dlfcn.c
index b75c9e23e0..f22e641bab 100644
--- a/src/lib/libcrypto/dso/dso_dlfcn.c
+++ b/src/lib/libcrypto/dso/dso_dlfcn.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dso_dlfcn.c,v 1.27 2014/07/11 08:44:48 jsing Exp $ */
+/* $OpenBSD: dso_dlfcn.c,v 1.28 2015/02/07 13:19:15 doug Exp $ */
 /* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
  * project 2000.
  */
@@ -82,12 +82,6 @@ static int dlfcn_load(DSO *dso);
 static int dlfcn_unload(DSO *dso);
 static void *dlfcn_bind_var(DSO *dso, const char *symname);
 static DSO_FUNC_TYPE dlfcn_bind_func(DSO *dso, const char *symname);
-#if 0
-static int dlfcn_unbind(DSO *dso, char *symname, void *symptr);
-static int dlfcn_init(DSO *dso);
-static int dlfcn_finish(DSO *dso);
-static long dlfcn_ctrl(DSO *dso, int cmd, long larg, void *parg);
-#endif
 static char *dlfcn_name_converter(DSO *dso, const char *filename);
 static char *dlfcn_merger(DSO *dso, const char *filespec1,
     const char *filespec2);
diff --git a/src/lib/libcrypto/ec/ec_curve.c b/src/lib/libcrypto/ec/ec_curve.c
index 6490cd9d84..df49089bb6 100644
--- a/src/lib/libcrypto/ec/ec_curve.c
+++ b/src/lib/libcrypto/ec/ec_curve.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_curve.c,v 1.9 2014/11/12 18:21:07 miod Exp $ */
+/* $OpenBSD: ec_curve.c,v 1.10 2015/02/07 13:19:15 doug Exp $ */
 /*
  * Written by Nils Larsch for the OpenSSL project.
  */
@@ -1008,13 +1008,6 @@ static const struct {
                 NID_X9_62_characteristic_two_field, 0, 21, 2
         },
         {                       /* no seed */
-#if 0
-/* The algorithm used to derive the curve parameters from
- * the seed used here is slightly different than the
- * algorithm described in X9.62 . */
-                0x24, 0xB7, 0xB1, 0x37, 0xC8, 0xA1, 0x4D, 0x69, 0x6E, 0x67,
-                0x68, 0x75, 0x61, 0x51, 0x75, 0x6F, 0xD0, 0xDA, 0x2E, 0x5C,
-#endif
                 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,     /* p */
                 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                 0xC9,
@@ -1045,12 +1038,6 @@ static const struct {
                 NID_X9_62_characteristic_two_field, 0, 21, 2
         },
         {                       /* no seed */
-#if 0
-/* The seed here was used to created the curve parameters in normal
- * basis representation (and not the polynomial representation used here) */
-                0x85, 0xE2, 0x5B, 0xFE, 0x5C, 0x86, 0x22, 0x6C, 0xDB, 0x12,
-                0x01, 0x6F, 0x75, 0x53, 0xF9, 0xD0, 0xE6, 0x93, 0xA2, 0x68,
-#endif
                 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,     /* p */
                 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                 0xC9,
diff --git a/src/lib/libcrypto/ec/ec_mult.c b/src/lib/libcrypto/ec/ec_mult.c
index 3dc17bc409..9e3aee13a2 100644
--- a/src/lib/libcrypto/ec/ec_mult.c
+++ b/src/lib/libcrypto/ec/ec_mult.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_mult.c,v 1.15 2014/11/11 06:23:43 guenther Exp $ */
+/* $OpenBSD: ec_mult.c,v 1.16 2015/02/07 13:19:15 doug Exp $ */
 /*
  * Originally written by Bodo Moeller and Nils Larsch for the OpenSSL project.
  */
@@ -627,11 +627,8 @@ ec_wNAF_mul(const EC_GROUP * group, EC_POINT * r, const BIGNUM * scalar,
                 }
         }
 
-#if 1                           /* optional; EC_window_bits_for_scalar_size
-                                 * assumes we do this step */
         if (!EC_POINTs_make_affine(group, num_val, val, ctx))
                 goto err;
-#endif
 
         r_is_at_infinity = 1;
 
diff --git a/src/lib/libcrypto/ecdh/ech_lib.c b/src/lib/libcrypto/ecdh/ech_lib.c
index e9fae9428b..43c4f8ce31 100644
--- a/src/lib/libcrypto/ecdh/ech_lib.c
+++ b/src/lib/libcrypto/ecdh/ech_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ech_lib.c,v 1.7 2014/07/10 22:45:57 jsing Exp $ */
+/* $OpenBSD: ech_lib.c,v 1.8 2015/02/07 13:19:15 doug Exp $ */
 /* ====================================================================
  * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
  *
@@ -106,11 +106,6 @@ int ECDH_set_method(EC_KEY *eckey, const ECDH_METHOD *meth)
         if (ecdh == NULL)
                 return 0;
 
-#if 0
-        mtmp = ecdh->meth;
-        if (mtmp->finish)
-                mtmp->finish(eckey);
-#endif
 #ifndef OPENSSL_NO_ENGINE
         if (ecdh->engine)
                 {
@@ -119,10 +114,6 @@ int ECDH_set_method(EC_KEY *eckey, const ECDH_METHOD *meth)
                 }
 #endif
         ecdh->meth = meth;
-#if 0
-        if (meth->init) 
-                meth->init(eckey);
-#endif
         return 1;
         }
 
@@ -159,14 +150,6 @@ static ECDH_DATA *ECDH_DATA_new_method(ENGINE *engine)
 
         ret->flags = ret->meth->flags;
         CRYPTO_new_ex_data(CRYPTO_EX_INDEX_ECDH, ret, &ret->ex_data);
-#if 0
-        if ((ret->meth->init != NULL) && !ret->meth->init(ret))
-                {
-                CRYPTO_free_ex_data(CRYPTO_EX_INDEX_ECDH, ret, &ret->ex_data);
-                free(ret);
-                ret=NULL;
-                }
-#endif  
         return(ret);
         }
 
diff --git a/src/lib/libcrypto/ecdh/ech_locl.h b/src/lib/libcrypto/ecdh/ech_locl.h
index fff54abf60..077c7dab95 100644
--- a/src/lib/libcrypto/ecdh/ech_locl.h
+++ b/src/lib/libcrypto/ecdh/ech_locl.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ech_locl.h,v 1.2 2014/06/12 15:49:29 deraadt Exp $ */
+/* $OpenBSD: ech_locl.h,v 1.3 2015/02/07 13:19:15 doug Exp $ */
 /* ====================================================================
  * Copyright (c) 2000-2005 The OpenSSL Project.  All rights reserved.
  *
@@ -67,10 +67,6 @@ struct ecdh_method
         const char *name;
         int (*compute_key)(void *key, size_t outlen, const EC_POINT *pub_key, EC_KEY *ecdh,
                            void *(*KDF)(const void *in, size_t inlen, void *out, size_t *outlen));
-#if 0
-        int (*init)(EC_KEY *eckey);
-        int (*finish)(EC_KEY *eckey);
-#endif
         int flags;
         char *app_data;
         };
diff --git a/src/lib/libcrypto/ecdsa/ecs_lib.c b/src/lib/libcrypto/ecdsa/ecs_lib.c
index a92d6117c9..6cdf4c124b 100644
--- a/src/lib/libcrypto/ecdsa/ecs_lib.c
+++ b/src/lib/libcrypto/ecdsa/ecs_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ecs_lib.c,v 1.7 2014/07/10 22:45:57 jsing Exp $ */
+/* $OpenBSD: ecs_lib.c,v 1.8 2015/02/07 13:19:15 doug Exp $ */
 /* ====================================================================
  * Copyright (c) 1998-2005 The OpenSSL Project.  All rights reserved.
  *
@@ -138,14 +138,6 @@ static ECDSA_DATA *ECDSA_DATA_new_method(ENGINE *engine)
 
         ret->flags = ret->meth->flags;
         CRYPTO_new_ex_data(CRYPTO_EX_INDEX_ECDSA, ret, &ret->ex_data);
-#if 0
-        if ((ret->meth->init != NULL) && !ret->meth->init(ret))
-        {
-                CRYPTO_free_ex_data(CRYPTO_EX_INDEX_ECDSA, ret, &ret->ex_data);
-                free(ret);
-                ret=NULL;
-        }
-#endif  
         return(ret);
 }
 
diff --git a/src/lib/libcrypto/engine/eng_all.c b/src/lib/libcrypto/engine/eng_all.c
index 21b76266c7..014bcb132e 100644
--- a/src/lib/libcrypto/engine/eng_all.c
+++ b/src/lib/libcrypto/engine/eng_all.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: eng_all.c,v 1.26 2014/07/10 22:45:57 jsing Exp $ */
+/* $OpenBSD: eng_all.c,v 1.27 2015/02/07 13:19:15 doug Exp $ */
 /* Written by Richard Levitte <richard@levitte.org> for the OpenSSL
  * project 2000.
  */
@@ -66,13 +66,6 @@ ENGINE_load_builtin_engines(void)
 {
         /* Some ENGINEs need this */
         OPENSSL_cpuid_setup();
-#if 0
-        /* There's no longer any need for an "openssl" ENGINE unless, one day,
-         * it is the *only* way for standard builtin implementations to be be
-         * accessed (ie. it would be possible to statically link binaries with
-         * *no* builtin implementations). */
-        ENGINE_load_openssl();
-#endif
 
 #ifndef OPENSSL_NO_RSAX
         ENGINE_load_rsax();
diff --git a/src/lib/libcrypto/engine/eng_list.c b/src/lib/libcrypto/engine/eng_list.c
index b84504102f..78e978116a 100644
--- a/src/lib/libcrypto/engine/eng_list.c
+++ b/src/lib/libcrypto/engine/eng_list.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: eng_list.c,v 1.15 2014/07/11 08:44:48 jsing Exp $ */
+/* $OpenBSD: eng_list.c,v 1.16 2015/02/07 13:19:15 doug Exp $ */
 /* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
  * project 2000.
  */
@@ -378,14 +378,7 @@ ENGINE_by_id(const char *id)
                 }
         }
         CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
-#if 0
-        if (iterator == NULL) {
-                ENGINEerr(ENGINE_F_ENGINE_BY_ID,
-                    ENGINE_R_NO_SUCH_ENGINE);
-                ERR_asprintf_error_data("id=%s", id);
-        }
-        return iterator;
-#else
+
         /* EEK! Experimental code starts */
         if (iterator)
                 return iterator;
@@ -415,7 +408,6 @@ notfound:
         ERR_asprintf_error_data("id=%s", id);
         return NULL;
         /* EEK! Experimental code ends */
-#endif
 }
 
 int
diff --git a/src/lib/libcrypto/engine/eng_padlock.c b/src/lib/libcrypto/engine/eng_padlock.c
index 48040db82d..1c86a343df 100644
--- a/src/lib/libcrypto/engine/eng_padlock.c
+++ b/src/lib/libcrypto/engine/eng_padlock.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: eng_padlock.c,v 1.13 2014/10/18 17:20:40 jsing Exp $ */
+/* $OpenBSD: eng_padlock.c,v 1.14 2015/02/07 13:19:15 doug Exp $ */
 /*
  * Support for VIA PadLock Advanced Cryptography Engine (ACE)
  * Written by Michal Ludvig <michal@logix.cz>
@@ -168,9 +168,11 @@ padlock_bind_helper(ENGINE *e)
         /* Check available features */
         padlock_available();
 
-#if 1   /* disable RNG for now, see commentary in vicinity of RNG code */
+        /*
+         * RNG is currently disabled for reasons discussed in commentary just
+         * before padlock_rand_bytes function.
+         */
         padlock_use_rng = 0;
-#endif
 
         /* Generate a nice engine name with available features */
         (void) snprintf(padlock_name, sizeof(padlock_name),
diff --git a/src/lib/libcrypto/engine/tb_store.c b/src/lib/libcrypto/engine/tb_store.c
index 2f0cc004f3..e9ad11ab01 100644
--- a/src/lib/libcrypto/engine/tb_store.c
+++ b/src/lib/libcrypto/engine/tb_store.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tb_store.c,v 1.4 2014/06/12 15:49:29 deraadt Exp $ */
+/* $OpenBSD: tb_store.c,v 1.5 2015/02/07 13:19:15 doug Exp $ */
 /* ====================================================================
  * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
  *
@@ -93,29 +93,6 @@ ENGINE_register_all_STORE(void)
                 ENGINE_register_STORE(e);
 }
 
-/* The following two functions are removed because they're useless. */
-#if 0
-int
-ENGINE_set_default_STORE(ENGINE *e)
-{
-        if (e->store_meth)
-                return engine_table_register(&store_table,
-                    engine_unregister_all_STORE, e, &dummy_nid, 1, 1);
-        return 1;
-}
-#endif
-
-#if 0
-/* Exposed API function to get a functional reference from the implementation
- * table (ie. try to get a functional reference from the tabled structural
- * references). */
-ENGINE *
-ENGINE_get_default_STORE(void)
-{
-        return engine_table_select(&store_table, dummy_nid);
-}
-#endif
-
 /* Obtains an STORE implementation from an ENGINE functional reference */
 const STORE_METHOD *
 ENGINE_get_STORE(const ENGINE *e)
diff --git a/src/lib/libcrypto/evp/bio_b64.c b/src/lib/libcrypto/evp/bio_b64.c
index 53b8bcf615..b54e8793ec 100644
--- a/src/lib/libcrypto/evp/bio_b64.c
+++ b/src/lib/libcrypto/evp/bio_b64.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: bio_b64.c,v 1.19 2014/07/11 12:04:46 miod Exp $ */
+/* $OpenBSD: bio_b64.c,v 1.20 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -293,11 +293,7 @@ b64_read(BIO *b, char *out, int outl)
                 if (BIO_get_flags(b) & BIO_FLAGS_BASE64_NO_NL) {
                         int z, jj;
 
-#if 0
-                        jj = (i >> 2) << 2;
-#else
                         jj = i & ~3; /* process per 4 */
-#endif
                         z = EVP_DecodeBlock((unsigned char *)ctx->buf,
                             (unsigned char *)ctx->tmp, jj);
                         if (jj > 2) {
diff --git a/src/lib/libcrypto/evp/encode.c b/src/lib/libcrypto/evp/encode.c
index 067e62dfe9..725667bfff 100644
--- a/src/lib/libcrypto/evp/encode.c
+++ b/src/lib/libcrypto/evp/encode.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: encode.c,v 1.19 2014/08/06 16:01:44 jsing Exp $ */
+/* $OpenBSD: encode.c,v 1.20 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -415,36 +415,3 @@ EVP_DecodeFinal(EVP_ENCODE_CTX *ctx, unsigned char *out, int *outl)
         } else
                 return (1);
 }
-
-#ifdef undef
-int
-EVP_DecodeValid(unsigned char *buf, int len)
-{
-        int i, num = 0, bad = 0;
-
-        if (len == 0)
-                return (-1);
-        while (conv_ascii2bin(*buf) == B64_WS) {
-                buf++;
-                len--;
-                if (len == 0)
-                        return (-1);
-        }
-
-        for (i = len; i >= 4; i -= 4) {
-                if ((conv_ascii2bin(buf[0]) >= 0x40) ||
-                    (conv_ascii2bin(buf[1]) >= 0x40) ||
-                    (conv_ascii2bin(buf[2]) >= 0x40) ||
-                    (conv_ascii2bin(buf[3]) >= 0x40))
-                        return (-1);
-                buf += 4;
-                num += 1 + (buf[2] != '=') + (buf[3] != '=');
-        }
-        if ((i == 1) && (conv_ascii2bin(buf[0]) == B64_EOLN))
-                return (num);
-        if ((i == 2) && (conv_ascii2bin(buf[0]) == B64_EOLN) &&
-            (conv_ascii2bin(buf[0]) == B64_EOLN))
-                return (num);
-        return (1);
-}
-#endif
diff --git a/src/lib/libcrypto/evp/evp.h b/src/lib/libcrypto/evp/evp.h
index 6c1bf6c7cd..107119883a 100644
--- a/src/lib/libcrypto/evp/evp.h
+++ b/src/lib/libcrypto/evp/evp.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: evp.h,v 1.40 2014/11/09 19:17:13 miod Exp $ */
+/* $OpenBSD: evp.h,v 1.41 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -701,10 +701,6 @@ const EVP_CIPHER *EVP_des_cfb1(void);
 const EVP_CIPHER *EVP_des_cfb8(void);
 const EVP_CIPHER *EVP_des_ede_cfb64(void);
 # define EVP_des_ede_cfb EVP_des_ede_cfb64
-#if 0
-const EVP_CIPHER *EVP_des_ede_cfb1(void);
-const EVP_CIPHER *EVP_des_ede_cfb8(void);
-#endif
 const EVP_CIPHER *EVP_des_ede3_cfb64(void);
 # define EVP_des_ede3_cfb EVP_des_ede3_cfb64
 const EVP_CIPHER *EVP_des_ede3_cfb1(void);
diff --git a/src/lib/libcrypto/evp/p_sign.c b/src/lib/libcrypto/evp/p_sign.c
index f68a950c9c..4058d47f07 100644
--- a/src/lib/libcrypto/evp/p_sign.c
+++ b/src/lib/libcrypto/evp/p_sign.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: p_sign.c,v 1.12 2014/07/11 08:44:48 jsing Exp $ */
+/* $OpenBSD: p_sign.c,v 1.13 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -63,21 +63,6 @@
 #include <openssl/objects.h>
 #include <openssl/x509.h>
 
-#ifdef undef
-void
-EVP_SignInit(EVP_MD_CTX *ctx, EVP_MD *type)
-{
-        EVP_DigestInit_ex(ctx, type);
-}
-
-void
-EVP_SignUpdate(EVP_MD_CTX *ctx, unsigned char *data,
-    unsigned int count)
-{
-        EVP_DigestUpdate(ctx, data, count);
-}
-#endif
-
 int
 EVP_SignFinal(EVP_MD_CTX *ctx, unsigned char *sigret, unsigned int *siglen,
     EVP_PKEY *pkey)
diff --git a/src/lib/libcrypto/idea/idea_lcl.h b/src/lib/libcrypto/idea/idea_lcl.h
index cc58b360ad..e46c960875 100644
--- a/src/lib/libcrypto/idea/idea_lcl.h
+++ b/src/lib/libcrypto/idea/idea_lcl.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: idea_lcl.h,v 1.2 2014/06/12 15:49:29 deraadt Exp $ */
+/* $OpenBSD: idea_lcl.h,v 1.3 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -69,18 +69,6 @@ if (ul != 0) \
 else \
         r=(-(int)a-b+1); /* assuming a or b is 0 and in range */ 
 
-#ifdef undef
-#define idea_mul(r,a,b,ul,sl) \
-if (a == 0) r=(0x10001-b)&0xffff; \
-else if (b == 0) r=(0x10001-a)&0xffff; \
-else    { \
-        ul=(unsigned long)a*b; \
-        sl=(ul&0xffff)-(ul>>16); \
-        if (sl <= 0) sl+=0x10001; \
-        r=sl; \
-        } 
-#endif
-
 /*  7/12/95 - Many thanks to Rhys Weatherley <rweather@us.oracle.com>
  * for pointing out that I was assuming little endian
  * byte order for all quantities what idea
@@ -142,59 +130,6 @@ else	{ \
 #define n2s(c,l)        (l =((IDEA_INT)(*((c)++)))<< 8L, \
                          l|=((IDEA_INT)(*((c)++)))      )
 
-#ifdef undef
-/* NOTE - c is not incremented as per c2l */
-#define c2ln(c,l1,l2,n) { \
-                        c+=n; \
-                        l1=l2=0; \
-                        switch (n) { \
-                        case 8: l2 =((unsigned long)(*(--(c))))<<24; \
-                        case 7: l2|=((unsigned long)(*(--(c))))<<16; \
-                        case 6: l2|=((unsigned long)(*(--(c))))<< 8; \
-                        case 5: l2|=((unsigned long)(*(--(c))));     \
-                        case 4: l1 =((unsigned long)(*(--(c))))<<24; \
-                        case 3: l1|=((unsigned long)(*(--(c))))<<16; \
-                        case 2: l1|=((unsigned long)(*(--(c))))<< 8; \
-                        case 1: l1|=((unsigned long)(*(--(c))));     \
-                                } \
-                        }
-
-/* NOTE - c is not incremented as per l2c */
-#define l2cn(l1,l2,c,n) { \
-                        c+=n; \
-                        switch (n) { \
-                        case 8: *(--(c))=(unsigned char)(((l2)>>24)&0xff); \
-                        case 7: *(--(c))=(unsigned char)(((l2)>>16)&0xff); \
-                        case 6: *(--(c))=(unsigned char)(((l2)>> 8)&0xff); \
-                        case 5: *(--(c))=(unsigned char)(((l2)    )&0xff); \
-                        case 4: *(--(c))=(unsigned char)(((l1)>>24)&0xff); \
-                        case 3: *(--(c))=(unsigned char)(((l1)>>16)&0xff); \
-                        case 2: *(--(c))=(unsigned char)(((l1)>> 8)&0xff); \
-                        case 1: *(--(c))=(unsigned char)(((l1)    )&0xff); \
-                                } \
-                        }
-
-#undef c2s
-#define c2s(c,l)        (l =((unsigned long)(*((c)++)))    , \
-                         l|=((unsigned long)(*((c)++)))<< 8L)
-
-#undef s2c
-#define s2c(l,c)        (*((c)++)=(unsigned char)(((l)     )&0xff), \
-                         *((c)++)=(unsigned char)(((l)>> 8L)&0xff))
-
-#undef c2l
-#define c2l(c,l)        (l =((unsigned long)(*((c)++)))     , \
-                         l|=((unsigned long)(*((c)++)))<< 8L, \
-                         l|=((unsigned long)(*((c)++)))<<16L, \
-                         l|=((unsigned long)(*((c)++)))<<24L)
-
-#undef l2c
-#define l2c(l,c)        (*((c)++)=(unsigned char)(((l)     )&0xff), \
-                         *((c)++)=(unsigned char)(((l)>> 8L)&0xff), \
-                         *((c)++)=(unsigned char)(((l)>>16L)&0xff), \
-                         *((c)++)=(unsigned char)(((l)>>24L)&0xff))
-#endif
-
 #define E_IDEA(num) \
         x1&=0xffff; \
         idea_mul(x1,x1,*p,ul); p++; \
diff --git a/src/lib/libcrypto/modes/gcm128.c b/src/lib/libcrypto/modes/gcm128.c
index 5b600517be..1106617763 100644
--- a/src/lib/libcrypto/modes/gcm128.c
+++ b/src/lib/libcrypto/modes/gcm128.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: gcm128.c,v 1.10 2014/07/09 16:06:13 miod Exp $ */
+/* $OpenBSD: gcm128.c,v 1.11 2015/02/07 13:19:15 doug Exp $ */
 /* ====================================================================
  * Copyright (c) 2010 The OpenSSL Project.  All rights reserved.
  *
@@ -898,9 +898,6 @@ int CRYPTO_gcm128_encrypt(GCM128_CONTEXT *ctx,
 # endif
 #endif
 
-#if 0
-        n = (unsigned int)mlen%16; /* alternative to ctx->mres */
-#endif
         mlen += len;
         if (mlen>((U64(1)<<36)-32) || (sizeof(len)==8 && mlen<len))
                 return -1;
diff --git a/src/lib/libcrypto/pkcs12/p12_key.c b/src/lib/libcrypto/pkcs12/p12_key.c
index 0357c2bfa2..0b3547a6fb 100644
--- a/src/lib/libcrypto/pkcs12/p12_key.c
+++ b/src/lib/libcrypto/pkcs12/p12_key.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: p12_key.c,v 1.21 2014/07/12 16:03:37 miod Exp $ */
+/* $OpenBSD: p12_key.c,v 1.22 2015/02/07 13:19:15 doug Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -107,13 +107,6 @@ PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt,
         BIGNUM *Ij, *Bpl1;      /* These hold Ij and B + 1 */
         EVP_MD_CTX ctx;
 
-#if 0
-        if (!pass) {
-                PKCS12err(PKCS12_F_PKCS12_KEY_GEN_UNI, ERR_R_PASSED_NULL_PARAMETER);
-                return 0;
-        }
-#endif
-
         EVP_MD_CTX_init(&ctx);
         v = EVP_MD_block_size(md_type);
         u = EVP_MD_size(md_type);
diff --git a/src/lib/libcrypto/pkcs7/pk7_doit.c b/src/lib/libcrypto/pkcs7/pk7_doit.c
index d69aff8f41..252fab04d7 100644
--- a/src/lib/libcrypto/pkcs7/pk7_doit.c
+++ b/src/lib/libcrypto/pkcs7/pk7_doit.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pk7_doit.c,v 1.30 2014/10/22 13:02:04 jsing Exp $ */
+/* $OpenBSD: pk7_doit.c,v 1.31 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -482,15 +482,6 @@ PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
         }
 
         if (evp_cipher != NULL) {
-#if 0
-                unsigned char key[EVP_MAX_KEY_LENGTH];
-                unsigned char iv[EVP_MAX_IV_LENGTH];
-                unsigned char *p;
-                int keylen, ivlen;
-                int max;
-                X509_OBJECT ret;
-#endif
-
                 if ((etmp = BIO_new(BIO_f_cipher())) == NULL) {
                         PKCS7err(PKCS7_F_PKCS7_DATADECODE, ERR_R_BIO_LIB);
                         goto err;
@@ -594,20 +585,9 @@ PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                 etmp = NULL;
         }
 
-#if 1
         if (PKCS7_is_detached(p7) || (in_bio != NULL)) {
                 bio = in_bio;
         } else {
-#if 0
-                bio = BIO_new(BIO_s_mem());
-                /* We need to set this so that when we have read all
-                 * the data, the encrypt BIO, if present, will read
-                 * EOF and encode the last few bytes */
-                BIO_set_mem_eof_return(bio, 0);
-
-                if (data_body != NULL && data_body->length > 0)
-                        BIO_write(bio, (char *)data_body->data, data_body->length);
-#else
                 if (data_body != NULL && data_body->length > 0)
                         bio = BIO_new_mem_buf(data_body->data, data_body->length);
                 else {
@@ -616,11 +596,10 @@ PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                 }
                 if (bio == NULL)
                         goto err;
-#endif
         }
         BIO_push(out, bio);
         bio = NULL;
-#endif
+
         if (0) {
 err:
                 if (ek) {
diff --git a/src/lib/libcrypto/stack/stack.c b/src/lib/libcrypto/stack/stack.c
index cbd4d216f6..d941f9e6fb 100644
--- a/src/lib/libcrypto/stack/stack.c
+++ b/src/lib/libcrypto/stack/stack.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: stack.c,v 1.18 2014/07/11 08:44:49 jsing Exp $ */
+/* $OpenBSD: stack.c,v 1.19 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -56,16 +56,6 @@
  * [including the GNU Public Licence.]
  */
 
-/* Code for stacks
- * Author - Eric Young v 1.0
- * 1.2 eay 12-Mar-97 -  Modified sk_find so that it _DOES_ return the
- *                      lowest index for the searched item.
- *
- * 1.1 eay - Take from netdb and added to SSLeay
- *
- * 1.0 eay - First version 29/07/92
- */
-
 #include <stdio.h>
 #include <string.h>
 
diff --git a/src/lib/libcrypto/x509/x509_vfy.h b/src/lib/libcrypto/x509/x509_vfy.h
index 500b520495..e760279b52 100644
--- a/src/lib/libcrypto/x509/x509_vfy.h
+++ b/src/lib/libcrypto/x509/x509_vfy.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_vfy.h,v 1.14 2015/01/22 09:06:39 reyk Exp $ */
+/* $OpenBSD: x509_vfy.h,v 1.15 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -77,17 +77,6 @@
 extern "C" {
 #endif
 
-#if 0
-/* Outer object */
-typedef struct x509_hash_dir_st
-        {
-        int num_dirs;
-        char **dirs;
-        int *dirs_type;
-        int num_dirs_alloced;
-        } X509_HASH_DIR_CTX;
-#endif
-
 typedef struct x509_file_st
         {
         int num_paths;  /* number of paths to files or directories */
diff --git a/src/lib/libcrypto/x509v3/pcy_lib.c b/src/lib/libcrypto/x509v3/pcy_lib.c
index 321370e135..6f37064063 100644
--- a/src/lib/libcrypto/x509v3/pcy_lib.c
+++ b/src/lib/libcrypto/x509v3/pcy_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pcy_lib.c,v 1.4 2014/07/11 08:44:49 jsing Exp $ */
+/* $OpenBSD: pcy_lib.c,v 1.5 2015/02/07 13:19:15 doug Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2004.
  */
@@ -140,16 +140,6 @@ X509_policy_node_get0_policy(const X509_POLICY_NODE *node)
         return node->data->valid_policy;
 }
 
-#if 0
-int
-X509_policy_node_get_critical(const X509_POLICY_NODE *node)
-{
-        if (node_critical(node))
-                return 1;
-        return 0;
-}
-#endif
-
 STACK_OF(POLICYQUALINFO) *
 X509_policy_node_get0_qualifiers(const X509_POLICY_NODE *node)
 {
diff --git a/src/lib/libcrypto/x509v3/pcy_tree.c b/src/lib/libcrypto/x509v3/pcy_tree.c
index 2c6472a8a1..fa0e161562 100644
--- a/src/lib/libcrypto/x509v3/pcy_tree.c
+++ b/src/lib/libcrypto/x509v3/pcy_tree.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pcy_tree.c,v 1.12 2014/07/11 08:44:49 jsing Exp $ */
+/* $OpenBSD: pcy_tree.c,v 1.13 2015/02/07 13:19:15 doug Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2004.
  */
@@ -153,11 +153,6 @@ tree_init(X509_POLICY_TREE **ptree, STACK_OF(X509) *certs, unsigned int flags)
         *ptree = NULL;
         n = sk_X509_num(certs);
 
-#if 0
-        /* Disable policy mapping for now... */
-        flags |= X509_V_FLAG_INHIBIT_MAP;
-#endif
-
         if (flags & X509_V_FLAG_EXPLICIT_POLICY)
                 explicit_policy = 0;
         else
@@ -327,19 +322,6 @@ tree_link_nodes(X509_POLICY_LEVEL *curr, const X509_POLICY_CACHE *cache)
 
         for (i = 0; i < sk_X509_POLICY_DATA_num(cache->data); i++) {
                 data = sk_X509_POLICY_DATA_value(cache->data, i);
-                /* If a node is mapped any it doesn't have a corresponding
-                 * CertificatePolicies entry.
-                 * However such an identical node would be created
-                 * if anyPolicy matching is enabled because there would be
-                 * no match with the parent valid_policy_set. So we create
-                 * link because then it will have the mapping flags
-                 * right and we can prune it later.
-                 */
-#if 0
-                if ((data->flags & POLICY_DATA_FLAG_MAPPED_ANY) &&
-                    !(curr->flags & X509_V_FLAG_INHIBIT_ANY))
-                        continue;
-#endif
                 /* Look for matching nodes in previous level */
                 if (!tree_link_matching_nodes(curr, data))
                         return 0;
@@ -416,7 +398,6 @@ tree_link_any(X509_POLICY_LEVEL *curr, const X509_POLICY_CACHE *cache,
     X509_POLICY_TREE *tree)
 {
         int i;
-        /*X509_POLICY_DATA *data;*/
         X509_POLICY_NODE *node;
         X509_POLICY_LEVEL *last = curr - 1;
 
@@ -425,36 +406,6 @@ tree_link_any(X509_POLICY_LEVEL *curr, const X509_POLICY_CACHE *cache,
 
                 if (!tree_link_unmatched(curr, cache, node, tree))
                         return 0;
-
-#if 0
-
-                /* Skip any node with any children: we only want unmathced
-                 * nodes.
-                 *
-                 * Note: need something better for policy mapping
-                 * because each node may have multiple children
-                 */
-                if (node->nchild)
-                        continue;
-
-                /* Create a new node with qualifiers from anyPolicy and
-                 * id from unmatched node.
-                 */
-                data = policy_data_new(NULL, node->data->valid_policy,
-                    node_critical(node));
-
-                if (data == NULL)
-                        return 0;
-                /* Curr may not have anyPolicy */
-                data->qualifier_set = cache->anyPolicy->qualifier_set;
-                data->flags |= POLICY_DATA_FLAG_SHARED_QUALIFIERS;
-                if (!level_add_node(curr, data, node, tree)) {
-                        policy_data_free(data);
-                        return 0;
-                }
-
-#endif
-
         }
         /* Finally add link to anyPolicy */
         if (last->anyPolicy) {
diff --git a/src/lib/libcrypto/x509v3/v3_info.c b/src/lib/libcrypto/x509v3/v3_info.c
index 862f949b1b..0a4df34078 100644
--- a/src/lib/libcrypto/x509v3/v3_info.c
+++ b/src/lib/libcrypto/x509v3/v3_info.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: v3_info.c,v 1.19 2014/10/05 18:28:56 miod Exp $ */
+/* $OpenBSD: v3_info.c,v 1.20 2015/02/07 13:19:15 doug Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -208,8 +208,5 @@ int
 i2a_ACCESS_DESCRIPTION(BIO *bp, ACCESS_DESCRIPTION* a)
 {
         i2a_ASN1_OBJECT(bp, a->method);
-#ifdef UNDEF
-        i2a_GENERAL_NAME(bp, a->location);
-#endif
         return 2;
 }
diff --git a/src/lib/libcrypto/x509v3/v3_utl.c b/src/lib/libcrypto/x509v3/v3_utl.c
index 99090f3cd2..ee135a0b52 100644
--- a/src/lib/libcrypto/x509v3/v3_utl.c
+++ b/src/lib/libcrypto/x509v3/v3_utl.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: v3_utl.c,v 1.23 2014/07/13 16:03:10 beck Exp $ */
+/* $OpenBSD: v3_utl.c,v 1.24 2015/02/07 13:19:15 doug Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
  */
@@ -328,9 +328,6 @@ X509V3_parse_list(const char *line)
                                 *p = 0;
                                 ntmp = strip_spaces(q);
                                 q = p + 1;
-#if 0
-                                printf("%s\n", ntmp);
-#endif
                                 if (!ntmp) {
                                         X509V3err(X509V3_F_X509V3_PARSE_LIST,
                                             X509V3_R_INVALID_NULL_NAME);
@@ -345,9 +342,6 @@ X509V3_parse_list(const char *line)
                                 state = HDR_NAME;
                                 *p = 0;
                                 vtmp = strip_spaces(q);
-#if 0
-                                printf("%s\n", ntmp);
-#endif
                                 if (!vtmp) {
                                         X509V3err(X509V3_F_X509V3_PARSE_LIST,
                                             X509V3_R_INVALID_NULL_VALUE);
@@ -363,9 +357,6 @@ X509V3_parse_list(const char *line)
 
         if (state == HDR_VALUE) {
                 vtmp = strip_spaces(q);
-#if 0
-                printf("%s=%s\n", ntmp, vtmp);
-#endif
                 if (!vtmp) {
                         X509V3err(X509V3_F_X509V3_PARSE_LIST,
                             X509V3_R_INVALID_NULL_VALUE);
@@ -374,9 +365,6 @@ X509V3_parse_list(const char *line)
                 X509V3_add_value(ntmp, vtmp, &values);
         } else {
                 ntmp = strip_spaces(q);
-#if 0
-                printf("%s\n", ntmp);
-#endif
                 if (!ntmp) {
                         X509V3err(X509V3_F_X509V3_PARSE_LIST,
                             X509V3_R_INVALID_NULL_NAME);
diff --git a/src/lib/libssl/src/crypto/asn1/a_gentm.c b/src/lib/libssl/src/crypto/asn1/a_gentm.c
index c658b1ea35..bc3453f410 100644
--- a/src/lib/libssl/src/crypto/asn1/a_gentm.c
+++ b/src/lib/libssl/src/crypto/asn1/a_gentm.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: a_gentm.c,v 1.22 2014/07/11 08:44:47 jsing Exp $ */
+/* $OpenBSD: a_gentm.c,v 1.23 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -67,43 +67,6 @@
 
 #include "o_time.h"
 
-#if 0
-
-int
-i2d_ASN1_GENERALIZEDTIME(ASN1_GENERALIZEDTIME *a, unsigned char **pp)
-{
-        return(i2d_ASN1_bytes((ASN1_STRING *)a, pp,
-            V_ASN1_GENERALIZEDTIME, V_ASN1_UNIVERSAL));
-}
-
-
-ASN1_GENERALIZEDTIME *
-d2i_ASN1_GENERALIZEDTIME(ASN1_GENERALIZEDTIME **a, unsigned char **pp,
-    long length)
-{
-        ASN1_GENERALIZEDTIME *ret = NULL;
-
-        ret = (ASN1_GENERALIZEDTIME *)d2i_ASN1_bytes((ASN1_STRING **)a, pp, length,
-            V_ASN1_GENERALIZEDTIME, V_ASN1_UNIVERSAL);
-        if (ret == NULL) {
-                ASN1err(ASN1_F_D2I_ASN1_GENERALIZEDTIME, ERR_R_NESTED_ASN1_ERROR);
-                return (NULL);
-        }
-        if (!ASN1_GENERALIZEDTIME_check(ret)) {
-                ASN1err(ASN1_F_D2I_ASN1_GENERALIZEDTIME, ASN1_R_INVALID_TIME_FORMAT);
-                goto err;
-        }
-
-        return (ret);
-
-err:
-        if ((ret != NULL) && ((a == NULL) || (*a != ret)))
-                M_ASN1_GENERALIZEDTIME_free(ret);
-        return (NULL);
-}
-
-#endif
-
 int
 ASN1_GENERALIZEDTIME_check(ASN1_GENERALIZEDTIME *d)
 {
diff --git a/src/lib/libssl/src/crypto/asn1/a_strex.c b/src/lib/libssl/src/crypto/asn1/a_strex.c
index b592c0e18a..f60a70d94d 100644
--- a/src/lib/libssl/src/crypto/asn1/a_strex.c
+++ b/src/lib/libssl/src/crypto/asn1/a_strex.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: a_strex.c,v 1.24 2014/07/11 08:44:47 jsing Exp $ */
+/* $OpenBSD: a_strex.c,v 1.25 2015/02/07 13:19:15 doug Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -84,20 +84,6 @@
 /* Three IO functions for sending data to memory, a BIO and
  * and a FILE pointer.
  */
-#if 0                           /* never used */
-static int
-send_mem_chars(void *arg, const void *buf, int len)
-{
-        unsigned char **out = arg;
-
-        if (!out)
-                return 1;
-        memcpy(*out, buf, len);
-        *out += len;
-        return 1;
-}
-#endif
-
 static int
 send_bio_chars(void *arg, const void *buf, int len)
 {
diff --git a/src/lib/libssl/src/crypto/asn1/a_time.c b/src/lib/libssl/src/crypto/asn1/a_time.c
index 94e249960a..c5e882a4f6 100644
--- a/src/lib/libssl/src/crypto/asn1/a_time.c
+++ b/src/lib/libssl/src/crypto/asn1/a_time.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: a_time.c,v 1.21 2014/07/11 08:44:47 jsing Exp $ */
+/* $OpenBSD: a_time.c,v 1.22 2015/02/07 13:19:15 doug Exp $ */
 /* ====================================================================
  * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
  *
@@ -73,18 +73,6 @@ IMPLEMENT_ASN1_MSTRING(ASN1_TIME, B_ASN1_TIME)
 
 IMPLEMENT_ASN1_FUNCTIONS(ASN1_TIME)
 
-#if 0
-int
-i2d_ASN1_TIME(ASN1_TIME *a, unsigned char **pp)
-{
-        if (a->type == V_ASN1_UTCTIME || a->type == V_ASN1_GENERALIZEDTIME)
-                return(i2d_ASN1_bytes((ASN1_STRING *)a, pp,
-                    a->type, V_ASN1_UNIVERSAL));
-        ASN1err(ASN1_F_I2D_ASN1_TIME, ASN1_R_EXPECTING_A_TIME);
-        return -1;
-}
-#endif
-
 ASN1_TIME *
 ASN1_TIME_set(ASN1_TIME *s, time_t t)
 {
diff --git a/src/lib/libssl/src/crypto/asn1/asn1_lib.c b/src/lib/libssl/src/crypto/asn1/asn1_lib.c
index 2b952abae6..46de52a050 100644
--- a/src/lib/libssl/src/crypto/asn1/asn1_lib.c
+++ b/src/lib/libssl/src/crypto/asn1/asn1_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: asn1_lib.c,v 1.32 2014/07/11 14:49:12 miod Exp $ */
+/* $OpenBSD: asn1_lib.c,v 1.33 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -140,12 +140,6 @@ ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
         if (inf && !(ret & V_ASN1_CONSTRUCTED))
                 goto err;
 
-#if 0
-        fprintf(stderr, "p=%d + *plength=%ld > omax=%ld + *pp=%d  (%d > %d)\n",
-            (int)p, *plength, omax, (int)*pp, (int)(p+ *plength),
-            (int)(omax+ *pp));
-
-#endif
         if (*plength > (omax - (p - *pp))) {
                 ASN1err(ASN1_F_ASN1_GET_OBJECT, ASN1_R_TOO_LONG);
                 /* Set this so that even if things are not long enough
diff --git a/src/lib/libssl/src/crypto/asn1/asn1_par.c b/src/lib/libssl/src/crypto/asn1/asn1_par.c
index 2c8062bb8a..b5742fe97d 100644
--- a/src/lib/libssl/src/crypto/asn1/asn1_par.c
+++ b/src/lib/libssl/src/crypto/asn1/asn1_par.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: asn1_par.c,v 1.21 2014/10/03 06:02:38 doug Exp $ */
+/* $OpenBSD: asn1_par.c,v 1.22 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -126,11 +126,7 @@ asn1_parse2(BIO *bp, const unsigned char **pp, long length, int offset,
         /* ASN1_BMPSTRING *bmp=NULL;*/
         int dump_indent;
 
-#if 0
-        dump_indent = indent;
-#else
         dump_indent = 6;        /* Because we know BIO_dump_indent() */
-#endif
         p = *pp;
         tot = p + length;
         op = p - 1;
diff --git a/src/lib/libssl/src/crypto/asn1/t_x509.c b/src/lib/libssl/src/crypto/asn1/t_x509.c
index f4872d8b24..1c83fc5608 100644
--- a/src/lib/libssl/src/crypto/asn1/t_x509.c
+++ b/src/lib/libssl/src/crypto/asn1/t_x509.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: t_x509.c,v 1.25 2014/07/12 16:33:25 miod Exp $ */
+/* $OpenBSD: t_x509.c,v 1.26 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -172,14 +172,6 @@ X509_print_ex(BIO *bp, X509 *x, unsigned long nmflags, unsigned long cflag)
         if (!(cflag & X509_FLAG_NO_SIGNAME)) {
                 if (X509_signature_print(bp, x->sig_alg, NULL) <= 0)
                         goto err;
-#if 0
-                if (BIO_printf(bp, "%8sSignature Algorithm: ", "") <= 0)
-                        goto err;
-                if (i2a_ASN1_OBJECT(bp, ci->signature->algorithm) <= 0)
-                        goto err;
-                if (BIO_puts(bp, "\n") <= 0)
-                        goto err;
-#endif
         }
 
         if (!(cflag & X509_FLAG_NO_ISSUER)) {
diff --git a/src/lib/libssl/src/crypto/asn1/tasn_prn.c b/src/lib/libssl/src/crypto/asn1/tasn_prn.c
index 9383750a82..844960fc77 100644
--- a/src/lib/libssl/src/crypto/asn1/tasn_prn.c
+++ b/src/lib/libssl/src/crypto/asn1/tasn_prn.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tasn_prn.c,v 1.11 2014/07/11 08:44:47 jsing Exp $ */
+/* $OpenBSD: tasn_prn.c,v 1.12 2015/02/07 13:19:15 doug Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -260,11 +260,6 @@ asn1_item_print_ctx(BIO *out, ASN1_VALUE **fld, int indent, const ASN1_ITEM *it,
                 break;
 
         case ASN1_ITYPE_CHOICE:
-#if 0
-                if (!nohdr &&
-                    !asn1_print_fsname(out, indent, fname, sname, pctx))
-                        return 0;
-#endif
                 /* CHOICE type, get selector */
                 i = asn1_get_choice_selector(fld, it);
                 /* This should never happen... */
@@ -395,11 +390,6 @@ asn1_print_fsname(BIO *out, int indent, const char *fname, const char *sname,
         static char spaces[] = "                    ";
         const int nspaces = sizeof(spaces) - 1;
 
-#if 0
-        if (!sname && !fname)
-                return 1;
-#endif
-
         while (indent > nspaces) {
                 if (BIO_write(out, spaces, nspaces) != nspaces)
                         return 0;
diff --git a/src/lib/libssl/src/crypto/bio/bf_nbio.c b/src/lib/libssl/src/crypto/bio/bf_nbio.c
index a86feb49c2..24e2e7e8b9 100644
--- a/src/lib/libssl/src/crypto/bio/bf_nbio.c
+++ b/src/lib/libssl/src/crypto/bio/bf_nbio.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: bf_nbio.c,v 1.18 2014/10/22 13:02:03 jsing Exp $ */
+/* $OpenBSD: bf_nbio.c,v 1.19 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -130,10 +130,8 @@ static int
 nbiof_read(BIO *b, char *out, int outl)
 {
         int ret = 0;
-#if 1
         int num;
         unsigned char n;
-#endif
 
         if (out == NULL)
                 return (0);
@@ -141,7 +139,7 @@ nbiof_read(BIO *b, char *out, int outl)
                 return (0);
 
         BIO_clear_retry_flags(b);
-#if 1
+
         arc4random_buf(&n, 1);
         num = (n & 0x07);
 
@@ -151,9 +149,7 @@ nbiof_read(BIO *b, char *out, int outl)
         if (num == 0) {
                 ret = -1;
                 BIO_set_retry_read(b);
-        } else
-#endif
-        {
+        } else {
                 ret = BIO_read(b->next_bio, out, outl);
                 if (ret < 0)
                         BIO_copy_next_retry(b);
@@ -177,7 +173,6 @@ nbiof_write(BIO *b, const char *in, int inl)
 
         BIO_clear_retry_flags(b);
 
-#if 1
         if (nt->lwn > 0) {
                 num = nt->lwn;
                 nt->lwn = 0;
@@ -192,9 +187,7 @@ nbiof_write(BIO *b, const char *in, int inl)
         if (num == 0) {
                 ret = -1;
                 BIO_set_retry_write(b);
-        } else
-#endif
-        {
+        } else {
                 ret = BIO_write(b->next_bio, in, inl);
                 if (ret < 0) {
                         BIO_copy_next_retry(b);
diff --git a/src/lib/libssl/src/crypto/bn/bn.h b/src/lib/libssl/src/crypto/bn/bn.h
index 10414dc339..d93c9fc059 100644
--- a/src/lib/libssl/src/crypto/bn/bn.h
+++ b/src/lib/libssl/src/crypto/bn/bn.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: bn.h,v 1.25 2014/10/22 13:02:04 jsing Exp $ */
+/* $OpenBSD: bn.h,v 1.26 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1997 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -241,17 +241,6 @@ extern "C" {
                                                  |  BN_FLG_STATIC_DATA \
                                                  |  (n)))
 
-/* Already declared in ossl_typ.h */
-#if 0
-typedef struct bignum_st BIGNUM;
-/* Used for temp variables (declaration hidden in bn_lcl.h) */
-typedef struct bignum_ctx BN_CTX;
-typedef struct bn_blinding_st BN_BLINDING;
-typedef struct bn_mont_ctx_st BN_MONT_CTX;
-typedef struct bn_recp_ctx_st BN_RECP_CTX;
-typedef struct bn_gencb_st BN_GENCB;
-#endif
-
 struct bignum_st {
         BN_ULONG *d;    /* Pointer to an array of 'BN_BITS2' bit chunks. */
         int top;        /* Index of last used d +1. */
diff --git a/src/lib/libssl/src/crypto/conf/conf.h b/src/lib/libssl/src/crypto/conf/conf.h
index ba7fb69794..095066d31b 100644
--- a/src/lib/libssl/src/crypto/conf/conf.h
+++ b/src/lib/libssl/src/crypto/conf/conf.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: conf.h,v 1.13 2014/06/12 15:49:28 deraadt Exp $ */
+/* $OpenBSD: conf.h,v 1.14 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -149,9 +149,6 @@ struct conf_st {
 CONF *NCONF_new(CONF_METHOD *meth);
 CONF_METHOD *NCONF_default(void);
 CONF_METHOD *NCONF_WIN32(void);
-#if 0 /* Just to give you an idea of what I have in mind */
-CONF_METHOD *NCONF_XML(void);
-#endif
 void NCONF_free(CONF *conf);
 void NCONF_free_data(CONF *conf);
 
@@ -165,12 +162,7 @@ int NCONF_get_number_e(const CONF *conf, const char *group, const char *name,
 int NCONF_dump_fp(const CONF *conf, FILE *out);
 int NCONF_dump_bio(const CONF *conf, BIO *out);
 
-#if 0 /* The following function has no error checking,
-         and should therefore be avoided */
-long NCONF_get_number(CONF *conf, char *group, char *name);
-#else
 #define NCONF_get_number(c,g,n,r) NCONF_get_number_e(c,g,n,r)
-#endif
 
 /* Module functions */
 
diff --git a/src/lib/libssl/src/crypto/conf/conf_api.c b/src/lib/libssl/src/crypto/conf/conf_api.c
index 7480dda3d5..56a4f249ad 100644
--- a/src/lib/libssl/src/crypto/conf/conf_api.c
+++ b/src/lib/libssl/src/crypto/conf/conf_api.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: conf_api.c,v 1.11 2014/06/23 22:19:02 deraadt Exp $ */
+/* $OpenBSD: conf_api.c,v 1.12 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -165,28 +165,6 @@ _CONF_get_string(const CONF *conf, const char *section, const char *name)
         }
 }
 
-#if 0 /* There's no way to provide error checking with this function, so
-         force implementors of the higher levels to get a string and read
-         the number themselves. */
-long
-_CONF_get_number(CONF *conf, char *section, char *name)
-{
-        char *str;
-        long ret = 0;
-
-        str = _CONF_get_string(conf, section, name);
-        if (str == NULL)
-                return (0);
-        for (;;) {
-                if (conf->meth->is_number(conf, *str))
-                        ret = ret * 10 + conf->meth->to_int(conf, *str);
-                else
-                        return (ret);
-                str++;
-        }
-}
-#endif
-
 static unsigned long
 conf_value_hash(const CONF_VALUE *v)
 {
diff --git a/src/lib/libssl/src/crypto/conf/conf_def.c b/src/lib/libssl/src/crypto/conf/conf_def.c
index c437aeb457..e608e5fe9d 100644
--- a/src/lib/libssl/src/crypto/conf/conf_def.c
+++ b/src/lib/libssl/src/crypto/conf/conf_def.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: conf_def.c,v 1.28 2014/07/11 15:38:03 miod Exp $ */
+/* $OpenBSD: conf_def.c,v 1.29 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -388,27 +388,12 @@ again:
                                 }
                         } else
                                 tv = sv;
-#if 1
+
                         if (_CONF_add_string(conf, tv, v) == 0) {
                                 CONFerr(CONF_F_DEF_LOAD_BIO,
                                     ERR_R_MALLOC_FAILURE);
                                 goto err;
                         }
-#else
-                        v->section = tv->section;
-                        if (!sk_CONF_VALUE_push(ts, v)) {
-                                CONFerr(CONF_F_DEF_LOAD_BIO,
-                                    ERR_R_MALLOC_FAILURE);
-                                goto err;
-                        }
-                        vv = (CONF_VALUE *)lh_insert(conf->data, v);
-                        if (vv != NULL) {
-                                sk_CONF_VALUE_delete_ptr(ts, vv);
-                                free(vv->name);
-                                free(vv->value);
-                                free(vv);
-                        }
-#endif
                         v = NULL;
                 }
         }
diff --git a/src/lib/libssl/src/crypto/conf/conf_lib.c b/src/lib/libssl/src/crypto/conf/conf_lib.c
index 2119eb6219..a7c8be7c0d 100644
--- a/src/lib/libssl/src/crypto/conf/conf_lib.c
+++ b/src/lib/libssl/src/crypto/conf/conf_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: conf_lib.c,v 1.12 2014/07/09 11:10:50 bcook Exp $ */
+/* $OpenBSD: conf_lib.c,v 1.13 2015/02/07 13:19:15 doug Exp $ */
 /* Written by Richard Levitte (richard@levitte.org) for the OpenSSL
  * project 2000.
  */
@@ -373,21 +373,3 @@ NCONF_dump_bio(const CONF *conf, BIO *out)
 
         return conf->meth->dump(conf, out);
 }
-
-
-/* This function should be avoided */
-#if 0
-long
-NCONF_get_number(CONF *conf, char *group, char *name)
-{
-        int status;
-        long ret = 0;
-
-        status = NCONF_get_number_e(conf, group, name, &ret);
-        if (status == 0) {
-                /* This function does not believe in errors... */
-                ERR_get_error();
-        }
-        return ret;
-}
-#endif
diff --git a/src/lib/libssl/src/crypto/crypto.h b/src/lib/libssl/src/crypto/crypto.h
index 5cb1dda021..27b7f3fe02 100644
--- a/src/lib/libssl/src/crypto/crypto.h
+++ b/src/lib/libssl/src/crypto/crypto.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: crypto.h,v 1.32 2014/07/10 22:45:56 jsing Exp $ */
+/* $OpenBSD: crypto.h,v 1.33 2015/02/07 13:19:15 doug Exp $ */
 /* ====================================================================
  * Copyright (c) 1998-2006 The OpenSSL Project.  All rights reserved.
  *
@@ -142,20 +142,6 @@ extern "C" {
 #define SSLEAY_PLATFORM         4
 #define SSLEAY_DIR              5
 
-/* Already declared in ossl_typ.h */
-#if 0
-typedef struct crypto_ex_data_st CRYPTO_EX_DATA;
-/* Called when a new object is created */
-typedef int CRYPTO_EX_new(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
-    int idx, long argl, void *argp);
-/* Called when an object is free()ed */
-typedef void CRYPTO_EX_free(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
-    int idx, long argl, void *argp);
-/* Called when we need to dup an object */
-typedef int CRYPTO_EX_dup(CRYPTO_EX_DATA *to, CRYPTO_EX_DATA *from,
-    void *from_d, int idx, long argl, void *argp);
-#endif
-
 /* A generic structure to pass assorted data in a expandable way */
 typedef struct openssl_item_st {
         int code;
diff --git a/src/lib/libssl/src/crypto/des/cfb64ede.c b/src/lib/libssl/src/crypto/des/cfb64ede.c
index 0b5c7d6249..6d4d287775 100644
--- a/src/lib/libssl/src/crypto/des/cfb64ede.c
+++ b/src/lib/libssl/src/crypto/des/cfb64ede.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cfb64ede.c,v 1.8 2014/10/28 07:35:58 jsg Exp $ */
+/* $OpenBSD: cfb64ede.c,v 1.9 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -132,15 +132,6 @@ void DES_ede3_cfb64_encrypt(const unsigned char *in, unsigned char *out,
         *num=n;
         }
 
-#ifdef undef /* MACRO */
-void DES_ede2_cfb64_encrypt(unsigned char *in, unsigned char *out, long length,
-             DES_key_schedule ks1, DES_key_schedule ks2, DES_cblock (*ivec),
-             int *num, int enc)
-        {
-        DES_ede3_cfb64_encrypt(in,out,length,ks1,ks2,ks1,ivec,num,enc);
-        }
-#endif
-
 /* This is compatible with the single key CFB-r for DES, even thought that's
  * not what EVP needs.
  */
diff --git a/src/lib/libssl/src/crypto/des/des.h b/src/lib/libssl/src/crypto/des/des.h
index e7585bc3d9..e1331d3fa2 100644
--- a/src/lib/libssl/src/crypto/des/des.h
+++ b/src/lib/libssl/src/crypto/des/des.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: des.h,v 1.18 2014/06/12 15:49:28 deraadt Exp $ */
+/* $OpenBSD: des.h,v 1.19 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1997 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -178,11 +178,6 @@ void DES_ede3_ofb64_encrypt(const unsigned char *in,unsigned char *out,
                             long length,DES_key_schedule *ks1,
                             DES_key_schedule *ks2,DES_key_schedule *ks3,
                             DES_cblock *ivec,int *num);
-#if 0
-void DES_xwhite_in2out(const_DES_cblock *DES_key,const_DES_cblock *in_white,
-                       DES_cblock *out_white);
-#endif
-
 int DES_enc_read(int fd,void *buf,int len,DES_key_schedule *sched,
                  DES_cblock *iv);
 int DES_enc_write(int fd,const void *buf,int len,DES_key_schedule *sched,
diff --git a/src/lib/libssl/src/crypto/des/ofb64ede.c b/src/lib/libssl/src/crypto/des/ofb64ede.c
index 1d916e9305..474d38caaf 100644
--- a/src/lib/libssl/src/crypto/des/ofb64ede.c
+++ b/src/lib/libssl/src/crypto/des/ofb64ede.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ofb64ede.c,v 1.5 2014/10/28 07:35:58 jsg Exp $ */
+/* $OpenBSD: ofb64ede.c,v 1.6 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -105,8 +105,6 @@ void DES_ede3_ofb64_encrypt(const unsigned char *in,
                 }
         if (save)
                 {
-/*              v0=ti[0];
-                v1=ti[1];*/
                 iv = &(*ivec)[0];
                 l2c(v0,iv);
                 l2c(v1,iv);
@@ -114,12 +112,3 @@ void DES_ede3_ofb64_encrypt(const unsigned char *in,
         v0=v1=ti[0]=ti[1]=0;
         *num=n;
         }
-
-#ifdef undef /* MACRO */
-void DES_ede2_ofb64_encrypt(unsigned char *in,
-             unsigned char *out, long length, DES_key_schedule k1,
-             DES_key_schedule k2, DES_cblock (*ivec), int *num)
-        {
-        DES_ede3_ofb64_encrypt(in, out, length, k1,k2,k1, ivec, num);
-        }
-#endif
diff --git a/src/lib/libssl/src/crypto/des/xcbc_enc.c b/src/lib/libssl/src/crypto/des/xcbc_enc.c
index dc4607e8aa..4f7a070103 100644
--- a/src/lib/libssl/src/crypto/des/xcbc_enc.c
+++ b/src/lib/libssl/src/crypto/des/xcbc_enc.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: xcbc_enc.c,v 1.8 2014/10/28 07:35:58 jsg Exp $ */
+/* $OpenBSD: xcbc_enc.c,v 1.9 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -60,55 +60,6 @@
 
 /* RSA's DESX */
 
-#if 0 /* broken code, preserved just in case anyone specifically looks for this */
-static const unsigned char desx_white_in2out[256]={
-0xBD,0x56,0xEA,0xF2,0xA2,0xF1,0xAC,0x2A,0xB0,0x93,0xD1,0x9C,0x1B,0x33,0xFD,0xD0,
-0x30,0x04,0xB6,0xDC,0x7D,0xDF,0x32,0x4B,0xF7,0xCB,0x45,0x9B,0x31,0xBB,0x21,0x5A,
-0x41,0x9F,0xE1,0xD9,0x4A,0x4D,0x9E,0xDA,0xA0,0x68,0x2C,0xC3,0x27,0x5F,0x80,0x36,
-0x3E,0xEE,0xFB,0x95,0x1A,0xFE,0xCE,0xA8,0x34,0xA9,0x13,0xF0,0xA6,0x3F,0xD8,0x0C,
-0x78,0x24,0xAF,0x23,0x52,0xC1,0x67,0x17,0xF5,0x66,0x90,0xE7,0xE8,0x07,0xB8,0x60,
-0x48,0xE6,0x1E,0x53,0xF3,0x92,0xA4,0x72,0x8C,0x08,0x15,0x6E,0x86,0x00,0x84,0xFA,
-0xF4,0x7F,0x8A,0x42,0x19,0xF6,0xDB,0xCD,0x14,0x8D,0x50,0x12,0xBA,0x3C,0x06,0x4E,
-0xEC,0xB3,0x35,0x11,0xA1,0x88,0x8E,0x2B,0x94,0x99,0xB7,0x71,0x74,0xD3,0xE4,0xBF,
-0x3A,0xDE,0x96,0x0E,0xBC,0x0A,0xED,0x77,0xFC,0x37,0x6B,0x03,0x79,0x89,0x62,0xC6,
-0xD7,0xC0,0xD2,0x7C,0x6A,0x8B,0x22,0xA3,0x5B,0x05,0x5D,0x02,0x75,0xD5,0x61,0xE3,
-0x18,0x8F,0x55,0x51,0xAD,0x1F,0x0B,0x5E,0x85,0xE5,0xC2,0x57,0x63,0xCA,0x3D,0x6C,
-0xB4,0xC5,0xCC,0x70,0xB2,0x91,0x59,0x0D,0x47,0x20,0xC8,0x4F,0x58,0xE0,0x01,0xE2,
-0x16,0x38,0xC4,0x6F,0x3B,0x0F,0x65,0x46,0xBE,0x7E,0x2D,0x7B,0x82,0xF9,0x40,0xB5,
-0x1D,0x73,0xF8,0xEB,0x26,0xC7,0x87,0x97,0x25,0x54,0xB1,0x28,0xAA,0x98,0x9D,0xA5,
-0x64,0x6D,0x7A,0xD4,0x10,0x81,0x44,0xEF,0x49,0xD6,0xAE,0x2E,0xDD,0x76,0x5C,0x2F,
-0xA7,0x1C,0xC9,0x09,0x69,0x9A,0x83,0xCF,0x29,0x39,0xB9,0xE9,0x4C,0xFF,0x43,0xAB,
-        };
-
-void DES_xwhite_in2out(const_DES_cblock *des_key, const_DES_cblock *in_white,
-             DES_cblock *out_white)
-        {
-        int out0,out1;
-        int i;
-        const unsigned char *key = &(*des_key)[0];
-        const unsigned char *in = &(*in_white)[0];
-        unsigned char *out = &(*out_white)[0];
-
-        out[0]=out[1]=out[2]=out[3]=out[4]=out[5]=out[6]=out[7]=0;
-        out0=out1=0;
-        for (i=0; i<8; i++)
-                {
-                out[i]=key[i]^desx_white_in2out[out0^out1];
-                out0=out1;
-                out1=(int)out[i&0x07];
-                }
-
-        out0=out[0];
-        out1=out[i]; /* BUG: out-of-bounds read */
-        for (i=0; i<8; i++)
-                {
-                out[i]=in[i]^desx_white_in2out[out0^out1];
-                out0=out1;
-                out1=(int)out[i&0x07];
-                }
-        }
-#endif
-
 void DES_xcbc_encrypt(const unsigned char *in, unsigned char *out,
                       long length, DES_key_schedule *schedule,
                       DES_cblock *ivec, const_DES_cblock *inw,
diff --git a/src/lib/libssl/src/crypto/dh/dh_check.c b/src/lib/libssl/src/crypto/dh/dh_check.c
index 0f6c50b055..93e1003bd6 100644
--- a/src/lib/libssl/src/crypto/dh/dh_check.c
+++ b/src/lib/libssl/src/crypto/dh/dh_check.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh_check.c,v 1.14 2014/07/12 16:03:37 miod Exp $ */
+/* $OpenBSD: dh_check.c,v 1.15 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -91,12 +91,6 @@ DH_check(const DH *dh, int *ret)
                 l = BN_mod_word(dh->p, 24);
                 if (l != 11)
                         *ret |= DH_NOT_SUITABLE_GENERATOR;
-#if 0
-        } else if (BN_is_word(dh->g, DH_GENERATOR_3)) {
-                l = BN_mod_word(dh->p, 12);
-                if (l != 5)
-                        *ret |= DH_NOT_SUITABLE_GENERATOR;
-#endif
         } else if (BN_is_word(dh->g, DH_GENERATOR_5)) {
                 l = BN_mod_word(dh->p, 10);
                 if (l != 3 && l != 7)
diff --git a/src/lib/libssl/src/crypto/dh/dh_gen.c b/src/lib/libssl/src/crypto/dh/dh_gen.c
index 6a884eff9e..1bc37b987e 100644
--- a/src/lib/libssl/src/crypto/dh/dh_gen.c
+++ b/src/lib/libssl/src/crypto/dh/dh_gen.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh_gen.c,v 1.13 2014/07/11 08:44:48 jsing Exp $ */
+/* $OpenBSD: dh_gen.c,v 1.14 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -136,14 +136,6 @@ dh_builtin_genparams(DH *ret, int prime_len, int generator, BN_GENCB *cb)
                 if (!BN_set_word(t2, 11))
                         goto err;
                 g = 2;
-#if 0 /* does not work for safe primes */
-        } else if (generator == DH_GENERATOR_3) {
-                if (!BN_set_word(t1, 12))
-                        goto err;
-                if (!BN_set_word(t2, 5))
-                        goto err;
-                g = 3;
-#endif
         } else if (generator == DH_GENERATOR_5) {
                 if (!BN_set_word(t1, 10))
                         goto err;
diff --git a/src/lib/libssl/src/crypto/dso/dso.h b/src/lib/libssl/src/crypto/dso/dso.h
index 52d391c0a4..42de08089e 100644
--- a/src/lib/libssl/src/crypto/dso/dso.h
+++ b/src/lib/libssl/src/crypto/dso/dso.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: dso.h,v 1.10 2014/08/14 17:55:28 tobias Exp $ */
+/* $OpenBSD: dso.h,v 1.11 2015/02/07 13:19:15 doug Exp $ */
 /* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
  * project 2000.
  */
@@ -149,13 +149,6 @@ typedef struct dso_meth_st {
          * alone a DSO_METHOD implemented for them. */
         DSO_FUNC_TYPE (*dso_bind_func)(DSO *dso, const char *symname);
 
-/* I don't think this would actually be used in any circumstances. */
-#if 0
-        /* Unbinds a variable */
-        int (*dso_unbind_var)(DSO *dso, char *symname, void *symptr);
-        /* Unbinds a function */
-        int (*dso_unbind_func)(DSO *dso, char *symname, DSO_FUNC_TYPE symptr);
-#endif
         /* The generic (yuck) "ctrl()" function. NB: Negative return
          * values (rather than zero) indicate errors. */
         long (*dso_ctrl)(DSO *dso, int cmd, long larg, void *parg);
@@ -309,9 +302,6 @@ int DSO_pathbyaddr(void *addr, char *path, int sz);
  * itself or libsocket. */
 void *DSO_global_lookup(const char *name);
 
-/* If BeOS is defined, use shared images. If not, return NULL. */
-DSO_METHOD *DSO_METHOD_beos(void);
-
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
  * made after this point may be overwritten when the script is next run.
diff --git a/src/lib/libssl/src/crypto/dso/dso_dlfcn.c b/src/lib/libssl/src/crypto/dso/dso_dlfcn.c
index b75c9e23e0..f22e641bab 100644
--- a/src/lib/libssl/src/crypto/dso/dso_dlfcn.c
+++ b/src/lib/libssl/src/crypto/dso/dso_dlfcn.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dso_dlfcn.c,v 1.27 2014/07/11 08:44:48 jsing Exp $ */
+/* $OpenBSD: dso_dlfcn.c,v 1.28 2015/02/07 13:19:15 doug Exp $ */
 /* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
  * project 2000.
  */
@@ -82,12 +82,6 @@ static int dlfcn_load(DSO *dso);
 static int dlfcn_unload(DSO *dso);
 static void *dlfcn_bind_var(DSO *dso, const char *symname);
 static DSO_FUNC_TYPE dlfcn_bind_func(DSO *dso, const char *symname);
-#if 0
-static int dlfcn_unbind(DSO *dso, char *symname, void *symptr);
-static int dlfcn_init(DSO *dso);
-static int dlfcn_finish(DSO *dso);
-static long dlfcn_ctrl(DSO *dso, int cmd, long larg, void *parg);
-#endif
 static char *dlfcn_name_converter(DSO *dso, const char *filename);
 static char *dlfcn_merger(DSO *dso, const char *filespec1,
     const char *filespec2);
diff --git a/src/lib/libssl/src/crypto/ec/ec_curve.c b/src/lib/libssl/src/crypto/ec/ec_curve.c
index 6490cd9d84..df49089bb6 100644
--- a/src/lib/libssl/src/crypto/ec/ec_curve.c
+++ b/src/lib/libssl/src/crypto/ec/ec_curve.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_curve.c,v 1.9 2014/11/12 18:21:07 miod Exp $ */
+/* $OpenBSD: ec_curve.c,v 1.10 2015/02/07 13:19:15 doug Exp $ */
 /*
  * Written by Nils Larsch for the OpenSSL project.
  */
@@ -1008,13 +1008,6 @@ static const struct {
                 NID_X9_62_characteristic_two_field, 0, 21, 2
         },
         {                       /* no seed */
-#if 0
-/* The algorithm used to derive the curve parameters from
- * the seed used here is slightly different than the
- * algorithm described in X9.62 . */
-                0x24, 0xB7, 0xB1, 0x37, 0xC8, 0xA1, 0x4D, 0x69, 0x6E, 0x67,
-                0x68, 0x75, 0x61, 0x51, 0x75, 0x6F, 0xD0, 0xDA, 0x2E, 0x5C,
-#endif
                 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,     /* p */
                 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                 0xC9,
@@ -1045,12 +1038,6 @@ static const struct {
                 NID_X9_62_characteristic_two_field, 0, 21, 2
         },
         {                       /* no seed */
-#if 0
-/* The seed here was used to created the curve parameters in normal
- * basis representation (and not the polynomial representation used here) */
-                0x85, 0xE2, 0x5B, 0xFE, 0x5C, 0x86, 0x22, 0x6C, 0xDB, 0x12,
-                0x01, 0x6F, 0x75, 0x53, 0xF9, 0xD0, 0xE6, 0x93, 0xA2, 0x68,
-#endif
                 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,     /* p */
                 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                 0xC9,
diff --git a/src/lib/libssl/src/crypto/ec/ec_mult.c b/src/lib/libssl/src/crypto/ec/ec_mult.c
index 3dc17bc409..9e3aee13a2 100644
--- a/src/lib/libssl/src/crypto/ec/ec_mult.c
+++ b/src/lib/libssl/src/crypto/ec/ec_mult.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_mult.c,v 1.15 2014/11/11 06:23:43 guenther Exp $ */
+/* $OpenBSD: ec_mult.c,v 1.16 2015/02/07 13:19:15 doug Exp $ */
 /*
  * Originally written by Bodo Moeller and Nils Larsch for the OpenSSL project.
  */
@@ -627,11 +627,8 @@ ec_wNAF_mul(const EC_GROUP * group, EC_POINT * r, const BIGNUM * scalar,
                 }
         }
 
-#if 1                           /* optional; EC_window_bits_for_scalar_size
-                                 * assumes we do this step */
         if (!EC_POINTs_make_affine(group, num_val, val, ctx))
                 goto err;
-#endif
 
         r_is_at_infinity = 1;
 
diff --git a/src/lib/libssl/src/crypto/ecdh/ech_lib.c b/src/lib/libssl/src/crypto/ecdh/ech_lib.c
index e9fae9428b..43c4f8ce31 100644
--- a/src/lib/libssl/src/crypto/ecdh/ech_lib.c
+++ b/src/lib/libssl/src/crypto/ecdh/ech_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ech_lib.c,v 1.7 2014/07/10 22:45:57 jsing Exp $ */
+/* $OpenBSD: ech_lib.c,v 1.8 2015/02/07 13:19:15 doug Exp $ */
 /* ====================================================================
  * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
  *
@@ -106,11 +106,6 @@ int ECDH_set_method(EC_KEY *eckey, const ECDH_METHOD *meth)
         if (ecdh == NULL)
                 return 0;
 
-#if 0
-        mtmp = ecdh->meth;
-        if (mtmp->finish)
-                mtmp->finish(eckey);
-#endif
 #ifndef OPENSSL_NO_ENGINE
         if (ecdh->engine)
                 {
@@ -119,10 +114,6 @@ int ECDH_set_method(EC_KEY *eckey, const ECDH_METHOD *meth)
                 }
 #endif
         ecdh->meth = meth;
-#if 0
-        if (meth->init) 
-                meth->init(eckey);
-#endif
         return 1;
         }
 
@@ -159,14 +150,6 @@ static ECDH_DATA *ECDH_DATA_new_method(ENGINE *engine)
 
         ret->flags = ret->meth->flags;
         CRYPTO_new_ex_data(CRYPTO_EX_INDEX_ECDH, ret, &ret->ex_data);
-#if 0
-        if ((ret->meth->init != NULL) && !ret->meth->init(ret))
-                {
-                CRYPTO_free_ex_data(CRYPTO_EX_INDEX_ECDH, ret, &ret->ex_data);
-                free(ret);
-                ret=NULL;
-                }
-#endif  
         return(ret);
         }
 
diff --git a/src/lib/libssl/src/crypto/ecdh/ech_locl.h b/src/lib/libssl/src/crypto/ecdh/ech_locl.h
index fff54abf60..077c7dab95 100644
--- a/src/lib/libssl/src/crypto/ecdh/ech_locl.h
+++ b/src/lib/libssl/src/crypto/ecdh/ech_locl.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ech_locl.h,v 1.2 2014/06/12 15:49:29 deraadt Exp $ */
+/* $OpenBSD: ech_locl.h,v 1.3 2015/02/07 13:19:15 doug Exp $ */
 /* ====================================================================
  * Copyright (c) 2000-2005 The OpenSSL Project.  All rights reserved.
  *
@@ -67,10 +67,6 @@ struct ecdh_method
         const char *name;
         int (*compute_key)(void *key, size_t outlen, const EC_POINT *pub_key, EC_KEY *ecdh,
                            void *(*KDF)(const void *in, size_t inlen, void *out, size_t *outlen));
-#if 0
-        int (*init)(EC_KEY *eckey);
-        int (*finish)(EC_KEY *eckey);
-#endif
         int flags;
         char *app_data;
         };
diff --git a/src/lib/libssl/src/crypto/ecdsa/ecs_lib.c b/src/lib/libssl/src/crypto/ecdsa/ecs_lib.c
index a92d6117c9..6cdf4c124b 100644
--- a/src/lib/libssl/src/crypto/ecdsa/ecs_lib.c
+++ b/src/lib/libssl/src/crypto/ecdsa/ecs_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ecs_lib.c,v 1.7 2014/07/10 22:45:57 jsing Exp $ */
+/* $OpenBSD: ecs_lib.c,v 1.8 2015/02/07 13:19:15 doug Exp $ */
 /* ====================================================================
  * Copyright (c) 1998-2005 The OpenSSL Project.  All rights reserved.
  *
@@ -138,14 +138,6 @@ static ECDSA_DATA *ECDSA_DATA_new_method(ENGINE *engine)
 
         ret->flags = ret->meth->flags;
         CRYPTO_new_ex_data(CRYPTO_EX_INDEX_ECDSA, ret, &ret->ex_data);
-#if 0
-        if ((ret->meth->init != NULL) && !ret->meth->init(ret))
-        {
-                CRYPTO_free_ex_data(CRYPTO_EX_INDEX_ECDSA, ret, &ret->ex_data);
-                free(ret);
-                ret=NULL;
-        }
-#endif  
         return(ret);
 }
 
diff --git a/src/lib/libssl/src/crypto/engine/eng_all.c b/src/lib/libssl/src/crypto/engine/eng_all.c
index 21b76266c7..014bcb132e 100644
--- a/src/lib/libssl/src/crypto/engine/eng_all.c
+++ b/src/lib/libssl/src/crypto/engine/eng_all.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: eng_all.c,v 1.26 2014/07/10 22:45:57 jsing Exp $ */
+/* $OpenBSD: eng_all.c,v 1.27 2015/02/07 13:19:15 doug Exp $ */
 /* Written by Richard Levitte <richard@levitte.org> for the OpenSSL
  * project 2000.
  */
@@ -66,13 +66,6 @@ ENGINE_load_builtin_engines(void)
 {
         /* Some ENGINEs need this */
         OPENSSL_cpuid_setup();
-#if 0
-        /* There's no longer any need for an "openssl" ENGINE unless, one day,
-         * it is the *only* way for standard builtin implementations to be be
-         * accessed (ie. it would be possible to statically link binaries with
-         * *no* builtin implementations). */
-        ENGINE_load_openssl();
-#endif
 
 #ifndef OPENSSL_NO_RSAX
         ENGINE_load_rsax();
diff --git a/src/lib/libssl/src/crypto/engine/eng_list.c b/src/lib/libssl/src/crypto/engine/eng_list.c
index b84504102f..78e978116a 100644
--- a/src/lib/libssl/src/crypto/engine/eng_list.c
+++ b/src/lib/libssl/src/crypto/engine/eng_list.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: eng_list.c,v 1.15 2014/07/11 08:44:48 jsing Exp $ */
+/* $OpenBSD: eng_list.c,v 1.16 2015/02/07 13:19:15 doug Exp $ */
 /* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
  * project 2000.
  */
@@ -378,14 +378,7 @@ ENGINE_by_id(const char *id)
                 }
         }
         CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
-#if 0
-        if (iterator == NULL) {
-                ENGINEerr(ENGINE_F_ENGINE_BY_ID,
-                    ENGINE_R_NO_SUCH_ENGINE);
-                ERR_asprintf_error_data("id=%s", id);
-        }
-        return iterator;
-#else
+
         /* EEK! Experimental code starts */
         if (iterator)
                 return iterator;
@@ -415,7 +408,6 @@ notfound:
         ERR_asprintf_error_data("id=%s", id);
         return NULL;
         /* EEK! Experimental code ends */
-#endif
 }
 
 int
diff --git a/src/lib/libssl/src/crypto/engine/eng_padlock.c b/src/lib/libssl/src/crypto/engine/eng_padlock.c
index 48040db82d..1c86a343df 100644
--- a/src/lib/libssl/src/crypto/engine/eng_padlock.c
+++ b/src/lib/libssl/src/crypto/engine/eng_padlock.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: eng_padlock.c,v 1.13 2014/10/18 17:20:40 jsing Exp $ */
+/* $OpenBSD: eng_padlock.c,v 1.14 2015/02/07 13:19:15 doug Exp $ */
 /*
  * Support for VIA PadLock Advanced Cryptography Engine (ACE)
  * Written by Michal Ludvig <michal@logix.cz>
@@ -168,9 +168,11 @@ padlock_bind_helper(ENGINE *e)
         /* Check available features */
         padlock_available();
 
-#if 1   /* disable RNG for now, see commentary in vicinity of RNG code */
+        /*
+         * RNG is currently disabled for reasons discussed in commentary just
+         * before padlock_rand_bytes function.
+         */
         padlock_use_rng = 0;
-#endif
 
         /* Generate a nice engine name with available features */
         (void) snprintf(padlock_name, sizeof(padlock_name),
diff --git a/src/lib/libssl/src/crypto/engine/tb_store.c b/src/lib/libssl/src/crypto/engine/tb_store.c
index 2f0cc004f3..e9ad11ab01 100644
--- a/src/lib/libssl/src/crypto/engine/tb_store.c
+++ b/src/lib/libssl/src/crypto/engine/tb_store.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tb_store.c,v 1.4 2014/06/12 15:49:29 deraadt Exp $ */
+/* $OpenBSD: tb_store.c,v 1.5 2015/02/07 13:19:15 doug Exp $ */
 /* ====================================================================
  * Copyright (c) 2003 The OpenSSL Project.  All rights reserved.
  *
@@ -93,29 +93,6 @@ ENGINE_register_all_STORE(void)
                 ENGINE_register_STORE(e);
 }
 
-/* The following two functions are removed because they're useless. */
-#if 0
-int
-ENGINE_set_default_STORE(ENGINE *e)
-{
-        if (e->store_meth)
-                return engine_table_register(&store_table,
-                    engine_unregister_all_STORE, e, &dummy_nid, 1, 1);
-        return 1;
-}
-#endif
-
-#if 0
-/* Exposed API function to get a functional reference from the implementation
- * table (ie. try to get a functional reference from the tabled structural
- * references). */
-ENGINE *
-ENGINE_get_default_STORE(void)
-{
-        return engine_table_select(&store_table, dummy_nid);
-}
-#endif
-
 /* Obtains an STORE implementation from an ENGINE functional reference */
 const STORE_METHOD *
 ENGINE_get_STORE(const ENGINE *e)
diff --git a/src/lib/libssl/src/crypto/evp/bio_b64.c b/src/lib/libssl/src/crypto/evp/bio_b64.c
index 53b8bcf615..b54e8793ec 100644
--- a/src/lib/libssl/src/crypto/evp/bio_b64.c
+++ b/src/lib/libssl/src/crypto/evp/bio_b64.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: bio_b64.c,v 1.19 2014/07/11 12:04:46 miod Exp $ */
+/* $OpenBSD: bio_b64.c,v 1.20 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -293,11 +293,7 @@ b64_read(BIO *b, char *out, int outl)
                 if (BIO_get_flags(b) & BIO_FLAGS_BASE64_NO_NL) {
                         int z, jj;
 
-#if 0
-                        jj = (i >> 2) << 2;
-#else
                         jj = i & ~3; /* process per 4 */
-#endif
                         z = EVP_DecodeBlock((unsigned char *)ctx->buf,
                             (unsigned char *)ctx->tmp, jj);
                         if (jj > 2) {
diff --git a/src/lib/libssl/src/crypto/evp/encode.c b/src/lib/libssl/src/crypto/evp/encode.c
index 067e62dfe9..725667bfff 100644
--- a/src/lib/libssl/src/crypto/evp/encode.c
+++ b/src/lib/libssl/src/crypto/evp/encode.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: encode.c,v 1.19 2014/08/06 16:01:44 jsing Exp $ */
+/* $OpenBSD: encode.c,v 1.20 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -415,36 +415,3 @@ EVP_DecodeFinal(EVP_ENCODE_CTX *ctx, unsigned char *out, int *outl)
         } else
                 return (1);
 }
-
-#ifdef undef
-int
-EVP_DecodeValid(unsigned char *buf, int len)
-{
-        int i, num = 0, bad = 0;
-
-        if (len == 0)
-                return (-1);
-        while (conv_ascii2bin(*buf) == B64_WS) {
-                buf++;
-                len--;
-                if (len == 0)
-                        return (-1);
-        }
-
-        for (i = len; i >= 4; i -= 4) {
-                if ((conv_ascii2bin(buf[0]) >= 0x40) ||
-                    (conv_ascii2bin(buf[1]) >= 0x40) ||
-                    (conv_ascii2bin(buf[2]) >= 0x40) ||
-                    (conv_ascii2bin(buf[3]) >= 0x40))
-                        return (-1);
-                buf += 4;
-                num += 1 + (buf[2] != '=') + (buf[3] != '=');
-        }
-        if ((i == 1) && (conv_ascii2bin(buf[0]) == B64_EOLN))
-                return (num);
-        if ((i == 2) && (conv_ascii2bin(buf[0]) == B64_EOLN) &&
-            (conv_ascii2bin(buf[0]) == B64_EOLN))
-                return (num);
-        return (1);
-}
-#endif
diff --git a/src/lib/libssl/src/crypto/evp/evp.h b/src/lib/libssl/src/crypto/evp/evp.h
index 6c1bf6c7cd..107119883a 100644
--- a/src/lib/libssl/src/crypto/evp/evp.h
+++ b/src/lib/libssl/src/crypto/evp/evp.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: evp.h,v 1.40 2014/11/09 19:17:13 miod Exp $ */
+/* $OpenBSD: evp.h,v 1.41 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -701,10 +701,6 @@ const EVP_CIPHER *EVP_des_cfb1(void);
 const EVP_CIPHER *EVP_des_cfb8(void);
 const EVP_CIPHER *EVP_des_ede_cfb64(void);
 # define EVP_des_ede_cfb EVP_des_ede_cfb64
-#if 0
-const EVP_CIPHER *EVP_des_ede_cfb1(void);
-const EVP_CIPHER *EVP_des_ede_cfb8(void);
-#endif
 const EVP_CIPHER *EVP_des_ede3_cfb64(void);
 # define EVP_des_ede3_cfb EVP_des_ede3_cfb64
 const EVP_CIPHER *EVP_des_ede3_cfb1(void);
diff --git a/src/lib/libssl/src/crypto/evp/p_sign.c b/src/lib/libssl/src/crypto/evp/p_sign.c
index f68a950c9c..4058d47f07 100644
--- a/src/lib/libssl/src/crypto/evp/p_sign.c
+++ b/src/lib/libssl/src/crypto/evp/p_sign.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: p_sign.c,v 1.12 2014/07/11 08:44:48 jsing Exp $ */
+/* $OpenBSD: p_sign.c,v 1.13 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -63,21 +63,6 @@
 #include <openssl/objects.h>
 #include <openssl/x509.h>
 
-#ifdef undef
-void
-EVP_SignInit(EVP_MD_CTX *ctx, EVP_MD *type)
-{
-        EVP_DigestInit_ex(ctx, type);
-}
-
-void
-EVP_SignUpdate(EVP_MD_CTX *ctx, unsigned char *data,
-    unsigned int count)
-{
-        EVP_DigestUpdate(ctx, data, count);
-}
-#endif
-
 int
 EVP_SignFinal(EVP_MD_CTX *ctx, unsigned char *sigret, unsigned int *siglen,
     EVP_PKEY *pkey)
diff --git a/src/lib/libssl/src/crypto/idea/idea_lcl.h b/src/lib/libssl/src/crypto/idea/idea_lcl.h
index cc58b360ad..e46c960875 100644
--- a/src/lib/libssl/src/crypto/idea/idea_lcl.h
+++ b/src/lib/libssl/src/crypto/idea/idea_lcl.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: idea_lcl.h,v 1.2 2014/06/12 15:49:29 deraadt Exp $ */
+/* $OpenBSD: idea_lcl.h,v 1.3 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -69,18 +69,6 @@ if (ul != 0) \
 else \
         r=(-(int)a-b+1); /* assuming a or b is 0 and in range */ 
 
-#ifdef undef
-#define idea_mul(r,a,b,ul,sl) \
-if (a == 0) r=(0x10001-b)&0xffff; \
-else if (b == 0) r=(0x10001-a)&0xffff; \
-else    { \
-        ul=(unsigned long)a*b; \
-        sl=(ul&0xffff)-(ul>>16); \
-        if (sl <= 0) sl+=0x10001; \
-        r=sl; \
-        } 
-#endif
-
 /*  7/12/95 - Many thanks to Rhys Weatherley <rweather@us.oracle.com>
  * for pointing out that I was assuming little endian
  * byte order for all quantities what idea
@@ -142,59 +130,6 @@ else	{ \
 #define n2s(c,l)        (l =((IDEA_INT)(*((c)++)))<< 8L, \
                          l|=((IDEA_INT)(*((c)++)))      )
 
-#ifdef undef
-/* NOTE - c is not incremented as per c2l */
-#define c2ln(c,l1,l2,n) { \
-                        c+=n; \
-                        l1=l2=0; \
-                        switch (n) { \
-                        case 8: l2 =((unsigned long)(*(--(c))))<<24; \
-                        case 7: l2|=((unsigned long)(*(--(c))))<<16; \
-                        case 6: l2|=((unsigned long)(*(--(c))))<< 8; \
-                        case 5: l2|=((unsigned long)(*(--(c))));     \
-                        case 4: l1 =((unsigned long)(*(--(c))))<<24; \
-                        case 3: l1|=((unsigned long)(*(--(c))))<<16; \
-                        case 2: l1|=((unsigned long)(*(--(c))))<< 8; \
-                        case 1: l1|=((unsigned long)(*(--(c))));     \
-                                } \
-                        }
-
-/* NOTE - c is not incremented as per l2c */
-#define l2cn(l1,l2,c,n) { \
-                        c+=n; \
-                        switch (n) { \
-                        case 8: *(--(c))=(unsigned char)(((l2)>>24)&0xff); \
-                        case 7: *(--(c))=(unsigned char)(((l2)>>16)&0xff); \
-                        case 6: *(--(c))=(unsigned char)(((l2)>> 8)&0xff); \
-                        case 5: *(--(c))=(unsigned char)(((l2)    )&0xff); \
-                        case 4: *(--(c))=(unsigned char)(((l1)>>24)&0xff); \
-                        case 3: *(--(c))=(unsigned char)(((l1)>>16)&0xff); \
-                        case 2: *(--(c))=(unsigned char)(((l1)>> 8)&0xff); \
-                        case 1: *(--(c))=(unsigned char)(((l1)    )&0xff); \
-                                } \
-                        }
-
-#undef c2s
-#define c2s(c,l)        (l =((unsigned long)(*((c)++)))    , \
-                         l|=((unsigned long)(*((c)++)))<< 8L)
-
-#undef s2c
-#define s2c(l,c)        (*((c)++)=(unsigned char)(((l)     )&0xff), \
-                         *((c)++)=(unsigned char)(((l)>> 8L)&0xff))
-
-#undef c2l
-#define c2l(c,l)        (l =((unsigned long)(*((c)++)))     , \
-                         l|=((unsigned long)(*((c)++)))<< 8L, \
-                         l|=((unsigned long)(*((c)++)))<<16L, \
-                         l|=((unsigned long)(*((c)++)))<<24L)
-
-#undef l2c
-#define l2c(l,c)        (*((c)++)=(unsigned char)(((l)     )&0xff), \
-                         *((c)++)=(unsigned char)(((l)>> 8L)&0xff), \
-                         *((c)++)=(unsigned char)(((l)>>16L)&0xff), \
-                         *((c)++)=(unsigned char)(((l)>>24L)&0xff))
-#endif
-
 #define E_IDEA(num) \
         x1&=0xffff; \
         idea_mul(x1,x1,*p,ul); p++; \
diff --git a/src/lib/libssl/src/crypto/modes/gcm128.c b/src/lib/libssl/src/crypto/modes/gcm128.c
index 5b600517be..1106617763 100644
--- a/src/lib/libssl/src/crypto/modes/gcm128.c
+++ b/src/lib/libssl/src/crypto/modes/gcm128.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: gcm128.c,v 1.10 2014/07/09 16:06:13 miod Exp $ */
+/* $OpenBSD: gcm128.c,v 1.11 2015/02/07 13:19:15 doug Exp $ */
 /* ====================================================================
  * Copyright (c) 2010 The OpenSSL Project.  All rights reserved.
  *
@@ -898,9 +898,6 @@ int CRYPTO_gcm128_encrypt(GCM128_CONTEXT *ctx,
 # endif
 #endif
 
-#if 0
-        n = (unsigned int)mlen%16; /* alternative to ctx->mres */
-#endif
         mlen += len;
         if (mlen>((U64(1)<<36)-32) || (sizeof(len)==8 && mlen<len))
                 return -1;
diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_key.c b/src/lib/libssl/src/crypto/pkcs12/p12_key.c
index 0357c2bfa2..0b3547a6fb 100644
--- a/src/lib/libssl/src/crypto/pkcs12/p12_key.c
+++ b/src/lib/libssl/src/crypto/pkcs12/p12_key.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: p12_key.c,v 1.21 2014/07/12 16:03:37 miod Exp $ */
+/* $OpenBSD: p12_key.c,v 1.22 2015/02/07 13:19:15 doug Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -107,13 +107,6 @@ PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt,
         BIGNUM *Ij, *Bpl1;      /* These hold Ij and B + 1 */
         EVP_MD_CTX ctx;
 
-#if 0
-        if (!pass) {
-                PKCS12err(PKCS12_F_PKCS12_KEY_GEN_UNI, ERR_R_PASSED_NULL_PARAMETER);
-                return 0;
-        }
-#endif
-
         EVP_MD_CTX_init(&ctx);
         v = EVP_MD_block_size(md_type);
         u = EVP_MD_size(md_type);
diff --git a/src/lib/libssl/src/crypto/pkcs7/pk7_doit.c b/src/lib/libssl/src/crypto/pkcs7/pk7_doit.c
index d69aff8f41..252fab04d7 100644
--- a/src/lib/libssl/src/crypto/pkcs7/pk7_doit.c
+++ b/src/lib/libssl/src/crypto/pkcs7/pk7_doit.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pk7_doit.c,v 1.30 2014/10/22 13:02:04 jsing Exp $ */
+/* $OpenBSD: pk7_doit.c,v 1.31 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -482,15 +482,6 @@ PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
         }
 
         if (evp_cipher != NULL) {
-#if 0
-                unsigned char key[EVP_MAX_KEY_LENGTH];
-                unsigned char iv[EVP_MAX_IV_LENGTH];
-                unsigned char *p;
-                int keylen, ivlen;
-                int max;
-                X509_OBJECT ret;
-#endif
-
                 if ((etmp = BIO_new(BIO_f_cipher())) == NULL) {
                         PKCS7err(PKCS7_F_PKCS7_DATADECODE, ERR_R_BIO_LIB);
                         goto err;
@@ -594,20 +585,9 @@ PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                 etmp = NULL;
         }
 
-#if 1
         if (PKCS7_is_detached(p7) || (in_bio != NULL)) {
                 bio = in_bio;
         } else {
-#if 0
-                bio = BIO_new(BIO_s_mem());
-                /* We need to set this so that when we have read all
-                 * the data, the encrypt BIO, if present, will read
-                 * EOF and encode the last few bytes */
-                BIO_set_mem_eof_return(bio, 0);
-
-                if (data_body != NULL && data_body->length > 0)
-                        BIO_write(bio, (char *)data_body->data, data_body->length);
-#else
                 if (data_body != NULL && data_body->length > 0)
                         bio = BIO_new_mem_buf(data_body->data, data_body->length);
                 else {
@@ -616,11 +596,10 @@ PKCS7_dataDecode(PKCS7 *p7, EVP_PKEY *pkey, BIO *in_bio, X509 *pcert)
                 }
                 if (bio == NULL)
                         goto err;
-#endif
         }
         BIO_push(out, bio);
         bio = NULL;
-#endif
+
         if (0) {
 err:
                 if (ek) {
diff --git a/src/lib/libssl/src/crypto/stack/stack.c b/src/lib/libssl/src/crypto/stack/stack.c
index cbd4d216f6..d941f9e6fb 100644
--- a/src/lib/libssl/src/crypto/stack/stack.c
+++ b/src/lib/libssl/src/crypto/stack/stack.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: stack.c,v 1.18 2014/07/11 08:44:49 jsing Exp $ */
+/* $OpenBSD: stack.c,v 1.19 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -56,16 +56,6 @@
  * [including the GNU Public Licence.]
  */
 
-/* Code for stacks
- * Author - Eric Young v 1.0
- * 1.2 eay 12-Mar-97 -  Modified sk_find so that it _DOES_ return the
- *                      lowest index for the searched item.
- *
- * 1.1 eay - Take from netdb and added to SSLeay
- *
- * 1.0 eay - First version 29/07/92
- */
-
 #include <stdio.h>
 #include <string.h>
 
diff --git a/src/lib/libssl/src/crypto/x509/x509_vfy.h b/src/lib/libssl/src/crypto/x509/x509_vfy.h
index 500b520495..e760279b52 100644
--- a/src/lib/libssl/src/crypto/x509/x509_vfy.h
+++ b/src/lib/libssl/src/crypto/x509/x509_vfy.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_vfy.h,v 1.14 2015/01/22 09:06:39 reyk Exp $ */
+/* $OpenBSD: x509_vfy.h,v 1.15 2015/02/07 13:19:15 doug Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -77,17 +77,6 @@
 extern "C" {
 #endif
 
-#if 0
-/* Outer object */
-typedef struct x509_hash_dir_st
-        {
-        int num_dirs;
-        char **dirs;
-        int *dirs_type;
-        int num_dirs_alloced;
-        } X509_HASH_DIR_CTX;
-#endif
-
 typedef struct x509_file_st
         {
         int num_paths;  /* number of paths to files or directories */
diff --git a/src/lib/libssl/src/crypto/x509v3/pcy_lib.c b/src/lib/libssl/src/crypto/x509v3/pcy_lib.c
index 321370e135..6f37064063 100644
--- a/src/lib/libssl/src/crypto/x509v3/pcy_lib.c
+++ b/src/lib/libssl/src/crypto/x509v3/pcy_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pcy_lib.c,v 1.4 2014/07/11 08:44:49 jsing Exp $ */
+/* $OpenBSD: pcy_lib.c,v 1.5 2015/02/07 13:19:15 doug Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2004.
  */
@@ -140,16 +140,6 @@ X509_policy_node_get0_policy(const X509_POLICY_NODE *node)
         return node->data->valid_policy;
 }
 
-#if 0
-int
-X509_policy_node_get_critical(const X509_POLICY_NODE *node)
-{
-        if (node_critical(node))
-                return 1;
-        return 0;
-}
-#endif
-
 STACK_OF(POLICYQUALINFO) *
 X509_policy_node_get0_qualifiers(const X509_POLICY_NODE *node)
 {
diff --git a/src/lib/libssl/src/crypto/x509v3/pcy_tree.c b/src/lib/libssl/src/crypto/x509v3/pcy_tree.c
index 2c6472a8a1..fa0e161562 100644
--- a/src/lib/libssl/src/crypto/x509v3/pcy_tree.c
+++ b/src/lib/libssl/src/crypto/x509v3/pcy_tree.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pcy_tree.c,v 1.12 2014/07/11 08:44:49 jsing Exp $ */
+/* $OpenBSD: pcy_tree.c,v 1.13 2015/02/07 13:19:15 doug Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2004.
  */
@@ -153,11 +153,6 @@ tree_init(X509_POLICY_TREE **ptree, STACK_OF(X509) *certs, unsigned int flags)
         *ptree = NULL;
         n = sk_X509_num(certs);
 
-#if 0
-        /* Disable policy mapping for now... */
-        flags |= X509_V_FLAG_INHIBIT_MAP;
-#endif
-
         if (flags & X509_V_FLAG_EXPLICIT_POLICY)
                 explicit_policy = 0;
         else
@@ -327,19 +322,6 @@ tree_link_nodes(X509_POLICY_LEVEL *curr, const X509_POLICY_CACHE *cache)
 
         for (i = 0; i < sk_X509_POLICY_DATA_num(cache->data); i++) {
                 data = sk_X509_POLICY_DATA_value(cache->data, i);
-                /* If a node is mapped any it doesn't have a corresponding
-                 * CertificatePolicies entry.
-                 * However such an identical node would be created
-                 * if anyPolicy matching is enabled because there would be
-                 * no match with the parent valid_policy_set. So we create
-                 * link because then it will have the mapping flags
-                 * right and we can prune it later.
-                 */
-#if 0
-                if ((data->flags & POLICY_DATA_FLAG_MAPPED_ANY) &&
-                    !(curr->flags & X509_V_FLAG_INHIBIT_ANY))
-                        continue;
-#endif
                 /* Look for matching nodes in previous level */
                 if (!tree_link_matching_nodes(curr, data))
                         return 0;
@@ -416,7 +398,6 @@ tree_link_any(X509_POLICY_LEVEL *curr, const X509_POLICY_CACHE *cache,
     X509_POLICY_TREE *tree)
 {
         int i;
-        /*X509_POLICY_DATA *data;*/
         X509_POLICY_NODE *node;
         X509_POLICY_LEVEL *last = curr - 1;
 
@@ -425,36 +406,6 @@ tree_link_any(X509_POLICY_LEVEL *curr, const X509_POLICY_CACHE *cache,
 
                 if (!tree_link_unmatched(curr, cache, node, tree))
                         return 0;
-
-#if 0
-
-                /* Skip any node with any children: we only want unmathced
-                 * nodes.
-                 *
-                 * Note: need something better for policy mapping
-                 * because each node may have multiple children
-                 */
-                if (node->nchild)
-                        continue;
-
-                /* Create a new node with qualifiers from anyPolicy and
-                 * id from unmatched node.
-                 */
-                data = policy_data_new(NULL, node->data->valid_policy,
-                    node_critical(node));
-
-                if (data == NULL)
-                        return 0;
-                /* Curr may not have anyPolicy */
-                data->qualifier_set = cache->anyPolicy->qualifier_set;
-                data->flags |= POLICY_DATA_FLAG_SHARED_QUALIFIERS;
-                if (!level_add_node(curr, data, node, tree)) {
-                        policy_data_free(data);
-                        return 0;
-                }
-
-#endif
-
         }
         /* Finally add link to anyPolicy */
         if (last->anyPolicy) {
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_info.c b/src/lib/libssl/src/crypto/x509v3/v3_info.c
index 862f949b1b..0a4df34078 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_info.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_info.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: v3_info.c,v 1.19 2014/10/05 18:28:56 miod Exp $ */
+/* $OpenBSD: v3_info.c,v 1.20 2015/02/07 13:19:15 doug Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -208,8 +208,5 @@ int
 i2a_ACCESS_DESCRIPTION(BIO *bp, ACCESS_DESCRIPTION* a)
 {
         i2a_ASN1_OBJECT(bp, a->method);
-#ifdef UNDEF
-        i2a_GENERAL_NAME(bp, a->location);
-#endif
         return 2;
 }
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_utl.c b/src/lib/libssl/src/crypto/x509v3/v3_utl.c
index 99090f3cd2..ee135a0b52 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_utl.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_utl.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: v3_utl.c,v 1.23 2014/07/13 16:03:10 beck Exp $ */
+/* $OpenBSD: v3_utl.c,v 1.24 2015/02/07 13:19:15 doug Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
  */
@@ -328,9 +328,6 @@ X509V3_parse_list(const char *line)
                                 *p = 0;
                                 ntmp = strip_spaces(q);
                                 q = p + 1;
-#if 0
-                                printf("%s\n", ntmp);
-#endif
                                 if (!ntmp) {
                                         X509V3err(X509V3_F_X509V3_PARSE_LIST,
                                             X509V3_R_INVALID_NULL_NAME);
@@ -345,9 +342,6 @@ X509V3_parse_list(const char *line)
                                 state = HDR_NAME;
                                 *p = 0;
                                 vtmp = strip_spaces(q);
-#if 0
-                                printf("%s\n", ntmp);
-#endif
                                 if (!vtmp) {
                                         X509V3err(X509V3_F_X509V3_PARSE_LIST,
                                             X509V3_R_INVALID_NULL_VALUE);
@@ -363,9 +357,6 @@ X509V3_parse_list(const char *line)
 
         if (state == HDR_VALUE) {
                 vtmp = strip_spaces(q);
-#if 0
-                printf("%s=%s\n", ntmp, vtmp);
-#endif
                 if (!vtmp) {
                         X509V3err(X509V3_F_X509V3_PARSE_LIST,
                             X509V3_R_INVALID_NULL_VALUE);
@@ -374,9 +365,6 @@ X509V3_parse_list(const char *line)
                 X509V3_add_value(ntmp, vtmp, &values);
         } else {
                 ntmp = strip_spaces(q);
-#if 0
-                printf("%s\n", ntmp);
-#endif
                 if (!ntmp) {
                         X509V3err(X509V3_F_X509V3_PARSE_LIST,
                             X509V3_R_INVALID_NULL_NAME);