import openssl-0.9.7-stable-SNAP-20020911 (without idea)

128 files changed, 6497 insertions, 519 deletions

diff --git a/src/lib/libcrypto/crypto-lib.com b/src/lib/libcrypto/crypto-lib.com
index 4847a69a71..dfcff11860 100644
--- a/src/lib/libcrypto/crypto-lib.com
+++ b/src/lib/libcrypto/crypto-lib.com
@@ -231,7 +231,7 @@ $ LIB_RAND = "md_rand,randfile,rand_lib,rand_err,rand_egd,"+ -
         "rand_vms"
 $ LIB_ERR = "err,err_all,err_prn"
 $ LIB_OBJECTS = "o_names,obj_dat,obj_lib,obj_err"
-$ LIB_EVP = "encode,digest,evp_enc,evp_key,"+ -
+$ LIB_EVP = "encode,digest,evp_enc,evp_key,evp_acnf,"+ -
         "e_des,e_bf,e_idea,e_des3,"+ -
         "e_rc4,e_aes,names,"+ -
         "e_xcbc_d,e_rc2,e_cast,e_rc5"
@@ -265,14 +265,14 @@ $ LIB_X509V3 = "v3_bcons,v3_bitst,v3_conf,v3_extku,v3_ia5,v3_lib,"+ -
         "v3_prn,v3_utl,v3err,v3_genn,v3_alt,v3_skey,v3_akey,v3_pku,"+ -
         "v3_int,v3_enum,v3_sxnet,v3_cpols,v3_crld,v3_purp,v3_info,"+ -
         "v3_ocsp,v3_akeya"
-$ LIB_CONF = "conf_err,conf_lib,conf_api,conf_def,conf_mod,conf_mall"
+$ LIB_CONF = "conf_err,conf_lib,conf_api,conf_def,conf_mod,conf_mall,conf_sap"
 $ LIB_TXT_DB = "txt_db"
 $ LIB_PKCS7 = "pk7_asn1,pk7_lib,pkcs7err,pk7_doit,pk7_smime,pk7_attr,"+ -
         "pk7_mime"
 $ LIB_PKCS12 = "p12_add,p12_asn,p12_attr,p12_crpt,p12_crt,p12_decr,"+ -
         "p12_init,p12_key,p12_kiss,p12_mutl,"+ -
         "p12_utl,p12_npas,pk12err,p12_p8d,p12_p8e"
-$ LIB_COMP = "comp_lib,"+ -
+$ LIB_COMP = "comp_lib,comp_err,"+ -
         "c_rle,c_zlib"
 $ LIB_OCSP = "ocsp_asn,ocsp_ext,ocsp_ht,ocsp_lib,ocsp_cl,"+ -
         "ocsp_srv,ocsp_prn,ocsp_vfy,ocsp_err"
@@ -1325,7 +1325,7 @@ $   CC4 = CC - CCDISABLEWARNINGS + CC4DISABLEWARNINGS
 $!
 $!  Show user the result
 $!
-$   WRITE SYS$OUTPUT "Main C Compiling Command: ",CC
+$   WRITE/SYMBOL SYS$OUTPUT "Main C Compiling Command: ",CC
 $!
 $!  Else The User Entered An Invalid Arguement.
 $!
@@ -1356,7 +1356,7 @@ $ IF ARCH .EQS. "AXP" THEN MACRO = "MACRO/MIGRATION/''DEBUGGER'/''MACRO_OPTIMIZE
 $!
 $!  Show user the result
 $!
-$   WRITE SYS$OUTPUT "Main MACRO Compiling Command: ",MACRO
+$   WRITE/SYMBOL SYS$OUTPUT "Main MACRO Compiling Command: ",MACRO
 $!
 $! Time to check the contents, and to make sure we get the correct library.
 $!
diff --git a/src/lib/libcrypto/des/des_ver.h b/src/lib/libcrypto/des/des_ver.h
index 0fa94d5368..379bbadda2 100644
--- a/src/lib/libcrypto/des/des_ver.h
+++ b/src/lib/libcrypto/des/des_ver.h
@@ -63,5 +63,9 @@
 # define OPENSSL_EXTERN OPENSSL_EXPORT
 #endif
 
-OPENSSL_EXTERN char *DES_version;       /* SSLeay version string */
-OPENSSL_EXTERN char *libdes_version;    /* old libdes version string */
+/* The following macros make sure the names are different from libdes names */
+#define DES_version OSSL_DES_version
+#define libdes_version OSSL_libdes_version
+
+OPENSSL_EXTERN const char *OSSL_DES_version;    /* SSLeay version string */
+OPENSSL_EXTERN const char *OSSL_libdes_version; /* old libdes version string */
diff --git a/src/lib/libcrypto/engine/hw_4758_cca.c b/src/lib/libcrypto/engine/hw_4758_cca.c
index 1053c52082..bfb80968e2 100644
--- a/src/lib/libcrypto/engine/hw_4758_cca.c
+++ b/src/lib/libcrypto/engine/hw_4758_cca.c
@@ -953,7 +953,7 @@ static void cca_ex_free(void *obj, void *item, CRYPTO_EX_DATA *ad, int idx,
 #ifdef ENGINE_DYNAMIC_SUPPORT 
 static int bind_fn(ENGINE *e, const char *id)
         {
-        if(id && (strcmp(id, engine_cswift_id) != 0))
+        if(id && (strcmp(id, engine_4758_cca_id) != 0))
                 return 0;
         if(!bind_helper(e))
                 return 0;
diff --git a/src/lib/libcrypto/engine/hw_ubsec.c b/src/lib/libcrypto/engine/hw_ubsec.c
index 63397f868c..ed8401ec16 100644
--- a/src/lib/libcrypto/engine/hw_ubsec.c
+++ b/src/lib/libcrypto/engine/hw_ubsec.c
@@ -93,7 +93,7 @@ static int ubsec_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa);
 static int ubsec_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
                 const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
 #ifndef OPENSSL_NO_DSA
-#if NOT_USED
+#ifdef NOT_USED
 static int ubsec_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,
                 BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
                 BN_CTX *ctx, BN_MONT_CTX *in_mont);
@@ -113,7 +113,7 @@ static int ubsec_dh_compute_key(unsigned char *key,const BIGNUM *pub_key,DH *dh)
 static int ubsec_dh_generate_key(DH *dh);
 #endif
 
-#if NOT_USED
+#ifdef NOT_USED
 static int ubsec_rand_bytes(unsigned char *buf, int num);
 static int ubsec_rand_status(void);
 #endif
@@ -663,7 +663,7 @@ static int ubsec_mod_exp_crt(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
 }
 
 #ifndef OPENSSL_NO_DSA
-#if NOT_USED
+#ifdef NOT_USED
 static int ubsec_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,
                 BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
                 BN_CTX *ctx, BN_MONT_CTX *in_mont)
@@ -987,7 +987,7 @@ err:
         }
 #endif
 
-#if NOT_USED
+#ifdef NOT_USED
 static int ubsec_rand_bytes(unsigned char * buf,
                             int num)
         {
diff --git a/src/lib/libcrypto/mem.c b/src/lib/libcrypto/mem.c
index effec714e8..a7826908e6 100644
--- a/src/lib/libcrypto/mem.c
+++ b/src/lib/libcrypto/mem.c
@@ -303,6 +303,9 @@ void *CRYPTO_realloc(void *str, int num, const char *file, int line)
         {
         void *ret = NULL;
 
+        if (str == NULL)
+                return CRYPTO_malloc(num, file, line);
+
         if (realloc_debug_func != NULL)
                 realloc_debug_func(str, NULL, num, file, line, 0);
         ret = realloc_ex_func(str,num,file,line);
diff --git a/src/lib/libcrypto/ripemd/rmdtest.c b/src/lib/libcrypto/ripemd/rmdtest.c
index 19e9741db2..be1fb8b1f6 100644
--- a/src/lib/libcrypto/ripemd/rmdtest.c
+++ b/src/lib/libcrypto/ripemd/rmdtest.c
@@ -59,7 +59,6 @@
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
-#include <openssl/ripemd.h>
 
 #ifdef OPENSSL_NO_RIPEMD
 int main(int argc, char *argv[])
@@ -68,6 +67,7 @@ int main(int argc, char *argv[])
     return(0);
 }
 #else
+#include <openssl/ripemd.h>
 #include <openssl/evp.h>
 
 #ifdef CHARSET_EBCDIC
diff --git a/src/lib/libcrypto/util/libeay.num b/src/lib/libcrypto/util/libeay.num
index 512185e257..7e5728495f 100644
--- a/src/lib/libcrypto/util/libeay.num
+++ b/src/lib/libcrypto/util/libeay.num
@@ -2792,3 +2792,4 @@ ASN1_UNIVERSALSTRING_it                 3234	EXIST:!EXPORT_VAR_AS_FUNCTION:VARIA
 ASN1_UNIVERSALSTRING_it                 3234    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:
 d2i_ASN1_UNIVERSALSTRING                3235    EXIST::FUNCTION:
 EVP_des_ede3_ecb                        3236    EXIST::FUNCTION:DES
+X509_REQ_print_ex                       3237    EXIST::FUNCTION:BIO
diff --git a/src/lib/libcrypto/util/pod2mantest b/src/lib/libcrypto/util/pod2mantest
index e01c6192a7..412ca8d6d8 100644
--- a/src/lib/libcrypto/util/pod2mantest
+++ b/src/lib/libcrypto/util/pod2mantest
@@ -12,7 +12,8 @@
 
 IFS=:
 if test "$OSTYPE" = "msdosdjgpp"; then IFS=";"; fi
-try_without_dir=false
+
+try_without_dir=true
 # First we try "pod2man", then "$dir/pod2man" for each item in $PATH.
 for dir in dummy${IFS}$PATH; do
     if [ "$try_without_dir" = true ]; then
@@ -30,9 +31,16 @@ for dir in dummy${IFS}$PATH; do
     if [ ! "$pod2man" = '' ]; then
         failure=none
 
+        if "$pod2man" --section=1 --center=OpenSSL --release=dev pod2mantest.pod | fgrep OpenSSL >/dev/null; then
+            :
+        else
+            failure=BasicTest
+        fi
 
-        if "$pod2man" --section=1 --center=OpenSSL --release=dev pod2mantest.pod | grep '^MARKER - ' >/dev/null 2>&1; then
-            failure=MultilineTest
+        if [ "$failure" = none ]; then
+            if "$pod2man" --section=1 --center=OpenSSL --release=dev pod2mantest.pod | grep '^MARKER - ' >/dev/null; then
+                failure=MultilineTest
+            fi
         fi
 
 
@@ -46,9 +54,5 @@ for dir in dummy${IFS}$PATH; do
 done
 
 echo "No working pod2man found.  Consider installing a new version." >&2
-if [ "$1" = ignore ]; then
-  echo "As a workaround, we'll use a bundled old copy of pod2man.pl." >&2
-  echo "../../util/pod2man.pl"
-  exit 0
-fi
-exit 1
+echo "As a workaround, we'll use a bundled old copy of pod2man.pl." >&2
+echo "$1 ../../util/pod2man.pl"
diff --git a/src/lib/libssl/src/CHANGES b/src/lib/libssl/src/CHANGES
index 5c80970b52..03b697cd7e 100644
--- a/src/lib/libssl/src/CHANGES
+++ b/src/lib/libssl/src/CHANGES
@@ -2,7 +2,13 @@
  OpenSSL CHANGES
  _______________
 
- Changes between 0.9.6e and 0.9.7  [XX xxx 2002]
+ Changes between 0.9.6h and 0.9.7  [XX xxx 2002]
+
+  *) Make -nameopt work fully for req and add -reqopt switch.
+     [Michael Bell <michael.bell@rz.hu-berlin.de>, Steve Henson]
+
+  *) The "block size" for block ciphers in CFB and OFB mode should be 1.
+     [Steve Henson, reported by Yngve Nysaeter Pettersen <yngve@opera.com>]
 
   *) Make sure tests can be performed even if the corresponding algorithms
      have been removed entirely.  This was also the last step to make
@@ -1667,6 +1673,37 @@ des-cbc           3624.96k     5258.21k     5530.91k     5624.30k     5628.26k
   *) Clean old EAY MD5 hack from e_os.h.
      [Richard Levitte]
 
+ Changes between 0.9.6g and 0.9.6h  [xx XXX xxxx]
+
+  *) Reorder cleanup sequence in SSL_CTX_free(): only remove the ex_data after
+     the cached sessions are flushed, as the remove_cb() might use ex_data
+     contents. Bug found by Sam Varshavchik <mrsam@courier-mta.com>
+     (see [openssl.org #212]).
+     [Geoff Thorpe, Lutz Jaenicke]
+
+  *) Fix typo in OBJ_txt2obj which incorrectly passed the content
+     length, instead of the encoding length to d2i_ASN1_OBJECT.
+     [Steve Henson]
+
+ Changes between 0.9.6f and 0.9.6g  [9 Aug 2002]
+
+  *) [In 0.9.6g-engine release:]
+     Fix crypto/engine/vendor_defns/cswift.h for WIN32 (use '_stdcall').
+     [Lynn Gazis <lgazis@rainbow.com>]
+
+ Changes between 0.9.6e and 0.9.6f  [8 Aug 2002]
+
+  *) Fix ASN1 checks. Check for overflow by comparing with LONG_MAX
+     and get fix the header length calculation.
+     [Florian Weimer <Weimer@CERT.Uni-Stuttgart.DE>,
+        Alon Kantor <alonk@checkpoint.com> (and others),
+        Steve Henson]
+
+  *) Use proper error handling instead of 'assertions' in buffer
+     overflow checks added in 0.9.6e.  This prevents DoS (the
+     assertions could call abort()).
+     [Arne Ansper <arne@ats.cyber.ee>, Bodo Moeller]
+  
  Changes between 0.9.6d and 0.9.6e  [30 Jul 2002]
 
   *) Add various sanity checks to asn1_get_length() to reject
diff --git a/src/lib/libssl/src/Configure b/src/lib/libssl/src/Configure
index 74bd8877e5..292ca877c6 100644
--- a/src/lib/libssl/src/Configure
+++ b/src/lib/libssl/src/Configure
@@ -120,7 +120,7 @@ my $alpha_asm="::::::::";
 # -DB_ENDIAN slows things down on a sparc for md5, but helps sha1.
 # So the md5_locl.h file has an undef B_ENDIAN if sun is defined
 
-#config-string  $cc : $cflags : $unistd : $thread_cflag : $sys_id : $lflags : $bn_ops : $bn_obj : $des_obj : $bf_obj : $md5_obj : $sha1_obj : $cast_obj : $rc4_obj : $rmd160_obj : $rc5_obj : $dso_scheme : $shared_target : $shared_cflag : $shared_ldflag : $shared_extension : $ranlib
+#config-string  $cc : $cflags : $unistd : $thread_cflag : $sys_id : $lflags : $bn_ops : $bn_obj : $des_obj : $bf_obj : $md5_obj : $sha1_obj : $cast_obj : $rc4_obj : $rmd160_obj : $rc5_obj : $dso_scheme : $shared_target : $shared_cflag : $shared_ldflag : $shared_extension : $ranlib : $arflags
 
 my %table=(
 # File 'TABLE' (created by 'make TABLE') contains the data from this list,
@@ -387,8 +387,8 @@ my %table=(
 "linux-mips",   "gcc:-DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::(unknown):::BN_LLONG:::",
 "linux-ppc",    "gcc:-DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 "linux-m68k",   "gcc:-DB_ENDIAN -DTERMIO -O2 -fomit-frame-pointer -Wall::-D_REENTRANT:::BN_LLONG::",
-"linux-s390",   "gcc:-DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT:::BN_LLONG::",
-"linux-s390x", "gcc:-DB_ENDIAN -DTERMIO -DNO_ASM -O3 -fomit-frame-pointer -Wall::-D_REENTRANT:::SIXTY_FOUR_BIT_LONG:::::::::::linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"linux-s390",   "gcc:-DB_ENDIAN -DTERMIO -DNO_ASM -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"linux-s390x",  "gcc:-DB_ENDIAN -DTERMIO -DNO_ASM -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 "linux-ia64",   "gcc:-DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK RC4_CHAR:asm/ia64.o:::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 "NetBSD-sparc", "gcc:-DTERMIOS -O3 -fomit-frame-pointer -mv8 -Wall -DB_ENDIAN::(unknown):::BN_LLONG MD2_CHAR RC4_INDEX DES_UNROLL::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 "NetBSD-m68",   "gcc:-DTERMIOS -O3 -fomit-frame-pointer -Wall -DB_ENDIAN::(unknown):::BN_LLONG MD2_CHAR RC4_INDEX DES_UNROLL::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
@@ -438,6 +438,7 @@ my %table=(
 "aix-gcc",  "gcc:-O3 -DB_ENDIAN::(unknown):AIX::BN_LLONG RC4_CHAR:::",
 "aix43-cc",   "cc:-O -DAIX -DB_ENDIAN -qmaxmem=16384::(unknown):::BN_LLONG RC4_CHAR::::::::::dlfcn:",
 "aix43-gcc",  "gcc:-O3 -DAIX -DB_ENDIAN::(unknown):::BN_LLONG RC4_CHAR::::::::::dlfcn:",
+"aix64-cc",   "cc:-O -DAIX -DB_ENDIAN -qmaxmem=16384 -q64::(unknown):::SIXTY_FOUR_BIT_LONG RC4_CHAR::::::::::dlfcn::::::-X 64",
 
 #
 # Cray T90 and similar (SDSC)
@@ -586,6 +587,7 @@ my $idx_shared_cflag = $idx++;
 my $idx_shared_ldflag = $idx++;
 my $idx_shared_extension = $idx++;
 my $idx_ranlib = $idx++;
+my $idx_arflags = $idx++;
 
 my $prefix="";
 my $openssldir="";
@@ -940,6 +942,7 @@ my $shared_cflag = $fields[$idx_shared_cflag];
 my $shared_ldflag = $fields[$idx_shared_ldflag];
 my $shared_extension = $fields[$idx_shared_extension];
 my $ranlib = $fields[$idx_ranlib];
+my $arflags = $fields[$idx_arflags];
 
 $cflags="$flags$cflags" if ($flags ne "");
 
@@ -1067,7 +1070,7 @@ if ($zlib)
         {
         $cflags = "-DZLIB $cflags";
         $cflags = "-DZLIB_SHARED $cflags" if $zlib == 2;
-        $lflags = "$lflags -lz" if $zlib == 2;
+        $lflags = "$lflags -lz" if $zlib == 1;
         }
 
 # You will find shlib_mark1 and shlib_mark2 explained in Makefile.org
@@ -1208,6 +1211,7 @@ while (<IN>)
         s/^RMD160_ASM_OBJ=.*$/RMD160_ASM_OBJ= $rmd160_obj/;
         s/^PROCESSOR=.*/PROCESSOR= $processor/;
         s/^RANLIB=.*/RANLIB= $ranlib/;
+        s/^ARFLAGS=.*/ARFLAGS= $arflags/;
         s/^PERL=.*/PERL= $perl/;
         s/^KRB5_INCLUDES=.*/KRB5_INCLUDES=$withargs{"krb5-include"}/;
         s/^LIBKRB5=.*/LIBKRB5=$withargs{"krb5-lib"}/;
@@ -1254,6 +1258,7 @@ print "SHA1_OBJ_ASM  =$sha1_obj\n";
 print "RMD160_OBJ_ASM=$rmd160_obj\n";
 print "PROCESSOR     =$processor\n";
 print "RANLIB        =$ranlib\n";
+print "ARFLAGS       =$arflags\n";
 print "PERL          =$perl\n";
 print "KRB5_INCLUDES =",$withargs{"krb5-include"},"\n"
         if $withargs{"krb5-include"} ne "";
@@ -1561,7 +1566,7 @@ sub print_table_entry
         my $bn_ops,my $bn_obj,my $des_obj,my $bf_obj,
         my $md5_obj,my $sha1_obj,my $cast_obj,my $rc4_obj,my $rmd160_obj,
         my $rc5_obj,my $dso_scheme,my $shared_target,my $shared_cflag,
-        my $shared_ldflag,my $shared_extension,my $ranlib)=
+        my $shared_ldflag,my $shared_extension,my $ranlib,my $arflags)=
         split(/\s*:\s*/,$table{$target} . ":" x 30 , -1);
                         
         print <<EOF
@@ -1589,6 +1594,7 @@ sub print_table_entry
 \$shared_ldflag = $shared_ldflag
 \$shared_extension = $shared_extension
 \$ranlib       = $ranlib
+\$arflags      = $arflags
 EOF
         }
 
diff --git a/src/lib/libssl/src/FAQ b/src/lib/libssl/src/FAQ
index ee03d97676..28027fdcac 100644
--- a/src/lib/libssl/src/FAQ
+++ b/src/lib/libssl/src/FAQ
@@ -36,6 +36,7 @@ OpenSSL  -  Frequently Asked Questions
 * Why does the linker complain about undefined symbols?
 * Why does the OpenSSL test fail with "bc: command not found"?
 * Why does the OpenSSL test fail with "bc: 1 no implemented"?
+* Why does the OpenSSL test fail with "bc: stack empty"?
 * Why does the OpenSSL compilation fail on Alpha Tru64 Unix?
 * Why does the OpenSSL compilation fail with "ar: command not found"?
 * Why does the OpenSSL compilation fail on Win32 with VC++?
@@ -64,7 +65,7 @@ OpenSSL  -  Frequently Asked Questions
 * Which is the current version of OpenSSL?
 
 The current version is available from <URL: http://www.openssl.org>.
-OpenSSL 0.9.6e was released on July 30, 2002.
+OpenSSL 0.9.6g was released on August 9, 2002.
 
 In addition to the current stable release, you can also access daily
 snapshots of the OpenSSL development version at <URL:
@@ -402,6 +403,17 @@ and compile/install it.  GNU bc (see http://www.gnu.org/software/software.html
 for download instructions) can be safely used, for example.
 
 
+* Why does the OpenSSL test fail with "bc: stack empty"?
+
+On some DG/ux versions, bc seems to have a too small stack for calculations
+that the OpenSSL bntest throws at it.  This gets triggered when you run the
+test suite (using "make test").  The message returned is "bc: stack empty".
+
+The best way to deal with this is to find another implementation of bc
+and compile/install it.  GNU bc (see http://www.gnu.org/software/software.html
+for download instructions) can be safely used, for example.
+
+
 * Why does the OpenSSL compilation fail on Alpha Tru64 Unix?
 
 On some Alpha installations running Tru64 Unix and Compaq C, the compilation
diff --git a/src/lib/libssl/src/Makefile.org b/src/lib/libssl/src/Makefile.org
index 8808dd7922..d7af0815f3 100644
--- a/src/lib/libssl/src/Makefile.org
+++ b/src/lib/libssl/src/Makefile.org
@@ -59,7 +59,8 @@ DEPFLAG=
 PEX_LIBS= 
 EX_LIBS= 
 EXE_EXT= 
-AR=ar r
+ARFLAGS=
+AR=ar $(ARFLAGS) r
 RANLIB= ranlib
 PERL= perl
 TAR= tar
@@ -251,7 +252,8 @@ link-shared:
                 for i in $(SHLIBDIRS); do \
                         prev=lib$$i$(SHLIB_EXT); \
                         for j in $${tmp:-x}; do \
-                                ( set -x; ln -f -s $$prev lib$$i$$j ); \
+                                ( set -x; \
+                                rm -f lib$$i$$j; ln -s $$prev lib$$i$$j ); \
                                 prev=lib$$i$$j; \
                         done; \
                 done; \
@@ -273,9 +275,7 @@ do_gnu-shared:
         done
 
 DETECT_GNU_LD=${CC} -v 2>&1 | grep '^gcc' >/dev/null 2>&1 && \
-        collect2=`gcc -print-prog-name=collect2 2>&1` && \
-        [ -n "$$collect2" ] && \
-        my_ld=`$$collect2 --help 2>&1 | grep Usage: | sed 's/^Usage: *\([^ ][^ ]*\).*/\1/'` && \
+        my_ld=`gcc -print-prog-name=ld 2>&1` && \
         [ -n "$$my_ld" ] && \
         $$my_ld -v 2>&1 | grep 'GNU ld' >/dev/null 2>&1
 
@@ -731,7 +731,8 @@ install: all install_docs
                 done; \
                 (       here="`pwd`"; \
                         cd $(INSTALL_PREFIX)$(INSTALLTOP)/lib; \
-                        make -f $$here/Makefile link-shared ); \
+                        set $(MAKE); \
+                        $$1 -f $$here/Makefile link-shared ); \
         fi
 
 install_docs:
@@ -740,22 +741,23 @@ install_docs:
                 $(INSTALL_PREFIX)$(MANDIR)/man3 \
                 $(INSTALL_PREFIX)$(MANDIR)/man5 \
                 $(INSTALL_PREFIX)$(MANDIR)/man7
-        @for i in doc/apps/*.pod; do \
+        @pod2man="`cd util; ./pod2mantest $(PERL)`"; \
+        for i in doc/apps/*.pod; do \
                 fn=`basename $$i .pod`; \
                 if [ "$$fn" = "config" ]; then sec=5; else sec=1; fi; \
                 echo "installing man$$sec/`basename $$i .pod`.$$sec"; \
                 (cd `$(PERL) util/dirname.pl $$i`; \
-                sh -c "$(PERL) `cd ../../util; ./pod2mantest ignore` \
+                sh -c "$$pod2man \
                         --section=$$sec --center=OpenSSL \
                         --release=$(VERSION) `basename $$i`") \
                         >  $(INSTALL_PREFIX)$(MANDIR)/man$$sec/`basename $$i .pod`.$$sec; \
-        done
-        @for i in doc/crypto/*.pod doc/ssl/*.pod; do \
+        done; \
+        for i in doc/crypto/*.pod doc/ssl/*.pod; do \
                 fn=`basename $$i .pod`; \
                 if [ "$$fn" = "des_modes" ]; then sec=7; else sec=3; fi; \
                 echo "installing man$$sec/`basename $$i .pod`.$$sec"; \
                 (cd `$(PERL) util/dirname.pl $$i`; \
-                sh -c "$(PERL) `cd ../../util; ./pod2mantest ignore` \
+                sh -c "$$pod2man \
                         --section=$$sec --center=OpenSSL \
                         --release=$(VERSION) `basename $$i`") \
                         >  $(INSTALL_PREFIX)$(MANDIR)/man$$sec/`basename $$i .pod`.$$sec; \
diff --git a/src/lib/libssl/src/NEWS b/src/lib/libssl/src/NEWS
index 9531ba9c6e..418b3b0505 100644
--- a/src/lib/libssl/src/NEWS
+++ b/src/lib/libssl/src/NEWS
@@ -40,6 +40,14 @@
       o SSL/TLS: add callback to retrieve SSL/TLS messages.
       o SSL/TLS: support AES cipher suites (RFC3268).
 
+  Major changes between OpenSSL 0.9.6f and OpenSSL 0.9.6g:
+
+      o Important building fixes on Unix.
+
+  Major changes between OpenSSL 0.9.6e and OpenSSL 0.9.6f:
+
+      o Various important bugfixes.
+
   Major changes between OpenSSL 0.9.6d and OpenSSL 0.9.6e:
 
       o Important security related bugfixes.
diff --git a/src/lib/libssl/src/PROBLEMS b/src/lib/libssl/src/PROBLEMS
index 70e591a1d1..bf532d112b 100644
--- a/src/lib/libssl/src/PROBLEMS
+++ b/src/lib/libssl/src/PROBLEMS
@@ -38,3 +38,11 @@ may differ on your machine.
 As long as Apple doesn't fix the problem with ld, this problem building
 OpenSSL will remain as is.
 
+
+* Parallell make leads to errors
+
+While running tests, running a parallell make is a bad idea.  Many test
+scripts use the same name for output and input files, which means different
+will interfere with each other and lead to test failure.
+
+The solution is simple for now: don't run parallell make when testing.
diff --git a/src/lib/libssl/src/README b/src/lib/libssl/src/README
index 5394a17e3e..4228e145f9 100644
--- a/src/lib/libssl/src/README
+++ b/src/lib/libssl/src/README
@@ -154,7 +154,7 @@
     - Stack Traceback (if the application dumps core)
 
  Report the bug to the OpenSSL project via the Request Tracker
- (http://www.openssl.org/rt2.html) by mail to:
+ (http://www.openssl.org/support/rt2.html) by mail to:
 
     openssl-bugs@openssl.org
 
diff --git a/src/lib/libssl/src/apps/apps.c b/src/lib/libssl/src/apps/apps.c
index a302119d7f..1a24b1c596 100644
--- a/src/lib/libssl/src/apps/apps.c
+++ b/src/lib/libssl/src/apps/apps.c
@@ -798,7 +798,7 @@ end:
         return(x);
         }
 
-EVP_PKEY *load_key(BIO *err, const char *file, int format,
+EVP_PKEY *load_key(BIO *err, const char *file, int format, int maybe_stdin,
         const char *pass, ENGINE *e, const char *key_descrip)
         {
         BIO *key=NULL;
@@ -808,7 +808,7 @@ EVP_PKEY *load_key(BIO *err, const char *file, int format,
         cb_data.password = pass;
         cb_data.prompt_info = file;
 
-        if (file == NULL)
+        if (file == NULL && (!maybe_stdin || format == FORMAT_ENGINE))
                 {
                 BIO_printf(err,"no keyfile specified\n");
                 goto end;
@@ -828,12 +828,19 @@ EVP_PKEY *load_key(BIO *err, const char *file, int format,
                 ERR_print_errors(err);
                 goto end;
                 }
-        if (BIO_read_filename(key,file) <= 0)
+        if (file == NULL && maybe_stdin)
                 {
-                BIO_printf(err, "Error opening %s %s\n", key_descrip, file);
-                ERR_print_errors(err);
-                goto end;
+                setvbuf(stdin, NULL, _IONBF, 0);
+                BIO_set_fp(key,stdin,BIO_NOCLOSE);
                 }
+        else
+                if (BIO_read_filename(key,file) <= 0)
+                        {
+                        BIO_printf(err, "Error opening %s %s\n",
+                                key_descrip, file);
+                        ERR_print_errors(err);
+                        goto end;
+                        }
         if (format == FORMAT_ASN1)
                 {
                 pkey=d2i_PrivateKey_bio(key, NULL);
@@ -867,7 +874,7 @@ EVP_PKEY *load_key(BIO *err, const char *file, int format,
         return(pkey);
         }
 
-EVP_PKEY *load_pubkey(BIO *err, const char *file, int format,
+EVP_PKEY *load_pubkey(BIO *err, const char *file, int format, int maybe_stdin,
         const char *pass, ENGINE *e, const char *key_descrip)
         {
         BIO *key=NULL;
@@ -877,7 +884,7 @@ EVP_PKEY *load_pubkey(BIO *err, const char *file, int format,
         cb_data.password = pass;
         cb_data.prompt_info = file;
 
-        if (file == NULL)
+        if (file == NULL && (!maybe_stdin || format == FORMAT_ENGINE))
                 {
                 BIO_printf(err,"no keyfile specified\n");
                 goto end;
@@ -897,11 +904,18 @@ EVP_PKEY *load_pubkey(BIO *err, const char *file, int format,
                 ERR_print_errors(err);
                 goto end;
                 }
-        if (BIO_read_filename(key,file) <= 0)
+        if (file == NULL && maybe_stdin)
                 {
-                BIO_printf(err, "Error opening %s %s\n", key_descrip, file);
-                ERR_print_errors(err);
-                goto end;
+                setvbuf(stdin, NULL, _IONBF, 0);
+                BIO_set_fp(key,stdin,BIO_NOCLOSE);
+                }
+        else
+                if (BIO_read_filename(key,file) <= 0)
+                        {
+                        BIO_printf(err, "Error opening %s %s\n",
+                                key_descrip, file);
+                        ERR_print_errors(err);
+                        goto end;
                 }
         if (format == FORMAT_ASN1)
                 {
@@ -1074,6 +1088,7 @@ int set_cert_ex(unsigned long *flags, const char *arg)
                 { "no_extensions", X509_FLAG_NO_EXTENSIONS, 0},
                 { "no_sigdump", X509_FLAG_NO_SIGDUMP, 0},
                 { "no_aux", X509_FLAG_NO_AUX, 0},
+                { "no_attributes", X509_FLAG_NO_ATTRIBUTES, 0},
                 { "ext_default", X509V3_EXT_DEFAULT, X509V3_EXT_UNKNOWN_MASK},
                 { "ext_error", X509V3_EXT_ERROR_UNKNOWN, X509V3_EXT_UNKNOWN_MASK},
                 { "ext_parse", X509V3_EXT_PARSE_UNKNOWN, X509V3_EXT_UNKNOWN_MASK},
diff --git a/src/lib/libssl/src/apps/apps.h b/src/lib/libssl/src/apps/apps.h
index a88902ac13..32a79605ee 100644
--- a/src/lib/libssl/src/apps/apps.h
+++ b/src/lib/libssl/src/apps/apps.h
@@ -233,9 +233,9 @@ int app_passwd(BIO *err, char *arg1, char *arg2, char **pass1, char **pass2);
 int add_oid_section(BIO *err, CONF *conf);
 X509 *load_cert(BIO *err, const char *file, int format,
         const char *pass, ENGINE *e, const char *cert_descrip);
-EVP_PKEY *load_key(BIO *err, const char *file, int format,
+EVP_PKEY *load_key(BIO *err, const char *file, int format, int maybe_stdin,
         const char *pass, ENGINE *e, const char *key_descrip);
-EVP_PKEY *load_pubkey(BIO *err, const char *file, int format,
+EVP_PKEY *load_pubkey(BIO *err, const char *file, int format, int maybe_stdin,
         const char *pass, ENGINE *e, const char *key_descrip);
 STACK_OF(X509) *load_certs(BIO *err, const char *file, int format,
         const char *pass, ENGINE *e, const char *cert_descrip);
diff --git a/src/lib/libssl/src/apps/ca.c b/src/lib/libssl/src/apps/ca.c
index 322956de57..492b64f04f 100644
--- a/src/lib/libssl/src/apps/ca.c
+++ b/src/lib/libssl/src/apps/ca.c
@@ -699,7 +699,7 @@ bad:
                         goto err;
                         }
                 }
-        pkey = load_key(bio_err, keyfile, keyform, key, e, 
+        pkey = load_key(bio_err, keyfile, keyform, 0, key, e, 
                 "CA private key");
         if (key) memset(key,0,strlen(key));
         if (pkey == NULL)
@@ -2089,9 +2089,8 @@ again2:
                         }
                 }
 
-        row[DB_name]=X509_NAME_oneline(dn_subject,NULL,0);
         row[DB_serial]=BN_bn2hex(serial);
-        if ((row[DB_name] == NULL) || (row[DB_serial] == NULL))
+        if (row[DB_serial] == NULL)
                 {
                 BIO_printf(bio_err,"Memory allocation failure\n");
                 goto err;
@@ -2304,10 +2303,10 @@ again2:
 
         /* row[DB_serial] done already */
         row[DB_file]=(char *)OPENSSL_malloc(8);
-        /* row[DB_name] done already */
+        row[DB_name]=X509_NAME_oneline(X509_get_subject_name(ret),NULL,0);
 
         if ((row[DB_type] == NULL) || (row[DB_exp_date] == NULL) ||
-                (row[DB_file] == NULL))
+                (row[DB_file] == NULL) || (row[DB_name] == NULL))
                 {
                 BIO_printf(bio_err,"Memory allocation failure\n");
                 goto err;
diff --git a/src/lib/libssl/src/apps/dgst.c b/src/lib/libssl/src/apps/dgst.c
index e21c3d83ac..32e40c1f53 100644
--- a/src/lib/libssl/src/apps/dgst.c
+++ b/src/lib/libssl/src/apps/dgst.c
@@ -277,10 +277,10 @@ int MAIN(int argc, char **argv)
         if(keyfile)
                 {
                 if (want_pub)
-                        sigkey = load_pubkey(bio_err, keyfile, keyform, NULL,
+                        sigkey = load_pubkey(bio_err, keyfile, keyform, 0, NULL,
                                 e, "key file");
                 else
-                        sigkey = load_key(bio_err, keyfile, keyform, NULL,
+                        sigkey = load_key(bio_err, keyfile, keyform, 0, NULL,
                                 e, "key file");
                 if (!sigkey)
                         {
diff --git a/src/lib/libssl/src/apps/makeapps.com b/src/lib/libssl/src/apps/makeapps.com
index 2e666368b7..148246facc 100644
--- a/src/lib/libssl/src/apps/makeapps.com
+++ b/src/lib/libssl/src/apps/makeapps.com
@@ -1086,7 +1086,7 @@ $ CC = CC + "/DEFINE=(" + CCDEFS + ")" + CCDISABLEWARNINGS
 $!
 $! Show user the result
 $!
-$ WRITE SYS$OUTPUT "Main Compiling Command: ",CC
+$ WRITE/SYMBOL SYS$OUTPUT "Main Compiling Command: ",CC
 $!
 $! Special Threads For OpenVMS v7.1 Or Later
 $!
diff --git a/src/lib/libssl/src/apps/ocsp.c b/src/lib/libssl/src/apps/ocsp.c
index 49a156a1cf..59b97a634b 100644
--- a/src/lib/libssl/src/apps/ocsp.c
+++ b/src/lib/libssl/src/apps/ocsp.c
@@ -613,11 +613,11 @@ int MAIN(int argc, char **argv)
                         NULL, e, "CA certificate");
                 if (rcertfile)
                         {
-                        rother = load_certs(bio_err, sign_certfile, FORMAT_PEM,
+                        rother = load_certs(bio_err, rcertfile, FORMAT_PEM,
                                 NULL, e, "responder other certificates");
-                        if (!sign_other) goto end;
+                        if (!rother) goto end;
                         }
-                rkey = load_key(bio_err, rkeyfile, FORMAT_PEM, NULL, NULL,
+                rkey = load_key(bio_err, rkeyfile, FORMAT_PEM, 0, NULL, NULL,
                         "responder private key");
                 if (!rkey)
                         goto end;
@@ -663,7 +663,7 @@ int MAIN(int argc, char **argv)
                                 NULL, e, "signer certificates");
                         if (!sign_other) goto end;
                         }
-                key = load_key(bio_err, keyfile, FORMAT_PEM, NULL, NULL,
+                key = load_key(bio_err, keyfile, FORMAT_PEM, 0, NULL, NULL,
                         "signer private key");
                 if (!key)
                         goto end;
diff --git a/src/lib/libssl/src/apps/pkcs12.c b/src/lib/libssl/src/apps/pkcs12.c
index e345cf1489..1697f6157f 100644
--- a/src/lib/libssl/src/apps/pkcs12.c
+++ b/src/lib/libssl/src/apps/pkcs12.c
@@ -427,7 +427,7 @@ int MAIN(int argc, char **argv)
         CRYPTO_push_info("process -export_cert");
         CRYPTO_push_info("reading private key");
 #endif
-        key = load_key(bio_err, keyname ? keyname : infile, FORMAT_PEM,
+        key = load_key(bio_err, keyname ? keyname : infile, FORMAT_PEM, 1,
                 passin, e, "private key");
         if (!key) {
                 goto export_end;
@@ -508,9 +508,10 @@ int MAIN(int argc, char **argv)
                     /* Exclude verified certificate */
                     for (i = 1; i < sk_X509_num (chain2) ; i++) 
                         sk_X509_push(certs, sk_X509_value (chain2, i));
-                }
-                sk_X509_free(chain2);
-                if (vret) {
+                    /* Free first certificate */
+                    X509_free(sk_X509_value(chain2, 0));
+                    sk_X509_free(chain2);
+                } else {
                         BIO_printf (bio_err, "Error %s getting chain.\n",
                                         X509_verify_cert_error_string(vret));
                         goto export_end;
@@ -537,8 +538,6 @@ int MAIN(int argc, char **argv)
         }
         sk_X509_pop_free(certs, X509_free);
         certs = NULL;
-        /* ucert is part of certs so it is already freed */
-        ucert = NULL;
 
 #ifdef CRYPTO_MDEBUG
         CRYPTO_pop_info();
@@ -627,7 +626,6 @@ int MAIN(int argc, char **argv)
         if (certs) sk_X509_pop_free(certs, X509_free);
         if (safes) sk_PKCS7_pop_free(safes, PKCS7_free);
         if (bags) sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
-        if (ucert) X509_free(ucert);
 
 #ifdef CRYPTO_MDEBUG
         CRYPTO_pop_info();
diff --git a/src/lib/libssl/src/apps/pkcs8.c b/src/lib/libssl/src/apps/pkcs8.c
index ba91caee6b..912e32006b 100644
--- a/src/lib/libssl/src/apps/pkcs8.c
+++ b/src/lib/libssl/src/apps/pkcs8.c
@@ -222,7 +222,8 @@ int MAIN(int argc, char **argv)
         if (topk8)
                 {
                 BIO_free(in); /* Not needed in this section */
-                pkey = load_key(bio_err, infile, informat, passin, e, "key");
+                pkey = load_key(bio_err, infile, informat, 1,
+                        passin, e, "key");
                 if (!pkey) {
                         return (1);
                 }
diff --git a/src/lib/libssl/src/apps/req.c b/src/lib/libssl/src/apps/req.c
index 5631a3839b..a3c1e0b4c4 100644
--- a/src/lib/libssl/src/apps/req.c
+++ b/src/lib/libssl/src/apps/req.c
@@ -151,7 +151,7 @@ int MAIN(int argc, char **argv)
 #ifndef OPENSSL_NO_DSA
         DSA *dsa_params=NULL;
 #endif
-        unsigned long nmflag = 0;
+        unsigned long nmflag = 0, reqflag = 0;
         int ex=1,x509=0,days=30;
         X509 *x509ss=NULL;
         X509_REQ *req=NULL;
@@ -356,6 +356,11 @@ int MAIN(int argc, char **argv)
                         if (--argc < 1) goto bad;
                         if (!set_name_ex(&nmflag, *(++argv))) goto bad;
                         }
+                else if (strcmp(*argv,"-reqopt") == 0)
+                        {
+                        if (--argc < 1) goto bad;
+                        if (!set_cert_ex(&reqflag, *(++argv))) goto bad;
+                        }
                 else if (strcmp(*argv,"-subject") == 0)
                         subject=1;
                 else if (strcmp(*argv,"-text") == 0)
@@ -448,7 +453,8 @@ bad:
                 BIO_printf(bio_err," -extensions .. specify certificate extension section (override value in config file)\n");
                 BIO_printf(bio_err," -reqexts ..    specify request extension section (override value in config file)\n");
                 BIO_printf(bio_err," -utf8          input characters are UTF8 (default ASCII)\n");
-                BIO_printf(bio_err," -nameopt arg    - various certificate name options\n");
+                BIO_printf(bio_err," -nameopt arg   - various certificate name options\n");
+                BIO_printf(bio_err," -reqopt arg    - various request text options\n\n");
                 goto end;
                 }
 
@@ -622,7 +628,7 @@ bad:
 
         if (keyfile != NULL)
                 {
-                pkey = load_key(bio_err, keyfile, keyform, passin, e,
+                pkey = load_key(bio_err, keyfile, keyform, 0, passin, e,
                         "Private Key");
                 if (!pkey)
                         {
@@ -981,9 +987,9 @@ loop:
         if (text)
                 {
                 if (x509)
-                        X509_print(out,x509ss);
+                        X509_print_ex(out, x509ss, nmflag, reqflag);
                 else    
-                        X509_REQ_print(out,req);
+                        X509_REQ_print_ex(out, req, nmflag, reqflag);
                 }
 
         if(subject) 
diff --git a/src/lib/libssl/src/apps/rsa.c b/src/lib/libssl/src/apps/rsa.c
index 60a3381527..4e19bc16fb 100644
--- a/src/lib/libssl/src/apps/rsa.c
+++ b/src/lib/libssl/src/apps/rsa.c
@@ -238,12 +238,12 @@ bad:
                 if (pubin)
                         pkey = load_pubkey(bio_err, infile,
                                 (informat == FORMAT_NETSCAPE && sgckey ?
-                                        FORMAT_IISSGC : informat),
+                                        FORMAT_IISSGC : informat), 1,
                                 passin, e, "Public Key");
                 else
                         pkey = load_key(bio_err, infile,
                                 (informat == FORMAT_NETSCAPE && sgckey ?
-                                        FORMAT_IISSGC : informat),
+                                        FORMAT_IISSGC : informat), 1,
                                 passin, e, "Private Key");
 
                 if (pkey != NULL)
diff --git a/src/lib/libssl/src/apps/rsautl.c b/src/lib/libssl/src/apps/rsautl.c
index 9b02e6782e..36957e5b84 100644
--- a/src/lib/libssl/src/apps/rsautl.c
+++ b/src/lib/libssl/src/apps/rsautl.c
@@ -169,12 +169,12 @@ int MAIN(int argc, char **argv)
         
         switch(key_type) {
                 case KEY_PRIVKEY:
-                pkey = load_key(bio_err, keyfile, keyform,
+                pkey = load_key(bio_err, keyfile, keyform, 0,
                         NULL, e, "Private Key");
                 break;
 
                 case KEY_PUBKEY:
-                pkey = load_pubkey(bio_err, keyfile, keyform,
+                pkey = load_pubkey(bio_err, keyfile, keyform, 0,
                         NULL, e, "Public Key");
                 break;
 
diff --git a/src/lib/libssl/src/apps/s_server.c b/src/lib/libssl/src/apps/s_server.c
index 497abf44ef..b03231f3ba 100644
--- a/src/lib/libssl/src/apps/s_server.c
+++ b/src/lib/libssl/src/apps/s_server.c
@@ -320,10 +320,10 @@ static char **local_argv;
 static int ebcdic_new(BIO *bi);
 static int ebcdic_free(BIO *a);
 static int ebcdic_read(BIO *b, char *out, int outl);
-static int ebcdic_write(BIO *b, char *in, int inl);
-static long ebcdic_ctrl(BIO *b, int cmd, long num, char *ptr);
+static int ebcdic_write(BIO *b, const char *in, int inl);
+static long ebcdic_ctrl(BIO *b, int cmd, long num, void *ptr);
 static int ebcdic_gets(BIO *bp, char *buf, int size);
-static int ebcdic_puts(BIO *bp, char *str);
+static int ebcdic_puts(BIO *bp, const char *str);
 
 #define BIO_TYPE_EBCDIC_FILTER  (18|0x0200)
 static BIO_METHOD methods_ebcdic=
@@ -388,7 +388,7 @@ static int ebcdic_read(BIO *b, char *out, int outl)
         return(ret);
 }
 
-static int ebcdic_write(BIO *b, char *in, int inl)
+static int ebcdic_write(BIO *b, const char *in, int inl)
 {
         EBCDIC_OUTBUFF *wbuf;
         int ret=0;
@@ -421,7 +421,7 @@ static int ebcdic_write(BIO *b, char *in, int inl)
         return(ret);
 }
 
-static long ebcdic_ctrl(BIO *b, int cmd, long num, char *ptr)
+static long ebcdic_ctrl(BIO *b, int cmd, long num, void *ptr)
 {
         long ret;
 
@@ -440,7 +440,7 @@ static long ebcdic_ctrl(BIO *b, int cmd, long num, char *ptr)
 
 static int ebcdic_gets(BIO *bp, char *buf, int size)
 {
-        int i, ret;
+        int i, ret=0;
         if (bp->next_bio == NULL) return(0);
 /*      return(BIO_gets(bp->next_bio,buf,size));*/
         for (i=0; i<size-1; ++i)
@@ -459,7 +459,7 @@ static int ebcdic_gets(BIO *bp, char *buf, int size)
         return (ret < 0 && i == 0) ? ret : i;
 }
 
-static int ebcdic_puts(BIO *bp, char *str)
+static int ebcdic_puts(BIO *bp, const char *str)
 {
         if (bp->next_bio == NULL) return(0);
         return ebcdic_write(bp, str, strlen(str));
diff --git a/src/lib/libssl/src/apps/smime.c b/src/lib/libssl/src/apps/smime.c
index 90fe026f56..ef0e477464 100644
--- a/src/lib/libssl/src/apps/smime.c
+++ b/src/lib/libssl/src/apps/smime.c
@@ -428,7 +428,7 @@ int MAIN(int argc, char **argv)
         } else keyfile = NULL;
 
         if(keyfile) {
-                key = load_key(bio_err, keyfile, keyform, passin, e,
+                key = load_key(bio_err, keyfile, keyform, 0, passin, e,
                                "signing key file");
                 if (!key) {
                         goto end;
diff --git a/src/lib/libssl/src/apps/spkac.c b/src/lib/libssl/src/apps/spkac.c
index 049a37963c..4ce53e36c9 100644
--- a/src/lib/libssl/src/apps/spkac.c
+++ b/src/lib/libssl/src/apps/spkac.c
@@ -186,7 +186,7 @@ bad:
         if(keyfile) {
                 pkey = load_key(bio_err,
                                 strcmp(keyfile, "-") ? keyfile : NULL,
-                                FORMAT_PEM, passin, e, "private key");
+                                FORMAT_PEM, 1, passin, e, "private key");
                 if(!pkey) {
                         goto end;
                 }
diff --git a/src/lib/libssl/src/apps/x509.c b/src/lib/libssl/src/apps/x509.c
index a797da0ffa..5a41c389ee 100644
--- a/src/lib/libssl/src/apps/x509.c
+++ b/src/lib/libssl/src/apps/x509.c
@@ -861,8 +861,8 @@ bad:
                                 if (Upkey == NULL)
                                         {
                                         Upkey=load_key(bio_err,
-                                                keyfile,keyformat, passin, e,
-                                                "Private key");
+                                                keyfile, keyformat, 0,
+                                                passin, e, "Private key");
                                         if (Upkey == NULL) goto end;
                                         }
 #ifndef OPENSSL_NO_DSA
@@ -880,8 +880,9 @@ bad:
                                 if (CAkeyfile != NULL)
                                         {
                                         CApkey=load_key(bio_err,
-                                                CAkeyfile,CAkeyformat, passin,
-                                                e, "CA Private Key");
+                                                CAkeyfile, CAkeyformat,
+                                                0, passin, e,
+                                                "CA Private Key");
                                         if (CApkey == NULL) goto end;
                                         }
 #ifndef OPENSSL_NO_DSA
@@ -908,8 +909,8 @@ bad:
                                 else
                                         {
                                         pk=load_key(bio_err,
-                                                keyfile,FORMAT_PEM, passin, e,
-                                                "request key");
+                                                keyfile, FORMAT_PEM, 0,
+                                                passin, e, "request key");
                                         if (pk == NULL) goto end;
                                         }
 
diff --git a/src/lib/libssl/src/config b/src/lib/libssl/src/config
index 972cdb70a3..3e9af7680a 100644
--- a/src/lib/libssl/src/config
+++ b/src/lib/libssl/src/config
@@ -393,6 +393,9 @@ exit 0
 GCCVER=`(gcc -dumpversion) 2>/dev/null`
 if [ "$GCCVER" != "" ]; then
   CC=gcc
+  # then strip off whatever prefix egcs prepends the number with...
+  # Hopefully, this will work for any future prefixes as well.
+  GCCVER=`echo $GCCVER | sed 's/^[a-zA-Z]*\-//'`
   # Since gcc 3.1 gcc --version behaviour has changed.  gcc -dumpversion
   # does give us what we want though, so we use that.  We just just the
   # major and minor version numbers.
diff --git a/src/lib/libssl/src/crypto/asn1/a_bitstr.c b/src/lib/libssl/src/crypto/asn1/a_bitstr.c
index ed0bdfbde1..e0265f69d2 100644
--- a/src/lib/libssl/src/crypto/asn1/a_bitstr.c
+++ b/src/lib/libssl/src/crypto/asn1/a_bitstr.c
@@ -120,6 +120,12 @@ ASN1_BIT_STRING *c2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a, unsigned char **pp,
         unsigned char *p,*s;
         int i;
 
+        if (len < 1)
+                {
+                i=ASN1_R_STRING_TOO_SHORT;
+                goto err;
+                }
+
         if ((a == NULL) || ((*a) == NULL))
                 {
                 if ((ret=M_ASN1_BIT_STRING_new()) == NULL) return(NULL);
diff --git a/src/lib/libssl/src/crypto/asn1/a_strex.c b/src/lib/libssl/src/crypto/asn1/a_strex.c
index 8dab29dca1..7ddb7662f1 100644
--- a/src/lib/libssl/src/crypto/asn1/a_strex.c
+++ b/src/lib/libssl/src/crypto/asn1/a_strex.c
@@ -544,7 +544,7 @@ int ASN1_STRING_to_UTF8(unsigned char **out, ASN1_STRING *in)
 {
         ASN1_STRING stmp, *str = &stmp;
         int mbflag, type, ret;
-        if(!*out || !in) return -1;
+        if(!in) return -1;
         type = in->type;
         if((type < 0) || (type > 30)) return -1;
         mbflag = tag2nbyte[type];
@@ -553,6 +553,6 @@ int ASN1_STRING_to_UTF8(unsigned char **out, ASN1_STRING *in)
         stmp.data = NULL;
         ret = ASN1_mbstring_copy(&str, in->data, in->length, mbflag, B_ASN1_UTF8STRING);
         if(ret < 0) return ret;
-        if(out) *out = stmp.data;
+        *out = stmp.data;
         return stmp.length;
 }
diff --git a/src/lib/libssl/src/crypto/asn1/asn1_lib.c b/src/lib/libssl/src/crypto/asn1/asn1_lib.c
index 422685a3b4..0638870ab7 100644
--- a/src/lib/libssl/src/crypto/asn1/asn1_lib.c
+++ b/src/lib/libssl/src/crypto/asn1/asn1_lib.c
@@ -57,6 +57,7 @@
  */
 
 #include <stdio.h>
+#include <limits.h>
 #include "cryptlib.h"
 #include <openssl/asn1.h>
 #include <openssl/asn1_mac.h>
@@ -124,7 +125,7 @@ int ASN1_get_object(unsigned char **pp, long *plength, int *ptag, int *pclass,
                 (int)(omax+ *pp));
 
 #endif
-        if (*plength > (omax - (*pp - p)))
+        if (*plength > (omax - (p - *pp)))
                 {
                 ASN1err(ASN1_F_ASN1_GET_OBJECT,ASN1_R_TOO_LONG);
                 /* Set this so that even if things are not long enough
@@ -141,7 +142,7 @@ err:
 static int asn1_get_length(unsigned char **pp, int *inf, long *rl, int max)
         {
         unsigned char *p= *pp;
-        long ret=0;
+        unsigned long ret=0;
         int i;
 
         if (max-- < 1) return(0);
@@ -170,10 +171,10 @@ static int asn1_get_length(unsigned char **pp, int *inf, long *rl, int max)
                 else
                         ret=i;
                 }
-        if (ret < 0)
+        if (ret > LONG_MAX)
                 return 0;
         *pp=p;
-        *rl=ret;
+        *rl=(long)ret;
         return(1);
         }
 
diff --git a/src/lib/libssl/src/crypto/asn1/t_req.c b/src/lib/libssl/src/crypto/asn1/t_req.c
index 848c29a2dd..739f272ecf 100644
--- a/src/lib/libssl/src/crypto/asn1/t_req.c
+++ b/src/lib/libssl/src/crypto/asn1/t_req.c
@@ -82,7 +82,7 @@ int X509_REQ_print_fp(FILE *fp, X509_REQ *x)
         }
 #endif
 
-int X509_REQ_print(BIO *bp, X509_REQ *x)
+int X509_REQ_print_ex(BIO *bp, X509_REQ *x, unsigned long nmflags, unsigned long cflag)
         {
         unsigned long l;
         int i;
@@ -92,143 +92,185 @@ int X509_REQ_print(BIO *bp, X509_REQ *x)
         STACK_OF(X509_ATTRIBUTE) *sk;
         STACK_OF(X509_EXTENSION) *exts;
         char str[128];
+        char mlch = ' ';
+        int nmindent = 0;
+
+        if((nmflags & XN_FLAG_SEP_MASK) == XN_FLAG_SEP_MULTILINE) {
+                mlch = '\n';
+                nmindent = 12;
+        }
+
+        if(nmflags == X509_FLAG_COMPAT)
+                nmindent = 16;
+
 
         ri=x->req_info;
-        sprintf(str,"Certificate Request:\n");
-        if (BIO_puts(bp,str) <= 0) goto err;
-        sprintf(str,"%4sData:\n","");
-        if (BIO_puts(bp,str) <= 0) goto err;
-
-        neg=(ri->version->type == V_ASN1_NEG_INTEGER)?"-":"";
-        l=0;
-        for (i=0; i<ri->version->length; i++)
-                { l<<=8; l+=ri->version->data[i]; }
-        sprintf(str,"%8sVersion: %s%lu (%s0x%lx)\n","",neg,l,neg,l);
-        if (BIO_puts(bp,str) <= 0) goto err;
-        sprintf(str,"%8sSubject: ","");
-        if (BIO_puts(bp,str) <= 0) goto err;
-
-        X509_NAME_print(bp,ri->subject,16);
-        sprintf(str,"\n%8sSubject Public Key Info:\n","");
-        if (BIO_puts(bp,str) <= 0) goto err;
-        i=OBJ_obj2nid(ri->pubkey->algor->algorithm);
-        sprintf(str,"%12sPublic Key Algorithm: %s\n","",
-                (i == NID_undef)?"UNKNOWN":OBJ_nid2ln(i));
-        if (BIO_puts(bp,str) <= 0) goto err;
-
-        pkey=X509_REQ_get_pubkey(x);
-#ifndef OPENSSL_NO_RSA
-        if (pkey != NULL && pkey->type == EVP_PKEY_RSA)
+        if(!(cflag & X509_FLAG_NO_HEADER))
                 {
-                BIO_printf(bp,"%12sRSA Public Key: (%d bit)\n","",
-                        BN_num_bits(pkey->pkey.rsa->n));
-                RSA_print(bp,pkey->pkey.rsa,16);
+                if (BIO_write(bp,"Certificate Request:\n",21) <= 0) goto err;
+                if (BIO_write(bp,"    Data:\n",10) <= 0) goto err;
                 }
-        else 
-#endif
-#ifndef OPENSSL_NO_DSA
-                if (pkey != NULL && pkey->type == EVP_PKEY_DSA)
+        if(!(cflag & X509_FLAG_NO_VERSION))
                 {
-                BIO_printf(bp,"%12sDSA Public Key:\n","");
-                DSA_print(bp,pkey->pkey.dsa,16);
+                neg=(ri->version->type == V_ASN1_NEG_INTEGER)?"-":"";
+                l=0;
+                for (i=0; i<ri->version->length; i++)
+                        { l<<=8; l+=ri->version->data[i]; }
+                sprintf(str,"%8sVersion: %s%lu (%s0x%lx)\n","",neg,l,neg,l);
+                if (BIO_puts(bp,str) <= 0) goto err;
                 }
-        else
-#endif
-                BIO_printf(bp,"%12sUnknown Public Key:\n","");
+        if(!(cflag & X509_FLAG_NO_SUBJECT))
+                {
+                if (BIO_printf(bp,"        Subject:%c",mlch) <= 0) goto err;
+                if (X509_NAME_print_ex(bp,ri->subject,nmindent, nmflags) < 0) goto err;
+                if (BIO_write(bp,"\n",1) <= 0) goto err;
+                }
+        if(!(cflag & X509_FLAG_NO_PUBKEY))
+                {
+                if (BIO_write(bp,"        Subject Public Key Info:\n",33) <= 0)
+                        goto err;
+                if (BIO_printf(bp,"%12sPublic Key Algorithm: ","") <= 0)
+                        goto err;
+                if (i2a_ASN1_OBJECT(bp, ri->pubkey->algor->algorithm) <= 0)
+                        goto err;
+                if (BIO_puts(bp, "\n") <= 0)
+                        goto err;
 
-        if (pkey != NULL)
-            EVP_PKEY_free(pkey);
+                pkey=X509_REQ_get_pubkey(x);
+                if (pkey == NULL)
+                        {
+                        BIO_printf(bp,"%12sUnable to load Public Key\n","");
+                        ERR_print_errors(bp);
+                        }
+                else
+#ifndef OPENSSL_NO_RSA
+                if (pkey->type == EVP_PKEY_RSA)
+                        {
+                        BIO_printf(bp,"%12sRSA Public Key: (%d bit)\n","",
+                        BN_num_bits(pkey->pkey.rsa->n));
+                        RSA_print(bp,pkey->pkey.rsa,16);
+                        }
+                else
+#endif
+#ifndef OPENSSL_NO_DSA
+                if (pkey->type == EVP_PKEY_DSA)
+                        {
+                        BIO_printf(bp,"%12sDSA Public Key:\n","");
+                        DSA_print(bp,pkey->pkey.dsa,16);
+                        }
+                else
+#endif
+                        BIO_printf(bp,"%12sUnknown Public Key:\n","");
 
-        /* may not be */
-        sprintf(str,"%8sAttributes:\n","");
-        if (BIO_puts(bp,str) <= 0) goto err;
+                EVP_PKEY_free(pkey);
+                }
 
-        sk=x->req_info->attributes;
-        if (sk_X509_ATTRIBUTE_num(sk) == 0)
+        if(!(cflag & X509_FLAG_NO_ATTRIBUTES))
                 {
-                sprintf(str,"%12sa0:00\n","");
+                /* may not be */
+                sprintf(str,"%8sAttributes:\n","");
                 if (BIO_puts(bp,str) <= 0) goto err;
-                }
-        else
-                {
-                for (i=0; i<sk_X509_ATTRIBUTE_num(sk); i++)
+
+                sk=x->req_info->attributes;
+                if (sk_X509_ATTRIBUTE_num(sk) == 0)
                         {
-                        ASN1_TYPE *at;
-                        X509_ATTRIBUTE *a;
-                        ASN1_BIT_STRING *bs=NULL;
-                        ASN1_TYPE *t;
-                        int j,type=0,count=1,ii=0;
-
-                        a=sk_X509_ATTRIBUTE_value(sk,i);
-                        if(X509_REQ_extension_nid(OBJ_obj2nid(a->object)))
-                                                                continue;
-                        sprintf(str,"%12s","");
+                        sprintf(str,"%12sa0:00\n","");
                         if (BIO_puts(bp,str) <= 0) goto err;
-                        if ((j=i2a_ASN1_OBJECT(bp,a->object)) > 0)
+                        }
+                else
                         {
-                        if (a->single)
+                        for (i=0; i<sk_X509_ATTRIBUTE_num(sk); i++)
                                 {
-                                t=a->value.single;
-                                type=t->type;
-                                bs=t->value.bit_string;
-                                }
-                        else
+                                ASN1_TYPE *at;
+                                X509_ATTRIBUTE *a;
+                                ASN1_BIT_STRING *bs=NULL;
+                                ASN1_TYPE *t;
+                                int j,type=0,count=1,ii=0;
+
+                                a=sk_X509_ATTRIBUTE_value(sk,i);
+                                if(X509_REQ_extension_nid(OBJ_obj2nid(a->object)))
+                                                                        continue;
+                                sprintf(str,"%12s","");
+                                if (BIO_puts(bp,str) <= 0) goto err;
+                                if ((j=i2a_ASN1_OBJECT(bp,a->object)) > 0)
                                 {
-                                ii=0;
-                                count=sk_ASN1_TYPE_num(a->value.set);
+                                if (a->single)
+                                        {
+                                        t=a->value.single;
+                                        type=t->type;
+                                        bs=t->value.bit_string;
+                                        }
+                                else
+                                        {
+                                        ii=0;
+                                        count=sk_ASN1_TYPE_num(a->value.set);
 get_next:
-                                at=sk_ASN1_TYPE_value(a->value.set,ii);
-                                type=at->type;
-                                bs=at->value.asn1_string;
+                                        at=sk_ASN1_TYPE_value(a->value.set,ii);
+                                        type=at->type;
+                                        bs=at->value.asn1_string;
+                                        }
+                                }
+                                for (j=25-j; j>0; j--)
+                                        if (BIO_write(bp," ",1) != 1) goto err;
+                                if (BIO_puts(bp,":") <= 0) goto err;
+                                if (    (type == V_ASN1_PRINTABLESTRING) ||
+                                        (type == V_ASN1_T61STRING) ||
+                                        (type == V_ASN1_IA5STRING))
+                                        {
+                                        if (BIO_write(bp,(char *)bs->data,bs->length)
+                                                != bs->length)
+                                                goto err;
+                                        BIO_puts(bp,"\n");
+                                        }
+                                else
+                                        {
+                                        BIO_puts(bp,"unable to print attribute\n");
+                                        }
+                                if (++ii < count) goto get_next;
                                 }
                         }
-                        for (j=25-j; j>0; j--)
-                                if (BIO_write(bp," ",1) != 1) goto err;
-                        if (BIO_puts(bp,":") <= 0) goto err;
-                        if (    (type == V_ASN1_PRINTABLESTRING) ||
-                                (type == V_ASN1_T61STRING) ||
-                                (type == V_ASN1_IA5STRING))
+                }
+        if(!(cflag & X509_FLAG_NO_ATTRIBUTES))
+                {
+                exts = X509_REQ_get_extensions(x);
+                if(exts)
+                        {
+                        BIO_printf(bp,"%8sRequested Extensions:\n","");
+                        for (i=0; i<sk_X509_EXTENSION_num(exts); i++)
                                 {
-                                if (BIO_write(bp,(char *)bs->data,bs->length)
-                                        != bs->length)
+                                ASN1_OBJECT *obj;
+                                X509_EXTENSION *ex;
+                                int j;
+                                ex=sk_X509_EXTENSION_value(exts, i);
+                                if (BIO_printf(bp,"%12s","") <= 0) goto err;
+                                obj=X509_EXTENSION_get_object(ex);
+                                i2a_ASN1_OBJECT(bp,obj);
+                                j=X509_EXTENSION_get_critical(ex);
+                                if (BIO_printf(bp,": %s\n",j?"critical":"","") <= 0)
                                         goto err;
-                                BIO_puts(bp,"\n");
-                                }
-                        else
-                                {
-                                BIO_puts(bp,"unable to print attribute\n");
+                                if(!X509V3_EXT_print(bp, ex, 0, 16))
+                                        {
+                                        BIO_printf(bp, "%16s", "");
+                                        M_ASN1_OCTET_STRING_print(bp,ex->value);
+                                        }
+                                if (BIO_write(bp,"\n",1) <= 0) goto err;
                                 }
-                        if (++ii < count) goto get_next;
+                        sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
                         }
                 }
 
-        exts = X509_REQ_get_extensions(x);
-        if(exts) {
-                BIO_printf(bp,"%8sRequested Extensions:\n","");
-                for (i=0; i<sk_X509_EXTENSION_num(exts); i++) {
-                        ASN1_OBJECT *obj;
-                        X509_EXTENSION *ex;
-                        int j;
-                        ex=sk_X509_EXTENSION_value(exts, i);
-                        if (BIO_printf(bp,"%12s","") <= 0) goto err;
-                        obj=X509_EXTENSION_get_object(ex);
-                        i2a_ASN1_OBJECT(bp,obj);
-                        j=X509_EXTENSION_get_critical(ex);
-                        if (BIO_printf(bp,": %s\n",j?"critical":"","") <= 0)
-                                goto err;
-                        if(!X509V3_EXT_print(bp, ex, 0, 16)) {
-                                BIO_printf(bp, "%16s", "");
-                                M_ASN1_OCTET_STRING_print(bp,ex->value);
-                        }
-                        if (BIO_write(bp,"\n",1) <= 0) goto err;
+        if(!(cflag & X509_FLAG_NO_SIGDUMP))
+                {
+                if(!X509_signature_print(bp, x->sig_alg, x->signature)) goto err;
                 }
-                sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
-        }
-
-        if(!X509_signature_print(bp, x->sig_alg, x->signature)) goto err;
 
         return(1);
 err:
         X509err(X509_F_X509_REQ_PRINT,ERR_R_BUF_LIB);
         return(0);
         }
+
+int X509_REQ_print(BIO *bp, X509_REQ *x)
+        {
+        return X509_REQ_print_ex(bp, x, XN_FLAG_COMPAT, X509_FLAG_COMPAT);
+        }
diff --git a/src/lib/libssl/src/crypto/asn1/tasn_dec.c b/src/lib/libssl/src/crypto/asn1/tasn_dec.c
index 0fc1f421e2..f87c08793a 100644
--- a/src/lib/libssl/src/crypto/asn1/tasn_dec.c
+++ b/src/lib/libssl/src/crypto/asn1/tasn_dec.c
@@ -913,10 +913,10 @@ static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass, char *i
                         ctx->ptag = ptag;
                         ctx->hdrlen = p - q;
                         ctx->valid = 1;
-                        /* If definite length, length + header can't exceed total
-                         * amount of data available.
+                        /* If definite length, and no error, length +
+                         * header can't exceed total amount of data available. 
                          */
-                        if(!(i & 1) && ((plen + ctx->hdrlen) > len)) {
+                        if(!(i & 0x81) && ((plen + ctx->hdrlen) > len)) {
                                 ASN1err(ASN1_F_ASN1_CHECK_TLEN, ASN1_R_TOO_LONG);
                                 asn1_tlc_clear(ctx);
                                 return 0;
diff --git a/src/lib/libssl/src/crypto/bio/b_print.c b/src/lib/libssl/src/crypto/bio/b_print.c
index 3ce1290772..80c9cb69db 100644
--- a/src/lib/libssl/src/crypto/bio/b_print.c
+++ b/src/lib/libssl/src/crypto/bio/b_print.c
@@ -109,7 +109,7 @@
  * o ...                                       (for OpenSSL)
  */
 
-#if HAVE_LONG_DOUBLE
+#ifdef HAVE_LONG_DOUBLE
 #define LDOUBLE long double
 #else
 #define LDOUBLE double
diff --git a/src/lib/libssl/src/crypto/bn/bn.h b/src/lib/libssl/src/crypto/bn/bn.h
index 1eaf879553..b40682f831 100644
--- a/src/lib/libssl/src/crypto/bn/bn.h
+++ b/src/lib/libssl/src/crypto/bn/bn.h
@@ -430,7 +430,7 @@ int BN_mod_mul_montgomery(BIGNUM *r,const BIGNUM *a,const BIGNUM *b,
 int BN_from_montgomery(BIGNUM *r,const BIGNUM *a,
         BN_MONT_CTX *mont, BN_CTX *ctx);
 void BN_MONT_CTX_free(BN_MONT_CTX *mont);
-int BN_MONT_CTX_set(BN_MONT_CTX *mont,const BIGNUM *modulus,BN_CTX *ctx);
+int BN_MONT_CTX_set(BN_MONT_CTX *mont,const BIGNUM *mod,BN_CTX *ctx);
 BN_MONT_CTX *BN_MONT_CTX_copy(BN_MONT_CTX *to,BN_MONT_CTX *from);
 
 BN_BLINDING *BN_BLINDING_new(BIGNUM *A,BIGNUM *Ai,BIGNUM *mod);
diff --git a/src/lib/libssl/src/crypto/cryptlib.c b/src/lib/libssl/src/crypto/cryptlib.c
index d301b376f7..612b3b93b4 100644
--- a/src/lib/libssl/src/crypto/cryptlib.c
+++ b/src/lib/libssl/src/crypto/cryptlib.c
@@ -492,11 +492,3 @@ BOOL WINAPI DLLEntryPoint(HINSTANCE hinstDLL, DWORD fdwReason,
 #endif
 
 #endif
-
-void OpenSSLDie(const char *file,int line,const char *assertion)
-    {
-    fprintf(stderr,"%s(%d): OpenSSL internal error, assertion failed: %s\n",
-            file,line,assertion);
-    abort();
-    }
-
diff --git a/src/lib/libssl/src/crypto/cryptlib.h b/src/lib/libssl/src/crypto/cryptlib.h
index 985a6d377c..88e4ae509f 100644
--- a/src/lib/libssl/src/crypto/cryptlib.h
+++ b/src/lib/libssl/src/crypto/cryptlib.h
@@ -93,10 +93,6 @@ extern "C" {
 #define DECIMAL_SIZE(type)     ((sizeof(type)*8+2)/3+1)
 #define HEX_SIZE(type)         ((sizeof(type)*2)
 
-/* die if we have to */
-void OpenSSLDie(const char *file,int line,const char *assertion);
-#define die(e)  ((e) ? (void)0 : OpenSSLDie(__FILE__, __LINE__, #e))
-
 #ifdef  __cplusplus
 }
 #endif
diff --git a/src/lib/libssl/src/crypto/crypto-lib.com b/src/lib/libssl/src/crypto/crypto-lib.com
index 4847a69a71..dfcff11860 100644
--- a/src/lib/libssl/src/crypto/crypto-lib.com
+++ b/src/lib/libssl/src/crypto/crypto-lib.com
@@ -231,7 +231,7 @@ $ LIB_RAND = "md_rand,randfile,rand_lib,rand_err,rand_egd,"+ -
         "rand_vms"
 $ LIB_ERR = "err,err_all,err_prn"
 $ LIB_OBJECTS = "o_names,obj_dat,obj_lib,obj_err"
-$ LIB_EVP = "encode,digest,evp_enc,evp_key,"+ -
+$ LIB_EVP = "encode,digest,evp_enc,evp_key,evp_acnf,"+ -
         "e_des,e_bf,e_idea,e_des3,"+ -
         "e_rc4,e_aes,names,"+ -
         "e_xcbc_d,e_rc2,e_cast,e_rc5"
@@ -265,14 +265,14 @@ $ LIB_X509V3 = "v3_bcons,v3_bitst,v3_conf,v3_extku,v3_ia5,v3_lib,"+ -
         "v3_prn,v3_utl,v3err,v3_genn,v3_alt,v3_skey,v3_akey,v3_pku,"+ -
         "v3_int,v3_enum,v3_sxnet,v3_cpols,v3_crld,v3_purp,v3_info,"+ -
         "v3_ocsp,v3_akeya"
-$ LIB_CONF = "conf_err,conf_lib,conf_api,conf_def,conf_mod,conf_mall"
+$ LIB_CONF = "conf_err,conf_lib,conf_api,conf_def,conf_mod,conf_mall,conf_sap"
 $ LIB_TXT_DB = "txt_db"
 $ LIB_PKCS7 = "pk7_asn1,pk7_lib,pkcs7err,pk7_doit,pk7_smime,pk7_attr,"+ -
         "pk7_mime"
 $ LIB_PKCS12 = "p12_add,p12_asn,p12_attr,p12_crpt,p12_crt,p12_decr,"+ -
         "p12_init,p12_key,p12_kiss,p12_mutl,"+ -
         "p12_utl,p12_npas,pk12err,p12_p8d,p12_p8e"
-$ LIB_COMP = "comp_lib,"+ -
+$ LIB_COMP = "comp_lib,comp_err,"+ -
         "c_rle,c_zlib"
 $ LIB_OCSP = "ocsp_asn,ocsp_ext,ocsp_ht,ocsp_lib,ocsp_cl,"+ -
         "ocsp_srv,ocsp_prn,ocsp_vfy,ocsp_err"
@@ -1325,7 +1325,7 @@ $   CC4 = CC - CCDISABLEWARNINGS + CC4DISABLEWARNINGS
 $!
 $!  Show user the result
 $!
-$   WRITE SYS$OUTPUT "Main C Compiling Command: ",CC
+$   WRITE/SYMBOL SYS$OUTPUT "Main C Compiling Command: ",CC
 $!
 $!  Else The User Entered An Invalid Arguement.
 $!
@@ -1356,7 +1356,7 @@ $ IF ARCH .EQS. "AXP" THEN MACRO = "MACRO/MIGRATION/''DEBUGGER'/''MACRO_OPTIMIZE
 $!
 $!  Show user the result
 $!
-$   WRITE SYS$OUTPUT "Main MACRO Compiling Command: ",MACRO
+$   WRITE/SYMBOL SYS$OUTPUT "Main MACRO Compiling Command: ",MACRO
 $!
 $! Time to check the contents, and to make sure we get the correct library.
 $!
diff --git a/src/lib/libssl/src/crypto/des/des_ver.h b/src/lib/libssl/src/crypto/des/des_ver.h
index 0fa94d5368..379bbadda2 100644
--- a/src/lib/libssl/src/crypto/des/des_ver.h
+++ b/src/lib/libssl/src/crypto/des/des_ver.h
@@ -63,5 +63,9 @@
 # define OPENSSL_EXTERN OPENSSL_EXPORT
 #endif
 
-OPENSSL_EXTERN char *DES_version;       /* SSLeay version string */
-OPENSSL_EXTERN char *libdes_version;    /* old libdes version string */
+/* The following macros make sure the names are different from libdes names */
+#define DES_version OSSL_DES_version
+#define libdes_version OSSL_libdes_version
+
+OPENSSL_EXTERN const char *OSSL_DES_version;    /* SSLeay version string */
+OPENSSL_EXTERN const char *OSSL_libdes_version; /* old libdes version string */
diff --git a/src/lib/libssl/src/crypto/des/ecb_enc.c b/src/lib/libssl/src/crypto/des/ecb_enc.c
index 4650f2fa0f..1b70f68806 100644
--- a/src/lib/libssl/src/crypto/des/ecb_enc.c
+++ b/src/lib/libssl/src/crypto/des/ecb_enc.c
@@ -57,6 +57,7 @@
  */
 
 #include "des_locl.h"
+#include "des_ver.h"
 #include "spr.h"
 #include <openssl/opensslv.h>
 
diff --git a/src/lib/libssl/src/crypto/des/set_key.c b/src/lib/libssl/src/crypto/des/set_key.c
index 683916e71b..143008ed9c 100644
--- a/src/lib/libssl/src/crypto/des/set_key.c
+++ b/src/lib/libssl/src/crypto/des/set_key.c
@@ -342,7 +342,7 @@ void DES_set_key_unchecked(const_DES_cblock *key, DES_key_schedule *schedule)
         register DES_LONG *k;
         register int i;
 
-#if OPENBSD_DEV_CRYPTO
+#ifdef OPENBSD_DEV_CRYPTO
         memcpy(schedule->key,key,sizeof schedule->key);
         schedule->session=NULL;
 #endif
diff --git a/src/lib/libssl/src/crypto/engine/hw_4758_cca.c b/src/lib/libssl/src/crypto/engine/hw_4758_cca.c
index 1053c52082..bfb80968e2 100644
--- a/src/lib/libssl/src/crypto/engine/hw_4758_cca.c
+++ b/src/lib/libssl/src/crypto/engine/hw_4758_cca.c
@@ -953,7 +953,7 @@ static void cca_ex_free(void *obj, void *item, CRYPTO_EX_DATA *ad, int idx,
 #ifdef ENGINE_DYNAMIC_SUPPORT 
 static int bind_fn(ENGINE *e, const char *id)
         {
-        if(id && (strcmp(id, engine_cswift_id) != 0))
+        if(id && (strcmp(id, engine_4758_cca_id) != 0))
                 return 0;
         if(!bind_helper(e))
                 return 0;
diff --git a/src/lib/libssl/src/crypto/engine/hw_ubsec.c b/src/lib/libssl/src/crypto/engine/hw_ubsec.c
index 63397f868c..ed8401ec16 100644
--- a/src/lib/libssl/src/crypto/engine/hw_ubsec.c
+++ b/src/lib/libssl/src/crypto/engine/hw_ubsec.c
@@ -93,7 +93,7 @@ static int ubsec_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa);
 static int ubsec_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
                 const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
 #ifndef OPENSSL_NO_DSA
-#if NOT_USED
+#ifdef NOT_USED
 static int ubsec_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,
                 BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
                 BN_CTX *ctx, BN_MONT_CTX *in_mont);
@@ -113,7 +113,7 @@ static int ubsec_dh_compute_key(unsigned char *key,const BIGNUM *pub_key,DH *dh)
 static int ubsec_dh_generate_key(DH *dh);
 #endif
 
-#if NOT_USED
+#ifdef NOT_USED
 static int ubsec_rand_bytes(unsigned char *buf, int num);
 static int ubsec_rand_status(void);
 #endif
@@ -663,7 +663,7 @@ static int ubsec_mod_exp_crt(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
 }
 
 #ifndef OPENSSL_NO_DSA
-#if NOT_USED
+#ifdef NOT_USED
 static int ubsec_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,
                 BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
                 BN_CTX *ctx, BN_MONT_CTX *in_mont)
@@ -987,7 +987,7 @@ err:
         }
 #endif
 
-#if NOT_USED
+#ifdef NOT_USED
 static int ubsec_rand_bytes(unsigned char * buf,
                             int num)
         {
diff --git a/src/lib/libssl/src/crypto/evp/evp_locl.h b/src/lib/libssl/src/crypto/evp/evp_locl.h
index 7b088b4848..4d81a3bf4c 100644
--- a/src/lib/libssl/src/crypto/evp/evp_locl.h
+++ b/src/lib/libssl/src/crypto/evp/evp_locl.h
@@ -124,17 +124,17 @@ const EVP_CIPHER *EVP_##cname##_##mode(void) { return &cname##_##mode; }
 BLOCK_CIPHER_def1(cname, cbc, cbc, CBC, kstruct, nid, block_size, key_len, \
                   iv_len, flags, init_key, cleanup, set_asn1, get_asn1, ctrl)
 
-#define BLOCK_CIPHER_def_cfb(cname, kstruct, nid, block_size, key_len, \
+#define BLOCK_CIPHER_def_cfb(cname, kstruct, nid, key_len, \
                              iv_len, cbits, flags, init_key, cleanup, \
                              set_asn1, get_asn1, ctrl) \
-BLOCK_CIPHER_def1(cname, cfb##cbits, cfb, CFB, kstruct, nid, block_size, \
+BLOCK_CIPHER_def1(cname, cfb##cbits, cfb, CFB, kstruct, nid, 1, \
                   key_len, iv_len, flags, init_key, cleanup, set_asn1, \
                   get_asn1, ctrl)
 
-#define BLOCK_CIPHER_def_ofb(cname, kstruct, nid, block_size, key_len, \
+#define BLOCK_CIPHER_def_ofb(cname, kstruct, nid, key_len, \
                              iv_len, cbits, flags, init_key, cleanup, \
                              set_asn1, get_asn1, ctrl) \
-BLOCK_CIPHER_def1(cname, ofb##cbits, ofb, OFB, kstruct, nid, block_size, \
+BLOCK_CIPHER_def1(cname, ofb##cbits, ofb, OFB, kstruct, nid, 1, \
                   key_len, iv_len, flags, init_key, cleanup, set_asn1, \
                   get_asn1, ctrl)
 
@@ -149,9 +149,9 @@ BLOCK_CIPHER_def1(cname, ecb, ecb, ECB, kstruct, nid, block_size, key_len, \
                           init_key, cleanup, set_asn1, get_asn1, ctrl) \
 BLOCK_CIPHER_def_cbc(cname, kstruct, nid, block_size, key_len, iv_len, flags, \
                      init_key, cleanup, set_asn1, get_asn1, ctrl) \
-BLOCK_CIPHER_def_cfb(cname, kstruct, nid, block_size, key_len, iv_len, cbits, \
+BLOCK_CIPHER_def_cfb(cname, kstruct, nid, key_len, iv_len, cbits, \
                      flags, init_key, cleanup, set_asn1, get_asn1, ctrl) \
-BLOCK_CIPHER_def_ofb(cname, kstruct, nid, block_size, key_len, iv_len, cbits, \
+BLOCK_CIPHER_def_ofb(cname, kstruct, nid, key_len, iv_len, cbits, \
                      flags, init_key, cleanup, set_asn1, get_asn1, ctrl) \
 BLOCK_CIPHER_def_ecb(cname, kstruct, nid, block_size, key_len, iv_len, flags, \
                      init_key, cleanup, set_asn1, get_asn1, ctrl)
diff --git a/src/lib/libssl/src/crypto/mem.c b/src/lib/libssl/src/crypto/mem.c
index effec714e8..a7826908e6 100644
--- a/src/lib/libssl/src/crypto/mem.c
+++ b/src/lib/libssl/src/crypto/mem.c
@@ -303,6 +303,9 @@ void *CRYPTO_realloc(void *str, int num, const char *file, int line)
         {
         void *ret = NULL;
 
+        if (str == NULL)
+                return CRYPTO_malloc(num, file, line);
+
         if (realloc_debug_func != NULL)
                 realloc_debug_func(str, NULL, num, file, line, 0);
         ret = realloc_ex_func(str,num,file,line);
diff --git a/src/lib/libssl/src/crypto/objects/obj_dat.c b/src/lib/libssl/src/crypto/objects/obj_dat.c
index 02c3719f04..ce779dc1b5 100644
--- a/src/lib/libssl/src/crypto/objects/obj_dat.c
+++ b/src/lib/libssl/src/crypto/objects/obj_dat.c
@@ -425,7 +425,7 @@ ASN1_OBJECT *OBJ_txt2obj(const char *s, int no_name)
         a2d_ASN1_OBJECT(p,i,s,-1);
         
         p=buf;
-        op=d2i_ASN1_OBJECT(NULL,&p,i);
+        op=d2i_ASN1_OBJECT(NULL,&p,j);
         OPENSSL_free(buf);
         return op;
         }
diff --git a/src/lib/libssl/src/crypto/pem/pem_lib.c b/src/lib/libssl/src/crypto/pem/pem_lib.c
index 18b751a91a..a8db6ffbf5 100644
--- a/src/lib/libssl/src/crypto/pem/pem_lib.c
+++ b/src/lib/libssl/src/crypto/pem/pem_lib.c
@@ -366,8 +366,11 @@ err:
         memset(iv,0,sizeof(iv));
         memset((char *)&ctx,0,sizeof(ctx));
         memset(buf,0,PEM_BUFSIZE);
-        memset(data,0,(unsigned int)dsize);
-        OPENSSL_free(data);
+        if (data != NULL)
+                {
+                memset(data,0,(unsigned int)dsize);
+                OPENSSL_free(data);
+                }
         return(ret);
         }
 
diff --git a/src/lib/libssl/src/crypto/pkcs12/p12_asn.c b/src/lib/libssl/src/crypto/pkcs12/p12_asn.c
index c327bdba03..a3739fee1a 100644
--- a/src/lib/libssl/src/crypto/pkcs12/p12_asn.c
+++ b/src/lib/libssl/src/crypto/pkcs12/p12_asn.c
@@ -83,8 +83,8 @@ ASN1_ADB_TEMPLATE(bag_default) = ASN1_EXP(PKCS12_BAGS, value.other, ASN1_ANY, 0)
 
 ASN1_ADB(PKCS12_BAGS) = {
         ADB_ENTRY(NID_x509Certificate, ASN1_EXP(PKCS12_BAGS, value.x509cert, ASN1_OCTET_STRING, 0)),
-        ADB_ENTRY(NID_x509Certificate, ASN1_EXP(PKCS12_BAGS, value.x509crl, ASN1_OCTET_STRING, 0)),
-        ADB_ENTRY(NID_x509Certificate, ASN1_EXP(PKCS12_BAGS, value.sdsicert, ASN1_IA5STRING, 0)),
+        ADB_ENTRY(NID_x509Crl, ASN1_EXP(PKCS12_BAGS, value.x509crl, ASN1_OCTET_STRING, 0)),
+        ADB_ENTRY(NID_sdsiCertificate, ASN1_EXP(PKCS12_BAGS, value.sdsicert, ASN1_IA5STRING, 0)),
 } ASN1_ADB_END(PKCS12_BAGS, 0, type, 0, &bag_default_tt, NULL);
 
 ASN1_SEQUENCE(PKCS12_BAGS) = {
@@ -98,7 +98,7 @@ ASN1_ADB_TEMPLATE(safebag_default) = ASN1_EXP(PKCS12_SAFEBAG, value.other, ASN1_
 
 ASN1_ADB(PKCS12_SAFEBAG) = {
         ADB_ENTRY(NID_keyBag, ASN1_EXP(PKCS12_SAFEBAG, value.keybag, PKCS8_PRIV_KEY_INFO, 0)),
-        ADB_ENTRY(NID_pkcs8ShroudedKeyBag, ASN1_EXP(PKCS12_SAFEBAG, value.keybag, X509_SIG, 0)),
+        ADB_ENTRY(NID_pkcs8ShroudedKeyBag, ASN1_EXP(PKCS12_SAFEBAG, value.shkeybag, X509_SIG, 0)),
         ADB_ENTRY(NID_safeContentsBag, ASN1_EXP_SET_OF(PKCS12_SAFEBAG, value.safes, PKCS12_SAFEBAG, 0)),
         ADB_ENTRY(NID_certBag, ASN1_EXP(PKCS12_SAFEBAG, value.bag, PKCS12_BAGS, 0)),
         ADB_ENTRY(NID_crlBag, ASN1_EXP(PKCS12_SAFEBAG, value.bag, PKCS12_BAGS, 0)),
diff --git a/src/lib/libssl/src/crypto/pkcs7/pk7_lib.c b/src/lib/libssl/src/crypto/pkcs7/pk7_lib.c
index c00ed6833a..985b07245c 100644
--- a/src/lib/libssl/src/crypto/pkcs7/pk7_lib.c
+++ b/src/lib/libssl/src/crypto/pkcs7/pk7_lib.c
@@ -74,6 +74,13 @@ long PKCS7_ctrl(PKCS7 *p7, int cmd, long larg, char *parg)
                 if (nid == NID_pkcs7_signed)
                         {
                         ret=p7->detached=(int)larg;
+                        if (ret && PKCS7_type_is_data(p7->d.sign->contents))
+                                        {
+                                        ASN1_OCTET_STRING *os;
+                                        os=p7->d.sign->contents->d.data;
+                                        ASN1_OCTET_STRING_free(os);
+                                        p7->d.sign->contents->d.data = NULL;
+                                        }
                         }
                 else
                         {
diff --git a/src/lib/libssl/src/crypto/ripemd/rmdtest.c b/src/lib/libssl/src/crypto/ripemd/rmdtest.c
index 19e9741db2..be1fb8b1f6 100644
--- a/src/lib/libssl/src/crypto/ripemd/rmdtest.c
+++ b/src/lib/libssl/src/crypto/ripemd/rmdtest.c
@@ -59,7 +59,6 @@
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
-#include <openssl/ripemd.h>
 
 #ifdef OPENSSL_NO_RIPEMD
 int main(int argc, char *argv[])
@@ -68,6 +67,7 @@ int main(int argc, char *argv[])
     return(0);
 }
 #else
+#include <openssl/ripemd.h>
 #include <openssl/evp.h>
 
 #ifdef CHARSET_EBCDIC
diff --git a/src/lib/libssl/src/crypto/x509/x509.h b/src/lib/libssl/src/crypto/x509/x509.h
index c75aa0c717..7095440d36 100644
--- a/src/lib/libssl/src/crypto/x509/x509.h
+++ b/src/lib/libssl/src/crypto/x509/x509.h
@@ -331,6 +331,7 @@ DECLARE_STACK_OF(X509_TRUST)
 #define X509_FLAG_NO_EXTENSIONS         (1L << 8)
 #define X509_FLAG_NO_SIGDUMP            (1L << 9)
 #define X509_FLAG_NO_AUX                (1L << 10)
+#define X509_FLAG_NO_ATTRIBUTES         (1L << 11)
 
 /* Flags specific to X509_NAME_print_ex() */    
 
@@ -1015,6 +1016,7 @@ int		X509_print(BIO *bp,X509 *x);
 int             X509_ocspid_print(BIO *bp,X509 *x);
 int             X509_CERT_AUX_print(BIO *bp,X509_CERT_AUX *x, int indent);
 int             X509_CRL_print(BIO *bp,X509_CRL *x);
+int             X509_REQ_print_ex(BIO *bp, X509_REQ *x, unsigned long nmflag, unsigned long cflag);
 int             X509_REQ_print(BIO *bp,X509_REQ *req);
 #endif
 
diff --git a/src/lib/libssl/src/demos/engines/cluster_labs/Makefile b/src/lib/libssl/src/demos/engines/cluster_labs/Makefile
new file mode 100644
index 0000000000..956193f093
--- /dev/null
+++ b/src/lib/libssl/src/demos/engines/cluster_labs/Makefile
@@ -0,0 +1,114 @@
+LIBNAME=        libclabs
+SRC=            hw_cluster_labs.c
+OBJ=            hw_cluster_labs.o
+HEADER=         hw_cluster_labs.h
+
+CC=             gcc
+PIC=            -fPIC
+CFLAGS=         -g -I../../../include $(PIC) -DENGINE_DYNAMIC_SUPPORT -DFLAT_INC
+AR=             ar r
+RANLIB=         ranlib
+
+LIB=            $(LIBNAME).a
+SHLIB=          $(LIBNAME).so
+
+all:
+                @echo 'Please choose a system to build on:'
+                @echo ''
+                @echo 'tru64:    Tru64 Unix, Digital Unix, Digital OSF/1'
+                @echo 'solaris:  Solaris'
+                @echo 'irix:     IRIX'
+                @echo 'hpux32:   32-bit HP/UX'
+                @echo 'hpux64:   64-bit HP/UX'
+                @echo 'aix:      AIX'
+                @echo 'gnu:      Generic GNU-based system (gcc and GNU ld)'
+                @echo ''
+
+FORCE.update:
+update:         FORCE.update
+                perl ../../../util/mkerr.pl -conf hw_cluster_labs.ec \
+                        -nostatic -staticloader -write hw_cluster_labs.c
+
+gnu:            $(SHLIB).gnu
+tru64:          $(SHLIB).tru64
+solaris:        $(SHLIB).solaris
+irix:           $(SHLIB).irix
+hpux32:         $(SHLIB).hpux32
+hpux64:         $(SHLIB).hpux64
+aix:            $(SHLIB).aix
+
+$(LIB):         $(OBJ)
+                $(AR) $(LIB) $(OBJ)
+                - $(RANLIB) $(LIB)
+
+LINK_SO=        \
+  ld -r -o $(LIBNAME).o $$ALLSYMSFLAGS $(LIB) && \
+  (nm -Pg $(LIBNAME).o | grep ' [BDT] ' | cut -f1 -d' ' > $(LIBNAME).exp; \
+   $$SHAREDCMD $$SHAREDFLAGS -o $(SHLIB) $(LIBNAME).o -L ../../.. -lcrypto -lc)
+
+$(SHLIB).gnu:   $(LIB)
+                ALLSYMSFLAGS='--whole-archive' \
+                SHAREDFLAGS='-shared -Wl,-soname=$(SHLIB)' \
+                SHAREDCMD='$(CC)'; \
+                $(LINK_SO)
+                touch $(SHLIB).gnu
+$(SHLIB).tru64: $(LIB)
+                ALLSYMSFLAGS='-all' \
+                SHAREDFLAGS='-shared' \
+                SHAREDCMD='$(CC)'; \
+                $(LINK_SO)
+                touch $(SHLIB).tru64
+$(SHLIB).solaris:       $(LIB)
+                ALLSYMSFLAGS='-z allextract' \
+                SHAREDFLAGS='-G -h $(SHLIB)' \
+                SHAREDCMD='$(CC)'; \
+                $(LINK_SO)
+                touch $(SHLIB).solaris
+$(SHLIB).irix:  $(LIB)
+                ALLSYMSFLAGS='-all' \
+                SHAREDFLAGS='-shared -Wl,-soname,$(SHLIB)' \
+                SHAREDCMD='$(CC)'; \
+                $(LINK_SO)
+                touch $(SHLIB).irix
+$(SHLIB).hpux32:        $(LIB)
+                ALLSYMSFLAGS='-Fl' \
+                SHAREDFLAGS='+vnocompatwarnings -b -z +s +h $(SHLIB)' \
+                SHAREDCMD='/usr/ccs/bin/ld'; \
+                $(LINK_SO)
+                touch $(SHLIB).hpux32
+$(SHLIB).hpux64:        $(LIB)
+                ALLSYMSFLAGS='+forceload' \
+                SHAREDFLAGS='-b -z +h $(SHLIB)' \
+                SHAREDCMD='/usr/ccs/bin/ld'; \
+                $(LINK_SO)
+                touch $(SHLIB).hpux64
+$(SHLIB).aix:   $(LIB)
+                ALLSYMSFLAGS='-bnogc' \
+                SHAREDFLAGS='-G -bE:$(LIBNAME).exp -bM:SRE' \
+                SHAREDCMD='$(CC)'; \
+                $(LINK_SO)
+                touch $(SHLIB).aix
+
+depend:
+                sed -e '/^# DO NOT DELETE.*/,$$d' < Makefile > Makefile.tmp
+                echo '# DO NOT DELETE THIS LINE -- make depend depends on it.' >> Makefile.tmp
+                gcc -M $(CFLAGS) $(SRC) >> Makefile.tmp
+                perl ../../../util/clean-depend.pl < Makefile.tmp > Makefile.new
+                rm -f Makefile.tmp Makefile
+                mv Makefile.new Makefile
+
+# DO NOT DELETE THIS LINE -- make depend depends on it.
+
+rsaref.o: ../../../include/openssl/asn1.h ../../../include/openssl/bio.h
+rsaref.o: ../../../include/openssl/bn.h ../../../include/openssl/crypto.h
+rsaref.o: ../../../include/openssl/dh.h ../../../include/openssl/dsa.h
+rsaref.o: ../../../include/openssl/e_os2.h ../../../include/openssl/engine.h
+rsaref.o: ../../../include/openssl/err.h ../../../include/openssl/lhash.h
+rsaref.o: ../../../include/openssl/opensslconf.h
+rsaref.o: ../../../include/openssl/opensslv.h
+rsaref.o: ../../../include/openssl/ossl_typ.h ../../../include/openssl/rand.h
+rsaref.o: ../../../include/openssl/rsa.h ../../../include/openssl/safestack.h
+rsaref.o: ../../../include/openssl/stack.h ../../../include/openssl/symhacks.h
+rsaref.o: ../../../include/openssl/ui.h rsaref.c rsaref_err.c rsaref_err.h
+rsaref.o: source/des.h source/global.h source/md2.h source/md5.h source/rsa.h
+rsaref.o: source/rsaref.h
diff --git a/src/lib/libssl/src/demos/engines/cluster_labs/cluster_labs.h b/src/lib/libssl/src/demos/engines/cluster_labs/cluster_labs.h
new file mode 100644
index 0000000000..d0926796f0
--- /dev/null
+++ b/src/lib/libssl/src/demos/engines/cluster_labs/cluster_labs.h
@@ -0,0 +1,35 @@
+typedef int cl_engine_init(void);
+typedef int cl_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                        const BIGNUM *m, BN_CTX *cgx);
+typedef int cl_mod_exp_crt(BIGNUM *r, BIGNUM *a, const BIGNUM *p,
+                const BIGNUM *q, const BIGNUM *dmp1, const BIGNUM *dmq1,
+                const BIGNUM *iqmp, BN_CTX *ctx);
+typedef int cl_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa);
+typedef int cl_rsa_pub_enc(int flen, const unsigned char *from,
+             unsigned char *to, RSA *rsa, int padding);
+typedef int cl_rsa_pub_dec(int flen, const unsigned char *from,
+             unsigned char *to, RSA *rsa, int padding);
+typedef int cl_rsa_priv_enc(int flen, const unsigned char *from, 
+                unsigned char *to, RSA *rsa, int padding);
+typedef int cl_rsa_priv_dec(int flen, const unsigned char *from, 
+                unsigned char *to, RSA *rsa, int padding);              
+typedef int cl_rand_bytes(unsigned char *buf, int num);
+typedef DSA_SIG *cl_dsa_sign(const unsigned char *dgst, int dlen, DSA *dsa);
+typedef int cl_dsa_verify(const unsigned char *dgst, int dgst_len,
+                                DSA_SIG *sig, DSA *dsa);
+
+
+static const char *CLUSTER_LABS_LIB_NAME = "cluster_labs";
+static const char *CLUSTER_LABS_F1       = "hw_engine_init";
+static const char *CLUSTER_LABS_F2       = "hw_mod_exp";
+static const char *CLUSTER_LABS_F3       = "hw_mod_exp_crt";
+static const char *CLUSTER_LABS_F4       = "hw_rsa_mod_exp";
+static const char *CLUSTER_LABS_F5       = "hw_rsa_priv_enc";
+static const char *CLUSTER_LABS_F6       = "hw_rsa_priv_dec";
+static const char *CLUSTER_LABS_F7       = "hw_rsa_pub_enc";
+static const char *CLUSTER_LABS_F8       = "hw_rsa_pub_dec";
+static const char *CLUSTER_LABS_F20      = "hw_rand_bytes";
+static const char *CLUSTER_LABS_F30      = "hw_dsa_sign";
+static const char *CLUSTER_LABS_F31      = "hw_dsa_verify";
+
+
diff --git a/src/lib/libssl/src/demos/engines/cluster_labs/hw_cluster_labs.c b/src/lib/libssl/src/demos/engines/cluster_labs/hw_cluster_labs.c
new file mode 100644
index 0000000000..00c14f2755
--- /dev/null
+++ b/src/lib/libssl/src/demos/engines/cluster_labs/hw_cluster_labs.c
@@ -0,0 +1,718 @@
+/* crypto/engine/hw_cluster_labs.c */
+/* Written by Jan Tschirschwitz (jan.tschirschwitz@cluster-labs.com
+ * for the OpenSSL project 2000.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#define MSC_VER   /* only used cryptic.h */
+
+#include <stdio.h>
+#include <openssl/crypto.h>
+#include <openssl/dso.h>
+#include <openssl/des.h>
+#include <openssl/engine.h>
+
+#ifndef NO_HW
+#ifndef NO_HW_CLUSTER_LABS
+
+#ifdef FLAT_INC
+#include "cluster_labs.h"
+#else
+#include "vendor_defns/cluster_labs.h"
+#endif
+
+#define CL_LIB_NAME "cluster_labs engine"
+#include "hw_cluster_labs_err.c"
+
+
+static int cluster_labs_destroy(ENGINE *e);
+static int cluster_labs_init(ENGINE *e);
+static int cluster_labs_finish(ENGINE *e);
+static int cluster_labs_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)());
+
+
+/* BIGNUM stuff */
+/* This function is aliased to mod_exp (with the mont stuff dropped). */
+static int cluster_labs_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
+                
+/* RSA stuff */
+#ifndef OPENSSL_NO_RSA
+static int cluster_labs_rsa_pub_enc(int flen, const unsigned char *from,
+             unsigned char *to, RSA *rsa, int padding);
+static int cluster_labs_rsa_pub_dec(int flen, const unsigned char *from,
+             unsigned char *to, RSA *rsa, int padding);
+static int cluster_labs_rsa_priv_enc(int flen, const unsigned char *from, 
+                unsigned char *to, RSA *rsa, int padding);
+static int cluster_labs_rsa_priv_dec(int flen, const unsigned char *from, 
+                unsigned char *to, RSA *rsa, int padding);
+static int cluster_labs_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa);
+#endif
+
+/* DSA stuff */
+#ifndef OPENSSL_NO_DSA
+DSA_SIG *cluster_labs_dsa_sign(const unsigned char *dgst, int dlen, DSA *dsa);
+static int cluster_labs_dsa_verify(const unsigned char *dgst, int dgst_len,
+                                DSA_SIG *sig, DSA *dsa);
+static int cluster_labs_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,
+                BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
+                BN_CTX *ctx, BN_MONT_CTX *in_mont);
+static int cluster_labs_mod_exp_dsa(DSA *dsa, BIGNUM *r, BIGNUM *a,
+                const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
+                BN_MONT_CTX *m_ctx);
+#endif
+                                                                
+/* DH stuff */
+#ifndef OPENSSL_NO_DH
+/* This function is alised to mod_exp (with the DH and mont dropped). */
+static int cluster_labs_mod_exp_dh(const DH *dh, BIGNUM *r, const BIGNUM *a, const BIGNUM *p, 
+                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
+#endif
+                
+/* RANDOM stuff */                                              
+static int cluster_labs_rand_bytes(unsigned char *buf, int num);
+
+/* The definitions for control commands specific to this engine */
+#define CLUSTER_LABS_CMD_SO_PATH                ENGINE_CMD_BASE
+static const ENGINE_CMD_DEFN cluster_labs_cmd_defns[] =
+        {
+        { CLUSTER_LABS_CMD_SO_PATH,
+          "SO_PATH",
+          "Specifies the path to the 'cluster labs' shared library",
+          ENGINE_CMD_FLAG_STRING
+        },
+        {0, NULL, NULL, 0}
+        };
+
+/* Our internal RSA_METHOD that we provide pointers to */
+#ifndef OPENSSL_NO_RSA
+static RSA_METHOD cluster_labs_rsa =
+        {
+        "Cluster Labs RSA method",
+        cluster_labs_rsa_pub_enc,       /* rsa_pub_enc */
+        cluster_labs_rsa_pub_dec,       /* rsa_pub_dec */
+        cluster_labs_rsa_priv_enc,      /* rsa_priv_enc */
+        cluster_labs_rsa_priv_dec,      /* rsa_priv_dec */
+        cluster_labs_rsa_mod_exp,       /* rsa_mod_exp */
+        cluster_labs_mod_exp_mont,      /* bn_mod_exp */
+        NULL,                           /* init */
+        NULL,                           /* finish */
+        0,                              /* flags */
+        NULL,                           /* apps_data */
+        NULL,                           /* rsa_sign */
+        NULL                            /* rsa_verify */
+        };
+#endif
+
+/* Our internal DSA_METHOD that we provide pointers to */
+#ifndef OPENSSL_NO_DSA
+static DSA_METHOD cluster_labs_dsa =
+        {
+        "Cluster Labs DSA method",
+        cluster_labs_dsa_sign,          /* dsa_do_sign */
+        NULL,                           /* dsa_sign_setup */
+        cluster_labs_dsa_verify,        /* dsa_do_verify */
+        cluster_labs_dsa_mod_exp,       /* dsa_mod_exp */
+        cluster_labs_mod_exp_dsa,       /* bn_mod_exp */
+        NULL,                           /* init */
+        NULL,                           /* finish */
+        0,                              /* flags */
+        NULL                            /* app_data */
+        };
+#endif  
+
+/* Our internal DH_METHOD that we provide pointers to */
+#ifndef OPENSSL_NO_DH
+static DH_METHOD cluster_labs_dh =
+        {
+        "Cluster Labs DH method",
+        NULL,                           /* generate key */
+        NULL,                           /* compute key */
+        cluster_labs_mod_exp_dh,        /* bn_mod_exp */
+        NULL,                           /* init */
+        NULL,                           /* finish */
+        0,                              /* flags */
+        NULL                            /* app_data */
+        };
+#endif  
+        
+static RAND_METHOD cluster_labs_rand =
+        {
+        /* "Cluster Labs RAND method", */
+        NULL,                           /* seed */
+        cluster_labs_rand_bytes,        /* bytes */
+        NULL,                           /* cleanup */
+        NULL,                           /* add */
+        cluster_labs_rand_bytes,        /* pseudorand */
+        NULL,                           /* status */
+        };      
+
+static const char *engine_cluster_labs_id = "cluster_labs";
+static const char *engine_cluster_labs_name = "Cluster Labs hardware engine support";
+
+/* engine implementation */
+/*-----------------------*/
+static int bind_helper(ENGINE *e)
+        {
+        
+        if(!ENGINE_set_id(e, engine_cluster_labs_id) ||
+                        !ENGINE_set_name(e, engine_cluster_labs_name) ||
+#ifndef OPENSSL_NO_RSA
+                        !ENGINE_set_RSA(e, &cluster_labs_rsa) ||
+#endif
+#ifndef OPENSSL_NO_DSA
+                        !ENGINE_set_DSA(e, &cluster_labs_dsa) ||
+#endif
+#ifndef OPENSSL_NO_DH
+                        !ENGINE_set_DH(e, &cluster_labs_dh) ||
+#endif
+                        !ENGINE_set_RAND(e, &cluster_labs_rand) ||
+                        !ENGINE_set_destroy_function(e, cluster_labs_destroy) ||
+                        !ENGINE_set_init_function(e, cluster_labs_init) ||
+                        !ENGINE_set_finish_function(e, cluster_labs_finish) ||
+                        !ENGINE_set_ctrl_function(e, cluster_labs_ctrl) ||
+                        !ENGINE_set_cmd_defns(e, cluster_labs_cmd_defns))
+                return 0;
+        /* Ensure the error handling is set up */
+        ERR_load_CL_strings();
+        return 1;
+        }
+        
+#ifndef ENGINE_DYNAMIC_SUPPORT
+static ENGINE *engine_cluster_labs(void)
+        {
+        ENGINE *ret = ENGINE_new();
+
+        if(!ret)
+                return NULL;
+        if(!bind_helper(ret))
+                {
+                ENGINE_free(ret);
+                return NULL;
+                }
+        return ret;
+        }
+
+void ENGINE_load_cluster_labs(void)
+        {
+
+        ENGINE *cluster_labs = engine_cluster_labs();
+        
+        if(!cluster_labs) return;
+        ENGINE_add(cluster_labs);
+        ENGINE_free(cluster_labs);
+        ERR_clear_error();
+        }
+#endif /* !ENGINE_DYNAMIC_SUPPORT */
+
+static int cluster_labs_destroy(ENGINE *e)
+        {
+        
+        ERR_unload_CL_strings();
+        return 1;
+        }
+
+
+
+/* This is a process-global DSO handle used for loading and unloading
+ * the Cluster Labs library. NB: This is only set (or unset) during an
+ * init() or finish() call (reference counts permitting) and they're
+ * operating with global locks, so this should be thread-safe
+ * implicitly. */
+static DSO *cluster_labs_dso = NULL;
+
+/* These are the function pointers that are (un)set when the library has
+ * successfully (un)loaded. */
+static cl_engine_init           *p_cl_engine_init                = NULL;
+static cl_mod_exp               *p_cl_mod_exp                    = NULL;
+static cl_mod_exp_crt           *p_cl_mod_exp_crt                = NULL;
+static cl_rsa_mod_exp           *p_cl_rsa_mod_exp                = NULL;
+static cl_rsa_priv_enc          *p_cl_rsa_priv_enc               = NULL;
+static cl_rsa_priv_dec          *p_cl_rsa_priv_dec               = NULL;
+static cl_rsa_pub_enc           *p_cl_rsa_pub_enc                = NULL;
+static cl_rsa_pub_dec           *p_cl_rsa_pub_dec                = NULL;
+static cl_rand_bytes            *p_cl_rand_bytes                 = NULL;
+static cl_dsa_sign              *p_cl_dsa_sign                   = NULL;
+static cl_dsa_verify            *p_cl_dsa_verify                 = NULL;
+
+
+int cluster_labs_init(ENGINE *e)
+        {
+
+        cl_engine_init                  *p1;
+        cl_mod_exp                      *p2;
+        cl_mod_exp_crt                  *p3;
+        cl_rsa_mod_exp                  *p4;
+        cl_rsa_priv_enc                 *p5;
+        cl_rsa_priv_dec                 *p6;    
+        cl_rsa_pub_enc                  *p7;
+        cl_rsa_pub_dec                  *p8;
+        cl_rand_bytes                   *p20;
+        cl_dsa_sign                     *p30;   
+        cl_dsa_verify                   *p31;           
+        
+        /* engine already loaded */
+        if(cluster_labs_dso != NULL)
+                {
+                CLerr(CL_F_CLUSTER_LABS_INIT,CL_R_ALREADY_LOADED);
+                goto err;
+                }
+        /* try to load engine    */     
+        cluster_labs_dso = DSO_load(NULL, CLUSTER_LABS_LIB_NAME, NULL,0);
+        if(cluster_labs_dso == NULL)
+                {
+                CLerr(CL_F_CLUSTER_LABS_INIT,CL_R_DSO_FAILURE);
+                goto err;
+                }
+        /* bind functions */
+        if(     !(p1 = (cl_engine_init *)DSO_bind_func(
+                                cluster_labs_dso, CLUSTER_LABS_F1)) ||
+                !(p2 = (cl_mod_exp *)DSO_bind_func(
+                                cluster_labs_dso, CLUSTER_LABS_F2)) ||                  
+                !(p3 = (cl_mod_exp_crt *)DSO_bind_func(
+                                cluster_labs_dso, CLUSTER_LABS_F3)) ||                          
+                !(p4 = (cl_rsa_mod_exp *)DSO_bind_func(
+                                cluster_labs_dso, CLUSTER_LABS_F4)) ||                          
+                !(p5 = (cl_rsa_priv_enc *)DSO_bind_func(
+                                cluster_labs_dso, CLUSTER_LABS_F5)) ||
+                !(p6 = (cl_rsa_priv_dec *)DSO_bind_func(
+                                cluster_labs_dso, CLUSTER_LABS_F6)) ||
+                !(p7 = (cl_rsa_pub_enc *)DSO_bind_func(
+                                cluster_labs_dso, CLUSTER_LABS_F7)) ||
+                !(p8 = (cl_rsa_pub_dec *)DSO_bind_func(
+                                cluster_labs_dso, CLUSTER_LABS_F8)) ||
+                !(p20= (cl_rand_bytes *)DSO_bind_func(
+                                cluster_labs_dso, CLUSTER_LABS_F20)) ||
+                !(p30= (cl_dsa_sign *)DSO_bind_func(
+                                cluster_labs_dso, CLUSTER_LABS_F30)) ||
+                !(p31= (cl_dsa_verify *)DSO_bind_func(
+                                cluster_labs_dso, CLUSTER_LABS_F31)))
+                {
+                CLerr(CL_F_CLUSTER_LABS_INIT,CL_R_DSO_FAILURE);
+                goto err;
+                }
+                
+        /* copy function pointers */
+        p_cl_engine_init                = p1;
+        p_cl_mod_exp                    = p2;
+        p_cl_mod_exp_crt                = p3;   
+        p_cl_rsa_mod_exp                = p4;
+        p_cl_rsa_priv_enc               = p5;
+        p_cl_rsa_priv_dec               = p6;
+        p_cl_rsa_pub_enc                = p7;
+        p_cl_rsa_pub_dec                = p8;
+        p_cl_rand_bytes                 = p20;  
+        p_cl_dsa_sign                   = p30;
+        p_cl_dsa_verify                 = p31;  
+        
+        
+        
+        /* cluster labs engine init */
+        if(p_cl_engine_init()== 0){
+                CLerr(CL_F_CLUSTER_LABS_INIT,CL_R_INIT_FAILED);         
+                goto err;
+        }
+
+        return(1);
+
+err:    
+        /* reset all pointers */
+        if(cluster_labs_dso)
+                DSO_free(cluster_labs_dso);
+
+        cluster_labs_dso                = NULL;
+        p_cl_engine_init                = NULL; 
+        p_cl_mod_exp                    = NULL;
+        p_cl_mod_exp_crt                = NULL;
+        p_cl_rsa_mod_exp                = NULL;
+        p_cl_rsa_priv_enc               = NULL;
+        p_cl_rsa_priv_dec               = NULL; 
+        p_cl_rsa_pub_enc                = NULL;
+        p_cl_rsa_pub_dec                = NULL; 
+        p_cl_rand_bytes                 = NULL; 
+        p_cl_dsa_sign                   = NULL;
+        p_cl_dsa_verify                 = NULL; 
+        
+        return(0);
+        }
+        
+
+static int cluster_labs_finish(ENGINE *e)
+        {
+
+        if(cluster_labs_dso == NULL)
+                {
+                CLerr(CL_F_CLUSTER_LABS_FINISH,CL_R_NOT_LOADED);
+                return 0;
+                }
+        if(!DSO_free(cluster_labs_dso))
+                {
+                CLerr(CL_F_CLUSTER_LABS_FINISH,CL_R_DSO_FAILURE);
+                return 0;
+                }
+                
+        cluster_labs_dso                = NULL;
+        p_cl_engine_init                = NULL;         
+        p_cl_mod_exp                    = NULL;
+        p_cl_rsa_mod_exp                = NULL; 
+        p_cl_mod_exp_crt                = NULL; 
+        p_cl_rsa_priv_enc               = NULL; 
+        p_cl_rsa_priv_dec               = NULL; 
+        p_cl_rsa_pub_enc                = NULL;
+        p_cl_rsa_pub_dec                = NULL; 
+        p_cl_rand_bytes                 = NULL;         
+        p_cl_dsa_sign                   = NULL;
+        p_cl_dsa_verify                 = NULL; 
+        
+        return(1);      
+        
+        }
+        
+static int cluster_labs_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)())
+        {
+        int initialised = ((cluster_labs_dso == NULL) ? 0 : 1);
+
+        switch(cmd)
+                {
+        case CLUSTER_LABS_CMD_SO_PATH:
+                if(p == NULL)
+                        {
+                        CLerr(CL_F_CLUSTER_LABS_CTRL,ERR_R_PASSED_NULL_PARAMETER);
+                        return 0;
+                        }
+                if(initialised)
+                        {
+                        CLerr(CL_F_CLUSTER_LABS_CTRL,CL_R_ALREADY_LOADED);
+                        return 0;
+                        }
+                CLUSTER_LABS_LIB_NAME = (const char *)p;
+                return 1;
+        default:
+                break;
+                }
+        CLerr(CL_F_CLUSTER_LABS_CTRL,CL_R_COMMAND_NOT_IMPLEMENTED);
+        return 0;
+        }
+        
+
+static int cluster_labs_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                const BIGNUM *m, BN_CTX *ctx)
+        {
+
+        if(cluster_labs_dso == NULL)
+                {
+                CLerr(CL_F_CLUSTER_LABS_MOD_EXP,CL_R_NOT_LOADED);
+                return 0;
+                }       
+        if(p_cl_mod_exp == NULL)
+                {
+                CLerr(CL_F_CLUSTER_LABS_MOD_EXP,CL_R_FUNCTION_NOT_BINDED);
+                return 0;
+                }
+
+        return  p_cl_mod_exp(r, a, p, m, ctx);
+
+        }
+        
+static int cluster_labs_mod_exp_crt(BIGNUM *r, BIGNUM *a, const BIGNUM *p,
+                const BIGNUM *q, const BIGNUM *dmp1, const BIGNUM *dmq1,
+                const BIGNUM *iqmp, BN_CTX *ctx)
+        {
+
+        if(cluster_labs_dso == NULL)
+                {
+                CLerr(CL_F_CLUSTER_LABS_MOD_EXP_CRT,CL_R_NOT_LOADED);           
+                return 0;
+                }
+        if(p_cl_mod_exp_crt == NULL)
+                {
+                CLerr(CL_F_CLUSTER_LABS_MOD_EXP_CRT,CL_R_FUNCTION_NOT_BINDED);          
+                return 0;
+                }
+        
+        return  p_cl_mod_exp_crt(r, a, p, q,dmp1, dmq1, iqmp, ctx);
+        
+        }
+        
+static int cluster_labs_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
+        {
+
+        if(cluster_labs_dso == NULL)
+                {
+                CLerr(CL_F_CLUSTER_LABS_RSA_MOD_EXP,CL_R_NOT_LOADED);           
+                return 0;
+                }
+        if(p_cl_rsa_mod_exp == NULL)
+                {
+                CLerr(CL_F_CLUSTER_LABS_RSA_MOD_EXP,CL_R_FUNCTION_NOT_BINDED);                          
+                return 0;
+                }
+
+        return p_cl_rsa_mod_exp(r0, I, rsa);
+
+        }
+        
+DSA_SIG *cluster_labs_dsa_sign(const unsigned char *dgst, int dlen, DSA *dsa)
+        {
+
+        if(cluster_labs_dso == NULL)
+                {
+                CLerr(CL_F_CLUSTER_LABS_DSA_SIGN,CL_R_NOT_LOADED);              
+                return 0;
+                }
+        if(p_cl_dsa_sign == NULL)
+                {
+                CLerr(CL_F_CLUSTER_LABS_DSA_SIGN,CL_R_FUNCTION_NOT_BINDED);                             
+                return 0;
+                }
+
+        return p_cl_dsa_sign(dgst, dlen, dsa);
+        
+        }
+        
+static int cluster_labs_dsa_verify(const unsigned char *dgst, int dgst_len,
+                                DSA_SIG *sig, DSA *dsa)
+        {
+
+        if(cluster_labs_dso == NULL)
+                {
+                CLerr(CL_F_CLUSTER_LABS_DSA_VERIFY,CL_R_NOT_LOADED);            
+                return 0;
+                }
+        
+        if(p_cl_dsa_verify == NULL)
+                {
+                CLerr(CL_F_CLUSTER_LABS_DSA_VERIFY,CL_R_FUNCTION_NOT_BINDED);                           
+                return 0;
+                }
+
+        return p_cl_dsa_verify(dgst, dgst_len, sig, dsa);
+        
+        }                       
+
+static int cluster_labs_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,
+                BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
+                BN_CTX *ctx, BN_MONT_CTX *in_mont)
+        {
+        BIGNUM t;
+        int status = 0;
+                
+        BN_init(&t);
+        /* let rr = a1 ^ p1 mod m */
+        if (!cluster_labs_mod_exp(rr,a1,p1,m,ctx)) goto end;
+        /* let t = a2 ^ p2 mod m */
+        if (!cluster_labs_mod_exp(&t,a2,p2,m,ctx)) goto end;
+        /* let rr = rr * t mod m */
+        if (!BN_mod_mul(rr,rr,&t,m,ctx)) goto end;
+        status = 1;
+end:
+        BN_free(&t);
+        
+        return(1);
+
+        }
+
+static int cluster_labs_mod_exp_dsa(DSA *dsa, BIGNUM *r, BIGNUM *a,
+                const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
+                BN_MONT_CTX *m_ctx)
+        {
+        return  cluster_labs_mod_exp(r, a, p, m, ctx);
+        }
+        
+/* This function is aliased to mod_exp (with the mont stuff dropped). */
+static int cluster_labs_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
+        {
+        return  cluster_labs_mod_exp(r, a, p, m, ctx);
+        }
+        
+
+/* This function is aliased to mod_exp (with the dh and mont dropped). */
+static int cluster_labs_mod_exp_dh(const DH *dh, BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
+        {
+        return  cluster_labs_mod_exp(r, a, p, m, ctx);
+        }
+
+
+static int cluster_labs_rsa_pub_enc(int flen, const unsigned char *from,
+             unsigned char *to, RSA *rsa, int padding)
+        {
+
+        if(cluster_labs_dso == NULL)
+                {
+                CLerr(CL_F_CLUSTER_LABS_RSA_PUB_ENC,CL_R_NOT_LOADED);           
+                return 0;
+                }
+        if(p_cl_rsa_priv_enc == NULL)
+                {
+                CLerr(CL_F_CLUSTER_LABS_RSA_PUB_ENC,CL_R_FUNCTION_NOT_BINDED);                          
+                return 0;
+                }
+                
+        return  p_cl_rsa_pub_enc(flen, from, to, rsa, padding);
+        
+        }  
+             
+static int cluster_labs_rsa_pub_dec(int flen, const unsigned char *from,
+             unsigned char *to, RSA *rsa, int padding)
+        {
+
+        if(cluster_labs_dso == NULL)
+                {
+                CLerr(CL_F_CLUSTER_LABS_RSA_PUB_DEC,CL_R_NOT_LOADED);           
+                return 0;
+                }
+        if(p_cl_rsa_priv_enc == NULL)
+                {
+                CLerr(CL_F_CLUSTER_LABS_RSA_PUB_DEC,CL_R_FUNCTION_NOT_BINDED);                          
+                return 0;
+                }
+                
+        return  p_cl_rsa_pub_dec(flen, from, to, rsa, padding);
+        
+        }  
+
+
+static int cluster_labs_rsa_priv_enc(int flen, const unsigned char *from, 
+                unsigned char *to, RSA *rsa, int padding)
+        {
+
+        if(cluster_labs_dso == NULL)
+                {
+                CLerr(CL_F_CLUSTER_LABS_RSA_PRIV_ENC,CL_R_NOT_LOADED);          
+                return 0;
+                }
+
+        if(p_cl_rsa_priv_enc == NULL)
+                {
+                CLerr(CL_F_CLUSTER_LABS_RSA_PRIV_ENC,CL_R_FUNCTION_NOT_BINDED);                         
+                return 0;
+                }
+                
+        return  p_cl_rsa_priv_enc(flen, from, to, rsa, padding);
+        
+        }  
+
+static int cluster_labs_rsa_priv_dec(int flen, const unsigned char *from, 
+                unsigned char *to, RSA *rsa, int padding)
+        {
+        
+        if(cluster_labs_dso == NULL)
+                {
+                CLerr(CL_F_CLUSTER_LABS_RSA_PRIV_DEC,CL_R_NOT_LOADED);          
+                return 0;
+                }
+        if(p_cl_rsa_priv_dec == NULL)
+                {
+                CLerr(CL_F_CLUSTER_LABS_RSA_PRIV_DEC,CL_R_FUNCTION_NOT_BINDED);                         
+                return 0;
+                }
+
+        return  p_cl_rsa_priv_dec(flen, from, to, rsa, padding);
+                
+        }  
+
+/************************************************************************************
+* Symmetric algorithms
+************************************************************************************/
+/* this will be come soon! */
+
+/************************************************************************************
+* Random generator
+************************************************************************************/
+
+static int cluster_labs_rand_bytes(unsigned char *buf, int num){
+
+        if(cluster_labs_dso == NULL)
+                {
+                CLerr(CL_F_CLUSTER_LABS_RAND_BYTES,CL_R_NOT_LOADED);            
+                return 0;
+                }
+        if(p_cl_mod_exp_crt == NULL)
+                {
+                CLerr(CL_F_CLUSTER_LABS_RAND_BYTES,CL_R_FUNCTION_NOT_BINDED);                           
+                return 0;
+                }
+
+        return  p_cl_rand_bytes(buf, num);
+
+}
+
+
+/* This stuff is needed if this ENGINE is being compiled into a self-contained
+ * shared-library. */
+#ifdef ENGINE_DYNAMIC_SUPPORT
+static int bind_fn(ENGINE *e, const char *id)
+        {
+        fprintf(stderr, "bind_fn CLUSTER_LABS\n");
+        if(id && (strcmp(id, engine_cluster_labs_id) != 0)) {
+                fprintf(stderr, "bind_fn return(0) first\n");
+                return 0;
+                }
+        if(!bind_helper(e)) {
+                fprintf(stderr, "bind_fn return(1) first\n");
+                return 0;
+                }
+        fprintf(stderr, "bind_fn return(1)\n");         
+        return 1;
+        }
+IMPLEMENT_DYNAMIC_CHECK_FN()
+IMPLEMENT_DYNAMIC_BIND_FN(bind_fn)
+#endif /* ENGINE_DYNAMIC_SUPPORT */
+                                                
+#endif /* !NO_HW_CLUSTER_LABS */
+#endif /* !NO_HW */
+
diff --git a/src/lib/libssl/src/demos/engines/cluster_labs/hw_cluster_labs.ec b/src/lib/libssl/src/demos/engines/cluster_labs/hw_cluster_labs.ec
new file mode 100644
index 0000000000..1f64786542
--- /dev/null
+++ b/src/lib/libssl/src/demos/engines/cluster_labs/hw_cluster_labs.ec
@@ -0,0 +1,8 @@
+# configuration file for util/mkerr.pl
+#
+# use like this:
+#
+#       perl ../../../util/mkerr.pl -conf hw_cluster_labs.ec \
+#               -nostatic -staticloader -write *.c
+
+L CL            hw_cluster_labs_err.h           hw_cluster_labs_err.c
diff --git a/src/lib/libssl/src/demos/engines/cluster_labs/hw_cluster_labs_err.c b/src/lib/libssl/src/demos/engines/cluster_labs/hw_cluster_labs_err.c
new file mode 100644
index 0000000000..a7fa4083b1
--- /dev/null
+++ b/src/lib/libssl/src/demos/engines/cluster_labs/hw_cluster_labs_err.c
@@ -0,0 +1,151 @@
+/* hw_cluster_labs_err.c */
+/* ====================================================================
+ * Copyright (c) 1999-2002 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* NOTE: this file was auto generated by the mkerr.pl script: any changes
+ * made to it will be overwritten when the script next updates this file,
+ * only reason strings will be preserved.
+ */
+
+#include <stdio.h>
+#include <openssl/err.h>
+#include "hw_cluster_labs_err.h"
+
+/* BEGIN ERROR CODES */
+#ifndef OPENSSL_NO_ERR
+static ERR_STRING_DATA CL_str_functs[]=
+        {
+{ERR_PACK(0,CL_F_CLUSTER_LABS_CTRL,0),  "CLUSTER_LABS_CTRL"},
+{ERR_PACK(0,CL_F_CLUSTER_LABS_DSA_SIGN,0),      "CLUSTER_LABS_DSA_SIGN"},
+{ERR_PACK(0,CL_F_CLUSTER_LABS_DSA_VERIFY,0),    "CLUSTER_LABS_DSA_VERIFY"},
+{ERR_PACK(0,CL_F_CLUSTER_LABS_FINISH,0),        "CLUSTER_LABS_FINISH"},
+{ERR_PACK(0,CL_F_CLUSTER_LABS_INIT,0),  "CLUSTER_LABS_INIT"},
+{ERR_PACK(0,CL_F_CLUSTER_LABS_MOD_EXP,0),       "CLUSTER_LABS_MOD_EXP"},
+{ERR_PACK(0,CL_F_CLUSTER_LABS_MOD_EXP_CRT,0),   "CLUSTER_LABS_MOD_EXP_CRT"},
+{ERR_PACK(0,CL_F_CLUSTER_LABS_RAND_BYTES,0),    "CLUSTER_LABS_RAND_BYTES"},
+{ERR_PACK(0,CL_F_CLUSTER_LABS_RSA_MOD_EXP,0),   "CLUSTER_LABS_RSA_MOD_EXP"},
+{ERR_PACK(0,CL_F_CLUSTER_LABS_RSA_PRIV_DEC,0),  "CLUSTER_LABS_RSA_PRIV_DEC"},
+{ERR_PACK(0,CL_F_CLUSTER_LABS_RSA_PRIV_ENC,0),  "CLUSTER_LABS_RSA_PRIV_ENC"},
+{ERR_PACK(0,CL_F_CLUSTER_LABS_RSA_PUB_DEC,0),   "CLUSTER_LABS_RSA_PUB_DEC"},
+{ERR_PACK(0,CL_F_CLUSTER_LABS_RSA_PUB_ENC,0),   "CLUSTER_LABS_RSA_PUB_ENC"},
+{0,NULL}
+        };
+
+static ERR_STRING_DATA CL_str_reasons[]=
+        {
+{CL_R_ALREADY_LOADED                     ,"already loaded"},
+{CL_R_COMMAND_NOT_IMPLEMENTED            ,"command not implemented"},
+{CL_R_DSO_FAILURE                        ,"dso failure"},
+{CL_R_FUNCTION_NOT_BINDED                ,"function not binded"},
+{CL_R_INIT_FAILED                        ,"init failed"},
+{CL_R_NOT_LOADED                         ,"not loaded"},
+{0,NULL}
+        };
+
+#endif
+
+#ifdef CL_LIB_NAME
+static ERR_STRING_DATA CL_lib_name[]=
+        {
+{0      ,CL_LIB_NAME},
+{0,NULL}
+        };
+#endif
+
+
+static int CL_lib_error_code=0;
+static int CL_error_init=1;
+
+static void ERR_load_CL_strings(void)
+        {
+        if (CL_lib_error_code == 0)
+                CL_lib_error_code=ERR_get_next_error_library();
+
+        if (CL_error_init)
+                {
+                CL_error_init=0;
+#ifndef OPENSSL_NO_ERR
+                ERR_load_strings(CL_lib_error_code,CL_str_functs);
+                ERR_load_strings(CL_lib_error_code,CL_str_reasons);
+#endif
+
+#ifdef CL_LIB_NAME
+                CL_lib_name->error = ERR_PACK(CL_lib_error_code,0,0);
+                ERR_load_strings(0,CL_lib_name);
+#endif
+                }
+        }
+
+static void ERR_unload_CL_strings(void)
+        {
+        if (CL_error_init == 0)
+                {
+#ifndef OPENSSL_NO_ERR
+                ERR_unload_strings(CL_lib_error_code,CL_str_functs);
+                ERR_unload_strings(CL_lib_error_code,CL_str_reasons);
+#endif
+
+#ifdef CL_LIB_NAME
+                ERR_unload_strings(0,CL_lib_name);
+#endif
+                CL_error_init=1;
+                }
+        }
+
+static void ERR_CL_error(int function, int reason, char *file, int line)
+        {
+        if (CL_lib_error_code == 0)
+                CL_lib_error_code=ERR_get_next_error_library();
+        ERR_PUT_error(CL_lib_error_code,function,reason,file,line);
+        }
diff --git a/src/lib/libssl/src/demos/engines/cluster_labs/hw_cluster_labs_err.h b/src/lib/libssl/src/demos/engines/cluster_labs/hw_cluster_labs_err.h
new file mode 100644
index 0000000000..afc175b133
--- /dev/null
+++ b/src/lib/libssl/src/demos/engines/cluster_labs/hw_cluster_labs_err.h
@@ -0,0 +1,95 @@
+/* ====================================================================
+ * Copyright (c) 2001-2002 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#ifndef HEADER_CL_ERR_H
+#define HEADER_CL_ERR_H
+
+/* BEGIN ERROR CODES */
+/* The following lines are auto generated by the script mkerr.pl. Any changes
+ * made after this point may be overwritten when the script is next run.
+ */
+static void ERR_load_CL_strings(void);
+static void ERR_unload_CL_strings(void);
+static void ERR_CL_error(int function, int reason, char *file, int line);
+#define CLerr(f,r) ERR_CL_error((f),(r),__FILE__,__LINE__)
+
+/* Error codes for the CL functions. */
+
+/* Function codes. */
+#define CL_F_CLUSTER_LABS_CTRL                           100
+#define CL_F_CLUSTER_LABS_DSA_SIGN                       101
+#define CL_F_CLUSTER_LABS_DSA_VERIFY                     102
+#define CL_F_CLUSTER_LABS_FINISH                         103
+#define CL_F_CLUSTER_LABS_INIT                           104
+#define CL_F_CLUSTER_LABS_MOD_EXP                        105
+#define CL_F_CLUSTER_LABS_MOD_EXP_CRT                    106
+#define CL_F_CLUSTER_LABS_RAND_BYTES                     107
+#define CL_F_CLUSTER_LABS_RSA_MOD_EXP                    108
+#define CL_F_CLUSTER_LABS_RSA_PRIV_DEC                   109
+#define CL_F_CLUSTER_LABS_RSA_PRIV_ENC                   110
+#define CL_F_CLUSTER_LABS_RSA_PUB_DEC                    111
+#define CL_F_CLUSTER_LABS_RSA_PUB_ENC                    112
+
+/* Reason codes. */
+#define CL_R_ALREADY_LOADED                              100
+#define CL_R_COMMAND_NOT_IMPLEMENTED                     101
+#define CL_R_DSO_FAILURE                                 102
+#define CL_R_FUNCTION_NOT_BINDED                         103
+#define CL_R_INIT_FAILED                                 104
+#define CL_R_NOT_LOADED                                  105
+
+#ifdef  __cplusplus
+}
+#endif
+#endif
diff --git a/src/lib/libssl/src/demos/engines/ibmca/Makefile b/src/lib/libssl/src/demos/engines/ibmca/Makefile
new file mode 100644
index 0000000000..72f3546359
--- /dev/null
+++ b/src/lib/libssl/src/demos/engines/ibmca/Makefile
@@ -0,0 +1,114 @@
+LIBNAME=        libibmca
+SRC=            hw_ibmca.c
+OBJ=            hw_ibmca.o
+HEADER=         hw_ibmca.h
+
+CC=             gcc
+PIC=            -fPIC
+CFLAGS=         -g -I../../../include $(PIC) -DENGINE_DYNAMIC_SUPPORT -DFLAT_INC
+AR=             ar r
+RANLIB=         ranlib
+
+LIB=            $(LIBNAME).a
+SHLIB=          $(LIBNAME).so
+
+all:
+                @echo 'Please choose a system to build on:'
+                @echo ''
+                @echo 'tru64:    Tru64 Unix, Digital Unix, Digital OSF/1'
+                @echo 'solaris:  Solaris'
+                @echo 'irix:     IRIX'
+                @echo 'hpux32:   32-bit HP/UX'
+                @echo 'hpux64:   64-bit HP/UX'
+                @echo 'aix:      AIX'
+                @echo 'gnu:      Generic GNU-based system (gcc and GNU ld)'
+                @echo ''
+
+FORCE.update:
+update:         FORCE.update
+                perl ../../../util/mkerr.pl -conf hw_ibmca.ec \
+                        -nostatic -staticloader -write hw_ibmca.c
+
+gnu:            $(SHLIB).gnu
+tru64:          $(SHLIB).tru64
+solaris:        $(SHLIB).solaris
+irix:           $(SHLIB).irix
+hpux32:         $(SHLIB).hpux32
+hpux64:         $(SHLIB).hpux64
+aix:            $(SHLIB).aix
+
+$(LIB):         $(OBJ)
+                $(AR) $(LIB) $(OBJ)
+                - $(RANLIB) $(LIB)
+
+LINK_SO=        \
+  ld -r -o $(LIBNAME).o $$ALLSYMSFLAGS $(LIB) && \
+  (nm -Pg $(LIBNAME).o | grep ' [BDT] ' | cut -f1 -d' ' > $(LIBNAME).exp; \
+   $$SHAREDCMD $$SHAREDFLAGS -o $(SHLIB) $(LIBNAME).o -L ../../.. -lcrypto -lc)
+
+$(SHLIB).gnu:   $(LIB)
+                ALLSYMSFLAGS='--whole-archive' \
+                SHAREDFLAGS='-shared -Wl,-soname=$(SHLIB)' \
+                SHAREDCMD='$(CC)'; \
+                $(LINK_SO)
+                touch $(SHLIB).gnu
+$(SHLIB).tru64: $(LIB)
+                ALLSYMSFLAGS='-all' \
+                SHAREDFLAGS='-shared' \
+                SHAREDCMD='$(CC)'; \
+                $(LINK_SO)
+                touch $(SHLIB).tru64
+$(SHLIB).solaris:       $(LIB)
+                ALLSYMSFLAGS='-z allextract' \
+                SHAREDFLAGS='-G -h $(SHLIB)' \
+                SHAREDCMD='$(CC)'; \
+                $(LINK_SO)
+                touch $(SHLIB).solaris
+$(SHLIB).irix:  $(LIB)
+                ALLSYMSFLAGS='-all' \
+                SHAREDFLAGS='-shared -Wl,-soname,$(SHLIB)' \
+                SHAREDCMD='$(CC)'; \
+                $(LINK_SO)
+                touch $(SHLIB).irix
+$(SHLIB).hpux32:        $(LIB)
+                ALLSYMSFLAGS='-Fl' \
+                SHAREDFLAGS='+vnocompatwarnings -b -z +s +h $(SHLIB)' \
+                SHAREDCMD='/usr/ccs/bin/ld'; \
+                $(LINK_SO)
+                touch $(SHLIB).hpux32
+$(SHLIB).hpux64:        $(LIB)
+                ALLSYMSFLAGS='+forceload' \
+                SHAREDFLAGS='-b -z +h $(SHLIB)' \
+                SHAREDCMD='/usr/ccs/bin/ld'; \
+                $(LINK_SO)
+                touch $(SHLIB).hpux64
+$(SHLIB).aix:   $(LIB)
+                ALLSYMSFLAGS='-bnogc' \
+                SHAREDFLAGS='-G -bE:$(LIBNAME).exp -bM:SRE' \
+                SHAREDCMD='$(CC)'; \
+                $(LINK_SO)
+                touch $(SHLIB).aix
+
+depend:
+                sed -e '/^# DO NOT DELETE.*/,$$d' < Makefile > Makefile.tmp
+                echo '# DO NOT DELETE THIS LINE -- make depend depends on it.' >> Makefile.tmp
+                gcc -M $(CFLAGS) $(SRC) >> Makefile.tmp
+                perl ../../../util/clean-depend.pl < Makefile.tmp > Makefile.new
+                rm -f Makefile.tmp Makefile
+                mv Makefile.new Makefile
+
+# DO NOT DELETE THIS LINE -- make depend depends on it.
+
+rsaref.o: ../../../include/openssl/asn1.h ../../../include/openssl/bio.h
+rsaref.o: ../../../include/openssl/bn.h ../../../include/openssl/crypto.h
+rsaref.o: ../../../include/openssl/dh.h ../../../include/openssl/dsa.h
+rsaref.o: ../../../include/openssl/e_os2.h ../../../include/openssl/engine.h
+rsaref.o: ../../../include/openssl/err.h ../../../include/openssl/lhash.h
+rsaref.o: ../../../include/openssl/opensslconf.h
+rsaref.o: ../../../include/openssl/opensslv.h
+rsaref.o: ../../../include/openssl/ossl_typ.h ../../../include/openssl/rand.h
+rsaref.o: ../../../include/openssl/rsa.h ../../../include/openssl/safestack.h
+rsaref.o: ../../../include/openssl/stack.h ../../../include/openssl/symhacks.h
+rsaref.o: ../../../include/openssl/ui.h rsaref.c rsaref_err.c rsaref_err.h
+rsaref.o: source/des.h source/global.h source/md2.h source/md5.h source/rsa.h
+rsaref.o: source/rsaref.h
diff --git a/src/lib/libssl/src/demos/engines/ibmca/hw_ibmca.c b/src/lib/libssl/src/demos/engines/ibmca/hw_ibmca.c
new file mode 100644
index 0000000000..881b16a7cb
--- /dev/null
+++ b/src/lib/libssl/src/demos/engines/ibmca/hw_ibmca.c
@@ -0,0 +1,917 @@
+/* crypto/engine/hw_ibmca.c */

+/* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL

+ * project 2000.

+ */

+/* ====================================================================

+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.

+ *

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted provided that the following conditions

+ * are met:

+ *

+ * 1. Redistributions of source code must retain the above copyright

+ *    notice, this list of conditions and the following disclaimer.

+ *

+ * 2. Redistributions in binary form must reproduce the above copyright

+ *    notice, this list of conditions and the following disclaimer in

+ *    the documentation and/or other materials provided with the

+ *    distribution.

+ *

+ * 3. All advertising materials mentioning features or use of this

+ *    software must display the following acknowledgment:

+ *    "This product includes software developed by the OpenSSL Project

+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"

+ *

+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to

+ *    endorse or promote products derived from this software without

+ *    prior written permission. For written permission, please contact

+ *    licensing@OpenSSL.org.

+ *

+ * 5. Products derived from this software may not be called "OpenSSL"

+ *    nor may "OpenSSL" appear in their names without prior written

+ *    permission of the OpenSSL Project.

+ *

+ * 6. Redistributions of any form whatsoever must retain the following

+ *    acknowledgment:

+ *    "This product includes software developed by the OpenSSL Project

+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"

+ *

+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY

+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR

+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

+ * OF THE POSSIBILITY OF SUCH DAMAGE.

+ * ====================================================================

+ *

+ * This product includes cryptographic software written by Eric Young

+ * (eay@cryptsoft.com).  This product includes software written by Tim

+ * Hudson (tjh@cryptsoft.com).

+ *

+ */

+

+/* (C) COPYRIGHT International Business Machines Corp. 2001 */

+

+#include <stdio.h>

+#include <openssl/crypto.h>

+#include <openssl/dso.h>

+#include <openssl/engine.h>

+

+#ifndef OPENSSL_NO_HW

+#ifndef OPENSSL_NO_HW_IBMCA

+

+#ifdef FLAT_INC

+#include "ica_openssl_api.h"

+#else

+#include "vendor_defns/ica_openssl_api.h"

+#endif

+

+#define IBMCA_LIB_NAME "ibmca engine"

+#include "hw_ibmca_err.c"

+

+static int ibmca_destroy(ENGINE *e);

+static int ibmca_init(ENGINE *e);

+static int ibmca_finish(ENGINE *e);

+static int ibmca_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)());

+

+static const char *IBMCA_F1 = "icaOpenAdapter";

+static const char *IBMCA_F2 = "icaCloseAdapter";

+static const char *IBMCA_F3 = "icaRsaModExpo";

+static const char *IBMCA_F4 = "icaRandomNumberGenerate";

+static const char *IBMCA_F5 = "icaRsaCrt";

+

+ICA_ADAPTER_HANDLE handle=0;

+

+/* BIGNUM stuff */

+static int ibmca_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,

+        const BIGNUM *m, BN_CTX *ctx);

+

+static int ibmca_mod_exp_crt(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,

+        const BIGNUM *q, const BIGNUM *dmp1, const BIGNUM *dmq1,

+        const BIGNUM *iqmp, BN_CTX *ctx);

+

+#ifndef OPENSSL_NO_RSA  

+/* RSA stuff */

+static int ibmca_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa);

+#endif

+

+/* This function is aliased to mod_exp (with the mont stuff dropped). */

+static int ibmca_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,

+        const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);

+

+#ifndef OPENSSL_NO_DSA 

+/* DSA stuff */

+static int ibmca_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,

+        BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,

+        BN_CTX *ctx, BN_MONT_CTX *in_mont);

+static int ibmca_mod_exp_dsa(DSA *dsa, BIGNUM *r, BIGNUM *a,

+        const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,

+        BN_MONT_CTX *m_ctx);

+#endif

+

+#ifndef OPENSSL_NO_DH 

+/* DH stuff */

+/* This function is alised to mod_exp (with the DH and mont dropped). */

+static int ibmca_mod_exp_dh(const DH *dh, BIGNUM *r, 

+        const BIGNUM *a, const BIGNUM *p,

+        const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);

+#endif

+

+/* RAND stuff */

+static int ibmca_rand_bytes(unsigned char *buf, int num);

+static int ibmca_rand_status(void);

+

+

+/* WJH - check for more commands, like in nuron */

+

+/* The definitions for control commands specific to this engine */

+#define IBMCA_CMD_SO_PATH               ENGINE_CMD_BASE

+static const ENGINE_CMD_DEFN ibmca_cmd_defns[] = {

+        {IBMCA_CMD_SO_PATH,

+                "SO_PATH",

+                "Specifies the path to the 'atasi' shared library",

+                ENGINE_CMD_FLAG_STRING},

+        {0, NULL, NULL, 0}

+        };

+

+#ifndef OPENSSL_NO_RSA  

+/* Our internal RSA_METHOD that we provide pointers to */

+static RSA_METHOD ibmca_rsa =

+        {

+        "Ibmca RSA method",

+        NULL,

+        NULL,

+        NULL,

+        NULL,

+        ibmca_rsa_mod_exp,

+        ibmca_mod_exp_mont,

+        NULL,

+        NULL,

+        0,

+        NULL,

+        NULL,

+        NULL

+        };

+#endif

+

+#ifndef OPENSSL_NO_DSA

+/* Our internal DSA_METHOD that we provide pointers to */

+static DSA_METHOD ibmca_dsa =

+        {

+        "Ibmca DSA method",

+        NULL, /* dsa_do_sign */

+        NULL, /* dsa_sign_setup */

+        NULL, /* dsa_do_verify */

+        ibmca_dsa_mod_exp, /* dsa_mod_exp */

+        ibmca_mod_exp_dsa, /* bn_mod_exp */

+        NULL, /* init */

+        NULL, /* finish */

+        0, /* flags */

+        NULL /* app_data */

+        };

+#endif

+

+#ifndef OPENSSL_NO_DH

+/* Our internal DH_METHOD that we provide pointers to */

+static DH_METHOD ibmca_dh =

+        {

+        "Ibmca DH method",

+        NULL,

+        NULL,

+        ibmca_mod_exp_dh,

+        NULL,

+        NULL,

+        0,

+        NULL

+        };

+#endif

+

+static RAND_METHOD ibmca_rand =

+        {

+        /* "IBMCA RAND method", */

+        NULL,

+        ibmca_rand_bytes,

+        NULL,

+        NULL,

+        ibmca_rand_bytes,

+        ibmca_rand_status,

+        };

+

+/* Constants used when creating the ENGINE */

+static const char *engine_ibmca_id = "ibmca";

+static const char *engine_ibmca_name = "Ibmca hardware engine support";

+

+/* This internal function is used by ENGINE_ibmca() and possibly by the

+ * "dynamic" ENGINE support too */

+static int bind_helper(ENGINE *e)

+        {

+#ifndef OPENSSL_NO_RSA

+        const RSA_METHOD *meth1;

+#endif

+#ifndef OPENSSL_NO_DSA

+        const DSA_METHOD *meth2;

+#endif

+#ifndef OPENSSL_NO_DH

+        const DH_METHOD *meth3;

+#endif

+        if(!ENGINE_set_id(e, engine_ibmca_id) ||

+                !ENGINE_set_name(e, engine_ibmca_name) ||

+#ifndef OPENSSL_NO_RSA

+                !ENGINE_set_RSA(e, &ibmca_rsa) ||

+#endif

+#ifndef OPENSSL_NO_DSA

+                !ENGINE_set_DSA(e, &ibmca_dsa) ||

+#endif

+#ifndef OPENSSL_NO_DH

+                !ENGINE_set_DH(e, &ibmca_dh) ||

+#endif

+                !ENGINE_set_RAND(e, &ibmca_rand) ||

+                !ENGINE_set_destroy_function(e, ibmca_destroy) ||

+                !ENGINE_set_init_function(e, ibmca_init) ||

+                !ENGINE_set_finish_function(e, ibmca_finish) ||

+                !ENGINE_set_ctrl_function(e, ibmca_ctrl) ||

+                !ENGINE_set_cmd_defns(e, ibmca_cmd_defns))

+                return 0;

+

+#ifndef OPENSSL_NO_RSA

+        /* We know that the "PKCS1_SSLeay()" functions hook properly

+         * to the ibmca-specific mod_exp and mod_exp_crt so we use

+         * those functions. NB: We don't use ENGINE_openssl() or

+         * anything "more generic" because something like the RSAref

+         * code may not hook properly, and if you own one of these

+         * cards then you have the right to do RSA operations on it

+         * anyway! */ 

+        meth1 = RSA_PKCS1_SSLeay();

+        ibmca_rsa.rsa_pub_enc = meth1->rsa_pub_enc;

+        ibmca_rsa.rsa_pub_dec = meth1->rsa_pub_dec;

+        ibmca_rsa.rsa_priv_enc = meth1->rsa_priv_enc;

+        ibmca_rsa.rsa_priv_dec = meth1->rsa_priv_dec;

+#endif

+

+#ifndef OPENSSL_NO_DSA

+        /* Use the DSA_OpenSSL() method and just hook the mod_exp-ish

+         * bits. */

+        meth2 = DSA_OpenSSL();

+        ibmca_dsa.dsa_do_sign = meth2->dsa_do_sign;

+        ibmca_dsa.dsa_sign_setup = meth2->dsa_sign_setup;

+        ibmca_dsa.dsa_do_verify = meth2->dsa_do_verify;

+#endif

+

+#ifndef OPENSSL_NO_DH

+        /* Much the same for Diffie-Hellman */

+        meth3 = DH_OpenSSL();

+        ibmca_dh.generate_key = meth3->generate_key;

+        ibmca_dh.compute_key = meth3->compute_key;

+#endif

+

+        /* Ensure the ibmca error handling is set up */

+        ERR_load_IBMCA_strings(); 

+        return 1;

+        }

+

+static ENGINE *engine_ibmca(void)

+        {

+        ENGINE *ret = ENGINE_new();

+        if(!ret)

+                return NULL;

+        if(!bind_helper(ret))

+                {

+                ENGINE_free(ret);

+                return NULL;

+                }

+        return ret;

+        }

+

+void ENGINE_load_ibmca(void)

+        {

+        /* Copied from eng_[openssl|dyn].c */

+        ENGINE *toadd = engine_ibmca();

+        if(!toadd) return;

+        ENGINE_add(toadd);

+        ENGINE_free(toadd);

+        ERR_clear_error();

+        }

+

+/* Destructor (complements the "ENGINE_ibmca()" constructor) */

+static int ibmca_destroy(ENGINE *e)

+        {

+        /* Unload the ibmca error strings so any error state including our

+         * functs or reasons won't lead to a segfault (they simply get displayed

+         * without corresponding string data because none will be found). */

+        ERR_unload_IBMCA_strings(); 

+        return 1;

+        }

+

+

+/* This is a process-global DSO handle used for loading and unloading

+ * the Ibmca library. NB: This is only set (or unset) during an

+ * init() or finish() call (reference counts permitting) and they're

+ * operating with global locks, so this should be thread-safe

+ * implicitly. */

+

+static DSO *ibmca_dso = NULL;

+

+/* These are the function pointers that are (un)set when the library has

+ * successfully (un)loaded. */

+

+static unsigned int    (ICA_CALL *p_icaOpenAdapter)();

+static unsigned int    (ICA_CALL *p_icaCloseAdapter)();

+static unsigned int    (ICA_CALL *p_icaRsaModExpo)();

+static unsigned int    (ICA_CALL *p_icaRandomNumberGenerate)();

+static unsigned int    (ICA_CALL *p_icaRsaCrt)();

+

+/* utility function to obtain a context */

+static int get_context(ICA_ADAPTER_HANDLE *p_handle)

+        {

+        unsigned int status=0;

+

+        status = p_icaOpenAdapter(0, p_handle);

+        if(status != 0)

+                return 0;

+        return 1;

+        }

+

+/* similarly to release one. */

+static void release_context(ICA_ADAPTER_HANDLE handle)

+        {

+        p_icaCloseAdapter(handle);

+        }

+

+/* (de)initialisation functions. */

+static int ibmca_init(ENGINE *e)

+        {

+

+        void          (*p1)();

+        void          (*p2)();

+        void          (*p3)();

+        void          (*p4)();

+        void          (*p5)();

+

+        if(ibmca_dso != NULL)

+                {

+                IBMCAerr(IBMCA_F_IBMCA_INIT,IBMCA_R_ALREADY_LOADED);

+                goto err;

+                }

+        /* Attempt to load libatasi.so/atasi.dll/whatever. Needs to be

+         * changed unfortunately because the Ibmca drivers don't have

+         * standard library names that can be platform-translated well. */

+        /* TODO: Work out how to actually map to the names the Ibmca

+         * drivers really use - for now a symbollic link needs to be

+         * created on the host system from libatasi.so to atasi.so on

+         * unix variants. */

+

+        /* WJH XXX check name translation */

+

+        ibmca_dso = DSO_load(NULL, IBMCA_LIBNAME, NULL,

+                             /* DSO_FLAG_NAME_TRANSLATION */ 0);

+        if(ibmca_dso == NULL)

+                {

+                IBMCAerr(IBMCA_F_IBMCA_INIT,IBMCA_R_DSO_FAILURE);

+                goto err;

+                }

+

+        if(!(p1 = DSO_bind_func(

+                ibmca_dso, IBMCA_F1)) ||

+                !(p2 = DSO_bind_func(

+                        ibmca_dso, IBMCA_F2)) ||

+                !(p3 = DSO_bind_func(

+                        ibmca_dso, IBMCA_F3)) ||

+                !(p4 = DSO_bind_func(

+                        ibmca_dso, IBMCA_F4)) ||

+                !(p5 = DSO_bind_func(

+                        ibmca_dso, IBMCA_F5)))

+                {

+                IBMCAerr(IBMCA_F_IBMCA_INIT,IBMCA_R_DSO_FAILURE);

+                goto err;

+                }

+

+        /* Copy the pointers */

+

+        p_icaOpenAdapter =           (unsigned int (ICA_CALL *)())p1;

+        p_icaCloseAdapter =          (unsigned int (ICA_CALL *)())p2;

+        p_icaRsaModExpo =            (unsigned int (ICA_CALL *)())p3;

+        p_icaRandomNumberGenerate =  (unsigned int (ICA_CALL *)())p4;

+        p_icaRsaCrt =                (unsigned int (ICA_CALL *)())p5;

+

+        if(!get_context(&handle))

+                {

+                IBMCAerr(IBMCA_F_IBMCA_INIT,IBMCA_R_UNIT_FAILURE);

+                goto err;

+                }

+

+        return 1;

+ err:

+        if(ibmca_dso)

+                DSO_free(ibmca_dso);

+

+        p_icaOpenAdapter = NULL;

+        p_icaCloseAdapter = NULL;

+        p_icaRsaModExpo = NULL;

+        p_icaRandomNumberGenerate = NULL;

+

+        return 0;

+        }

+

+static int ibmca_finish(ENGINE *e)

+        {

+        if(ibmca_dso == NULL)

+                {

+                IBMCAerr(IBMCA_F_IBMCA_FINISH,IBMCA_R_NOT_LOADED);

+                return 0;

+                }

+        release_context(handle);

+        if(!DSO_free(ibmca_dso))

+                {

+                IBMCAerr(IBMCA_F_IBMCA_FINISH,IBMCA_R_DSO_FAILURE);

+                return 0;

+                }

+        ibmca_dso = NULL;

+

+        return 1;

+        }

+

+static int ibmca_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)())

+        {

+        int initialised = ((ibmca_dso == NULL) ? 0 : 1);

+        switch(cmd)

+                {

+        case IBMCA_CMD_SO_PATH:

+                if(p == NULL)

+                        {

+                        IBMCAerr(IBMCA_F_IBMCA_CTRL,ERR_R_PASSED_NULL_PARAMETER);

+                        return 0;

+                        }

+                if(initialised)

+                        {

+                        IBMCAerr(IBMCA_F_IBMCA_CTRL,IBMCA_R_ALREADY_LOADED);

+                        return 0;

+                        }

+                IBMCA_LIBNAME = (const char *)p;

+                return 1;

+        default:

+                break;

+                }

+        IBMCAerr(IBMCA_F_IBMCA_CTRL,IBMCA_R_CTRL_COMMAND_NOT_IMPLEMENTED);

+        return 0;

+        }

+

+

+static int ibmca_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,

+        const BIGNUM *m, BN_CTX *ctx)

+        {

+        /* I need somewhere to store temporary serialised values for

+         * use with the Ibmca API calls. A neat cheat - I'll use

+         * BIGNUMs from the BN_CTX but access their arrays directly as

+         * byte arrays <grin>. This way I don't have to clean anything

+         * up. */

+

+        BIGNUM *argument=NULL;

+        BIGNUM *result=NULL;

+        BIGNUM *key=NULL;

+        int to_return;

+        int inLen, outLen, tmpLen;

+

+

+        ICA_KEY_RSA_MODEXPO *publKey=NULL;

+        unsigned int rc;

+

+        to_return = 0; /* expect failure */

+

+        if(!ibmca_dso)

+                {

+                IBMCAerr(IBMCA_F_IBMCA_MOD_EXP,IBMCA_R_NOT_LOADED);

+                goto err;

+                }

+        /* Prepare the params */

+        BN_CTX_start(ctx);

+        argument = BN_CTX_get(ctx);

+        result = BN_CTX_get(ctx);

+        key = BN_CTX_get(ctx);

+

+        if( !argument || !result || !key)

+                {

+                IBMCAerr(IBMCA_F_IBMCA_MOD_EXP,IBMCA_R_BN_CTX_FULL);

+                goto err;

+                }

+

+

+        if(!bn_wexpand(argument, m->top) || !bn_wexpand(result, m->top) ||

+                !bn_wexpand(key, sizeof(*publKey)/BN_BYTES))

+

+                {

+                IBMCAerr(IBMCA_F_IBMCA_MOD_EXP,IBMCA_R_BN_EXPAND_FAIL);

+                goto err;

+                }

+

+        publKey = (ICA_KEY_RSA_MODEXPO *)key->d;

+

+        if (publKey == NULL)

+                {

+                goto err;

+                }

+        memset(publKey, 0, sizeof(ICA_KEY_RSA_MODEXPO));

+

+        publKey->keyType   =  CORRECT_ENDIANNESS(ME_KEY_TYPE);

+        publKey->keyLength =  CORRECT_ENDIANNESS(sizeof(ICA_KEY_RSA_MODEXPO));

+        publKey->expOffset =  (char *) publKey->keyRecord - (char *) publKey;

+

+        /* A quirk of the card: the exponent length has to be the same

+     as the modulus (key) length */

+

+        outLen = BN_num_bytes(m);

+

+/* check for modulus length SAB*/

+        if (outLen > 256 ) {

+                IBMCAerr(IBMCA_F_IBMCA_MOD_EXP,IBMCA_R_MEXP_LENGTH_TO_LARGE);

+                goto err;

+        }

+/* check for modulus length SAB*/

+

+

+        publKey->expLength = publKey->nLength = outLen;

+/* SAB Check for underflow condition

+    the size of the exponent is less than the size of the parameter

+    then we have a big problem and will underflow the keyRecord

+   buffer.  Bad stuff could happen then

+*/

+if (outLen < BN_num_bytes(p)){

+        IBMCAerr(IBMCA_F_IBMCA_MOD_EXP,IBMCA_R_UNDERFLOW_KEYRECORD);

+        goto err;

+}

+/* SAB End check for underflow */

+

+

+        BN_bn2bin(p, &publKey->keyRecord[publKey->expLength -

+                BN_num_bytes(p)]);

+        BN_bn2bin(m, &publKey->keyRecord[publKey->expLength]);

+

+

+

+        publKey->modulusBitLength = CORRECT_ENDIANNESS(publKey->nLength * 8);

+        publKey->nOffset   = CORRECT_ENDIANNESS(publKey->expOffset + 

+                                                publKey->expLength);

+

+        publKey->expOffset = CORRECT_ENDIANNESS((char *) publKey->keyRecord - 

+                                                (char *) publKey);

+

+        tmpLen = outLen;

+        publKey->expLength = publKey->nLength = CORRECT_ENDIANNESS(tmpLen);

+

+  /* Prepare the argument */

+

+        memset(argument->d, 0, outLen);

+        BN_bn2bin(a, (unsigned char *)argument->d + outLen -

+                 BN_num_bytes(a));

+

+        inLen = outLen;

+

+  /* Perform the operation */

+

+          if( (rc = p_icaRsaModExpo(handle, inLen,(unsigned char *)argument->d,

+                publKey, &outLen, (unsigned char *)result->d))

+                !=0 )

+

+                {

+                printf("rc = %d\n", rc);

+                IBMCAerr(IBMCA_F_IBMCA_MOD_EXP,IBMCA_R_REQUEST_FAILED);

+                goto err;

+                }

+

+

+        /* Convert the response */

+        BN_bin2bn((unsigned char *)result->d, outLen, r);

+        to_return = 1;

+ err:

+        BN_CTX_end(ctx);

+        return to_return;

+        }

+

+#ifndef OPENSSL_NO_RSA 

+static int ibmca_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)

+        {

+        BN_CTX *ctx;

+        int to_return = 0;

+

+        if((ctx = BN_CTX_new()) == NULL)

+                goto err;

+        if(!rsa->p || !rsa->q || !rsa->dmp1 || !rsa->dmq1 || !rsa->iqmp)

+                {

+                if(!rsa->d || !rsa->n)

+                        {

+                        IBMCAerr(IBMCA_F_IBMCA_RSA_MOD_EXP,

+                                IBMCA_R_MISSING_KEY_COMPONENTS);

+                        goto err;

+                        }

+                to_return = ibmca_mod_exp(r0, I, rsa->d, rsa->n, ctx);

+                }

+        else

+                {

+                to_return = ibmca_mod_exp_crt(r0, I, rsa->p, rsa->q, rsa->dmp1,

+                        rsa->dmq1, rsa->iqmp, ctx);

+                }

+ err:

+        if(ctx)

+                BN_CTX_free(ctx);

+        return to_return;

+        }

+#endif

+

+/* Ein kleines chinesisches "Restessen"  */

+static int ibmca_mod_exp_crt(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,

+        const BIGNUM *q, const BIGNUM *dmp1,

+        const BIGNUM *dmq1, const BIGNUM *iqmp, BN_CTX *ctx)

+        {

+

+        BIGNUM *argument = NULL;

+        BIGNUM *result = NULL;

+        BIGNUM *key = NULL;

+

+        int to_return = 0; /* expect failure */

+

+        char                *pkey=NULL;

+        ICA_KEY_RSA_CRT     *privKey=NULL;

+        int inLen, outLen;

+

+        int rc;

+        unsigned int        offset, pSize, qSize;

+/* SAB New variables */

+        unsigned int keyRecordSize;

+        unsigned int pbytes = BN_num_bytes(p);

+        unsigned int qbytes = BN_num_bytes(q);

+        unsigned int dmp1bytes = BN_num_bytes(dmp1);

+        unsigned int dmq1bytes = BN_num_bytes(dmq1);

+        unsigned int iqmpbytes = BN_num_bytes(iqmp);

+

+        /* Prepare the params */

+

+        BN_CTX_start(ctx);

+        argument = BN_CTX_get(ctx);

+        result = BN_CTX_get(ctx);

+        key = BN_CTX_get(ctx);

+

+        if(!argument || !result || !key)

+                {

+                IBMCAerr(IBMCA_F_IBMCA_MOD_EXP_CRT,IBMCA_R_BN_CTX_FULL);

+                goto err;

+                }

+

+        if(!bn_wexpand(argument, p->top + q->top) ||

+                !bn_wexpand(result, p->top + q->top) ||

+                !bn_wexpand(key, sizeof(*privKey)/BN_BYTES ))

+                {

+                IBMCAerr(IBMCA_F_IBMCA_MOD_EXP_CRT,IBMCA_R_BN_EXPAND_FAIL);

+                goto err;

+                }

+

+

+        privKey = (ICA_KEY_RSA_CRT *)key->d;

+/* SAB Add check for total size in bytes of the parms does not exceed

+   the buffer space we have

+   do this first

+*/

+      keyRecordSize = pbytes+qbytes+dmp1bytes+dmq1bytes+iqmpbytes;

+     if (  keyRecordSize > sizeof(privKey->keyRecord )) {

+         IBMCAerr(IBMCA_F_IBMCA_MOD_EXP_CRT,IBMCA_R_OPERANDS_TO_LARGE);

+         goto err;

+     }

+

+     if ( (qbytes + dmq1bytes)  > 256 ){

+         IBMCAerr(IBMCA_F_IBMCA_MOD_EXP_CRT,IBMCA_R_OPERANDS_TO_LARGE);

+         goto err;

+     }

+

+     if ( pbytes + dmp1bytes > 256 ) {

+         IBMCAerr(IBMCA_F_IBMCA_MOD_EXP_CRT,IBMCA_R_OPERANDS_TO_LARGE);

+         goto err;

+     }

+

+/* end SAB additions */

+  

+        memset(privKey, 0, sizeof(ICA_KEY_RSA_CRT));

+        privKey->keyType =  CORRECT_ENDIANNESS(CRT_KEY_TYPE);

+        privKey->keyLength = CORRECT_ENDIANNESS(sizeof(ICA_KEY_RSA_CRT));

+        privKey->modulusBitLength = 

+          CORRECT_ENDIANNESS(BN_num_bytes(q) * 2 * 8);

+

+        /*

+         * p,dp & qInv are 1 QWORD Larger

+         */

+        privKey->pLength = CORRECT_ENDIANNESS(BN_num_bytes(p)+8);

+        privKey->qLength = CORRECT_ENDIANNESS(BN_num_bytes(q));

+        privKey->dpLength = CORRECT_ENDIANNESS(BN_num_bytes(dmp1)+8);

+        privKey->dqLength = CORRECT_ENDIANNESS(BN_num_bytes(dmq1));

+        privKey->qInvLength = CORRECT_ENDIANNESS(BN_num_bytes(iqmp)+8);

+

+        offset = (char *) privKey->keyRecord

+                  - (char *) privKey;

+

+        qSize = BN_num_bytes(q);

+        pSize = qSize + 8;   /*  1 QWORD larger */

+

+

+/* SAB  probably aittle redundant, but we'll verify that each of the

+   components which make up a key record sent ot the card does not exceed

+   the space that is allocated for it.  this handles the case where even if

+   the total length does not exceed keyrecord zied, if the operands are funny sized

+they could cause potential side affects on either the card or the result */

+

+     if ( (pbytes > pSize) || (dmp1bytes > pSize) ||

+          (iqmpbytes > pSize) || ( qbytes >qSize) ||

+          (dmq1bytes > qSize) ) {

+                IBMCAerr(IBMCA_F_IBMCA_MOD_EXP_CRT, IBMCA_R_OPERANDS_TO_LARGE);

+                goto err;

+

+        }

+     

+

+        privKey->dpOffset = CORRECT_ENDIANNESS(offset);

+

+        offset += pSize;

+        privKey->dqOffset = CORRECT_ENDIANNESS(offset);

+

+        offset += qSize;

+        privKey->pOffset = CORRECT_ENDIANNESS(offset);

+

+        offset += pSize;

+        privKey->qOffset = CORRECT_ENDIANNESS(offset);

+

+        offset += qSize;

+        privKey->qInvOffset = CORRECT_ENDIANNESS(offset);

+

+        pkey = (char *) privKey->keyRecord;

+

+

+/* SAB first check that we don;t under flow the buffer */

+        if ( pSize < pbytes ) {

+                IBMCAerr(IBMCA_F_IBMCA_MOD_EXP_CRT, IBMCA_R_UNDERFLOW_CONDITION);

+                goto err;

+        }

+

+        /* pkey += pSize - BN_num_bytes(p); WROING this should be dmp1) */

+        pkey += pSize - BN_num_bytes(dmp1);

+        BN_bn2bin(dmp1, pkey);   

+        pkey += BN_num_bytes(dmp1);  /* move the pointer */

+

+        BN_bn2bin(dmq1, pkey);  /* Copy over dmq1 */

+

+        pkey += qSize;     /* move pointer */

+        pkey += pSize - BN_num_bytes(p);  /* set up for zero padding of next field */

+

+        BN_bn2bin(p, pkey);

+        pkey += BN_num_bytes(p);  /* increment pointer by number of bytes moved  */

+

+        BN_bn2bin(q, pkey);

+        pkey += qSize ;  /* move the pointer */

+        pkey +=  pSize - BN_num_bytes(iqmp); /* Adjust for padding */

+        BN_bn2bin(iqmp, pkey);

+

+        /* Prepare the argument and response */

+

+        outLen = CORRECT_ENDIANNESS(privKey->qLength) * 2;  /* Correct endianess is used 

+                                                because the fields were converted above */

+

+        if (outLen > 256) {

+                IBMCAerr(IBMCA_F_IBMCA_MOD_EXP_CRT,IBMCA_R_OUTLEN_TO_LARGE);

+                goto err;

+        }

+

+        /* SAB check for underflow here on the argeument */

+        if ( outLen < BN_num_bytes(a)) {

+                IBMCAerr(IBMCA_F_IBMCA_MOD_EXP_CRT,IBMCA_R_UNDERFLOW_CONDITION);

+                goto err;

+        }

+

+        BN_bn2bin(a, (unsigned char *)argument->d + outLen -

+                          BN_num_bytes(a));

+        inLen = outLen;

+

+        memset(result->d, 0, outLen);

+

+        /* Perform the operation */

+

+        if ( (rc = p_icaRsaCrt(handle, inLen, (unsigned char *)argument->d,

+                privKey, &outLen, (unsigned char *)result->d)) != 0)

+                {

+                printf("rc = %d\n", rc);

+                IBMCAerr(IBMCA_F_IBMCA_MOD_EXP_CRT,IBMCA_R_REQUEST_FAILED);

+                goto err;

+                }

+

+        /* Convert the response */

+

+        BN_bin2bn((unsigned char *)result->d, outLen, r);

+        to_return = 1;

+

+ err:

+        BN_CTX_end(ctx);

+        return to_return;

+

+        }

+

+#ifndef OPENSSL_NO_DSA

+/* This code was liberated and adapted from the commented-out code in

+ * dsa_ossl.c. Because of the unoptimised form of the Ibmca acceleration

+ * (it doesn't have a CRT form for RSA), this function means that an

+ * Ibmca system running with a DSA server certificate can handshake

+ * around 5 or 6 times faster/more than an equivalent system running with

+ * RSA. Just check out the "signs" statistics from the RSA and DSA parts

+ * of "openssl speed -engine ibmca dsa1024 rsa1024". */

+static int ibmca_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,

+        BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,

+        BN_CTX *ctx, BN_MONT_CTX *in_mont)

+        {

+        BIGNUM t;

+        int to_return = 0;

+

+        BN_init(&t);

+        /* let rr = a1 ^ p1 mod m */

+        if (!ibmca_mod_exp(rr,a1,p1,m,ctx)) goto end;

+        /* let t = a2 ^ p2 mod m */

+        if (!ibmca_mod_exp(&t,a2,p2,m,ctx)) goto end;

+        /* let rr = rr * t mod m */

+        if (!BN_mod_mul(rr,rr,&t,m,ctx)) goto end;

+        to_return = 1;

+ end:

+        BN_free(&t);

+        return to_return;

+        }

+

+

+static int ibmca_mod_exp_dsa(DSA *dsa, BIGNUM *r, BIGNUM *a,

+        const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,

+        BN_MONT_CTX *m_ctx)

+        {

+        return ibmca_mod_exp(r, a, p, m, ctx);

+        }

+#endif

+

+/* This function is aliased to mod_exp (with the mont stuff dropped). */

+static int ibmca_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,

+        const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)

+        {

+        return ibmca_mod_exp(r, a, p, m, ctx);

+        }

+

+#ifndef OPENSSL_NO_DH 

+/* This function is aliased to mod_exp (with the dh and mont dropped). */

+static int ibmca_mod_exp_dh(DH const *dh, BIGNUM *r, 

+        const BIGNUM *a, const BIGNUM *p, 

+        const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)

+        {

+        return ibmca_mod_exp(r, a, p, m, ctx);

+        }

+#endif

+

+/* Random bytes are good */

+static int ibmca_rand_bytes(unsigned char *buf, int num)

+        {

+        int to_return = 0; /* assume failure */

+        unsigned int ret;

+

+

+        if(handle == 0)

+                {

+                IBMCAerr(IBMCA_F_IBMCA_RAND_BYTES,IBMCA_R_NOT_INITIALISED);

+                goto err;

+                }

+

+        ret = p_icaRandomNumberGenerate(handle, num, buf);

+        if (ret < 0)

+                {

+                IBMCAerr(IBMCA_F_IBMCA_RAND_BYTES,IBMCA_R_REQUEST_FAILED);

+                goto err;

+                }

+        to_return = 1;

+ err:

+        return to_return;

+        }

+

+static int ibmca_rand_status(void)

+        {

+        return 1;

+        }

+

+/* This stuff is needed if this ENGINE is being compiled into a self-contained

+ * shared-library. */

+#ifdef ENGINE_DYNAMIC_SUPPORT

+static int bind_fn(ENGINE *e, const char *id)

+        {

+        if(id && (strcmp(id, engine_ibmca_id) != 0))  /* WJH XXX */

+                return 0;

+        if(!bind_helper(e))

+                return 0;

+        return 1;

+        }

+IMPLEMENT_DYNAMIC_CHECK_FN()

+IMPLEMENT_DYNAMIC_BIND_FN(bind_fn)

+#endif /* ENGINE_DYNAMIC_SUPPORT */

+

+

+#endif /* !OPENSSL_NO_HW_IBMCA */

+#endif /* !OPENSSL_NO_HW */

diff --git a/src/lib/libssl/src/demos/engines/ibmca/hw_ibmca.ec b/src/lib/libssl/src/demos/engines/ibmca/hw_ibmca.ec
new file mode 100644
index 0000000000..f68646d237
--- /dev/null
+++ b/src/lib/libssl/src/demos/engines/ibmca/hw_ibmca.ec
@@ -0,0 +1,8 @@
+# configuration file for util/mkerr.pl
+#
+# use like this:
+#
+#       perl ../../../util/mkerr.pl -conf hw_ibmca.ec \
+#               -nostatic -staticloader -write *.c
+
+L IBMCA         hw_ibmca_err.h                  hw_ibmca_err.c
diff --git a/src/lib/libssl/src/demos/engines/ibmca/hw_ibmca_err.c b/src/lib/libssl/src/demos/engines/ibmca/hw_ibmca_err.c
new file mode 100644
index 0000000000..c4053f6d30
--- /dev/null
+++ b/src/lib/libssl/src/demos/engines/ibmca/hw_ibmca_err.c
@@ -0,0 +1,154 @@
+/* hw_ibmca_err.c */
+/* ====================================================================
+ * Copyright (c) 1999-2002 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* NOTE: this file was auto generated by the mkerr.pl script: any changes
+ * made to it will be overwritten when the script next updates this file,
+ * only reason strings will be preserved.
+ */
+
+#include <stdio.h>
+#include <openssl/err.h>
+#include "hw_ibmca_err.h"
+
+/* BEGIN ERROR CODES */
+#ifndef OPENSSL_NO_ERR
+static ERR_STRING_DATA IBMCA_str_functs[]=
+        {
+{ERR_PACK(0,IBMCA_F_IBMCA_CTRL,0),      "IBMCA_CTRL"},
+{ERR_PACK(0,IBMCA_F_IBMCA_FINISH,0),    "IBMCA_FINISH"},
+{ERR_PACK(0,IBMCA_F_IBMCA_INIT,0),      "IBMCA_INIT"},
+{ERR_PACK(0,IBMCA_F_IBMCA_MOD_EXP,0),   "IBMCA_MOD_EXP"},
+{ERR_PACK(0,IBMCA_F_IBMCA_MOD_EXP_CRT,0),       "IBMCA_MOD_EXP_CRT"},
+{ERR_PACK(0,IBMCA_F_IBMCA_RAND_BYTES,0),        "IBMCA_RAND_BYTES"},
+{ERR_PACK(0,IBMCA_F_IBMCA_RSA_MOD_EXP,0),       "IBMCA_RSA_MOD_EXP"},
+{0,NULL}
+        };
+
+static ERR_STRING_DATA IBMCA_str_reasons[]=
+        {
+{IBMCA_R_ALREADY_LOADED                  ,"already loaded"},
+{IBMCA_R_BN_CTX_FULL                     ,"bn ctx full"},
+{IBMCA_R_BN_EXPAND_FAIL                  ,"bn expand fail"},
+{IBMCA_R_CTRL_COMMAND_NOT_IMPLEMENTED    ,"ctrl command not implemented"},
+{IBMCA_R_DSO_FAILURE                     ,"dso failure"},
+{IBMCA_R_MEXP_LENGTH_TO_LARGE            ,"mexp length to large"},
+{IBMCA_R_MISSING_KEY_COMPONENTS          ,"missing key components"},
+{IBMCA_R_NOT_INITIALISED                 ,"not initialised"},
+{IBMCA_R_NOT_LOADED                      ,"not loaded"},
+{IBMCA_R_OPERANDS_TO_LARGE               ,"operands to large"},
+{IBMCA_R_OUTLEN_TO_LARGE                 ,"outlen to large"},
+{IBMCA_R_REQUEST_FAILED                  ,"request failed"},
+{IBMCA_R_UNDERFLOW_CONDITION             ,"underflow condition"},
+{IBMCA_R_UNDERFLOW_KEYRECORD             ,"underflow keyrecord"},
+{IBMCA_R_UNIT_FAILURE                    ,"unit failure"},
+{0,NULL}
+        };
+
+#endif
+
+#ifdef IBMCA_LIB_NAME
+static ERR_STRING_DATA IBMCA_lib_name[]=
+        {
+{0      ,IBMCA_LIB_NAME},
+{0,NULL}
+        };
+#endif
+
+
+static int IBMCA_lib_error_code=0;
+static int IBMCA_error_init=1;
+
+static void ERR_load_IBMCA_strings(void)
+        {
+        if (IBMCA_lib_error_code == 0)
+                IBMCA_lib_error_code=ERR_get_next_error_library();
+
+        if (IBMCA_error_init)
+                {
+                IBMCA_error_init=0;
+#ifndef OPENSSL_NO_ERR
+                ERR_load_strings(IBMCA_lib_error_code,IBMCA_str_functs);
+                ERR_load_strings(IBMCA_lib_error_code,IBMCA_str_reasons);
+#endif
+
+#ifdef IBMCA_LIB_NAME
+                IBMCA_lib_name->error = ERR_PACK(IBMCA_lib_error_code,0,0);
+                ERR_load_strings(0,IBMCA_lib_name);
+#endif
+                }
+        }
+
+static void ERR_unload_IBMCA_strings(void)
+        {
+        if (IBMCA_error_init == 0)
+                {
+#ifndef OPENSSL_NO_ERR
+                ERR_unload_strings(IBMCA_lib_error_code,IBMCA_str_functs);
+                ERR_unload_strings(IBMCA_lib_error_code,IBMCA_str_reasons);
+#endif
+
+#ifdef IBMCA_LIB_NAME
+                ERR_unload_strings(0,IBMCA_lib_name);
+#endif
+                IBMCA_error_init=1;
+                }
+        }
+
+static void ERR_IBMCA_error(int function, int reason, char *file, int line)
+        {
+        if (IBMCA_lib_error_code == 0)
+                IBMCA_lib_error_code=ERR_get_next_error_library();
+        ERR_PUT_error(IBMCA_lib_error_code,function,reason,file,line);
+        }
diff --git a/src/lib/libssl/src/demos/engines/ibmca/hw_ibmca_err.h b/src/lib/libssl/src/demos/engines/ibmca/hw_ibmca_err.h
new file mode 100644
index 0000000000..da64bde5f2
--- /dev/null
+++ b/src/lib/libssl/src/demos/engines/ibmca/hw_ibmca_err.h
@@ -0,0 +1,98 @@
+/* ====================================================================
+ * Copyright (c) 2001-2002 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#ifndef HEADER_IBMCA_ERR_H
+#define HEADER_IBMCA_ERR_H
+
+/* BEGIN ERROR CODES */
+/* The following lines are auto generated by the script mkerr.pl. Any changes
+ * made after this point may be overwritten when the script is next run.
+ */
+static void ERR_load_IBMCA_strings(void);
+static void ERR_unload_IBMCA_strings(void);
+static void ERR_IBMCA_error(int function, int reason, char *file, int line);
+#define IBMCAerr(f,r) ERR_IBMCA_error((f),(r),__FILE__,__LINE__)
+
+/* Error codes for the IBMCA functions. */
+
+/* Function codes. */
+#define IBMCA_F_IBMCA_CTRL                               100
+#define IBMCA_F_IBMCA_FINISH                             101
+#define IBMCA_F_IBMCA_INIT                               102
+#define IBMCA_F_IBMCA_MOD_EXP                            103
+#define IBMCA_F_IBMCA_MOD_EXP_CRT                        104
+#define IBMCA_F_IBMCA_RAND_BYTES                         105
+#define IBMCA_F_IBMCA_RSA_MOD_EXP                        106
+
+/* Reason codes. */
+#define IBMCA_R_ALREADY_LOADED                           100
+#define IBMCA_R_BN_CTX_FULL                              101
+#define IBMCA_R_BN_EXPAND_FAIL                           102
+#define IBMCA_R_CTRL_COMMAND_NOT_IMPLEMENTED             103
+#define IBMCA_R_DSO_FAILURE                              104
+#define IBMCA_R_MEXP_LENGTH_TO_LARGE                     105
+#define IBMCA_R_MISSING_KEY_COMPONENTS                   106
+#define IBMCA_R_NOT_INITIALISED                          107
+#define IBMCA_R_NOT_LOADED                               108
+#define IBMCA_R_OPERANDS_TO_LARGE                        109
+#define IBMCA_R_OUTLEN_TO_LARGE                          110
+#define IBMCA_R_REQUEST_FAILED                           111
+#define IBMCA_R_UNDERFLOW_CONDITION                      112
+#define IBMCA_R_UNDERFLOW_KEYRECORD                      113
+#define IBMCA_R_UNIT_FAILURE                             114
+
+#ifdef  __cplusplus
+}
+#endif
+#endif
diff --git a/src/lib/libssl/src/demos/engines/ibmca/ica_openssl_api.h b/src/lib/libssl/src/demos/engines/ibmca/ica_openssl_api.h
new file mode 100644
index 0000000000..c77e0fd5c0
--- /dev/null
+++ b/src/lib/libssl/src/demos/engines/ibmca/ica_openssl_api.h
@@ -0,0 +1,189 @@
+
+#ifndef __ICA_OPENSSL_API_H__
+#define __ICA_OPENSSL_API_H__
+
+/**
+ ** abstract data types for API
+ **/
+
+#define ICA_ADAPTER_HANDLE int
+
+#if defined(linux) || defined (_AIX)
+#define ICA_CALL 
+#endif
+
+#if defined(WIN32) || defined(_WIN32)
+#define ICA_CALL  __stdcall
+#endif
+
+/*------------------------------------------------*
+ | RSA defines and typedefs                       |
+ *------------------------------------------------*/
+ /*
+ * All data elements of the RSA key are in big-endian format
+ * Modulus-Exponent form of key
+ *
+ */
+ #define MAX_EXP_SIZE 256
+ #define MAX_MODULUS_SIZE 256
+ #define MAX_MODEXP_SIZE  (MAX_EXP_SIZE + MAX_MODULUS_SIZE)
+
+ #define MAX_OPERAND_SIZE  MAX_EXP_SIZE
+
+ typedef unsigned char ICA_KEY_RSA_MODEXPO_REC[MAX_MODEXP_SIZE];
+ /*
+ * All data elements of the RSA key are in big-endian format
+ * Chinese Remainder Thereom(CRT) form of key
+ * Used only for Decrypt, the encrypt form is typically Modulus-Exponent
+ *
+ */
+ #define MAX_BP_SIZE 136
+ #define MAX_BQ_SIZE 128
+ #define MAX_NP_SIZE 136
+ #define MAX_NQ_SIZE 128
+ #define MAX_QINV_SIZE 136
+ #define MAX_RSACRT_SIZE (MAX_BP_SIZE+MAX_BQ_SIZE+MAX_NP_SIZE+MAX_NQ_SIZE+MAX_QINV_SIZE)
+
+#define RSA_GEN_OPERAND_MAX   256 /* bytes */
+
+typedef unsigned char ICA_KEY_RSA_CRT_REC[MAX_RSACRT_SIZE];
+/*------------------------------------------------*
+ | RSA key token types                            |
+ *------------------------------------------------*/
+
+#define  RSA_PUBLIC_MODULUS_EXPONENT        3
+#define  RSA_PKCS_PRIVATE_CHINESE_REMAINDER 6
+
+#define KEYTYPE_MODEXPO         1
+#define KEYTYPE_PKCSCRT         2
+
+
+/*------------------------------------------------*
+ | RSA Key Token format                           |
+ *------------------------------------------------*/
+
+/*
+ * NOTE:  All the fields in the ICA_KEY_RSA_MODEXPO structure
+ *        (lengths, offsets, exponents, modulus, etc.) are
+ *        stored in big-endian format
+ */
+
+typedef struct _ICA_KEY_RSA_MODEXPO
+{   unsigned int  keyType;             /* RSA key type.               */
+    unsigned int  keyLength;           /* Total length of the token.  */
+    unsigned int  modulusBitLength;    /* Modulus n bit length.       */
+                                       /* -- Start of the data length.*/
+    unsigned int  nLength;             /* Modulus n = p * q           */
+    unsigned int  expLength;           /* exponent (public or private)*/
+                                       /*   e = 1/d * mod(p-1)(q-1)   */
+                                       /* -- Start of the data offsets*/
+    unsigned int  nOffset;             /* Modulus n .                 */
+    unsigned int  expOffset;           /* exponent (public or private)*/
+    unsigned char reserved[112];       /* reserved area               */
+                                       /* -- Start of the variable -- */
+                                       /* -- length token data.    -- */
+    ICA_KEY_RSA_MODEXPO_REC keyRecord;
+} ICA_KEY_RSA_MODEXPO;
+#define SZ_HEADER_MODEXPO (sizeof(ICA_KEY_RSA_MODEXPO) - sizeof(ICA_KEY_RSA_MODEXPO_REC))
+
+/*
+ * NOTE:  All the fields in the ICA_KEY_RSA_CRT structure
+ *        (lengths, offsets, exponents, modulus, etc.) are
+ *        stored in big-endian format
+ */
+
+typedef struct _ICA_KEY_RSA_CRT
+{   unsigned int  keyType;             /* RSA key type.               */
+    unsigned int  keyLength;           /* Total length of the token.  */
+    unsigned int  modulusBitLength;    /* Modulus n bit length.       */
+                                       /* -- Start of the data length.*/
+#if _AIX
+    unsigned int  nLength;             /* Modulus n = p * q           */
+#endif
+    unsigned int  pLength;             /* Prime number p .            */
+    unsigned int  qLength;             /* Prime number q .            */
+    unsigned int  dpLength;            /* dp = d * mod(p-1) .         */
+    unsigned int  dqLength;            /* dq = d * mod(q-1) .         */
+    unsigned int  qInvLength;          /* PKCS: qInv = Ap/q           */
+                                       /* -- Start of the data offsets*/
+#if _AIX
+    unsigned int  nOffset;             /* Modulus n .                 */
+#endif
+    unsigned int  pOffset;             /* Prime number p .            */
+    unsigned int  qOffset;             /* Prime number q .            */
+    unsigned int  dpOffset;            /* dp .                        */
+    unsigned int  dqOffset;            /* dq .                        */
+    unsigned int  qInvOffset;          /* qInv for PKCS               */
+#if _AIX
+    unsigned char reserved[80];        /* reserved area               */
+#else
+    unsigned char reserved[88];        /* reserved area               */
+#endif
+                                       /* -- Start of the variable -- */
+                                       /* -- length token data.    -- */
+    ICA_KEY_RSA_CRT_REC keyRecord;
+} ICA_KEY_RSA_CRT;
+#define SZ_HEADER_CRT (sizeof(ICA_KEY_RSA_CRT) - sizeof(ICA_KEY_RSA_CRT_REC))
+
+unsigned int
+icaOpenAdapter( unsigned int        adapterId,
+                ICA_ADAPTER_HANDLE *pAdapterHandle );
+
+unsigned int
+icaCloseAdapter( ICA_ADAPTER_HANDLE adapterHandle );
+
+unsigned int
+icaRsaModExpo( ICA_ADAPTER_HANDLE    hAdapterHandle,
+               unsigned int          inputDataLength,
+               unsigned char        *pInputData,
+               ICA_KEY_RSA_MODEXPO  *pKeyModExpo,
+               unsigned int         *pOutputDataLength,
+               unsigned char        *pOutputData );
+
+unsigned int
+icaRsaCrt( ICA_ADAPTER_HANDLE     hAdapterHandle,
+           unsigned int           inputDataLength,
+           unsigned char         *pInputData,
+           ICA_KEY_RSA_CRT       *pKeyCrt,
+           unsigned int          *pOutputDataLength,
+           unsigned char         *pOutputData );
+
+unsigned int
+icaRandomNumberGenerate( ICA_ADAPTER_HANDLE  hAdapterHandle,
+                         unsigned int        outputDataLength,
+                         unsigned char      *pOutputData );
+
+/* Specific macros and definitions to not have IFDEF;s all over the
+   main code */
+
+#if (_AIX)
+static const char *IBMCA_LIBNAME = "/lib/libica.a(shr.o)";
+#elif (WIN32)
+static const char *IBMCA_LIBNAME = "cryptica";
+#else
+static const char *IBMCA_LIBNAME = "ica";
+#endif
+
+#if (WIN32)
+/*
+ The ICA_KEY_RSA_MODEXPO & ICA_KEY_RSA_CRT lengths and
+ offsets must be in big-endian format.
+
+*/
+#define CORRECT_ENDIANNESS(b) (  \
+                             (((unsigned long) (b) & 0x000000ff) << 24) |  \
+                             (((unsigned long) (b) & 0x0000ff00) <<  8) |  \
+                             (((unsigned long) (b) & 0x00ff0000) >>  8) |  \
+                             (((unsigned long) (b) & 0xff000000) >> 24)    \
+                             )
+#define CRT_KEY_TYPE   RSA_PKCS_PRIVATE_CHINESE_REMAINDER
+#define ME_KEY_TYPE    RSA_PUBLIC_MODULUS_EXPONENT
+#else
+#define CORRECT_ENDIANNESS(b) (b)
+#define CRT_KEY_TYPE       KEYTYPE_PKCSCRT
+#define ME_KEY_TYPE        KEYTYPE_MODEXPO
+#endif
+
+
+
+#endif   /* __ICA_OPENSSL_API_H__ */
diff --git a/src/lib/libssl/src/demos/engines/rsaref/Makefile b/src/lib/libssl/src/demos/engines/rsaref/Makefile
index 5fbcda3576..003e35df2e 100644
--- a/src/lib/libssl/src/demos/engines/rsaref/Makefile
+++ b/src/lib/libssl/src/demos/engines/rsaref/Makefile
@@ -48,7 +48,7 @@ $(LIB):		$(OBJ)
 
 LINK_SO=        \
   ld -r -o $(LIBNAME).o $$ALLSYMSFLAGS $(LIB) install/librsaref.a && \
-  (nm -Pg $(LIBNAME).o | grep ' [BD] ' | cut -f1 -d' ' > $(LIBNAME).exp; \
+  (nm -Pg $(LIBNAME).o | grep ' [BDT] ' | cut -f1 -d' ' > $(LIBNAME).exp; \
    $$SHAREDCMD $$SHAREDFLAGS -o $(SHLIB) $(LIBNAME).o -L ../../.. -lcrypto -lc)
 
 $(SHLIB).gnu:   $(LIB) install/librsaref.a
diff --git a/src/lib/libssl/src/demos/engines/rsaref/rsaref.c b/src/lib/libssl/src/demos/engines/rsaref/rsaref.c
index e23f64c01e..f092acbf3f 100644
--- a/src/lib/libssl/src/demos/engines/rsaref/rsaref.c
+++ b/src/lib/libssl/src/demos/engines/rsaref/rsaref.c
@@ -116,7 +116,7 @@ static const EVP_CIPHER cipher_des_cbc =
         {
         NID_des_cbc,
         8, 8, 8,
-        0,
+        0 | EVP_CIPH_CBC_MODE,
         cipher_des_cbc_init,
         cipher_des_cbc_code,
         cipher_des_cbc_clean,
@@ -131,7 +131,7 @@ static const EVP_CIPHER cipher_des_ede3_cbc =
         {
         NID_des_ede3_cbc,
         8, 24, 8,
-        0,
+        0 | EVP_CIPH_CBC_MODE,
         cipher_des_ede3_cbc_init,
         cipher_des_ede3_cbc_code,
         cipher_des_ede3_cbc_clean,
@@ -146,7 +146,7 @@ static const EVP_CIPHER cipher_desx_cbc =
         {
         NID_desx_cbc,
         8, 24, 8,
-        0,
+        0 | EVP_CIPH_CBC_MODE,
         cipher_desx_cbc_init,
         cipher_desx_cbc_code,
         cipher_desx_cbc_clean,
diff --git a/src/lib/libssl/src/demos/engines/zencod/Makefile b/src/lib/libssl/src/demos/engines/zencod/Makefile
new file mode 100644
index 0000000000..5b6a339ab2
--- /dev/null
+++ b/src/lib/libssl/src/demos/engines/zencod/Makefile
@@ -0,0 +1,114 @@
+LIBNAME=        libzencod
+SRC=            hw_zencod.c
+OBJ=            hw_zencod.o
+HEADER=         hw_zencod.h
+
+CC=             gcc
+PIC=            -fPIC
+CFLAGS=         -g -I../../../include $(PIC) -DENGINE_DYNAMIC_SUPPORT -DFLAT_INC
+AR=             ar r
+RANLIB=         ranlib
+
+LIB=            $(LIBNAME).a
+SHLIB=          $(LIBNAME).so
+
+all:
+                @echo 'Please choose a system to build on:'
+                @echo ''
+                @echo 'tru64:    Tru64 Unix, Digital Unix, Digital OSF/1'
+                @echo 'solaris:  Solaris'
+                @echo 'irix:     IRIX'
+                @echo 'hpux32:   32-bit HP/UX'
+                @echo 'hpux64:   64-bit HP/UX'
+                @echo 'aix:      AIX'
+                @echo 'gnu:      Generic GNU-based system (gcc and GNU ld)'
+                @echo ''
+
+FORCE.update:
+update:         FORCE.update
+                perl ../../../util/mkerr.pl -conf hw_zencod.ec \
+                        -nostatic -staticloader -write hw_zencod.c
+
+gnu:            $(SHLIB).gnu
+tru64:          $(SHLIB).tru64
+solaris:        $(SHLIB).solaris
+irix:           $(SHLIB).irix
+hpux32:         $(SHLIB).hpux32
+hpux64:         $(SHLIB).hpux64
+aix:            $(SHLIB).aix
+
+$(LIB):         $(OBJ)
+                $(AR) $(LIB) $(OBJ)
+                - $(RANLIB) $(LIB)
+
+LINK_SO=        \
+  ld -r -o $(LIBNAME).o $$ALLSYMSFLAGS $(LIB) && \
+  (nm -Pg $(LIBNAME).o | grep ' [BDT] ' | cut -f1 -d' ' > $(LIBNAME).exp; \
+   $$SHAREDCMD $$SHAREDFLAGS -o $(SHLIB) $(LIBNAME).o -L ../../.. -lcrypto -lc)
+
+$(SHLIB).gnu:   $(LIB)
+                ALLSYMSFLAGS='--whole-archive' \
+                SHAREDFLAGS='-shared -Wl,-soname=$(SHLIB)' \
+                SHAREDCMD='$(CC)'; \
+                $(LINK_SO)
+                touch $(SHLIB).gnu
+$(SHLIB).tru64: $(LIB)
+                ALLSYMSFLAGS='-all' \
+                SHAREDFLAGS='-shared' \
+                SHAREDCMD='$(CC)'; \
+                $(LINK_SO)
+                touch $(SHLIB).tru64
+$(SHLIB).solaris:       $(LIB)
+                ALLSYMSFLAGS='-z allextract' \
+                SHAREDFLAGS='-G -h $(SHLIB)' \
+                SHAREDCMD='$(CC)'; \
+                $(LINK_SO)
+                touch $(SHLIB).solaris
+$(SHLIB).irix:  $(LIB)
+                ALLSYMSFLAGS='-all' \
+                SHAREDFLAGS='-shared -Wl,-soname,$(SHLIB)' \
+                SHAREDCMD='$(CC)'; \
+                $(LINK_SO)
+                touch $(SHLIB).irix
+$(SHLIB).hpux32:        $(LIB)
+                ALLSYMSFLAGS='-Fl' \
+                SHAREDFLAGS='+vnocompatwarnings -b -z +s +h $(SHLIB)' \
+                SHAREDCMD='/usr/ccs/bin/ld'; \
+                $(LINK_SO)
+                touch $(SHLIB).hpux32
+$(SHLIB).hpux64:        $(LIB)
+                ALLSYMSFLAGS='+forceload' \
+                SHAREDFLAGS='-b -z +h $(SHLIB)' \
+                SHAREDCMD='/usr/ccs/bin/ld'; \
+                $(LINK_SO)
+                touch $(SHLIB).hpux64
+$(SHLIB).aix:   $(LIB)
+                ALLSYMSFLAGS='-bnogc' \
+                SHAREDFLAGS='-G -bE:$(LIBNAME).exp -bM:SRE' \
+                SHAREDCMD='$(CC)'; \
+                $(LINK_SO)
+                touch $(SHLIB).aix
+
+depend:
+                sed -e '/^# DO NOT DELETE.*/,$$d' < Makefile > Makefile.tmp
+                echo '# DO NOT DELETE THIS LINE -- make depend depends on it.' >> Makefile.tmp
+                gcc -M $(CFLAGS) $(SRC) >> Makefile.tmp
+                perl ../../../util/clean-depend.pl < Makefile.tmp > Makefile.new
+                rm -f Makefile.tmp Makefile
+                mv Makefile.new Makefile
+
+# DO NOT DELETE THIS LINE -- make depend depends on it.
+
+rsaref.o: ../../../include/openssl/asn1.h ../../../include/openssl/bio.h
+rsaref.o: ../../../include/openssl/bn.h ../../../include/openssl/crypto.h
+rsaref.o: ../../../include/openssl/dh.h ../../../include/openssl/dsa.h
+rsaref.o: ../../../include/openssl/e_os2.h ../../../include/openssl/engine.h
+rsaref.o: ../../../include/openssl/err.h ../../../include/openssl/lhash.h
+rsaref.o: ../../../include/openssl/opensslconf.h
+rsaref.o: ../../../include/openssl/opensslv.h
+rsaref.o: ../../../include/openssl/ossl_typ.h ../../../include/openssl/rand.h
+rsaref.o: ../../../include/openssl/rsa.h ../../../include/openssl/safestack.h
+rsaref.o: ../../../include/openssl/stack.h ../../../include/openssl/symhacks.h
+rsaref.o: ../../../include/openssl/ui.h rsaref.c rsaref_err.c rsaref_err.h
+rsaref.o: source/des.h source/global.h source/md2.h source/md5.h source/rsa.h
+rsaref.o: source/rsaref.h
diff --git a/src/lib/libssl/src/demos/engines/zencod/hw_zencod.c b/src/lib/libssl/src/demos/engines/zencod/hw_zencod.c
new file mode 100644
index 0000000000..308e18710f
--- /dev/null
+++ b/src/lib/libssl/src/demos/engines/zencod/hw_zencod.c
@@ -0,0 +1,1736 @@
+/* crypto/engine/hw_zencod.c */
+ /* Written by Fred Donnat (frederic.donnat@zencod.com) for "zencod"
+ * engine integration in order to redirect crypto computing on a crypto
+ * hardware accelerator zenssl32  ;-)
+ *
+ * Date : 25 jun 2002
+ * Revision : 17 Ju7 2002
+ * Version : zencod_engine-0.9.7
+ */
+
+/* ====================================================================
+ * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+
+/* ENGINE general include */
+#include <stdio.h>
+#include <openssl/crypto.h>
+#include <openssl/dso.h>
+#include <openssl/engine.h>
+
+#ifndef OPENSSL_NO_HW
+#ifndef OPENSSL_NO_HW_ZENCOD
+
+#ifdef FLAT_INC
+#  include "hw_zencod.h"
+#else
+#  include "vendor_defns/hw_zencod.h"
+#endif
+
+#define ZENCOD_LIB_NAME "zencod engine"
+#include "hw_zencod_err.c"
+
+#define FAIL_TO_SOFTWARE                -15
+
+#define ZEN_LIBRARY     "zenbridge"
+
+#if 0
+#  define PERROR(s)     perror(s)
+#  define CHEESE()      fputs("## [ZenEngine] ## " __FUNCTION__ "\n", stderr)
+#else
+#  define PERROR(s)
+#  define CHEESE()
+#endif
+
+
+/* Sorry ;) */
+#ifndef WIN32
+static inline void esrever ( unsigned char *d, int l )
+{
+        for(;--l>0;--l,d++){*d^=*(d+l);*(d+l)^=*d;*d^=*(d+l);}
+}
+
+static inline void ypcmem ( unsigned char *d, const unsigned char *s, int l )
+{
+        for(d+=l;l--;)*--d=*s++;
+}
+#else
+static __inline void esrever ( unsigned char *d, int l )
+{
+        for(;--l>0;--l,d++){*d^=*(d+l);*(d+l)^=*d;*d^=*(d+l);}
+}
+
+static __inline void ypcmem ( unsigned char *d, const unsigned char *s, int l )
+{
+        for(d+=l;l--;)*--d=*s++;
+}
+#endif
+
+
+#define BIGNUM2ZEN(n, bn)       (ptr_zencod_init_number((n), \
+                                        (unsigned long) ((bn)->top * BN_BITS2), \
+                                        (unsigned char *) ((bn)->d)))
+
+#define ZEN_BITS(n, bytes)      (ptr_zencod_bytes2bits((unsigned char *) (n), (unsigned long) (bytes)))
+#define ZEN_BYTES(bits) (ptr_zencod_bits2bytes((unsigned long) (bits)))
+
+
+/* Function for ENGINE detection and control */
+static int zencod_destroy ( ENGINE *e ) ;
+static int zencod_init ( ENGINE *e ) ;
+static int zencod_finish ( ENGINE *e ) ;
+static int zencod_ctrl ( ENGINE *e, int cmd, long i, void *p, void (*f) () ) ;
+
+/* BIGNUM stuff */
+static int zencod_bn_mod_exp ( BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx ) ;
+
+/* RSA stuff */
+#ifndef OPENSSL_NO_RSA
+static int RSA_zencod_rsa_mod_exp ( BIGNUM *r0, const BIGNUM *I, RSA *rsa ) ;
+static int RSA_zencod_bn_mod_exp ( BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx ) ;
+#endif
+
+/* DSA stuff */
+#ifndef OPENSSL_NO_DSA
+static int DSA_zencod_bn_mod_exp ( DSA *dsa, BIGNUM *r, BIGNUM *a, const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
+                BN_MONT_CTX *m_ctx ) ;
+
+static DSA_SIG *DSA_zencod_do_sign ( const unsigned char *dgst, int dlen, DSA *dsa ) ;
+static int DSA_zencod_do_verify ( const unsigned char *dgst, int dgst_len, DSA_SIG *sig,
+                DSA *dsa ) ;
+#endif
+
+/* DH stuff */
+#ifndef OPENSSL_NO_DH
+static int DH_zencod_bn_mod_exp ( const DH *dh, BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
+                BN_MONT_CTX *m_ctx ) ;
+static int DH_zencod_generate_key ( DH *dh ) ;
+static int DH_zencod_compute_key ( unsigned char *key, const BIGNUM *pub_key, DH *dh ) ;
+#endif
+
+/* Rand stuff */
+static void RAND_zencod_seed ( const void *buf, int num ) ;
+static int RAND_zencod_rand_bytes ( unsigned char *buf, int num ) ;
+static int RAND_zencod_rand_status ( void ) ;
+
+/* Digest Stuff */
+static int engine_digests ( ENGINE *e, const EVP_MD **digest, const int **nids, int nid ) ;
+
+/* Cipher Stuff */
+static int engine_ciphers ( ENGINE *e, const EVP_CIPHER **cipher, const int **nids, int nid ) ;
+
+
+#define ZENCOD_CMD_SO_PATH                      ENGINE_CMD_BASE
+static const ENGINE_CMD_DEFN zencod_cmd_defns [ ] =
+{
+        { ZENCOD_CMD_SO_PATH,
+          "SO_PATH",
+          "Specifies the path to the 'zenbridge' shared library",
+          ENGINE_CMD_FLAG_STRING},
+        { 0, NULL, NULL, 0 }
+} ;
+
+
+#ifndef OPENSSL_NO_RSA
+/* Our internal RSA_METHOD specific to zencod ENGINE providing pointers to our function */
+static RSA_METHOD zencod_rsa =
+{
+        "ZENCOD RSA method",
+        NULL,
+        NULL,
+        NULL,
+        NULL,
+        RSA_zencod_rsa_mod_exp,
+        RSA_zencod_bn_mod_exp,
+        NULL,
+        NULL,
+        0,
+        NULL,
+        NULL,
+        NULL
+} ;
+#endif
+
+#ifndef OPENSSL_NO_DSA
+/* Our internal DSA_METHOD specific to zencod ENGINE providing pointers to our function */
+static DSA_METHOD zencod_dsa =
+{
+        "ZENCOD DSA method",
+        DSA_zencod_do_sign,
+        NULL,
+        DSA_zencod_do_verify,
+        NULL,
+        DSA_zencod_bn_mod_exp,
+        NULL,
+        NULL,
+        0,
+        NULL
+} ;
+#endif
+
+#ifndef OPENSSL_NO_DH
+/* Our internal DH_METHOD specific to zencod ENGINE providing pointers to our function */
+static DH_METHOD zencod_dh =
+{
+        "ZENCOD DH method",
+        DH_zencod_generate_key,
+        DH_zencod_compute_key,
+        DH_zencod_bn_mod_exp,
+        NULL,
+        NULL,
+        0,
+        NULL
+} ;
+#endif
+
+/* Our internal RAND_meth specific to zencod ZNGINE providing pointers to  our function */
+static RAND_METHOD zencod_rand =
+{
+        RAND_zencod_seed,
+        RAND_zencod_rand_bytes,
+        NULL,
+        NULL,
+        RAND_zencod_rand_bytes,
+        RAND_zencod_rand_status
+} ;
+
+
+/* Constants used when creating the ENGINE */
+static const char *engine_zencod_id = "zencod";
+static const char *engine_zencod_name = "ZENCOD hardware engine support";
+
+
+/* This internal function is used by ENGINE_zencod () and possibly by the
+ * "dynamic" ENGINE support too   ;-)
+ */
+static int bind_helper ( ENGINE *e )
+{
+
+#ifndef OPENSSL_NO_RSA
+        const RSA_METHOD *meth_rsa ;
+#endif
+#ifndef OPENSSL_NO_DSA
+        const DSA_METHOD *meth_dsa ;
+#endif
+#ifndef OPENSSL_NO_DH
+        const DH_METHOD *meth_dh ;
+#endif
+
+        const RAND_METHOD *meth_rand ;
+
+
+        if ( !ENGINE_set_id ( e, engine_zencod_id ) ||
+                        !ENGINE_set_name ( e, engine_zencod_name ) ||
+#ifndef OPENSSL_NO_RSA
+                        !ENGINE_set_RSA ( e, &zencod_rsa ) ||
+#endif
+#ifndef OPENSSL_NO_DSA
+                        !ENGINE_set_DSA ( e, &zencod_dsa ) ||
+#endif
+#ifndef OPENSSL_NO_DH
+                        !ENGINE_set_DH ( e, &zencod_dh ) ||
+#endif
+                        !ENGINE_set_RAND ( e, &zencod_rand ) ||
+
+                        !ENGINE_set_destroy_function ( e, zencod_destroy ) ||
+                        !ENGINE_set_init_function ( e, zencod_init ) ||
+                        !ENGINE_set_finish_function ( e, zencod_finish ) ||
+                        !ENGINE_set_ctrl_function ( e, zencod_ctrl ) ||
+                        !ENGINE_set_cmd_defns ( e, zencod_cmd_defns ) ||
+                        !ENGINE_set_digests ( e, engine_digests ) ||
+                        !ENGINE_set_ciphers ( e, engine_ciphers ) ) {
+                return 0 ;
+        }
+
+#ifndef OPENSSL_NO_RSA
+        /* We know that the "PKCS1_SSLeay()" functions hook properly
+         * to the Zencod-specific mod_exp and mod_exp_crt so we use
+         * those functions. NB: We don't use ENGINE_openssl() or
+         * anything "more generic" because something like the RSAref
+         * code may not hook properly, and if you own one of these
+         * cards then you have the right to do RSA operations on it
+         * anyway!
+         */
+        meth_rsa = RSA_PKCS1_SSLeay () ;
+
+        zencod_rsa.rsa_pub_enc = meth_rsa->rsa_pub_enc ;
+        zencod_rsa.rsa_pub_dec = meth_rsa->rsa_pub_dec ;
+        zencod_rsa.rsa_priv_enc = meth_rsa->rsa_priv_enc ;
+        zencod_rsa.rsa_priv_dec = meth_rsa->rsa_priv_dec ;
+        /* meth_rsa->rsa_mod_exp */
+        /* meth_rsa->bn_mod_exp */
+        zencod_rsa.init = meth_rsa->init ;
+        zencod_rsa.finish = meth_rsa->finish ;
+#endif
+
+#ifndef OPENSSL_NO_DSA
+        /* We use OpenSSL meth to supply what we don't provide ;-*)
+         */
+        meth_dsa = DSA_OpenSSL () ;
+
+        /* meth_dsa->dsa_do_sign */
+        zencod_dsa.dsa_sign_setup = meth_dsa->dsa_sign_setup ;
+        /* meth_dsa->dsa_do_verify */
+        zencod_dsa.dsa_mod_exp = meth_dsa->dsa_mod_exp ;
+        /* zencod_dsa.bn_mod_exp = meth_dsa->bn_mod_exp ; */
+        zencod_dsa.init = meth_dsa->init ;
+        zencod_dsa.finish = meth_dsa->finish ;
+#endif
+
+#ifndef OPENSSL_NO_DH
+        /* We use OpenSSL meth to supply what we don't provide ;-*)
+         */
+        meth_dh = DH_OpenSSL () ;
+
+        /* zencod_dh.generate_key = meth_dh->generate_key ; */
+        /* zencod_dh.compute_key = meth_dh->compute_key ; */
+        /* zencod_dh.bn_mod_exp = meth_dh->bn_mod_exp ; */
+        zencod_dh.init = meth_dh->init ;
+        zencod_dh.finish = meth_dh->finish ;
+
+#endif
+
+        /* We use OpenSSL (SSLeay) meth to supply what we don't provide ;-*)
+         */
+        meth_rand = RAND_SSLeay () ;
+
+        /* meth_rand->seed ; */
+        /* zencod_rand.seed = meth_rand->seed ; */
+        /* meth_rand->bytes ; */
+        /* zencod_rand.bytes = meth_rand->bytes ; */
+        zencod_rand.cleanup = meth_rand->cleanup ;
+        zencod_rand.add = meth_rand->add ;
+        /* meth_rand->pseudorand ; */
+        /* zencod_rand.pseudorand = meth_rand->pseudorand ; */
+        /* zencod_rand.status = meth_rand->status ; */
+        /* meth_rand->status ; */
+
+        /* Ensure the zencod error handling is set up */
+        ERR_load_ZENCOD_strings () ;
+        return 1 ;
+}
+
+
+/* As this is only ever called once, there's no need for locking
+ * (indeed - the lock will already be held by our caller!!!)
+ */
+ENGINE *ENGINE_zencod ( void )
+{
+
+        ENGINE *eng = ENGINE_new () ;
+
+        if ( !eng ) {
+                return NULL ;
+        }
+        if ( !bind_helper ( eng ) ) {
+                ENGINE_free ( eng ) ;
+                return NULL ;
+        }
+
+        return eng ;
+}
+
+
+void ENGINE_load_zencod ( void )
+{
+        /* Copied from eng_[openssl|dyn].c */
+        ENGINE *toadd = ENGINE_zencod ( ) ;
+        if ( !toadd ) return ;
+        ENGINE_add ( toadd ) ;
+        ENGINE_free ( toadd ) ;
+        ERR_clear_error ( ) ;
+}
+
+
+/* This is a process-global DSO handle used for loading and unloading
+ * the ZENBRIDGE library.
+ * NB: This is only set (or unset) during an * init () or finish () call
+ * (reference counts permitting) and they're  * operating with global locks,
+ * so this should be thread-safe * implicitly.
+ */
+static DSO *zencod_dso = NULL ;
+
+static t_zencod_test *ptr_zencod_test = NULL ;
+static t_zencod_bytes2bits *ptr_zencod_bytes2bits = NULL ;
+static t_zencod_bits2bytes *ptr_zencod_bits2bytes = NULL ;
+static t_zencod_new_number *ptr_zencod_new_number = NULL ;
+static t_zencod_init_number *ptr_zencod_init_number = NULL ;
+
+static t_zencod_rsa_mod_exp *ptr_zencod_rsa_mod_exp = NULL ;
+static t_zencod_rsa_mod_exp_crt *ptr_zencod_rsa_mod_exp_crt = NULL ;
+static t_zencod_dsa_do_sign *ptr_zencod_dsa_do_sign = NULL ;
+static t_zencod_dsa_do_verify *ptr_zencod_dsa_do_verify = NULL ;
+static t_zencod_dh_generate_key *ptr_zencod_dh_generate_key = NULL ;
+static t_zencod_dh_compute_key *ptr_zencod_dh_compute_key = NULL ;
+static t_zencod_rand_bytes *ptr_zencod_rand_bytes = NULL ;
+static t_zencod_math_mod_exp *ptr_zencod_math_mod_exp = NULL ;
+
+static t_zencod_md5_init *ptr_zencod_md5_init = NULL ;
+static t_zencod_md5_update *ptr_zencod_md5_update = NULL ;
+static t_zencod_md5_do_final *ptr_zencod_md5_do_final = NULL ;
+static t_zencod_sha1_init *ptr_zencod_sha1_init = NULL ;
+static t_zencod_sha1_update *ptr_zencod_sha1_update = NULL ;
+static t_zencod_sha1_do_final *ptr_zencod_sha1_do_final = NULL ;
+
+static t_zencod_xdes_cipher *ptr_zencod_xdes_cipher = NULL ;
+static t_zencod_rc4_cipher *ptr_zencod_rc4_cipher = NULL ;
+
+/* These are the static string constants for the DSO file name and the function
+ * symbol names to bind to.
+ */
+static const char *ZENCOD_LIBNAME = ZEN_LIBRARY ;
+
+static const char *ZENCOD_Fct_0 = "test_device" ;
+static const char *ZENCOD_Fct_1 = "zenbridge_bytes2bits" ;
+static const char *ZENCOD_Fct_2 = "zenbridge_bits2bytes" ;
+static const char *ZENCOD_Fct_3 = "zenbridge_new_number" ;
+static const char *ZENCOD_Fct_4 = "zenbridge_init_number" ;
+
+static const char *ZENCOD_Fct_exp_1 = "zenbridge_rsa_mod_exp" ;
+static const char *ZENCOD_Fct_exp_2 = "zenbridge_rsa_mod_exp_crt" ;
+static const char *ZENCOD_Fct_dsa_1 = "zenbridge_dsa_do_sign" ;
+static const char *ZENCOD_Fct_dsa_2 = "zenbridge_dsa_do_verify" ;
+static const char *ZENCOD_Fct_dh_1 = "zenbridge_dh_generate_key" ;
+static const char *ZENCOD_Fct_dh_2 = "zenbridge_dh_compute_key" ;
+static const char *ZENCOD_Fct_rand_1 = "zenbridge_rand_bytes" ;
+static const char *ZENCOD_Fct_math_1 = "zenbridge_math_mod_exp" ;
+
+static const char *ZENCOD_Fct_md5_1 = "zenbridge_md5_init" ;
+static const char *ZENCOD_Fct_md5_2 = "zenbridge_md5_update" ;
+static const char *ZENCOD_Fct_md5_3 = "zenbridge_md5_do_final" ;
+static const char *ZENCOD_Fct_sha1_1 = "zenbridge_sha1_init" ;
+static const char *ZENCOD_Fct_sha1_2 = "zenbridge_sha1_update" ;
+static const char *ZENCOD_Fct_sha1_3 = "zenbridge_sha1_do_final" ;
+
+static const char *ZENCOD_Fct_xdes_1 = "zenbridge_xdes_cipher" ;
+static const char *ZENCOD_Fct_rc4_1 = "zenbridge_rc4_cipher" ;
+
+/* Destructor (complements the "ENGINE_zencod ()" constructor)
+ */
+static int zencod_destroy (ENGINE *e )
+{
+
+        ERR_unload_ZENCOD_strings () ;
+
+        return 1 ;
+}
+
+
+/* (de)initialisation functions. Control Function
+ */
+static int zencod_init ( ENGINE *e )
+{
+
+        t_zencod_test *ptr_0 ;
+        t_zencod_bytes2bits *ptr_1 ;
+        t_zencod_bits2bytes *ptr_2 ;
+        t_zencod_new_number *ptr_3 ;
+        t_zencod_init_number *ptr_4 ;
+        t_zencod_rsa_mod_exp *ptr_exp_1 ;
+        t_zencod_rsa_mod_exp_crt *ptr_exp_2 ;
+        t_zencod_dsa_do_sign *ptr_dsa_1 ;
+        t_zencod_dsa_do_verify *ptr_dsa_2 ;
+        t_zencod_dh_generate_key *ptr_dh_1 ;
+        t_zencod_dh_compute_key *ptr_dh_2 ;
+        t_zencod_rand_bytes *ptr_rand_1 ;
+        t_zencod_math_mod_exp *ptr_math_1 ;
+        t_zencod_md5_init *ptr_md5_1 ;
+        t_zencod_md5_update *ptr_md5_2 ;
+        t_zencod_md5_do_final *ptr_md5_3 ;
+        t_zencod_sha1_init *ptr_sha1_1 ;
+        t_zencod_sha1_update *ptr_sha1_2 ;
+        t_zencod_sha1_do_final *ptr_sha1_3 ;
+        t_zencod_xdes_cipher *ptr_xdes_1 ;
+        t_zencod_rc4_cipher *ptr_rc4_1 ;
+
+        CHEESE () ;
+
+        /*
+         * We Should add some tests for non NULL parameters or bad value !!
+         * Stuff to be done ...
+         */
+
+        if ( zencod_dso != NULL ) {
+                ZENCODerr ( ZENCOD_F_ZENCOD_INIT, ZENCOD_R_ALREADY_LOADED ) ;
+                goto err ;
+        }
+        /* Trying to load the Library "cryptozen"
+         */
+        zencod_dso = DSO_load ( NULL, ZENCOD_LIBNAME, NULL, 0 ) ;
+        if ( zencod_dso == NULL ) {
+                ZENCODerr ( ZENCOD_F_ZENCOD_INIT, ZENCOD_R_DSO_FAILURE ) ;
+                goto err ;
+        }
+
+        /* Trying to load Function from the Library
+         */
+        if ( ! ( ptr_1 = (t_zencod_bytes2bits*) DSO_bind_func ( zencod_dso, ZENCOD_Fct_1 ) ) ||
+                        ! ( ptr_2 = (t_zencod_bits2bytes*) DSO_bind_func ( zencod_dso, ZENCOD_Fct_2 ) ) ||
+                        ! ( ptr_3 = (t_zencod_new_number*) DSO_bind_func ( zencod_dso, ZENCOD_Fct_3 ) ) ||
+                        ! ( ptr_4 = (t_zencod_init_number*) DSO_bind_func ( zencod_dso, ZENCOD_Fct_4 ) ) ||
+                        ! ( ptr_exp_1 = (t_zencod_rsa_mod_exp*) DSO_bind_func ( zencod_dso, ZENCOD_Fct_exp_1 ) ) ||
+                        ! ( ptr_exp_2 = (t_zencod_rsa_mod_exp_crt*) DSO_bind_func ( zencod_dso, ZENCOD_Fct_exp_2 ) ) ||
+                        ! ( ptr_dsa_1 = (t_zencod_dsa_do_sign*) DSO_bind_func ( zencod_dso, ZENCOD_Fct_dsa_1 ) ) ||
+                        ! ( ptr_dsa_2 = (t_zencod_dsa_do_verify*) DSO_bind_func ( zencod_dso, ZENCOD_Fct_dsa_2 ) ) ||
+                        ! ( ptr_dh_1 = (t_zencod_dh_generate_key*) DSO_bind_func ( zencod_dso, ZENCOD_Fct_dh_1 ) ) ||
+                        ! ( ptr_dh_2 = (t_zencod_dh_compute_key*) DSO_bind_func ( zencod_dso, ZENCOD_Fct_dh_2 ) ) ||
+                        ! ( ptr_rand_1 = (t_zencod_rand_bytes*) DSO_bind_func ( zencod_dso, ZENCOD_Fct_rand_1 ) ) ||
+                        ! ( ptr_math_1 = (t_zencod_math_mod_exp*) DSO_bind_func ( zencod_dso, ZENCOD_Fct_math_1 ) ) ||
+                        ! ( ptr_0 = (t_zencod_test *) DSO_bind_func ( zencod_dso, ZENCOD_Fct_0 ) ) ||
+                        ! ( ptr_md5_1 = (t_zencod_md5_init *) DSO_bind_func ( zencod_dso, ZENCOD_Fct_md5_1 ) ) ||
+                        ! ( ptr_md5_2 = (t_zencod_md5_update *) DSO_bind_func ( zencod_dso, ZENCOD_Fct_md5_2 ) ) ||
+                        ! ( ptr_md5_3 = (t_zencod_md5_do_final *) DSO_bind_func ( zencod_dso, ZENCOD_Fct_md5_3 ) ) ||
+                        ! ( ptr_sha1_1 = (t_zencod_sha1_init *) DSO_bind_func ( zencod_dso, ZENCOD_Fct_sha1_1 ) ) ||
+                        ! ( ptr_sha1_2 = (t_zencod_sha1_update *) DSO_bind_func ( zencod_dso, ZENCOD_Fct_sha1_2 ) ) ||
+                        ! ( ptr_sha1_3 = (t_zencod_sha1_do_final *) DSO_bind_func ( zencod_dso, ZENCOD_Fct_sha1_3 ) ) ||
+                        ! ( ptr_xdes_1 = (t_zencod_xdes_cipher *) DSO_bind_func ( zencod_dso, ZENCOD_Fct_xdes_1 ) ) ||
+                        ! ( ptr_rc4_1 = (t_zencod_rc4_cipher *) DSO_bind_func ( zencod_dso, ZENCOD_Fct_rc4_1 ) ) ) {
+
+                ZENCODerr ( ZENCOD_F_ZENCOD_INIT, ZENCOD_R_DSO_FAILURE ) ;
+                goto err ;
+        }
+
+        /* The function from "cryptozen" Library have been correctly loaded so copy them
+         */
+        ptr_zencod_test = ptr_0 ;
+        ptr_zencod_bytes2bits = ptr_1 ;
+        ptr_zencod_bits2bytes = ptr_2 ;
+        ptr_zencod_new_number = ptr_3 ;
+        ptr_zencod_init_number = ptr_4 ;
+        ptr_zencod_rsa_mod_exp = ptr_exp_1 ;
+        ptr_zencod_rsa_mod_exp_crt = ptr_exp_2 ;
+        ptr_zencod_dsa_do_sign = ptr_dsa_1 ;
+        ptr_zencod_dsa_do_verify = ptr_dsa_2 ;
+        ptr_zencod_dh_generate_key = ptr_dh_1 ;
+        ptr_zencod_dh_compute_key = ptr_dh_2 ;
+        ptr_zencod_rand_bytes = ptr_rand_1 ;
+        ptr_zencod_math_mod_exp = ptr_math_1 ;
+        ptr_zencod_test = ptr_0 ;
+        ptr_zencod_md5_init = ptr_md5_1 ;
+        ptr_zencod_md5_update = ptr_md5_2 ;
+        ptr_zencod_md5_do_final = ptr_md5_3 ;
+        ptr_zencod_sha1_init = ptr_sha1_1 ;
+        ptr_zencod_sha1_update = ptr_sha1_2 ;
+        ptr_zencod_sha1_do_final = ptr_sha1_3 ;
+        ptr_zencod_xdes_cipher = ptr_xdes_1 ;
+        ptr_zencod_rc4_cipher = ptr_rc4_1 ;
+
+        /* We should peform a test to see if there is actually any unit runnig on the system ...
+         * Even if the cryptozen library is loaded the module coul not be loaded on the system ...
+         * For now we may just open and close the device !!
+         */
+
+        if ( ptr_zencod_test () != 0 ) {
+                ZENCODerr ( ZENCOD_F_ZENCOD_INIT, ZENCOD_R_UNIT_FAILURE ) ;
+                goto err ;
+        }
+
+        return 1 ;
+err :
+        if ( zencod_dso ) {
+                DSO_free ( zencod_dso ) ;
+        }
+        zencod_dso = NULL ;
+        ptr_zencod_bytes2bits = NULL ;
+        ptr_zencod_bits2bytes = NULL ;
+        ptr_zencod_new_number = NULL ;
+        ptr_zencod_init_number = NULL ;
+        ptr_zencod_rsa_mod_exp = NULL ;
+        ptr_zencod_rsa_mod_exp_crt = NULL ;
+        ptr_zencod_dsa_do_sign = NULL ;
+        ptr_zencod_dsa_do_verify = NULL ;
+        ptr_zencod_dh_generate_key = NULL ;
+        ptr_zencod_dh_compute_key = NULL ;
+        ptr_zencod_rand_bytes = NULL ;
+        ptr_zencod_math_mod_exp = NULL ;
+        ptr_zencod_test = NULL ;
+        ptr_zencod_md5_init = NULL ;
+        ptr_zencod_md5_update = NULL ;
+        ptr_zencod_md5_do_final = NULL ;
+        ptr_zencod_sha1_init = NULL ;
+        ptr_zencod_sha1_update = NULL ;
+        ptr_zencod_sha1_do_final = NULL ;
+        ptr_zencod_xdes_cipher = NULL ;
+        ptr_zencod_rc4_cipher = NULL ;
+
+        return 0 ;
+}
+
+
+static int zencod_finish ( ENGINE *e )
+{
+
+        CHEESE () ;
+
+        /*
+         * We Should add some tests for non NULL parameters or bad value !!
+         * Stuff to be done ...
+         */
+        if ( zencod_dso == NULL ) {
+                ZENCODerr ( ZENCOD_F_ZENCOD_FINISH, ZENCOD_R_NOT_LOADED ) ;
+                return 0 ;
+        }
+        if ( !DSO_free ( zencod_dso ) ) {
+                ZENCODerr ( ZENCOD_F_ZENCOD_FINISH, ZENCOD_R_DSO_FAILURE ) ;
+                return 0 ;
+        }
+
+        zencod_dso = NULL ;
+
+        ptr_zencod_bytes2bits = NULL ;
+        ptr_zencod_bits2bytes = NULL ;
+        ptr_zencod_new_number = NULL ;
+        ptr_zencod_init_number = NULL ;
+        ptr_zencod_rsa_mod_exp = NULL ;
+        ptr_zencod_rsa_mod_exp_crt = NULL ;
+        ptr_zencod_dsa_do_sign = NULL ;
+        ptr_zencod_dsa_do_verify = NULL ;
+        ptr_zencod_dh_generate_key = NULL ;
+        ptr_zencod_dh_compute_key = NULL ;
+        ptr_zencod_rand_bytes = NULL ;
+        ptr_zencod_math_mod_exp = NULL ;
+        ptr_zencod_test = NULL ;
+        ptr_zencod_md5_init = NULL ;
+        ptr_zencod_md5_update = NULL ;
+        ptr_zencod_md5_do_final = NULL ;
+        ptr_zencod_sha1_init = NULL ;
+        ptr_zencod_sha1_update = NULL ;
+        ptr_zencod_sha1_do_final = NULL ;
+        ptr_zencod_xdes_cipher = NULL ;
+        ptr_zencod_rc4_cipher = NULL ;
+
+        return 1 ;
+}
+
+
+static int zencod_ctrl ( ENGINE *e, int cmd, long i, void *p, void (*f) () )
+{
+
+        int initialised = ( ( zencod_dso == NULL ) ? 0 : 1 ) ;
+
+        CHEESE () ;
+
+        /*
+         * We Should add some tests for non NULL parameters or bad value !!
+         * Stuff to be done ...
+         */
+        switch ( cmd ) {
+        case ZENCOD_CMD_SO_PATH :
+                if ( p == NULL ) {
+                        ZENCODerr ( ZENCOD_F_ZENCOD_CTRL, ERR_R_PASSED_NULL_PARAMETER ) ;
+                        return 0 ;
+                }
+                if ( initialised ) {
+                        ZENCODerr ( ZENCOD_F_ZENCOD_CTRL, ZENCOD_R_ALREADY_LOADED ) ;
+                        return 0 ;
+                }
+                ZENCOD_LIBNAME = (const char *) p ;
+                return 1 ;
+        default :
+                break ;
+        }
+
+        ZENCODerr ( ZENCOD_F_ZENCOD_CTRL, ZENCOD_R_CTRL_COMMAND_NOT_IMPLEMENTED ) ;
+
+        return 0 ;
+}
+
+
+/* BIGNUM stuff Functions
+ */
+static int zencod_bn_mod_exp ( BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx )
+{
+        zen_nb_t y, x, e, n;
+        int ret;
+
+        CHEESE () ;
+
+        if ( !zencod_dso ) {
+                ENGINEerr(ZENCOD_F_ZENCOD_BN_MOD_EXP, ZENCOD_R_NOT_LOADED);
+                return 0;
+        }
+
+        if ( !bn_wexpand(r, m->top + 1) ) {
+                ENGINEerr(ZENCOD_F_ZENCOD_BN_MOD_EXP, ZENCOD_R_BN_EXPAND_FAIL);
+                return 0;
+        }
+
+        memset(r->d, 0, BN_num_bytes(m));
+
+        ptr_zencod_init_number ( &y, (r->dmax - 1) * sizeof (BN_ULONG) * 8, (unsigned char *) r->d ) ;
+        BIGNUM2ZEN ( &x, a ) ;
+        BIGNUM2ZEN ( &e, p ) ;
+        BIGNUM2ZEN ( &n, m ) ;
+
+        /* Must invert x and e parameter due to BN mod exp prototype ... */
+        ret = ptr_zencod_math_mod_exp ( &y, &e, &x, &n ) ;
+
+        if ( ret )  {
+                PERROR("zenbridge_math_mod_exp");
+                ENGINEerr(ZENCOD_F_ZENCOD_BN_MOD_EXP, ZENCOD_R_REQUEST_FAILED);
+                return 0;
+        }
+
+        r->top = (BN_num_bits(m) + BN_BITS2 - 1) / BN_BITS2;
+
+        return 1;
+}
+
+
+/* RSA stuff Functions
+ */
+#ifndef OPENSSL_NO_RSA
+static int RSA_zencod_rsa_mod_exp ( BIGNUM *r0, const BIGNUM *i, RSA *rsa )
+{
+
+        CHEESE () ;
+
+        if ( !zencod_dso ) {
+                ENGINEerr(ZENCOD_F_ZENCOD_RSA_MOD_EXP_CRT, ZENCOD_R_NOT_LOADED);
+                return 0;
+        }
+
+        if ( !rsa->p || !rsa->q || !rsa->dmp1 || !rsa->dmq1 || !rsa->iqmp ) {
+                ENGINEerr(ZENCOD_F_ZENCOD_RSA_MOD_EXP_CRT, ZENCOD_R_BAD_KEY_COMPONENTS);
+                return 0;
+        }
+
+        /* Do in software if argument is too large for hardware */
+        if ( RSA_size(rsa) * 8 > ZENBRIDGE_MAX_KEYSIZE_RSA_CRT ) {
+                const RSA_METHOD *meth;
+
+                meth = RSA_PKCS1_SSLeay();
+                return meth->rsa_mod_exp(r0, i, rsa);
+        } else {
+                zen_nb_t y, x, p, q, dmp1, dmq1, iqmp;
+
+                if ( !bn_expand(r0, RSA_size(rsa) * 8) ) {
+                        ENGINEerr(ZENCOD_F_ZENCOD_RSA_MOD_EXP_CRT, ZENCOD_R_BN_EXPAND_FAIL);
+                        return 0;
+                }
+                r0->top = (RSA_size(rsa) * 8 + BN_BITS2 - 1) / BN_BITS2;
+
+                BIGNUM2ZEN ( &x, i ) ;
+                BIGNUM2ZEN ( &y, r0 ) ;
+                BIGNUM2ZEN ( &p, rsa->p ) ;
+                BIGNUM2ZEN ( &q, rsa->q ) ;
+                BIGNUM2ZEN ( &dmp1, rsa->dmp1 ) ;
+                BIGNUM2ZEN ( &dmq1, rsa->dmq1 ) ;
+                BIGNUM2ZEN ( &iqmp, rsa->iqmp ) ;
+
+                if ( ptr_zencod_rsa_mod_exp_crt ( &y, &x, &p, &q, &dmp1, &dmq1, &iqmp ) < 0 ) {
+                        PERROR("zenbridge_rsa_mod_exp_crt");
+                        ENGINEerr(ZENCOD_F_ZENCOD_RSA_MOD_EXP_CRT, ZENCOD_R_REQUEST_FAILED);
+                        return 0;
+                }
+
+                return 1;
+        }
+}
+
+
+/* This function is aliased to RSA_mod_exp (with the mont stuff dropped).
+ */
+static int RSA_zencod_bn_mod_exp ( BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+                const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx )
+{
+
+        CHEESE () ;
+
+        if ( !zencod_dso ) {
+                ENGINEerr(ZENCOD_F_ZENCOD_RSA_MOD_EXP, ZENCOD_R_NOT_LOADED);
+                return 0;
+        }
+
+        /* Do in software if argument is too large for hardware */
+        if ( BN_num_bits(m) > ZENBRIDGE_MAX_KEYSIZE_RSA ) {
+                const RSA_METHOD *meth;
+
+                meth = RSA_PKCS1_SSLeay();
+                return meth->bn_mod_exp(r, a, p, m, ctx, m_ctx);
+        } else {
+                zen_nb_t y, x, e, n;
+
+                if ( !bn_expand(r, BN_num_bits(m)) ) {
+                        ENGINEerr(ZENCOD_F_ZENCOD_RSA_MOD_EXP, ZENCOD_R_BN_EXPAND_FAIL);
+                        return 0;
+                }
+                r->top = (BN_num_bits(m) + BN_BITS2 - 1) / BN_BITS2;
+
+                BIGNUM2ZEN ( &x, a ) ;
+                BIGNUM2ZEN ( &y, r ) ;
+                BIGNUM2ZEN ( &e, p ) ;
+                BIGNUM2ZEN ( &n, m ) ;
+
+                if ( ptr_zencod_rsa_mod_exp ( &y, &x, &n, &e ) < 0 ) {
+                        PERROR("zenbridge_rsa_mod_exp");
+                        ENGINEerr(ZENCOD_F_ZENCOD_RSA_MOD_EXP, ZENCOD_R_REQUEST_FAILED);
+                        return 0;
+                }
+
+                return 1;
+        }
+}
+#endif /* !OPENSSL_NO_RSA */
+
+
+#ifndef OPENSSL_NO_DSA
+/* DSA stuff Functions
+ */
+static DSA_SIG *DSA_zencod_do_sign ( const unsigned char *dgst, int dlen, DSA *dsa )
+{
+        zen_nb_t p, q, g, x, y, r, s, data;
+        DSA_SIG *sig;
+        BIGNUM *bn_r = NULL;
+        BIGNUM *bn_s = NULL;
+        char msg[20];
+
+        CHEESE();
+
+        if ( !zencod_dso ) {
+                ENGINEerr(ZENCOD_F_ZENCOD_DSA_DO_SIGN, ZENCOD_R_NOT_LOADED);
+                goto FAILED;
+        }
+
+        if ( dlen > 160 ) {
+                ENGINEerr(ZENCOD_F_ZENCOD_DSA_DO_SIGN, ZENCOD_R_REQUEST_FAILED);
+                goto FAILED;
+        }
+
+        /* Do in software if argument is too large for hardware */
+        if ( BN_num_bits(dsa->p) > ZENBRIDGE_MAX_KEYSIZE_DSA_SIGN ||
+                BN_num_bits(dsa->g) > ZENBRIDGE_MAX_KEYSIZE_DSA_SIGN ) {
+                const DSA_METHOD *meth;
+                ENGINEerr(ZENCOD_F_ZENCOD_DSA_DO_SIGN, ZENCOD_R_BAD_KEY_COMPONENTS);
+                meth = DSA_OpenSSL();
+                return meth->dsa_do_sign(dgst, dlen, dsa);
+        }
+
+        if ( !(bn_s = BN_new()) || !(bn_r = BN_new()) ) {
+                ENGINEerr(ZENCOD_F_ZENCOD_DSA_DO_SIGN, ZENCOD_R_BAD_KEY_COMPONENTS);
+                goto FAILED;
+        }
+
+        if ( !bn_expand(bn_r, 160) || !bn_expand(bn_s, 160) ) {
+                ENGINEerr(ZENCOD_F_ZENCOD_DSA_DO_SIGN, ZENCOD_R_BN_EXPAND_FAIL);
+                goto FAILED;
+        }
+
+        bn_r->top = bn_s->top = (160 + BN_BITS2 - 1) / BN_BITS2;
+        BIGNUM2ZEN ( &p, dsa->p ) ;
+        BIGNUM2ZEN ( &q, dsa->q ) ;
+        BIGNUM2ZEN ( &g, dsa->g ) ;
+        BIGNUM2ZEN ( &x, dsa->priv_key ) ;
+        BIGNUM2ZEN ( &y, dsa->pub_key ) ;
+        BIGNUM2ZEN ( &r, bn_r ) ;
+        BIGNUM2ZEN ( &s, bn_s ) ;
+        q.len = x.len = 160;
+
+        ypcmem(msg, dgst, 20);
+        ptr_zencod_init_number ( &data, 160, msg ) ;
+
+        if ( ptr_zencod_dsa_do_sign ( 0, &data, &y, &p, &q, &g, &x, &r, &s ) < 0 ) {
+                PERROR("zenbridge_dsa_do_sign");
+                ENGINEerr(ZENCOD_F_ZENCOD_DSA_DO_SIGN, ZENCOD_R_REQUEST_FAILED);
+                goto FAILED;
+        }
+
+        if ( !( sig = DSA_SIG_new () ) ) {
+                ENGINEerr(ZENCOD_F_ZENCOD_DSA_DO_SIGN, ZENCOD_R_REQUEST_FAILED);
+                goto FAILED;
+        }
+        sig->r = bn_r;
+        sig->s = bn_s;
+        return sig;
+
+ FAILED:
+        if (bn_r)
+                BN_free(bn_r);
+        if (bn_s)
+                BN_free(bn_s);
+        return NULL;
+}
+
+
+static int DSA_zencod_do_verify ( const unsigned char *dgst, int dlen, DSA_SIG *sig, DSA *dsa )
+{
+        zen_nb_t data, p, q, g, y, r, s, v;
+        char msg[20];
+        char v_data[20];
+        int ret;
+
+        CHEESE();
+
+        if ( !zencod_dso ) {
+                ENGINEerr(ZENCOD_F_ZENCOD_DSA_DO_VERIFY, ZENCOD_R_NOT_LOADED);
+                return 0;
+        }
+
+        if ( dlen > 160 ) {
+                ENGINEerr(ZENCOD_F_ZENCOD_DSA_DO_SIGN, ZENCOD_R_REQUEST_FAILED);
+                return 0;
+        }
+
+        /* Do in software if argument is too large for hardware */
+        if ( BN_num_bits(dsa->p) > ZENBRIDGE_MAX_KEYSIZE_DSA_SIGN ||
+                BN_num_bits(dsa->g) > ZENBRIDGE_MAX_KEYSIZE_DSA_SIGN ) {
+                const DSA_METHOD *meth;
+                ENGINEerr(ZENCOD_F_ZENCOD_DSA_DO_SIGN, ZENCOD_R_BAD_KEY_COMPONENTS);
+                meth = DSA_OpenSSL();
+                return meth->dsa_do_verify(dgst, dlen, sig, dsa);
+        }
+
+        BIGNUM2ZEN ( &p, dsa->p ) ;
+        BIGNUM2ZEN ( &q, dsa->q ) ;
+        BIGNUM2ZEN ( &g, dsa->g ) ;
+        BIGNUM2ZEN ( &y, dsa->pub_key ) ;
+        BIGNUM2ZEN ( &r, sig->r ) ;
+        BIGNUM2ZEN ( &s, sig->s ) ;
+        ptr_zencod_init_number ( &v, 160, v_data ) ;
+        ypcmem(msg, dgst, 20);
+        ptr_zencod_init_number ( &data, 160, msg ) ;
+
+        if ( ( ret = ptr_zencod_dsa_do_verify ( 0, &data, &p, &q, &g, &y, &r, &s, &v ) ) < 0 ) {
+                PERROR("zenbridge_dsa_do_verify");
+                ENGINEerr(ZENCOD_F_ZENCOD_DSA_DO_VERIFY, ZENCOD_R_REQUEST_FAILED);
+                return 0;
+        }
+
+        return ( ( ret == 0 ) ? 1 : ret ) ;
+}
+
+
+static int DSA_zencod_bn_mod_exp ( DSA *dsa, BIGNUM *r, BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
+                             BN_CTX *ctx, BN_MONT_CTX *m_ctx )
+{
+        CHEESE () ;
+
+        return zencod_bn_mod_exp ( r, a, p, m, ctx ) ;
+}
+#endif /* !OPENSSL_NO_DSA */
+
+
+#ifndef OPENSSl_NO_DH
+/* DH stuff Functions
+ */
+static int DH_zencod_generate_key ( DH *dh )
+{
+        BIGNUM *bn_prv = NULL;
+        BIGNUM *bn_pub = NULL;
+        zen_nb_t y, x, g, p;
+        int generate_x;
+
+        CHEESE();
+
+        if ( !zencod_dso ) {
+                ENGINEerr(ZENCOD_F_ZENCOD_DH_GENERATE, ZENCOD_R_NOT_LOADED);
+                return 0;
+        }
+
+        /* Private key */
+        if ( dh->priv_key ) {
+                bn_prv = dh->priv_key;
+                generate_x = 0;
+        } else {
+                if (!(bn_prv = BN_new())) {
+                        ENGINEerr(ZENCOD_F_ZENCOD_DH_GENERATE, ZENCOD_R_BN_EXPAND_FAIL);
+                        goto FAILED;
+                }
+                generate_x = 1;
+        }
+
+        /* Public key */
+        if ( dh->pub_key )
+                bn_pub = dh->pub_key;
+        else
+                if ( !( bn_pub = BN_new () ) ) {
+                        ENGINEerr(ZENCOD_F_ZENCOD_DH_GENERATE, ZENCOD_R_BN_EXPAND_FAIL);
+                        goto FAILED;
+                }
+
+        /* Expand */
+        if ( !bn_wexpand ( bn_prv, dh->p->dmax ) ||
+            !bn_wexpand ( bn_pub, dh->p->dmax ) ) {
+                ENGINEerr(ZENCOD_F_ZENCOD_DH_GENERATE, ZENCOD_R_BN_EXPAND_FAIL);
+                goto FAILED;
+        }
+        bn_prv->top = dh->p->top;
+        bn_pub->top = dh->p->top;
+
+        /* Convert all keys */
+        BIGNUM2ZEN ( &p, dh->p ) ;
+        BIGNUM2ZEN ( &g, dh->g ) ;
+        BIGNUM2ZEN ( &y, bn_pub ) ;
+        BIGNUM2ZEN ( &x, bn_prv ) ;
+        x.len = DH_size(dh) * 8;
+
+        /* Adjust the lengths of P and G */
+        p.len = ptr_zencod_bytes2bits ( p.data, ZEN_BYTES ( p.len ) ) ;
+        g.len = ptr_zencod_bytes2bits ( g.data, ZEN_BYTES ( g.len ) ) ;
+
+        /* Send the request to the driver */
+        if ( ptr_zencod_dh_generate_key ( &y, &x, &g, &p, generate_x ) < 0 ) {
+                perror("zenbridge_dh_generate_key");
+                ENGINEerr(ZENCOD_F_ZENCOD_DH_GENERATE, ZENCOD_R_REQUEST_FAILED);
+                goto FAILED;
+        }
+
+        dh->priv_key = bn_prv;
+        dh->pub_key  = bn_pub;
+
+        return 1;
+
+ FAILED:
+        if (!dh->priv_key && bn_prv)
+                BN_free(bn_prv);
+        if (!dh->pub_key && bn_pub)
+                BN_free(bn_pub);
+
+        return 0;
+}
+
+
+static int DH_zencod_compute_key ( unsigned char *key, const BIGNUM *pub_key, DH *dh )
+{
+        zen_nb_t y, x, p, k;
+
+        CHEESE();
+
+        if ( !zencod_dso ) {
+                ENGINEerr(ZENCOD_F_ZENCOD_DH_COMPUTE, ZENCOD_R_NOT_LOADED);
+                return 0;
+        }
+
+        if ( !dh->priv_key ) {
+                ENGINEerr(ZENCOD_F_ZENCOD_DH_COMPUTE, ZENCOD_R_BAD_KEY_COMPONENTS);
+                return 0;
+        }
+
+        /* Convert all keys */
+        BIGNUM2ZEN ( &y, pub_key ) ;
+        BIGNUM2ZEN ( &x, dh->priv_key ) ;
+        BIGNUM2ZEN ( &p, dh->p ) ;
+        ptr_zencod_init_number ( &k, p.len, key ) ;
+
+        /* Adjust the lengths */
+        p.len = ptr_zencod_bytes2bits ( p.data, ZEN_BYTES ( p.len ) ) ;
+        y.len = ptr_zencod_bytes2bits ( y.data, ZEN_BYTES ( y.len ) ) ;
+        x.len = ptr_zencod_bytes2bits ( x.data, ZEN_BYTES ( x.len ) ) ;
+
+        /* Call the hardware */
+        if ( ptr_zencod_dh_compute_key ( &k, &y, &x, &p ) < 0 ) {
+                ENGINEerr(ZENCOD_F_ZENCOD_DH_COMPUTE, ZENCOD_R_REQUEST_FAILED);
+                return 0;
+        }
+
+        /* The key must be written MSB -> LSB */
+        k.len = ptr_zencod_bytes2bits ( k.data, ZEN_BYTES ( k.len ) ) ;
+        esrever ( key, ZEN_BYTES ( k.len ) ) ;
+
+        return ZEN_BYTES ( k.len ) ;
+}
+
+
+static int DH_zencod_bn_mod_exp ( const DH *dh, BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
+                BN_MONT_CTX *m_ctx )
+{
+        CHEESE () ;
+
+        return zencod_bn_mod_exp ( r, a, p, m, ctx ) ;
+}
+#endif  /* !OPENSSL_NO_DH */
+
+
+/* RAND stuff Functions
+ */
+static void RAND_zencod_seed ( const void *buf, int num )
+{
+        /* Nothing to do cause our crypto accelerator provide a true random generator */
+}
+
+
+static int RAND_zencod_rand_bytes ( unsigned char *buf, int num )
+{
+        zen_nb_t r;
+
+        CHEESE();
+
+        if ( !zencod_dso ) {
+                ENGINEerr(ZENCOD_F_ZENCOD_RAND, ZENCOD_R_NOT_LOADED);
+                return 0;
+        }
+
+        ptr_zencod_init_number ( &r, num * 8, buf ) ;
+
+        if ( ptr_zencod_rand_bytes ( &r, ZENBRIDGE_RNG_DIRECT ) < 0 ) {
+                PERROR("zenbridge_rand_bytes");
+                ENGINEerr(ZENCOD_F_ZENCOD_RAND, ZENCOD_R_REQUEST_FAILED);
+                return 0;
+        }
+
+        return 1;
+}
+
+
+static int RAND_zencod_rand_status ( void )
+{
+        CHEESE () ;
+
+        return 1;
+}
+
+
+/* This stuff is needed if this ENGINE is being compiled into a self-contained
+ * shared-library.
+ */
+#ifdef ENGINE_DYNAMIC_SUPPORT
+static int bind_fn ( ENGINE *e, const char *id )
+{
+
+        if ( id && ( strcmp ( id, engine_zencod_id ) != 0 ) ) {
+                return 0 ;
+        }
+        if ( !bind_helper ( e ) )  {
+                return 0 ;
+        }
+
+        return 1 ;
+}
+
+IMPLEMENT_DYNAMIC_CHECK_FN ()
+IMPLEMENT_DYNAMIC_BIND_FN ( bind_fn )
+#endif /* ENGINE_DYNAMIC_SUPPORT */
+
+
+
+
+/*
+ * Adding "Digest" and "Cipher" tools ...
+ * This is in development ... ;-)
+ * In orfer to code this, i refer to hw_openbsd_dev_crypto and openssl engine made by Geoff Thorpe (if i'm rigth),
+ * and evp, sha md5 definitions etc ...
+ */
+/* First add some include ... */
+#include <openssl/evp.h>
+#include <openssl/sha.h>
+#include <openssl/md5.h>
+#include <openssl/rc4.h>
+#include <openssl/des.h>
+
+
+/* Some variables declaration ... */
+/* DONS:
+ * Disable symetric computation except DES and 3DES, but let part of the code
+ */
+/* static int engine_digest_nids [ ] = { NID_sha1, NID_md5 } ; */
+static int engine_digest_nids [ ] = {  } ;
+static int engine_digest_nids_num = 0 ;
+/* static int engine_cipher_nids [ ] = { NID_rc4, NID_rc4_40, NID_des_cbc, NID_des_ede3_cbc } ; */
+static int engine_cipher_nids [ ] = { NID_des_cbc, NID_des_ede3_cbc } ;
+static int engine_cipher_nids_num = 2 ;
+
+
+/* Function prototype ... */
+/*  SHA stuff */
+static int engine_sha1_init ( EVP_MD_CTX *ctx ) ;
+static int engine_sha1_update ( EVP_MD_CTX *ctx, const void *data, unsigned long count ) ;
+static int engine_sha1_final ( EVP_MD_CTX *ctx, unsigned char *md ) ;
+
+/*  MD5 stuff */
+static int engine_md5_init ( EVP_MD_CTX *ctx ) ;
+static int engine_md5_update ( EVP_MD_CTX *ctx, const void *data, unsigned long count ) ;
+static int engine_md5_final ( EVP_MD_CTX *ctx, unsigned char *md ) ;
+
+static int engine_md_cleanup ( EVP_MD_CTX *ctx ) ;
+static int engine_md_copy ( EVP_MD_CTX *to, const EVP_MD_CTX *from ) ;
+
+
+/* RC4 Stuff */
+static int engine_rc4_init_key ( EVP_CIPHER_CTX *ctx, const unsigned char *key, const unsigned char *iv, int enc ) ;
+static int engine_rc4_cipher ( EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *in, unsigned int inl ) ;
+
+/* DES Stuff */
+static int engine_des_init_key ( EVP_CIPHER_CTX *ctx, const unsigned char *key, const unsigned char *iv, int enc ) ;
+static int engine_des_cbc_cipher ( EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *in, unsigned int inl ) ;
+
+/*  3DES Stuff */
+static int engine_des_ede3_init_key ( EVP_CIPHER_CTX *ctx, const unsigned char *key, const unsigned char *iv, int enc ) ;
+static int engine_des_ede3_cbc_cipher ( EVP_CIPHER_CTX *ctx, unsigned char *out,const unsigned char *in, unsigned int inl ) ;
+
+static int engine_cipher_cleanup ( EVP_CIPHER_CTX *ctx ) ;      /* cleanup ctx */
+
+
+/* The one for SHA ... */
+static const EVP_MD engine_sha1_md =
+{
+        NID_sha1,
+        NID_sha1WithRSAEncryption,
+        SHA_DIGEST_LENGTH,
+        EVP_MD_FLAG_ONESHOT,
+        /* 0, */                        /* EVP_MD_FLAG_ONESHOT = x0001 digest can only handle a single block
+                                * XXX: set according to device info ... */
+        engine_sha1_init,
+        engine_sha1_update,
+        engine_sha1_final,
+        engine_md_copy,         /* dev_crypto_sha_copy */
+        engine_md_cleanup,              /* dev_crypto_sha_cleanup */
+        EVP_PKEY_RSA_method,
+        SHA_CBLOCK,
+        /* sizeof ( EVP_MD * ) + sizeof ( SHA_CTX ) */
+        sizeof ( ZEN_MD_DATA )
+        /* sizeof ( MD_CTX_DATA )       The message digest data stucture ... */
+} ;
+
+/* The one for MD5 ... */
+static const EVP_MD engine_md5_md =
+{
+        NID_md5,
+        NID_md5WithRSAEncryption,
+        MD5_DIGEST_LENGTH,
+        EVP_MD_FLAG_ONESHOT,
+        /* 0, */                        /* EVP_MD_FLAG_ONESHOT = x0001 digest can only handle a single block
+                                * XXX: set according to device info ... */
+        engine_md5_init,
+        engine_md5_update,
+        engine_md5_final,
+        engine_md_copy,         /* dev_crypto_md5_copy */
+        engine_md_cleanup,              /* dev_crypto_md5_cleanup */
+        EVP_PKEY_RSA_method,
+        MD5_CBLOCK,
+        /* sizeof ( EVP_MD * ) + sizeof ( MD5_CTX ) */
+        sizeof ( ZEN_MD_DATA )
+        /* sizeof ( MD_CTX_DATA )       The message digest data stucture ... */
+} ;
+
+
+/* The one for RC4 ... */
+#define EVP_RC4_KEY_SIZE                        16
+
+/* Try something static ... */
+typedef struct
+{
+        unsigned int len ;
+        unsigned int first ;
+        unsigned char rc4_state [ 260 ] ;
+} NEW_ZEN_RC4_KEY ;
+
+#define rc4_data(ctx)                           ( (EVP_RC4_KEY *) ( ctx )->cipher_data )
+
+static const EVP_CIPHER engine_rc4 =
+{
+        NID_rc4,
+        1,
+        16,                             /* EVP_RC4_KEY_SIZE should be 128 bits */
+        0,                              /* FIXME: key should be up to 256 bytes */
+        EVP_CIPH_VARIABLE_LENGTH,
+        engine_rc4_init_key,
+        engine_rc4_cipher,
+        engine_cipher_cleanup,
+        sizeof ( NEW_ZEN_RC4_KEY ),
+        NULL,
+        NULL,
+        NULL
+} ;
+
+/* The one for RC4_40 ... */
+static const EVP_CIPHER engine_rc4_40 =
+{
+        NID_rc4_40,
+        1,
+        5,                              /* 40 bits */
+        0,
+        EVP_CIPH_VARIABLE_LENGTH,
+        engine_rc4_init_key,
+        engine_rc4_cipher,
+        engine_cipher_cleanup,
+        sizeof ( NEW_ZEN_RC4_KEY ),
+        NULL,
+        NULL,
+        NULL
+} ;
+
+/* The one for DES ... */
+
+/* Try something static ... */
+typedef struct
+{
+        unsigned char des_key [ 24 ] ;
+        unsigned char des_iv [ 8 ] ;
+} ZEN_DES_KEY ;
+
+static const EVP_CIPHER engine_des_cbc =
+        {
+        NID_des_cbc,
+        8, 8, 8,
+        0 | EVP_CIPH_CBC_MODE,
+        engine_des_init_key,
+        engine_des_cbc_cipher,
+        engine_cipher_cleanup,
+        sizeof(ZEN_DES_KEY),
+        EVP_CIPHER_set_asn1_iv,
+        EVP_CIPHER_get_asn1_iv,
+        NULL,
+        NULL
+        };
+
+/* The one for 3DES ... */
+
+/* Try something static ... */
+typedef struct
+{
+        unsigned char des3_key [ 24 ] ;
+        unsigned char des3_iv [ 8 ] ;
+} ZEN_3DES_KEY ;
+
+#define des_data(ctx)                            ( (DES_EDE_KEY *) ( ctx )->cipher_data )
+
+static const EVP_CIPHER engine_des_ede3_cbc =
+        {
+        NID_des_ede3_cbc,
+        8, 8, 8,
+        0 | EVP_CIPH_CBC_MODE,
+        engine_des_ede3_init_key,
+        engine_des_ede3_cbc_cipher,
+        engine_cipher_cleanup,
+        sizeof(ZEN_3DES_KEY),
+        EVP_CIPHER_set_asn1_iv,
+        EVP_CIPHER_get_asn1_iv,
+        NULL,
+        NULL
+        };
+
+
+/* General function cloned on hw_openbsd_dev_crypto one ... */
+static int engine_digests ( ENGINE *e, const EVP_MD **digest, const int **nids, int nid )
+{
+
+#ifdef DEBUG_ZENCOD_MD
+        fprintf ( stderr, "\t=>Function : static int engine_digests () called !\n" ) ;
+#endif
+
+        if ( !digest ) {
+                /* We are returning a list of supported nids */
+                *nids = engine_digest_nids ;
+                return engine_digest_nids_num ;
+        }
+        /* We are being asked for a specific digest */
+        if ( nid == NID_md5 ) {
+                *digest = &engine_md5_md ;
+        }
+        else if ( nid == NID_sha1 ) {
+                *digest = &engine_sha1_md ;
+        }
+        else {
+                *digest = NULL ;
+                return 0 ;
+        }
+        return 1 ;
+}
+
+
+/* SHA stuff Functions
+ */
+static int engine_sha1_init ( EVP_MD_CTX *ctx )
+{
+
+        int to_return = 0 ;
+
+        /* Test with zenbridge library ... */
+        to_return = ptr_zencod_sha1_init ( (ZEN_MD_DATA *) ctx->md_data ) ;
+        to_return = !to_return ;
+
+        return to_return ;
+}
+
+
+static int engine_sha1_update ( EVP_MD_CTX *ctx, const void *data, unsigned long count )
+{
+
+        zen_nb_t input ;
+        int to_return = 0 ;
+
+        /* Convert parameters ... */
+        input.len = count ;
+        input.data = (unsigned char *) data ;
+
+        /* Test with zenbridge library ... */
+        to_return = ptr_zencod_sha1_update ( (ZEN_MD_DATA *) ctx->md_data, (const zen_nb_t *) &input ) ;
+        to_return = !to_return ;
+
+        return to_return ;
+}
+
+
+static int engine_sha1_final ( EVP_MD_CTX *ctx, unsigned char *md )
+{
+
+        zen_nb_t output ;
+        int to_return = 0 ;
+
+        /* Convert parameters ... */
+        output.len = SHA_DIGEST_LENGTH ;
+        output.data = md ;
+
+        /* Test with zenbridge library ... */
+        to_return = ptr_zencod_sha1_do_final ( (ZEN_MD_DATA *) ctx->md_data, (zen_nb_t *) &output ) ;
+        to_return = !to_return ;
+
+        return to_return ;
+}
+
+
+
+/* MD5 stuff Functions
+ */
+static int engine_md5_init ( EVP_MD_CTX *ctx )
+{
+
+        int to_return = 0 ;
+
+        /* Test with zenbridge library ... */
+        to_return = ptr_zencod_md5_init ( (ZEN_MD_DATA *) ctx->md_data ) ;
+        to_return = !to_return ;
+
+        return to_return ;
+}
+
+
+static int engine_md5_update ( EVP_MD_CTX *ctx, const void *data, unsigned long count )
+{
+
+        zen_nb_t input ;
+        int to_return = 0 ;
+
+        /* Convert parameters ... */
+        input.len = count ;
+        input.data = (unsigned char *) data ;
+
+        /* Test with zenbridge library ... */
+        to_return = ptr_zencod_md5_update ( (ZEN_MD_DATA *) ctx->md_data, (const zen_nb_t *) &input ) ;
+        to_return = !to_return ;
+
+        return to_return ;
+}
+
+
+static int engine_md5_final ( EVP_MD_CTX *ctx, unsigned char *md )
+{
+
+        zen_nb_t output ;
+        int to_return = 0 ;
+
+        /* Convert parameters ... */
+        output.len = MD5_DIGEST_LENGTH ;
+        output.data = md ;
+
+        /* Test with zenbridge library ... */
+        to_return = ptr_zencod_md5_do_final ( (ZEN_MD_DATA *) ctx->md_data, (zen_nb_t *) &output ) ;
+        to_return = !to_return ;
+
+        return to_return ;
+}
+
+
+static int engine_md_cleanup ( EVP_MD_CTX *ctx )
+{
+
+        ZEN_MD_DATA *zen_md_data = (ZEN_MD_DATA *) ctx->md_data ;
+
+        if ( zen_md_data->HashBuffer != NULL ) {
+                OPENSSL_free ( zen_md_data->HashBuffer ) ;
+                zen_md_data->HashBufferSize = 0 ;
+                ctx->md_data = NULL ;
+        }
+
+        return 1 ;
+}
+
+
+static int engine_md_copy ( EVP_MD_CTX *to, const EVP_MD_CTX *from )
+{
+        const ZEN_MD_DATA *from_md = (ZEN_MD_DATA *) from->md_data ;
+        ZEN_MD_DATA *to_md = (ZEN_MD_DATA *) to->md_data ;
+
+        to_md->HashBuffer = OPENSSL_malloc ( from_md->HashBufferSize ) ;
+        memcpy ( to_md->HashBuffer, from_md->HashBuffer, from_md->HashBufferSize ) ;
+
+        return 1;
+}
+
+
+/* General function cloned on hw_openbsd_dev_crypto one ... */
+static int engine_ciphers ( ENGINE *e, const EVP_CIPHER **cipher, const int **nids, int nid )
+{
+
+        if ( !cipher ) {
+                /* We are returning a list of supported nids */
+                *nids = engine_cipher_nids ;
+                return engine_cipher_nids_num ;
+        }
+        /* We are being asked for a specific cipher */
+        if ( nid == NID_rc4 ) {
+                *cipher = &engine_rc4 ;
+        }
+        else if ( nid == NID_rc4_40 ) {
+                *cipher = &engine_rc4_40 ;
+        }
+        else if ( nid == NID_des_cbc ) {
+                *cipher = &engine_des_cbc ;
+        }
+        else if ( nid == NID_des_ede3_cbc ) {
+                *cipher = &engine_des_ede3_cbc ;
+        }
+        else {
+                *cipher = NULL ;
+                return 0 ;
+        }
+
+        return 1 ;
+}
+
+
+static int engine_rc4_init_key ( EVP_CIPHER_CTX *ctx, const unsigned char *key, const unsigned char *iv, int enc )
+{
+        int to_return = 0 ;
+        int i = 0 ;
+        int nb = 0 ;
+        NEW_ZEN_RC4_KEY *tmp_rc4_key = NULL ;
+
+        tmp_rc4_key = (NEW_ZEN_RC4_KEY *) ( ctx->cipher_data ) ;
+        tmp_rc4_key->first = 0 ;
+        tmp_rc4_key->len = ctx->key_len ;
+        tmp_rc4_key->rc4_state [ 0 ] = 0x00 ;
+        tmp_rc4_key->rc4_state [ 2 ] = 0x00 ;
+        nb = 256 / ctx->key_len ;
+        for ( i = 0; i < nb ; i++ ) {
+                memcpy ( &( tmp_rc4_key->rc4_state [ 4 + i*ctx->key_len ] ), key, ctx->key_len ) ;
+        }
+
+        to_return = 1 ;
+
+        return to_return ;
+}
+
+
+static int engine_rc4_cipher ( EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *in, unsigned int in_len )
+{
+
+        zen_nb_t output, input ;
+        zen_nb_t rc4key ;
+        int to_return = 0 ;
+        NEW_ZEN_RC4_KEY *tmp_rc4_key = NULL ;
+
+        /* Convert parameters ... */
+        input.len = in_len ;
+        input.data = (unsigned char *) in ;
+        output.len = in_len ;
+        output.data = (unsigned char *) out ;
+
+        tmp_rc4_key = ( (NEW_ZEN_RC4_KEY *) ( ctx->cipher_data ) ) ;
+        rc4key.len = 260 ;
+        rc4key.data = &( tmp_rc4_key->rc4_state [ 0 ] ) ;
+
+        /* Test with zenbridge library ... */
+        to_return = ptr_zencod_rc4_cipher ( &output, &input, (const zen_nb_t *) &rc4key, &( tmp_rc4_key->rc4_state [0] ), &( tmp_rc4_key->rc4_state [3] ), !tmp_rc4_key->first ) ;
+        to_return = !to_return ;
+
+        /* Update encryption state ... */
+        tmp_rc4_key->first = 1 ;
+        tmp_rc4_key = NULL ;
+
+        return to_return ;
+}
+
+
+static int engine_des_init_key ( EVP_CIPHER_CTX *ctx, const unsigned char *key, const unsigned char *iv, int enc )
+{
+
+        ZEN_DES_KEY *tmp_des_key = NULL ;
+        int to_return = 0 ;
+
+        tmp_des_key = (ZEN_DES_KEY *) ( ctx->cipher_data ) ;
+        memcpy ( &( tmp_des_key->des_key [ 0 ] ), key, 8 ) ;
+        memcpy ( &( tmp_des_key->des_key [ 8 ] ), key, 8 ) ;
+        memcpy ( &( tmp_des_key->des_key [ 16 ] ), key, 8 ) ;
+        memcpy ( &( tmp_des_key->des_iv [ 0 ] ), iv, 8 ) ;
+
+        to_return = 1 ;
+
+        return to_return ;
+}
+
+
+static int engine_des_cbc_cipher ( EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *in, unsigned int inl )
+{
+
+        zen_nb_t output, input ;
+        zen_nb_t deskey_1, deskey_2, deskey_3, iv ;
+        int to_return = 0 ;
+
+        /* Convert parameters ... */
+        input.len = inl ;
+        input.data = (unsigned char *) in ;
+        output.len = inl ;
+        output.data = out ;
+
+        /* Set key parameters ... */
+        deskey_1.len = 8 ;
+        deskey_2.len = 8 ;
+        deskey_3.len = 8 ;
+        deskey_1.data = (unsigned char *) ( (ZEN_DES_KEY *) ( ctx->cipher_data ) )->des_key ;
+        deskey_2.data =  (unsigned char *) &( (ZEN_DES_KEY *) ( ctx->cipher_data ) )->des_key [ 8 ] ;
+        deskey_3.data =  (unsigned char *) &( (ZEN_DES_KEY *) ( ctx->cipher_data ) )->des_key [ 16 ] ;
+
+        /* Key correct iv ... */
+        memcpy ( ( (ZEN_DES_KEY *) ( ctx->cipher_data ) )->des_iv, ctx->iv, 8 ) ;
+        iv.len = 8 ;
+        iv.data = (unsigned char *) ( (ZEN_DES_KEY *) ( ctx->cipher_data ) )->des_iv ;
+
+        if ( ctx->encrypt == 0 ) {
+                memcpy ( ctx->iv, &( input.data [ input.len - 8 ] ), 8 ) ;
+        }
+
+        /* Test with zenbridge library ... */
+        to_return = ptr_zencod_xdes_cipher ( &output, &input,
+                        (zen_nb_t *) &deskey_1, (zen_nb_t *) &deskey_2, (zen_nb_t *) &deskey_3, &iv, ctx->encrypt ) ;
+        to_return = !to_return ;
+
+        /* But we need to set up the rigth iv ...
+         * Test ENCRYPT or DECRYPT mode to set iv ... */
+        if ( ctx->encrypt == 1 ) {
+                memcpy ( ctx->iv, &( output.data [ output.len - 8 ] ), 8 ) ;
+        }
+
+        return to_return ;
+}
+
+
+static int engine_des_ede3_init_key ( EVP_CIPHER_CTX *ctx, const unsigned char *key, const unsigned char *iv, int enc )
+{
+
+        ZEN_3DES_KEY *tmp_3des_key = NULL ;
+        int to_return = 0 ;
+
+        tmp_3des_key = (ZEN_3DES_KEY *) ( ctx->cipher_data ) ;
+        memcpy ( &( tmp_3des_key->des3_key [ 0 ] ), key, 24 ) ;
+        memcpy ( &( tmp_3des_key->des3_iv [ 0 ] ), iv, 8 ) ;
+
+        to_return = 1;
+
+        return to_return ;
+}
+
+
+static int engine_des_ede3_cbc_cipher ( EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *in,
+        unsigned int in_len )
+{
+
+        zen_nb_t output, input ;
+        zen_nb_t deskey_1, deskey_2, deskey_3, iv ;
+        int to_return = 0 ;
+
+        /* Convert parameters ... */
+        input.len = in_len ;
+        input.data = (unsigned char *) in ;
+        output.len = in_len ;
+        output.data = out ;
+
+        /* Set key ... */
+        deskey_1.len = 8 ;
+        deskey_2.len = 8 ;
+        deskey_3.len = 8 ;
+        deskey_1.data =  (unsigned char *) ( (ZEN_3DES_KEY *) ( ctx->cipher_data ) )->des3_key ;
+        deskey_2.data =  (unsigned char *) &( (ZEN_3DES_KEY *) ( ctx->cipher_data ) )->des3_key [ 8 ] ;
+        deskey_3.data =  (unsigned char *) &( (ZEN_3DES_KEY *) ( ctx->cipher_data ) )->des3_key [ 16 ] ;
+
+        /* Key correct iv ... */
+        memcpy ( ( (ZEN_3DES_KEY *) ( ctx->cipher_data ) )->des3_iv, ctx->iv, 8 ) ;
+        iv.len = 8 ;
+        iv.data = (unsigned char *) ( (ZEN_3DES_KEY *) ( ctx->cipher_data ) )->des3_iv ;
+
+        if ( ctx->encrypt == 0 ) {
+                memcpy ( ctx->iv, &( input.data [ input.len - 8 ] ), 8 ) ;
+        }
+
+        /* Test with zenbridge library ... */
+        to_return = ptr_zencod_xdes_cipher ( &output, &input,
+                        (zen_nb_t *) &deskey_1, (zen_nb_t *) &deskey_2, (zen_nb_t *) &deskey_3, &iv, ctx->encrypt ) ;
+        to_return = !to_return ;
+
+        if ( ctx->encrypt == 1 ) {
+                memcpy ( ctx->iv, &( output.data [ output.len - 8 ] ), 8 ) ;
+        }
+
+        return to_return ;
+}
+
+
+static int engine_cipher_cleanup ( EVP_CIPHER_CTX *ctx )
+{
+
+        /* Set the key pointer ... */
+        if ( ctx->cipher->nid == NID_rc4 || ctx->cipher->nid == NID_rc4_40 ) {
+        }
+        else if ( ctx->cipher->nid == NID_des_cbc ) {
+        }
+        else if ( ctx->cipher->nid == NID_des_ede3_cbc ) {
+        }
+
+        return 1 ;
+}
+
+
+#endif /* !OPENSSL_NO_HW_ZENCOD */
+#endif /* !OPENSSL_NO_HW */
diff --git a/src/lib/libssl/src/demos/engines/zencod/hw_zencod.ec b/src/lib/libssl/src/demos/engines/zencod/hw_zencod.ec
new file mode 100644
index 0000000000..1552c79be6
--- /dev/null
+++ b/src/lib/libssl/src/demos/engines/zencod/hw_zencod.ec
@@ -0,0 +1,8 @@
+# configuration file for util/mkerr.pl
+#
+# use like this:
+#
+#       perl ../../../util/mkerr.pl -conf hw_zencod.ec \
+#               -nostatic -staticloader -write *.c
+
+L ZENCOD        hw_zencod_err.h                 hw_zencod_err.c
diff --git a/src/lib/libssl/src/demos/engines/zencod/hw_zencod.h b/src/lib/libssl/src/demos/engines/zencod/hw_zencod.h
new file mode 100644
index 0000000000..195345d8c6
--- /dev/null
+++ b/src/lib/libssl/src/demos/engines/zencod/hw_zencod.h
@@ -0,0 +1,160 @@
+/* File : /crypto/engine/vendor_defns/hw_zencod.h */
+/* ====================================================================
+ * Written by Donnat Frederic (frederic.donnat@zencod.com) from ZENCOD
+ * for "zencod" ENGINE integration in OpenSSL project.
+ */
+
+
+ #ifndef        _HW_ZENCOD_H_
+#define _HW_ZENCOD_H_
+
+#include <stdio.h>
+
+#ifdef  __cplusplus
+extern "C" {
+#endif  /* __cplusplus */
+
+#define ZENBRIDGE_MAX_KEYSIZE_RSA       2048
+#define ZENBRIDGE_MAX_KEYSIZE_RSA_CRT   1024
+#define ZENBRIDGE_MAX_KEYSIZE_DSA_SIGN  1024
+#define ZENBRIDGE_MAX_KEYSIZE_DSA_VRFY  1024
+
+/* Library version computation */
+#define ZENBRIDGE_VERSION_MAJOR(x)      (((x) >> 16) | 0xff)
+#define ZENBRIDGE_VERSION_MINOR(x)      (((x) >>  8) | 0xff)
+#define ZENBRIDGE_VERSION_PATCH(x)      (((x) >>  0) | 0xff)
+#define ZENBRIDGE_VERSION(x, y, z)              ((x) << 16 | (y) << 8 | (z))
+
+/*
+ * Memory type
+ */
+typedef struct zencod_number_s {
+        unsigned long len;
+        unsigned char *data;
+} zen_nb_t;
+
+#define KEY     zen_nb_t
+
+
+/*
+ * Misc
+ */
+typedef int t_zencod_lib_version (void);
+typedef int t_zencod_hw_version (void);
+typedef int t_zencod_test (void);
+typedef int t_zencod_dump_key (FILE *stream, char *msg, KEY *key);
+
+
+/*
+ * Key managment tools
+ */
+typedef KEY *t_zencod_new_number (unsigned long len, unsigned char *data);
+typedef int t_zencod_init_number (KEY *n, unsigned long len, unsigned char *data);
+typedef unsigned long t_zencod_bytes2bits (unsigned char *n, unsigned long bytes);
+typedef unsigned long t_zencod_bits2bytes (unsigned long bits);
+
+
+/*
+ * RSA API
+ */
+/* Compute modular exponential : y = x**e | n */
+typedef int t_zencod_rsa_mod_exp (KEY *y, KEY *x, KEY *n, KEY *e);
+/* Compute modular exponential : y1 = (x | p)**edp | p, y2 = (x | p)**edp | p, y = y2 + (qinv * (y1 - y2) | p) * q */
+typedef int t_zencod_rsa_mod_exp_crt (KEY *y, KEY *x, KEY *p, KEY *q,
+                                        KEY *edp, KEY *edq, KEY *qinv);
+
+
+/*
+ * DSA API
+ */
+typedef int t_zencod_dsa_do_sign (unsigned int hash, KEY *data, KEY *random,
+                                    KEY *p, KEY *q, KEY *g, KEY *x, KEY *r, KEY *s);
+typedef int t_zencod_dsa_do_verify (unsigned int hash, KEY *data,
+                                      KEY *p, KEY *q, KEY *g, KEY *y,
+                                      KEY *r, KEY *s, KEY *v);
+
+
+/*
+ * DH API
+ */
+ /* Key generation : compute public value y = g**x | n */
+typedef int t_zencod_dh_generate_key (KEY *y, KEY *x, KEY *g, KEY *n, int gen_x);
+typedef int t_zencod_dh_compute_key (KEY *k, KEY *y, KEY *x, KEY *n);
+
+
+/*
+ * RNG API
+ */
+#define ZENBRIDGE_RNG_DIRECT            0
+#define ZENBRIDGE_RNG_SHA1              1
+typedef int t_zencod_rand_bytes (KEY *rand, unsigned int flags);
+
+
+/*
+ * Math API
+ */
+typedef int t_zencod_math_mod_exp (KEY *r, KEY *a, KEY *e, KEY *n);
+
+
+
+
+/*
+ * Symetric API
+ */
+/* Define a data structure for digests operations */
+typedef struct ZEN_data_st
+{
+        unsigned int HashBufferSize ;
+        unsigned char *HashBuffer ;
+} ZEN_MD_DATA ;
+
+/*
+ * Functions for Digest (MD5, SHA1) stuff
+ */
+/* output : output data buffer */
+/* input : input data buffer */
+/* algo : hash algorithm, MD5 or SHA1 */
+/* typedef int t_zencod_hash ( KEY *output, const KEY *input, int algo ) ;
+ * typedef int t_zencod_sha_hash ( KEY *output, const KEY *input, int algo ) ;
+ */
+/* For now separate this stuff that mad it easier to test */
+typedef int t_zencod_md5_init ( ZEN_MD_DATA *data ) ;
+typedef int t_zencod_md5_update ( ZEN_MD_DATA *data, const KEY *input ) ;
+typedef int t_zencod_md5_do_final ( ZEN_MD_DATA *data, KEY *output ) ;
+
+typedef int t_zencod_sha1_init ( ZEN_MD_DATA *data ) ;
+typedef int t_zencod_sha1_update ( ZEN_MD_DATA *data, const KEY *input ) ;
+typedef int t_zencod_sha1_do_final ( ZEN_MD_DATA *data, KEY *output ) ;
+
+
+/*
+ * Functions for Cipher (RC4, DES, 3DES) stuff
+ */
+/* output : output data buffer */
+/* input : input data buffer */
+/* key : rc4 key data */
+/* index_1 : value of index x from RC4 key structure */
+/* index_2 : value of index y from RC4 key structure */
+/* Be carefull : RC4 key should be expanded before calling this method (Should we provide an expand function ??) */
+typedef int t_zencod_rc4_cipher ( KEY *output, const KEY *input, const KEY *key,
+                unsigned char *index_1, unsigned char *index_2, int mode ) ;
+
+/* output : output data buffer */
+/* input : input data buffer */
+/* key_1 : des first key data */
+/* key_2 : des second key data */
+/* key_3 : des third key data */
+/* iv : initial vector */
+/* mode : xdes mode (encrypt or decrypt) */
+/* Be carefull : In DES mode key_1 = key_2 = key_3 (as far as i can see !!) */
+typedef int t_zencod_xdes_cipher ( KEY *output, const KEY *input, const KEY *key_1,
+                const KEY *key_2, const KEY *key_3, const KEY *iv, int mode ) ;
+
+
+#undef KEY
+
+#ifdef  __cplusplus
+}
+#endif  /* __cplusplus */
+
+#endif  /* !_HW_ZENCOD_H_ */
diff --git a/src/lib/libssl/src/demos/engines/zencod/hw_zencod_err.c b/src/lib/libssl/src/demos/engines/zencod/hw_zencod_err.c
new file mode 100644
index 0000000000..8ed0fffc9c
--- /dev/null
+++ b/src/lib/libssl/src/demos/engines/zencod/hw_zencod_err.c
@@ -0,0 +1,151 @@
+/* hw_zencod_err.c */
+/* ====================================================================
+ * Copyright (c) 1999-2002 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* NOTE: this file was auto generated by the mkerr.pl script: any changes
+ * made to it will be overwritten when the script next updates this file,
+ * only reason strings will be preserved.
+ */
+
+#include <stdio.h>
+#include <openssl/err.h>
+#include "hw_zencod_err.h"
+
+/* BEGIN ERROR CODES */
+#ifndef OPENSSL_NO_ERR
+static ERR_STRING_DATA ZENCOD_str_functs[]=
+        {
+{ERR_PACK(0,ZENCOD_F_ZENCOD_BN_MOD_EXP,0),      "ZENCOD_BN_MOD_EXP"},
+{ERR_PACK(0,ZENCOD_F_ZENCOD_CTRL,0),    "ZENCOD_CTRL"},
+{ERR_PACK(0,ZENCOD_F_ZENCOD_DH_COMPUTE,0),      "ZENCOD_DH_COMPUTE"},
+{ERR_PACK(0,ZENCOD_F_ZENCOD_DH_GENERATE,0),     "ZENCOD_DH_GENERATE"},
+{ERR_PACK(0,ZENCOD_F_ZENCOD_DSA_DO_SIGN,0),     "ZENCOD_DSA_DO_SIGN"},
+{ERR_PACK(0,ZENCOD_F_ZENCOD_DSA_DO_VERIFY,0),   "ZENCOD_DSA_DO_VERIFY"},
+{ERR_PACK(0,ZENCOD_F_ZENCOD_FINISH,0),  "ZENCOD_FINISH"},
+{ERR_PACK(0,ZENCOD_F_ZENCOD_INIT,0),    "ZENCOD_INIT"},
+{ERR_PACK(0,ZENCOD_F_ZENCOD_RAND,0),    "ZENCOD_RAND"},
+{ERR_PACK(0,ZENCOD_F_ZENCOD_RSA_MOD_EXP,0),     "ZENCOD_RSA_MOD_EXP"},
+{ERR_PACK(0,ZENCOD_F_ZENCOD_RSA_MOD_EXP_CRT,0), "ZENCOD_RSA_MOD_EXP_CRT"},
+{0,NULL}
+        };
+
+static ERR_STRING_DATA ZENCOD_str_reasons[]=
+        {
+{ZENCOD_R_ALREADY_LOADED                 ,"already loaded"},
+{ZENCOD_R_BAD_KEY_COMPONENTS             ,"bad key components"},
+{ZENCOD_R_BN_EXPAND_FAIL                 ,"bn expand fail"},
+{ZENCOD_R_CTRL_COMMAND_NOT_IMPLEMENTED   ,"ctrl command not implemented"},
+{ZENCOD_R_DSO_FAILURE                    ,"dso failure"},
+{ZENCOD_R_NOT_LOADED                     ,"not loaded"},
+{ZENCOD_R_REQUEST_FAILED                 ,"request failed"},
+{ZENCOD_R_UNIT_FAILURE                   ,"unit failure"},
+{0,NULL}
+        };
+
+#endif
+
+#ifdef ZENCOD_LIB_NAME
+static ERR_STRING_DATA ZENCOD_lib_name[]=
+        {
+{0      ,ZENCOD_LIB_NAME},
+{0,NULL}
+        };
+#endif
+
+
+static int ZENCOD_lib_error_code=0;
+static int ZENCOD_error_init=1;
+
+static void ERR_load_ZENCOD_strings(void)
+        {
+        if (ZENCOD_lib_error_code == 0)
+                ZENCOD_lib_error_code=ERR_get_next_error_library();
+
+        if (ZENCOD_error_init)
+                {
+                ZENCOD_error_init=0;
+#ifndef OPENSSL_NO_ERR
+                ERR_load_strings(ZENCOD_lib_error_code,ZENCOD_str_functs);
+                ERR_load_strings(ZENCOD_lib_error_code,ZENCOD_str_reasons);
+#endif
+
+#ifdef ZENCOD_LIB_NAME
+                ZENCOD_lib_name->error = ERR_PACK(ZENCOD_lib_error_code,0,0);
+                ERR_load_strings(0,ZENCOD_lib_name);
+#endif
+                }
+        }
+
+static void ERR_unload_ZENCOD_strings(void)
+        {
+        if (ZENCOD_error_init == 0)
+                {
+#ifndef OPENSSL_NO_ERR
+                ERR_unload_strings(ZENCOD_lib_error_code,ZENCOD_str_functs);
+                ERR_unload_strings(ZENCOD_lib_error_code,ZENCOD_str_reasons);
+#endif
+
+#ifdef ZENCOD_LIB_NAME
+                ERR_unload_strings(0,ZENCOD_lib_name);
+#endif
+                ZENCOD_error_init=1;
+                }
+        }
+
+static void ERR_ZENCOD_error(int function, int reason, char *file, int line)
+        {
+        if (ZENCOD_lib_error_code == 0)
+                ZENCOD_lib_error_code=ERR_get_next_error_library();
+        ERR_PUT_error(ZENCOD_lib_error_code,function,reason,file,line);
+        }
diff --git a/src/lib/libssl/src/demos/engines/zencod/hw_zencod_err.h b/src/lib/libssl/src/demos/engines/zencod/hw_zencod_err.h
new file mode 100644
index 0000000000..1b5dcb5685
--- /dev/null
+++ b/src/lib/libssl/src/demos/engines/zencod/hw_zencod_err.h
@@ -0,0 +1,95 @@
+/* ====================================================================
+ * Copyright (c) 2001-2002 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#ifndef HEADER_ZENCOD_ERR_H
+#define HEADER_ZENCOD_ERR_H
+
+/* BEGIN ERROR CODES */
+/* The following lines are auto generated by the script mkerr.pl. Any changes
+ * made after this point may be overwritten when the script is next run.
+ */
+static void ERR_load_ZENCOD_strings(void);
+static void ERR_unload_ZENCOD_strings(void);
+static void ERR_ZENCOD_error(int function, int reason, char *file, int line);
+#define ZENCODerr(f,r) ERR_ZENCOD_error((f),(r),__FILE__,__LINE__)
+
+/* Error codes for the ZENCOD functions. */
+
+/* Function codes. */
+#define ZENCOD_F_ZENCOD_BN_MOD_EXP                       100
+#define ZENCOD_F_ZENCOD_CTRL                             101
+#define ZENCOD_F_ZENCOD_DH_COMPUTE                       102
+#define ZENCOD_F_ZENCOD_DH_GENERATE                      103
+#define ZENCOD_F_ZENCOD_DSA_DO_SIGN                      104
+#define ZENCOD_F_ZENCOD_DSA_DO_VERIFY                    105
+#define ZENCOD_F_ZENCOD_FINISH                           106
+#define ZENCOD_F_ZENCOD_INIT                             107
+#define ZENCOD_F_ZENCOD_RAND                             108
+#define ZENCOD_F_ZENCOD_RSA_MOD_EXP                      109
+#define ZENCOD_F_ZENCOD_RSA_MOD_EXP_CRT                  110
+
+/* Reason codes. */
+#define ZENCOD_R_ALREADY_LOADED                          100
+#define ZENCOD_R_BAD_KEY_COMPONENTS                      101
+#define ZENCOD_R_BN_EXPAND_FAIL                          102
+#define ZENCOD_R_CTRL_COMMAND_NOT_IMPLEMENTED            103
+#define ZENCOD_R_DSO_FAILURE                             104
+#define ZENCOD_R_NOT_LOADED                              105
+#define ZENCOD_R_REQUEST_FAILED                          106
+#define ZENCOD_R_UNIT_FAILURE                            107
+
+#ifdef  __cplusplus
+}
+#endif
+#endif
diff --git a/src/lib/libssl/src/doc/crypto/DH_set_method.pod b/src/lib/libssl/src/doc/crypto/DH_set_method.pod
index d990bf8786..73261fc467 100644
--- a/src/lib/libssl/src/doc/crypto/DH_set_method.pod
+++ b/src/lib/libssl/src/doc/crypto/DH_set_method.pod
@@ -2,7 +2,7 @@
 
 =head1 NAME
 
-DH_set_default_openssl_method, DH_get_default_openssl_method,
+DH_set_default_method, DH_get_default_method,
 DH_set_method, DH_new_method, DH_OpenSSL - select DH method
 
 =head1 SYNOPSIS
@@ -10,45 +10,47 @@ DH_set_method, DH_new_method, DH_OpenSSL - select DH method
  #include <openssl/dh.h>
  #include <openssl/engine.h>
 
- void DH_set_default_openssl_method(DH_METHOD *meth);
+ void DH_set_default_method(const DH_METHOD *meth);
 
- DH_METHOD *DH_get_default_openssl_method(void);
+ const DH_METHOD *DH_get_default_method(void);
 
- int DH_set_method(DH *dh, ENGINE *engine);
+ int DH_set_method(DH *dh, const DH_METHOD *meth);
 
  DH *DH_new_method(ENGINE *engine);
 
- DH_METHOD *DH_OpenSSL(void);
+ const DH_METHOD *DH_OpenSSL(void);
 
 =head1 DESCRIPTION
 
 A B<DH_METHOD> specifies the functions that OpenSSL uses for Diffie-Hellman
 operations. By modifying the method, alternative implementations
-such as hardware accelerators may be used.
-
-Initially, the default is to use the OpenSSL internal implementation.
-DH_OpenSSL() returns a pointer to that method.
-
-DH_set_default_openssl_method() makes B<meth> the default method for all DH
-structures created later. B<NB:> This is true only whilst the default engine
-for Diffie-Hellman operations remains as "openssl". ENGINEs provide an
-encapsulation for implementations of one or more algorithms, and all the DH
-functions mentioned here operate within the scope of the default
-"openssl" engine.
-
-DH_get_default_openssl_method() returns a pointer to the current default
-method for the "openssl" engine.
-
-DH_set_method() selects B<engine> as the engine that will be responsible for
-all operations using the structure B<dh>. If this function completes successfully,
-then the B<dh> structure will have its own functional reference of B<engine>, so
-the caller should remember to free their own reference to B<engine> when they are
-finished with it. NB: An ENGINE's DH_METHOD can be retrieved (or set) by
-ENGINE_get_DH() or ENGINE_set_DH().
-
-DH_new_method() allocates and initializes a DH structure so that
-B<engine> will be used for the DH operations. If B<engine> is NULL,
-the default engine for Diffie-Hellman opertaions is used.
+such as hardware accelerators may be used. IMPORTANT: See the NOTES section for
+important information about how these DH API functions are affected by the use
+of B<ENGINE> API calls.
+
+Initially, the default DH_METHOD is the OpenSSL internal implementation, as
+returned by DH_OpenSSL().
+
+DH_set_default_method() makes B<meth> the default method for all DH
+structures created later. B<NB>: This is true only whilst no ENGINE has been set
+as a default for DH, so this function is no longer recommended.
+
+DH_get_default_method() returns a pointer to the current default DH_METHOD.
+However, the meaningfulness of this result is dependant on whether the ENGINE
+API is being used, so this function is no longer recommended.
+
+DH_set_method() selects B<meth> to perform all operations using the key B<dh>.
+This will replace the DH_METHOD used by the DH key and if the previous method
+was supplied by an ENGINE, the handle to that ENGINE will be released during the
+change. It is possible to have DH keys that only work with certain DH_METHOD
+implementations (eg. from an ENGINE module that supports embedded
+hardware-protected keys), and in such cases attempting to change the DH_METHOD
+for the key can have unexpected results.
+
+DH_new_method() allocates and initializes a DH structure so that B<engine> will
+be used for the DH operations. If B<engine> is NULL, the default ENGINE for DH
+operations is used, and if no default ENGINE is set, the DH_METHOD controlled by
+DH_set_default_method() is used.
 
 =head1 THE DH_METHOD STRUCTURE
 
@@ -82,17 +84,28 @@ the default engine for Diffie-Hellman opertaions is used.
 
 =head1 RETURN VALUES
 
-DH_OpenSSL() and DH_get_default_openssl_method() return pointers to the
-respective B<DH_METHOD>s.
+DH_OpenSSL() and DH_get_default_method() return pointers to the respective
+B<DH_METHOD>s.
+
+DH_set_default_method() returns no value.
+
+DH_set_method() returns non-zero if the provided B<meth> was successfully set as
+the method for B<dh> (including unloading the ENGINE handle if the previous
+method was supplied by an ENGINE).
 
-DH_set_default_openssl_method() returns no value.
+DH_new_method() returns NULL and sets an error code that can be obtained by
+L<ERR_get_error(3)|ERR_get_error(3)> if the allocation fails. Otherwise it
+returns a pointer to the newly allocated structure.
 
-DH_set_method() returns non-zero if the ENGINE associated with B<dh>
-was successfully changed to B<engine>.
+=head1 NOTES
 
-DH_new_method() returns NULL and sets an error code that can be
-obtained by L<ERR_get_error(3)|ERR_get_error(3)> if the allocation fails.
-Otherwise it returns a pointer to the newly allocated structure.
+As of version 0.9.7, DH_METHOD implementations are grouped together with other
+algorithmic APIs (eg. RSA_METHOD, EVP_CIPHER, etc) in B<ENGINE> modules. If a
+default ENGINE is specified for DH functionality using an ENGINE API function,
+that will override any DH defaults set using the DH API (ie.
+DH_set_default_method()). For this reason, the ENGINE API is the recommended way
+to control default implementations for use in DH and other cryptographic
+algorithms.
 
 =head1 SEE ALSO
 
@@ -103,9 +116,14 @@ L<dh(3)|dh(3)>, L<DH_new(3)|DH_new(3)>
 DH_set_default_method(), DH_get_default_method(), DH_set_method(),
 DH_new_method() and DH_OpenSSL() were added in OpenSSL 0.9.4.
 
-DH_set_default_openssl_method() and DH_get_default_openssl_method()
-replaced DH_set_default_method() and DH_get_default_method() respectively,
-and DH_set_method() and DH_new_method() were altered to use B<ENGINE>s
-rather than B<DH_METHOD>s during development of OpenSSL 0.9.6.
+DH_set_default_openssl_method() and DH_get_default_openssl_method() replaced
+DH_set_default_method() and DH_get_default_method() respectively, and
+DH_set_method() and DH_new_method() were altered to use B<ENGINE>s rather than
+B<DH_METHOD>s during development of the engine version of OpenSSL 0.9.6. For
+0.9.7, the handling of defaults in the ENGINE API was restructured so that this
+change was reversed, and behaviour of the other functions resembled more closely
+the previous behaviour. The behaviour of defaults in the ENGINE API now
+transparently overrides the behaviour of defaults in the DH API without
+requiring changing these function prototypes.
 
 =cut
diff --git a/src/lib/libssl/src/doc/crypto/DSA_dup_DH.pod b/src/lib/libssl/src/doc/crypto/DSA_dup_DH.pod
index 29cb1075d1..fdfe125ab0 100644
--- a/src/lib/libssl/src/doc/crypto/DSA_dup_DH.pod
+++ b/src/lib/libssl/src/doc/crypto/DSA_dup_DH.pod
@@ -8,7 +8,7 @@ DSA_dup_DH - create a DH structure out of DSA structure
 
  #include <openssl/dsa.h>
 
- DH * DSA_dup_DH(DSA *r);
+ DH * DSA_dup_DH(const DSA *r);
 
 =head1 DESCRIPTION
 
diff --git a/src/lib/libssl/src/doc/crypto/DSA_new.pod b/src/lib/libssl/src/doc/crypto/DSA_new.pod
index 7dde54445b..546146d9de 100644
--- a/src/lib/libssl/src/doc/crypto/DSA_new.pod
+++ b/src/lib/libssl/src/doc/crypto/DSA_new.pod
@@ -14,7 +14,8 @@ DSA_new, DSA_free - allocate and free DSA objects
 
 =head1 DESCRIPTION
 
-DSA_new() allocates and initializes a B<DSA> structure.
+DSA_new() allocates and initializes a B<DSA> structure. It is equivalent to
+calling DSA_new_method(NULL).
 
 DSA_free() frees the B<DSA> structure and its components. The values are
 erased before the memory is returned to the system.
diff --git a/src/lib/libssl/src/doc/crypto/DSA_set_method.pod b/src/lib/libssl/src/doc/crypto/DSA_set_method.pod
index 36a1052d27..bc3cfb1f0a 100644
--- a/src/lib/libssl/src/doc/crypto/DSA_set_method.pod
+++ b/src/lib/libssl/src/doc/crypto/DSA_set_method.pod
@@ -2,7 +2,7 @@
 
 =head1 NAME
 
-DSA_set_default_openssl_method, DSA_get_default_openssl_method,
+DSA_set_default_method, DSA_get_default_method,
 DSA_set_method, DSA_new_method, DSA_OpenSSL - select DSA method
 
 =head1 SYNOPSIS
@@ -10,11 +10,11 @@ DSA_set_method, DSA_new_method, DSA_OpenSSL - select DSA method
  #include <openssl/dsa.h>
  #include <openssl/engine.h>
 
- void DSA_set_default_openssl_method(DSA_METHOD *meth);
+ void DSA_set_default_method(const DSA_METHOD *meth);
 
- DSA_METHOD *DSA_get_default_openssl_method(void);
+ const DSA_METHOD *DSA_get_default_method(void);
 
- int DSA_set_method(DSA *dsa, ENGINE *engine);
+ int DSA_set_method(DSA *dsa, const DSA_METHOD *meth);
 
  DSA *DSA_new_method(ENGINE *engine);
 
@@ -24,26 +24,35 @@ DSA_set_method, DSA_new_method, DSA_OpenSSL - select DSA method
 
 A B<DSA_METHOD> specifies the functions that OpenSSL uses for DSA
 operations. By modifying the method, alternative implementations
-such as hardware accelerators may be used.
-
-Initially, the default is to use the OpenSSL internal implementation.
-DSA_OpenSSL() returns a pointer to that method.
-
-DSA_set_default_openssl_method() makes B<meth> the default method for
-all DSA structures created later. B<NB:> This is true only whilst the
-default engine for DSA operations remains as "openssl". ENGINEs
-provide an encapsulation for implementations of one or more algorithms at a
-time, and all the DSA functions mentioned here operate within the scope
-of the default "openssl" engine.
-
-DSA_get_default_openssl_method() returns a pointer to the current default
-method for the "openssl" engine.
-
-DSA_set_method() selects B<engine> for all operations using the structure B<dsa>.
-
-DSA_new_method() allocates and initializes a DSA structure so that
-B<engine> will be used for the DSA operations. If B<engine> is NULL,
-the default engine for DSA operations is used.
+such as hardware accelerators may be used. IMPORTANT: See the NOTES section for
+important information about how these DSA API functions are affected by the use
+of B<ENGINE> API calls.
+
+Initially, the default DSA_METHOD is the OpenSSL internal implementation,
+as returned by DSA_OpenSSL().
+
+DSA_set_default_method() makes B<meth> the default method for all DSA
+structures created later. B<NB>: This is true only whilst no ENGINE has
+been set as a default for DSA, so this function is no longer recommended.
+
+DSA_get_default_method() returns a pointer to the current default
+DSA_METHOD. However, the meaningfulness of this result is dependant on
+whether the ENGINE API is being used, so this function is no longer 
+recommended.
+
+DSA_set_method() selects B<meth> to perform all operations using the key
+B<rsa>. This will replace the DSA_METHOD used by the DSA key and if the
+previous method was supplied by an ENGINE, the handle to that ENGINE will
+be released during the change. It is possible to have DSA keys that only
+work with certain DSA_METHOD implementations (eg. from an ENGINE module
+that supports embedded hardware-protected keys), and in such cases
+attempting to change the DSA_METHOD for the key can have unexpected
+results.
+
+DSA_new_method() allocates and initializes a DSA structure so that B<engine>
+will be used for the DSA operations. If B<engine> is NULL, the default engine
+for DSA operations is used, and if no default ENGINE is set, the DSA_METHOD
+controlled by DSA_set_default_method() is used.
 
 =head1 THE DSA_METHOD STRUCTURE
 
@@ -89,18 +98,29 @@ struct
 
 =head1 RETURN VALUES
 
-DSA_OpenSSL() and DSA_get_default_openssl_method() return pointers to the
-respective B<DSA_METHOD>s.
+DSA_OpenSSL() and DSA_get_default_method() return pointers to the respective
+B<DSA_METHOD>s.
 
-DSA_set_default_openssl_method() returns no value.
+DSA_set_default_method() returns no value.
 
-DSA_set_method() returns non-zero if the ENGINE associated with B<dsa>
-was successfully changed to B<engine>.
+DSA_set_method() returns non-zero if the provided B<meth> was successfully set as
+the method for B<dsa> (including unloading the ENGINE handle if the previous
+method was supplied by an ENGINE).
 
 DSA_new_method() returns NULL and sets an error code that can be
 obtained by L<ERR_get_error(3)|ERR_get_error(3)> if the allocation
 fails. Otherwise it returns a pointer to the newly allocated structure.
 
+=head1 NOTES
+
+As of version 0.9.7, DSA_METHOD implementations are grouped together with other
+algorithmic APIs (eg. RSA_METHOD, EVP_CIPHER, etc) in B<ENGINE> modules. If a
+default ENGINE is specified for DSA functionality using an ENGINE API function,
+that will override any DSA defaults set using the DSA API (ie.
+DSA_set_default_method()). For this reason, the ENGINE API is the recommended way
+to control default implementations for use in DSA and other cryptographic
+algorithms.
+
 =head1 SEE ALSO
 
 L<dsa(3)|dsa(3)>, L<DSA_new(3)|DSA_new(3)>
@@ -110,9 +130,14 @@ L<dsa(3)|dsa(3)>, L<DSA_new(3)|DSA_new(3)>
 DSA_set_default_method(), DSA_get_default_method(), DSA_set_method(),
 DSA_new_method() and DSA_OpenSSL() were added in OpenSSL 0.9.4.
 
-DSA_set_default_openssl_method() and DSA_get_default_openssl_method()
-replaced DSA_set_default_method() and DSA_get_default_method() respectively,
-and DSA_set_method() and DSA_new_method() were altered to use B<ENGINE>s
-rather than B<DSA_METHOD>s during development of OpenSSL 0.9.6.
+DSA_set_default_openssl_method() and DSA_get_default_openssl_method() replaced
+DSA_set_default_method() and DSA_get_default_method() respectively, and
+DSA_set_method() and DSA_new_method() were altered to use B<ENGINE>s rather than
+B<DSA_METHOD>s during development of the engine version of OpenSSL 0.9.6. For
+0.9.7, the handling of defaults in the ENGINE API was restructured so that this
+change was reversed, and behaviour of the other functions resembled more closely
+the previous behaviour. The behaviour of defaults in the ENGINE API now
+transparently overrides the behaviour of defaults in the DSA API without
+requiring changing these function prototypes.
 
 =cut
diff --git a/src/lib/libssl/src/doc/crypto/DSA_size.pod b/src/lib/libssl/src/doc/crypto/DSA_size.pod
index 23b6320a4d..ba4f650361 100644
--- a/src/lib/libssl/src/doc/crypto/DSA_size.pod
+++ b/src/lib/libssl/src/doc/crypto/DSA_size.pod
@@ -8,7 +8,7 @@ DSA_size - get DSA signature size
 
  #include <openssl/dsa.h>
 
- int DSA_size(DSA *dsa);
+ int DSA_size(const DSA *dsa);
 
 =head1 DESCRIPTION
 
diff --git a/src/lib/libssl/src/doc/crypto/EVP_SealInit.pod b/src/lib/libssl/src/doc/crypto/EVP_SealInit.pod
index 0451eb648a..25ef07f7c7 100644
--- a/src/lib/libssl/src/doc/crypto/EVP_SealInit.pod
+++ b/src/lib/libssl/src/doc/crypto/EVP_SealInit.pod
@@ -73,4 +73,6 @@ L<EVP_OpenInit(3)|EVP_OpenInit(3)>
 
 =head1 HISTORY
 
+EVP_SealFinal() did not return a value before OpenSSL 0.9.7.
+
 =cut
diff --git a/src/lib/libssl/src/doc/crypto/RAND_set_rand_method.pod b/src/lib/libssl/src/doc/crypto/RAND_set_rand_method.pod
index 464eba416d..c9bb6d9f27 100644
--- a/src/lib/libssl/src/doc/crypto/RAND_set_rand_method.pod
+++ b/src/lib/libssl/src/doc/crypto/RAND_set_rand_method.pod
@@ -8,22 +8,30 @@ RAND_set_rand_method, RAND_get_rand_method, RAND_SSLeay - select RAND method
 
  #include <openssl/rand.h>
 
- void RAND_set_rand_method(RAND_METHOD *meth);
+ void RAND_set_rand_method(const RAND_METHOD *meth);
 
- RAND_METHOD *RAND_get_rand_method(void);
+ const RAND_METHOD *RAND_get_rand_method(void);
 
  RAND_METHOD *RAND_SSLeay(void);
 
 =head1 DESCRIPTION
 
-A B<RAND_METHOD> specifies the functions that OpenSSL uses for random
-number generation. By modifying the method, alternative
-implementations such as hardware RNGs may be used.  Initially, the
-default is to use the OpenSSL internal implementation. RAND_SSLeay()
-returns a pointer to that method.
+A B<RAND_METHOD> specifies the functions that OpenSSL uses for random number
+generation. By modifying the method, alternative implementations such as
+hardware RNGs may be used. IMPORTANT: See the NOTES section for important
+information about how these RAND API functions are affected by the use of
+B<ENGINE> API calls.
 
-RAND_set_rand_method() sets the RAND method to B<meth>.
-RAND_get_rand_method() returns a pointer to the current method.
+Initially, the default RAND_METHOD is the OpenSSL internal implementation, as
+returned by RAND_SSLeay().
+
+RAND_set_default_method() makes B<meth> the method for PRNG use. B<NB>: This is
+true only whilst no ENGINE has been set as a default for RAND, so this function
+is no longer recommended.
+
+RAND_get_default_method() returns a pointer to the current RAND_METHOD.
+However, the meaningfulness of this result is dependant on whether the ENGINE
+API is being used, so this function is no longer recommended.
 
 =head1 THE RAND_METHOD STRUCTURE
 
@@ -47,13 +55,29 @@ Each component may be NULL if the function is not implemented.
 RAND_set_rand_method() returns no value. RAND_get_rand_method() and
 RAND_SSLeay() return pointers to the respective methods.
 
+=head1 NOTES
+
+As of version 0.9.7, RAND_METHOD implementations are grouped together with other
+algorithmic APIs (eg. RSA_METHOD, EVP_CIPHER, etc) in B<ENGINE> modules. If a
+default ENGINE is specified for RAND functionality using an ENGINE API function,
+that will override any RAND defaults set using the RAND API (ie.
+RAND_set_rand_method()). For this reason, the ENGINE API is the recommended way
+to control default implementations for use in RAND and other cryptographic
+algorithms.
+
 =head1 SEE ALSO
 
-L<rand(3)|rand(3)>
+L<rand(3)|rand(3)>, L<engine(3)|engine(3)>
 
 =head1 HISTORY
 
 RAND_set_rand_method(), RAND_get_rand_method() and RAND_SSLeay() are
 available in all versions of OpenSSL.
 
+In the engine version of version 0.9.6, RAND_set_rand_method() was altered to
+take an ENGINE pointer as its argument. As of version 0.9.7, that has been
+reverted as the ENGINE API transparently overrides RAND defaults if used,
+otherwise RAND API functions work as before. RAND_set_rand_engine() was also
+introduced in version 0.9.7.
+
 =cut
diff --git a/src/lib/libssl/src/doc/crypto/RSA_new.pod b/src/lib/libssl/src/doc/crypto/RSA_new.pod
index f16490ea6a..f0d996c40f 100644
--- a/src/lib/libssl/src/doc/crypto/RSA_new.pod
+++ b/src/lib/libssl/src/doc/crypto/RSA_new.pod
@@ -14,7 +14,8 @@ RSA_new, RSA_free - allocate and free RSA objects
 
 =head1 DESCRIPTION
 
-RSA_new() allocates and initializes an B<RSA> structure.
+RSA_new() allocates and initializes an B<RSA> structure. It is equivalent to
+calling RSA_new_method(NULL).
 
 RSA_free() frees the B<RSA> structure and its components. The key is
 erased before the memory is returned to the system.
@@ -29,7 +30,8 @@ RSA_free() returns no value.
 
 =head1 SEE ALSO
 
-L<err(3)|err(3)>, L<rsa(3)|rsa(3)>, L<RSA_generate_key(3)|RSA_generate_key(3)>
+L<err(3)|err(3)>, L<rsa(3)|rsa(3)>, L<RSA_generate_key(3)|RSA_generate_key(3)>,
+L<RSA_new_method(3)|RSA_new_method(3)>
 
 =head1 HISTORY
 
diff --git a/src/lib/libssl/src/doc/crypto/RSA_set_method.pod b/src/lib/libssl/src/doc/crypto/RSA_set_method.pod
index 14917dd35f..0687c2242a 100644
--- a/src/lib/libssl/src/doc/crypto/RSA_set_method.pod
+++ b/src/lib/libssl/src/doc/crypto/RSA_set_method.pod
@@ -11,52 +11,64 @@ RSA_null_method, RSA_flags, RSA_new_method - select RSA method
  #include <openssl/rsa.h>
  #include <openssl/engine.h>
 
- void RSA_set_default_openssl_method(RSA_METHOD *meth);
+ void RSA_set_default_method(const RSA_METHOD *meth);
 
- RSA_METHOD *RSA_get_default_openssl_method(void);
+ RSA_METHOD *RSA_get_default_method(void);
 
- int RSA_set_method(RSA *rsa, ENGINE *engine);
+ int RSA_set_method(RSA *rsa, const RSA_METHOD *meth);
 
- RSA_METHOD *RSA_get_method(RSA *rsa);
+ RSA_METHOD *RSA_get_method(const RSA *rsa);
 
  RSA_METHOD *RSA_PKCS1_SSLeay(void);
 
  RSA_METHOD *RSA_null_method(void);
 
- int RSA_flags(RSA *rsa);
+ int RSA_flags(const RSA *rsa);
 
  RSA *RSA_new_method(ENGINE *engine);
 
 =head1 DESCRIPTION
 
 An B<RSA_METHOD> specifies the functions that OpenSSL uses for RSA
-operations. By modifying the method, alternative implementations
-such as hardware accelerators may be used.
-
-Initially, the default is to use the OpenSSL internal implementation.
-RSA_PKCS1_SSLeay() returns a pointer to that method.
-
-RSA_set_default_openssl_method() makes B<meth> the default method for all B<RSA>
-structures created later. B<NB:> This is true only whilst the default engine
-for RSA operations remains as "openssl". ENGINEs provide an
-encapsulation for implementations of one or more algorithms at a time, and all
-the RSA functions mentioned here operate within the scope of the default
-"openssl" engine.
-
-RSA_get_default_openssl_method() returns a pointer to the current default
-method for the "openssl" engine.
-
-RSA_set_method() selects B<engine> for all operations using the key
-B<rsa>.
-
-RSA_get_method() returns a pointer to the RSA_METHOD from the currently
-selected ENGINE for B<rsa>.
-
-RSA_flags() returns the B<flags> that are set for B<rsa>'s current method.
+operations. By modifying the method, alternative implementations such as
+hardware accelerators may be used. IMPORTANT: See the NOTES section for
+important information about how these RSA API functions are affected by the
+use of B<ENGINE> API calls.
+
+Initially, the default RSA_METHOD is the OpenSSL internal implementation,
+as returned by RSA_PKCS1_SSLeay().
+
+RSA_set_default_method() makes B<meth> the default method for all RSA
+structures created later. B<NB>: This is true only whilst no ENGINE has
+been set as a default for RSA, so this function is no longer recommended.
+
+RSA_get_default_method() returns a pointer to the current default
+RSA_METHOD. However, the meaningfulness of this result is dependant on
+whether the ENGINE API is being used, so this function is no longer 
+recommended.
+
+RSA_set_method() selects B<meth> to perform all operations using the key
+B<rsa>. This will replace the RSA_METHOD used by the RSA key and if the
+previous method was supplied by an ENGINE, the handle to that ENGINE will
+be released during the change. It is possible to have RSA keys that only
+work with certain RSA_METHOD implementations (eg. from an ENGINE module
+that supports embedded hardware-protected keys), and in such cases
+attempting to change the RSA_METHOD for the key can have unexpected
+results.
+
+RSA_get_method() returns a pointer to the RSA_METHOD being used by B<rsa>.
+This method may or may not be supplied by an ENGINE implementation, but if
+it is, the return value can only be guaranteed to be valid as long as the
+RSA key itself is valid and does not have its implementation changed by
+RSA_set_method().
+
+RSA_flags() returns the B<flags> that are set for B<rsa>'s current
+RSA_METHOD. See the BUGS section.
 
 RSA_new_method() allocates and initializes an RSA structure so that
-B<engine> will be used for the RSA operations. If B<engine> is NULL,
-the default engine for RSA operations is used.
+B<engine> will be used for the RSA operations. If B<engine> is NULL, the
+default ENGINE for RSA operations is used, and if no default ENGINE is set,
+the RSA_METHOD controlled by RSA_set_default_method() is used.
 
 =head1 THE RSA_METHOD STRUCTURE
 
@@ -121,22 +133,45 @@ the default engine for RSA operations is used.
 
 =head1 RETURN VALUES
 
-RSA_PKCS1_SSLeay(), RSA_PKCS1_null_method(), RSA_get_default_openssl_method()
+RSA_PKCS1_SSLeay(), RSA_PKCS1_null_method(), RSA_get_default_method()
 and RSA_get_method() return pointers to the respective RSA_METHODs.
 
-RSA_set_default_openssl_method() returns no value.
+RSA_set_default_method() returns no value.
 
-RSA_set_method() selects B<engine> as the engine that will be responsible for
-all operations using the structure B<rsa>. If this function completes successfully,
-then the B<rsa> structure will have its own functional reference of B<engine>, so
-the caller should remember to free their own reference to B<engine> when they are
-finished with it. NB: An ENGINE's RSA_METHOD can be retrieved (or set) by
-ENGINE_get_RSA() or ENGINE_set_RSA().
+RSA_set_method() returns a pointer to the old RSA_METHOD implementation
+that was replaced. However, this return value should probably be ignored
+because if it was supplied by an ENGINE, the pointer could be invalidated
+at any time if the ENGINE is unloaded (in fact it could be unloaded as a
+result of the RSA_set_method() function releasing its handle to the
+ENGINE). For this reason, the return type may be replaced with a B<void>
+declaration in a future release.
 
-RSA_new_method() returns NULL and sets an error code that can be
-obtained by L<ERR_get_error(3)|ERR_get_error(3)> if the allocation fails. Otherwise
+RSA_new_method() returns NULL and sets an error code that can be obtained
+by L<ERR_get_error(3)|ERR_get_error(3)> if the allocation fails. Otherwise
 it returns a pointer to the newly allocated structure.
 
+=head1 NOTES
+
+As of version 0.9.7, RSA_METHOD implementations are grouped together with
+other algorithmic APIs (eg. DSA_METHOD, EVP_CIPHER, etc) into B<ENGINE>
+modules. If a default ENGINE is specified for RSA functionality using an
+ENGINE API function, that will override any RSA defaults set using the RSA
+API (ie.  RSA_set_default_method()). For this reason, the ENGINE API is the
+recommended way to control default implementations for use in RSA and other
+cryptographic algorithms.
+
+=head1 BUGS
+
+The behaviour of RSA_flags() is a mis-feature that is left as-is for now
+to avoid creating compatibility problems. RSA functionality, such as the
+encryption functions, are controlled by the B<flags> value in the RSA key
+itself, not by the B<flags> value in the RSA_METHOD attached to the RSA key
+(which is what this function returns). If the flags element of an RSA key
+is changed, the changes will be honoured by RSA functionality but will not
+be reflected in the return value of the RSA_flags() function - in effect
+RSA_flags() behaves more like an RSA_default_flags() function (which does
+not currently exist).
+
 =head1 SEE ALSO
 
 L<rsa(3)|rsa(3)>, L<RSA_new(3)|RSA_new(3)>
@@ -149,8 +184,14 @@ well as the rsa_sign and rsa_verify components of RSA_METHOD were
 added in OpenSSL 0.9.4.
 
 RSA_set_default_openssl_method() and RSA_get_default_openssl_method()
-replaced RSA_set_default_method() and RSA_get_default_method() respectively,
-and RSA_set_method() and RSA_new_method() were altered to use B<ENGINE>s
-rather than B<RSA_METHOD>s during development of OpenSSL 0.9.6.
+replaced RSA_set_default_method() and RSA_get_default_method()
+respectively, and RSA_set_method() and RSA_new_method() were altered to use
+B<ENGINE>s rather than B<RSA_METHOD>s during development of the engine
+version of OpenSSL 0.9.6. For 0.9.7, the handling of defaults in the ENGINE
+API was restructured so that this change was reversed, and behaviour of the
+other functions resembled more closely the previous behaviour. The
+behaviour of defaults in the ENGINE API now transparently overrides the
+behaviour of defaults in the RSA API without requiring changing these
+function prototypes.
 
 =cut
diff --git a/src/lib/libssl/src/doc/crypto/RSA_size.pod b/src/lib/libssl/src/doc/crypto/RSA_size.pod
index b36b4d58d5..5b7f835f95 100644
--- a/src/lib/libssl/src/doc/crypto/RSA_size.pod
+++ b/src/lib/libssl/src/doc/crypto/RSA_size.pod
@@ -8,7 +8,7 @@ RSA_size - get RSA modulus size
 
  #include <openssl/rsa.h>
 
- int RSA_size(RSA *rsa);
+ int RSA_size(const RSA *rsa);
 
 =head1 DESCRIPTION
 
diff --git a/src/lib/libssl/src/doc/crypto/dh.pod b/src/lib/libssl/src/doc/crypto/dh.pod
index b4be4be405..c3ccd06207 100644
--- a/src/lib/libssl/src/doc/crypto/dh.pod
+++ b/src/lib/libssl/src/doc/crypto/dh.pod
@@ -12,20 +12,20 @@ dh - Diffie-Hellman key agreement
  DH *   DH_new(void);
  void   DH_free(DH *dh);
 
- int    DH_size(DH *dh);
+ int    DH_size(const DH *dh);
 
  DH *   DH_generate_parameters(int prime_len, int generator,
                 void (*callback)(int, int, void *), void *cb_arg);
- int    DH_check(DH *dh, int *codes);
+ int    DH_check(const DH *dh, int *codes);
 
  int    DH_generate_key(DH *dh);
  int    DH_compute_key(unsigned char *key, BIGNUM *pub_key, DH *dh);
 
- void DH_set_default_openssl_method(DH_METHOD *meth);
- DH_METHOD *DH_get_default_openssl_method(void);
- int DH_set_method(DH *dh, ENGINE *engine);
+ void DH_set_default_method(const DH_METHOD *meth);
+ const DH_METHOD *DH_get_default_method(void);
+ int DH_set_method(DH *dh, const DH_METHOD *meth);
  DH *DH_new_method(ENGINE *engine);
- DH_METHOD *DH_OpenSSL(void);
+ const DH_METHOD *DH_OpenSSL(void);
 
  int DH_get_ex_new_index(long argl, char *argp, int (*new_func)(),
              int (*dup_func)(), void (*free_func)());
@@ -33,10 +33,10 @@ dh - Diffie-Hellman key agreement
  char *DH_get_ex_data(DH *d, int idx);
 
  DH *   d2i_DHparams(DH **a, unsigned char **pp, long length);
- int    i2d_DHparams(DH *a, unsigned char **pp);
+ int    i2d_DHparams(const DH *a, unsigned char **pp);
 
- int    DHparams_print_fp(FILE *fp, DH *x);
- int    DHparams_print(BIO *bp, DH *x);
+ int    DHparams_print_fp(FILE *fp, const DH *x);
+ int    DHparams_print(BIO *bp, const DH *x);
 
 =head1 DESCRIPTION
 
@@ -57,11 +57,20 @@ The B<DH> structure consists of several BIGNUM components.
         };
  DH
 
+Note that DH keys may use non-standard B<DH_METHOD> implementations,
+either directly or by the use of B<ENGINE> modules. In some cases (eg. an
+ENGINE providing support for hardware-embedded keys), these BIGNUM values
+will not be used by the implementation or may be used for alternative data
+storage. For this reason, applications should generally avoid using DH
+structure elements directly and instead use API functions to query or
+modify keys.
+
 =head1 SEE ALSO
 
 L<dhparam(1)|dhparam(1)>, L<bn(3)|bn(3)>, L<dsa(3)|dsa(3)>, L<err(3)|err(3)>,
-L<rand(3)|rand(3)>, L<rsa(3)|rsa(3)>, L<DH_set_method(3)|DH_set_method(3)>,
-L<DH_new(3)|DH_new(3)>, L<DH_get_ex_new_index(3)|DH_get_ex_new_index(3)>,
+L<rand(3)|rand(3)>, L<rsa(3)|rsa(3)>, L<engine(3)|engine(3)>,
+L<DH_set_method(3)|DH_set_method(3)>, L<DH_new(3)|DH_new(3)>,
+L<DH_get_ex_new_index(3)|DH_get_ex_new_index(3)>,
 L<DH_generate_parameters(3)|DH_generate_parameters(3)>,
 L<DH_compute_key(3)|DH_compute_key(3)>, L<d2i_DHparams(3)|d2i_DHparams(3)>,
 L<RSA_print(3)|RSA_print(3)> 
diff --git a/src/lib/libssl/src/doc/crypto/dsa.pod b/src/lib/libssl/src/doc/crypto/dsa.pod
index 82d7fb77cd..da07d2b930 100644
--- a/src/lib/libssl/src/doc/crypto/dsa.pod
+++ b/src/lib/libssl/src/doc/crypto/dsa.pod
@@ -12,13 +12,13 @@ dsa - Digital Signature Algorithm
  DSA *  DSA_new(void);
  void   DSA_free(DSA *dsa);
 
- int    DSA_size(DSA *dsa);
+ int    DSA_size(const DSA *dsa);
 
  DSA *  DSA_generate_parameters(int bits, unsigned char *seed,
                 int seed_len, int *counter_ret, unsigned long *h_ret,
                 void (*callback)(int, int, void *), void *cb_arg);
 
- DH *   DSA_dup_DH(DSA *r);
+ DH *   DSA_dup_DH(const DSA *r);
 
  int    DSA_generate_key(DSA *dsa);
 
@@ -27,13 +27,13 @@ dsa - Digital Signature Algorithm
  int    DSA_sign_setup(DSA *dsa, BN_CTX *ctx, BIGNUM **kinvp,
                 BIGNUM **rp);
  int    DSA_verify(int dummy, const unsigned char *dgst, int len,
-                unsigned char *sigbuf, int siglen, DSA *dsa);
+                const unsigned char *sigbuf, int siglen, DSA *dsa);
 
- void DSA_set_default_openssl_method(DSA_METHOD *meth);
- DSA_METHOD *DSA_get_default_openssl_method(void);
- int DSA_set_method(DSA *dsa, ENGINE *engine);
+ void DSA_set_default_method(const DSA_METHOD *meth);
+ const DSA_METHOD *DSA_get_default_method(void);
+ int DSA_set_method(DSA *dsa, const DSA_METHOD *meth);
  DSA *DSA_new_method(ENGINE *engine);
- DSA_METHOD *DSA_OpenSSL(void);
+ const DSA_METHOD *DSA_OpenSSL(void);
 
  int DSA_get_ex_new_index(long argl, char *argp, int (*new_func)(),
              int (*dup_func)(), void (*free_func)());
@@ -42,7 +42,7 @@ dsa - Digital Signature Algorithm
 
  DSA_SIG *DSA_SIG_new(void);
  void   DSA_SIG_free(DSA_SIG *a);
- int    i2d_DSA_SIG(DSA_SIG *a, unsigned char **pp);
+ int    i2d_DSA_SIG(const DSA_SIG *a, unsigned char **pp);
  DSA_SIG *d2i_DSA_SIG(DSA_SIG **v, unsigned char **pp, long length);
 
  DSA_SIG *DSA_do_sign(const unsigned char *dgst, int dlen, DSA *dsa);
@@ -52,14 +52,14 @@ dsa - Digital Signature Algorithm
  DSA *  d2i_DSAPublicKey(DSA **a, unsigned char **pp, long length);
  DSA *  d2i_DSAPrivateKey(DSA **a, unsigned char **pp, long length);
  DSA *  d2i_DSAparams(DSA **a, unsigned char **pp, long length);
- int    i2d_DSAPublicKey(DSA *a, unsigned char **pp);
- int    i2d_DSAPrivateKey(DSA *a, unsigned char **pp);
- int    i2d_DSAparams(DSA *a,unsigned char **pp);
+ int    i2d_DSAPublicKey(const DSA *a, unsigned char **pp);
+ int    i2d_DSAPrivateKey(const DSA *a, unsigned char **pp);
+ int    i2d_DSAparams(const DSA *a,unsigned char **pp);
 
- int    DSAparams_print(BIO *bp, DSA *x);
- int    DSAparams_print_fp(FILE *fp, DSA *x);
- int    DSA_print(BIO *bp, DSA *x, int off);
- int    DSA_print_fp(FILE *bp, DSA *x, int off);
+ int    DSAparams_print(BIO *bp, const DSA *x);
+ int    DSAparams_print_fp(FILE *fp, const DSA *x);
+ int    DSA_print(BIO *bp, const DSA *x, int off);
+ int    DSA_print_fp(FILE *bp, const DSA *x, int off);
 
 =head1 DESCRIPTION
 
@@ -85,6 +85,14 @@ The B<DSA> structure consists of several BIGNUM components.
 
 In public keys, B<priv_key> is NULL.
 
+Note that DSA keys may use non-standard B<DSA_METHOD> implementations,
+either directly or by the use of B<ENGINE> modules. In some cases (eg. an
+ENGINE providing support for hardware-embedded keys), these BIGNUM values
+will not be used by the implementation or may be used for alternative data
+storage. For this reason, applications should generally avoid using DSA
+structure elements directly and instead use API functions to query or
+modify keys.
+
 =head1 CONFORMING TO
 
 US Federal Information Processing Standard FIPS 186 (Digital Signature
@@ -93,7 +101,8 @@ Standard, DSS), ANSI X9.30
 =head1 SEE ALSO
 
 L<bn(3)|bn(3)>, L<dh(3)|dh(3)>, L<err(3)|err(3)>, L<rand(3)|rand(3)>,
-L<rsa(3)|rsa(3)>, L<sha(3)|sha(3)>, L<DSA_new(3)|DSA_new(3)>,
+L<rsa(3)|rsa(3)>, L<sha(3)|sha(3)>, L<engine(3)|engine(3)>,
+L<DSA_new(3)|DSA_new(3)>,
 L<DSA_size(3)|DSA_size(3)>,
 L<DSA_generate_parameters(3)|DSA_generate_parameters(3)>,
 L<DSA_dup_DH(3)|DSA_dup_DH(3)>,
diff --git a/src/lib/libssl/src/doc/crypto/engine.pod b/src/lib/libssl/src/doc/crypto/engine.pod
new file mode 100644
index 0000000000..61e0264bb7
--- /dev/null
+++ b/src/lib/libssl/src/doc/crypto/engine.pod
@@ -0,0 +1,621 @@
+=pod
+
+=head1 NAME
+
+engine - ENGINE cryptographic module support
+
+=head1 SYNOPSIS
+
+ #include <openssl/engine.h>
+
+ ENGINE *ENGINE_get_first(void);
+ ENGINE *ENGINE_get_last(void);
+ ENGINE *ENGINE_get_next(ENGINE *e);
+ ENGINE *ENGINE_get_prev(ENGINE *e);
+
+ int ENGINE_add(ENGINE *e);
+ int ENGINE_remove(ENGINE *e);
+
+ ENGINE *ENGINE_by_id(const char *id);
+
+ int ENGINE_init(ENGINE *e);
+ int ENGINE_finish(ENGINE *e);
+
+ void ENGINE_load_openssl(void);
+ void ENGINE_load_dynamic(void);
+ void ENGINE_load_cswift(void);
+ void ENGINE_load_chil(void);
+ void ENGINE_load_atalla(void);
+ void ENGINE_load_nuron(void);
+ void ENGINE_load_ubsec(void);
+ void ENGINE_load_aep(void);
+ void ENGINE_load_sureware(void);
+ void ENGINE_load_4758cca(void);
+ void ENGINE_load_openbsd_dev_crypto(void);
+ void ENGINE_load_builtin_engines(void);
+
+ void ENGINE_cleanup(void);
+
+ ENGINE *ENGINE_get_default_RSA(void);
+ ENGINE *ENGINE_get_default_DSA(void);
+ ENGINE *ENGINE_get_default_DH(void);
+ ENGINE *ENGINE_get_default_RAND(void);
+ ENGINE *ENGINE_get_cipher_engine(int nid);
+ ENGINE *ENGINE_get_digest_engine(int nid);
+
+ int ENGINE_set_default_RSA(ENGINE *e);
+ int ENGINE_set_default_DSA(ENGINE *e);
+ int ENGINE_set_default_DH(ENGINE *e);
+ int ENGINE_set_default_RAND(ENGINE *e);
+ int ENGINE_set_default_ciphers(ENGINE *e);
+ int ENGINE_set_default_digests(ENGINE *e);
+ int ENGINE_set_default_string(ENGINE *e, const char *list);
+
+ int ENGINE_set_default(ENGINE *e, unsigned int flags);
+
+ unsigned int ENGINE_get_table_flags(void);
+ void ENGINE_set_table_flags(unsigned int flags);
+
+ int ENGINE_register_RSA(ENGINE *e);
+ void ENGINE_unregister_RSA(ENGINE *e);
+ void ENGINE_register_all_RSA(void);
+ int ENGINE_register_DSA(ENGINE *e);
+ void ENGINE_unregister_DSA(ENGINE *e);
+ void ENGINE_register_all_DSA(void);
+ int ENGINE_register_DH(ENGINE *e);
+ void ENGINE_unregister_DH(ENGINE *e);
+ void ENGINE_register_all_DH(void);
+ int ENGINE_register_RAND(ENGINE *e);
+ void ENGINE_unregister_RAND(ENGINE *e);
+ void ENGINE_register_all_RAND(void);
+ int ENGINE_register_ciphers(ENGINE *e);
+ void ENGINE_unregister_ciphers(ENGINE *e);
+ void ENGINE_register_all_ciphers(void);
+ int ENGINE_register_digests(ENGINE *e);
+ void ENGINE_unregister_digests(ENGINE *e);
+ void ENGINE_register_all_digests(void);
+ int ENGINE_register_complete(ENGINE *e);
+ int ENGINE_register_all_complete(void);
+
+ int ENGINE_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)());
+ int ENGINE_cmd_is_executable(ENGINE *e, int cmd);
+ int ENGINE_ctrl_cmd(ENGINE *e, const char *cmd_name,
+         long i, void *p, void (*f)(), int cmd_optional);
+ int ENGINE_ctrl_cmd_string(ENGINE *e, const char *cmd_name, const char *arg,
+                 int cmd_optional);
+
+ int ENGINE_set_ex_data(ENGINE *e, int idx, void *arg);
+ void *ENGINE_get_ex_data(const ENGINE *e, int idx);
+
+ int ENGINE_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+         CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func);
+
+ ENGINE *ENGINE_new(void);
+ int ENGINE_free(ENGINE *e);
+
+ int ENGINE_set_id(ENGINE *e, const char *id);
+ int ENGINE_set_name(ENGINE *e, const char *name);
+ int ENGINE_set_RSA(ENGINE *e, const RSA_METHOD *rsa_meth);
+ int ENGINE_set_DSA(ENGINE *e, const DSA_METHOD *dsa_meth);
+ int ENGINE_set_DH(ENGINE *e, const DH_METHOD *dh_meth);
+ int ENGINE_set_RAND(ENGINE *e, const RAND_METHOD *rand_meth);
+ int ENGINE_set_destroy_function(ENGINE *e, ENGINE_GEN_INT_FUNC_PTR destroy_f);
+ int ENGINE_set_init_function(ENGINE *e, ENGINE_GEN_INT_FUNC_PTR init_f);
+ int ENGINE_set_finish_function(ENGINE *e, ENGINE_GEN_INT_FUNC_PTR finish_f);
+ int ENGINE_set_ctrl_function(ENGINE *e, ENGINE_CTRL_FUNC_PTR ctrl_f);
+ int ENGINE_set_load_privkey_function(ENGINE *e, ENGINE_LOAD_KEY_PTR loadpriv_f);
+ int ENGINE_set_load_pubkey_function(ENGINE *e, ENGINE_LOAD_KEY_PTR loadpub_f);
+ int ENGINE_set_ciphers(ENGINE *e, ENGINE_CIPHERS_PTR f);
+ int ENGINE_set_digests(ENGINE *e, ENGINE_DIGESTS_PTR f);
+ int ENGINE_set_flags(ENGINE *e, int flags);
+ int ENGINE_set_cmd_defns(ENGINE *e, const ENGINE_CMD_DEFN *defns);
+
+ const char *ENGINE_get_id(const ENGINE *e);
+ const char *ENGINE_get_name(const ENGINE *e);
+ const RSA_METHOD *ENGINE_get_RSA(const ENGINE *e);
+ const DSA_METHOD *ENGINE_get_DSA(const ENGINE *e);
+ const DH_METHOD *ENGINE_get_DH(const ENGINE *e);
+ const RAND_METHOD *ENGINE_get_RAND(const ENGINE *e);
+ ENGINE_GEN_INT_FUNC_PTR ENGINE_get_destroy_function(const ENGINE *e);
+ ENGINE_GEN_INT_FUNC_PTR ENGINE_get_init_function(const ENGINE *e);
+ ENGINE_GEN_INT_FUNC_PTR ENGINE_get_finish_function(const ENGINE *e);
+ ENGINE_CTRL_FUNC_PTR ENGINE_get_ctrl_function(const ENGINE *e);
+ ENGINE_LOAD_KEY_PTR ENGINE_get_load_privkey_function(const ENGINE *e);
+ ENGINE_LOAD_KEY_PTR ENGINE_get_load_pubkey_function(const ENGINE *e);
+ ENGINE_CIPHERS_PTR ENGINE_get_ciphers(const ENGINE *e);
+ ENGINE_DIGESTS_PTR ENGINE_get_digests(const ENGINE *e);
+ const EVP_CIPHER *ENGINE_get_cipher(ENGINE *e, int nid);
+ const EVP_MD *ENGINE_get_digest(ENGINE *e, int nid);
+ int ENGINE_get_flags(const ENGINE *e);
+ const ENGINE_CMD_DEFN *ENGINE_get_cmd_defns(const ENGINE *e);
+
+ EVP_PKEY *ENGINE_load_private_key(ENGINE *e, const char *key_id,
+     UI_METHOD *ui_method, void *callback_data);
+ EVP_PKEY *ENGINE_load_public_key(ENGINE *e, const char *key_id,
+     UI_METHOD *ui_method, void *callback_data);
+
+ void ENGINE_add_conf_module(void);
+
+=head1 DESCRIPTION
+
+These functions create, manipulate, and use cryptographic modules in the
+form of B<ENGINE> objects. These objects act as containers for
+implementations of cryptographic algorithms, and support a
+reference-counted mechanism to allow them to be dynamically loaded in and
+out of the running application.
+
+The cryptographic functionality that can be provided by an B<ENGINE>
+implementation includes the following abstractions;
+
+ RSA_METHOD - for providing alternative RSA implementations
+ DSA_METHOD, DH_METHOD, RAND_METHOD - alternative DSA, DH, and RAND
+ EVP_CIPHER - potentially multiple cipher algorithms (indexed by 'nid')
+ EVP_DIGEST - potentially multiple hash algorithms (indexed by 'nid')
+ key-loading - loading public and/or private EVP_PKEY keys
+
+=head2 Reference counting and handles
+
+Due to the modular nature of the ENGINE API, pointers to ENGINEs need to be
+treated as handles - ie. not only as pointers, but also as references to
+the underlying ENGINE object. Ie. you should obtain a new reference when
+making copies of an ENGINE pointer if the copies will be used (and
+released) independantly.
+
+ENGINE objects have two levels of reference-counting to match the way in
+which the objects are used. At the most basic level, each ENGINE pointer is
+inherently a B<structural> reference - you need a structural reference
+simply to refer to the pointer value at all, as this kind of reference is
+your guarantee that the structure can not be deallocated until you release
+your reference.
+
+However, a structural reference provides no guarantee that the ENGINE has
+been initiliased to be usable to perform any of its cryptographic
+implementations - and indeed it's quite possible that most ENGINEs will not
+initialised at all on standard setups, as ENGINEs are typically used to
+support specialised hardware. To use an ENGINE's functionality, you need a
+B<functional> reference. This kind of reference can be considered a
+specialised form of structural reference, because each functional reference
+implicitly contains a structural reference as well - however to avoid
+difficult-to-find programming bugs, it is recommended to treat the two
+kinds of reference independantly. If you have a functional reference to an
+ENGINE, you have a guarantee that the ENGINE has been initialised ready to
+perform cryptographic operations and will not be uninitialised or cleaned
+up until after you have released your reference.
+
+We will discuss the two kinds of reference separately, including how to
+tell which one you are dealing with at any given point in time (after all
+they are both simply (ENGINE *) pointers, the difference is in the way they
+are used).
+
+=head3 Structural references
+
+This basic type of reference is typically used for creating new ENGINEs
+dynamically, iterating across OpenSSL's internal linked-list of loaded
+ENGINEs, reading information about an ENGINE, etc. Essentially a structural
+reference is sufficient if you only need to query or manipulate the data of
+an ENGINE implementation rather than use its functionality.
+
+The ENGINE_new() function returns a structural reference to a new (empty)
+ENGINE object. Other than that, structural references come from return
+values to various ENGINE API functions such as; ENGINE_by_id(),
+ENGINE_get_first(), ENGINE_get_last(), ENGINE_get_next(),
+ENGINE_get_prev(). All structural references should be released by a
+corresponding to call to the ENGINE_free() function - the ENGINE object
+itself will only actually be cleaned up and deallocated when the last
+structural reference is released.
+
+It should also be noted that many ENGINE API function calls that accept a
+structural reference will internally obtain another reference - typically
+this happens whenever the supplied ENGINE will be needed by OpenSSL after
+the function has returned. Eg. the function to add a new ENGINE to
+OpenSSL's internal list is ENGINE_add() - if this function returns success,
+then OpenSSL will have stored a new structural reference internally so the
+caller is still responsible for freeing their own reference with
+ENGINE_free() when they are finished with it. In a similar way, some
+functions will automatically release the structural reference passed to it
+if part of the function's job is to do so. Eg. the ENGINE_get_next() and
+ENGINE_get_prev() functions are used for iterating across the internal
+ENGINE list - they will return a new structural reference to the next (or
+previous) ENGINE in the list or NULL if at the end (or beginning) of the
+list, but in either case the structural reference passed to the function is
+released on behalf of the caller.
+
+To clarify a particular function's handling of references, one should
+always consult that function's documentation "man" page, or failing that
+the openssl/engine.h header file includes some hints.
+
+=head3 Functional references
+
+As mentioned, functional references exist when the cryptographic
+functionality of an ENGINE is required to be available. A functional
+reference can be obtained in one of two ways; from an existing structural
+reference to the required ENGINE, or by asking OpenSSL for the default
+operational ENGINE for a given cryptographic purpose.
+
+To obtain a functional reference from an existing structural reference,
+call the ENGINE_init() function. This returns zero if the ENGINE was not
+already operational and couldn't be successfully initialised (eg. lack of
+system drivers, no special hardware attached, etc), otherwise it will
+return non-zero to indicate that the ENGINE is now operational and will
+have allocated a new B<functional> reference to the ENGINE. In this case,
+the supplied ENGINE pointer is, from the point of the view of the caller,
+both a structural reference and a functional reference - so if the caller
+intends to use it as a functional reference it should free the structural
+reference with ENGINE_free() first. If the caller wishes to use it only as
+a structural reference (eg. if the ENGINE_init() call was simply to test if
+the ENGINE seems available/online), then it should free the functional
+reference; all functional references are released by the ENGINE_finish()
+function.
+
+The second way to get a functional reference is by asking OpenSSL for a
+default implementation for a given task, eg. by ENGINE_get_default_RSA(),
+ENGINE_get_default_cipher_engine(), etc. These are discussed in the next
+section, though they are not usually required by application programmers as
+they are used automatically when creating and using the relevant
+algorithm-specific types in OpenSSL, such as RSA, DSA, EVP_CIPHER_CTX, etc.
+
+=head2 Default implementations
+
+For each supported abstraction, the ENGINE code maintains an internal table
+of state to control which implementations are available for a given
+abstraction and which should be used by default. These implementations are
+registered in the tables separated-out by an 'nid' index, because
+abstractions like EVP_CIPHER and EVP_DIGEST support many distinct
+algorithms and modes - ENGINEs will support different numbers and
+combinations of these. In the case of other abstractions like RSA, DSA,
+etc, there is only one "algorithm" so all implementations implicitly
+register using the same 'nid' index. ENGINEs can be B<registered> into
+these tables to make themselves available for use automatically by the
+various abstractions, eg. RSA. For illustrative purposes, we continue with
+the RSA example, though all comments apply similarly to the other
+abstractions (they each get their own table and linkage to the
+corresponding section of openssl code).
+
+When a new RSA key is being created, ie. in RSA_new_method(), a
+"get_default" call will be made to the ENGINE subsystem to process the RSA
+state table and return a functional reference to an initialised ENGINE
+whose RSA_METHOD should be used. If no ENGINE should (or can) be used, it
+will return NULL and the RSA key will operate with a NULL ENGINE handle by
+using the conventional RSA implementation in OpenSSL (and will from then on
+behave the way it used to before the ENGINE API existed - for details see
+L<RSA_new_method(3)|RSA_new_method(3)>).
+
+Each state table has a flag to note whether it has processed this
+"get_default" query since the table was last modified, because to process
+this question it must iterate across all the registered ENGINEs in the
+table trying to initialise each of them in turn, in case one of them is
+operational. If it returns a functional reference to an ENGINE, it will
+also cache another reference to speed up processing future queries (without
+needing to iterate across the table). Likewise, it will cache a NULL
+response if no ENGINE was available so that future queries won't repeat the
+same iteration unless the state table changes. This behaviour can also be
+changed; if the ENGINE_TABLE_FLAG_NOINIT flag is set (using
+ENGINE_set_table_flags()), no attempted initialisations will take place,
+instead the only way for the state table to return a non-NULL ENGINE to the
+"get_default" query will be if one is expressly set in the table. Eg.
+ENGINE_set_default_RSA() does the same job as ENGINE_register_RSA() except
+that it also sets the state table's cached response for the "get_default"
+query.
+
+In the case of abstractions like EVP_CIPHER, where implementations are
+indexed by 'nid', these flags and cached-responses are distinct for each
+'nid' value.
+
+It is worth illustrating the difference between "registration" of ENGINEs
+into these per-algorithm state tables and using the alternative
+"set_default" functions. The latter handles both "registration" and also
+setting the cached "default" ENGINE in each relevant state table - so
+registered ENGINEs will only have a chance to be initialised for use as a
+default if a default ENGINE wasn't already set for the same state table.
+Eg. if ENGINE X supports cipher nids {A,B} and RSA, ENGINE Y supports
+ciphers {A} and DSA, and the following code is executed;
+
+ ENGINE_register_complete(X);
+ ENGINE_set_default(Y, ENGINE_METHOD_ALL);
+ e1 = ENGINE_get_default_RSA();
+ e2 = ENGINE_get_cipher_engine(A);
+ e3 = ENGINE_get_cipher_engine(B);
+ e4 = ENGINE_get_default_DSA();
+ e5 = ENGINE_get_cipher_engine(C);
+
+The results would be as follows;
+
+ assert(e1 == X);
+ assert(e2 == Y);
+ assert(e3 == X);
+ assert(e4 == Y);
+ assert(e5 == NULL);
+
+=head2 Application requirements
+
+This section will explain the basic things an application programmer should
+support to make the most useful elements of the ENGINE functionality
+available to the user. The first thing to consider is whether the
+programmer wishes to make alternative ENGINE modules available to the
+application and user. OpenSSL maintains an internal linked list of
+"visible" ENGINEs from which it has to operate - at start-up, this list is
+empty and in fact if an application does not call any ENGINE API calls and
+it uses static linking against openssl, then the resulting application
+binary will not contain any alternative ENGINE code at all. So the first
+consideration is whether any/all available ENGINE implementations should be
+made visible to OpenSSL - this is controlled by calling the various "load"
+functions, eg.
+
+ /* Make the "dynamic" ENGINE available */
+ void ENGINE_load_dynamic(void);
+ /* Make the CryptoSwift hardware acceleration support available */
+ void ENGINE_load_cswift(void);
+ /* Make support for nCipher's "CHIL" hardware available */
+ void ENGINE_load_chil(void);
+ ...
+ /* Make ALL ENGINE implementations bundled with OpenSSL available */
+ void ENGINE_load_builtin_engines(void);
+
+Having called any of these functions, ENGINE objects would have been
+dynamically allocated and populated with these implementations and linked
+into OpenSSL's internal linked list. At this point it is important to
+mention an important API function;
+
+ void ENGINE_cleanup(void);
+
+If no ENGINE API functions are called at all in an application, then there
+are no inherent memory leaks to worry about from the ENGINE functionality,
+however if any ENGINEs are "load"ed, even if they are never registered or
+used, it is necessary to use the ENGINE_cleanup() function to
+correspondingly cleanup before program exit, if the caller wishes to avoid
+memory leaks. This mechanism uses an internal callback registration table
+so that any ENGINE API functionality that knows it requires cleanup can
+register its cleanup details to be called during ENGINE_cleanup(). This
+approach allows ENGINE_cleanup() to clean up after any ENGINE functionality
+at all that your program uses, yet doesn't automatically create linker
+dependencies to all possible ENGINE functionality - only the cleanup
+callbacks required by the functionality you do use will be required by the
+linker.
+
+The fact that ENGINEs are made visible to OpenSSL (and thus are linked into
+the program and loaded into memory at run-time) does not mean they are
+"registered" or called into use by OpenSSL automatically - that behaviour
+is something for the application to have control over. Some applications
+will want to allow the user to specify exactly which ENGINE they want used
+if any is to be used at all. Others may prefer to load all support and have
+OpenSSL automatically use at run-time any ENGINE that is able to
+successfully initialise - ie. to assume that this corresponds to
+acceleration hardware attached to the machine or some such thing. There are
+probably numerous other ways in which applications may prefer to handle
+things, so we will simply illustrate the consequences as they apply to a
+couple of simple cases and leave developers to consider these and the
+source code to openssl's builtin utilities as guides.
+
+=head3 Using a specific ENGINE implementation
+
+Here we'll assume an application has been configured by its user or admin
+to want to use the "ACME" ENGINE if it is available in the version of
+OpenSSL the application was compiled with. If it is available, it should be
+used by default for all RSA, DSA, and symmetric cipher operation, otherwise
+OpenSSL should use its builtin software as per usual. The following code
+illustrates how to approach this;
+
+ ENGINE *e;
+ const char *engine_id = "ACME";
+ ENGINE_load_builtin_engines();
+ e = ENGINE_by_id(engine_id);
+ if(!e)
+     /* the engine isn't available */
+     return;
+ if(!ENGINE_init(e)) {
+     /* the engine couldn't initialise, release 'e' */
+     ENGINE_free(e);
+     return;
+ }
+ if(!ENGINE_set_default_RSA(e))
+     /* This should only happen when 'e' can't initialise, but the previous
+      * statement suggests it did. */
+     abort();
+ ENGINE_set_default_DSA(e);
+ ENGINE_set_default_ciphers(e);
+ /* Release the functional reference from ENGINE_init() */
+ ENGINE_finish(e);
+ /* Release the structural reference from ENGINE_by_id() */
+ ENGINE_free(e);
+
+=head3 Automatically using builtin ENGINE implementations
+
+Here we'll assume we want to load and register all ENGINE implementations
+bundled with OpenSSL, such that for any cryptographic algorithm required by
+OpenSSL - if there is an ENGINE that implements it and can be initialise,
+it should be used. The following code illustrates how this can work;
+
+ /* Load all bundled ENGINEs into memory and make them visible */
+ ENGINE_load_builtin_engines();
+ /* Register all of them for every algorithm they collectively implement */
+ ENGINE_register_all_complete();
+
+That's all that's required. Eg. the next time OpenSSL tries to set up an
+RSA key, any bundled ENGINEs that implement RSA_METHOD will be passed to
+ENGINE_init() and if any of those succeed, that ENGINE will be set as the
+default for use with RSA from then on.
+
+=head2 Advanced configuration support
+
+There is a mechanism supported by the ENGINE framework that allows each
+ENGINE implementation to define an arbitrary set of configuration
+"commands" and expose them to OpenSSL and any applications based on
+OpenSSL. This mechanism is entirely based on the use of name-value pairs
+and and assumes ASCII input (no unicode or UTF for now!), so it is ideal if
+applications want to provide a transparent way for users to provide
+arbitrary configuration "directives" directly to such ENGINEs. It is also
+possible for the application to dynamically interrogate the loaded ENGINE
+implementations for the names, descriptions, and input flags of their
+available "control commands", providing a more flexible configuration
+scheme. However, if the user is expected to know which ENGINE device he/she
+is using (in the case of specialised hardware, this goes without saying)
+then applications may not need to concern themselves with discovering the
+supported control commands and simply prefer to allow settings to passed
+into ENGINEs exactly as they are provided by the user.
+
+Before illustrating how control commands work, it is worth mentioning what
+they are typically used for. Broadly speaking there are two uses for
+control commands; the first is to provide the necessary details to the
+implementation (which may know nothing at all specific to the host system)
+so that it can be initialised for use. This could include the path to any
+driver or config files it needs to load, required network addresses,
+smart-card identifiers, passwords to initialise password-protected devices,
+logging information, etc etc. This class of commands typically needs to be
+passed to an ENGINE B<before> attempting to initialise it, ie. before
+calling ENGINE_init(). The other class of commands consist of settings or
+operations that tweak certain behaviour or cause certain operations to take
+place, and these commands may work either before or after ENGINE_init(), or
+in same cases both. ENGINE implementations should provide indications of
+this in the descriptions attached to builtin control commands and/or in
+external product documentation.
+
+=head3 Issuing control commands to an ENGINE
+
+Let's illustrate by example; a function for which the caller supplies the
+name of the ENGINE it wishes to use, a table of string-pairs for use before
+initialisation, and another table for use after initialisation. Note that
+the string-pairs used for control commands consist of a command "name"
+followed by the command "parameter" - the parameter could be NULL in some
+cases but the name can not. This function should initialise the ENGINE
+(issuing the "pre" commands beforehand and the "post" commands afterwards)
+and set it as the default for everything except RAND and then return a
+boolean success or failure.
+
+ int generic_load_engine_fn(const char *engine_id,
+                            const char **pre_cmds, int pre_num,
+                            const char **post_cmds, int post_num)
+ {
+     ENGINE *e = ENGINE_by_id(engine_id);
+     if(!e) return 0;
+     while(pre_num--) {
+         if(!ENGINE_ctrl_cmd_string(e, pre_cmds[0], pre_cmds[1], 0)) {
+             fprintf(stderr, "Failed command (%s - %s:%s)\n", engine_id,
+                 pre_cmds[0], pre_cmds[1] ? pre_cmds[1] : "(NULL)");
+             ENGINE_free(e);
+             return 0;
+         }
+         pre_cmds += 2;
+     }
+     if(!ENGINE_init(e)) {
+         fprintf(stderr, "Failed initialisation\n");
+         ENGINE_free(e);
+         return 0;
+     }
+     /* ENGINE_init() returned a functional reference, so free the structural
+      * reference from ENGINE_by_id(). */
+     ENGINE_free(e);
+     while(post_num--) {
+         if(!ENGINE_ctrl_cmd_string(e, post_cmds[0], post_cmds[1], 0)) {
+             fprintf(stderr, "Failed command (%s - %s:%s)\n", engine_id,
+                 post_cmds[0], post_cmds[1] ? post_cmds[1] : "(NULL)");
+             ENGINE_finish(e);
+             return 0;
+         }
+         post_cmds += 2;
+     }
+     ENGINE_set_default(e, ENGINE_METHOD_ALL & ~ENGINE_METHOD_RAND);
+     /* Success */
+     return 1;
+ }
+
+Note that ENGINE_ctrl_cmd_string() accepts a boolean argument that can
+relax the semantics of the function - if set non-zero it will only return
+failure if the ENGINE supported the given command name but failed while
+executing it, if the ENGINE doesn't support the command name it will simply
+return success without doing anything. In this case we assume the user is
+only supplying commands specific to the given ENGINE so we set this to
+FALSE.
+
+=head3 Discovering supported control commands
+
+It is possible to discover at run-time the names, numerical-ids, descriptions
+and input parameters of the control commands supported from a structural
+reference to any ENGINE. It is first important to note that some control
+commands are defined by OpenSSL itself and it will intercept and handle these
+control commands on behalf of the ENGINE, ie. the ENGINE's ctrl() handler is not
+used for the control command. openssl/engine.h defines a symbol,
+ENGINE_CMD_BASE, that all control commands implemented by ENGINEs from. Any
+command value lower than this symbol is considered a "generic" command is
+handled directly by the OpenSSL core routines.
+
+It is using these "core" control commands that one can discover the the control
+commands implemented by a given ENGINE, specifically the commands;
+
+ #define ENGINE_HAS_CTRL_FUNCTION               10
+ #define ENGINE_CTRL_GET_FIRST_CMD_TYPE         11
+ #define ENGINE_CTRL_GET_NEXT_CMD_TYPE          12
+ #define ENGINE_CTRL_GET_CMD_FROM_NAME          13
+ #define ENGINE_CTRL_GET_NAME_LEN_FROM_CMD      14
+ #define ENGINE_CTRL_GET_NAME_FROM_CMD          15
+ #define ENGINE_CTRL_GET_DESC_LEN_FROM_CMD      16
+ #define ENGINE_CTRL_GET_DESC_FROM_CMD          17
+ #define ENGINE_CTRL_GET_CMD_FLAGS              18
+
+Whilst these commands are automatically processed by the OpenSSL framework code,
+they use various properties exposed by each ENGINE by which to process these
+queries. An ENGINE has 3 properties it exposes that can affect this behaviour;
+it can supply a ctrl() handler, it can specify ENGINE_FLAGS_MANUAL_CMD_CTRL in
+the ENGINE's flags, and it can expose an array of control command descriptions.
+If an ENGINE specifies the ENGINE_FLAGS_MANUAL_CMD_CTRL flag, then it will
+simply pass all these "core" control commands directly to the ENGINE's ctrl()
+handler (and thus, it must have supplied one), so it is up to the ENGINE to
+reply to these "discovery" commands itself. If that flag is not set, then the
+OpenSSL framework code will work with the following rules;
+
+ if no ctrl() handler supplied;
+     ENGINE_HAS_CTRL_FUNCTION returns FALSE (zero),
+     all other commands fail.
+ if a ctrl() handler was supplied but no array of control commands;
+     ENGINE_HAS_CTRL_FUNCTION returns TRUE,
+     all other commands fail.
+ if a ctrl() handler and array of control commands was supplied;
+     ENGINE_HAS_CTRL_FUNCTION returns TRUE,
+     all other commands proceed processing ...
+
+If the ENGINE's array of control commands is empty then all other commands will
+fail, otherwise; ENGINE_CTRL_GET_FIRST_CMD_TYPE returns the identifier of
+the first command supported by the ENGINE, ENGINE_GET_NEXT_CMD_TYPE takes the
+identifier of a command supported by the ENGINE and returns the next command
+identifier or fails if there are no more, ENGINE_CMD_FROM_NAME takes a string
+name for a command and returns the corresponding identifier or fails if no such
+command name exists, and the remaining commands take a command identifier and
+return properties of the corresponding commands. All except
+ENGINE_CTRL_GET_FLAGS return the string length of a command name or description,
+or populate a supplied character buffer with a copy of the command name or
+description. ENGINE_CTRL_GET_FLAGS returns a bitwise-OR'd mask of the following
+possible values;
+
+ #define ENGINE_CMD_FLAG_NUMERIC                (unsigned int)0x0001
+ #define ENGINE_CMD_FLAG_STRING                 (unsigned int)0x0002
+ #define ENGINE_CMD_FLAG_NO_INPUT               (unsigned int)0x0004
+ #define ENGINE_CMD_FLAG_INTERNAL               (unsigned int)0x0008
+
+If the ENGINE_CMD_FLAG_INTERNAL flag is set, then any other flags are purely
+informational to the caller - this flag will prevent the command being usable
+for any higher-level ENGINE functions such as ENGINE_ctrl_cmd_string().
+"INTERNAL" commands are not intended to be exposed to text-based configuration
+by applications, administrations, users, etc. These can support arbitrary
+operations via ENGINE_ctrl(), including passing to and/or from the control
+commands data of any arbitrary type. These commands are supported in the
+discovery mechanisms simply to allow applications determinie if an ENGINE
+supports certain specific commands it might want to use (eg. application "foo"
+might query various ENGINEs to see if they implement "FOO_GET_VENDOR_LOGO_GIF" -
+and ENGINE could therefore decide whether or not to support this "foo"-specific
+extension).
+
+=head2 Future developments
+
+The ENGINE API and internal architecture is currently being reviewed. Slated for
+possible release in 0.9.8 is support for transparent loading of "dynamic"
+ENGINEs (built as self-contained shared-libraries). This would allow ENGINE
+implementations to be provided independantly of OpenSSL libraries and/or
+OpenSSL-based applications, and would also remove any requirement for
+applications to explicitly use the "dynamic" ENGINE to bind to shared-library
+implementations.
+
+=head1 SEE ALSO
+
+L<rsa(3)|rsa(3)>, L<dsa(3)|dsa(3)>, L<dh(3)|dh(3)>, L<rand(3)|rand(3)>,
+L<RSA_new_method(3)|RSA_new_method(3)>
+
+=cut
diff --git a/src/lib/libssl/src/doc/crypto/evp.pod b/src/lib/libssl/src/doc/crypto/evp.pod
index edf47dbde6..b3ca14314f 100644
--- a/src/lib/libssl/src/doc/crypto/evp.pod
+++ b/src/lib/libssl/src/doc/crypto/evp.pod
@@ -24,6 +24,13 @@ functions.  The B<EVP_Digest>I<...> functions provide message digests.
 
 Algorithms are loaded with OpenSSL_add_all_algorithms(3).
 
+All the symmetric algorithms (ciphers) and digests can be replaced by ENGINE
+modules providing alternative implementations. If ENGINE implementations of
+ciphers or digests are registered as defaults, then the various EVP functions
+will automatically use those implementations automatically in preference to
+built in software implementations. For more information, consult the engine(3)
+man page.
+
 =head1 SEE ALSO
 
 L<EVP_DigestInit(3)|EVP_DigestInit(3)>,
@@ -32,6 +39,7 @@ L<EVP_OpenInit(3)|EVP_OpenInit(3)>,
 L<EVP_SealInit(3)|EVP_SealInit(3)>,
 L<EVP_SignInit(3)|EVP_SignInit(3)>,
 L<EVP_VerifyInit(3)|EVP_VerifyInit(3)>,
-L<OpenSSL_add_all_algorithms(3)|OpenSSL_add_all_algorithms(3)>
+L<OpenSSL_add_all_algorithms(3)|OpenSSL_add_all_algorithms(3)>,
+L<engine(3)|engine(3)>
 
 =cut
diff --git a/src/lib/libssl/src/doc/crypto/rand.pod b/src/lib/libssl/src/doc/crypto/rand.pod
index 96901f109e..1c068c85b3 100644
--- a/src/lib/libssl/src/doc/crypto/rand.pod
+++ b/src/lib/libssl/src/doc/crypto/rand.pod
@@ -8,13 +8,14 @@ rand - pseudo-random number generator
 
  #include <openssl/rand.h>
 
+ int  RAND_set_rand_engine(ENGINE *engine);
+
  int  RAND_bytes(unsigned char *buf, int num);
  int  RAND_pseudo_bytes(unsigned char *buf, int num);
 
  void RAND_seed(const void *buf, int num);
  void RAND_add(const void *buf, int num, int entropy);
  int  RAND_status(void);
- void RAND_screen(void);
 
  int  RAND_load_file(const char *file, long max_bytes);
  int  RAND_write_file(const char *file);
@@ -22,14 +23,31 @@ rand - pseudo-random number generator
 
  int  RAND_egd(const char *path);
 
- void RAND_set_rand_method(RAND_METHOD *meth);
- RAND_METHOD *RAND_get_rand_method(void);
+ void RAND_set_rand_method(const RAND_METHOD *meth);
+ const RAND_METHOD *RAND_get_rand_method(void);
  RAND_METHOD *RAND_SSLeay(void);
 
  void RAND_cleanup(void);
 
+ /* For Win32 only */
+ void RAND_screen(void);
+ int RAND_event(UINT, WPARAM, LPARAM);
+
 =head1 DESCRIPTION
 
+Since the introduction of the ENGINE API, the recommended way of controlling
+default implementations is by using the ENGINE API functions. The default
+B<RAND_METHOD>, as set by RAND_set_rand_method() and returned by
+RAND_get_rand_method(), is only used if no ENGINE has been set as the default
+"rand" implementation. Hence, these two functions are no longer the recommened
+way to control defaults.
+
+If an alternative B<RAND_METHOD> implementation is being used (either set
+directly or as provided by an ENGINE module), then it is entirely responsible
+for the generation and management of a cryptographically secure PRNG stream. The
+mechanisms described below relate solely to the software PRNG implementation
+built in to OpenSSL and used by default.
+
 These functions implement a cryptographically secure pseudo-random
 number generator (PRNG). It is used by other library functions for
 example to generate random keys, and applications can use it when they
diff --git a/src/lib/libssl/src/doc/crypto/rsa.pod b/src/lib/libssl/src/doc/crypto/rsa.pod
index 2b93a12b65..45ac53ffc1 100644
--- a/src/lib/libssl/src/doc/crypto/rsa.pod
+++ b/src/lib/libssl/src/doc/crypto/rsa.pod
@@ -16,13 +16,17 @@ rsa - RSA public key cryptosystem
     unsigned char *to, RSA *rsa, int padding);
  int RSA_private_decrypt(int flen, unsigned char *from,
     unsigned char *to, RSA *rsa, int padding);
+ int RSA_private_encrypt(int flen, unsigned char *from,
+    unsigned char *to, RSA *rsa,int padding);
+ int RSA_public_decrypt(int flen, unsigned char *from, 
+    unsigned char *to, RSA *rsa,int padding);
 
  int RSA_sign(int type, unsigned char *m, unsigned int m_len,
     unsigned char *sigret, unsigned int *siglen, RSA *rsa);
  int RSA_verify(int type, unsigned char *m, unsigned int m_len,
     unsigned char *sigbuf, unsigned int siglen, RSA *rsa);
 
- int RSA_size(RSA *rsa);
+ int RSA_size(const RSA *rsa);
 
  RSA *RSA_generate_key(int num, unsigned long e,
     void (*callback)(int,int,void *), void *cb_arg);
@@ -32,13 +36,13 @@ rsa - RSA public key cryptosystem
  int RSA_blinding_on(RSA *rsa, BN_CTX *ctx);
  void RSA_blinding_off(RSA *rsa);
 
- void RSA_set_default_openssl_method(RSA_METHOD *meth);
- RSA_METHOD *RSA_get_default_openssl_method(void);
- int RSA_set_method(RSA *rsa, ENGINE *engine);
- RSA_METHOD *RSA_get_method(RSA *rsa);
+ void RSA_set_default_method(const RSA_METHOD *meth);
+ const RSA_METHOD *RSA_get_default_method(void);
+ int RSA_set_method(RSA *rsa, const RSA_METHOD *meth);
+ const RSA_METHOD *RSA_get_method(const RSA *rsa);
  RSA_METHOD *RSA_PKCS1_SSLeay(void);
  RSA_METHOD *RSA_null_method(void);
- int RSA_flags(RSA *rsa);
+ int RSA_flags(const RSA *rsa);
  RSA *RSA_new_method(ENGINE *engine);
 
  int RSA_print(BIO *bp, RSA *x, int offset);
@@ -49,11 +53,6 @@ rsa - RSA public key cryptosystem
  int RSA_set_ex_data(RSA *r,int idx,char *arg);
  char *RSA_get_ex_data(RSA *r, int idx);
 
- int RSA_private_encrypt(int flen, unsigned char *from,
-    unsigned char *to, RSA *rsa,int padding);
- int RSA_public_decrypt(int flen, unsigned char *from, 
-    unsigned char *to, RSA *rsa,int padding);
-
  int RSA_sign_ASN1_OCTET_STRING(int dummy, unsigned char *m,
     unsigned int m_len, unsigned char *sigret, unsigned int *siglen,
     RSA *rsa);
@@ -90,6 +89,14 @@ B<p>, B<q>, B<dmp1>, B<dmq1> and B<iqmp> may be B<NULL> in private
 keys, but the RSA operations are much faster when these values are
 available.
 
+Note that RSA keys may use non-standard B<RSA_METHOD> implementations,
+either directly or by the use of B<ENGINE> modules. In some cases (eg. an
+ENGINE providing support for hardware-embedded keys), these BIGNUM values
+will not be used by the implementation or may be used for alternative data
+storage. For this reason, applications should generally avoid using RSA
+structure elements directly and instead use API functions to query or
+modify keys.
+
 =head1 CONFORMING TO
 
 SSL, PKCS #1 v2.0
@@ -101,7 +108,7 @@ RSA was covered by a US patent which expired in September 2000.
 =head1 SEE ALSO
 
 L<rsa(1)|rsa(1)>, L<bn(3)|bn(3)>, L<dsa(3)|dsa(3)>, L<dh(3)|dh(3)>,
-L<rand(3)|rand(3)>, L<RSA_new(3)|RSA_new(3)>,
+L<rand(3)|rand(3)>, L<engine(3)|engine(3)>, L<RSA_new(3)|RSA_new(3)>,
 L<RSA_public_encrypt(3)|RSA_public_encrypt(3)>,
 L<RSA_sign(3)|RSA_sign(3)>, L<RSA_size(3)|RSA_size(3)>,
 L<RSA_generate_key(3)|RSA_generate_key(3)>,
diff --git a/src/lib/libssl/src/doc/openssl.txt b/src/lib/libssl/src/doc/openssl.txt
index 5da519e7e4..432a17b66c 100644
--- a/src/lib/libssl/src/doc/openssl.txt
+++ b/src/lib/libssl/src/doc/openssl.txt
@@ -344,7 +344,7 @@ the extension.
 
 Examples:
 
-subjectAltName=email:copy,email:my@other.address,URL:http://my.url.here/
+subjectAltName=email:copy,email:my@other.address,URI:http://my.url.here/
 subjectAltName=email:my@other.address,RID:1.2.3.4
 
 Issuer Alternative Name.
diff --git a/src/lib/libssl/src/doc/ssl/SSL_CTX_set_msg_callback.pod b/src/lib/libssl/src/doc/ssl/SSL_CTX_set_msg_callback.pod
index a423932d0a..0015e6ea79 100644
--- a/src/lib/libssl/src/doc/ssl/SSL_CTX_set_msg_callback.pod
+++ b/src/lib/libssl/src/doc/ssl/SSL_CTX_set_msg_callback.pod
@@ -69,6 +69,8 @@ The B<SSL> object that received or sent the message.
 The user-defined argument optionally defined by
 SSL_CTX_set_msg_callback_arg() or SSL_set_msg_callback_arg().
 
+=back
+
 =head1 NOTES
 
 Protocol messages are passed to the callback function after decryption
diff --git a/src/lib/libssl/src/ssl/s2_clnt.c b/src/lib/libssl/src/ssl/s2_clnt.c
index 26efe53856..570d0664ed 100644
--- a/src/lib/libssl/src/ssl/s2_clnt.c
+++ b/src/lib/libssl/src/ssl/s2_clnt.c
@@ -536,7 +536,12 @@ static int get_server_hello(SSL *s)
                 }
                 
         s->s2->conn_id_length=s->s2->tmp.conn_id_length;
-        die(s->s2->conn_id_length <= sizeof s->s2->conn_id);
+        if (s->s2->conn_id_length > sizeof s->s2->conn_id)
+                {
+                ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
+                SSLerr(SSL_F_GET_SERVER_HELLO, SSL_R_SSL2_CONNECTION_ID_TOO_LONG);
+                return -1;
+                }
         memcpy(s->s2->conn_id,p,s->s2->tmp.conn_id_length);
         return(1);
         }
@@ -638,7 +643,12 @@ static int client_master_key(SSL *s)
                 /* make key_arg data */
                 i=EVP_CIPHER_iv_length(c);
                 sess->key_arg_length=i;
-                die(i <= SSL_MAX_KEY_ARG_LENGTH);
+                if (i > SSL_MAX_KEY_ARG_LENGTH)
+                        {
+                        ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
+                        SSLerr(SSL_F_CLIENT_MASTER_KEY, ERR_R_INTERNAL_ERROR);
+                        return -1;
+                        }
                 if (i > 0) RAND_pseudo_bytes(sess->key_arg,i);
 
                 /* make a master key */
@@ -646,7 +656,12 @@ static int client_master_key(SSL *s)
                 sess->master_key_length=i;
                 if (i > 0)
                         {
-                        die(i <= sizeof sess->master_key);
+                        if (i > sizeof sess->master_key)
+                                {
+                                ssl2_return_error(s, SSL2_PE_UNDEFINED_ERROR);
+                                SSLerr(SSL_F_CLIENT_MASTER_KEY, ERR_R_INTERNAL_ERROR);
+                                return -1;
+                                }
                         if (RAND_bytes(sess->master_key,i) <= 0)
                                 {
                                 ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
@@ -690,7 +705,12 @@ static int client_master_key(SSL *s)
                 d+=enc;
                 karg=sess->key_arg_length;      
                 s2n(karg,p); /* key arg size */
-                die(karg <= sizeof sess->key_arg);
+                if (karg > sizeof sess->key_arg)
+                        {
+                        ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
+                        SSLerr(SSL_F_CLIENT_MASTER_KEY, ERR_R_INTERNAL_ERROR);
+                        return -1;
+                        }
                 memcpy(d,sess->key_arg,(unsigned int)karg);
                 d+=karg;
 
@@ -711,7 +731,11 @@ static int client_finished(SSL *s)
                 {
                 p=(unsigned char *)s->init_buf->data;
                 *(p++)=SSL2_MT_CLIENT_FINISHED;
-                die(s->s2->conn_id_length <= sizeof s->s2->conn_id);
+                if (s->s2->conn_id_length > sizeof s->s2->conn_id)
+                        {
+                        SSLerr(SSL_F_CLIENT_FINISHED, ERR_R_INTERNAL_ERROR);
+                        return -1;
+                        }
                 memcpy(p,s->s2->conn_id,(unsigned int)s->s2->conn_id_length);
 
                 s->state=SSL2_ST_SEND_CLIENT_FINISHED_B;
@@ -984,10 +1008,9 @@ static int get_server_finished(SSL *s)
                 {
                 if (!(s->options & SSL_OP_MICROSOFT_SESS_ID_BUG))
                         {
-                        die(s->session->session_id_length
-                            <= sizeof s->session->session_id);
-                        if (memcmp(buf,s->session->session_id,
-                                (unsigned int)s->session->session_id_length) != 0)
+                        if ((s->session->session_id_length > sizeof s->session->session_id)
+                            || (0 != memcmp(buf, s->session->session_id,
+                                            (unsigned int)s->session->session_id_length)))
                                 {
                                 ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
                                 SSLerr(SSL_F_GET_SERVER_FINISHED,SSL_R_SSL_SESSION_ID_IS_DIFFERENT);
diff --git a/src/lib/libssl/src/ssl/s2_enc.c b/src/lib/libssl/src/ssl/s2_enc.c
index a28e747d2d..690252e3d3 100644
--- a/src/lib/libssl/src/ssl/s2_enc.c
+++ b/src/lib/libssl/src/ssl/s2_enc.c
@@ -96,7 +96,8 @@ int ssl2_enc_init(SSL *s, int client)
         num=c->key_len;
         s->s2->key_material_length=num*2;
 
-        ssl2_generate_key_material(s);
+        if (ssl2_generate_key_material(s) <= 0)
+                return 0;
 
         EVP_EncryptInit_ex(ws,c,NULL,&(s->s2->key_material[(client)?num:0]),
                 s->session->key_arg);
diff --git a/src/lib/libssl/src/ssl/s2_lib.c b/src/lib/libssl/src/ssl/s2_lib.c
index 9bf55268df..cc0dcfa956 100644
--- a/src/lib/libssl/src/ssl/s2_lib.c
+++ b/src/lib/libssl/src/ssl/s2_lib.c
@@ -416,12 +416,15 @@ int ssl2_put_cipher_by_char(const SSL_CIPHER *c, unsigned char *p)
         return(3);
         }
 
-void ssl2_generate_key_material(SSL *s)
+int ssl2_generate_key_material(SSL *s)
         {
         unsigned int i;
         EVP_MD_CTX ctx;
         unsigned char *km;
         unsigned char c='0';
+        const EVP_MD *md5;
+
+        md5 = EVP_md5();
 
 #ifdef CHARSET_EBCDIC
         c = os_toascii['0']; /* Must be an ASCII '0', not EBCDIC '0',
@@ -429,23 +432,35 @@ void ssl2_generate_key_material(SSL *s)
 #endif
         EVP_MD_CTX_init(&ctx);
         km=s->s2->key_material;
-        die(s->s2->key_material_length <= sizeof s->s2->key_material);
-        for (i=0; i<s->s2->key_material_length; i+=MD5_DIGEST_LENGTH)
+
+        if (s->session->master_key_length < 0 || s->session->master_key_length > sizeof s->session->master_key)
+                {
+                SSLerr(SSL_F_SSL2_GENERATE_KEY_MATERIAL, ERR_R_INTERNAL_ERROR);
+                return 0;
+                }
+
+        for (i=0; i<s->s2->key_material_length; i += EVP_MD_size(md5))
                 {
-                EVP_DigestInit_ex(&ctx,EVP_md5(), NULL);
+                if (((km - s->s2->key_material) + EVP_MD_size(md5)) > sizeof s->s2->key_material)
+                        {
+                        /* EVP_DigestFinal_ex() below would write beyond buffer */
+                        SSLerr(SSL_F_SSL2_GENERATE_KEY_MATERIAL, ERR_R_INTERNAL_ERROR);
+                        return 0;
+                        }
+
+                EVP_DigestInit_ex(&ctx, md5, NULL);
 
-                die(s->session->master_key_length >= 0
-                    && s->session->master_key_length
-                    < sizeof s->session->master_key);
                 EVP_DigestUpdate(&ctx,s->session->master_key,s->session->master_key_length);
                 EVP_DigestUpdate(&ctx,&c,1);
                 c++;
                 EVP_DigestUpdate(&ctx,s->s2->challenge,s->s2->challenge_length);
                 EVP_DigestUpdate(&ctx,s->s2->conn_id,s->s2->conn_id_length);
                 EVP_DigestFinal_ex(&ctx,km,NULL);
-                km+=MD5_DIGEST_LENGTH;
+                km += EVP_MD_size(md5);
                 }
+
         EVP_MD_CTX_cleanup(&ctx);
+        return 1;
         }
 
 void ssl2_return_error(SSL *s, int err)
@@ -470,10 +485,14 @@ void ssl2_write_error(SSL *s)
         buf[2]=(s->error_code)&0xff;
 
 /*      state=s->rwstate;*/
-        error=s->error;
+
+        error=s->error; /* number of bytes left to write */
         s->error=0;
-        die(error >= 0 && error <= 3);
+        if (error < 0 || error > sizeof buf) /* can't happen */
+                return;
+  
         i=ssl2_write(s,&(buf[3-error]),error);
+
 /*      if (i == error) s->rwstate=state; */
 
         if (i < 0)
diff --git a/src/lib/libssl/src/ssl/s2_srvr.c b/src/lib/libssl/src/ssl/s2_srvr.c
index 391287bfcd..97dda2dde0 100644
--- a/src/lib/libssl/src/ssl/s2_srvr.c
+++ b/src/lib/libssl/src/ssl/s2_srvr.c
@@ -399,8 +399,7 @@ static int get_client_master_key(SSL *s)
                                 SSLerr(SSL_F_GET_CLIENT_MASTER_KEY,SSL_R_READ_WRONG_PACKET_TYPE);
                                 }
                         else
-                                SSLerr(SSL_F_GET_CLIENT_MASTER_KEY,
-                                        SSL_R_PEER_ERROR);
+                                SSLerr(SSL_F_GET_CLIENT_MASTER_KEY, SSL_R_PEER_ERROR);
                         return(-1);
                         }
 
@@ -408,8 +407,7 @@ static int get_client_master_key(SSL *s)
                 if (cp == NULL)
                         {
                         ssl2_return_error(s,SSL2_PE_NO_CIPHER);
-                        SSLerr(SSL_F_GET_CLIENT_MASTER_KEY,
-                                SSL_R_NO_CIPHER_MATCH);
+                        SSLerr(SSL_F_GET_CLIENT_MASTER_KEY, SSL_R_NO_CIPHER_MATCH);
                         return(-1);
                         }
                 s->session->cipher= cp;
@@ -420,8 +418,8 @@ static int get_client_master_key(SSL *s)
                 n2s(p,i); s->session->key_arg_length=i;
                 if(s->session->key_arg_length > SSL_MAX_KEY_ARG_LENGTH)
                         {
-                        SSLerr(SSL_F_GET_CLIENT_MASTER_KEY,
-                                   SSL_R_KEY_ARG_TOO_LONG);
+                        ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
+                        SSLerr(SSL_F_GET_CLIENT_MASTER_KEY, SSL_R_KEY_ARG_TOO_LONG);
                         return -1;
                         }
                 s->state=SSL2_ST_GET_CLIENT_MASTER_KEY_B;
@@ -429,11 +427,17 @@ static int get_client_master_key(SSL *s)
 
         /* SSL2_ST_GET_CLIENT_MASTER_KEY_B */
         p=(unsigned char *)s->init_buf->data;
-        die(s->init_buf->length >= SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER);
+        if (s->init_buf->length < SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER)
+                {
+                ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
+                SSLerr(SSL_F_GET_CLIENT_MASTER_KEY, ERR_R_INTERNAL_ERROR);
+                return -1;
+                }
         keya=s->session->key_arg_length;
         len = 10 + (unsigned long)s->s2->tmp.clear + (unsigned long)s->s2->tmp.enc + (unsigned long)keya;
         if (len > SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER)
                 {
+                ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
                 SSLerr(SSL_F_GET_CLIENT_MASTER_KEY,SSL_R_MESSAGE_TOO_LONG);
                 return -1;
                 }
@@ -512,7 +516,13 @@ static int get_client_master_key(SSL *s)
 #endif
 
         if (is_export) i+=s->s2->tmp.clear;
-        die(i <= SSL_MAX_MASTER_KEY_LENGTH);
+
+        if (i > SSL_MAX_MASTER_KEY_LENGTH)
+                {
+                ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
+                SSLerr(SSL_F_GET_CLIENT_MASTER_KEY, ERR_R_INTERNAL_ERROR);
+                return -1;
+                }
         s->session->master_key_length=i;
         memcpy(s->session->master_key,p,(unsigned int)i);
         return(1);
@@ -563,6 +573,7 @@ static int get_client_hello(SSL *s)
                 if (    (i < SSL2_MIN_CHALLENGE_LENGTH) ||
                         (i > SSL2_MAX_CHALLENGE_LENGTH))
                         {
+                        ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
                         SSLerr(SSL_F_GET_CLIENT_HELLO,SSL_R_INVALID_CHALLENGE_LENGTH);
                         return(-1);
                         }
@@ -574,6 +585,7 @@ static int get_client_hello(SSL *s)
         len = 9 + (unsigned long)s->s2->tmp.cipher_spec_length + (unsigned long)s->s2->challenge_length + (unsigned long)s->s2->tmp.session_id_length;
         if (len > SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER)
                 {
+                ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
                 SSLerr(SSL_F_GET_CLIENT_HELLO,SSL_R_MESSAGE_TOO_LONG);
                 return -1;
                 }
@@ -679,7 +691,12 @@ static int get_client_hello(SSL *s)
         p+=s->s2->tmp.session_id_length;
 
         /* challenge */
-        die(s->s2->challenge_length <= sizeof s->s2->challenge);
+        if (s->s2->challenge_length > sizeof s->s2->challenge)
+                {
+                ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
+                SSLerr(SSL_F_GET_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
+                return -1;
+                }
         memcpy(s->s2->challenge,p,(unsigned int)s->s2->challenge_length);
         return(1);
 mem_err:
@@ -836,7 +853,12 @@ static int get_client_finished(SSL *s)
                 }
 
         /* SSL2_ST_GET_CLIENT_FINISHED_B */
-        die(s->s2->conn_id_length <= sizeof s->s2->conn_id);
+        if (s->s2->conn_id_length > sizeof s->s2->conn_id)
+                {
+                ssl2_return_error(s,SSL2_PE_UNDEFINED_ERROR);
+                SSLerr(SSL_F_GET_CLIENT_FINISHED, ERR_R_INTERNAL_ERROR);
+                return -1;
+                }
         len = 1 + (unsigned long)s->s2->conn_id_length;
         n = (int)len - s->init_num;
         i = ssl2_read(s,(char *)&(p[s->init_num]),n);
@@ -864,7 +886,11 @@ static int server_verify(SSL *s)
                 {
                 p=(unsigned char *)s->init_buf->data;
                 *(p++)=SSL2_MT_SERVER_VERIFY;
-                die(s->s2->challenge_length <= sizeof s->s2->challenge);
+                if (s->s2->challenge_length > sizeof s->s2->challenge)
+                        {
+                        SSLerr(SSL_F_SERVER_VERIFY, ERR_R_INTERNAL_ERROR);
+                        return -1;
+                        }
                 memcpy(p,s->s2->challenge,(unsigned int)s->s2->challenge_length);
                 /* p+=s->s2->challenge_length; */
 
@@ -884,10 +910,12 @@ static int server_finish(SSL *s)
                 p=(unsigned char *)s->init_buf->data;
                 *(p++)=SSL2_MT_SERVER_FINISHED;
 
-                die(s->session->session_id_length
-                    <= sizeof s->session->session_id);
-                memcpy(p,s->session->session_id,
-                        (unsigned int)s->session->session_id_length);
+                if (s->session->session_id_length > sizeof s->session->session_id)
+                        {
+                        SSLerr(SSL_F_SERVER_FINISH, ERR_R_INTERNAL_ERROR);
+                        return -1;
+                        }
+                memcpy(p,s->session->session_id, (unsigned int)s->session->session_id_length);
                 /* p+=s->session->session_id_length; */
 
                 s->state=SSL2_ST_SEND_SERVER_FINISHED_B;
@@ -1004,7 +1032,7 @@ static int request_certificate(SSL *s)
         len = 6 + (unsigned long)s->s2->tmp.clen + (unsigned long)s->s2->tmp.rlen;
         if (len > SSL2_MAX_RECORD_LENGTH_3_BYTE_HEADER)
                 {
-                SSLerr(SSL_F_GET_CLIENT_MASTER_KEY,SSL_R_MESSAGE_TOO_LONG);
+                SSLerr(SSL_F_REQUEST_CERTIFICATE,SSL_R_MESSAGE_TOO_LONG);
                 goto end;
                 }
         j = (int)len - s->init_num;
diff --git a/src/lib/libssl/src/ssl/s3_clnt.c b/src/lib/libssl/src/ssl/s3_clnt.c
index 2699b5863b..2b58482484 100644
--- a/src/lib/libssl/src/ssl/s3_clnt.c
+++ b/src/lib/libssl/src/ssl/s3_clnt.c
@@ -546,7 +546,11 @@ static int ssl3_client_hello(SSL *s)
                 *(p++)=i;
                 if (i != 0)
                         {
-                        die(i <= sizeof s->session->session_id);
+                        if (i > sizeof s->session->session_id)
+                                {
+                                SSLerr(SSL_F_SSL3_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
+                                goto err;
+                                }
                         memcpy(p,s->session->session_id,i);
                         p+=i;
                         }
@@ -1598,7 +1602,11 @@ static int ssl3_send_client_key_exchange(SSL *s)
                                 SSL_MAX_MASTER_KEY_LENGTH);
                         EVP_EncryptFinal_ex(&ciph_ctx,&(epms[outl]),&padl);
                         outl += padl;
-                        die(outl <= sizeof epms);
+                        if (outl > sizeof epms)
+                                {
+                                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
+                                goto err;
+                                }
                         EVP_CIPHER_CTX_cleanup(&ciph_ctx);
 
                         /*  KerberosWrapper.EncryptedPreMasterSecret    */
diff --git a/src/lib/libssl/src/ssl/s3_srvr.c b/src/lib/libssl/src/ssl/s3_srvr.c
index 782b57f57a..20d716fb1b 100644
--- a/src/lib/libssl/src/ssl/s3_srvr.c
+++ b/src/lib/libssl/src/ssl/s3_srvr.c
@@ -965,7 +965,11 @@ static int ssl3_send_server_hello(SSL *s)
                         s->session->session_id_length=0;
 
                 sl=s->session->session_id_length;
-                die(sl <= sizeof s->session->session_id);
+                if (sl > sizeof s->session->session_id)
+                        {
+                        SSLerr(SSL_F_SSL3_SEND_SERVER_HELLO, ERR_R_INTERNAL_ERROR);
+                        return -1;
+                        }
                 *(p++)=sl;
                 memcpy(p,s->session->session_id,sl);
                 p+=sl;
@@ -1588,7 +1592,7 @@ static int ssl3_get_client_key_exchange(SSL *s)
                 /* Note that the length is checked again below,
                 ** after decryption
                 */
-                if(enc.pms_length > sizeof pms)
+                if(enc_pms.length > sizeof pms)
                         {
                         SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
                                SSL_R_DATA_LENGTH_TOO_LONG);
diff --git a/src/lib/libssl/src/ssl/ssl-lib.com b/src/lib/libssl/src/ssl/ssl-lib.com
index 1f1921e162..d6829a8d64 100644
--- a/src/lib/libssl/src/ssl/ssl-lib.com
+++ b/src/lib/libssl/src/ssl/ssl-lib.com
@@ -1067,7 +1067,7 @@ $   ENDIF
 $!
 $!  Show user the result
 $!
-$   WRITE SYS$OUTPUT "Main Compiling Command: ",CC
+$   WRITE/SYMBOL SYS$OUTPUT "Main Compiling Command: ",CC
 $!
 $!  Else The User Entered An Invalid Arguement.
 $!
diff --git a/src/lib/libssl/src/ssl/ssl.h b/src/lib/libssl/src/ssl/ssl.h
index d9949e8eb2..e9d1e896d7 100644
--- a/src/lib/libssl/src/ssl/ssl.h
+++ b/src/lib/libssl/src/ssl/ssl.h
@@ -1462,6 +1462,7 @@ void ERR_load_SSL_strings(void);
 
 /* Function codes. */
 #define SSL_F_CLIENT_CERTIFICATE                         100
+#define SSL_F_CLIENT_FINISHED                            238
 #define SSL_F_CLIENT_HELLO                               101
 #define SSL_F_CLIENT_MASTER_KEY                          102
 #define SSL_F_D2I_SSL_SESSION                            103
@@ -1475,7 +1476,9 @@ void ERR_load_SSL_strings(void);
 #define SSL_F_I2D_SSL_SESSION                            111
 #define SSL_F_READ_N                                     112
 #define SSL_F_REQUEST_CERTIFICATE                        113
+#define SSL_F_SERVER_FINISH                              239
 #define SSL_F_SERVER_HELLO                               114
+#define SSL_F_SERVER_VERIFY                              240
 #define SSL_F_SSL23_ACCEPT                               115
 #define SSL_F_SSL23_CLIENT_HELLO                         116
 #define SSL_F_SSL23_CONNECT                              117
@@ -1487,6 +1490,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_F_SSL2_ACCEPT                                122
 #define SSL_F_SSL2_CONNECT                               123
 #define SSL_F_SSL2_ENC_INIT                              124
+#define SSL_F_SSL2_GENERATE_KEY_MATERIAL                 241
 #define SSL_F_SSL2_PEEK                                  234
 #define SSL_F_SSL2_READ                                  125
 #define SSL_F_SSL2_READ_INTERNAL                         236
@@ -1523,6 +1527,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE              152
 #define SSL_F_SSL3_SEND_CLIENT_VERIFY                    153
 #define SSL_F_SSL3_SEND_SERVER_CERTIFICATE               154
+#define SSL_F_SSL3_SEND_SERVER_HELLO                     242
 #define SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE              155
 #define SSL_F_SSL3_SETUP_BUFFERS                         156
 #define SSL_F_SSL3_SETUP_KEY_BLOCK                       157
@@ -1747,6 +1752,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_SHORT_READ                                 219
 #define SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE      220
 #define SSL_R_SSL23_DOING_SESSION_ID_REUSE               221
+#define SSL_R_SSL2_CONNECTION_ID_TOO_LONG                1114
 #define SSL_R_SSL3_SESSION_ID_TOO_LONG                   1113
 #define SSL_R_SSL3_SESSION_ID_TOO_SHORT                  222
 #define SSL_R_SSLV3_ALERT_BAD_CERTIFICATE                1042
diff --git a/src/lib/libssl/src/ssl/ssl_asn1.c b/src/lib/libssl/src/ssl/ssl_asn1.c
index 1638c6b525..3723fc2e37 100644
--- a/src/lib/libssl/src/ssl/ssl_asn1.c
+++ b/src/lib/libssl/src/ssl/ssl_asn1.c
@@ -294,10 +294,11 @@ SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, unsigned char **pp,
                 i=SSL2_MAX_SSL_SESSION_ID_LENGTH;
 
         if (os.length > i)
-                os.length=i;
+                os.length = i;
+        if (os.length > sizeof ret->session_id) /* can't happen */
+                os.length = sizeof ret->session_id;
 
         ret->session_id_length=os.length;
-        die(os.length <= sizeof ret->session_id);
         memcpy(ret->session_id,os.data,os.length);
 
         M_ASN1_D2I_get(osp,d2i_ASN1_OCTET_STRING);
diff --git a/src/lib/libssl/src/ssl/ssl_err.c b/src/lib/libssl/src/ssl/ssl_err.c
index 0cad32c855..7067a745f3 100644
--- a/src/lib/libssl/src/ssl/ssl_err.c
+++ b/src/lib/libssl/src/ssl/ssl_err.c
@@ -67,6 +67,7 @@
 static ERR_STRING_DATA SSL_str_functs[]=
         {
 {ERR_PACK(0,SSL_F_CLIENT_CERTIFICATE,0),        "CLIENT_CERTIFICATE"},
+{ERR_PACK(0,SSL_F_CLIENT_FINISHED,0),   "CLIENT_FINISHED"},
 {ERR_PACK(0,SSL_F_CLIENT_HELLO,0),      "CLIENT_HELLO"},
 {ERR_PACK(0,SSL_F_CLIENT_MASTER_KEY,0), "CLIENT_MASTER_KEY"},
 {ERR_PACK(0,SSL_F_D2I_SSL_SESSION,0),   "d2i_SSL_SESSION"},
@@ -80,7 +81,9 @@ static ERR_STRING_DATA SSL_str_functs[]=
 {ERR_PACK(0,SSL_F_I2D_SSL_SESSION,0),   "i2d_SSL_SESSION"},
 {ERR_PACK(0,SSL_F_READ_N,0),    "READ_N"},
 {ERR_PACK(0,SSL_F_REQUEST_CERTIFICATE,0),       "REQUEST_CERTIFICATE"},
+{ERR_PACK(0,SSL_F_SERVER_FINISH,0),     "SERVER_FINISH"},
 {ERR_PACK(0,SSL_F_SERVER_HELLO,0),      "SERVER_HELLO"},
+{ERR_PACK(0,SSL_F_SERVER_VERIFY,0),     "SERVER_VERIFY"},
 {ERR_PACK(0,SSL_F_SSL23_ACCEPT,0),      "SSL23_ACCEPT"},
 {ERR_PACK(0,SSL_F_SSL23_CLIENT_HELLO,0),        "SSL23_CLIENT_HELLO"},
 {ERR_PACK(0,SSL_F_SSL23_CONNECT,0),     "SSL23_CONNECT"},
@@ -92,6 +95,7 @@ static ERR_STRING_DATA SSL_str_functs[]=
 {ERR_PACK(0,SSL_F_SSL2_ACCEPT,0),       "SSL2_ACCEPT"},
 {ERR_PACK(0,SSL_F_SSL2_CONNECT,0),      "SSL2_CONNECT"},
 {ERR_PACK(0,SSL_F_SSL2_ENC_INIT,0),     "SSL2_ENC_INIT"},
+{ERR_PACK(0,SSL_F_SSL2_GENERATE_KEY_MATERIAL,0),        "SSL2_GENERATE_KEY_MATERIAL"},
 {ERR_PACK(0,SSL_F_SSL2_PEEK,0), "SSL2_PEEK"},
 {ERR_PACK(0,SSL_F_SSL2_READ,0), "SSL2_READ"},
 {ERR_PACK(0,SSL_F_SSL2_READ_INTERNAL,0),        "SSL2_READ_INTERNAL"},
@@ -128,6 +132,7 @@ static ERR_STRING_DATA SSL_str_functs[]=
 {ERR_PACK(0,SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,0),     "SSL3_SEND_CLIENT_KEY_EXCHANGE"},
 {ERR_PACK(0,SSL_F_SSL3_SEND_CLIENT_VERIFY,0),   "SSL3_SEND_CLIENT_VERIFY"},
 {ERR_PACK(0,SSL_F_SSL3_SEND_SERVER_CERTIFICATE,0),      "SSL3_SEND_SERVER_CERTIFICATE"},
+{ERR_PACK(0,SSL_F_SSL3_SEND_SERVER_HELLO,0),    "SSL3_SEND_SERVER_HELLO"},
 {ERR_PACK(0,SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,0),     "SSL3_SEND_SERVER_KEY_EXCHANGE"},
 {ERR_PACK(0,SSL_F_SSL3_SETUP_BUFFERS,0),        "SSL3_SETUP_BUFFERS"},
 {ERR_PACK(0,SSL_F_SSL3_SETUP_KEY_BLOCK,0),      "SSL3_SETUP_KEY_BLOCK"},
@@ -355,6 +360,7 @@ static ERR_STRING_DATA SSL_str_reasons[]=
 {SSL_R_SHORT_READ                        ,"short read"},
 {SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE,"signature for non signing certificate"},
 {SSL_R_SSL23_DOING_SESSION_ID_REUSE      ,"ssl23 doing session id reuse"},
+{SSL_R_SSL2_CONNECTION_ID_TOO_LONG       ,"ssl2 connection id too long"},
 {SSL_R_SSL3_SESSION_ID_TOO_LONG          ,"ssl3 session id too long"},
 {SSL_R_SSL3_SESSION_ID_TOO_SHORT         ,"ssl3 session id too short"},
 {SSL_R_SSLV3_ALERT_BAD_CERTIFICATE       ,"sslv3 alert bad certificate"},
diff --git a/src/lib/libssl/src/ssl/ssl_lib.c b/src/lib/libssl/src/ssl/ssl_lib.c
index ab172aeaec..4bc4ce5b3a 100644
--- a/src/lib/libssl/src/ssl/ssl_lib.c
+++ b/src/lib/libssl/src/ssl/ssl_lib.c
@@ -1405,13 +1405,24 @@ void SSL_CTX_free(SSL_CTX *a)
                 abort(); /* ok */
                 }
 #endif
-        CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);
 
+        /*
+         * Free internal session cache. However: the remove_cb() may reference
+         * the ex_data of SSL_CTX, thus the ex_data store can only be removed
+         * after the sessions were flushed.
+         * As the ex_data handling routines might also touch the session cache,
+         * the most secure solution seems to be: empty (flush) the cache, then
+         * free ex_data, then finally free the cache.
+         * (See ticket [openssl.org #212].)
+         */
         if (a->sessions != NULL)
-                {
                 SSL_CTX_flush_sessions(a,0);
+
+        CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_CTX, a, &a->ex_data);
+
+        if (a->sessions != NULL)
                 lh_free(a->sessions);
-                }
+
         if (a->cert_store != NULL)
                 X509_STORE_free(a->cert_store);
         if (a->cipher_list != NULL)
diff --git a/src/lib/libssl/src/ssl/ssl_locl.h b/src/lib/libssl/src/ssl/ssl_locl.h
index fe4ac839cf..dd6c7a7323 100644
--- a/src/lib/libssl/src/ssl/ssl_locl.h
+++ b/src/lib/libssl/src/ssl/ssl_locl.h
@@ -510,7 +510,7 @@ STACK_OF(SSL_CIPHER) *ssl_get_ciphers_by_id(SSL *s);
 int ssl_verify_alarm_type(long type);
 
 int ssl2_enc_init(SSL *s, int client);
-void ssl2_generate_key_material(SSL *s);
+int ssl2_generate_key_material(SSL *s);
 void ssl2_enc(SSL *s,int send_data);
 void ssl2_mac(SSL *s,unsigned char *mac,int send_data);
 SSL_CIPHER *ssl2_get_cipher_by_char(const unsigned char *p);
diff --git a/src/lib/libssl/src/ssl/ssl_sess.c b/src/lib/libssl/src/ssl/ssl_sess.c
index 8bfc382bb6..ca1a7427be 100644
--- a/src/lib/libssl/src/ssl/ssl_sess.c
+++ b/src/lib/libssl/src/ssl/ssl_sess.c
@@ -251,7 +251,12 @@ int ssl_get_new_session(SSL *s, int session)
                 ss->session_id_length=0;
                 }
 
-        die(s->sid_ctx_length <= sizeof ss->sid_ctx);
+        if (s->sid_ctx_length > sizeof ss->sid_ctx)
+                {
+                SSLerr(SSL_F_SSL_GET_NEW_SESSION, ERR_R_INTERNAL_ERROR);
+                SSL_SESSION_free(ss);
+                return 0;
+                }
         memcpy(ss->sid_ctx,s->sid_ctx,s->sid_ctx_length);
         ss->sid_ctx_length=s->sid_ctx_length;
         s->session=ss;
diff --git a/src/lib/libssl/src/ssl/ssltest.c b/src/lib/libssl/src/ssl/ssltest.c
index 1afdfa7750..4f6379e160 100644
--- a/src/lib/libssl/src/ssl/ssltest.c
+++ b/src/lib/libssl/src/ssl/ssltest.c
@@ -400,12 +400,22 @@ int main(int argc, char *argv[])
                         debug=1;
                 else if (strcmp(*argv,"-reuse") == 0)
                         reuse=1;
-#ifndef OPENSSL_NO_DH
                 else if (strcmp(*argv,"-dhe1024") == 0)
+                        {
+#ifndef OPENSSL_NO_DH
                         dhe1024=1;
+#else
+                        fprintf(stderr,"ignoring -dhe1024, since I'm compiled without DH\n";
+#endif
+                        }
                 else if (strcmp(*argv,"-dhe1024dsa") == 0)
+                        {
+#ifndef OPENSSL_NO_DH
                         dhe1024dsa=1;
+#else
+                        fprintf(stderr,"ignoring -dhe1024, since I'm compiled without DH\n";
 #endif
+                        }
                 else if (strcmp(*argv,"-no_dhe") == 0)
                         no_dhe=1;
                 else if (strcmp(*argv,"-ssl2") == 0)
diff --git a/src/lib/libssl/src/test/dummytest.c b/src/lib/libssl/src/test/dummytest.c
index f98f003ef9..5b4467e042 100644
--- a/src/lib/libssl/src/test/dummytest.c
+++ b/src/lib/libssl/src/test/dummytest.c
@@ -8,7 +8,7 @@
 
 int main(int argc, char *argv[])
         {
-        char *p, *q, *program;
+        char *p, *q = 0, *program;
 
         p = strrchr(argv[0], '/');
         if (!p) p = strrchr(argv[0], '\\');
@@ -34,7 +34,8 @@ int main(int argc, char *argv[])
                 }
 
         for(p = program; *p; p++)
-                if (islower(*p)) *p = toupper(*p);
+                if (islower((unsigned char)(*p)))
+                        *p = toupper((unsigned char)(*p));
 
         q = strstr(program, "TEST");
         if (q > p && q[-1] == '_') q--;
diff --git a/src/lib/libssl/src/test/maketests.com b/src/lib/libssl/src/test/maketests.com
index b3bf8bb837..91e859deab 100644
--- a/src/lib/libssl/src/test/maketests.com
+++ b/src/lib/libssl/src/test/maketests.com
@@ -887,7 +887,7 @@ $   CC = CC + "/DEFINE=(" + CCDEFS + ")" + CCDISABLEWARNINGS
 $!
 $!  Show user the result
 $!
-$   WRITE SYS$OUTPUT "Main Compiling Command: ",CC
+$   WRITE/SYMBOL SYS$OUTPUT "Main Compiling Command: ",CC
 $!
 $!  Else The User Entered An Invalid Arguement.
 $!
diff --git a/src/lib/libssl/src/test/tcrl.com b/src/lib/libssl/src/test/tcrl.com
index 2e6ab2814d..86bf9735aa 100644
--- a/src/lib/libssl/src/test/tcrl.com
+++ b/src/lib/libssl/src/test/tcrl.com
@@ -13,7 +13,9 @@ $	write sys$output "testing CRL conversions"
 $       if f$search("fff.*") .nes "" then delete fff.*;*
 $       if f$search("ff.*") .nes "" then delete ff.*;*
 $       if f$search("f.*") .nes "" then delete f.*;*
-$       copy 't' fff.p
+$       convert/fdl=sys$input: 't' fff.p
+RECORD
+        FORMAT STREAM_LF
 $
 $       write sys$output "p -> d"
 $       'cmd' -in fff.p -inform p -outform d -out f.d
diff --git a/src/lib/libssl/src/test/testenc.com b/src/lib/libssl/src/test/testenc.com
index 3b66f2e0d0..c24fa388c0 100644
--- a/src/lib/libssl/src/test/testenc.com
+++ b/src/lib/libssl/src/test/testenc.com
@@ -9,7 +9,9 @@ $	test := p.txt
 $       cmd := mcr 'exe_dir'openssl
 $
 $       if f$search(test) .nes. "" then delete 'test';*
-$       copy 'testsrc' 'test'
+$       convert/fdl=sys$input: 'testsrc' 'test'
+RECORD
+        FORMAT STREAM_LF
 $
 $       if f$search(test+"-cipher") .nes. "" then delete 'test'-cipher;*
 $       if f$search(test+"-clear") .nes. "" then delete 'test'-clear;*
diff --git a/src/lib/libssl/src/test/tpkcs7.com b/src/lib/libssl/src/test/tpkcs7.com
index 9e345937c6..047834fba4 100644
--- a/src/lib/libssl/src/test/tpkcs7.com
+++ b/src/lib/libssl/src/test/tpkcs7.com
@@ -13,7 +13,9 @@ $	write sys$output "testing PKCS7 conversions"
 $       if f$search("fff.*") .nes "" then delete fff.*;*
 $       if f$search("ff.*") .nes "" then delete ff.*;*
 $       if f$search("f.*") .nes "" then delete f.*;*
-$       copy 't' fff.p
+$       convert/fdl=sys$input: 't' fff.p
+RECORD
+        FORMAT STREAM_LF
 $
 $       write sys$output "p -> d"
 $       'cmd' -in fff.p -inform p -outform d -out f.d
diff --git a/src/lib/libssl/src/test/tpkcs7d.com b/src/lib/libssl/src/test/tpkcs7d.com
index 7d4f8794a4..193bb72137 100644
--- a/src/lib/libssl/src/test/tpkcs7d.com
+++ b/src/lib/libssl/src/test/tpkcs7d.com
@@ -13,7 +13,9 @@ $	write sys$output "testing PKCS7 conversions (2)"
 $       if f$search("fff.*") .nes "" then delete fff.*;*
 $       if f$search("ff.*") .nes "" then delete ff.*;*
 $       if f$search("f.*") .nes "" then delete f.*;*
-$       copy 't' fff.p
+$       convert/fdl=sys$input: 't' fff.p
+RECORD
+        FORMAT STREAM_LF
 $
 $       write sys$output "p -> d"
 $       'cmd' -in fff.p -inform p -outform d -out f.d
diff --git a/src/lib/libssl/src/test/treq.com b/src/lib/libssl/src/test/treq.com
index 22c22c3aa9..5524e485ba 100644
--- a/src/lib/libssl/src/test/treq.com
+++ b/src/lib/libssl/src/test/treq.com
@@ -13,7 +13,9 @@ $	write sys$output "testing req conversions"
 $       if f$search("fff.*") .nes "" then delete fff.*;*
 $       if f$search("ff.*") .nes "" then delete ff.*;*
 $       if f$search("f.*") .nes "" then delete f.*;*
-$       copy 't' fff.p
+$       convert/fdl=sys$input: 't' fff.p
+RECORD
+        FORMAT STREAM_LF
 $
 $       write sys$output "p -> d"
 $       'cmd' -in fff.p -inform p -outform d -out f.d
diff --git a/src/lib/libssl/src/test/trsa.com b/src/lib/libssl/src/test/trsa.com
index 6b6c318e2b..6dbe59ef64 100644
--- a/src/lib/libssl/src/test/trsa.com
+++ b/src/lib/libssl/src/test/trsa.com
@@ -24,7 +24,9 @@ $	write sys$output "testing RSA conversions"
 $       if f$search("fff.*") .nes "" then delete fff.*;*
 $       if f$search("ff.*") .nes "" then delete ff.*;*
 $       if f$search("f.*") .nes "" then delete f.*;*
-$       copy 't' fff.p
+$       convert/fdl=sys$input: 't' fff.p
+RECORD
+        FORMAT STREAM_LF
 $
 $       write sys$output "p -> d"
 $       'cmd' -in fff.p -inform p -outform d -out f.d
diff --git a/src/lib/libssl/src/test/tsid.com b/src/lib/libssl/src/test/tsid.com
index bde23f9bb9..abd1d4d737 100644
--- a/src/lib/libssl/src/test/tsid.com
+++ b/src/lib/libssl/src/test/tsid.com
@@ -13,7 +13,9 @@ $	write sys$output "testing session-id conversions"
 $       if f$search("fff.*") .nes "" then delete fff.*;*
 $       if f$search("ff.*") .nes "" then delete ff.*;*
 $       if f$search("f.*") .nes "" then delete f.*;*
-$       copy 't' fff.p
+$       convert/fdl=sys$input: 't' fff.p
+RECORD
+        FORMAT STREAM_LF
 $
 $       write sys$output "p -> d"
 $       'cmd' -in fff.p -inform p -outform d -out f.d
diff --git a/src/lib/libssl/src/test/tx509.com b/src/lib/libssl/src/test/tx509.com
index 985969c566..7b2592f773 100644
--- a/src/lib/libssl/src/test/tx509.com
+++ b/src/lib/libssl/src/test/tx509.com
@@ -13,7 +13,9 @@ $	write sys$output "testing X509 conversions"
 $       if f$search("fff.*") .nes "" then delete fff.*;*
 $       if f$search("ff.*") .nes "" then delete ff.*;*
 $       if f$search("f.*") .nes "" then delete f.*;*
-$       copy 't' fff.p
+$       convert/fdl=sys$input: 't' fff.p
+RECORD
+        FORMAT STREAM_LF
 $
 $       write sys$output "p -> d"
 $       'cmd' -in fff.p -inform p -outform d -out f.d
diff --git a/src/lib/libssl/src/util/libeay.num b/src/lib/libssl/src/util/libeay.num
index 512185e257..7e5728495f 100644
--- a/src/lib/libssl/src/util/libeay.num
+++ b/src/lib/libssl/src/util/libeay.num
@@ -2792,3 +2792,4 @@ ASN1_UNIVERSALSTRING_it                 3234	EXIST:!EXPORT_VAR_AS_FUNCTION:VARIA
 ASN1_UNIVERSALSTRING_it                 3234    EXIST:EXPORT_VAR_AS_FUNCTION:FUNCTION:
 d2i_ASN1_UNIVERSALSTRING                3235    EXIST::FUNCTION:
 EVP_des_ede3_ecb                        3236    EXIST::FUNCTION:DES
+X509_REQ_print_ex                       3237    EXIST::FUNCTION:BIO
diff --git a/src/lib/libssl/src/util/pod2mantest b/src/lib/libssl/src/util/pod2mantest
index e01c6192a7..412ca8d6d8 100644
--- a/src/lib/libssl/src/util/pod2mantest
+++ b/src/lib/libssl/src/util/pod2mantest
@@ -12,7 +12,8 @@
 
 IFS=:
 if test "$OSTYPE" = "msdosdjgpp"; then IFS=";"; fi
-try_without_dir=false
+
+try_without_dir=true
 # First we try "pod2man", then "$dir/pod2man" for each item in $PATH.
 for dir in dummy${IFS}$PATH; do
     if [ "$try_without_dir" = true ]; then
@@ -30,9 +31,16 @@ for dir in dummy${IFS}$PATH; do
     if [ ! "$pod2man" = '' ]; then
         failure=none
 
+        if "$pod2man" --section=1 --center=OpenSSL --release=dev pod2mantest.pod | fgrep OpenSSL >/dev/null; then
+            :
+        else
+            failure=BasicTest
+        fi
 
-        if "$pod2man" --section=1 --center=OpenSSL --release=dev pod2mantest.pod | grep '^MARKER - ' >/dev/null 2>&1; then
-            failure=MultilineTest
+        if [ "$failure" = none ]; then
+            if "$pod2man" --section=1 --center=OpenSSL --release=dev pod2mantest.pod | grep '^MARKER - ' >/dev/null; then
+                failure=MultilineTest
+            fi
         fi
 
 
@@ -46,9 +54,5 @@ for dir in dummy${IFS}$PATH; do
 done
 
 echo "No working pod2man found.  Consider installing a new version." >&2
-if [ "$1" = ignore ]; then
-  echo "As a workaround, we'll use a bundled old copy of pod2man.pl." >&2
-  echo "../../util/pod2man.pl"
-  exit 0
-fi
-exit 1
+echo "As a workaround, we'll use a bundled old copy of pod2man.pl." >&2
+echo "$1 ../../util/pod2man.pl"
diff --git a/src/lib/libssl/test/dummytest.c b/src/lib/libssl/test/dummytest.c
index f98f003ef9..5b4467e042 100644
--- a/src/lib/libssl/test/dummytest.c
+++ b/src/lib/libssl/test/dummytest.c
@@ -8,7 +8,7 @@
 
 int main(int argc, char *argv[])
         {
-        char *p, *q, *program;
+        char *p, *q = 0, *program;
 
         p = strrchr(argv[0], '/');
         if (!p) p = strrchr(argv[0], '\\');
@@ -34,7 +34,8 @@ int main(int argc, char *argv[])
                 }
 
         for(p = program; *p; p++)
-                if (islower(*p)) *p = toupper(*p);
+                if (islower((unsigned char)(*p)))
+                        *p = toupper((unsigned char)(*p));
 
         q = strstr(program, "TEST");
         if (q > p && q[-1] == '_') q--;
diff --git a/src/lib/libssl/test/maketests.com b/src/lib/libssl/test/maketests.com
index b3bf8bb837..91e859deab 100644
--- a/src/lib/libssl/test/maketests.com
+++ b/src/lib/libssl/test/maketests.com
@@ -887,7 +887,7 @@ $   CC = CC + "/DEFINE=(" + CCDEFS + ")" + CCDISABLEWARNINGS
 $!
 $!  Show user the result
 $!
-$   WRITE SYS$OUTPUT "Main Compiling Command: ",CC
+$   WRITE/SYMBOL SYS$OUTPUT "Main Compiling Command: ",CC
 $!
 $!  Else The User Entered An Invalid Arguement.
 $!
diff --git a/src/lib/libssl/test/tcrl.com b/src/lib/libssl/test/tcrl.com
index 2e6ab2814d..86bf9735aa 100644
--- a/src/lib/libssl/test/tcrl.com
+++ b/src/lib/libssl/test/tcrl.com
@@ -13,7 +13,9 @@ $	write sys$output "testing CRL conversions"
 $       if f$search("fff.*") .nes "" then delete fff.*;*
 $       if f$search("ff.*") .nes "" then delete ff.*;*
 $       if f$search("f.*") .nes "" then delete f.*;*
-$       copy 't' fff.p
+$       convert/fdl=sys$input: 't' fff.p
+RECORD
+        FORMAT STREAM_LF
 $
 $       write sys$output "p -> d"
 $       'cmd' -in fff.p -inform p -outform d -out f.d
diff --git a/src/lib/libssl/test/testenc.com b/src/lib/libssl/test/testenc.com
index 3b66f2e0d0..c24fa388c0 100644
--- a/src/lib/libssl/test/testenc.com
+++ b/src/lib/libssl/test/testenc.com
@@ -9,7 +9,9 @@ $	test := p.txt
 $       cmd := mcr 'exe_dir'openssl
 $
 $       if f$search(test) .nes. "" then delete 'test';*
-$       copy 'testsrc' 'test'
+$       convert/fdl=sys$input: 'testsrc' 'test'
+RECORD
+        FORMAT STREAM_LF
 $
 $       if f$search(test+"-cipher") .nes. "" then delete 'test'-cipher;*
 $       if f$search(test+"-clear") .nes. "" then delete 'test'-clear;*
diff --git a/src/lib/libssl/test/tpkcs7.com b/src/lib/libssl/test/tpkcs7.com
index 9e345937c6..047834fba4 100644
--- a/src/lib/libssl/test/tpkcs7.com
+++ b/src/lib/libssl/test/tpkcs7.com
@@ -13,7 +13,9 @@ $	write sys$output "testing PKCS7 conversions"
 $       if f$search("fff.*") .nes "" then delete fff.*;*
 $       if f$search("ff.*") .nes "" then delete ff.*;*
 $       if f$search("f.*") .nes "" then delete f.*;*
-$       copy 't' fff.p
+$       convert/fdl=sys$input: 't' fff.p
+RECORD
+        FORMAT STREAM_LF
 $
 $       write sys$output "p -> d"
 $       'cmd' -in fff.p -inform p -outform d -out f.d
diff --git a/src/lib/libssl/test/tpkcs7d.com b/src/lib/libssl/test/tpkcs7d.com
index 7d4f8794a4..193bb72137 100644
--- a/src/lib/libssl/test/tpkcs7d.com
+++ b/src/lib/libssl/test/tpkcs7d.com
@@ -13,7 +13,9 @@ $	write sys$output "testing PKCS7 conversions (2)"
 $       if f$search("fff.*") .nes "" then delete fff.*;*
 $       if f$search("ff.*") .nes "" then delete ff.*;*
 $       if f$search("f.*") .nes "" then delete f.*;*
-$       copy 't' fff.p
+$       convert/fdl=sys$input: 't' fff.p
+RECORD
+        FORMAT STREAM_LF
 $
 $       write sys$output "p -> d"
 $       'cmd' -in fff.p -inform p -outform d -out f.d
diff --git a/src/lib/libssl/test/treq.com b/src/lib/libssl/test/treq.com
index 22c22c3aa9..5524e485ba 100644
--- a/src/lib/libssl/test/treq.com
+++ b/src/lib/libssl/test/treq.com
@@ -13,7 +13,9 @@ $	write sys$output "testing req conversions"
 $       if f$search("fff.*") .nes "" then delete fff.*;*
 $       if f$search("ff.*") .nes "" then delete ff.*;*
 $       if f$search("f.*") .nes "" then delete f.*;*
-$       copy 't' fff.p
+$       convert/fdl=sys$input: 't' fff.p
+RECORD
+        FORMAT STREAM_LF
 $
 $       write sys$output "p -> d"
 $       'cmd' -in fff.p -inform p -outform d -out f.d
diff --git a/src/lib/libssl/test/trsa.com b/src/lib/libssl/test/trsa.com
index 6b6c318e2b..6dbe59ef64 100644
--- a/src/lib/libssl/test/trsa.com
+++ b/src/lib/libssl/test/trsa.com
@@ -24,7 +24,9 @@ $	write sys$output "testing RSA conversions"
 $       if f$search("fff.*") .nes "" then delete fff.*;*
 $       if f$search("ff.*") .nes "" then delete ff.*;*
 $       if f$search("f.*") .nes "" then delete f.*;*
-$       copy 't' fff.p
+$       convert/fdl=sys$input: 't' fff.p
+RECORD
+        FORMAT STREAM_LF
 $
 $       write sys$output "p -> d"
 $       'cmd' -in fff.p -inform p -outform d -out f.d
diff --git a/src/lib/libssl/test/tsid.com b/src/lib/libssl/test/tsid.com
index bde23f9bb9..abd1d4d737 100644
--- a/src/lib/libssl/test/tsid.com
+++ b/src/lib/libssl/test/tsid.com
@@ -13,7 +13,9 @@ $	write sys$output "testing session-id conversions"
 $       if f$search("fff.*") .nes "" then delete fff.*;*
 $       if f$search("ff.*") .nes "" then delete ff.*;*
 $       if f$search("f.*") .nes "" then delete f.*;*
-$       copy 't' fff.p
+$       convert/fdl=sys$input: 't' fff.p
+RECORD
+        FORMAT STREAM_LF
 $
 $       write sys$output "p -> d"
 $       'cmd' -in fff.p -inform p -outform d -out f.d
diff --git a/src/lib/libssl/test/tx509.com b/src/lib/libssl/test/tx509.com
index 985969c566..7b2592f773 100644
--- a/src/lib/libssl/test/tx509.com
+++ b/src/lib/libssl/test/tx509.com
@@ -13,7 +13,9 @@ $	write sys$output "testing X509 conversions"
 $       if f$search("fff.*") .nes "" then delete fff.*;*
 $       if f$search("ff.*") .nes "" then delete ff.*;*
 $       if f$search("f.*") .nes "" then delete f.*;*
-$       copy 't' fff.p
+$       convert/fdl=sys$input: 't' fff.p
+RECORD
+        FORMAT STREAM_LF
 $
 $       write sys$output "p -> d"
 $       'cmd' -in fff.p -inform p -outform d -out f.d