This commit was manufactured by cvs2git to create tag 'OPENBSD_5_8_BASE'.OPENBSD_5_8_BASE

81 files changed, 0 insertions, 25197 deletions

diff --git a/src/lib/libcrypto/asn1/a_bitstr.c b/src/lib/libcrypto/asn1/a_bitstr.c
deleted file mode 100644
index c0259ad815..0000000000
--- a/src/lib/libcrypto/asn1/a_bitstr.c
+++ /dev/null
@@ -1,259 +0,0 @@
-/* $OpenBSD: a_bitstr.c,v 1.22 2015/07/29 14:58:34 jsing Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-#include <string.h>
-
-#include <openssl/asn1.h>
-#include <openssl/err.h>
-
-int
-ASN1_BIT_STRING_set(ASN1_BIT_STRING *x, unsigned char *d, int len)
-{
-        return ASN1_STRING_set(x, d, len);
-}
-
-int
-i2c_ASN1_BIT_STRING(ASN1_BIT_STRING *a, unsigned char **pp)
-{
-        int ret, j, bits, len;
-        unsigned char *p, *d;
-
-        if (a == NULL)
-                return (0);
-
-        len = a->length;
-
-        if (len > 0) {
-                if (a->flags & ASN1_STRING_FLAG_BITS_LEFT) {
-                        bits = (int)a->flags & 0x07;
-                } else {
-                        for (; len > 0; len--) {
-                                if (a->data[len - 1])
-                                        break;
-                        }
-                        j = a->data[len - 1];
-                        if (j & 0x01)
-                                bits = 0;
-                        else if (j & 0x02)
-                                bits = 1;
-                        else if (j & 0x04)
-                                bits = 2;
-                        else if (j & 0x08)
-                                bits = 3;
-                        else if (j & 0x10)
-                                bits = 4;
-                        else if (j & 0x20)
-                                bits = 5;
-                        else if (j & 0x40)
-                                bits = 6;
-                        else if (j & 0x80)
-                                bits = 7;
-                        else
-                                bits = 0; /* should not happen */
-                }
-        } else
-                bits = 0;
-
-        ret = 1 + len;
-        if (pp == NULL)
-                return (ret);
-
-        p= *pp;
-
-        *(p++) = (unsigned char)bits;
-        d = a->data;
-        memcpy(p, d, len);
-        p += len;
-        if (len > 0)
-                p[-1]&=(0xff << bits);
-        *pp = p;
-        return (ret);
-}
-
-ASN1_BIT_STRING *
-c2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a, const unsigned char **pp, long len)
-{
-        ASN1_BIT_STRING *ret = NULL;
-        const unsigned char *p;
-        unsigned char *s;
-        int i;
-
-        if (len < 1) {
-                i = ASN1_R_STRING_TOO_SHORT;
-                goto err;
-        }
-
-        if ((a == NULL) || ((*a) == NULL)) {
-                if ((ret = M_ASN1_BIT_STRING_new()) == NULL)
-                        return (NULL);
-        } else
-                ret = (*a);
-
-        p = *pp;
-        i = *(p++);
-        /* We do this to preserve the settings.  If we modify
-         * the settings, via the _set_bit function, we will recalculate
-         * on output */
-        ret->flags&= ~(ASN1_STRING_FLAG_BITS_LEFT|0x07); /* clear */
-        ret->flags|=(ASN1_STRING_FLAG_BITS_LEFT|(i&0x07)); /* set */
-
-        if (len-- > 1) /* using one because of the bits left byte */
-        {
-                s = malloc(len);
-                if (s == NULL) {
-                        i = ERR_R_MALLOC_FAILURE;
-                        goto err;
-                }
-                memcpy(s, p, len);
-                s[len - 1] &= (0xff << i);
-                p += len;
-        } else
-                s = NULL;
-
-        ret->length = (int)len;
-        free(ret->data);
-        ret->data = s;
-        ret->type = V_ASN1_BIT_STRING;
-        if (a != NULL)
-                (*a) = ret;
-        *pp = p;
-        return (ret);
-
-err:
-        ASN1err(ASN1_F_C2I_ASN1_BIT_STRING, i);
-        if ((ret != NULL) && ((a == NULL) || (*a != ret)))
-                M_ASN1_BIT_STRING_free(ret);
-        return (NULL);
-}
-
-/* These next 2 functions from Goetz Babin-Ebell <babinebell@trustcenter.de>
- */
-int
-ASN1_BIT_STRING_set_bit(ASN1_BIT_STRING *a, int n, int value)
-{
-        int w, v, iv;
-        unsigned char *c;
-
-        w = n/8;
-        v = 1 << (7 - (n & 0x07));
-        iv = ~v;
-        if (!value)
-                v = 0;
-
-        if (a == NULL)
-                return 0;
-
-        a->flags &= ~(ASN1_STRING_FLAG_BITS_LEFT | 0x07); /* clear, set on write */
-
-        if ((a->length < (w + 1)) || (a->data == NULL)) {
-                if (!value)
-                        return(1); /* Don't need to set */
-                c = OPENSSL_realloc_clean(a->data, a->length, w + 1);
-                if (c == NULL) {
-                        ASN1err(ASN1_F_ASN1_BIT_STRING_SET_BIT, ERR_R_MALLOC_FAILURE);
-                        return 0;
-                }
-                if (w + 1 - a->length > 0)
-                        memset(c + a->length, 0, w + 1 - a->length);
-                a->data = c;
-                a->length = w + 1;
-        }
-        a->data[w] = ((a->data[w]) & iv) | v;
-        while ((a->length > 0) && (a->data[a->length - 1] == 0))
-                a->length--;
-
-        return (1);
-}
-
-int
-ASN1_BIT_STRING_get_bit(ASN1_BIT_STRING *a, int n)
-{
-        int w, v;
-
-        w = n / 8;
-        v = 1 << (7 - (n & 0x07));
-        if ((a == NULL) || (a->length < (w + 1)) || (a->data == NULL))
-                return (0);
-        return ((a->data[w] & v) != 0);
-}
-
-/*
- * Checks if the given bit string contains only bits specified by
- * the flags vector. Returns 0 if there is at least one bit set in 'a'
- * which is not specified in 'flags', 1 otherwise.
- * 'len' is the length of 'flags'.
- */
-int
-ASN1_BIT_STRING_check(ASN1_BIT_STRING *a, unsigned char *flags, int flags_len)
-{
-        int i, ok;
-
-        /* Check if there is one bit set at all. */
-        if (!a || !a->data)
-                return 1;
-
-        /* Check each byte of the internal representation of the bit string. */
-        ok = 1;
-        for (i = 0; i < a->length && ok; ++i) {
-                unsigned char mask = i < flags_len ? ~flags[i] : 0xff;
-                /* We are done if there is an unneeded bit set. */
-                ok = (a->data[i] & mask) == 0;
-        }
-        return ok;
-}
diff --git a/src/lib/libcrypto/asn1/a_bool.c b/src/lib/libcrypto/asn1/a_bool.c
deleted file mode 100644
index d5a0c0c8a4..0000000000
--- a/src/lib/libcrypto/asn1/a_bool.c
+++ /dev/null
@@ -1,115 +0,0 @@
-/* $OpenBSD: a_bool.c,v 1.7 2014/07/11 08:44:47 jsing Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-
-#include <openssl/asn1t.h>
-#include <openssl/err.h>
-
-int
-i2d_ASN1_BOOLEAN(int a, unsigned char **pp)
-{
-        int r;
-        unsigned char *p;
-
-        r = ASN1_object_size(0, 1, V_ASN1_BOOLEAN);
-        if (pp == NULL)
-                return (r);
-        p = *pp;
-
-        ASN1_put_object(&p, 0, 1, V_ASN1_BOOLEAN, V_ASN1_UNIVERSAL);
-        *(p++) = (unsigned char)a;
-        *pp = p;
-        return (r);
-}
-
-int
-d2i_ASN1_BOOLEAN(int *a, const unsigned char **pp, long length)
-{
-        int ret = -1;
-        const unsigned char *p;
-        long len;
-        int inf, tag, xclass;
-        int i = 0;
-
-        p = *pp;
-        inf = ASN1_get_object(&p, &len, &tag, &xclass, length);
-        if (inf & 0x80) {
-                i = ASN1_R_BAD_OBJECT_HEADER;
-                goto err;
-        }
-
-        if (tag != V_ASN1_BOOLEAN) {
-                i = ASN1_R_EXPECTING_A_BOOLEAN;
-                goto err;
-        }
-
-        if (len != 1) {
-                i = ASN1_R_BOOLEAN_IS_WRONG_LENGTH;
-                goto err;
-        }
-        ret = (int)*(p++);
-        if (a != NULL)
-                (*a) = ret;
-        *pp = p;
-        return (ret);
-
-err:
-        ASN1err(ASN1_F_D2I_ASN1_BOOLEAN, i);
-        return (ret);
-}
diff --git a/src/lib/libcrypto/asn1/a_bytes.c b/src/lib/libcrypto/asn1/a_bytes.c
deleted file mode 100644
index 727ad3ed9b..0000000000
--- a/src/lib/libcrypto/asn1/a_bytes.c
+++ /dev/null
@@ -1,306 +0,0 @@
-/* $OpenBSD: a_bytes.c,v 1.18 2014/07/11 08:44:47 jsing Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-#include <string.h>
-
-#include <openssl/asn1.h>
-#include <openssl/buffer.h>
-#include <openssl/err.h>
-
-static int asn1_collate_primitive(ASN1_STRING *a, ASN1_const_CTX *c);
-/* type is a 'bitmap' of acceptable string types.
- */
-ASN1_STRING *
-d2i_ASN1_type_bytes(ASN1_STRING **a, const unsigned char **pp,
-    long length, int type)
-{
-        ASN1_STRING *ret = NULL;
-        const unsigned char *p;
-        unsigned char *s;
-        long len;
-        int inf, tag, xclass;
-        int i = 0;
-
-        p = *pp;
-        inf = ASN1_get_object(&p, &len, &tag, &xclass, length);
-        if (inf & 0x80)
-                goto err;
-
-        if (tag >= 32) {
-                i = ASN1_R_TAG_VALUE_TOO_HIGH;
-                goto err;
-        }
-        if (!(ASN1_tag2bit(tag) & type)) {
-                i = ASN1_R_WRONG_TYPE;
-                goto err;
-        }
-
-        /* If a bit-string, exit early */
-        if (tag == V_ASN1_BIT_STRING)
-                return (d2i_ASN1_BIT_STRING(a, pp, length));
-
-        if ((a == NULL) || ((*a) == NULL)) {
-                if ((ret = ASN1_STRING_new()) == NULL)
-                        return (NULL);
-        } else
-                ret = (*a);
-
-        if (len != 0) {
-                s = malloc(len + 1);
-                if (s == NULL) {
-                        i = ERR_R_MALLOC_FAILURE;
-                        goto err;
-                }
-                memcpy(s, p, len);
-                s[len]='\0';
-                p += len;
-        } else
-                s = NULL;
-
-        free(ret->data);
-        ret->length = (int)len;
-        ret->data = s;
-        ret->type = tag;
-        if (a != NULL)
-                (*a) = ret;
-        *pp = p;
-        return (ret);
-
-err:
-        ASN1err(ASN1_F_D2I_ASN1_TYPE_BYTES, i);
-        if (a == NULL || *a != ret)
-                ASN1_STRING_free(ret);
-        return (NULL);
-}
-
-int
-i2d_ASN1_bytes(ASN1_STRING *a, unsigned char **pp, int tag, int xclass)
-{
-        int ret, r, constructed;
-        unsigned char *p;
-
-        if (a == NULL)
-                return (0);
-
-        if (tag == V_ASN1_BIT_STRING)
-                return (i2d_ASN1_BIT_STRING(a, pp));
-
-        ret = a->length;
-        r = ASN1_object_size(0, ret, tag);
-        if (pp == NULL)
-                return (r);
-        p = *pp;
-
-        if ((tag == V_ASN1_SEQUENCE) || (tag == V_ASN1_SET))
-                constructed = 1;
-        else
-                constructed = 0;
-        ASN1_put_object(&p, constructed, ret, tag, xclass);
-        memcpy(p, a->data, a->length);
-        p += a->length;
-        *pp = p;
-        return (r);
-}
-
-ASN1_STRING *
-d2i_ASN1_bytes(ASN1_STRING **a, const unsigned char **pp,
-    long length, int Ptag, int Pclass)
-{
-        ASN1_STRING *ret = NULL;
-        const unsigned char *p;
-        unsigned char *s;
-        long len;
-        int inf, tag, xclass;
-        int i = 0;
-
-        if ((a == NULL) || ((*a) == NULL)) {
-                if ((ret = ASN1_STRING_new()) == NULL)
-                        return (NULL);
-        } else
-                ret = (*a);
-
-        p= *pp;
-        inf = ASN1_get_object(&p, &len, &tag, &xclass, length);
-        if (inf & 0x80) {
-                i = ASN1_R_BAD_OBJECT_HEADER;
-                goto err;
-        }
-
-        if (tag != Ptag) {
-                i = ASN1_R_WRONG_TAG;
-                goto err;
-        }
-
-        if (inf & V_ASN1_CONSTRUCTED) {
-                ASN1_const_CTX c;
-
-                c.pp = pp;
-                c.p = p;
-                c.inf = inf;
-                c.slen = len;
-                c.tag = Ptag;
-                c.xclass = Pclass;
-                c.max = (length == 0) ? 0 : (p + length);
-                if (!asn1_collate_primitive(ret, &c))
-                        goto err;
-                else {
-                        p = c.p;
-                }
-        } else {
-                if (len != 0) {
-                        if ((ret->length < len) || (ret->data == NULL)) {
-                                free(ret->data);
-                                ret->data = NULL;
-                                s = malloc(len + 1);
-                                if (s == NULL) {
-                                        i = ERR_R_MALLOC_FAILURE;
-                                        goto err;
-                                }
-                        } else
-                                s = ret->data;
-                        memcpy(s, p, len);
-                        s[len] = '\0';
-                        p += len;
-                } else {
-                        s = NULL;
-                        free(ret->data);
-                }
-
-                ret->length = (int)len;
-                ret->data = s;
-                ret->type = Ptag;
-        }
-
-        if (a != NULL)
-                (*a) = ret;
-        *pp = p;
-        return (ret);
-
-err:
-        if (a == NULL || *a != ret)
-                ASN1_STRING_free(ret);
-        ASN1err(ASN1_F_D2I_ASN1_BYTES, i);
-        return (NULL);
-}
-
-
-/* We are about to parse 0..n d2i_ASN1_bytes objects, we are to collapse
- * them into the one structure that is then returned */
-/* There have been a few bug fixes for this function from
- * Paul Keogh <paul.keogh@sse.ie>, many thanks to him */
-static int
-asn1_collate_primitive(ASN1_STRING *a, ASN1_const_CTX *c)
-{
-        ASN1_STRING *os = NULL;
-        BUF_MEM b;
-        int num;
-
-        b.length = 0;
-        b.max = 0;
-        b.data = NULL;
-
-        if (a == NULL) {
-                c->error = ERR_R_PASSED_NULL_PARAMETER;
-                goto err;
-        }
-
-        num = 0;
-        for (;;) {
-                if (c->inf & 1) {
-                        c->eos = ASN1_const_check_infinite_end(&c->p,
-                            (long)(c->max - c->p));
-                        if (c->eos)
-                                break;
-                } else {
-                        if (c->slen <= 0)
-                                break;
-                }
-
-                c->q = c->p;
-                if (d2i_ASN1_bytes(&os, &c->p, c->max - c->p, c->tag,
-                    c->xclass) == NULL) {
-                        c->error = ERR_R_ASN1_LIB;
-                        goto err;
-                }
-
-                if (!BUF_MEM_grow_clean(&b, num + os->length)) {
-                        c->error = ERR_R_BUF_LIB;
-                        goto err;
-                }
-                memcpy(&(b.data[num]), os->data, os->length);
-                if (!(c->inf & 1))
-                        c->slen -= (c->p - c->q);
-                num += os->length;
-        }
-
-        if (!asn1_const_Finish(c))
-                goto err;
-
-        a->length = num;
-        free(a->data);
-        a->data = (unsigned char *)b.data;
-        ASN1_STRING_free(os);
-        return (1);
-
-err:
-        ASN1err(ASN1_F_ASN1_COLLATE_PRIMITIVE, c->error);
-        ASN1_STRING_free(os);
-        free(b.data);
-        return (0);
-}
diff --git a/src/lib/libcrypto/asn1/a_d2i_fp.c b/src/lib/libcrypto/asn1/a_d2i_fp.c
deleted file mode 100644
index c0fb0a3802..0000000000
--- a/src/lib/libcrypto/asn1/a_d2i_fp.c
+++ /dev/null
@@ -1,271 +0,0 @@
-/* $OpenBSD: a_d2i_fp.c,v 1.11 2014/07/13 11:10:20 miod Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <limits.h>
-#include <stdio.h>
-
-#include <openssl/asn1.h>
-#include <openssl/buffer.h>
-#include <openssl/err.h>
-
-static int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb);
-
-#ifndef NO_OLD_ASN1
-
-void *
-ASN1_d2i_fp(void *(*xnew)(void), d2i_of_void *d2i, FILE *in, void **x)
-{
-        BIO *b;
-        void *ret;
-
-        if ((b = BIO_new(BIO_s_file())) == NULL) {
-                ASN1err(ASN1_F_ASN1_D2I_FP, ERR_R_BUF_LIB);
-                return (NULL);
-        }
-        BIO_set_fp(b, in, BIO_NOCLOSE);
-        ret = ASN1_d2i_bio(xnew, d2i, b, x);
-        BIO_free(b);
-        return (ret);
-}
-
-void *
-ASN1_d2i_bio(void *(*xnew)(void), d2i_of_void *d2i, BIO *in, void **x)
-{
-        BUF_MEM *b = NULL;
-        const unsigned char *p;
-        void *ret = NULL;
-        int len;
-
-        len = asn1_d2i_read_bio(in, &b);
-        if (len < 0)
-                goto err;
-
-        p = (unsigned char *)b->data;
-        ret = d2i(x, &p, len);
-
-err:
-        if (b != NULL)
-                BUF_MEM_free(b);
-        return (ret);
-}
-
-#endif
-
-void *
-ASN1_item_d2i_bio(const ASN1_ITEM *it, BIO *in, void *x)
-{
-        BUF_MEM *b = NULL;
-        const unsigned char *p;
-        void *ret = NULL;
-        int len;
-
-        len = asn1_d2i_read_bio(in, &b);
-        if (len < 0)
-                goto err;
-
-        p = (const unsigned char *)b->data;
-        ret = ASN1_item_d2i(x, &p, len, it);
-
-err:
-        if (b != NULL)
-                BUF_MEM_free(b);
-        return (ret);
-}
-
-void *
-ASN1_item_d2i_fp(const ASN1_ITEM *it, FILE *in, void *x)
-{
-        BIO *b;
-        char *ret;
-
-        if ((b = BIO_new(BIO_s_file())) == NULL) {
-                ASN1err(ASN1_F_ASN1_ITEM_D2I_FP, ERR_R_BUF_LIB);
-                return (NULL);
-        }
-        BIO_set_fp(b, in, BIO_NOCLOSE);
-        ret = ASN1_item_d2i_bio(it, b, x);
-        BIO_free(b);
-        return (ret);
-}
-
-#define HEADER_SIZE   8
-static int
-asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)
-{
-        BUF_MEM *b;
-        unsigned char *p;
-        int i;
-        ASN1_const_CTX c;
-        size_t want = HEADER_SIZE;
-        int eos = 0;
-        size_t off = 0;
-        size_t len = 0;
-
-        b = BUF_MEM_new();
-        if (b == NULL) {
-                ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ERR_R_MALLOC_FAILURE);
-                return -1;
-        }
-
-        ERR_clear_error();
-        for (;;) {
-                if (want >= (len - off)) {
-                        want -= (len - off);
-
-                        if (len + want < len || !BUF_MEM_grow_clean(b, len + want)) {
-                                ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ERR_R_MALLOC_FAILURE);
-                                goto err;
-                        }
-                        i = BIO_read(in, &(b->data[len]), want);
-                        if ((i < 0) && ((len - off) == 0)) {
-                                ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ASN1_R_NOT_ENOUGH_DATA);
-                                goto err;
-                        }
-                        if (i > 0) {
-                                if (len + i < len) {
-                                        ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ASN1_R_TOO_LONG);
-                                        goto err;
-                                }
-                                len += i;
-                        }
-                }
-                /* else data already loaded */
-
-                p = (unsigned char *) & (b->data[off]);
-                c.p = p;
-                c.inf = ASN1_get_object(&(c.p), &(c.slen), &(c.tag),
-                    &(c.xclass), len - off);
-                if (c.inf & 0x80) {
-                        unsigned long e;
-
-                        e = ERR_GET_REASON(ERR_peek_error());
-                        if (e != ASN1_R_TOO_LONG)
-                                goto err;
-                        else
-                                ERR_clear_error(); /* clear error */
-                }
-                i = c.p - p;    /* header length */
-                off += i;       /* end of data */
-
-                if (c.inf & 1) {
-                        /* no data body so go round again */
-                        eos++;
-                        if (eos < 0) {
-                                ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ASN1_R_HEADER_TOO_LONG);
-                                goto err;
-                        }
-                        want = HEADER_SIZE;
-                } else if (eos && (c.slen == 0) && (c.tag == V_ASN1_EOC)) {
-                        /* eos value, so go back and read another header */
-                        eos--;
-                        if (eos <= 0)
-                                break;
-                        else
-                                want = HEADER_SIZE;
-                } else {
-                        /* suck in c.slen bytes of data */
-                        want = c.slen;
-                        if (want > (len - off)) {
-                                want -= (len - off);
-                                if (want > INT_MAX /* BIO_read takes an int length */ ||
-                                    len+want < len) {
-                                        ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ASN1_R_TOO_LONG);
-                                        goto err;
-                                }
-                                if (!BUF_MEM_grow_clean(b, len + want)) {
-                                        ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ERR_R_MALLOC_FAILURE);
-                                        goto err;
-                                }
-                                while (want > 0) {
-                                        i = BIO_read(in, &(b->data[len]), want);
-                                        if (i <= 0) {
-                                                ASN1err(ASN1_F_ASN1_D2I_READ_BIO,
-                                                    ASN1_R_NOT_ENOUGH_DATA);
-                                                goto err;
-                                        }
-                                        /* This can't overflow because
-                                         * |len+want| didn't overflow. */
-                                        len += i;
-                                        want -= i;
-                                }
-                        }
-                        if (off + c.slen < off) {
-                                ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ASN1_R_TOO_LONG);
-                                goto err;
-                        }
-                        off += c.slen;
-                        if (eos <= 0) {
-                                break;
-                        } else
-                                want = HEADER_SIZE;
-                }
-        }
-
-        if (off > INT_MAX) {
-                ASN1err(ASN1_F_ASN1_D2I_READ_BIO, ASN1_R_TOO_LONG);
-                goto err;
-        }
-
-        *pb = b;
-        return off;
-
-err:
-        if (b != NULL)
-                BUF_MEM_free(b);
-        return -1;
-}
diff --git a/src/lib/libcrypto/asn1/a_digest.c b/src/lib/libcrypto/asn1/a_digest.c
deleted file mode 100644
index 085a57d811..0000000000
--- a/src/lib/libcrypto/asn1/a_digest.c
+++ /dev/null
@@ -1,84 +0,0 @@
-/* $OpenBSD: a_digest.c,v 1.15 2014/07/11 08:44:47 jsing Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <sys/types.h>
-
-#include <stdio.h>
-#include <time.h>
-
-#include <openssl/buffer.h>
-#include <openssl/err.h>
-#include <openssl/evp.h>
-#include <openssl/x509.h>
-
-int
-ASN1_item_digest(const ASN1_ITEM *it, const EVP_MD *type, void *asn,
-    unsigned char *md, unsigned int *len)
-{
-        int i;
-        unsigned char *str = NULL;
-
-        i = ASN1_item_i2d(asn, &str, it);
-        if (!str)
-                return (0);
-
-        if (!EVP_Digest(str, i, md, len, type, NULL))
-                return 0;
-        free(str);
-        return (1);
-}
diff --git a/src/lib/libcrypto/asn1/a_dup.c b/src/lib/libcrypto/asn1/a_dup.c
deleted file mode 100644
index 79cd1d4586..0000000000
--- a/src/lib/libcrypto/asn1/a_dup.c
+++ /dev/null
@@ -1,118 +0,0 @@
-/* $OpenBSD: a_dup.c,v 1.13 2014/07/11 08:44:47 jsing Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-
-#include <openssl/asn1.h>
-#include <openssl/err.h>
-
-#ifndef NO_OLD_ASN1
-
-void *
-ASN1_dup(i2d_of_void *i2d, d2i_of_void *d2i, void *x)
-{
-        unsigned char *b, *p;
-        const unsigned char *p2;
-        int i;
-        char *ret;
-
-        if (x == NULL)
-                return (NULL);
-
-        i = i2d(x, NULL);
-        b = malloc(i + 10);
-        if (b == NULL) {
-                ASN1err(ASN1_F_ASN1_DUP, ERR_R_MALLOC_FAILURE);
-                return (NULL);
-        }
-        p = b;
-        i = i2d(x, &p);
-        p2 = b;
-        ret = d2i(NULL, &p2, i);
-        free(b);
-        return (ret);
-}
-
-#endif
-
-/* ASN1_ITEM version of dup: this follows the model above except we don't need
- * to allocate the buffer. At some point this could be rewritten to directly dup
- * the underlying structure instead of doing and encode and decode.
- */
-
-void *
-ASN1_item_dup(const ASN1_ITEM *it, void *x)
-{
-        unsigned char *b = NULL;
-        const unsigned char *p;
-        long i;
-        void *ret;
-
-        if (x == NULL)
-                return (NULL);
-
-        i = ASN1_item_i2d(x, &b, it);
-        if (b == NULL) {
-                ASN1err(ASN1_F_ASN1_ITEM_DUP, ERR_R_MALLOC_FAILURE);
-                return (NULL);
-        }
-        p = b;
-        ret = ASN1_item_d2i(NULL, &p, i, it);
-        free(b);
-        return (ret);
-}
diff --git a/src/lib/libcrypto/asn1/a_enum.c b/src/lib/libcrypto/asn1/a_enum.c
deleted file mode 100644
index 3c059266be..0000000000
--- a/src/lib/libcrypto/asn1/a_enum.c
+++ /dev/null
@@ -1,189 +0,0 @@
-/* $OpenBSD: a_enum.c,v 1.16 2014/09/21 12:17:42 miod Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-
-#include <openssl/asn1.h>
-#include <openssl/bn.h>
-#include <openssl/err.h>
-
-/*
- * Code for ENUMERATED type: identical to INTEGER apart from a different tag.
- * for comments on encoding see a_int.c
- */
-
-int
-ASN1_ENUMERATED_set(ASN1_ENUMERATED *a, long v)
-{
-        int j, k;
-        unsigned int i;
-        unsigned char buf[sizeof(long) + 1];
-        long d;
-
-        a->type = V_ASN1_ENUMERATED;
-        if (a->length < (int)(sizeof(long) + 1)) {
-                free(a->data);
-                a->data = calloc(1, sizeof(long) + 1);
-        }
-        if (a->data == NULL) {
-                ASN1err(ASN1_F_ASN1_ENUMERATED_SET, ERR_R_MALLOC_FAILURE);
-                return (0);
-        }
-        d = v;
-        if (d < 0) {
-                d = -d;
-                a->type = V_ASN1_NEG_ENUMERATED;
-        }
-
-        for (i = 0; i < sizeof(long); i++) {
-                if (d == 0)
-                        break;
-                buf[i] = (int)d & 0xff;
-                d >>= 8;
-        }
-        j = 0;
-        for (k = i - 1; k >= 0; k--)
-                a->data[j++] = buf[k];
-        a->length = j;
-        return (1);
-}
-
-long
-ASN1_ENUMERATED_get(ASN1_ENUMERATED *a)
-{
-        int neg = 0, i;
-        long r = 0;
-
-        if (a == NULL)
-                return (0L);
-        i = a->type;
-        if (i == V_ASN1_NEG_ENUMERATED)
-                neg = 1;
-        else if (i != V_ASN1_ENUMERATED)
-                return -1;
-
-        if (a->length > (int)sizeof(long)) {
-                /* hmm... a bit ugly */
-                return -1;
-        }
-        if (a->data == NULL)
-                return 0;
-
-        for (i = 0; i < a->length; i++) {
-                r <<= 8;
-                r |= (unsigned char)a->data[i];
-        }
-        if (neg)
-                r = -r;
-        return (r);
-}
-
-ASN1_ENUMERATED *
-BN_to_ASN1_ENUMERATED(BIGNUM *bn, ASN1_ENUMERATED *ai)
-{
-        ASN1_ENUMERATED *ret;
-        int len, j;
-
-        if (ai == NULL)
-                ret = M_ASN1_ENUMERATED_new();
-        else
-                ret = ai;
-        if (ret == NULL) {
-                ASN1err(ASN1_F_BN_TO_ASN1_ENUMERATED, ERR_R_NESTED_ASN1_ERROR);
-                goto err;
-        }
-        if (BN_is_negative(bn))
-                ret->type = V_ASN1_NEG_ENUMERATED;
-        else
-                ret->type = V_ASN1_ENUMERATED;
-        j = BN_num_bits(bn);
-        len = ((j == 0) ? 0 : ((j / 8) + 1));
-        if (ret->length < len + 4) {
-                unsigned char *new_data = realloc(ret->data, len + 4);
-                if (!new_data) {
-                        ASN1err(ASN1_F_BN_TO_ASN1_ENUMERATED, ERR_R_MALLOC_FAILURE);
-                        goto err;
-                }
-                ret->data = new_data;
-        }
-        ret->length = BN_bn2bin(bn, ret->data);
-
-        /* Correct zero case */
-        if (!ret->length) {
-                ret->data[0] = 0;
-                ret->length = 1;
-        }
-        return (ret);
-
-err:
-        if (ret != ai)
-                M_ASN1_ENUMERATED_free(ret);
-        return (NULL);
-}
-
-BIGNUM *
-ASN1_ENUMERATED_to_BN(ASN1_ENUMERATED *ai, BIGNUM *bn)
-{
-        BIGNUM *ret;
-
-        if ((ret = BN_bin2bn(ai->data, ai->length, bn)) == NULL)
-                ASN1err(ASN1_F_ASN1_ENUMERATED_TO_BN, ASN1_R_BN_LIB);
-        else if (ai->type == V_ASN1_NEG_ENUMERATED)
-                BN_set_negative(ret, 1);
-        return (ret);
-}
diff --git a/src/lib/libcrypto/asn1/a_i2d_fp.c b/src/lib/libcrypto/asn1/a_i2d_fp.c
deleted file mode 100644
index 424068d784..0000000000
--- a/src/lib/libcrypto/asn1/a_i2d_fp.c
+++ /dev/null
@@ -1,158 +0,0 @@
-/* $OpenBSD: a_i2d_fp.c,v 1.14 2014/07/11 08:44:47 jsing Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-
-#include <openssl/asn1.h>
-#include <openssl/buffer.h>
-#include <openssl/err.h>
-
-#ifndef NO_OLD_ASN1
-
-int
-ASN1_i2d_fp(i2d_of_void *i2d, FILE *out, void *x)
-{
-        BIO *b;
-        int ret;
-
-        if ((b = BIO_new(BIO_s_file())) == NULL) {
-                ASN1err(ASN1_F_ASN1_I2D_FP, ERR_R_BUF_LIB);
-                return (0);
-        }
-        BIO_set_fp(b, out, BIO_NOCLOSE);
-        ret = ASN1_i2d_bio(i2d, b, x);
-        BIO_free(b);
-        return (ret);
-}
-
-int
-ASN1_i2d_bio(i2d_of_void *i2d, BIO *out, unsigned char *x)
-{
-        char *b;
-        unsigned char *p;
-        int i, j = 0, n, ret = 1;
-
-        n = i2d(x, NULL);
-        b = malloc(n);
-        if (b == NULL) {
-                ASN1err(ASN1_F_ASN1_I2D_BIO, ERR_R_MALLOC_FAILURE);
-                return (0);
-        }
-
-        p = (unsigned char *)b;
-        i2d(x, &p);
-
-        for (;;) {
-                i = BIO_write(out, &(b[j]), n);
-                if (i == n)
-                        break;
-                if (i <= 0) {
-                        ret = 0;
-                        break;
-                }
-                j += i;
-                n -= i;
-        }
-        free(b);
-        return (ret);
-}
-
-#endif
-
-int
-ASN1_item_i2d_fp(const ASN1_ITEM *it, FILE *out, void *x)
-{
-        BIO *b;
-        int ret;
-
-        if ((b = BIO_new(BIO_s_file())) == NULL) {
-                ASN1err(ASN1_F_ASN1_ITEM_I2D_FP, ERR_R_BUF_LIB);
-                return (0);
-        }
-        BIO_set_fp(b, out, BIO_NOCLOSE);
-        ret = ASN1_item_i2d_bio(it, b, x);
-        BIO_free(b);
-        return (ret);
-}
-
-int
-ASN1_item_i2d_bio(const ASN1_ITEM *it, BIO *out, void *x)
-{
-        unsigned char *b = NULL;
-        int i, j = 0, n, ret = 1;
-
-        n = ASN1_item_i2d(x, &b, it);
-        if (b == NULL) {
-                ASN1err(ASN1_F_ASN1_ITEM_I2D_BIO, ERR_R_MALLOC_FAILURE);
-                return (0);
-        }
-
-        for (;;) {
-                i = BIO_write(out, &(b[j]), n);
-                if (i == n)
-                        break;
-                if (i <= 0) {
-                        ret = 0;
-                        break;
-                }
-                j += i;
-                n -= i;
-        }
-        free(b);
-        return (ret);
-}
diff --git a/src/lib/libcrypto/asn1/a_int.c b/src/lib/libcrypto/asn1/a_int.c
deleted file mode 100644
index 6a378c0884..0000000000
--- a/src/lib/libcrypto/asn1/a_int.c
+++ /dev/null
@@ -1,463 +0,0 @@
-/* $OpenBSD: a_int.c,v 1.28 2015/07/29 14:58:34 jsing Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-#include <string.h>
-
-#include <openssl/asn1.h>
-#include <openssl/bn.h>
-#include <openssl/err.h>
-
-ASN1_INTEGER *
-ASN1_INTEGER_dup(const ASN1_INTEGER *x)
-{
-        return ASN1_STRING_dup(x);
-}
-
-int
-ASN1_INTEGER_cmp(const ASN1_INTEGER *x, const ASN1_INTEGER *y)
-{
-        int neg, ret;
-
-        /* Compare signs */
-        neg = x->type & V_ASN1_NEG;
-        if (neg != (y->type & V_ASN1_NEG)) {
-                if (neg)
-                        return -1;
-                else
-                        return 1;
-        }
-
-        ret = ASN1_STRING_cmp(x, y);
-
-        if (neg)
-                return -ret;
-        else
-                return ret;
-}
-
-
-/*
- * This converts an ASN1 INTEGER into its content encoding.
- * The internal representation is an ASN1_STRING whose data is a big endian
- * representation of the value, ignoring the sign. The sign is determined by
- * the type: V_ASN1_INTEGER for positive and V_ASN1_NEG_INTEGER for negative.
- *
- * Positive integers are no problem: they are almost the same as the DER
- * encoding, except if the first byte is >= 0x80 we need to add a zero pad.
- *
- * Negative integers are a bit trickier...
- * The DER representation of negative integers is in 2s complement form.
- * The internal form is converted by complementing each octet and finally
- * adding one to the result. This can be done less messily with a little trick.
- * If the internal form has trailing zeroes then they will become FF by the
- * complement and 0 by the add one (due to carry) so just copy as many trailing
- * zeros to the destination as there are in the source. The carry will add one
- * to the last none zero octet: so complement this octet and add one and finally
- * complement any left over until you get to the start of the string.
- *
- * Padding is a little trickier too. If the first bytes is > 0x80 then we pad
- * with 0xff. However if the first byte is 0x80 and one of the following bytes
- * is non-zero we pad with 0xff. The reason for this distinction is that 0x80
- * followed by optional zeros isn't padded.
- */
-
-int
-i2c_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **pp)
-{
-        int pad = 0, ret, i, neg;
-        unsigned char *p, *n, pb = 0;
-
-        if (a == NULL)
-                return (0);
-        neg = a->type & V_ASN1_NEG;
-        if (a->length == 0)
-                ret = 1;
-        else {
-                ret = a->length;
-                i = a->data[0];
-                if (!neg && (i > 127)) {
-                        pad = 1;
-                        pb = 0;
-                } else if (neg) {
-                        if (i > 128) {
-                                pad = 1;
-                                pb = 0xFF;
-                        } else if (i == 128) {
-                                /*
-                                 * Special case: if any other bytes non zero we pad:
-                                 * otherwise we don't.
-                                 */
-                                for (i = 1; i < a->length; i++) if (a->data[i]) {
-                                        pad = 1;
-                                        pb = 0xFF;
-                                        break;
-                                }
-                        }
-                }
-                ret += pad;
-        }
-        if (pp == NULL)
-                return (ret);
-        p= *pp;
-
-        if (pad)
-                *(p++) = pb;
-        if (a->length == 0)
-                *(p++) = 0;
-        else if (!neg)
-                memcpy(p, a->data, a->length);
-        else {
-                /* Begin at the end of the encoding */
-                n = a->data + a->length - 1;
-                p += a->length - 1;
-                i = a->length;
-                /* Copy zeros to destination as long as source is zero */
-                while (!*n) {
-                        *(p--) = 0;
-                        n--;
-                        i--;
-                }
-                /* Complement and increment next octet */
-                *(p--) = ((*(n--)) ^ 0xff) + 1;
-                i--;
-                /* Complement any octets left */
-                for (; i > 0; i--)
-                        *(p--) = *(n--) ^ 0xff;
-        }
-
-        *pp += ret;
-        return (ret);
-}
-
-/* Convert just ASN1 INTEGER content octets to ASN1_INTEGER structure */
-
-ASN1_INTEGER *
-c2i_ASN1_INTEGER(ASN1_INTEGER **a, const unsigned char **pp, long len)
-{
-        ASN1_INTEGER *ret = NULL;
-        const unsigned char *p, *pend;
-        unsigned char *to, *s;
-        int i;
-
-        if ((a == NULL) || ((*a) == NULL)) {
-                if ((ret = M_ASN1_INTEGER_new()) == NULL)
-                        return (NULL);
-                ret->type = V_ASN1_INTEGER;
-        } else
-                ret = (*a);
-
-        p = *pp;
-        pend = p + len;
-
-        /* We must malloc stuff, even for 0 bytes otherwise it
-         * signifies a missing NULL parameter. */
-        s = malloc(len + 1);
-        if (s == NULL) {
-                i = ERR_R_MALLOC_FAILURE;
-                goto err;
-        }
-        to = s;
-        if (!len) {
-                /* Strictly speaking this is an illegal INTEGER but we
-                 * tolerate it.
-                 */
-                ret->type = V_ASN1_INTEGER;
-        } else if (*p & 0x80) /* a negative number */ {
-                ret->type = V_ASN1_NEG_INTEGER;
-                if ((*p == 0xff) && (len != 1)) {
-                        p++;
-                        len--;
-                }
-                i = len;
-                p += i - 1;
-                to += i - 1;
-                while((!*p) && i) {
-                        *(to--) = 0;
-                        i--;
-                        p--;
-                }
-                /* Special case: if all zeros then the number will be of
-                 * the form FF followed by n zero bytes: this corresponds to
-                 * 1 followed by n zero bytes. We've already written n zeros
-                 * so we just append an extra one and set the first byte to
-                 * a 1. This is treated separately because it is the only case
-                 * where the number of bytes is larger than len.
-                 */
-                if (!i) {
-                        *s = 1;
-                        s[len] = 0;
-                        len++;
-                } else {
-                        *(to--) = (*(p--) ^ 0xff) + 1;
-                        i--;
-                        for (; i > 0; i--)
-                                *(to--) = *(p--) ^ 0xff;
-                }
-        } else {
-                ret->type = V_ASN1_INTEGER;
-                if ((*p == 0) && (len != 1)) {
-                        p++;
-                        len--;
-                }
-                memcpy(s, p, len);
-        }
-
-        free(ret->data);
-        ret->data = s;
-        ret->length = (int)len;
-        if (a != NULL)
-                (*a) = ret;
-        *pp = pend;
-        return (ret);
-
-err:
-        ASN1err(ASN1_F_C2I_ASN1_INTEGER, i);
-        if (a == NULL || *a != ret)
-                M_ASN1_INTEGER_free(ret);
-        return (NULL);
-}
-
-
-/* This is a version of d2i_ASN1_INTEGER that ignores the sign bit of
- * ASN1 integers: some broken software can encode a positive INTEGER
- * with its MSB set as negative (it doesn't add a padding zero).
- */
-
-ASN1_INTEGER *
-d2i_ASN1_UINTEGER(ASN1_INTEGER **a, const unsigned char **pp, long length)
-{
-        ASN1_INTEGER *ret = NULL;
-        const unsigned char *p;
-        unsigned char *s;
-        long len;
-        int inf, tag, xclass;
-        int i;
-
-        if ((a == NULL) || ((*a) == NULL)) {
-                if ((ret = M_ASN1_INTEGER_new()) == NULL)
-                        return (NULL);
-                ret->type = V_ASN1_INTEGER;
-        } else
-                ret = (*a);
-
-        p = *pp;
-        inf = ASN1_get_object(&p, &len, &tag, &xclass, length);
-        if (inf & 0x80) {
-                i = ASN1_R_BAD_OBJECT_HEADER;
-                goto err;
-        }
-
-        if (tag != V_ASN1_INTEGER) {
-                i = ASN1_R_EXPECTING_AN_INTEGER;
-                goto err;
-        }
-
-        /* We must malloc stuff, even for 0 bytes otherwise it
-         * signifies a missing NULL parameter. */
-        s = malloc(len + 1);
-        if (s == NULL) {
-                i = ERR_R_MALLOC_FAILURE;
-                goto err;
-        }
-        ret->type = V_ASN1_INTEGER;
-        if (len) {
-                if ((*p == 0) && (len != 1)) {
-                        p++;
-                        len--;
-                }
-                memcpy(s, p, len);
-                p += len;
-        }
-
-        free(ret->data);
-        ret->data = s;
-        ret->length = (int)len;
-        if (a != NULL)
-                (*a) = ret;
-        *pp = p;
-        return (ret);
-
-err:
-        ASN1err(ASN1_F_D2I_ASN1_UINTEGER, i);
-        if (a == NULL || *a != ret)
-                M_ASN1_INTEGER_free(ret);
-        return (NULL);
-}
-
-int
-ASN1_INTEGER_set(ASN1_INTEGER *a, long v)
-{
-        int j, k;
-        unsigned int i;
-        unsigned char buf[sizeof(long) + 1];
-        long d;
-
-        a->type = V_ASN1_INTEGER;
-        /* XXX ssl/ssl_asn1.c:i2d_SSL_SESSION() depends upon this bound vae */
-        if (a->length < (int)(sizeof(long) + 1)) {
-                free(a->data);
-                a->data = calloc(1, sizeof(long) + 1);
-        }
-        if (a->data == NULL) {
-                ASN1err(ASN1_F_ASN1_INTEGER_SET, ERR_R_MALLOC_FAILURE);
-                return (0);
-        }
-        d = v;
-        if (d < 0) {
-                d = -d;
-                a->type = V_ASN1_NEG_INTEGER;
-        }
-
-        for (i = 0; i < sizeof(long); i++) {
-                if (d == 0)
-                        break;
-                buf[i] = (int)d & 0xff;
-                d >>= 8;
-        }
-        j = 0;
-        for (k = i - 1; k >= 0; k--)
-                a->data[j++] = buf[k];
-        a->length = j;
-        return (1);
-}
-
-long
-ASN1_INTEGER_get(const ASN1_INTEGER *a)
-{
-        int neg = 0, i;
-        long r = 0;
-
-        if (a == NULL)
-                return (0L);
-        i = a->type;
-        if (i == V_ASN1_NEG_INTEGER)
-                neg = 1;
-        else if (i != V_ASN1_INTEGER)
-                return -1;
-
-        if (a->length > (int)sizeof(long)) {
-                /* hmm... a bit ugly, return all ones */
-                return -1;
-        }
-        if (a->data == NULL)
-                return 0;
-
-        for (i = 0; i < a->length; i++) {
-                r <<= 8;
-                r |= (unsigned char)a->data[i];
-        }
-        if (neg)
-                r = -r;
-        return (r);
-}
-
-ASN1_INTEGER *
-BN_to_ASN1_INTEGER(const BIGNUM *bn, ASN1_INTEGER *ai)
-{
-        ASN1_INTEGER *ret;
-        int len, j;
-
-        if (ai == NULL)
-                ret = M_ASN1_INTEGER_new();
-        else
-                ret = ai;
-        if (ret == NULL) {
-                ASN1err(ASN1_F_BN_TO_ASN1_INTEGER, ERR_R_NESTED_ASN1_ERROR);
-                goto err;
-        }
-        if (BN_is_negative(bn))
-                ret->type = V_ASN1_NEG_INTEGER;
-        else
-                ret->type = V_ASN1_INTEGER;
-        j = BN_num_bits(bn);
-        len = ((j == 0) ? 0 : ((j / 8) + 1));
-        if (ret->length < len + 4) {
-                unsigned char *new_data = realloc(ret->data, len + 4);
-                if (!new_data) {
-                        ASN1err(ASN1_F_BN_TO_ASN1_INTEGER, ERR_R_MALLOC_FAILURE);
-                        goto err;
-                }
-                ret->data = new_data;
-        }
-        ret->length = BN_bn2bin(bn, ret->data);
-
-        /* Correct zero case */
-        if (!ret->length) {
-                ret->data[0] = 0;
-                ret->length = 1;
-        }
-        return (ret);
-
-err:
-        if (ret != ai)
-                M_ASN1_INTEGER_free(ret);
-        return (NULL);
-}
-
-BIGNUM *
-ASN1_INTEGER_to_BN(const ASN1_INTEGER *ai, BIGNUM *bn)
-{
-        BIGNUM *ret;
-
-        if ((ret = BN_bin2bn(ai->data, ai->length, bn)) == NULL)
-                ASN1err(ASN1_F_ASN1_INTEGER_TO_BN, ASN1_R_BN_LIB);
-        else if (ai->type == V_ASN1_NEG_INTEGER)
-                BN_set_negative(ret, 1);
-        return (ret);
-}
diff --git a/src/lib/libcrypto/asn1/a_mbstr.c b/src/lib/libcrypto/asn1/a_mbstr.c
deleted file mode 100644
index e715fe7348..0000000000
--- a/src/lib/libcrypto/asn1/a_mbstr.c
+++ /dev/null
@@ -1,453 +0,0 @@
-/* $OpenBSD: a_mbstr.c,v 1.22 2015/07/16 02:18:58 miod Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 1999.
- */
-/* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <ctype.h>
-#include <stdio.h>
-#include <string.h>
-
-#include <openssl/asn1.h>
-#include <openssl/err.h>
-
-#include "asn1_locl.h"
-
-static int traverse_string(const unsigned char *p, int len, int inform,
-    int (*rfunc)(unsigned long value, void *in), void *arg);
-static int in_utf8(unsigned long value, void *arg);
-static int out_utf8(unsigned long value, void *arg);
-static int type_str(unsigned long value, void *arg);
-static int cpy_asc(unsigned long value, void *arg);
-static int cpy_bmp(unsigned long value, void *arg);
-static int cpy_univ(unsigned long value, void *arg);
-static int cpy_utf8(unsigned long value, void *arg);
-static int is_printable(unsigned long value);
-
-/* These functions take a string in UTF8, ASCII or multibyte form and
- * a mask of permissible ASN1 string types. It then works out the minimal
- * type (using the order Printable < IA5 < T61 < BMP < Universal < UTF8)
- * and creates a string of the correct type with the supplied data.
- * Yes this is horrible: it has to be :-(
- * The 'ncopy' form checks minimum and maximum size limits too.
- */
-
-int
-ASN1_mbstring_copy(ASN1_STRING **out, const unsigned char *in, int len,
-    int inform, unsigned long mask)
-{
-        return ASN1_mbstring_ncopy(out, in, len, inform, mask, 0, 0);
-}
-
-int
-ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
-    int inform, unsigned long mask, long minsize, long maxsize)
-{
-        int str_type;
-        int ret;
-        char free_out;
-        int outform, outlen = 0;
-        ASN1_STRING *dest;
-        unsigned char *p;
-        int nchar;
-        int (*cpyfunc)(unsigned long, void *) = NULL;
-
-        if (len < 0)
-                len = strlen((const char *)in);
-        if (!mask)
-                mask = DIRSTRING_TYPE;
-
-        /* First do a string check and work out the number of characters */
-        switch (inform) {
-        case MBSTRING_BMP:
-                if (len & 1) {
-                        ASN1err(ASN1_F_ASN1_MBSTRING_NCOPY,
-                            ASN1_R_INVALID_BMPSTRING_LENGTH);
-                        return -1;
-                }
-                nchar = len >> 1;
-                break;
-
-        case MBSTRING_UNIV:
-                if (len & 3) {
-                        ASN1err(ASN1_F_ASN1_MBSTRING_NCOPY,
-                            ASN1_R_INVALID_UNIVERSALSTRING_LENGTH);
-                        return -1;
-                }
-                nchar = len >> 2;
-                break;
-
-        case MBSTRING_UTF8:
-                nchar = 0;
-                /* This counts the characters and does utf8 syntax checking */
-                ret = traverse_string(in, len, MBSTRING_UTF8, in_utf8, &nchar);
-                if (ret < 0) {
-                        ASN1err(ASN1_F_ASN1_MBSTRING_NCOPY,
-                            ASN1_R_INVALID_UTF8STRING);
-                        return -1;
-                }
-                break;
-
-        case MBSTRING_ASC:
-                nchar = len;
-                break;
-
-        default:
-                ASN1err(ASN1_F_ASN1_MBSTRING_NCOPY, ASN1_R_UNKNOWN_FORMAT);
-                return -1;
-        }
-
-        if ((minsize > 0) && (nchar < minsize)) {
-                ASN1err(ASN1_F_ASN1_MBSTRING_NCOPY, ASN1_R_STRING_TOO_SHORT);
-                ERR_asprintf_error_data("minsize=%ld", minsize);
-                return -1;
-        }
-
-        if ((maxsize > 0) && (nchar > maxsize)) {
-                ASN1err(ASN1_F_ASN1_MBSTRING_NCOPY, ASN1_R_STRING_TOO_LONG);
-                ERR_asprintf_error_data("maxsize=%ld", maxsize);
-                return -1;
-        }
-
-        /* Now work out minimal type (if any) */
-        if (traverse_string(in, len, inform, type_str, &mask) < 0) {
-                ASN1err(ASN1_F_ASN1_MBSTRING_NCOPY, ASN1_R_ILLEGAL_CHARACTERS);
-                return -1;
-        }
-
-
-        /* Now work out output format and string type */
-        outform = MBSTRING_ASC;
-        if (mask & B_ASN1_PRINTABLESTRING)
-                str_type = V_ASN1_PRINTABLESTRING;
-        else if (mask & B_ASN1_IA5STRING)
-                str_type = V_ASN1_IA5STRING;
-        else if (mask & B_ASN1_T61STRING)
-                str_type = V_ASN1_T61STRING;
-        else if (mask & B_ASN1_BMPSTRING) {
-                str_type = V_ASN1_BMPSTRING;
-                outform = MBSTRING_BMP;
-        } else if (mask & B_ASN1_UNIVERSALSTRING) {
-                str_type = V_ASN1_UNIVERSALSTRING;
-                outform = MBSTRING_UNIV;
-        } else {
-                str_type = V_ASN1_UTF8STRING;
-                outform = MBSTRING_UTF8;
-        }
-        if (!out)
-                return str_type;
-        if (*out) {
-                free_out = 0;
-                dest = *out;
-                if (dest->data) {
-                        dest->length = 0;
-                        free(dest->data);
-                        dest->data = NULL;
-                }
-                dest->type = str_type;
-        } else {
-                free_out = 1;
-                dest = ASN1_STRING_type_new(str_type);
-                if (!dest) {
-                        ASN1err(ASN1_F_ASN1_MBSTRING_NCOPY,
-                            ERR_R_MALLOC_FAILURE);
-                        return -1;
-                }
-                *out = dest;
-        }
-        /* If both the same type just copy across */
-        if (inform == outform) {
-                if (!ASN1_STRING_set(dest, in, len)) {
-                        ASN1err(ASN1_F_ASN1_MBSTRING_NCOPY,
-                            ERR_R_MALLOC_FAILURE);
-                        goto err;
-                }
-                return str_type;
-        }
-
-        /* Work out how much space the destination will need */
-        switch (outform) {
-        case MBSTRING_ASC:
-                outlen = nchar;
-                cpyfunc = cpy_asc;
-                break;
-
-        case MBSTRING_BMP:
-                outlen = nchar << 1;
-                cpyfunc = cpy_bmp;
-                break;
-
-        case MBSTRING_UNIV:
-                outlen = nchar << 2;
-                cpyfunc = cpy_univ;
-                break;
-
-        case MBSTRING_UTF8:
-                outlen = 0;
-                if (traverse_string(in, len, inform, out_utf8, &outlen) < 0) {
-                        ASN1err(ASN1_F_ASN1_MBSTRING_NCOPY,
-                            ASN1_R_ILLEGAL_CHARACTERS);
-                        goto err;
-                }
-                cpyfunc = cpy_utf8;
-                break;
-        }
-        if (!(p = malloc(outlen + 1))) {
-                ASN1err(ASN1_F_ASN1_MBSTRING_NCOPY, ERR_R_MALLOC_FAILURE);
-                goto err;
-        }
-        dest->length = outlen;
-        dest->data = p;
-        p[outlen] = 0;
-        traverse_string(in, len, inform, cpyfunc, &p);
-        return str_type;
-
-err:
-        if (free_out) {
-                ASN1_STRING_free(dest);
-                *out = NULL;
-        }
-        return -1;
-}
-
-/* This function traverses a string and passes the value of each character
- * to an optional function along with a void * argument.
- */
-
-static int
-traverse_string(const unsigned char *p, int len, int inform,
-    int (*rfunc)(unsigned long value, void *in), void *arg)
-{
-        unsigned long value;
-        int ret;
-
-        while (len) {
-                switch (inform) {
-                case MBSTRING_ASC:
-                        value = *p++;
-                        len--;
-                        break;
-                case MBSTRING_BMP:
-                        value = *p++ << 8;
-                        value |= *p++;
-                        /* BMP is explictly defined to not support surrogates */
-                        if (UNICODE_IS_SURROGATE(value))
-                                return -1;
-                        len -= 2;
-                        break;
-                case MBSTRING_UNIV:
-                        value = (unsigned long)*p++ << 24;
-                        value |= *p++ << 16;
-                        value |= *p++ << 8;
-                        value |= *p++;
-                        if (value > UNICODE_MAX || UNICODE_IS_SURROGATE(value))
-                                return -1;
-                        len -= 4;
-                        break;
-                default:
-                        ret = UTF8_getc(p, len, &value);
-                        if (ret < 0)
-                                return -1;
-                        len -= ret;
-                        p += ret;
-                        break;
-                }
-                if (rfunc) {
-                        ret = rfunc(value, arg);
-                        if (ret <= 0)
-                                return ret;
-                }
-        }
-        return 1;
-}
-
-/* Various utility functions for traverse_string */
-
-/* Just count number of characters */
-
-static int
-in_utf8(unsigned long value, void *arg)
-{
-        int *nchar;
-
-        nchar = arg;
-        (*nchar)++;
-        return 1;
-}
-
-/* Determine size of output as a UTF8 String */
-
-static int
-out_utf8(unsigned long value, void *arg)
-{
-        int *outlen;
-        int ret;
-
-        outlen = arg;
-        ret = UTF8_putc(NULL, -1, value);
-        if (ret < 0)
-                return ret;
-        *outlen += ret;
-        return 1;
-}
-
-/* Determine the "type" of a string: check each character against a
- * supplied "mask".
- */
-
-static int
-type_str(unsigned long value, void *arg)
-{
-        unsigned long types;
-
-        types = *((unsigned long *)arg);
-        if ((types & B_ASN1_PRINTABLESTRING) && !is_printable(value))
-                types &= ~B_ASN1_PRINTABLESTRING;
-        if ((types & B_ASN1_IA5STRING) && (value > 127))
-                types &= ~B_ASN1_IA5STRING;
-        if ((types & B_ASN1_T61STRING) && (value > 0xff))
-                types &= ~B_ASN1_T61STRING;
-        if ((types & B_ASN1_BMPSTRING) && (value > 0xffff))
-                types &= ~B_ASN1_BMPSTRING;
-        if (!types)
-                return -1;
-        *((unsigned long *)arg) = types;
-        return 1;
-}
-
-/* Copy one byte per character ASCII like strings */
-
-static int
-cpy_asc(unsigned long value, void *arg)
-{
-        unsigned char **p, *q;
-
-        p = arg;
-        q = *p;
-        *q = value;
-        (*p)++;
-        return 1;
-}
-
-/* Copy two byte per character BMPStrings */
-
-static int
-cpy_bmp(unsigned long value, void *arg)
-{
-        unsigned char **p, *q;
-
-        p = arg;
-        q = *p;
-        *q++ = (value >> 8) & 0xff;
-        *q = value & 0xff;
-        *p += 2;
-        return 1;
-}
-
-/* Copy four byte per character UniversalStrings */
-
-static int
-cpy_univ(unsigned long value, void *arg)
-{
-        unsigned char **p, *q;
-
-        p = arg;
-        q = *p;
-        *q++ = (value >> 24) & 0xff;
-        *q++ = (value >> 16) & 0xff;
-        *q++ = (value >> 8) & 0xff;
-        *q = value & 0xff;
-        *p += 4;
-        return 1;
-}
-
-/* Copy to a UTF8String */
-
-static int
-cpy_utf8(unsigned long value, void *arg)
-{
-        unsigned char **p;
-
-        int ret;
-        p = arg;
-        /* We already know there is enough room so pass 0xff as the length */
-        ret = UTF8_putc(*p, 0xff, value);
-        *p += ret;
-        return 1;
-}
-
-/* Return 1 if the character is permitted in a PrintableString */
-static int
-is_printable(unsigned long value)
-{
-        int ch;
-
-        if (value > 0x7f)
-                return 0;
-        ch = (int)value;
-
-        /* Note: we can't use 'isalnum' because certain accented
-         * characters may count as alphanumeric in some environments.
-         */
-        if ((ch >= 'a') && (ch <= 'z'))
-                return 1;
-        if ((ch >= 'A') && (ch <= 'Z'))
-                return 1;
-        if ((ch >= '0') && (ch <= '9'))
-                return 1;
-        if ((ch == ' ') || strchr("'()+,-./:=?", ch))
-                return 1;
-        return 0;
-}
diff --git a/src/lib/libcrypto/asn1/a_object.c b/src/lib/libcrypto/asn1/a_object.c
deleted file mode 100644
index 7bcabec034..0000000000
--- a/src/lib/libcrypto/asn1/a_object.c
+++ /dev/null
@@ -1,405 +0,0 @@
-/* $OpenBSD: a_object.c,v 1.24 2015/02/10 08:33:10 jsing Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <limits.h>
-#include <stdio.h>
-#include <string.h>
-
-#include <openssl/asn1.h>
-#include <openssl/bn.h>
-#include <openssl/err.h>
-#include <openssl/buffer.h>
-#include <openssl/objects.h>
-
-int
-i2d_ASN1_OBJECT(ASN1_OBJECT *a, unsigned char **pp)
-{
-        unsigned char *p;
-        int objsize;
-
-        if ((a == NULL) || (a->data == NULL))
-                return (0);
-
-        objsize = ASN1_object_size(0, a->length, V_ASN1_OBJECT);
-        if (pp == NULL)
-                return objsize;
-
-        p = *pp;
-        ASN1_put_object(&p, 0, a->length, V_ASN1_OBJECT, V_ASN1_UNIVERSAL);
-        memcpy(p, a->data, a->length);
-        p += a->length;
-
-        *pp = p;
-        return (objsize);
-}
-
-int
-a2d_ASN1_OBJECT(unsigned char *out, int olen, const char *buf, int num)
-{
-        int i, first, len = 0, c, use_bn;
-        char ftmp[24], *tmp = ftmp;
-        int tmpsize = sizeof ftmp;
-        const char *p;
-        unsigned long l;
-        BIGNUM *bl = NULL;
-
-        if (num == 0)
-                return (0);
-        else if (num == -1)
-                num = strlen(buf);
-
-        p = buf;
-        c = *(p++);
-        num--;
-        if ((c >= '0') && (c <= '2')) {
-                first= c-'0';
-        } else {
-                ASN1err(ASN1_F_A2D_ASN1_OBJECT, ASN1_R_FIRST_NUM_TOO_LARGE);
-                goto err;
-        }
-
-        if (num <= 0) {
-                ASN1err(ASN1_F_A2D_ASN1_OBJECT, ASN1_R_MISSING_SECOND_NUMBER);
-                goto err;
-        }
-        c = *(p++);
-        num--;
-        for (;;) {
-                if (num <= 0)
-                        break;
-                if ((c != '.') && (c != ' ')) {
-                        ASN1err(ASN1_F_A2D_ASN1_OBJECT,
-                            ASN1_R_INVALID_SEPARATOR);
-                        goto err;
-                }
-                l = 0;
-                use_bn = 0;
-                for (;;) {
-                        if (num <= 0)
-                                break;
-                        num--;
-                        c = *(p++);
-                        if ((c == ' ') || (c == '.'))
-                                break;
-                        if ((c < '0') || (c > '9')) {
-                                ASN1err(ASN1_F_A2D_ASN1_OBJECT,
-                                    ASN1_R_INVALID_DIGIT);
-                                goto err;
-                        }
-                        if (!use_bn && l >= ((ULONG_MAX - 80) / 10L)) {
-                                use_bn = 1;
-                                if (!bl)
-                                        bl = BN_new();
-                                if (!bl || !BN_set_word(bl, l))
-                                        goto err;
-                        }
-                        if (use_bn) {
-                                if (!BN_mul_word(bl, 10L) ||
-                                    !BN_add_word(bl, c-'0'))
-                                        goto err;
-                        } else
-                                l = l * 10L + (long)(c - '0');
-                }
-                if (len == 0) {
-                        if ((first < 2) && (l >= 40)) {
-                                ASN1err(ASN1_F_A2D_ASN1_OBJECT,
-                                    ASN1_R_SECOND_NUMBER_TOO_LARGE);
-                                goto err;
-                        }
-                        if (use_bn) {
-                                if (!BN_add_word(bl, first * 40))
-                                        goto err;
-                        } else
-                                l += (long)first * 40;
-                }
-                i = 0;
-                if (use_bn) {
-                        int blsize;
-                        blsize = BN_num_bits(bl);
-                        blsize = (blsize + 6) / 7;
-                        if (blsize > tmpsize) {
-                                if (tmp != ftmp)
-                                        free(tmp);
-                                tmpsize = blsize + 32;
-                                tmp = malloc(tmpsize);
-                                if (!tmp)
-                                        goto err;
-                        }
-                        while (blsize--)
-                                tmp[i++] = (unsigned char)BN_div_word(bl, 0x80L);
-                } else {
-
-                        for (;;) {
-                                tmp[i++] = (unsigned char)l & 0x7f;
-                                l >>= 7L;
-                                if (l == 0L)
-                                        break;
-                        }
-
-                }
-                if (out != NULL) {
-                        if (len + i > olen) {
-                                ASN1err(ASN1_F_A2D_ASN1_OBJECT,
-                                    ASN1_R_BUFFER_TOO_SMALL);
-                                goto err;
-                        }
-                        while (--i > 0)
-                                out[len++] = tmp[i]|0x80;
-                        out[len++] = tmp[0];
-                } else
-                        len += i;
-        }
-        if (tmp != ftmp)
-                free(tmp);
-        BN_free(bl);
-        return (len);
-
-err:
-        if (tmp != ftmp)
-                free(tmp);
-        BN_free(bl);
-        return (0);
-}
-
-int
-i2t_ASN1_OBJECT(char *buf, int buf_len, ASN1_OBJECT *a)
-{
-        return OBJ_obj2txt(buf, buf_len, a, 0);
-}
-
-int
-i2a_ASN1_OBJECT(BIO *bp, ASN1_OBJECT *a)
-{
-        char buf[80], *p = buf;
-        int i;
-
-        if ((a == NULL) || (a->data == NULL))
-                return(BIO_write(bp, "NULL",4));
-        i = i2t_ASN1_OBJECT(buf, sizeof buf, a);
-        if (i > (int)(sizeof(buf) - 1)) {
-                p = malloc(i + 1);
-                if (!p)
-                        return -1;
-                i2t_ASN1_OBJECT(p, i + 1, a);
-        }
-        if (i <= 0)
-                return BIO_write(bp, "<INVALID>", 9);
-        BIO_write(bp, p, i);
-        if (p != buf)
-                free(p);
-        return (i);
-}
-
-ASN1_OBJECT *
-d2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp, long length)
-{
-        const unsigned char *p;
-        long len;
-        int tag, xclass;
-        int inf, i;
-        ASN1_OBJECT *ret = NULL;
-
-        p = *pp;
-        inf = ASN1_get_object(&p, &len, &tag, &xclass, length);
-        if (inf & 0x80) {
-                i = ASN1_R_BAD_OBJECT_HEADER;
-                goto err;
-        }
-
-        if (tag != V_ASN1_OBJECT) {
-                i = ASN1_R_EXPECTING_AN_OBJECT;
-                goto err;
-        }
-        ret = c2i_ASN1_OBJECT(a, &p, len);
-        if (ret)
-                *pp = p;
-        return ret;
-
-err:
-        ASN1err(ASN1_F_D2I_ASN1_OBJECT, i);
-        return (NULL);
-}
-
-ASN1_OBJECT *
-c2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp, long len)
-{
-        ASN1_OBJECT *ret = NULL;
-        const unsigned char *p;
-        unsigned char *data;
-        int i, length;
-
-        /*
-         * Sanity check OID encoding:
-         * - need at least one content octet
-         * - MSB must be clear in the last octet
-         * - can't have leading 0x80 in subidentifiers, see: X.690 8.19.2
-         */
-        if (len <= 0 || len > INT_MAX || pp == NULL || (p = *pp) == NULL ||
-            p[len - 1] & 0x80) {
-                ASN1err(ASN1_F_C2I_ASN1_OBJECT, ASN1_R_INVALID_OBJECT_ENCODING);
-                return (NULL);
-        }
-
-        /* Now 0 < len <= INT_MAX, so the cast is safe. */
-        length = (int)len;
-        for (i = 0; i < length; i++, p++) {
-                if (*p == 0x80 && (!i || !(p[-1] & 0x80))) {
-                        ASN1err(ASN1_F_C2I_ASN1_OBJECT,
-                            ASN1_R_INVALID_OBJECT_ENCODING);
-                        return NULL;
-                }
-        }
-
-        /* only the ASN1_OBJECTs from the 'table' will have values
-         * for ->sn or ->ln */
-        if ((a == NULL) || ((*a) == NULL) ||
-            !((*a)->flags & ASN1_OBJECT_FLAG_DYNAMIC)) {
-                if ((ret = ASN1_OBJECT_new()) == NULL)
-                        return (NULL);
-        } else
-                ret = (*a);
-
-        p = *pp;
-        /* detach data from object */
-        data = (unsigned char *)ret->data;
-        ret->data = NULL;
-        /* once detached we can change it */
-        if ((data == NULL) || (ret->length < length)) {
-                ret->length = 0;
-                free(data);
-                data = malloc(length);
-                if (data == NULL) {
-                        i = ERR_R_MALLOC_FAILURE;
-                        goto err;
-                }
-                ret->flags |= ASN1_OBJECT_FLAG_DYNAMIC_DATA;
-        }
-        memcpy(data, p, length);
-        /* reattach data to object, after which it remains const */
-        ret->data = data;
-        ret->length = length;
-        ret->sn = NULL;
-        ret->ln = NULL;
-        /* ret->flags=ASN1_OBJECT_FLAG_DYNAMIC; we know it is dynamic */
-        p += length;
-
-        if (a != NULL)
-                (*a) = ret;
-        *pp = p;
-        return (ret);
-
-err:
-        ASN1err(ASN1_F_C2I_ASN1_OBJECT, i);
-        if ((ret != NULL) && ((a == NULL) || (*a != ret)))
-                ASN1_OBJECT_free(ret);
-        return (NULL);
-}
-
-ASN1_OBJECT *
-ASN1_OBJECT_new(void)
-{
-        ASN1_OBJECT *ret;
-
-        ret = malloc(sizeof(ASN1_OBJECT));
-        if (ret == NULL) {
-                ASN1err(ASN1_F_ASN1_OBJECT_NEW, ERR_R_MALLOC_FAILURE);
-                return (NULL);
-        }
-        ret->length = 0;
-        ret->data = NULL;
-        ret->nid = 0;
-        ret->sn = NULL;
-        ret->ln = NULL;
-        ret->flags = ASN1_OBJECT_FLAG_DYNAMIC;
-        return (ret);
-}
-
-void
-ASN1_OBJECT_free(ASN1_OBJECT *a)
-{
-        if (a == NULL)
-                return;
-        if (a->flags & ASN1_OBJECT_FLAG_DYNAMIC_STRINGS) {
-                free((void *)a->sn);
-                free((void *)a->ln);
-                a->sn = a->ln = NULL;
-        }
-        if (a->flags & ASN1_OBJECT_FLAG_DYNAMIC_DATA) {
-                free((void *)a->data);
-                a->data = NULL;
-                a->length = 0;
-        }
-        if (a->flags & ASN1_OBJECT_FLAG_DYNAMIC)
-                free(a);
-}
-
-ASN1_OBJECT *
-ASN1_OBJECT_create(int nid, unsigned char *data, int len,
-    const char *sn, const char *ln)
-{
-        ASN1_OBJECT o;
-
-        o.sn = sn;
-        o.ln = ln;
-        o.data = data;
-        o.nid = nid;
-        o.length = len;
-        o.flags = ASN1_OBJECT_FLAG_DYNAMIC | ASN1_OBJECT_FLAG_DYNAMIC_STRINGS |
-            ASN1_OBJECT_FLAG_DYNAMIC_DATA;
-        return (OBJ_dup(&o));
-}
diff --git a/src/lib/libcrypto/asn1/a_octet.c b/src/lib/libcrypto/asn1/a_octet.c
deleted file mode 100644
index d998675d3f..0000000000
--- a/src/lib/libcrypto/asn1/a_octet.c
+++ /dev/null
@@ -1,79 +0,0 @@
-/* $OpenBSD: a_octet.c,v 1.10 2015/07/29 14:58:34 jsing Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-
-#include <openssl/asn1.h>
-
-ASN1_OCTET_STRING *
-ASN1_OCTET_STRING_dup(const ASN1_OCTET_STRING *x)
-{
-        return ASN1_STRING_dup(x);
-}
-
-int
-ASN1_OCTET_STRING_cmp(const ASN1_OCTET_STRING *a, const ASN1_OCTET_STRING *b)
-{
-        return ASN1_STRING_cmp(a, b);
-}
-
-int
-ASN1_OCTET_STRING_set(ASN1_OCTET_STRING *x, const unsigned char *d, int len)
-{
-        return ASN1_STRING_set(x, d, len);
-}
diff --git a/src/lib/libcrypto/asn1/a_print.c b/src/lib/libcrypto/asn1/a_print.c
deleted file mode 100644
index ddcee54c7d..0000000000
--- a/src/lib/libcrypto/asn1/a_print.c
+++ /dev/null
@@ -1,125 +0,0 @@
-/* $OpenBSD: a_print.c,v 1.11 2014/07/11 08:44:47 jsing Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-
-#include <openssl/asn1.h>
-
-int
-ASN1_PRINTABLE_type(const unsigned char *s, int len)
-{
-        int c;
-        int ia5 = 0;
-        int t61 = 0;
-
-        if (len <= 0)
-                len = -1;
-        if (s == NULL)
-                return (V_ASN1_PRINTABLESTRING);
-
-        while ((*s) && (len-- != 0)) {
-                c= *(s++);
-                if (!(((c >= 'a') && (c <= 'z')) ||
-                    ((c >= 'A') && (c <= 'Z')) ||
-                    (c == ' ') ||
-                    ((c >= '0') && (c <= '9')) ||
-                    (c == ' ') || (c == '\'') ||
-                    (c == '(') || (c == ')') ||
-                    (c == '+') || (c == ',') ||
-                    (c == '-') || (c == '.') ||
-                    (c == '/') || (c == ':') ||
-                    (c == '=') || (c == '?')))
-                        ia5 = 1;
-                if (c & 0x80)
-                        t61 = 1;
-        }
-        if (t61)
-                return (V_ASN1_T61STRING);
-        if (ia5)
-                return (V_ASN1_IA5STRING);
-        return (V_ASN1_PRINTABLESTRING);
-}
-
-int
-ASN1_UNIVERSALSTRING_to_string(ASN1_UNIVERSALSTRING *s)
-{
-        int i;
-        unsigned char *p;
-
-        if (s->type != V_ASN1_UNIVERSALSTRING)
-                return (0);
-        if ((s->length % 4) != 0)
-                return (0);
-        p = s->data;
-        for (i = 0; i < s->length; i += 4) {
-                if ((p[0] != '\0') || (p[1] != '\0') || (p[2] != '\0'))
-                        break;
-                else
-                        p += 4;
-        }
-        if (i < s->length)
-                return (0);
-        p = s->data;
-        for (i = 3; i < s->length; i += 4) {
-                *(p++) = s->data[i];
-        }
-        *(p) = '\0';
-        s->length /= 4;
-        s->type = ASN1_PRINTABLE_type(s->data, s->length);
-        return (1);
-}
diff --git a/src/lib/libcrypto/asn1/a_set.c b/src/lib/libcrypto/asn1/a_set.c
deleted file mode 100644
index 63d55c3714..0000000000
--- a/src/lib/libcrypto/asn1/a_set.c
+++ /dev/null
@@ -1,237 +0,0 @@
-/* $OpenBSD: a_set.c,v 1.17 2015/03/19 14:00:22 tedu Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-#include <string.h>
-
-#include <openssl/asn1_mac.h>
-#include <openssl/err.h>
-
-#ifndef NO_ASN1_OLD
-
-typedef struct {
-        unsigned char *pbData;
-        int cbData;
-} MYBLOB;
-
-/* SetBlobCmp
- * This function compares two elements of SET_OF block
- */
-static int
-SetBlobCmp(const void *elem1, const void *elem2)
-{
-        const MYBLOB *b1 = (const MYBLOB *)elem1;
-        const MYBLOB *b2 = (const MYBLOB *)elem2;
-        int r;
-
-        r = memcmp(b1->pbData, b2->pbData,
-            b1->cbData < b2->cbData ? b1->cbData : b2->cbData);
-        if (r != 0)
-                return r;
-        return b1->cbData - b2->cbData;
-}
-
-/* int is_set:  if TRUE, then sort the contents (i.e. it isn't a SEQUENCE) */
-int
-i2d_ASN1_SET(STACK_OF(OPENSSL_BLOCK) *a, unsigned char **pp, i2d_of_void *i2d,
-    int ex_tag, int ex_class, int is_set)
-{
-        int ret = 0, r;
-        int i;
-        unsigned char *p;
-        unsigned char *pStart, *pTempMem;
-        MYBLOB *rgSetBlob;
-        int totSize;
-
-        if (a == NULL)
-                return 0;
-        for (i = sk_OPENSSL_BLOCK_num(a) - 1; i >= 0; i--)
-                ret += i2d(sk_OPENSSL_BLOCK_value(a, i), NULL);
-        r = ASN1_object_size(1, ret, ex_tag);
-        if (pp == NULL)
-                return r;
-
-        p = *pp;
-        ASN1_put_object(&p, 1, ret, ex_tag, ex_class);
-
-        /* Modified by gp@nsj.co.jp */
-        /* And then again by Ben */
-        /* And again by Steve */
-
-        if (!is_set || (sk_OPENSSL_BLOCK_num(a) < 2)) {
-                for (i = 0; i < sk_OPENSSL_BLOCK_num(a); i++)
-                        i2d(sk_OPENSSL_BLOCK_value(a, i), &p);
-
-                *pp = p;
-                return r;
-        }
-
-        pStart  = p;    /* Catch the beg of Setblobs*/
-        /* In this array we will store the SET blobs */
-        rgSetBlob = reallocarray(NULL, sk_OPENSSL_BLOCK_num(a), sizeof(MYBLOB));
-        if (rgSetBlob == NULL) {
-                ASN1err(ASN1_F_I2D_ASN1_SET, ERR_R_MALLOC_FAILURE);
-                return 0;
-        }
-
-        for (i = 0; i < sk_OPENSSL_BLOCK_num(a); i++) {
-                rgSetBlob[i].pbData = p;        /* catch each set encode blob */
-                i2d(sk_OPENSSL_BLOCK_value(a, i), &p);
-                /* Length of this SetBlob */
-                rgSetBlob[i].cbData = p - rgSetBlob[i].pbData;
-        }
-        *pp = p;
-        totSize = p - pStart;   /* This is the total size of all set blobs */
-
-        /* Now we have to sort the blobs. I am using a simple algo.
-         * Sort ptrs
-         * Copy to temp-mem
-         * Copy from temp-mem to user-mem
-         */
-        qsort(rgSetBlob, sk_OPENSSL_BLOCK_num(a), sizeof(MYBLOB), SetBlobCmp);
-        if ((pTempMem = malloc(totSize)) == NULL) {
-                free(rgSetBlob);
-                ASN1err(ASN1_F_I2D_ASN1_SET, ERR_R_MALLOC_FAILURE);
-                return 0;
-        }
-
-        /* Copy to temp mem */
-        p = pTempMem;
-        for (i = 0; i < sk_OPENSSL_BLOCK_num(a); ++i) {
-                memcpy(p, rgSetBlob[i].pbData, rgSetBlob[i].cbData);
-                p += rgSetBlob[i].cbData;
-        }
-
-        /* Copy back to user mem*/
-        memcpy(pStart, pTempMem, totSize);
-        free(pTempMem);
-        free(rgSetBlob);
-
-        return r;
-}
-
-STACK_OF(OPENSSL_BLOCK) *
-d2i_ASN1_SET(STACK_OF(OPENSSL_BLOCK) **a, const unsigned char **pp, long length,
-    d2i_of_void *d2i, void (*free_func)(OPENSSL_BLOCK), int ex_tag,
-    int ex_class)
-{
-        ASN1_const_CTX c;
-        STACK_OF(OPENSSL_BLOCK) *ret = NULL;
-
-        if (a == NULL || (*a) == NULL) {
-                if ((ret = sk_OPENSSL_BLOCK_new_null()) == NULL) {
-                        ASN1err(ASN1_F_D2I_ASN1_SET, ERR_R_MALLOC_FAILURE);
-                        goto err;
-                }
-        } else
-                ret = *a;
-
-        c.p = *pp;
-        c.max = (length == 0) ? 0 : (c.p + length);
-
-        c.inf = ASN1_get_object(&c.p, &c.slen, &c.tag, &c.xclass, c.max - c.p);
-        if (c.inf & 0x80)
-                goto err;
-        if (ex_class != c.xclass) {
-                ASN1err(ASN1_F_D2I_ASN1_SET, ASN1_R_BAD_CLASS);
-                goto err;
-        }
-        if (ex_tag != c.tag) {
-                ASN1err(ASN1_F_D2I_ASN1_SET, ASN1_R_BAD_TAG);
-                goto err;
-        }
-        if (c.slen + c.p > c.max) {
-                ASN1err(ASN1_F_D2I_ASN1_SET, ASN1_R_LENGTH_ERROR);
-                goto err;
-        }
-        /* check for infinite constructed - it can be as long
-         * as the amount of data passed to us */
-        if (c.inf == (V_ASN1_CONSTRUCTED + 1))
-                c.slen = length + *pp - c.p;
-        c.max = c.p + c.slen;
-
-        while (c.p < c.max) {
-                char *s;
-
-                if (M_ASN1_D2I_end_sequence())
-                        break;
-                if ((s = d2i(NULL, &c.p, c.slen)) == NULL) {
-                        ASN1err(ASN1_F_D2I_ASN1_SET,
-                            ASN1_R_ERROR_PARSING_SET_ELEMENT);
-                        asn1_add_error(*pp, (int)(c.p - *pp));
-                        goto err;
-                }
-                if (!sk_OPENSSL_BLOCK_push(ret, s))
-                        goto err;
-        }
-        if (a != NULL)
-                *a = ret;
-        *pp = c.p;
-        return ret;
-
-err:
-        if (a == NULL || *a != ret) {
-                if (free_func != NULL)
-                        sk_OPENSSL_BLOCK_pop_free(ret, free_func);
-                else
-                        sk_OPENSSL_BLOCK_free(ret);
-        }
-        return NULL;
-}
-
-#endif
diff --git a/src/lib/libcrypto/asn1/a_sign.c b/src/lib/libcrypto/asn1/a_sign.c
deleted file mode 100644
index d9385312a7..0000000000
--- a/src/lib/libcrypto/asn1/a_sign.c
+++ /dev/null
@@ -1,240 +0,0 @@
-/* $OpenBSD: a_sign.c,v 1.20 2015/07/19 18:29:31 miod Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-/* ====================================================================
- * Copyright (c) 1998-2003 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    openssl-core@openssl.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <sys/types.h>
-
-#include <stdio.h>
-#include <time.h>
-
-#include <openssl/bn.h>
-#include <openssl/buffer.h>
-#include <openssl/err.h>
-#include <openssl/evp.h>
-#include <openssl/objects.h>
-#include <openssl/x509.h>
-
-#include "asn1_locl.h"
-
-int
-ASN1_item_sign(const ASN1_ITEM *it, X509_ALGOR *algor1, X509_ALGOR *algor2,
-    ASN1_BIT_STRING *signature, void *asn, EVP_PKEY *pkey, const EVP_MD *type)
-{
-        EVP_MD_CTX ctx;
-        EVP_MD_CTX_init(&ctx);
-        if (!EVP_DigestSignInit(&ctx, NULL, type, NULL, pkey)) {
-                EVP_MD_CTX_cleanup(&ctx);
-                return 0;
-        }
-        return ASN1_item_sign_ctx(it, algor1, algor2, signature, asn, &ctx);
-}
-
-
-int
-ASN1_item_sign_ctx(const ASN1_ITEM *it, X509_ALGOR *algor1, X509_ALGOR *algor2,
-    ASN1_BIT_STRING *signature, void *asn, EVP_MD_CTX *ctx)
-{
-        const EVP_MD *type;
-        EVP_PKEY *pkey;
-        unsigned char *buf_in = NULL, *buf_out = NULL;
-        size_t inl = 0, outl = 0, outll = 0;
-        int signid, paramtype;
-        int rv;
-
-        type = EVP_MD_CTX_md(ctx);
-        pkey = EVP_PKEY_CTX_get0_pkey(ctx->pctx);
-
-        if (!type || !pkey) {
-                ASN1err(ASN1_F_ASN1_ITEM_SIGN_CTX,
-                    ASN1_R_CONTEXT_NOT_INITIALISED);
-                return 0;
-        }
-
-        if (pkey->ameth->item_sign) {
-                rv = pkey->ameth->item_sign(ctx, it, asn, algor1, algor2,
-                    signature);
-                if (rv == 1)
-                        outl = signature->length;
-                /* Return value meanings:
-                 * <=0: error.
-                 *   1: method does everything.
-                 *   2: carry on as normal.
-                 *   3: ASN1 method sets algorithm identifiers: just sign.
-                 */
-                if (rv <= 0)
-                        ASN1err(ASN1_F_ASN1_ITEM_SIGN_CTX, ERR_R_EVP_LIB);
-                if (rv <= 1)
-                        goto err;
-        } else
-                rv = 2;
-
-        if (rv == 2) {
-                if (type->flags & EVP_MD_FLAG_PKEY_METHOD_SIGNATURE) {
-                        if (!pkey->ameth ||
-                            !OBJ_find_sigid_by_algs(&signid,
-                                EVP_MD_nid(type), pkey->ameth->pkey_id)) {
-                                ASN1err(ASN1_F_ASN1_ITEM_SIGN_CTX,
-                                    ASN1_R_DIGEST_AND_KEY_TYPE_NOT_SUPPORTED);
-                                return 0;
-                        }
-                } else
-                        signid = type->pkey_type;
-
-                if (pkey->ameth->pkey_flags & ASN1_PKEY_SIGPARAM_NULL)
-                        paramtype = V_ASN1_NULL;
-                else
-                        paramtype = V_ASN1_UNDEF;
-
-                if (algor1)
-                        X509_ALGOR_set0(algor1,
-                            OBJ_nid2obj(signid), paramtype, NULL);
-                if (algor2)
-                        X509_ALGOR_set0(algor2,
-                            OBJ_nid2obj(signid), paramtype, NULL);
-
-        }
-
-        inl = ASN1_item_i2d(asn, &buf_in, it);
-        outll = outl = EVP_PKEY_size(pkey);
-        buf_out = malloc(outl);
-        if ((buf_in == NULL) || (buf_out == NULL)) {
-                outl = 0;
-                ASN1err(ASN1_F_ASN1_ITEM_SIGN_CTX, ERR_R_MALLOC_FAILURE);
-                goto err;
-        }
-
-        if (!EVP_DigestSignUpdate(ctx, buf_in, inl) ||
-            !EVP_DigestSignFinal(ctx, buf_out, &outl)) {
-                outl = 0;
-                ASN1err(ASN1_F_ASN1_ITEM_SIGN_CTX, ERR_R_EVP_LIB);
-                goto err;
-        }
-        free(signature->data);
-        signature->data = buf_out;
-        buf_out = NULL;
-        signature->length = outl;
-        /* In the interests of compatibility, I'll make sure that
-         * the bit string has a 'not-used bits' value of 0
-         */
-        signature->flags &= ~(ASN1_STRING_FLAG_BITS_LEFT|0x07);
-        signature->flags |= ASN1_STRING_FLAG_BITS_LEFT;
-
-err:
-        EVP_MD_CTX_cleanup(ctx);
-        if (buf_in != NULL) {
-                OPENSSL_cleanse((char *)buf_in, inl);
-                free(buf_in);
-        }
-        if (buf_out != NULL) {
-                OPENSSL_cleanse((char *)buf_out, outll);
-                free(buf_out);
-        }
-        return (outl);
-}
diff --git a/src/lib/libcrypto/asn1/a_strex.c b/src/lib/libcrypto/asn1/a_strex.c
deleted file mode 100644
index f60a70d94d..0000000000
--- a/src/lib/libcrypto/asn1/a_strex.c
+++ /dev/null
@@ -1,646 +0,0 @@
-/* $OpenBSD: a_strex.c,v 1.25 2015/02/07 13:19:15 doug Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 2000.
- */
-/* ====================================================================
- * Copyright (c) 2000 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <stdio.h>
-#include <string.h>
-
-#include <openssl/asn1.h>
-#include <openssl/crypto.h>
-#include <openssl/x509.h>
-
-#include "asn1_locl.h"
-
-#include "charmap.h"
-
-/* ASN1_STRING_print_ex() and X509_NAME_print_ex().
- * Enhanced string and name printing routines handling
- * multibyte characters, RFC2253 and a host of other
- * options.
- */
-
-#define CHARTYPE_BS_ESC         (ASN1_STRFLGS_ESC_2253 | CHARTYPE_FIRST_ESC_2253 | CHARTYPE_LAST_ESC_2253)
-
-#define ESC_FLAGS (ASN1_STRFLGS_ESC_2253 | \
-                  ASN1_STRFLGS_ESC_QUOTE | \
-                  ASN1_STRFLGS_ESC_CTRL | \
-                  ASN1_STRFLGS_ESC_MSB)
-
-
-/* Three IO functions for sending data to memory, a BIO and
- * and a FILE pointer.
- */
-static int
-send_bio_chars(void *arg, const void *buf, int len)
-{
-        if (!arg)
-                return 1;
-        if (BIO_write(arg, buf, len) != len)
-                return 0;
-        return 1;
-}
-
-static int
-send_fp_chars(void *arg, const void *buf, int len)
-{
-        if (!arg)
-                return 1;
-        if (fwrite(buf, 1, (size_t)len, arg) != (size_t)len)
-                return 0;
-        return 1;
-}
-
-typedef int char_io(void *arg, const void *buf, int len);
-
-/* This function handles display of
- * strings, one character at a time.
- * It is passed an unsigned long for each
- * character because it could come from 2 or even
- * 4 byte forms.
- */
-
-static int
-do_esc_char(unsigned long c, unsigned char flags, char *do_quotes,
-    char_io *io_ch, void *arg)
-{
-        unsigned char chflgs, chtmp;
-        char tmphex[sizeof(long) * 2 + 3];
-
-        if (c > 0xffffffffL)
-                return -1;
-        if (c > 0xffff) {
-                snprintf(tmphex, sizeof tmphex, "\\W%08lX", c);
-                if (!io_ch(arg, tmphex, 10))
-                        return -1;
-                return 10;
-        }
-        if (c > 0xff) {
-                snprintf(tmphex, sizeof tmphex, "\\U%04lX", c);
-                if (!io_ch(arg, tmphex, 6))
-                        return -1;
-                return 6;
-        }
-        chtmp = (unsigned char)c;
-        if (chtmp > 0x7f)
-                chflgs = flags & ASN1_STRFLGS_ESC_MSB;
-        else
-                chflgs = char_type[chtmp] & flags;
-        if (chflgs & CHARTYPE_BS_ESC) {
-                /* If we don't escape with quotes, signal we need quotes */
-                if (chflgs & ASN1_STRFLGS_ESC_QUOTE) {
-                        if (do_quotes)
-                                *do_quotes = 1;
-                        if (!io_ch(arg, &chtmp, 1))
-                                return -1;
-                        return 1;
-                }
-                if (!io_ch(arg, "\\", 1))
-                        return -1;
-                if (!io_ch(arg, &chtmp, 1))
-                        return -1;
-                return 2;
-        }
-        if (chflgs & (ASN1_STRFLGS_ESC_CTRL|ASN1_STRFLGS_ESC_MSB)) {
-                snprintf(tmphex, sizeof tmphex, "\\%02X", chtmp);
-                if (!io_ch(arg, tmphex, 3))
-                        return -1;
-                return 3;
-        }
-        /* If we get this far and do any escaping at all must escape
-         * the escape character itself: backslash.
-         */
-        if (chtmp == '\\' && flags & ESC_FLAGS) {
-                if (!io_ch(arg, "\\\\", 2))
-                        return -1;
-                return 2;
-        }
-        if (!io_ch(arg, &chtmp, 1))
-                return -1;
-        return 1;
-}
-
-#define BUF_TYPE_WIDTH_MASK     0x7
-#define BUF_TYPE_CONVUTF8       0x8
-
-/* This function sends each character in a buffer to
- * do_esc_char(). It interprets the content formats
- * and converts to or from UTF8 as appropriate.
- */
-
-static int
-do_buf(unsigned char *buf, int buflen, int type, unsigned char flags,
-    char *quotes, char_io *io_ch, void *arg)
-{
-        int i, outlen, len;
-        unsigned char orflags, *p, *q;
-        unsigned long c;
-
-        p = buf;
-        q = buf + buflen;
-        outlen = 0;
-        while (p != q) {
-                if (p == buf && flags & ASN1_STRFLGS_ESC_2253)
-                        orflags = CHARTYPE_FIRST_ESC_2253;
-                else
-                        orflags = 0;
-                switch (type & BUF_TYPE_WIDTH_MASK) {
-                case 4:
-                        c = ((unsigned long)*p++) << 24;
-                        c |= ((unsigned long)*p++) << 16;
-                        c |= ((unsigned long)*p++) << 8;
-                        c |= *p++;
-                        if (c > UNICODE_MAX || UNICODE_IS_SURROGATE(c))
-                                return -1;
-                        break;
-
-                case 2:
-                        c = ((unsigned long)*p++) << 8;
-                        c |= *p++;
-                        if (UNICODE_IS_SURROGATE(c))
-                                return -1;
-                        break;
-
-                case 1:
-                        c = *p++;
-                        break;
-
-                case 0:
-                        i = UTF8_getc(p, q - p, &c);
-                        if (i < 0)
-                                return -1;      /* Invalid UTF8String */
-                        p += i;
-                        break;
-                default:
-                        return -1;              /* invalid width */
-                }
-                if (p == q && flags & ASN1_STRFLGS_ESC_2253)
-                        orflags = CHARTYPE_LAST_ESC_2253;
-                if (type & BUF_TYPE_CONVUTF8) {
-                        unsigned char utfbuf[6];
-                        int utflen;
-
-                        utflen = UTF8_putc(utfbuf, sizeof utfbuf, c);
-                        if (utflen < 0)
-                                return -1;
-                        for (i = 0; i < utflen; i++) {
-                                /* We don't need to worry about setting orflags correctly
-                                 * because if utflen==1 its value will be correct anyway
-                                 * otherwise each character will be > 0x7f and so the
-                                 * character will never be escaped on first and last.
-                                 */
-                                len = do_esc_char(utfbuf[i],
-                                    (unsigned char)(flags | orflags), quotes,
-                                    io_ch, arg);
-                                if (len < 0)
-                                        return -1;
-                                outlen += len;
-                        }
-                } else {
-                        len = do_esc_char(c, (unsigned char)(flags | orflags),
-                            quotes, io_ch, arg);
-                        if (len < 0)
-                                return -1;
-                        outlen += len;
-                }
-        }
-        return outlen;
-}
-
-/* This function hex dumps a buffer of characters */
-
-static int
-do_hex_dump(char_io *io_ch, void *arg, unsigned char *buf, int buflen)
-{
-        static const char hexdig[] = "0123456789ABCDEF";
-        unsigned char *p, *q;
-        char hextmp[2];
-        if (arg) {
-                p = buf;
-                q = buf + buflen;
-                while (p != q) {
-                        hextmp[0] = hexdig[*p >> 4];
-                        hextmp[1] = hexdig[*p & 0xf];
-                        if (!io_ch(arg, hextmp, 2))
-                                return -1;
-                        p++;
-                }
-        }
-        return buflen << 1;
-}
-
-/* "dump" a string. This is done when the type is unknown,
- * or the flags request it. We can either dump the content
- * octets or the entire DER encoding. This uses the RFC2253
- * #01234 format.
- */
-
-static int
-do_dump(unsigned long lflags, char_io *io_ch, void *arg, ASN1_STRING *str)
-{
-        /* Placing the ASN1_STRING in a temp ASN1_TYPE allows
-         * the DER encoding to readily obtained
-         */
-        ASN1_TYPE t;
-        unsigned char *der_buf, *p;
-        int outlen, der_len;
-
-        if (!io_ch(arg, "#", 1))
-                return -1;
-        /* If we don't dump DER encoding just dump content octets */
-        if (!(lflags & ASN1_STRFLGS_DUMP_DER)) {
-                outlen = do_hex_dump(io_ch, arg, str->data, str->length);
-                if (outlen < 0)
-                        return -1;
-                return outlen + 1;
-        }
-        t.type = str->type;
-        t.value.ptr = (char *)str;
-        der_len = i2d_ASN1_TYPE(&t, NULL);
-        der_buf = malloc(der_len);
-        if (!der_buf)
-                return -1;
-        p = der_buf;
-        i2d_ASN1_TYPE(&t, &p);
-        outlen = do_hex_dump(io_ch, arg, der_buf, der_len);
-        free(der_buf);
-        if (outlen < 0)
-                return -1;
-        return outlen + 1;
-}
-
-/* Lookup table to convert tags to character widths,
- * 0 = UTF8 encoded, -1 is used for non string types
- * otherwise it is the number of bytes per character
- */
-
-static const signed char tag2nbyte[] = {
-        -1, -1, -1, -1, -1,     /* 0-4 */
-        -1, -1, -1, -1, -1,     /* 5-9 */
-        -1, -1, 0, -1,          /* 10-13 */
-        -1, -1, -1, -1,         /* 15-17 */
-        -1, 1, 1,               /* 18-20 */
-        -1, 1, 1, 1,            /* 21-24 */
-        -1, 1, -1,              /* 25-27 */
-        4, -1, 2                /* 28-30 */
-};
-
-/* This is the main function, print out an
- * ASN1_STRING taking note of various escape
- * and display options. Returns number of
- * characters written or -1 if an error
- * occurred.
- */
-
-static int
-do_print_ex(char_io *io_ch, void *arg, unsigned long lflags, ASN1_STRING *str)
-{
-        int outlen, len;
-        int type;
-        char quotes;
-        unsigned char flags;
-
-        quotes = 0;
-        /* Keep a copy of escape flags */
-        flags = (unsigned char)(lflags & ESC_FLAGS);
-        type = str->type;
-        outlen = 0;
-
-        if (lflags & ASN1_STRFLGS_SHOW_TYPE) {
-                const char *tagname;
-                tagname = ASN1_tag2str(type);
-                outlen += strlen(tagname);
-                if (!io_ch(arg, tagname, outlen) || !io_ch(arg, ":", 1))
-                        return -1;
-                outlen++;
-        }
-
-        /* Decide what to do with type, either dump content or display it */
-
-        /* Dump everything */
-        if (lflags & ASN1_STRFLGS_DUMP_ALL)
-                type = -1;
-        /* Ignore the string type */
-        else if (lflags & ASN1_STRFLGS_IGNORE_TYPE)
-                type = 1;
-        else {
-                /* Else determine width based on type */
-                if ((type > 0) && (type < 31))
-                        type = tag2nbyte[type];
-                else
-                        type = -1;
-                if ((type == -1) && !(lflags & ASN1_STRFLGS_DUMP_UNKNOWN))
-                        type = 1;
-        }
-
-        if (type == -1) {
-                len = do_dump(lflags, io_ch, arg, str);
-                if (len < 0)
-                        return -1;
-                outlen += len;
-                return outlen;
-        }
-
-        if (lflags & ASN1_STRFLGS_UTF8_CONVERT) {
-                /* Note: if string is UTF8 and we want
-                 * to convert to UTF8 then we just interpret
-                 * it as 1 byte per character to avoid converting
-                 * twice.
-                 */
-                if (!type)
-                        type = 1;
-                else
-                        type |= BUF_TYPE_CONVUTF8;
-        }
-
-        len = do_buf(str->data, str->length, type, flags, &quotes, io_ch, NULL);
-        if (len < 0)
-                return -1;
-        outlen += len;
-        if (quotes)
-                outlen += 2;
-        if (!arg)
-                return outlen;
-        if (quotes && !io_ch(arg, "\"", 1))
-                return -1;
-        if (do_buf(str->data, str->length, type, flags, NULL, io_ch, arg) < 0)
-                return -1;
-        if (quotes && !io_ch(arg, "\"", 1))
-                return -1;
-        return outlen;
-}
-
-/* Used for line indenting: print 'indent' spaces */
-
-static int
-do_indent(char_io *io_ch, void *arg, int indent)
-{
-        int i;
-        for (i = 0; i < indent; i++)
-                if (!io_ch(arg, " ", 1))
-                        return 0;
-        return 1;
-}
-
-#define FN_WIDTH_LN     25
-#define FN_WIDTH_SN     10
-
-static int
-do_name_ex(char_io *io_ch, void *arg, X509_NAME *n, int indent,
-    unsigned long flags)
-{
-        int i, prev = -1, orflags, cnt;
-        int fn_opt, fn_nid;
-        ASN1_OBJECT *fn;
-        ASN1_STRING *val;
-        X509_NAME_ENTRY *ent;
-        char objtmp[80];
-        const char *objbuf;
-        int outlen, len;
-        char *sep_dn, *sep_mv, *sep_eq;
-        int sep_dn_len, sep_mv_len, sep_eq_len;
-
-        if (indent < 0)
-                indent = 0;
-        outlen = indent;
-        if (!do_indent(io_ch, arg, indent))
-                return -1;
-
-        switch (flags & XN_FLAG_SEP_MASK) {
-        case XN_FLAG_SEP_MULTILINE:
-                sep_dn = "\n";
-                sep_dn_len = 1;
-                sep_mv = " + ";
-                sep_mv_len = 3;
-                break;
-
-        case XN_FLAG_SEP_COMMA_PLUS:
-                sep_dn = ",";
-                sep_dn_len = 1;
-                sep_mv = "+";
-                sep_mv_len = 1;
-                indent = 0;
-                break;
-
-        case XN_FLAG_SEP_CPLUS_SPC:
-                sep_dn = ", ";
-                sep_dn_len = 2;
-                sep_mv = " + ";
-                sep_mv_len = 3;
-                indent = 0;
-                break;
-
-        case XN_FLAG_SEP_SPLUS_SPC:
-                sep_dn = "; ";
-                sep_dn_len = 2;
-                sep_mv = " + ";
-                sep_mv_len = 3;
-                indent = 0;
-                break;
-
-        default:
-                return -1;
-        }
-
-        if (flags & XN_FLAG_SPC_EQ) {
-                sep_eq = " = ";
-                sep_eq_len = 3;
-        } else {
-                sep_eq = "=";
-                sep_eq_len = 1;
-        }
-
-        fn_opt = flags & XN_FLAG_FN_MASK;
-
-        cnt = X509_NAME_entry_count(n);
-        for (i = 0; i < cnt; i++) {
-                if (flags & XN_FLAG_DN_REV)
-                        ent = X509_NAME_get_entry(n, cnt - i - 1);
-                else
-                        ent = X509_NAME_get_entry(n, i);
-                if (prev != -1) {
-                        if (prev == ent->set) {
-                                if (!io_ch(arg, sep_mv, sep_mv_len))
-                                        return -1;
-                                outlen += sep_mv_len;
-                        } else {
-                                if (!io_ch(arg, sep_dn, sep_dn_len))
-                                        return -1;
-                                outlen += sep_dn_len;
-                                if (!do_indent(io_ch, arg, indent))
-                                        return -1;
-                                outlen += indent;
-                        }
-                }
-                prev = ent->set;
-                fn = X509_NAME_ENTRY_get_object(ent);
-                val = X509_NAME_ENTRY_get_data(ent);
-                fn_nid = OBJ_obj2nid(fn);
-                if (fn_opt != XN_FLAG_FN_NONE) {
-                        int objlen, fld_len;
-                        if ((fn_opt == XN_FLAG_FN_OID) ||
-                            (fn_nid == NID_undef)) {
-                                OBJ_obj2txt(objtmp, sizeof objtmp, fn, 1);
-                                fld_len = 0; /* XXX: what should this be? */
-                                objbuf = objtmp;
-                        } else {
-                                if (fn_opt == XN_FLAG_FN_SN) {
-                                        fld_len = FN_WIDTH_SN;
-                                        objbuf = OBJ_nid2sn(fn_nid);
-                                } else if (fn_opt == XN_FLAG_FN_LN) {
-                                        fld_len = FN_WIDTH_LN;
-                                        objbuf = OBJ_nid2ln(fn_nid);
-                                } else {
-                                        fld_len = 0; /* XXX: what should this be? */
-                                        objbuf = "";
-                                }
-                        }
-                        objlen = strlen(objbuf);
-                        if (!io_ch(arg, objbuf, objlen))
-                                return -1;
-                        if ((objlen < fld_len) && (flags & XN_FLAG_FN_ALIGN)) {
-                                if (!do_indent(io_ch, arg, fld_len - objlen))
-                                        return -1;
-                                outlen += fld_len - objlen;
-                        }
-                        if (!io_ch(arg, sep_eq, sep_eq_len))
-                                return -1;
-                        outlen += objlen + sep_eq_len;
-                }
-                /* If the field name is unknown then fix up the DER dump
-                 * flag. We might want to limit this further so it will
-                 * DER dump on anything other than a few 'standard' fields.
-                 */
-                if ((fn_nid == NID_undef) &&
-                    (flags & XN_FLAG_DUMP_UNKNOWN_FIELDS))
-                        orflags = ASN1_STRFLGS_DUMP_ALL;
-                else
-                        orflags = 0;
-
-                len = do_print_ex(io_ch, arg, flags | orflags, val);
-                if (len < 0)
-                        return -1;
-                outlen += len;
-        }
-        return outlen;
-}
-
-/* Wrappers round the main functions */
-
-int
-X509_NAME_print_ex(BIO *out, X509_NAME *nm, int indent, unsigned long flags)
-{
-        if (flags == XN_FLAG_COMPAT)
-                return X509_NAME_print(out, nm, indent);
-        return do_name_ex(send_bio_chars, out, nm, indent, flags);
-}
-
-int
-X509_NAME_print_ex_fp(FILE *fp, X509_NAME *nm, int indent, unsigned long flags)
-{
-        if (flags == XN_FLAG_COMPAT) {
-                BIO *btmp;
-                int ret;
-                btmp = BIO_new_fp(fp, BIO_NOCLOSE);
-                if (!btmp)
-                        return -1;
-                ret = X509_NAME_print(btmp, nm, indent);
-                BIO_free(btmp);
-                return ret;
-        }
-        return do_name_ex(send_fp_chars, fp, nm, indent, flags);
-}
-
-int
-ASN1_STRING_print_ex(BIO *out, ASN1_STRING *str, unsigned long flags)
-{
-        return do_print_ex(send_bio_chars, out, flags, str);
-}
-
-int
-ASN1_STRING_print_ex_fp(FILE *fp, ASN1_STRING *str, unsigned long flags)
-{
-        return do_print_ex(send_fp_chars, fp, flags, str);
-}
-
-/* Utility function: convert any string type to UTF8, returns number of bytes
- * in output string or a negative error code
- */
-
-int
-ASN1_STRING_to_UTF8(unsigned char **out, ASN1_STRING *in)
-{
-        ASN1_STRING stmp, *str = &stmp;
-        int mbflag, type, ret;
-
-        if (!in)
-                return -1;
-        type = in->type;
-        if ((type < 0) || (type > 30))
-                return -1;
-        mbflag = tag2nbyte[type];
-        if (mbflag == -1)
-                return -1;
-        mbflag |= MBSTRING_FLAG;
-        stmp.data = NULL;
-        stmp.length = 0;
-        ret = ASN1_mbstring_copy(&str, in->data, in->length, mbflag,
-            B_ASN1_UTF8STRING);
-        if (ret < 0)
-                return ret;
-        *out = stmp.data;
-        return stmp.length;
-}
diff --git a/src/lib/libcrypto/asn1/a_strnid.c b/src/lib/libcrypto/asn1/a_strnid.c
deleted file mode 100644
index 0744ffb228..0000000000
--- a/src/lib/libcrypto/asn1/a_strnid.c
+++ /dev/null
@@ -1,292 +0,0 @@
-/* $OpenBSD: a_strnid.c,v 1.19 2015/02/10 11:22:21 jsing Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 1999.
- */
-/* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <ctype.h>
-#include <stdio.h>
-#include <string.h>
-
-#include <openssl/asn1.h>
-#include <openssl/err.h>
-#include <openssl/objects.h>
-
-static STACK_OF(ASN1_STRING_TABLE) *stable = NULL;
-static void st_free(ASN1_STRING_TABLE *tbl);
-static int sk_table_cmp(const ASN1_STRING_TABLE * const *a,
-    const ASN1_STRING_TABLE * const *b);
-
-
-/* This is the global mask for the mbstring functions: this is use to
- * mask out certain types (such as BMPString and UTF8String) because
- * certain software (e.g. Netscape) has problems with them.
- */
-
-static unsigned long global_mask = B_ASN1_UTF8STRING;
-
-void
-ASN1_STRING_set_default_mask(unsigned long mask)
-{
-        global_mask = mask;
-}
-
-unsigned long
-ASN1_STRING_get_default_mask(void)
-{
-        return global_mask;
-}
-
-/* This function sets the default to various "flavours" of configuration.
- * based on an ASCII string. Currently this is:
- * MASK:XXXX : a numerical mask value.
- * nobmp : Don't use BMPStrings (just Printable, T61).
- * pkix : PKIX recommendation in RFC2459.
- * utf8only : only use UTF8Strings (RFC2459 recommendation for 2004).
- * default:   the default value, Printable, T61, BMP.
- */
-
-int
-ASN1_STRING_set_default_mask_asc(const char *p)
-{
-        unsigned long mask;
-        char *end;
-
-        if (!strncmp(p, "MASK:", 5)) {
-                if (!p[5])
-                        return 0;
-                mask = strtoul(p + 5, &end, 0);
-                if (*end)
-                        return 0;
-        } else if (!strcmp(p, "nombstr"))
-                mask = ~((unsigned long)(B_ASN1_BMPSTRING|B_ASN1_UTF8STRING));
-        else if (!strcmp(p, "pkix"))
-                mask = ~((unsigned long)B_ASN1_T61STRING);
-        else if (!strcmp(p, "utf8only"))
-                mask = B_ASN1_UTF8STRING;
-        else if (!strcmp(p, "default"))
-                mask = 0xFFFFFFFFL;
-        else
-                return 0;
-        ASN1_STRING_set_default_mask(mask);
-        return 1;
-}
-
-/* The following function generates an ASN1_STRING based on limits in a table.
- * Frequently the types and length of an ASN1_STRING are restricted by a
- * corresponding OID. For example certificates and certificate requests.
- */
-
-ASN1_STRING *
-ASN1_STRING_set_by_NID(ASN1_STRING **out, const unsigned char *in, int inlen,
-    int inform, int nid)
-{
-        ASN1_STRING_TABLE *tbl;
-        ASN1_STRING *str = NULL;
-        unsigned long mask;
-        int ret;
-        if (!out)
-                out = &str;
-        tbl = ASN1_STRING_TABLE_get(nid);
-        if (tbl) {
-                mask = tbl->mask;
-                if (!(tbl->flags & STABLE_NO_MASK))
-                        mask &= global_mask;
-                ret = ASN1_mbstring_ncopy(out, in, inlen, inform, mask,
-                    tbl->minsize, tbl->maxsize);
-        } else
-                ret = ASN1_mbstring_copy(out, in, inlen, inform,
-                    DIRSTRING_TYPE & global_mask);
-        if (ret <= 0)
-                return NULL;
-        return *out;
-}
-
-/* Now the tables and helper functions for the string table:
- */
-
-/* size limits: this stuff is taken straight from RFC3280 */
-
-#define ub_name                         32768
-#define ub_common_name                  64
-#define ub_locality_name                128
-#define ub_state_name                   128
-#define ub_organization_name            64
-#define ub_organization_unit_name       64
-#define ub_title                        64
-#define ub_email_address                128
-#define ub_serial_number                64
-
-
-/* This table must be kept in NID order */
-
-static const ASN1_STRING_TABLE tbl_standard[] = {
-        {NID_commonName,                1, ub_common_name, DIRSTRING_TYPE, 0},
-        {NID_countryName,               2, 2, B_ASN1_PRINTABLESTRING, STABLE_NO_MASK},
-        {NID_localityName,              1, ub_locality_name, DIRSTRING_TYPE, 0},
-        {NID_stateOrProvinceName,       1, ub_state_name, DIRSTRING_TYPE, 0},
-        {NID_organizationName,          1, ub_organization_name, DIRSTRING_TYPE, 0},
-        {NID_organizationalUnitName,    1, ub_organization_unit_name, DIRSTRING_TYPE, 0},
-        {NID_pkcs9_emailAddress,        1, ub_email_address, B_ASN1_IA5STRING, STABLE_NO_MASK},
-        {NID_pkcs9_unstructuredName,    1, -1, PKCS9STRING_TYPE, 0},
-        {NID_pkcs9_challengePassword,   1, -1, PKCS9STRING_TYPE, 0},
-        {NID_pkcs9_unstructuredAddress, 1, -1, DIRSTRING_TYPE, 0},
-        {NID_givenName,                 1, ub_name, DIRSTRING_TYPE, 0},
-        {NID_surname,                   1, ub_name, DIRSTRING_TYPE, 0},
-        {NID_initials,                  1, ub_name, DIRSTRING_TYPE, 0},
-        {NID_serialNumber,              1, ub_serial_number, B_ASN1_PRINTABLESTRING, STABLE_NO_MASK},
-        {NID_friendlyName,              -1, -1, B_ASN1_BMPSTRING, STABLE_NO_MASK},
-        {NID_name,                      1, ub_name, DIRSTRING_TYPE, 0},
-        {NID_dnQualifier,               -1, -1, B_ASN1_PRINTABLESTRING, STABLE_NO_MASK},
-        {NID_domainComponent,           1, -1, B_ASN1_IA5STRING, STABLE_NO_MASK},
-        {NID_ms_csp_name,               -1, -1, B_ASN1_BMPSTRING, STABLE_NO_MASK}
-};
-
-static int
-sk_table_cmp(const ASN1_STRING_TABLE * const *a,
-    const ASN1_STRING_TABLE * const *b)
-{
-        return (*a)->nid - (*b)->nid;
-}
-
-DECLARE_OBJ_BSEARCH_CMP_FN(ASN1_STRING_TABLE, ASN1_STRING_TABLE, table);
-
-static int
-table_cmp(const ASN1_STRING_TABLE *a, const ASN1_STRING_TABLE *b)
-{
-        return a->nid - b->nid;
-}
-
-IMPLEMENT_OBJ_BSEARCH_CMP_FN(ASN1_STRING_TABLE, ASN1_STRING_TABLE, table);
-
-ASN1_STRING_TABLE *
-ASN1_STRING_TABLE_get(int nid)
-{
-        int idx;
-        ASN1_STRING_TABLE *ttmp;
-        ASN1_STRING_TABLE fnd;
-
-        fnd.nid = nid;
-        ttmp = OBJ_bsearch_table(&fnd, tbl_standard,
-            sizeof(tbl_standard)/sizeof(ASN1_STRING_TABLE));
-        if (ttmp)
-                return ttmp;
-        if (!stable)
-                return NULL;
-        idx = sk_ASN1_STRING_TABLE_find(stable, &fnd);
-        if (idx < 0)
-                return NULL;
-        return sk_ASN1_STRING_TABLE_value(stable, idx);
-}
-
-int
-ASN1_STRING_TABLE_add(int nid, long minsize, long maxsize, unsigned long mask,
-    unsigned long flags)
-{
-        ASN1_STRING_TABLE *tmp;
-        char new_nid = 0;
-
-        flags &= ~STABLE_FLAGS_MALLOC;
-        if (!stable)
-                stable = sk_ASN1_STRING_TABLE_new(sk_table_cmp);
-        if (!stable) {
-                ASN1err(ASN1_F_ASN1_STRING_TABLE_ADD, ERR_R_MALLOC_FAILURE);
-                return 0;
-        }
-        if (!(tmp = ASN1_STRING_TABLE_get(nid))) {
-                tmp = malloc(sizeof(ASN1_STRING_TABLE));
-                if (!tmp) {
-                        ASN1err(ASN1_F_ASN1_STRING_TABLE_ADD,
-                            ERR_R_MALLOC_FAILURE);
-                        return 0;
-                }
-                tmp->flags = flags | STABLE_FLAGS_MALLOC;
-                tmp->nid = nid;
-                new_nid = 1;
-        } else tmp->flags = (tmp->flags & STABLE_FLAGS_MALLOC) | flags;
-                if (minsize != -1)
-                tmp->minsize = minsize;
-        if (maxsize != -1)
-                tmp->maxsize = maxsize;
-        tmp->mask = mask;
-        if (new_nid) {
-                if (sk_ASN1_STRING_TABLE_push(stable, tmp) == 0) {
-                        free(tmp);
-                        ASN1err(ASN1_F_ASN1_STRING_TABLE_ADD,
-                            ERR_R_MALLOC_FAILURE);
-                        return 0;
-                }
-        }
-        return 1;
-}
-
-void
-ASN1_STRING_TABLE_cleanup(void)
-{
-        STACK_OF(ASN1_STRING_TABLE) *tmp;
-
-        tmp = stable;
-        if (!tmp)
-                return;
-        stable = NULL;
-        sk_ASN1_STRING_TABLE_pop_free(tmp, st_free);
-}
-
-static void
-st_free(ASN1_STRING_TABLE *tbl)
-{
-        if (tbl->flags & STABLE_FLAGS_MALLOC)
-                free(tbl);
-}
diff --git a/src/lib/libcrypto/asn1/a_time.c b/src/lib/libcrypto/asn1/a_time.c
deleted file mode 100644
index f51a8b1fbe..0000000000
--- a/src/lib/libcrypto/asn1/a_time.c
+++ /dev/null
@@ -1,225 +0,0 @@
-/* $OpenBSD: a_time.c,v 1.24 2015/07/24 13:49:58 jsing Exp $ */
-/* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-/* This is an implementation of the ASN1 Time structure which is:
- *    Time ::= CHOICE {
- *      utcTime        UTCTime,
- *      generalTime    GeneralizedTime }
- * written by Steve Henson.
- */
-
-#include <stdio.h>
-#include <string.h>
-#include <time.h>
-
-#include <openssl/asn1t.h>
-#include <openssl/err.h>
-
-#include "o_time.h"
-
-
-const ASN1_ITEM ASN1_TIME_it = {
-        .itype = ASN1_ITYPE_MSTRING,
-        .utype = B_ASN1_TIME,
-        .templates = NULL,
-        .tcount = 0,
-        .funcs = NULL,
-        .size = sizeof(ASN1_STRING),
-        .sname = "ASN1_TIME",
-};
-
-
-ASN1_TIME *
-d2i_ASN1_TIME(ASN1_TIME **a, const unsigned char **in, long len)
-{
-        return (ASN1_TIME *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &ASN1_TIME_it);
-}
-
-int
-i2d_ASN1_TIME(ASN1_TIME *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &ASN1_TIME_it);
-}
-
-ASN1_TIME *
-ASN1_TIME_new(void)
-{
-        return (ASN1_TIME *)ASN1_item_new(&ASN1_TIME_it);
-}
-
-void
-ASN1_TIME_free(ASN1_TIME *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &ASN1_TIME_it);
-}
-
-ASN1_TIME *
-ASN1_TIME_set(ASN1_TIME *s, time_t t)
-{
-        return ASN1_TIME_adj(s, t, 0, 0);
-}
-
-ASN1_TIME *
-ASN1_TIME_adj(ASN1_TIME *s, time_t t, int offset_day, long offset_sec)
-{
-        struct tm *ts;
-        struct tm data;
-
-        ts = gmtime_r(&t, &data);
-        if (ts == NULL) {
-                ASN1err(ASN1_F_ASN1_TIME_ADJ, ASN1_R_ERROR_GETTING_TIME);
-                return NULL;
-        }
-        if (offset_day || offset_sec) {
-                if (!OPENSSL_gmtime_adj(ts, offset_day, offset_sec))
-                        return NULL;
-        }
-        if ((ts->tm_year >= 50) && (ts->tm_year < 150))
-                return ASN1_UTCTIME_adj(s, t, offset_day, offset_sec);
-        return ASN1_GENERALIZEDTIME_adj(s, t, offset_day, offset_sec);
-}
-
-int
-ASN1_TIME_check(ASN1_TIME *t)
-{
-        if (t->type == V_ASN1_GENERALIZEDTIME)
-                return ASN1_GENERALIZEDTIME_check(t);
-        else if (t->type == V_ASN1_UTCTIME)
-                return ASN1_UTCTIME_check(t);
-        return 0;
-}
-
-/* Convert an ASN1_TIME structure to GeneralizedTime */
-static ASN1_GENERALIZEDTIME *
-ASN1_TIME_to_generalizedtime_internal(ASN1_TIME *t, ASN1_GENERALIZEDTIME **out)
-{
-        ASN1_GENERALIZEDTIME *ret;
-        char *str;
-        int newlen;
-        int i;
-
-        if (!ASN1_TIME_check(t))
-                return NULL;
-
-        ret = *out;
-
-        /* If already GeneralizedTime just copy across */
-        if (t->type == V_ASN1_GENERALIZEDTIME) {
-                if (!ASN1_STRING_set(ret, t->data, t->length))
-                        return NULL;
-                return ret;
-        }
-
-        /* grow the string */
-        if (!ASN1_STRING_set(ret, NULL, t->length + 2))
-                return NULL;
-        /* ASN1_STRING_set() allocated 'len + 1' bytes. */
-        newlen = t->length + 2 + 1;
-        str = (char *)ret->data;
-        /* XXX ASN1_TIME is not Y2050 compatible */
-        i = snprintf(str, newlen, "%s%s", (t->data[0] >= '5') ? "19" : "20",
-            (char *) t->data);
-        if (i == -1 || i >= newlen) {
-                M_ASN1_GENERALIZEDTIME_free(ret);
-                *out = NULL;
-                return NULL;
-        }
-        return ret;
-}
-
-ASN1_GENERALIZEDTIME *
-ASN1_TIME_to_generalizedtime(ASN1_TIME *t, ASN1_GENERALIZEDTIME **out)
-{
-        ASN1_GENERALIZEDTIME *tmp = NULL, *ret;
-
-        if (!out || !*out) {
-                if (!(tmp = ASN1_GENERALIZEDTIME_new()))
-                        return NULL;
-                if (out != NULL)
-                        *out = tmp;
-                else
-                        out = &tmp;
-        }
-
-        ret = ASN1_TIME_to_generalizedtime_internal(t, out);
-        if (ret == NULL && tmp != NULL)
-                ASN1_GENERALIZEDTIME_free(tmp);
-
-        return ret;
-}
-
-int
-ASN1_TIME_set_string(ASN1_TIME *s, const char *str)
-{
-        ASN1_TIME t;
-
-        t.length = strlen(str);
-        t.data = (unsigned char *)str;
-        t.flags = 0;
-
-        t.type = V_ASN1_UTCTIME;
-
-        if (!ASN1_TIME_check(&t)) {
-                t.type = V_ASN1_GENERALIZEDTIME;
-                if (!ASN1_TIME_check(&t))
-                        return 0;
-        }
-
-        if (s && !ASN1_STRING_copy((ASN1_STRING *)s, (ASN1_STRING *)&t))
-                return 0;
-
-        return 1;
-}
diff --git a/src/lib/libcrypto/asn1/a_type.c b/src/lib/libcrypto/asn1/a_type.c
deleted file mode 100644
index 38b3c65beb..0000000000
--- a/src/lib/libcrypto/asn1/a_type.c
+++ /dev/null
@@ -1,158 +0,0 @@
-/* $OpenBSD: a_type.c,v 1.16 2015/03/19 14:00:22 tedu Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-
-#include <openssl/asn1t.h>
-#include <openssl/objects.h>
-
-int
-ASN1_TYPE_get(ASN1_TYPE *a)
-{
-        if ((a->value.ptr != NULL) || (a->type == V_ASN1_NULL))
-                return (a->type);
-        else
-                return (0);
-}
-
-void
-ASN1_TYPE_set(ASN1_TYPE *a, int type, void *value)
-{
-        if (a->value.ptr != NULL) {
-                ASN1_TYPE **tmp_a = &a;
-                ASN1_primitive_free((ASN1_VALUE **)tmp_a, NULL);
-        }
-        a->type = type;
-        if (type == V_ASN1_BOOLEAN)
-                a->value.boolean = value ? 0xff : 0;
-        else
-                a->value.ptr = value;
-}
-
-int
-ASN1_TYPE_set1(ASN1_TYPE *a, int type, const void *value)
-{
-        if (!value || (type == V_ASN1_BOOLEAN)) {
-                void *p = (void *)value;
-                ASN1_TYPE_set(a, type, p);
-        } else if (type == V_ASN1_OBJECT) {
-                ASN1_OBJECT *odup;
-                odup = OBJ_dup(value);
-                if (!odup)
-                        return 0;
-                ASN1_TYPE_set(a, type, odup);
-        } else {
-                ASN1_STRING *sdup;
-                sdup = ASN1_STRING_dup(value);
-                if (!sdup)
-                        return 0;
-                ASN1_TYPE_set(a, type, sdup);
-        }
-        return 1;
-}
-
-/* Returns 0 if they are equal, != 0 otherwise. */
-int
-ASN1_TYPE_cmp(ASN1_TYPE *a, ASN1_TYPE *b)
-{
-        int result = -1;
-
-        if (!a || !b || a->type != b->type)
-                return -1;
-
-        switch (a->type) {
-        case V_ASN1_OBJECT:
-                result = OBJ_cmp(a->value.object, b->value.object);
-                break;
-        case V_ASN1_BOOLEAN:
-                result = a->value.boolean - b->value.boolean;
-                break;
-        case V_ASN1_NULL:
-                result = 0;     /* They do not have content. */
-                break;
-
-        case V_ASN1_INTEGER:
-        case V_ASN1_NEG_INTEGER:
-        case V_ASN1_ENUMERATED:
-        case V_ASN1_NEG_ENUMERATED:
-        case V_ASN1_BIT_STRING:
-        case V_ASN1_OCTET_STRING:
-        case V_ASN1_SEQUENCE:
-        case V_ASN1_SET:
-        case V_ASN1_NUMERICSTRING:
-        case V_ASN1_PRINTABLESTRING:
-        case V_ASN1_T61STRING:
-        case V_ASN1_VIDEOTEXSTRING:
-        case V_ASN1_IA5STRING:
-        case V_ASN1_UTCTIME:
-        case V_ASN1_GENERALIZEDTIME:
-        case V_ASN1_GRAPHICSTRING:
-        case V_ASN1_VISIBLESTRING:
-        case V_ASN1_GENERALSTRING:
-        case V_ASN1_UNIVERSALSTRING:
-        case V_ASN1_BMPSTRING:
-        case V_ASN1_UTF8STRING:
-        case V_ASN1_OTHER:
-        default:
-                result = ASN1_STRING_cmp((ASN1_STRING *)a->value.ptr,
-                    (ASN1_STRING *)b->value.ptr);
-                break;
-        }
-
-        return result;
-}
diff --git a/src/lib/libcrypto/asn1/a_utf8.c b/src/lib/libcrypto/asn1/a_utf8.c
deleted file mode 100644
index 113a3a2e36..0000000000
--- a/src/lib/libcrypto/asn1/a_utf8.c
+++ /dev/null
@@ -1,199 +0,0 @@
-/* $OpenBSD: a_utf8.c,v 1.8 2014/07/11 08:44:47 jsing Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-
-#include <openssl/asn1.h>
-
-#include "asn1_locl.h"
-
-/* UTF8 utilities */
-
-/*
- * This parses a UTF8 string one character at a time. It is passed a pointer
- * to the string and the length of the string. It sets 'value' to the value of
- * the current character. It returns the number of characters read or a
- * negative error code:
- * -1 = string too short
- * -2 = illegal character
- * -3 = subsequent characters not of the form 10xxxxxx
- * -4 = character encoded incorrectly (not minimal length).
- */
-
-int
-UTF8_getc(const unsigned char *str, int len, unsigned long *val)
-{
-        const unsigned char *p;
-        unsigned long value;
-        int ret;
-        if (len <= 0)
-                return 0;
-        p = str;
-
-        /* Check syntax and work out the encoded value (if correct) */
-        if ((*p & 0x80) == 0) {
-                value = *p++ & 0x7f;
-                ret = 1;
-        } else if ((*p & 0xe0) == 0xc0) {
-                if (*p < 0xc2)
-                        return -2;
-                if (len < 2)
-                        return -1;
-                if ((p[1] & 0xc0) != 0x80)
-                        return -3;
-                value = (*p++ & 0x1f) << 6;
-                value |= *p++ & 0x3f;
-                if (value < 0x80)
-                        return -4;
-                ret = 2;
-        } else if ((*p & 0xf0) == 0xe0) {
-                if (len < 3)
-                        return -1;
-                if (((p[1] & 0xc0) != 0x80) ||
-                    ((p[2] & 0xc0) != 0x80))
-                        return -3;
-                value = (*p++ & 0xf) << 12;
-                value |= (*p++ & 0x3f) << 6;
-                value |= *p++ & 0x3f;
-                if (value < 0x800)
-                        return -4;
-                /* surrogate pair code points are not valid */
-                if (value >= 0xd800 && value < 0xe000)
-                        return -2;
-                ret = 3;
-        } else if ((*p & 0xf8) == 0xf0 && (*p < 0xf5)) {
-                if (len < 4)
-                        return -1;
-                if (((p[1] & 0xc0) != 0x80) ||
-                    ((p[2] & 0xc0) != 0x80) ||
-                    ((p[3] & 0xc0) != 0x80))
-                        return -3;
-                value = ((unsigned long)(*p++ & 0x7)) << 18;
-                value |= (*p++ & 0x3f) << 12;
-                value |= (*p++ & 0x3f) << 6;
-                value |= *p++ & 0x3f;
-                if (value < 0x10000)
-                        return -4;
-                if (value > UNICODE_MAX)
-                        return -2;
-                ret = 4;
-        } else
-                return -2;
-        *val = value;
-        return ret;
-}
-
-/* This takes a Unicode code point 'value' and writes its UTF-8 encoded form
- * in 'str' where 'str' is a buffer of at least length 'len'.  If 'str'
- * is NULL, then nothing is written and just the return code is determined.
-
- * Returns less than zero on error:
- *  -1 if 'str' is not NULL and 'len' is too small
- *  -2 if 'value' is an invalid character (surrogate or out-of-range)
- *
- * Otherwise, returns the number of bytes in 'value's encoded form
- * (i.e., the number of bytes written to 'str' when it's not NULL).
- *
- * It will need at most 4 characters.
- */
-
-int
-UTF8_putc(unsigned char *str, int len, unsigned long value)
-{
-        if (value < 0x80) {
-                if (str != NULL) {
-                        if (len < 1)
-                                return -1;
-                        str[0] = (unsigned char)value;
-                }
-                return 1;
-        }
-        if (value < 0x800) {
-                if (str != NULL) {
-                        if (len < 2)
-                                return -1;
-                        str[0] = (unsigned char)(((value >> 6) & 0x1f) | 0xc0);
-                        str[1] = (unsigned char)((value & 0x3f) | 0x80);
-                }
-                return 2;
-        }
-        if (value < 0x10000) {
-                if (UNICODE_IS_SURROGATE(value))
-                        return -2;
-                if (str != NULL) {
-                        if (len < 3)
-                                return -1;
-                        str[0] = (unsigned char)(((value >> 12) & 0xf) | 0xe0);
-                        str[1] = (unsigned char)(((value >> 6) & 0x3f) | 0x80);
-                        str[2] = (unsigned char)((value & 0x3f) | 0x80);
-                }
-                return 3;
-        }
-        if (value <= UNICODE_MAX) {
-                if (str != NULL) {
-                        if (len < 4)
-                                return -1;
-                        str[0] = (unsigned char)(((value >> 18) & 0x7) | 0xf0);
-                        str[1] = (unsigned char)(((value >> 12) & 0x3f) | 0x80);
-                        str[2] = (unsigned char)(((value >> 6) & 0x3f) | 0x80);
-                        str[3] = (unsigned char)((value & 0x3f) | 0x80);
-                }
-                return 4;
-        }
-        return -2;
-}
diff --git a/src/lib/libcrypto/asn1/a_verify.c b/src/lib/libcrypto/asn1/a_verify.c
deleted file mode 100644
index 3fc79b78f6..0000000000
--- a/src/lib/libcrypto/asn1/a_verify.c
+++ /dev/null
@@ -1,172 +0,0 @@
-/* $OpenBSD: a_verify.c,v 1.21 2015/01/28 04:14:31 beck Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <sys/types.h>
-
-#include <stdio.h>
-#include <time.h>
-
-#include <openssl/bn.h>
-#include <openssl/buffer.h>
-#include <openssl/err.h>
-#include <openssl/evp.h>
-#include <openssl/objects.h>
-#include <openssl/x509.h>
-
-#include "asn1_locl.h"
-
-int
-ASN1_item_verify(const ASN1_ITEM *it, X509_ALGOR *a,
-    ASN1_BIT_STRING *signature, void *asn, EVP_PKEY *pkey)
-{
-        EVP_MD_CTX ctx;
-        unsigned char *buf_in = NULL;
-        int ret = -1, inl;
-
-        int mdnid, pknid;
-
-        if (!pkey) {
-                ASN1err(ASN1_F_ASN1_ITEM_VERIFY, ERR_R_PASSED_NULL_PARAMETER);
-                return -1;
-        }
-
-        if (signature->type == V_ASN1_BIT_STRING && signature->flags & 0x7)
-        {
-                ASN1err(ASN1_F_ASN1_VERIFY,
-                    ASN1_R_INVALID_BIT_STRING_BITS_LEFT);
-                return -1;
-        }
-
-        EVP_MD_CTX_init(&ctx);
-
-        /* Convert signature OID into digest and public key OIDs */
-        if (!OBJ_find_sigid_algs(OBJ_obj2nid(a->algorithm), &mdnid, &pknid)) {
-                ASN1err(ASN1_F_ASN1_ITEM_VERIFY,
-                    ASN1_R_UNKNOWN_SIGNATURE_ALGORITHM);
-                goto err;
-        }
-        if (mdnid == NID_undef) {
-                if (!pkey->ameth || !pkey->ameth->item_verify) {
-                        ASN1err(ASN1_F_ASN1_ITEM_VERIFY,
-                            ASN1_R_UNKNOWN_SIGNATURE_ALGORITHM);
-                        goto err;
-                }
-                ret = pkey->ameth->item_verify(&ctx, it, asn, a,
-                    signature, pkey);
-                /* Return value of 2 means carry on, anything else means we
-                 * exit straight away: either a fatal error of the underlying
-                 * verification routine handles all verification.
-                 */
-                if (ret != 2)
-                        goto err;
-                ret = -1;
-        } else {
-                const EVP_MD *type;
-                type = EVP_get_digestbynid(mdnid);
-                if (type == NULL) {
-                        ASN1err(ASN1_F_ASN1_ITEM_VERIFY,
-                            ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM);
-                        goto err;
-                }
-
-                /* Check public key OID matches public key type */
-                if (EVP_PKEY_type(pknid) != pkey->ameth->pkey_id) {
-                        ASN1err(ASN1_F_ASN1_ITEM_VERIFY,
-                            ASN1_R_WRONG_PUBLIC_KEY_TYPE);
-                        goto err;
-                }
-
-                if (!EVP_DigestVerifyInit(&ctx, NULL, type, NULL, pkey)) {
-                        ASN1err(ASN1_F_ASN1_ITEM_VERIFY, ERR_R_EVP_LIB);
-                        ret = 0;
-                        goto err;
-                }
-
-        }
-
-        inl = ASN1_item_i2d(asn, &buf_in, it);
-
-        if (buf_in == NULL) {
-                ASN1err(ASN1_F_ASN1_ITEM_VERIFY, ERR_R_MALLOC_FAILURE);
-                goto err;
-        }
-
-        if (!EVP_DigestVerifyUpdate(&ctx, buf_in, inl)) {
-                ASN1err(ASN1_F_ASN1_ITEM_VERIFY, ERR_R_EVP_LIB);
-                ret = 0;
-                goto err;
-        }
-
-        OPENSSL_cleanse(buf_in, (unsigned int)inl);
-        free(buf_in);
-
-        if (EVP_DigestVerifyFinal(&ctx, signature->data,
-            (size_t)signature->length) <= 0) {
-                ASN1err(ASN1_F_ASN1_ITEM_VERIFY, ERR_R_EVP_LIB);
-                ret = 0;
-                goto err;
-        }
-        /* we don't need to zero the 'ctx' because we just checked
-         * public information */
-        /* memset(&ctx,0,sizeof(ctx)); */
-        ret = 1;
-
-err:
-        EVP_MD_CTX_cleanup(&ctx);
-        return (ret);
-}
diff --git a/src/lib/libcrypto/asn1/ameth_lib.c b/src/lib/libcrypto/asn1/ameth_lib.c
deleted file mode 100644
index 168321618c..0000000000
--- a/src/lib/libcrypto/asn1/ameth_lib.c
+++ /dev/null
@@ -1,457 +0,0 @@
-/* $OpenBSD: ameth_lib.c,v 1.15 2014/11/09 19:17:13 miod Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 2006.
- */
-/* ====================================================================
- * Copyright (c) 2006 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <stdio.h>
-#include <string.h>
-
-#include <openssl/opensslconf.h>
-
-#include <openssl/asn1t.h>
-#include <openssl/x509.h>
-
-#ifndef OPENSSL_NO_ENGINE
-#include <openssl/engine.h>
-#endif
-
-#include "asn1_locl.h"
-
-extern const EVP_PKEY_ASN1_METHOD rsa_asn1_meths[];
-extern const EVP_PKEY_ASN1_METHOD dsa_asn1_meths[];
-extern const EVP_PKEY_ASN1_METHOD dh_asn1_meth;
-extern const EVP_PKEY_ASN1_METHOD eckey_asn1_meth;
-extern const EVP_PKEY_ASN1_METHOD gostr01_asn1_meths[];
-extern const EVP_PKEY_ASN1_METHOD gostimit_asn1_meth;
-extern const EVP_PKEY_ASN1_METHOD hmac_asn1_meth;
-extern const EVP_PKEY_ASN1_METHOD cmac_asn1_meth;
-
-/* Keep this sorted in type order !! */
-static const EVP_PKEY_ASN1_METHOD *standard_methods[] = {
-#ifndef OPENSSL_NO_RSA
-        &rsa_asn1_meths[0],
-        &rsa_asn1_meths[1],
-#endif
-#ifndef OPENSSL_NO_DH
-        &dh_asn1_meth,
-#endif
-#ifndef OPENSSL_NO_DSA
-        &dsa_asn1_meths[0],
-        &dsa_asn1_meths[1],
-        &dsa_asn1_meths[2],
-        &dsa_asn1_meths[3],
-        &dsa_asn1_meths[4],
-#endif
-#ifndef OPENSSL_NO_EC
-        &eckey_asn1_meth,
-#endif
-#ifndef OPENSSL_NO_GOST
-        &gostr01_asn1_meths[0],
-        &gostimit_asn1_meth,
-#endif
-        &hmac_asn1_meth,
-        &cmac_asn1_meth,
-#ifndef OPENSSL_NO_GOST
-        &gostr01_asn1_meths[1],
-        &gostr01_asn1_meths[2],
-#endif
-};
-
-typedef int sk_cmp_fn_type(const char * const *a, const char * const *b);
-DECLARE_STACK_OF(EVP_PKEY_ASN1_METHOD)
-static STACK_OF(EVP_PKEY_ASN1_METHOD) *app_methods = NULL;
-
-DECLARE_OBJ_BSEARCH_CMP_FN(const EVP_PKEY_ASN1_METHOD *,
-    const EVP_PKEY_ASN1_METHOD *, ameth);
-
-static int
-ameth_cmp(const EVP_PKEY_ASN1_METHOD * const *a,
-    const EVP_PKEY_ASN1_METHOD * const *b)
-{
-        return ((*a)->pkey_id - (*b)->pkey_id);
-}
-
-IMPLEMENT_OBJ_BSEARCH_CMP_FN(const EVP_PKEY_ASN1_METHOD *,
-    const EVP_PKEY_ASN1_METHOD *, ameth);
-
-int
-EVP_PKEY_asn1_get_count(void)
-{
-        int num = sizeof(standard_methods) / sizeof(EVP_PKEY_ASN1_METHOD *);
-        if (app_methods)
-                num += sk_EVP_PKEY_ASN1_METHOD_num(app_methods);
-        return num;
-}
-
-const EVP_PKEY_ASN1_METHOD *
-EVP_PKEY_asn1_get0(int idx)
-{
-        int num = sizeof(standard_methods) / sizeof(EVP_PKEY_ASN1_METHOD *);
-        if (idx < 0)
-                return NULL;
-        if (idx < num)
-                return standard_methods[idx];
-        idx -= num;
-        return sk_EVP_PKEY_ASN1_METHOD_value(app_methods, idx);
-}
-
-static const EVP_PKEY_ASN1_METHOD *
-pkey_asn1_find(int type)
-{
-        EVP_PKEY_ASN1_METHOD tmp;
-        const EVP_PKEY_ASN1_METHOD *t = &tmp, **ret;
-        tmp.pkey_id = type;
-        if (app_methods) {
-                int idx;
-                idx = sk_EVP_PKEY_ASN1_METHOD_find(app_methods, &tmp);
-                if (idx >= 0)
-                        return sk_EVP_PKEY_ASN1_METHOD_value(app_methods, idx);
-        }
-        ret = OBJ_bsearch_ameth(&t, standard_methods,
-            sizeof(standard_methods) / sizeof(EVP_PKEY_ASN1_METHOD *));
-        if (!ret || !*ret)
-                return NULL;
-        return *ret;
-}
-
-/* Find an implementation of an ASN1 algorithm. If 'pe' is not NULL
- * also search through engines and set *pe to a functional reference
- * to the engine implementing 'type' or NULL if no engine implements
- * it.
- */
-
-const EVP_PKEY_ASN1_METHOD *
-EVP_PKEY_asn1_find(ENGINE **pe, int type)
-{
-        const EVP_PKEY_ASN1_METHOD *t;
-
-        for (;;) {
-                t = pkey_asn1_find(type);
-                if (!t || !(t->pkey_flags & ASN1_PKEY_ALIAS))
-                        break;
-                type = t->pkey_base_id;
-        }
-        if (pe) {
-#ifndef OPENSSL_NO_ENGINE
-                ENGINE *e;
-                /* type will contain the final unaliased type */
-                e = ENGINE_get_pkey_asn1_meth_engine(type);
-                if (e) {
-                        *pe = e;
-                        return ENGINE_get_pkey_asn1_meth(e, type);
-                }
-#endif
-                *pe = NULL;
-        }
-        return t;
-}
-
-const EVP_PKEY_ASN1_METHOD *
-EVP_PKEY_asn1_find_str(ENGINE **pe, const char *str, int len)
-{
-        int i;
-        const EVP_PKEY_ASN1_METHOD *ameth;
-        if (len == -1)
-                len = strlen(str);
-        if (pe) {
-#ifndef OPENSSL_NO_ENGINE
-                ENGINE *e;
-                ameth = ENGINE_pkey_asn1_find_str(&e, str, len);
-                if (ameth) {
-                        /* Convert structural into
-                         * functional reference
-                         */
-                        if (!ENGINE_init(e))
-                                ameth = NULL;
-                        ENGINE_free(e);
-                        *pe = e;
-                        return ameth;
-                }
-#endif
-                *pe = NULL;
-        }
-        for (i = 0; i < EVP_PKEY_asn1_get_count(); i++) {
-                ameth = EVP_PKEY_asn1_get0(i);
-                if (ameth->pkey_flags & ASN1_PKEY_ALIAS)
-                        continue;
-                if (((int)strlen(ameth->pem_str) == len) &&
-                    !strncasecmp(ameth->pem_str, str, len))
-                        return ameth;
-        }
-        return NULL;
-}
-
-int
-EVP_PKEY_asn1_add0(const EVP_PKEY_ASN1_METHOD *ameth)
-{
-        if (app_methods == NULL) {
-                app_methods = sk_EVP_PKEY_ASN1_METHOD_new(ameth_cmp);
-                if (!app_methods)
-                        return 0;
-        }
-        if (!sk_EVP_PKEY_ASN1_METHOD_push(app_methods, ameth))
-                return 0;
-        sk_EVP_PKEY_ASN1_METHOD_sort(app_methods);
-        return 1;
-}
-
-int
-EVP_PKEY_asn1_add_alias(int to, int from)
-{
-        EVP_PKEY_ASN1_METHOD *ameth;
-
-        ameth = EVP_PKEY_asn1_new(from, ASN1_PKEY_ALIAS, NULL, NULL);
-        if (!ameth)
-                return 0;
-        ameth->pkey_base_id = to;
-        if (!EVP_PKEY_asn1_add0(ameth)) {
-                EVP_PKEY_asn1_free(ameth);
-                return 0;
-        }
-        return 1;
-}
-
-int
-EVP_PKEY_asn1_get0_info(int *ppkey_id, int *ppkey_base_id, int *ppkey_flags,
-    const char **pinfo, const char **ppem_str,
-    const EVP_PKEY_ASN1_METHOD *ameth)
-{
-        if (!ameth)
-                return 0;
-        if (ppkey_id)
-                *ppkey_id = ameth->pkey_id;
-        if (ppkey_base_id)
-                *ppkey_base_id = ameth->pkey_base_id;
-        if (ppkey_flags)
-                *ppkey_flags = ameth->pkey_flags;
-        if (pinfo)
-                *pinfo = ameth->info;
-        if (ppem_str)
-                *ppem_str = ameth->pem_str;
-        return 1;
-}
-
-const EVP_PKEY_ASN1_METHOD*
-EVP_PKEY_get0_asn1(EVP_PKEY *pkey)
-{
-        return pkey->ameth;
-}
-
-EVP_PKEY_ASN1_METHOD*
-EVP_PKEY_asn1_new(int id, int flags, const char *pem_str, const char *info)
-{
-        EVP_PKEY_ASN1_METHOD *ameth;
-
-        ameth = calloc(1, sizeof(EVP_PKEY_ASN1_METHOD));
-        if (!ameth)
-                return NULL;
-
-        ameth->pkey_id = id;
-        ameth->pkey_base_id = id;
-        ameth->pkey_flags = flags | ASN1_PKEY_DYNAMIC;
-
-        if (info) {
-                ameth->info = strdup(info);
-                if (!ameth->info)
-                        goto err;
-        } else
-                ameth->info = NULL;
-
-        if (pem_str) {
-                ameth->pem_str = strdup(pem_str);
-                if (!ameth->pem_str)
-                        goto err;
-        } else
-                ameth->pem_str = NULL;
-
-        ameth->pub_decode = 0;
-        ameth->pub_encode = 0;
-        ameth->pub_cmp = 0;
-        ameth->pub_print = 0;
-
-        ameth->priv_decode = 0;
-        ameth->priv_encode = 0;
-        ameth->priv_print = 0;
-
-        ameth->old_priv_encode = 0;
-        ameth->old_priv_decode = 0;
-
-        ameth->item_verify = 0;
-        ameth->item_sign = 0;
-
-        ameth->pkey_size = 0;
-        ameth->pkey_bits = 0;
-
-        ameth->param_decode = 0;
-        ameth->param_encode = 0;
-        ameth->param_missing = 0;
-        ameth->param_copy = 0;
-        ameth->param_cmp = 0;
-        ameth->param_print = 0;
-
-        ameth->pkey_free = 0;
-        ameth->pkey_ctrl = 0;
-
-        return ameth;
-
-err:
-        EVP_PKEY_asn1_free(ameth);
-        return NULL;
-}
-
-void
-EVP_PKEY_asn1_copy(EVP_PKEY_ASN1_METHOD *dst, const EVP_PKEY_ASN1_METHOD *src)
-{
-        dst->pub_decode = src->pub_decode;
-        dst->pub_encode = src->pub_encode;
-        dst->pub_cmp = src->pub_cmp;
-        dst->pub_print = src->pub_print;
-
-        dst->priv_decode = src->priv_decode;
-        dst->priv_encode = src->priv_encode;
-        dst->priv_print = src->priv_print;
-
-        dst->old_priv_encode = src->old_priv_encode;
-        dst->old_priv_decode = src->old_priv_decode;
-
-        dst->pkey_size = src->pkey_size;
-        dst->pkey_bits = src->pkey_bits;
-
-        dst->param_decode = src->param_decode;
-        dst->param_encode = src->param_encode;
-        dst->param_missing = src->param_missing;
-        dst->param_copy = src->param_copy;
-        dst->param_cmp = src->param_cmp;
-        dst->param_print = src->param_print;
-
-        dst->pkey_free = src->pkey_free;
-        dst->pkey_ctrl = src->pkey_ctrl;
-
-        dst->item_sign = src->item_sign;
-        dst->item_verify = src->item_verify;
-}
-
-void
-EVP_PKEY_asn1_free(EVP_PKEY_ASN1_METHOD *ameth)
-{
-        if (ameth && (ameth->pkey_flags & ASN1_PKEY_DYNAMIC)) {
-                free(ameth->pem_str);
-                free(ameth->info);
-                free(ameth);
-        }
-}
-
-void
-EVP_PKEY_asn1_set_public(EVP_PKEY_ASN1_METHOD *ameth,
-    int (*pub_decode)(EVP_PKEY *pk, X509_PUBKEY *pub),
-    int (*pub_encode)(X509_PUBKEY *pub, const EVP_PKEY *pk),
-    int (*pub_cmp)(const EVP_PKEY *a, const EVP_PKEY *b),
-    int (*pub_print)(BIO *out, const EVP_PKEY *pkey, int indent,
-        ASN1_PCTX *pctx),
-    int (*pkey_size)(const EVP_PKEY *pk),
-    int (*pkey_bits)(const EVP_PKEY *pk))
-{
-        ameth->pub_decode = pub_decode;
-        ameth->pub_encode = pub_encode;
-        ameth->pub_cmp = pub_cmp;
-        ameth->pub_print = pub_print;
-        ameth->pkey_size = pkey_size;
-        ameth->pkey_bits = pkey_bits;
-}
-
-void
-EVP_PKEY_asn1_set_private(EVP_PKEY_ASN1_METHOD *ameth,
-    int (*priv_decode)(EVP_PKEY *pk, PKCS8_PRIV_KEY_INFO *p8inf),
-    int (*priv_encode)(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pk),
-    int (*priv_print)(BIO *out, const EVP_PKEY *pkey, int indent,
-        ASN1_PCTX *pctx))
-{
-        ameth->priv_decode = priv_decode;
-        ameth->priv_encode = priv_encode;
-        ameth->priv_print = priv_print;
-}
-
-void
-EVP_PKEY_asn1_set_param(EVP_PKEY_ASN1_METHOD *ameth,
-    int (*param_decode)(EVP_PKEY *pkey, const unsigned char **pder, int derlen),
-    int (*param_encode)(const EVP_PKEY *pkey, unsigned char **pder),
-    int (*param_missing)(const EVP_PKEY *pk),
-    int (*param_copy)(EVP_PKEY *to, const EVP_PKEY *from),
-    int (*param_cmp)(const EVP_PKEY *a, const EVP_PKEY *b),
-    int (*param_print)(BIO *out, const EVP_PKEY *pkey, int indent,
-        ASN1_PCTX *pctx))
-{
-        ameth->param_decode = param_decode;
-        ameth->param_encode = param_encode;
-        ameth->param_missing = param_missing;
-        ameth->param_copy = param_copy;
-        ameth->param_cmp = param_cmp;
-        ameth->param_print = param_print;
-}
-
-void
-EVP_PKEY_asn1_set_free(EVP_PKEY_ASN1_METHOD *ameth,
-    void (*pkey_free)(EVP_PKEY *pkey))
-{
-        ameth->pkey_free = pkey_free;
-}
-
-void
-EVP_PKEY_asn1_set_ctrl(EVP_PKEY_ASN1_METHOD *ameth,
-    int (*pkey_ctrl)(EVP_PKEY *pkey, int op, long arg1, void *arg2))
-{
-        ameth->pkey_ctrl = pkey_ctrl;
-}
diff --git a/src/lib/libcrypto/asn1/asn1.h b/src/lib/libcrypto/asn1/asn1.h
deleted file mode 100644
index 5ec89db3f0..0000000000
--- a/src/lib/libcrypto/asn1/asn1.h
+++ /dev/null
@@ -1,1355 +0,0 @@
-/* $OpenBSD: asn1.h,v 1.29 2015/01/28 04:14:31 beck Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#ifndef HEADER_ASN1_H
-#define HEADER_ASN1_H
-
-#include <time.h>
-
-#include <openssl/opensslconf.h>
-
-#ifndef OPENSSL_NO_BIO
-#include <openssl/bio.h>
-#endif
-#include <openssl/stack.h>
-#include <openssl/safestack.h>
-
-#include <openssl/ossl_typ.h>
-#ifndef OPENSSL_NO_DEPRECATED
-#include <openssl/bn.h>
-#endif
-
-#ifdef  __cplusplus
-extern "C" {
-#endif
-
-#define V_ASN1_UNIVERSAL                0x00
-#define V_ASN1_APPLICATION              0x40
-#define V_ASN1_CONTEXT_SPECIFIC         0x80
-#define V_ASN1_PRIVATE                  0xc0
-
-#define V_ASN1_CONSTRUCTED              0x20
-#define V_ASN1_PRIMITIVE_TAG            0x1f
-#define V_ASN1_PRIMATIVE_TAG            0x1f
-
-#define V_ASN1_APP_CHOOSE               -2      /* let the recipient choose */
-#define V_ASN1_OTHER                    -3      /* used in ASN1_TYPE */
-#define V_ASN1_ANY                      -4      /* used in ASN1 template code */
-
-#define V_ASN1_NEG                      0x100   /* negative flag */
-
-#define V_ASN1_UNDEF                    -1
-#define V_ASN1_EOC                      0
-#define V_ASN1_BOOLEAN                  1       /**/
-#define V_ASN1_INTEGER                  2
-#define V_ASN1_NEG_INTEGER              (2 | V_ASN1_NEG)
-#define V_ASN1_BIT_STRING               3
-#define V_ASN1_OCTET_STRING             4
-#define V_ASN1_NULL                     5
-#define V_ASN1_OBJECT                   6
-#define V_ASN1_OBJECT_DESCRIPTOR        7
-#define V_ASN1_EXTERNAL                 8
-#define V_ASN1_REAL                     9
-#define V_ASN1_ENUMERATED               10
-#define V_ASN1_NEG_ENUMERATED           (10 | V_ASN1_NEG)
-#define V_ASN1_UTF8STRING               12
-#define V_ASN1_SEQUENCE                 16
-#define V_ASN1_SET                      17
-#define V_ASN1_NUMERICSTRING            18      /**/
-#define V_ASN1_PRINTABLESTRING          19
-#define V_ASN1_T61STRING                20
-#define V_ASN1_TELETEXSTRING            20      /* alias */
-#define V_ASN1_VIDEOTEXSTRING           21      /**/
-#define V_ASN1_IA5STRING                22
-#define V_ASN1_UTCTIME                  23
-#define V_ASN1_GENERALIZEDTIME          24      /**/
-#define V_ASN1_GRAPHICSTRING            25      /**/
-#define V_ASN1_ISO64STRING              26      /**/
-#define V_ASN1_VISIBLESTRING            26      /* alias */
-#define V_ASN1_GENERALSTRING            27      /**/
-#define V_ASN1_UNIVERSALSTRING          28      /**/
-#define V_ASN1_BMPSTRING                30
-
-/* For use with d2i_ASN1_type_bytes() */
-#define B_ASN1_NUMERICSTRING    0x0001
-#define B_ASN1_PRINTABLESTRING  0x0002
-#define B_ASN1_T61STRING        0x0004
-#define B_ASN1_TELETEXSTRING    0x0004
-#define B_ASN1_VIDEOTEXSTRING   0x0008
-#define B_ASN1_IA5STRING        0x0010
-#define B_ASN1_GRAPHICSTRING    0x0020
-#define B_ASN1_ISO64STRING      0x0040
-#define B_ASN1_VISIBLESTRING    0x0040
-#define B_ASN1_GENERALSTRING    0x0080
-#define B_ASN1_UNIVERSALSTRING  0x0100
-#define B_ASN1_OCTET_STRING     0x0200
-#define B_ASN1_BIT_STRING       0x0400
-#define B_ASN1_BMPSTRING        0x0800
-#define B_ASN1_UNKNOWN          0x1000
-#define B_ASN1_UTF8STRING       0x2000
-#define B_ASN1_UTCTIME          0x4000
-#define B_ASN1_GENERALIZEDTIME  0x8000
-#define B_ASN1_SEQUENCE         0x10000
-
-/* For use with ASN1_mbstring_copy() */
-#define MBSTRING_FLAG           0x1000
-#define MBSTRING_UTF8           (MBSTRING_FLAG)
-#define MBSTRING_ASC            (MBSTRING_FLAG|1)
-#define MBSTRING_BMP            (MBSTRING_FLAG|2)
-#define MBSTRING_UNIV           (MBSTRING_FLAG|4)
-
-#define SMIME_OLDMIME           0x400
-#define SMIME_CRLFEOL           0x800
-#define SMIME_STREAM            0x1000
-
-struct X509_algor_st;
-DECLARE_STACK_OF(X509_ALGOR)
-
-#define DECLARE_ASN1_SET_OF(type) /* filled in by mkstack.pl */
-#define IMPLEMENT_ASN1_SET_OF(type) /* nothing, no longer needed */
-
-/* We MUST make sure that, except for constness, asn1_ctx_st and
-   asn1_const_ctx are exactly the same.  Fortunately, as soon as
-   the old ASN1 parsing macros are gone, we can throw this away
-   as well... */
-typedef struct asn1_ctx_st {
-        unsigned char *p;/* work char pointer */
-        int eos;        /* end of sequence read for indefinite encoding */
-        int error;      /* error code to use when returning an error */
-        int inf;        /* constructed if 0x20, indefinite is 0x21 */
-        int tag;        /* tag from last 'get object' */
-        int xclass;     /* class from last 'get object' */
-        long slen;      /* length of last 'get object' */
-        unsigned char *max; /* largest value of p allowed */
-        unsigned char *q;/* temporary variable */
-        unsigned char **pp;/* variable */
-        int line;       /* used in error processing */
-} ASN1_CTX;
-
-typedef struct asn1_const_ctx_st {
-        const unsigned char *p;/* work char pointer */
-        int eos;        /* end of sequence read for indefinite encoding */
-        int error;      /* error code to use when returning an error */
-        int inf;        /* constructed if 0x20, indefinite is 0x21 */
-        int tag;        /* tag from last 'get object' */
-        int xclass;     /* class from last 'get object' */
-        long slen;      /* length of last 'get object' */
-        const unsigned char *max; /* largest value of p allowed */
-        const unsigned char *q;/* temporary variable */
-        const unsigned char **pp;/* variable */
-        int line;       /* used in error processing */
-} ASN1_const_CTX;
-
-/* These are used internally in the ASN1_OBJECT to keep track of
- * whether the names and data need to be free()ed */
-#define ASN1_OBJECT_FLAG_DYNAMIC         0x01   /* internal use */
-#define ASN1_OBJECT_FLAG_CRITICAL        0x02   /* critical x509v3 object id */
-#define ASN1_OBJECT_FLAG_DYNAMIC_STRINGS 0x04   /* internal use */
-#define ASN1_OBJECT_FLAG_DYNAMIC_DATA    0x08   /* internal use */
-typedef struct asn1_object_st {
-        const char *sn, *ln;
-        int nid;
-        int length;
-        const unsigned char *data;      /* data remains const after init */
-        int flags;      /* Should we free this one */
-} ASN1_OBJECT;
-
-#define ASN1_STRING_FLAG_BITS_LEFT 0x08 /* Set if 0x07 has bits left value */
-/* This indicates that the ASN1_STRING is not a real value but just a place
- * holder for the location where indefinite length constructed data should
- * be inserted in the memory buffer
- */
-#define ASN1_STRING_FLAG_NDEF 0x010
-
-/* This flag is used by the CMS code to indicate that a string is not
- * complete and is a place holder for content when it had all been
- * accessed. The flag will be reset when content has been written to it.
- */
-
-#define ASN1_STRING_FLAG_CONT 0x020
-/* This flag is used by ASN1 code to indicate an ASN1_STRING is an MSTRING
- * type.
- */
-#define ASN1_STRING_FLAG_MSTRING 0x040
-/* This is the base type that holds just about everything :-) */
-struct asn1_string_st {
-        int length;
-        int type;
-        unsigned char *data;
-        /* The value of the following field depends on the type being
-         * held.  It is mostly being used for BIT_STRING so if the
-         * input data has a non-zero 'unused bits' value, it will be
-         * handled correctly */
-        long flags;
-};
-
-/* ASN1_ENCODING structure: this is used to save the received
- * encoding of an ASN1 type. This is useful to get round
- * problems with invalid encodings which can break signatures.
- */
-
-typedef struct ASN1_ENCODING_st {
-        unsigned char *enc;     /* DER encoding */
-        long len;               /* Length of encoding */
-        int modified;            /* set to 1 if 'enc' is invalid */
-} ASN1_ENCODING;
-
-/* Used with ASN1 LONG type: if a long is set to this it is omitted */
-#define ASN1_LONG_UNDEF 0x7fffffffL
-
-#define STABLE_FLAGS_MALLOC     0x01
-#define STABLE_NO_MASK          0x02
-#define DIRSTRING_TYPE  \
- (B_ASN1_PRINTABLESTRING|B_ASN1_T61STRING|B_ASN1_BMPSTRING|B_ASN1_UTF8STRING)
-#define PKCS9STRING_TYPE (DIRSTRING_TYPE|B_ASN1_IA5STRING)
-
-typedef struct asn1_string_table_st {
-        int nid;
-        long minsize;
-        long maxsize;
-        unsigned long mask;
-        unsigned long flags;
-} ASN1_STRING_TABLE;
-
-DECLARE_STACK_OF(ASN1_STRING_TABLE)
-
-/* size limits: this stuff is taken straight from RFC2459 */
-
-#define ub_name                         32768
-#define ub_common_name                  64
-#define ub_locality_name                128
-#define ub_state_name                   128
-#define ub_organization_name            64
-#define ub_organization_unit_name       64
-#define ub_title                        64
-#define ub_email_address                128
-
-/* Declarations for template structures: for full definitions
- * see asn1t.h
- */
-typedef struct ASN1_TEMPLATE_st ASN1_TEMPLATE;
-typedef struct ASN1_TLC_st ASN1_TLC;
-/* This is just an opaque pointer */
-typedef struct ASN1_VALUE_st ASN1_VALUE;
-
-/* Declare ASN1 functions: the implement macro in in asn1t.h */
-
-#define DECLARE_ASN1_FUNCTIONS(type) DECLARE_ASN1_FUNCTIONS_name(type, type)
-
-#define DECLARE_ASN1_ALLOC_FUNCTIONS(type) \
-        DECLARE_ASN1_ALLOC_FUNCTIONS_name(type, type)
-
-#define DECLARE_ASN1_FUNCTIONS_name(type, name) \
-        DECLARE_ASN1_ALLOC_FUNCTIONS_name(type, name) \
-        DECLARE_ASN1_ENCODE_FUNCTIONS(type, name, name)
-
-#define DECLARE_ASN1_FUNCTIONS_fname(type, itname, name) \
-        DECLARE_ASN1_ALLOC_FUNCTIONS_name(type, name) \
-        DECLARE_ASN1_ENCODE_FUNCTIONS(type, itname, name)
-
-#define DECLARE_ASN1_ENCODE_FUNCTIONS(type, itname, name) \
-        type *d2i_##name(type **a, const unsigned char **in, long len); \
-        int i2d_##name(type *a, unsigned char **out); \
-        DECLARE_ASN1_ITEM(itname)
-
-#define DECLARE_ASN1_ENCODE_FUNCTIONS_const(type, name) \
-        type *d2i_##name(type **a, const unsigned char **in, long len); \
-        int i2d_##name(const type *a, unsigned char **out); \
-        DECLARE_ASN1_ITEM(name)
-
-#define DECLARE_ASN1_NDEF_FUNCTION(name) \
-        int i2d_##name##_NDEF(name *a, unsigned char **out);
-
-#define DECLARE_ASN1_FUNCTIONS_const(name) \
-        DECLARE_ASN1_ALLOC_FUNCTIONS(name) \
-        DECLARE_ASN1_ENCODE_FUNCTIONS_const(name, name)
-
-#define DECLARE_ASN1_ALLOC_FUNCTIONS_name(type, name) \
-        type *name##_new(void); \
-        void name##_free(type *a);
-
-#define DECLARE_ASN1_PRINT_FUNCTION(stname) \
-        DECLARE_ASN1_PRINT_FUNCTION_fname(stname, stname)
-
-#define DECLARE_ASN1_PRINT_FUNCTION_fname(stname, fname) \
-        int fname##_print_ctx(BIO *out, stname *x, int indent, \
-                                         const ASN1_PCTX *pctx);
-
-#define D2I_OF(type) type *(*)(type **,const unsigned char **,long)
-#define I2D_OF(type) int (*)(type *,unsigned char **)
-#define I2D_OF_const(type) int (*)(const type *,unsigned char **)
-
-#define CHECKED_D2I_OF(type, d2i) \
-    ((d2i_of_void*) (1 ? d2i : ((D2I_OF(type))0)))
-#define CHECKED_I2D_OF(type, i2d) \
-    ((i2d_of_void*) (1 ? i2d : ((I2D_OF(type))0)))
-#define CHECKED_NEW_OF(type, xnew) \
-    ((void *(*)(void)) (1 ? xnew : ((type *(*)(void))0)))
-#define CHECKED_PTR_OF(type, p) \
-    ((void*) (1 ? p : (type*)0))
-#define CHECKED_PPTR_OF(type, p) \
-    ((void**) (1 ? p : (type**)0))
-
-#define TYPEDEF_D2I_OF(type) typedef type *d2i_of_##type(type **,const unsigned char **,long)
-#define TYPEDEF_I2D_OF(type) typedef int i2d_of_##type(type *,unsigned char **)
-#define TYPEDEF_D2I2D_OF(type) TYPEDEF_D2I_OF(type); TYPEDEF_I2D_OF(type)
-
-TYPEDEF_D2I2D_OF(void);
-
-/* The following macros and typedefs allow an ASN1_ITEM
- * to be embedded in a structure and referenced. Since
- * the ASN1_ITEM pointers need to be globally accessible
- * (possibly from shared libraries) they may exist in
- * different forms. On platforms that support it the
- * ASN1_ITEM structure itself will be globally exported.
- * Other platforms will export a function that returns
- * an ASN1_ITEM pointer.
- *
- * To handle both cases transparently the macros below
- * should be used instead of hard coding an ASN1_ITEM
- * pointer in a structure.
- *
- * The structure will look like this:
- *
- * typedef struct SOMETHING_st {
- *      ...
- *      ASN1_ITEM_EXP *iptr;
- *      ...
- * } SOMETHING;
- *
- * It would be initialised as e.g.:
- *
- * SOMETHING somevar = {...,ASN1_ITEM_ref(X509),...};
- *
- * and the actual pointer extracted with:
- *
- * const ASN1_ITEM *it = ASN1_ITEM_ptr(somevar.iptr);
- *
- * Finally an ASN1_ITEM pointer can be extracted from an
- * appropriate reference with: ASN1_ITEM_rptr(X509). This
- * would be used when a function takes an ASN1_ITEM * argument.
- *
- */
-
-
-/* ASN1_ITEM pointer exported type */
-typedef const ASN1_ITEM ASN1_ITEM_EXP;
-
-/* Macro to obtain ASN1_ITEM pointer from exported type */
-#define ASN1_ITEM_ptr(iptr) (iptr)
-
-/* Macro to include ASN1_ITEM pointer from base type */
-#define ASN1_ITEM_ref(iptr) (&(iptr##_it))
-
-#define ASN1_ITEM_rptr(ref) (&(ref##_it))
-
-#define DECLARE_ASN1_ITEM(name) \
-        extern const ASN1_ITEM name##_it;
-
-
-/* Parameters used by ASN1_STRING_print_ex() */
-
-/* These determine which characters to escape:
- * RFC2253 special characters, control characters and
- * MSB set characters
- */
-
-#define ASN1_STRFLGS_ESC_2253           1
-#define ASN1_STRFLGS_ESC_CTRL           2
-#define ASN1_STRFLGS_ESC_MSB            4
-
-
-/* This flag determines how we do escaping: normally
- * RC2253 backslash only, set this to use backslash and
- * quote.
- */
-
-#define ASN1_STRFLGS_ESC_QUOTE          8
-
-
-/* These three flags are internal use only. */
-
-/* Character is a valid PrintableString character */
-#define CHARTYPE_PRINTABLESTRING        0x10
-/* Character needs escaping if it is the first character */
-#define CHARTYPE_FIRST_ESC_2253         0x20
-/* Character needs escaping if it is the last character */
-#define CHARTYPE_LAST_ESC_2253          0x40
-
-/* NB the internal flags are safely reused below by flags
- * handled at the top level.
- */
-
-/* If this is set we convert all character strings
- * to UTF8 first
- */
-
-#define ASN1_STRFLGS_UTF8_CONVERT       0x10
-
-/* If this is set we don't attempt to interpret content:
- * just assume all strings are 1 byte per character. This
- * will produce some pretty odd looking output!
- */
-
-#define ASN1_STRFLGS_IGNORE_TYPE        0x20
-
-/* If this is set we include the string type in the output */
-#define ASN1_STRFLGS_SHOW_TYPE          0x40
-
-/* This determines which strings to display and which to
- * 'dump' (hex dump of content octets or DER encoding). We can
- * only dump non character strings or everything. If we
- * don't dump 'unknown' they are interpreted as character
- * strings with 1 octet per character and are subject to
- * the usual escaping options.
- */
-
-#define ASN1_STRFLGS_DUMP_ALL           0x80
-#define ASN1_STRFLGS_DUMP_UNKNOWN       0x100
-
-/* These determine what 'dumping' does, we can dump the
- * content octets or the DER encoding: both use the
- * RFC2253 #NNNNN notation.
- */
-
-#define ASN1_STRFLGS_DUMP_DER           0x200
-
-/* All the string flags consistent with RFC2253,
- * escaping control characters isn't essential in
- * RFC2253 but it is advisable anyway.
- */
-
-#define ASN1_STRFLGS_RFC2253    (ASN1_STRFLGS_ESC_2253 | \
-                                ASN1_STRFLGS_ESC_CTRL | \
-                                ASN1_STRFLGS_ESC_MSB | \
-                                ASN1_STRFLGS_UTF8_CONVERT | \
-                                ASN1_STRFLGS_DUMP_UNKNOWN | \
-                                ASN1_STRFLGS_DUMP_DER)
-
-DECLARE_STACK_OF(ASN1_INTEGER)
-DECLARE_ASN1_SET_OF(ASN1_INTEGER)
-
-DECLARE_STACK_OF(ASN1_GENERALSTRING)
-
-typedef struct asn1_type_st {
-        int type;
-        union {
-                char *ptr;
-                ASN1_BOOLEAN            boolean;
-                ASN1_STRING *           asn1_string;
-                ASN1_OBJECT *           object;
-                ASN1_INTEGER *          integer;
-                ASN1_ENUMERATED *       enumerated;
-                ASN1_BIT_STRING *       bit_string;
-                ASN1_OCTET_STRING *     octet_string;
-                ASN1_PRINTABLESTRING *  printablestring;
-                ASN1_T61STRING *        t61string;
-                ASN1_IA5STRING *        ia5string;
-                ASN1_GENERALSTRING *    generalstring;
-                ASN1_BMPSTRING *        bmpstring;
-                ASN1_UNIVERSALSTRING *  universalstring;
-                ASN1_UTCTIME *          utctime;
-                ASN1_GENERALIZEDTIME *  generalizedtime;
-                ASN1_VISIBLESTRING *    visiblestring;
-                ASN1_UTF8STRING *       utf8string;
-                /* set and sequence are left complete and still
-                 * contain the set or sequence bytes */
-                ASN1_STRING *           set;
-                ASN1_STRING *           sequence;
-                ASN1_VALUE *            asn1_value;
-        } value;
-} ASN1_TYPE;
-
-DECLARE_STACK_OF(ASN1_TYPE)
-DECLARE_ASN1_SET_OF(ASN1_TYPE)
-
-typedef STACK_OF(ASN1_TYPE) ASN1_SEQUENCE_ANY;
-
-DECLARE_ASN1_ENCODE_FUNCTIONS_const(ASN1_SEQUENCE_ANY, ASN1_SEQUENCE_ANY)
-DECLARE_ASN1_ENCODE_FUNCTIONS_const(ASN1_SEQUENCE_ANY, ASN1_SET_ANY)
-
-typedef struct NETSCAPE_X509_st {
-        ASN1_OCTET_STRING *header;
-        X509 *cert;
-} NETSCAPE_X509;
-
-/* This is used to contain a list of bit names */
-typedef struct BIT_STRING_BITNAME_st {
-        int bitnum;
-        const char *lname;
-        const char *sname;
-} BIT_STRING_BITNAME;
-
-
-#define M_ASN1_STRING_length(x) ((x)->length)
-#define M_ASN1_STRING_length_set(x, n)  ((x)->length = (n))
-#define M_ASN1_STRING_type(x)   ((x)->type)
-#define M_ASN1_STRING_data(x)   ((x)->data)
-
-/* Macros for string operations */
-#define M_ASN1_BIT_STRING_new() (ASN1_BIT_STRING *)\
-                ASN1_STRING_type_new(V_ASN1_BIT_STRING)
-#define M_ASN1_BIT_STRING_free(a)       ASN1_STRING_free((ASN1_STRING *)a)
-#define M_ASN1_BIT_STRING_dup(a) (ASN1_BIT_STRING *)\
-                ASN1_STRING_dup((const ASN1_STRING *)a)
-#define M_ASN1_BIT_STRING_cmp(a,b) ASN1_STRING_cmp(\
-                (const ASN1_STRING *)a,(const ASN1_STRING *)b)
-#define M_ASN1_BIT_STRING_set(a,b,c) ASN1_STRING_set((ASN1_STRING *)a,b,c)
-
-#define M_ASN1_INTEGER_new()    (ASN1_INTEGER *)\
-                ASN1_STRING_type_new(V_ASN1_INTEGER)
-#define M_ASN1_INTEGER_free(a)          ASN1_STRING_free((ASN1_STRING *)a)
-#define M_ASN1_INTEGER_dup(a) (ASN1_INTEGER *)\
-                ASN1_STRING_dup((const ASN1_STRING *)a)
-#define M_ASN1_INTEGER_cmp(a,b) ASN1_STRING_cmp(\
-                (const ASN1_STRING *)a,(const ASN1_STRING *)b)
-
-#define M_ASN1_ENUMERATED_new() (ASN1_ENUMERATED *)\
-                ASN1_STRING_type_new(V_ASN1_ENUMERATED)
-#define M_ASN1_ENUMERATED_free(a)       ASN1_STRING_free((ASN1_STRING *)a)
-#define M_ASN1_ENUMERATED_dup(a) (ASN1_ENUMERATED *)\
-                ASN1_STRING_dup((const ASN1_STRING *)a)
-#define M_ASN1_ENUMERATED_cmp(a,b)      ASN1_STRING_cmp(\
-                (const ASN1_STRING *)a,(const ASN1_STRING *)b)
-
-#define M_ASN1_OCTET_STRING_new()       (ASN1_OCTET_STRING *)\
-                ASN1_STRING_type_new(V_ASN1_OCTET_STRING)
-#define M_ASN1_OCTET_STRING_free(a)     ASN1_STRING_free((ASN1_STRING *)a)
-#define M_ASN1_OCTET_STRING_dup(a) (ASN1_OCTET_STRING *)\
-                ASN1_STRING_dup((const ASN1_STRING *)a)
-#define M_ASN1_OCTET_STRING_cmp(a,b) ASN1_STRING_cmp(\
-                (const ASN1_STRING *)a,(const ASN1_STRING *)b)
-#define M_ASN1_OCTET_STRING_set(a,b,c)  ASN1_STRING_set((ASN1_STRING *)a,b,c)
-#define M_ASN1_OCTET_STRING_print(a,b)  ASN1_STRING_print(a,(ASN1_STRING *)b)
-#define M_i2d_ASN1_OCTET_STRING(a,pp) \
-                i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_OCTET_STRING,\
-                V_ASN1_UNIVERSAL)
-
-#define B_ASN1_TIME \
-                        B_ASN1_UTCTIME | \
-                        B_ASN1_GENERALIZEDTIME
-
-#define B_ASN1_PRINTABLE \
-                        B_ASN1_NUMERICSTRING| \
-                        B_ASN1_PRINTABLESTRING| \
-                        B_ASN1_T61STRING| \
-                        B_ASN1_IA5STRING| \
-                        B_ASN1_BIT_STRING| \
-                        B_ASN1_UNIVERSALSTRING|\
-                        B_ASN1_BMPSTRING|\
-                        B_ASN1_UTF8STRING|\
-                        B_ASN1_SEQUENCE|\
-                        B_ASN1_UNKNOWN
-
-#define B_ASN1_DIRECTORYSTRING \
-                        B_ASN1_PRINTABLESTRING| \
-                        B_ASN1_TELETEXSTRING|\
-                        B_ASN1_BMPSTRING|\
-                        B_ASN1_UNIVERSALSTRING|\
-                        B_ASN1_UTF8STRING
-
-#define B_ASN1_DISPLAYTEXT \
-                        B_ASN1_IA5STRING| \
-                        B_ASN1_VISIBLESTRING| \
-                        B_ASN1_BMPSTRING|\
-                        B_ASN1_UTF8STRING
-
-#define M_ASN1_PRINTABLE_new()  ASN1_STRING_type_new(V_ASN1_T61STRING)
-#define M_ASN1_PRINTABLE_free(a)        ASN1_STRING_free((ASN1_STRING *)a)
-#define M_i2d_ASN1_PRINTABLE(a,pp) i2d_ASN1_bytes((ASN1_STRING *)a,\
-                pp,a->type,V_ASN1_UNIVERSAL)
-#define M_d2i_ASN1_PRINTABLE(a,pp,l) \
-                d2i_ASN1_type_bytes((ASN1_STRING **)a,pp,l, \
-                        B_ASN1_PRINTABLE)
-
-#define M_DIRECTORYSTRING_new() ASN1_STRING_type_new(V_ASN1_PRINTABLESTRING)
-#define M_DIRECTORYSTRING_free(a)       ASN1_STRING_free((ASN1_STRING *)a)
-#define M_i2d_DIRECTORYSTRING(a,pp) i2d_ASN1_bytes((ASN1_STRING *)a,\
-                                                pp,a->type,V_ASN1_UNIVERSAL)
-#define M_d2i_DIRECTORYSTRING(a,pp,l) \
-                d2i_ASN1_type_bytes((ASN1_STRING **)a,pp,l, \
-                        B_ASN1_DIRECTORYSTRING)
-
-#define M_DISPLAYTEXT_new() ASN1_STRING_type_new(V_ASN1_VISIBLESTRING)
-#define M_DISPLAYTEXT_free(a) ASN1_STRING_free((ASN1_STRING *)a)
-#define M_i2d_DISPLAYTEXT(a,pp) i2d_ASN1_bytes((ASN1_STRING *)a,\
-                                                pp,a->type,V_ASN1_UNIVERSAL)
-#define M_d2i_DISPLAYTEXT(a,pp,l) \
-                d2i_ASN1_type_bytes((ASN1_STRING **)a,pp,l, \
-                        B_ASN1_DISPLAYTEXT)
-
-#define M_ASN1_PRINTABLESTRING_new() (ASN1_PRINTABLESTRING *)\
-                ASN1_STRING_type_new(V_ASN1_PRINTABLESTRING)
-#define M_ASN1_PRINTABLESTRING_free(a)  ASN1_STRING_free((ASN1_STRING *)a)
-#define M_i2d_ASN1_PRINTABLESTRING(a,pp) \
-                i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_PRINTABLESTRING,\
-                V_ASN1_UNIVERSAL)
-#define M_d2i_ASN1_PRINTABLESTRING(a,pp,l) \
-                (ASN1_PRINTABLESTRING *)d2i_ASN1_type_bytes\
-                ((ASN1_STRING **)a,pp,l,B_ASN1_PRINTABLESTRING)
-
-#define M_ASN1_T61STRING_new()  (ASN1_T61STRING *)\
-                ASN1_STRING_type_new(V_ASN1_T61STRING)
-#define M_ASN1_T61STRING_free(a)        ASN1_STRING_free((ASN1_STRING *)a)
-#define M_i2d_ASN1_T61STRING(a,pp) \
-                i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_T61STRING,\
-                V_ASN1_UNIVERSAL)
-#define M_d2i_ASN1_T61STRING(a,pp,l) \
-                (ASN1_T61STRING *)d2i_ASN1_type_bytes\
-                ((ASN1_STRING **)a,pp,l,B_ASN1_T61STRING)
-
-#define M_ASN1_IA5STRING_new()  (ASN1_IA5STRING *)\
-                ASN1_STRING_type_new(V_ASN1_IA5STRING)
-#define M_ASN1_IA5STRING_free(a)        ASN1_STRING_free((ASN1_STRING *)a)
-#define M_ASN1_IA5STRING_dup(a) \
-                (ASN1_IA5STRING *)ASN1_STRING_dup((const ASN1_STRING *)a)
-#define M_i2d_ASN1_IA5STRING(a,pp) \
-                i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_IA5STRING,\
-                        V_ASN1_UNIVERSAL)
-#define M_d2i_ASN1_IA5STRING(a,pp,l) \
-                (ASN1_IA5STRING *)d2i_ASN1_type_bytes((ASN1_STRING **)a,pp,l,\
-                        B_ASN1_IA5STRING)
-
-#define M_ASN1_UTCTIME_new()    (ASN1_UTCTIME *)\
-                ASN1_STRING_type_new(V_ASN1_UTCTIME)
-#define M_ASN1_UTCTIME_free(a)  ASN1_STRING_free((ASN1_STRING *)a)
-#define M_ASN1_UTCTIME_dup(a) (ASN1_UTCTIME *)\
-                ASN1_STRING_dup((const ASN1_STRING *)a)
-
-#define M_ASN1_GENERALIZEDTIME_new()    (ASN1_GENERALIZEDTIME *)\
-                ASN1_STRING_type_new(V_ASN1_GENERALIZEDTIME)
-#define M_ASN1_GENERALIZEDTIME_free(a)  ASN1_STRING_free((ASN1_STRING *)a)
-#define M_ASN1_GENERALIZEDTIME_dup(a) (ASN1_GENERALIZEDTIME *)ASN1_STRING_dup(\
-        (const ASN1_STRING *)a)
-
-#define M_ASN1_TIME_new()       (ASN1_TIME *)\
-                ASN1_STRING_type_new(V_ASN1_UTCTIME)
-#define M_ASN1_TIME_free(a)     ASN1_STRING_free((ASN1_STRING *)a)
-#define M_ASN1_TIME_dup(a) (ASN1_TIME *)\
-        ASN1_STRING_dup((const ASN1_STRING *)a)
-
-#define M_ASN1_GENERALSTRING_new()      (ASN1_GENERALSTRING *)\
-                ASN1_STRING_type_new(V_ASN1_GENERALSTRING)
-#define M_ASN1_GENERALSTRING_free(a)    ASN1_STRING_free((ASN1_STRING *)a)
-#define M_i2d_ASN1_GENERALSTRING(a,pp) \
-                i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_GENERALSTRING,\
-                        V_ASN1_UNIVERSAL)
-#define M_d2i_ASN1_GENERALSTRING(a,pp,l) \
-                (ASN1_GENERALSTRING *)d2i_ASN1_type_bytes\
-                ((ASN1_STRING **)a,pp,l,B_ASN1_GENERALSTRING)
-
-#define M_ASN1_UNIVERSALSTRING_new()    (ASN1_UNIVERSALSTRING *)\
-                ASN1_STRING_type_new(V_ASN1_UNIVERSALSTRING)
-#define M_ASN1_UNIVERSALSTRING_free(a)  ASN1_STRING_free((ASN1_STRING *)a)
-#define M_i2d_ASN1_UNIVERSALSTRING(a,pp) \
-                i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_UNIVERSALSTRING,\
-                        V_ASN1_UNIVERSAL)
-#define M_d2i_ASN1_UNIVERSALSTRING(a,pp,l) \
-                (ASN1_UNIVERSALSTRING *)d2i_ASN1_type_bytes\
-                ((ASN1_STRING **)a,pp,l,B_ASN1_UNIVERSALSTRING)
-
-#define M_ASN1_BMPSTRING_new()  (ASN1_BMPSTRING *)\
-                ASN1_STRING_type_new(V_ASN1_BMPSTRING)
-#define M_ASN1_BMPSTRING_free(a)        ASN1_STRING_free((ASN1_STRING *)a)
-#define M_i2d_ASN1_BMPSTRING(a,pp) \
-                i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_BMPSTRING,\
-                        V_ASN1_UNIVERSAL)
-#define M_d2i_ASN1_BMPSTRING(a,pp,l) \
-                (ASN1_BMPSTRING *)d2i_ASN1_type_bytes\
-                ((ASN1_STRING **)a,pp,l,B_ASN1_BMPSTRING)
-
-#define M_ASN1_VISIBLESTRING_new()      (ASN1_VISIBLESTRING *)\
-                ASN1_STRING_type_new(V_ASN1_VISIBLESTRING)
-#define M_ASN1_VISIBLESTRING_free(a)    ASN1_STRING_free((ASN1_STRING *)a)
-#define M_i2d_ASN1_VISIBLESTRING(a,pp) \
-                i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_VISIBLESTRING,\
-                        V_ASN1_UNIVERSAL)
-#define M_d2i_ASN1_VISIBLESTRING(a,pp,l) \
-                (ASN1_VISIBLESTRING *)d2i_ASN1_type_bytes\
-                ((ASN1_STRING **)a,pp,l,B_ASN1_VISIBLESTRING)
-
-#define M_ASN1_UTF8STRING_new() (ASN1_UTF8STRING *)\
-                ASN1_STRING_type_new(V_ASN1_UTF8STRING)
-#define M_ASN1_UTF8STRING_free(a)       ASN1_STRING_free((ASN1_STRING *)a)
-#define M_i2d_ASN1_UTF8STRING(a,pp) \
-                i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_UTF8STRING,\
-                        V_ASN1_UNIVERSAL)
-#define M_d2i_ASN1_UTF8STRING(a,pp,l) \
-                (ASN1_UTF8STRING *)d2i_ASN1_type_bytes\
-                ((ASN1_STRING **)a,pp,l,B_ASN1_UTF8STRING)
-
-/* for the is_set parameter to i2d_ASN1_SET */
-#define IS_SEQUENCE     0
-#define IS_SET          1
-
-DECLARE_ASN1_FUNCTIONS_fname(ASN1_TYPE, ASN1_ANY, ASN1_TYPE)
-
-int ASN1_TYPE_get(ASN1_TYPE *a);
-void ASN1_TYPE_set(ASN1_TYPE *a, int type, void *value);
-int ASN1_TYPE_set1(ASN1_TYPE *a, int type, const void *value);
-int ASN1_TYPE_cmp(ASN1_TYPE *a, ASN1_TYPE *b);
-
-ASN1_OBJECT *ASN1_OBJECT_new(void );
-void ASN1_OBJECT_free(ASN1_OBJECT *a);
-int i2d_ASN1_OBJECT(ASN1_OBJECT *a, unsigned char **pp);
-ASN1_OBJECT *c2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
-    long length);
-ASN1_OBJECT *d2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
-    long length);
-
-DECLARE_ASN1_ITEM(ASN1_OBJECT)
-
-DECLARE_STACK_OF(ASN1_OBJECT)
-DECLARE_ASN1_SET_OF(ASN1_OBJECT)
-
-ASN1_STRING *ASN1_STRING_new(void);
-void ASN1_STRING_free(ASN1_STRING *a);
-int ASN1_STRING_copy(ASN1_STRING *dst, const ASN1_STRING *str);
-ASN1_STRING *ASN1_STRING_dup(const ASN1_STRING *a);
-ASN1_STRING *ASN1_STRING_type_new(int type );
-int ASN1_STRING_cmp(const ASN1_STRING *a, const ASN1_STRING *b);
-  /* Since this is used to store all sorts of things, via macros, for now, make
-     its data void * */
-int ASN1_STRING_set(ASN1_STRING *str, const void *data, int len);
-void ASN1_STRING_set0(ASN1_STRING *str, void *data, int len);
-int ASN1_STRING_length(const ASN1_STRING *x);
-void ASN1_STRING_length_set(ASN1_STRING *x, int n);
-int ASN1_STRING_type(ASN1_STRING *x);
-unsigned char * ASN1_STRING_data(ASN1_STRING *x);
-
-DECLARE_ASN1_FUNCTIONS(ASN1_BIT_STRING)
-int i2c_ASN1_BIT_STRING(ASN1_BIT_STRING *a, unsigned char **pp);
-ASN1_BIT_STRING *c2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a,
-    const unsigned char **pp, long length);
-int ASN1_BIT_STRING_set(ASN1_BIT_STRING *a, unsigned char *d, int length );
-int ASN1_BIT_STRING_set_bit(ASN1_BIT_STRING *a, int n, int value);
-int ASN1_BIT_STRING_get_bit(ASN1_BIT_STRING *a, int n);
-int ASN1_BIT_STRING_check(ASN1_BIT_STRING *a,
-    unsigned char *flags, int flags_len);
-
-#ifndef OPENSSL_NO_BIO
-int ASN1_BIT_STRING_name_print(BIO *out, ASN1_BIT_STRING *bs,
-    BIT_STRING_BITNAME *tbl, int indent);
-#endif
-int ASN1_BIT_STRING_num_asc(char *name, BIT_STRING_BITNAME *tbl);
-int ASN1_BIT_STRING_set_asc(ASN1_BIT_STRING *bs, char *name, int value,
-    BIT_STRING_BITNAME *tbl);
-
-int i2d_ASN1_BOOLEAN(int a, unsigned char **pp);
-int d2i_ASN1_BOOLEAN(int *a, const unsigned char **pp, long length);
-
-DECLARE_ASN1_FUNCTIONS(ASN1_INTEGER)
-int i2c_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **pp);
-ASN1_INTEGER *c2i_ASN1_INTEGER(ASN1_INTEGER **a, const unsigned char **pp,
-    long length);
-ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a, const unsigned char **pp,
-    long length);
-ASN1_INTEGER *  ASN1_INTEGER_dup(const ASN1_INTEGER *x);
-int ASN1_INTEGER_cmp(const ASN1_INTEGER *x, const ASN1_INTEGER *y);
-
-DECLARE_ASN1_FUNCTIONS(ASN1_ENUMERATED)
-
-int ASN1_UTCTIME_check(ASN1_UTCTIME *a);
-ASN1_UTCTIME *ASN1_UTCTIME_set(ASN1_UTCTIME *s, time_t t);
-ASN1_UTCTIME *ASN1_UTCTIME_adj(ASN1_UTCTIME *s, time_t t,
-    int offset_day, long offset_sec);
-int ASN1_UTCTIME_set_string(ASN1_UTCTIME *s, const char *str);
-int ASN1_UTCTIME_cmp_time_t(const ASN1_UTCTIME *s, time_t t);
-
-int ASN1_GENERALIZEDTIME_check(ASN1_GENERALIZEDTIME *a);
-ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_set(ASN1_GENERALIZEDTIME *s,
-    time_t t);
-ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_adj(ASN1_GENERALIZEDTIME *s,
-    time_t t, int offset_day, long offset_sec);
-int ASN1_GENERALIZEDTIME_set_string(ASN1_GENERALIZEDTIME *s, const char *str);
-
-DECLARE_ASN1_FUNCTIONS(ASN1_OCTET_STRING)
-ASN1_OCTET_STRING *ASN1_OCTET_STRING_dup(const ASN1_OCTET_STRING *a);
-int ASN1_OCTET_STRING_cmp(const ASN1_OCTET_STRING *a,
-    const ASN1_OCTET_STRING *b);
-int ASN1_OCTET_STRING_set(ASN1_OCTET_STRING *str, const unsigned char *data,
-    int len);
-
-DECLARE_ASN1_FUNCTIONS(ASN1_VISIBLESTRING)
-DECLARE_ASN1_FUNCTIONS(ASN1_UNIVERSALSTRING)
-DECLARE_ASN1_FUNCTIONS(ASN1_UTF8STRING)
-DECLARE_ASN1_FUNCTIONS(ASN1_NULL)
-DECLARE_ASN1_FUNCTIONS(ASN1_BMPSTRING)
-
-DECLARE_ASN1_FUNCTIONS_name(ASN1_STRING, ASN1_PRINTABLE)
-
-DECLARE_ASN1_FUNCTIONS_name(ASN1_STRING, DIRECTORYSTRING)
-DECLARE_ASN1_FUNCTIONS_name(ASN1_STRING, DISPLAYTEXT)
-DECLARE_ASN1_FUNCTIONS(ASN1_PRINTABLESTRING)
-DECLARE_ASN1_FUNCTIONS(ASN1_T61STRING)
-DECLARE_ASN1_FUNCTIONS(ASN1_IA5STRING)
-DECLARE_ASN1_FUNCTIONS(ASN1_GENERALSTRING)
-DECLARE_ASN1_FUNCTIONS(ASN1_UTCTIME)
-DECLARE_ASN1_FUNCTIONS(ASN1_GENERALIZEDTIME)
-DECLARE_ASN1_FUNCTIONS(ASN1_TIME)
-
-DECLARE_ASN1_ITEM(ASN1_OCTET_STRING_NDEF)
-
-ASN1_TIME *ASN1_TIME_set(ASN1_TIME *s, time_t t);
-ASN1_TIME *ASN1_TIME_adj(ASN1_TIME *s, time_t t, int offset_day,
-    long offset_sec);
-int ASN1_TIME_check(ASN1_TIME *t);
-ASN1_GENERALIZEDTIME *ASN1_TIME_to_generalizedtime(ASN1_TIME *t,
-    ASN1_GENERALIZEDTIME **out);
-int ASN1_TIME_set_string(ASN1_TIME *s, const char *str);
-
-int i2d_ASN1_SET(STACK_OF(OPENSSL_BLOCK) *a, unsigned char **pp,
-    i2d_of_void *i2d, int ex_tag, int ex_class, int is_set);
-STACK_OF(OPENSSL_BLOCK) *d2i_ASN1_SET(STACK_OF(OPENSSL_BLOCK) **a,
-    const unsigned char **pp, long length, d2i_of_void *d2i,
-    void (*free_func)(OPENSSL_BLOCK), int ex_tag, int ex_class);
-
-#ifndef OPENSSL_NO_BIO
-int i2a_ASN1_INTEGER(BIO *bp, ASN1_INTEGER *a);
-int a2i_ASN1_INTEGER(BIO *bp, ASN1_INTEGER *bs, char *buf, int size);
-int i2a_ASN1_ENUMERATED(BIO *bp, ASN1_ENUMERATED *a);
-int a2i_ASN1_ENUMERATED(BIO *bp, ASN1_ENUMERATED *bs, char *buf, int size);
-int i2a_ASN1_OBJECT(BIO *bp, ASN1_OBJECT *a);
-int a2i_ASN1_STRING(BIO *bp, ASN1_STRING *bs, char *buf, int size);
-int i2a_ASN1_STRING(BIO *bp, ASN1_STRING *a, int type);
-#endif
-int i2t_ASN1_OBJECT(char *buf, int buf_len, ASN1_OBJECT *a);
-
-int a2d_ASN1_OBJECT(unsigned char *out, int olen, const char *buf, int num);
-ASN1_OBJECT *ASN1_OBJECT_create(int nid, unsigned char *data, int len,
-    const char *sn, const char *ln);
-
-int ASN1_INTEGER_set(ASN1_INTEGER *a, long v);
-long ASN1_INTEGER_get(const ASN1_INTEGER *a);
-ASN1_INTEGER *BN_to_ASN1_INTEGER(const BIGNUM *bn, ASN1_INTEGER *ai);
-BIGNUM *ASN1_INTEGER_to_BN(const ASN1_INTEGER *ai, BIGNUM *bn);
-
-int ASN1_ENUMERATED_set(ASN1_ENUMERATED *a, long v);
-long ASN1_ENUMERATED_get(ASN1_ENUMERATED *a);
-ASN1_ENUMERATED *BN_to_ASN1_ENUMERATED(BIGNUM *bn, ASN1_ENUMERATED *ai);
-BIGNUM *ASN1_ENUMERATED_to_BN(ASN1_ENUMERATED *ai, BIGNUM *bn);
-
-/* General */
-/* given a string, return the correct type, max is the maximum length */
-int ASN1_PRINTABLE_type(const unsigned char *s, int max);
-
-int i2d_ASN1_bytes(ASN1_STRING *a, unsigned char **pp, int tag, int xclass);
-ASN1_STRING *d2i_ASN1_bytes(ASN1_STRING **a, const unsigned char **pp,
-    long length, int Ptag, int Pclass);
-unsigned long ASN1_tag2bit(int tag);
-/* type is one or more of the B_ASN1_ values. */
-ASN1_STRING *d2i_ASN1_type_bytes(ASN1_STRING **a, const unsigned char **pp,
-    long length, int type);
-
-/* PARSING */
-int asn1_Finish(ASN1_CTX *c);
-int asn1_const_Finish(ASN1_const_CTX *c);
-
-/* SPECIALS */
-int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
-    int *pclass, long omax);
-int ASN1_check_infinite_end(unsigned char **p, long len);
-int ASN1_const_check_infinite_end(const unsigned char **p, long len);
-void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
-    int xclass);
-int ASN1_put_eoc(unsigned char **pp);
-int ASN1_object_size(int constructed, int length, int tag);
-
-/* Used to implement other functions */
-void *ASN1_dup(i2d_of_void *i2d, d2i_of_void *d2i, void *x);
-
-#define ASN1_dup_of(type,i2d,d2i,x) \
-    ((type*)ASN1_dup(CHECKED_I2D_OF(type, i2d), \
-                     CHECKED_D2I_OF(type, d2i), \
-                     CHECKED_PTR_OF(type, x)))
-
-#define ASN1_dup_of_const(type,i2d,d2i,x) \
-    ((type*)ASN1_dup(CHECKED_I2D_OF(const type, i2d), \
-                     CHECKED_D2I_OF(type, d2i), \
-                     CHECKED_PTR_OF(const type, x)))
-
-void *ASN1_item_dup(const ASN1_ITEM *it, void *x);
-
-/* ASN1 alloc/free macros for when a type is only used internally */
-
-#define M_ASN1_new_of(type) (type *)ASN1_item_new(ASN1_ITEM_rptr(type))
-#define M_ASN1_free_of(x, type) \
-                ASN1_item_free(CHECKED_PTR_OF(type, x), ASN1_ITEM_rptr(type))
-
-void *ASN1_d2i_fp(void *(*xnew)(void), d2i_of_void *d2i, FILE *in, void **x);
-
-#define ASN1_d2i_fp_of(type,xnew,d2i,in,x) \
-    ((type*)ASN1_d2i_fp(CHECKED_NEW_OF(type, xnew), \
-                        CHECKED_D2I_OF(type, d2i), \
-                        in, \
-                        CHECKED_PPTR_OF(type, x)))
-
-void *ASN1_item_d2i_fp(const ASN1_ITEM *it, FILE *in, void *x);
-int ASN1_i2d_fp(i2d_of_void *i2d, FILE *out, void *x);
-
-#define ASN1_i2d_fp_of(type,i2d,out,x) \
-    (ASN1_i2d_fp(CHECKED_I2D_OF(type, i2d), \
-                 out, \
-                 CHECKED_PTR_OF(type, x)))
-
-#define ASN1_i2d_fp_of_const(type,i2d,out,x) \
-    (ASN1_i2d_fp(CHECKED_I2D_OF(const type, i2d), \
-                 out, \
-                 CHECKED_PTR_OF(const type, x)))
-
-int ASN1_item_i2d_fp(const ASN1_ITEM *it, FILE *out, void *x);
-int ASN1_STRING_print_ex_fp(FILE *fp, ASN1_STRING *str, unsigned long flags);
-
-int ASN1_STRING_to_UTF8(unsigned char **out, ASN1_STRING *in);
-
-#ifndef OPENSSL_NO_BIO
-void *ASN1_d2i_bio(void *(*xnew)(void), d2i_of_void *d2i, BIO *in, void **x);
-
-#define ASN1_d2i_bio_of(type,xnew,d2i,in,x) \
-    ((type*)ASN1_d2i_bio( CHECKED_NEW_OF(type, xnew), \
-                          CHECKED_D2I_OF(type, d2i), \
-                          in, \
-                          CHECKED_PPTR_OF(type, x)))
-
-void *ASN1_item_d2i_bio(const ASN1_ITEM *it, BIO *in, void *x);
-int ASN1_i2d_bio(i2d_of_void *i2d, BIO *out, unsigned char *x);
-
-#define ASN1_i2d_bio_of(type,i2d,out,x) \
-    (ASN1_i2d_bio(CHECKED_I2D_OF(type, i2d), \
-                  out, \
-                  CHECKED_PTR_OF(type, x)))
-
-#define ASN1_i2d_bio_of_const(type,i2d,out,x) \
-    (ASN1_i2d_bio(CHECKED_I2D_OF(const type, i2d), \
-                  out, \
-                  CHECKED_PTR_OF(const type, x)))
-
-int ASN1_item_i2d_bio(const ASN1_ITEM *it, BIO *out, void *x);
-int ASN1_UTCTIME_print(BIO *fp, const ASN1_UTCTIME *a);
-int ASN1_GENERALIZEDTIME_print(BIO *fp, const ASN1_GENERALIZEDTIME *a);
-int ASN1_TIME_print(BIO *fp, const ASN1_TIME *a);
-int ASN1_STRING_print(BIO *bp, const ASN1_STRING *v);
-int ASN1_STRING_print_ex(BIO *out, ASN1_STRING *str, unsigned long flags);
-int ASN1_bn_print(BIO *bp, const char *number, const BIGNUM *num,
-    unsigned char *buf, int off);
-int ASN1_parse(BIO *bp, const unsigned char *pp, long len, int indent);
-int ASN1_parse_dump(BIO *bp, const unsigned char *pp, long len, int indent, int dump);
-#endif
-const char *ASN1_tag2str(int tag);
-
-/* Used to load and write netscape format cert */
-
-DECLARE_ASN1_FUNCTIONS(NETSCAPE_X509)
-
-int ASN1_UNIVERSALSTRING_to_string(ASN1_UNIVERSALSTRING *s);
-
-int ASN1_TYPE_set_octetstring(ASN1_TYPE *a, unsigned char *data, int len);
-int ASN1_TYPE_get_octetstring(ASN1_TYPE *a, unsigned char *data, int max_len);
-int ASN1_TYPE_set_int_octetstring(ASN1_TYPE *a, long num, unsigned char *data,
-    int len);
-int ASN1_TYPE_get_int_octetstring(ASN1_TYPE *a, long *num, unsigned char *data,
-    int max_len);
-
-STACK_OF(OPENSSL_BLOCK) *ASN1_seq_unpack(const unsigned char *buf, int len,
-    d2i_of_void *d2i, void (*free_func)(OPENSSL_BLOCK));
-unsigned char *ASN1_seq_pack(STACK_OF(OPENSSL_BLOCK) *safes, i2d_of_void *i2d,
-    unsigned char **buf, int *len );
-void *ASN1_unpack_string(ASN1_STRING *oct, d2i_of_void *d2i);
-void *ASN1_item_unpack(ASN1_STRING *oct, const ASN1_ITEM *it);
-ASN1_STRING *ASN1_pack_string(void *obj, i2d_of_void *i2d,
-    ASN1_OCTET_STRING **oct);
-
-ASN1_STRING *ASN1_item_pack(void *obj, const ASN1_ITEM *it,
-    ASN1_OCTET_STRING **oct);
-
-void ASN1_STRING_set_default_mask(unsigned long mask);
-int ASN1_STRING_set_default_mask_asc(const char *p);
-unsigned long ASN1_STRING_get_default_mask(void);
-int ASN1_mbstring_copy(ASN1_STRING **out, const unsigned char *in, int len,
-    int inform, unsigned long mask);
-int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
-    int inform, unsigned long mask, long minsize, long maxsize);
-
-ASN1_STRING *ASN1_STRING_set_by_NID(ASN1_STRING **out,
-    const unsigned char *in, int inlen, int inform, int nid);
-ASN1_STRING_TABLE *ASN1_STRING_TABLE_get(int nid);
-int ASN1_STRING_TABLE_add(int, long, long, unsigned long, unsigned long);
-void ASN1_STRING_TABLE_cleanup(void);
-
-/* ASN1 template functions */
-
-/* Old API compatible functions */
-ASN1_VALUE *ASN1_item_new(const ASN1_ITEM *it);
-void ASN1_item_free(ASN1_VALUE *val, const ASN1_ITEM *it);
-ASN1_VALUE * ASN1_item_d2i(ASN1_VALUE **val, const unsigned char **in,
-    long len, const ASN1_ITEM *it);
-int ASN1_item_i2d(ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it);
-int ASN1_item_ndef_i2d(ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it);
-
-void ASN1_add_oid_module(void);
-
-ASN1_TYPE *ASN1_generate_nconf(char *str, CONF *nconf);
-ASN1_TYPE *ASN1_generate_v3(char *str, X509V3_CTX *cnf);
-
-/* ASN1 Print flags */
-
-/* Indicate missing OPTIONAL fields */
-#define ASN1_PCTX_FLAGS_SHOW_ABSENT             0x001
-/* Mark start and end of SEQUENCE */
-#define ASN1_PCTX_FLAGS_SHOW_SEQUENCE           0x002
-/* Mark start and end of SEQUENCE/SET OF */
-#define ASN1_PCTX_FLAGS_SHOW_SSOF               0x004
-/* Show the ASN1 type of primitives */
-#define ASN1_PCTX_FLAGS_SHOW_TYPE               0x008
-/* Don't show ASN1 type of ANY */
-#define ASN1_PCTX_FLAGS_NO_ANY_TYPE             0x010
-/* Don't show ASN1 type of MSTRINGs */
-#define ASN1_PCTX_FLAGS_NO_MSTRING_TYPE         0x020
-/* Don't show field names in SEQUENCE */
-#define ASN1_PCTX_FLAGS_NO_FIELD_NAME           0x040
-/* Show structure names of each SEQUENCE field */
-#define ASN1_PCTX_FLAGS_SHOW_FIELD_STRUCT_NAME  0x080
-/* Don't show structure name even at top level */
-#define ASN1_PCTX_FLAGS_NO_STRUCT_NAME          0x100
-
-int ASN1_item_print(BIO *out, ASN1_VALUE *ifld, int indent,
-    const ASN1_ITEM *it, const ASN1_PCTX *pctx);
-ASN1_PCTX *ASN1_PCTX_new(void);
-void ASN1_PCTX_free(ASN1_PCTX *p);
-unsigned long ASN1_PCTX_get_flags(ASN1_PCTX *p);
-void ASN1_PCTX_set_flags(ASN1_PCTX *p, unsigned long flags);
-unsigned long ASN1_PCTX_get_nm_flags(ASN1_PCTX *p);
-void ASN1_PCTX_set_nm_flags(ASN1_PCTX *p, unsigned long flags);
-unsigned long ASN1_PCTX_get_cert_flags(ASN1_PCTX *p);
-void ASN1_PCTX_set_cert_flags(ASN1_PCTX *p, unsigned long flags);
-unsigned long ASN1_PCTX_get_oid_flags(ASN1_PCTX *p);
-void ASN1_PCTX_set_oid_flags(ASN1_PCTX *p, unsigned long flags);
-unsigned long ASN1_PCTX_get_str_flags(ASN1_PCTX *p);
-void ASN1_PCTX_set_str_flags(ASN1_PCTX *p, unsigned long flags);
-
-BIO_METHOD *BIO_f_asn1(void);
-
-BIO *BIO_new_NDEF(BIO *out, ASN1_VALUE *val, const ASN1_ITEM *it);
-
-int i2d_ASN1_bio_stream(BIO *out, ASN1_VALUE *val, BIO *in, int flags,
-    const ASN1_ITEM *it);
-int PEM_write_bio_ASN1_stream(BIO *out, ASN1_VALUE *val, BIO *in, int flags,
-    const char *hdr, const ASN1_ITEM *it);
-int SMIME_write_ASN1(BIO *bio, ASN1_VALUE *val, BIO *data, int flags,
-    int ctype_nid, int econt_nid, STACK_OF(X509_ALGOR) *mdalgs,
-    const ASN1_ITEM *it);
-ASN1_VALUE *SMIME_read_ASN1(BIO *bio, BIO **bcont, const ASN1_ITEM *it);
-int SMIME_crlf_copy(BIO *in, BIO *out, int flags);
-int SMIME_text(BIO *in, BIO *out);
-
-/* BEGIN ERROR CODES */
-/* The following lines are auto generated by the script mkerr.pl. Any changes
- * made after this point may be overwritten when the script is next run.
- */
-void ERR_load_ASN1_strings(void);
-
-/* Error codes for the ASN1 functions. */
-
-/* Function codes. */
-#define ASN1_F_A2D_ASN1_OBJECT                           100
-#define ASN1_F_A2I_ASN1_ENUMERATED                       101
-#define ASN1_F_A2I_ASN1_INTEGER                          102
-#define ASN1_F_A2I_ASN1_STRING                           103
-#define ASN1_F_APPEND_EXP                                176
-#define ASN1_F_ASN1_BIT_STRING_SET_BIT                   183
-#define ASN1_F_ASN1_CB                                   177
-#define ASN1_F_ASN1_CHECK_TLEN                           104
-#define ASN1_F_ASN1_COLLATE_PRIMITIVE                    105
-#define ASN1_F_ASN1_COLLECT                              106
-#define ASN1_F_ASN1_D2I_EX_PRIMITIVE                     108
-#define ASN1_F_ASN1_D2I_FP                               109
-#define ASN1_F_ASN1_D2I_READ_BIO                         107
-#define ASN1_F_ASN1_DIGEST                               184
-#define ASN1_F_ASN1_DO_ADB                               110
-#define ASN1_F_ASN1_DUP                                  111
-#define ASN1_F_ASN1_ENUMERATED_SET                       112
-#define ASN1_F_ASN1_ENUMERATED_TO_BN                     113
-#define ASN1_F_ASN1_EX_C2I                               204
-#define ASN1_F_ASN1_FIND_END                             190
-#define ASN1_F_ASN1_GENERALIZEDTIME_ADJ                  216
-#define ASN1_F_ASN1_GENERALIZEDTIME_SET                  185
-#define ASN1_F_ASN1_GENERATE_V3                          178
-#define ASN1_F_ASN1_GET_OBJECT                           114
-#define ASN1_F_ASN1_HEADER_NEW                           115
-#define ASN1_F_ASN1_I2D_BIO                              116
-#define ASN1_F_ASN1_I2D_FP                               117
-#define ASN1_F_ASN1_INTEGER_SET                          118
-#define ASN1_F_ASN1_INTEGER_TO_BN                        119
-#define ASN1_F_ASN1_ITEM_D2I_FP                          206
-#define ASN1_F_ASN1_ITEM_DUP                             191
-#define ASN1_F_ASN1_ITEM_EX_COMBINE_NEW                  121
-#define ASN1_F_ASN1_ITEM_EX_D2I                          120
-#define ASN1_F_ASN1_ITEM_I2D_BIO                         192
-#define ASN1_F_ASN1_ITEM_I2D_FP                          193
-#define ASN1_F_ASN1_ITEM_PACK                            198
-#define ASN1_F_ASN1_ITEM_SIGN                            195
-#define ASN1_F_ASN1_ITEM_SIGN_CTX                        220
-#define ASN1_F_ASN1_ITEM_UNPACK                          199
-#define ASN1_F_ASN1_ITEM_VERIFY                          197
-#define ASN1_F_ASN1_MBSTRING_NCOPY                       122
-#define ASN1_F_ASN1_OBJECT_NEW                           123
-#define ASN1_F_ASN1_OUTPUT_DATA                          214
-#define ASN1_F_ASN1_PACK_STRING                          124
-#define ASN1_F_ASN1_PCTX_NEW                             205
-#define ASN1_F_ASN1_PKCS5_PBE_SET                        125
-#define ASN1_F_ASN1_SEQ_PACK                             126
-#define ASN1_F_ASN1_SEQ_UNPACK                           127
-#define ASN1_F_ASN1_SIGN                                 128
-#define ASN1_F_ASN1_STR2TYPE                             179
-#define ASN1_F_ASN1_STRING_SET                           186
-#define ASN1_F_ASN1_STRING_TABLE_ADD                     129
-#define ASN1_F_ASN1_STRING_TYPE_NEW                      130
-#define ASN1_F_ASN1_TEMPLATE_EX_D2I                      132
-#define ASN1_F_ASN1_TEMPLATE_NEW                         133
-#define ASN1_F_ASN1_TEMPLATE_NOEXP_D2I                   131
-#define ASN1_F_ASN1_TIME_ADJ                             217
-#define ASN1_F_ASN1_TIME_SET                             175
-#define ASN1_F_ASN1_TYPE_GET_INT_OCTETSTRING             134
-#define ASN1_F_ASN1_TYPE_GET_OCTETSTRING                 135
-#define ASN1_F_ASN1_UNPACK_STRING                        136
-#define ASN1_F_ASN1_UTCTIME_ADJ                          218
-#define ASN1_F_ASN1_UTCTIME_SET                          187
-#define ASN1_F_ASN1_VERIFY                               137
-#define ASN1_F_B64_READ_ASN1                             209
-#define ASN1_F_B64_WRITE_ASN1                            210
-#define ASN1_F_BIO_NEW_NDEF                              208
-#define ASN1_F_BITSTR_CB                                 180
-#define ASN1_F_BN_TO_ASN1_ENUMERATED                     138
-#define ASN1_F_BN_TO_ASN1_INTEGER                        139
-#define ASN1_F_C2I_ASN1_BIT_STRING                       189
-#define ASN1_F_C2I_ASN1_INTEGER                          194
-#define ASN1_F_C2I_ASN1_OBJECT                           196
-#define ASN1_F_COLLECT_DATA                              140
-#define ASN1_F_D2I_ASN1_BIT_STRING                       141
-#define ASN1_F_D2I_ASN1_BOOLEAN                          142
-#define ASN1_F_D2I_ASN1_BYTES                            143
-#define ASN1_F_D2I_ASN1_GENERALIZEDTIME                  144
-#define ASN1_F_D2I_ASN1_HEADER                           145
-#define ASN1_F_D2I_ASN1_INTEGER                          146
-#define ASN1_F_D2I_ASN1_OBJECT                           147
-#define ASN1_F_D2I_ASN1_SET                              148
-#define ASN1_F_D2I_ASN1_TYPE_BYTES                       149
-#define ASN1_F_D2I_ASN1_UINTEGER                         150
-#define ASN1_F_D2I_ASN1_UTCTIME                          151
-#define ASN1_F_D2I_AUTOPRIVATEKEY                        207
-#define ASN1_F_D2I_NETSCAPE_RSA                          152
-#define ASN1_F_D2I_NETSCAPE_RSA_2                        153
-#define ASN1_F_D2I_PRIVATEKEY                            154
-#define ASN1_F_D2I_PUBLICKEY                             155
-#define ASN1_F_D2I_RSA_NET                               200
-#define ASN1_F_D2I_RSA_NET_2                             201
-#define ASN1_F_D2I_X509                                  156
-#define ASN1_F_D2I_X509_CINF                             157
-#define ASN1_F_D2I_X509_PKEY                             159
-#define ASN1_F_I2D_ASN1_BIO_STREAM                       211
-#define ASN1_F_I2D_ASN1_SET                              188
-#define ASN1_F_I2D_ASN1_TIME                             160
-#define ASN1_F_I2D_DSA_PUBKEY                            161
-#define ASN1_F_I2D_EC_PUBKEY                             181
-#define ASN1_F_I2D_PRIVATEKEY                            163
-#define ASN1_F_I2D_PUBLICKEY                             164
-#define ASN1_F_I2D_RSA_NET                               162
-#define ASN1_F_I2D_RSA_PUBKEY                            165
-#define ASN1_F_LONG_C2I                                  166
-#define ASN1_F_OID_MODULE_INIT                           174
-#define ASN1_F_PARSE_TAGGING                             182
-#define ASN1_F_PKCS5_PBE2_SET_IV                         167
-#define ASN1_F_PKCS5_PBE_SET                             202
-#define ASN1_F_PKCS5_PBE_SET0_ALGOR                      215
-#define ASN1_F_PKCS5_PBKDF2_SET                          219
-#define ASN1_F_SMIME_READ_ASN1                           212
-#define ASN1_F_SMIME_TEXT                                213
-#define ASN1_F_X509_CINF_NEW                             168
-#define ASN1_F_X509_CRL_ADD0_REVOKED                     169
-#define ASN1_F_X509_INFO_NEW                             170
-#define ASN1_F_X509_NAME_ENCODE                          203
-#define ASN1_F_X509_NAME_EX_D2I                          158
-#define ASN1_F_X509_NAME_EX_NEW                          171
-#define ASN1_F_X509_NEW                                  172
-#define ASN1_F_X509_PKEY_NEW                             173
-
-/* Reason codes. */
-#define ASN1_R_ADDING_OBJECT                             171
-#define ASN1_R_ASN1_PARSE_ERROR                          203
-#define ASN1_R_ASN1_SIG_PARSE_ERROR                      204
-#define ASN1_R_AUX_ERROR                                 100
-#define ASN1_R_BAD_CLASS                                 101
-#define ASN1_R_BAD_OBJECT_HEADER                         102
-#define ASN1_R_BAD_PASSWORD_READ                         103
-#define ASN1_R_BAD_TAG                                   104
-#define ASN1_R_BMPSTRING_IS_WRONG_LENGTH                 214
-#define ASN1_R_BN_LIB                                    105
-#define ASN1_R_BOOLEAN_IS_WRONG_LENGTH                   106
-#define ASN1_R_BUFFER_TOO_SMALL                          107
-#define ASN1_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER           108
-#define ASN1_R_CONTEXT_NOT_INITIALISED                   217
-#define ASN1_R_DATA_IS_WRONG                             109
-#define ASN1_R_DECODE_ERROR                              110
-#define ASN1_R_DECODING_ERROR                            111
-#define ASN1_R_DEPTH_EXCEEDED                            174
-#define ASN1_R_DIGEST_AND_KEY_TYPE_NOT_SUPPORTED         198
-#define ASN1_R_ENCODE_ERROR                              112
-#define ASN1_R_ERROR_GETTING_TIME                        173
-#define ASN1_R_ERROR_LOADING_SECTION                     172
-#define ASN1_R_ERROR_PARSING_SET_ELEMENT                 113
-#define ASN1_R_ERROR_SETTING_CIPHER_PARAMS               114
-#define ASN1_R_EXPECTING_AN_INTEGER                      115
-#define ASN1_R_EXPECTING_AN_OBJECT                       116
-#define ASN1_R_EXPECTING_A_BOOLEAN                       117
-#define ASN1_R_EXPECTING_A_TIME                          118
-#define ASN1_R_EXPLICIT_LENGTH_MISMATCH                  119
-#define ASN1_R_EXPLICIT_TAG_NOT_CONSTRUCTED              120
-#define ASN1_R_FIELD_MISSING                             121
-#define ASN1_R_FIRST_NUM_TOO_LARGE                       122
-#define ASN1_R_HEADER_TOO_LONG                           123
-#define ASN1_R_ILLEGAL_BITSTRING_FORMAT                  175
-#define ASN1_R_ILLEGAL_BOOLEAN                           176
-#define ASN1_R_ILLEGAL_CHARACTERS                        124
-#define ASN1_R_ILLEGAL_FORMAT                            177
-#define ASN1_R_ILLEGAL_HEX                               178
-#define ASN1_R_ILLEGAL_IMPLICIT_TAG                      179
-#define ASN1_R_ILLEGAL_INTEGER                           180
-#define ASN1_R_ILLEGAL_NESTED_TAGGING                    181
-#define ASN1_R_ILLEGAL_NULL                              125
-#define ASN1_R_ILLEGAL_NULL_VALUE                        182
-#define ASN1_R_ILLEGAL_OBJECT                            183
-#define ASN1_R_ILLEGAL_OPTIONAL_ANY                      126
-#define ASN1_R_ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE          170
-#define ASN1_R_ILLEGAL_TAGGED_ANY                        127
-#define ASN1_R_ILLEGAL_TIME_VALUE                        184
-#define ASN1_R_INTEGER_NOT_ASCII_FORMAT                  185
-#define ASN1_R_INTEGER_TOO_LARGE_FOR_LONG                128
-#define ASN1_R_INVALID_BIT_STRING_BITS_LEFT              220
-#define ASN1_R_INVALID_BMPSTRING_LENGTH                  129
-#define ASN1_R_INVALID_DIGIT                             130
-#define ASN1_R_INVALID_MIME_TYPE                         205
-#define ASN1_R_INVALID_MODIFIER                          186
-#define ASN1_R_INVALID_NUMBER                            187
-#define ASN1_R_INVALID_OBJECT_ENCODING                   216
-#define ASN1_R_INVALID_SEPARATOR                         131
-#define ASN1_R_INVALID_TIME_FORMAT                       132
-#define ASN1_R_INVALID_UNIVERSALSTRING_LENGTH            133
-#define ASN1_R_INVALID_UTF8STRING                        134
-#define ASN1_R_IV_TOO_LARGE                              135
-#define ASN1_R_LENGTH_ERROR                              136
-#define ASN1_R_LIST_ERROR                                188
-#define ASN1_R_MIME_NO_CONTENT_TYPE                      206
-#define ASN1_R_MIME_PARSE_ERROR                          207
-#define ASN1_R_MIME_SIG_PARSE_ERROR                      208
-#define ASN1_R_MISSING_EOC                               137
-#define ASN1_R_MISSING_SECOND_NUMBER                     138
-#define ASN1_R_MISSING_VALUE                             189
-#define ASN1_R_MSTRING_NOT_UNIVERSAL                     139
-#define ASN1_R_MSTRING_WRONG_TAG                         140
-#define ASN1_R_NESTED_ASN1_STRING                        197
-#define ASN1_R_NON_HEX_CHARACTERS                        141
-#define ASN1_R_NOT_ASCII_FORMAT                          190
-#define ASN1_R_NOT_ENOUGH_DATA                           142
-#define ASN1_R_NO_CONTENT_TYPE                           209
-#define ASN1_R_NO_DEFAULT_DIGEST                         201
-#define ASN1_R_NO_MATCHING_CHOICE_TYPE                   143
-#define ASN1_R_NO_MULTIPART_BODY_FAILURE                 210
-#define ASN1_R_NO_MULTIPART_BOUNDARY                     211
-#define ASN1_R_NO_SIG_CONTENT_TYPE                       212
-#define ASN1_R_NULL_IS_WRONG_LENGTH                      144
-#define ASN1_R_OBJECT_NOT_ASCII_FORMAT                   191
-#define ASN1_R_ODD_NUMBER_OF_CHARS                       145
-#define ASN1_R_PRIVATE_KEY_HEADER_MISSING                146
-#define ASN1_R_SECOND_NUMBER_TOO_LARGE                   147
-#define ASN1_R_SEQUENCE_LENGTH_MISMATCH                  148
-#define ASN1_R_SEQUENCE_NOT_CONSTRUCTED                  149
-#define ASN1_R_SEQUENCE_OR_SET_NEEDS_CONFIG              192
-#define ASN1_R_SHORT_LINE                                150
-#define ASN1_R_SIG_INVALID_MIME_TYPE                     213
-#define ASN1_R_STREAMING_NOT_SUPPORTED                   202
-#define ASN1_R_STRING_TOO_LONG                           151
-#define ASN1_R_STRING_TOO_SHORT                          152
-#define ASN1_R_TAG_VALUE_TOO_HIGH                        153
-#define ASN1_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD 154
-#define ASN1_R_TIME_NOT_ASCII_FORMAT                     193
-#define ASN1_R_TOO_LONG                                  155
-#define ASN1_R_TYPE_NOT_CONSTRUCTED                      156
-#define ASN1_R_UNABLE_TO_DECODE_RSA_KEY                  157
-#define ASN1_R_UNABLE_TO_DECODE_RSA_PRIVATE_KEY          158
-#define ASN1_R_UNEXPECTED_EOC                            159
-#define ASN1_R_UNIVERSALSTRING_IS_WRONG_LENGTH           215
-#define ASN1_R_UNKNOWN_FORMAT                            160
-#define ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM          161
-#define ASN1_R_UNKNOWN_OBJECT_TYPE                       162
-#define ASN1_R_UNKNOWN_PUBLIC_KEY_TYPE                   163
-#define ASN1_R_UNKNOWN_SIGNATURE_ALGORITHM               199
-#define ASN1_R_UNKNOWN_TAG                               194
-#define ASN1_R_UNKOWN_FORMAT                             195
-#define ASN1_R_UNSUPPORTED_ANY_DEFINED_BY_TYPE           164
-#define ASN1_R_UNSUPPORTED_CIPHER                        165
-#define ASN1_R_UNSUPPORTED_ENCRYPTION_ALGORITHM          166
-#define ASN1_R_UNSUPPORTED_PUBLIC_KEY_TYPE               167
-#define ASN1_R_UNSUPPORTED_TYPE                          196
-#define ASN1_R_WRONG_PUBLIC_KEY_TYPE                     200
-#define ASN1_R_WRONG_TAG                                 168
-#define ASN1_R_WRONG_TYPE                                169
-
-#ifdef  __cplusplus
-}
-#endif
-#endif
diff --git a/src/lib/libcrypto/asn1/asn1_err.c b/src/lib/libcrypto/asn1/asn1_err.c
deleted file mode 100644
index 8fd5cf6765..0000000000
--- a/src/lib/libcrypto/asn1/asn1_err.c
+++ /dev/null
@@ -1,333 +0,0 @@
-/* $OpenBSD: asn1_err.c,v 1.19 2015/02/15 14:35:30 miod Exp $ */
-/* ====================================================================
- * Copyright (c) 1999-2011 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    openssl-core@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-/* NOTE: this file was auto generated by the mkerr.pl script: any changes
- * made to it will be overwritten when the script next updates this file,
- * only reason strings will be preserved.
- */
-
-#include <stdio.h>
-
-#include <openssl/opensslconf.h>
-
-#include <openssl/err.h>
-#include <openssl/asn1.h>
-
-/* BEGIN ERROR CODES */
-#ifndef OPENSSL_NO_ERR
-
-#define ERR_FUNC(func) ERR_PACK(ERR_LIB_ASN1,func,0)
-#define ERR_REASON(reason) ERR_PACK(ERR_LIB_ASN1,0,reason)
-
-static ERR_STRING_DATA ASN1_str_functs[] = {
-        {ERR_FUNC(ASN1_F_A2D_ASN1_OBJECT), "a2d_ASN1_OBJECT"},
-        {ERR_FUNC(ASN1_F_A2I_ASN1_ENUMERATED), "a2i_ASN1_ENUMERATED"},
-        {ERR_FUNC(ASN1_F_A2I_ASN1_INTEGER), "a2i_ASN1_INTEGER"},
-        {ERR_FUNC(ASN1_F_A2I_ASN1_STRING), "a2i_ASN1_STRING"},
-        {ERR_FUNC(ASN1_F_APPEND_EXP), "APPEND_EXP"},
-        {ERR_FUNC(ASN1_F_ASN1_BIT_STRING_SET_BIT), "ASN1_BIT_STRING_set_bit"},
-        {ERR_FUNC(ASN1_F_ASN1_CB), "ASN1_CB"},
-        {ERR_FUNC(ASN1_F_ASN1_CHECK_TLEN), "ASN1_CHECK_TLEN"},
-        {ERR_FUNC(ASN1_F_ASN1_COLLATE_PRIMITIVE), "ASN1_COLLATE_PRIMITIVE"},
-        {ERR_FUNC(ASN1_F_ASN1_COLLECT), "ASN1_COLLECT"},
-        {ERR_FUNC(ASN1_F_ASN1_D2I_EX_PRIMITIVE), "ASN1_D2I_EX_PRIMITIVE"},
-        {ERR_FUNC(ASN1_F_ASN1_D2I_FP), "ASN1_d2i_fp"},
-        {ERR_FUNC(ASN1_F_ASN1_D2I_READ_BIO), "ASN1_D2I_READ_BIO"},
-        {ERR_FUNC(ASN1_F_ASN1_DIGEST), "ASN1_digest"},
-        {ERR_FUNC(ASN1_F_ASN1_DO_ADB), "ASN1_DO_ADB"},
-        {ERR_FUNC(ASN1_F_ASN1_DUP), "ASN1_dup"},
-        {ERR_FUNC(ASN1_F_ASN1_ENUMERATED_SET), "ASN1_ENUMERATED_set"},
-        {ERR_FUNC(ASN1_F_ASN1_ENUMERATED_TO_BN), "ASN1_ENUMERATED_to_BN"},
-        {ERR_FUNC(ASN1_F_ASN1_EX_C2I), "ASN1_EX_C2I"},
-        {ERR_FUNC(ASN1_F_ASN1_FIND_END), "ASN1_FIND_END"},
-        {ERR_FUNC(ASN1_F_ASN1_GENERALIZEDTIME_ADJ), "ASN1_GENERALIZEDTIME_adj"},
-        {ERR_FUNC(ASN1_F_ASN1_GENERALIZEDTIME_SET), "ASN1_GENERALIZEDTIME_set"},
-        {ERR_FUNC(ASN1_F_ASN1_GENERATE_V3), "ASN1_generate_v3"},
-        {ERR_FUNC(ASN1_F_ASN1_GET_OBJECT), "ASN1_get_object"},
-        {ERR_FUNC(ASN1_F_ASN1_HEADER_NEW), "ASN1_HEADER_NEW"},
-        {ERR_FUNC(ASN1_F_ASN1_I2D_BIO), "ASN1_i2d_bio"},
-        {ERR_FUNC(ASN1_F_ASN1_I2D_FP), "ASN1_i2d_fp"},
-        {ERR_FUNC(ASN1_F_ASN1_INTEGER_SET), "ASN1_INTEGER_set"},
-        {ERR_FUNC(ASN1_F_ASN1_INTEGER_TO_BN), "ASN1_INTEGER_to_BN"},
-        {ERR_FUNC(ASN1_F_ASN1_ITEM_D2I_FP), "ASN1_item_d2i_fp"},
-        {ERR_FUNC(ASN1_F_ASN1_ITEM_DUP), "ASN1_item_dup"},
-        {ERR_FUNC(ASN1_F_ASN1_ITEM_EX_COMBINE_NEW), "ASN1_ITEM_EX_COMBINE_NEW"},
-        {ERR_FUNC(ASN1_F_ASN1_ITEM_EX_D2I), "ASN1_ITEM_EX_D2I"},
-        {ERR_FUNC(ASN1_F_ASN1_ITEM_I2D_BIO), "ASN1_item_i2d_bio"},
-        {ERR_FUNC(ASN1_F_ASN1_ITEM_I2D_FP), "ASN1_item_i2d_fp"},
-        {ERR_FUNC(ASN1_F_ASN1_ITEM_PACK), "ASN1_item_pack"},
-        {ERR_FUNC(ASN1_F_ASN1_ITEM_SIGN), "ASN1_item_sign"},
-        {ERR_FUNC(ASN1_F_ASN1_ITEM_SIGN_CTX), "ASN1_item_sign_ctx"},
-        {ERR_FUNC(ASN1_F_ASN1_ITEM_UNPACK), "ASN1_item_unpack"},
-        {ERR_FUNC(ASN1_F_ASN1_ITEM_VERIFY), "ASN1_item_verify"},
-        {ERR_FUNC(ASN1_F_ASN1_MBSTRING_NCOPY), "ASN1_mbstring_ncopy"},
-        {ERR_FUNC(ASN1_F_ASN1_OBJECT_NEW), "ASN1_OBJECT_new"},
-        {ERR_FUNC(ASN1_F_ASN1_OUTPUT_DATA), "ASN1_OUTPUT_DATA"},
-        {ERR_FUNC(ASN1_F_ASN1_PACK_STRING), "ASN1_pack_string"},
-        {ERR_FUNC(ASN1_F_ASN1_PCTX_NEW), "ASN1_PCTX_new"},
-        {ERR_FUNC(ASN1_F_ASN1_PKCS5_PBE_SET), "ASN1_PKCS5_PBE_SET"},
-        {ERR_FUNC(ASN1_F_ASN1_SEQ_PACK), "ASN1_seq_pack"},
-        {ERR_FUNC(ASN1_F_ASN1_SEQ_UNPACK), "ASN1_seq_unpack"},
-        {ERR_FUNC(ASN1_F_ASN1_SIGN), "ASN1_sign"},
-        {ERR_FUNC(ASN1_F_ASN1_STR2TYPE), "ASN1_STR2TYPE"},
-        {ERR_FUNC(ASN1_F_ASN1_STRING_SET), "ASN1_STRING_set"},
-        {ERR_FUNC(ASN1_F_ASN1_STRING_TABLE_ADD), "ASN1_STRING_TABLE_add"},
-        {ERR_FUNC(ASN1_F_ASN1_STRING_TYPE_NEW), "ASN1_STRING_type_new"},
-        {ERR_FUNC(ASN1_F_ASN1_TEMPLATE_EX_D2I), "ASN1_TEMPLATE_EX_D2I"},
-        {ERR_FUNC(ASN1_F_ASN1_TEMPLATE_NEW), "ASN1_TEMPLATE_NEW"},
-        {ERR_FUNC(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I), "ASN1_TEMPLATE_NOEXP_D2I"},
-        {ERR_FUNC(ASN1_F_ASN1_TIME_ADJ), "ASN1_TIME_adj"},
-        {ERR_FUNC(ASN1_F_ASN1_TIME_SET), "ASN1_TIME_set"},
-        {ERR_FUNC(ASN1_F_ASN1_TYPE_GET_INT_OCTETSTRING), "ASN1_TYPE_get_int_octetstring"},
-        {ERR_FUNC(ASN1_F_ASN1_TYPE_GET_OCTETSTRING), "ASN1_TYPE_get_octetstring"},
-        {ERR_FUNC(ASN1_F_ASN1_UNPACK_STRING), "ASN1_unpack_string"},
-        {ERR_FUNC(ASN1_F_ASN1_UTCTIME_ADJ), "ASN1_UTCTIME_adj"},
-        {ERR_FUNC(ASN1_F_ASN1_UTCTIME_SET), "ASN1_UTCTIME_set"},
-        {ERR_FUNC(ASN1_F_ASN1_VERIFY), "ASN1_verify"},
-        {ERR_FUNC(ASN1_F_B64_READ_ASN1), "B64_READ_ASN1"},
-        {ERR_FUNC(ASN1_F_B64_WRITE_ASN1), "B64_WRITE_ASN1"},
-        {ERR_FUNC(ASN1_F_BIO_NEW_NDEF), "BIO_new_NDEF"},
-        {ERR_FUNC(ASN1_F_BITSTR_CB), "BITSTR_CB"},
-        {ERR_FUNC(ASN1_F_BN_TO_ASN1_ENUMERATED), "BN_to_ASN1_ENUMERATED"},
-        {ERR_FUNC(ASN1_F_BN_TO_ASN1_INTEGER), "BN_to_ASN1_INTEGER"},
-        {ERR_FUNC(ASN1_F_C2I_ASN1_BIT_STRING), "c2i_ASN1_BIT_STRING"},
-        {ERR_FUNC(ASN1_F_C2I_ASN1_INTEGER), "c2i_ASN1_INTEGER"},
-        {ERR_FUNC(ASN1_F_C2I_ASN1_OBJECT), "c2i_ASN1_OBJECT"},
-        {ERR_FUNC(ASN1_F_COLLECT_DATA), "COLLECT_DATA"},
-        {ERR_FUNC(ASN1_F_D2I_ASN1_BIT_STRING), "D2I_ASN1_BIT_STRING"},
-        {ERR_FUNC(ASN1_F_D2I_ASN1_BOOLEAN), "d2i_ASN1_BOOLEAN"},
-        {ERR_FUNC(ASN1_F_D2I_ASN1_BYTES), "d2i_ASN1_bytes"},
-        {ERR_FUNC(ASN1_F_D2I_ASN1_GENERALIZEDTIME), "D2I_ASN1_GENERALIZEDTIME"},
-        {ERR_FUNC(ASN1_F_D2I_ASN1_HEADER), "D2I_ASN1_HEADER"},
-        {ERR_FUNC(ASN1_F_D2I_ASN1_INTEGER), "D2I_ASN1_INTEGER"},
-        {ERR_FUNC(ASN1_F_D2I_ASN1_OBJECT), "d2i_ASN1_OBJECT"},
-        {ERR_FUNC(ASN1_F_D2I_ASN1_SET), "d2i_ASN1_SET"},
-        {ERR_FUNC(ASN1_F_D2I_ASN1_TYPE_BYTES), "d2i_ASN1_type_bytes"},
-        {ERR_FUNC(ASN1_F_D2I_ASN1_UINTEGER), "d2i_ASN1_UINTEGER"},
-        {ERR_FUNC(ASN1_F_D2I_ASN1_UTCTIME), "D2I_ASN1_UTCTIME"},
-        {ERR_FUNC(ASN1_F_D2I_AUTOPRIVATEKEY), "d2i_AutoPrivateKey"},
-        {ERR_FUNC(ASN1_F_D2I_NETSCAPE_RSA), "d2i_Netscape_RSA"},
-        {ERR_FUNC(ASN1_F_D2I_NETSCAPE_RSA_2), "D2I_NETSCAPE_RSA_2"},
-        {ERR_FUNC(ASN1_F_D2I_PRIVATEKEY), "d2i_PrivateKey"},
-        {ERR_FUNC(ASN1_F_D2I_PUBLICKEY), "d2i_PublicKey"},
-        {ERR_FUNC(ASN1_F_D2I_RSA_NET), "d2i_RSA_NET"},
-        {ERR_FUNC(ASN1_F_D2I_RSA_NET_2), "D2I_RSA_NET_2"},
-        {ERR_FUNC(ASN1_F_D2I_X509), "D2I_X509"},
-        {ERR_FUNC(ASN1_F_D2I_X509_CINF), "D2I_X509_CINF"},
-        {ERR_FUNC(ASN1_F_D2I_X509_PKEY), "d2i_X509_PKEY"},
-        {ERR_FUNC(ASN1_F_I2D_ASN1_BIO_STREAM), "i2d_ASN1_bio_stream"},
-        {ERR_FUNC(ASN1_F_I2D_ASN1_SET), "i2d_ASN1_SET"},
-        {ERR_FUNC(ASN1_F_I2D_ASN1_TIME), "I2D_ASN1_TIME"},
-        {ERR_FUNC(ASN1_F_I2D_DSA_PUBKEY), "i2d_DSA_PUBKEY"},
-        {ERR_FUNC(ASN1_F_I2D_EC_PUBKEY), "i2d_EC_PUBKEY"},
-        {ERR_FUNC(ASN1_F_I2D_PRIVATEKEY), "i2d_PrivateKey"},
-        {ERR_FUNC(ASN1_F_I2D_PUBLICKEY), "i2d_PublicKey"},
-        {ERR_FUNC(ASN1_F_I2D_RSA_NET), "i2d_RSA_NET"},
-        {ERR_FUNC(ASN1_F_I2D_RSA_PUBKEY), "i2d_RSA_PUBKEY"},
-        {ERR_FUNC(ASN1_F_LONG_C2I), "LONG_C2I"},
-        {ERR_FUNC(ASN1_F_OID_MODULE_INIT), "OID_MODULE_INIT"},
-        {ERR_FUNC(ASN1_F_PARSE_TAGGING), "PARSE_TAGGING"},
-        {ERR_FUNC(ASN1_F_PKCS5_PBE2_SET_IV), "PKCS5_pbe2_set_iv"},
-        {ERR_FUNC(ASN1_F_PKCS5_PBE_SET), "PKCS5_pbe_set"},
-        {ERR_FUNC(ASN1_F_PKCS5_PBE_SET0_ALGOR), "PKCS5_pbe_set0_algor"},
-        {ERR_FUNC(ASN1_F_PKCS5_PBKDF2_SET), "PKCS5_pbkdf2_set"},
-        {ERR_FUNC(ASN1_F_SMIME_READ_ASN1), "SMIME_read_ASN1"},
-        {ERR_FUNC(ASN1_F_SMIME_TEXT), "SMIME_text"},
-        {ERR_FUNC(ASN1_F_X509_CINF_NEW), "X509_CINF_NEW"},
-        {ERR_FUNC(ASN1_F_X509_CRL_ADD0_REVOKED), "X509_CRL_add0_revoked"},
-        {ERR_FUNC(ASN1_F_X509_INFO_NEW), "X509_INFO_new"},
-        {ERR_FUNC(ASN1_F_X509_NAME_ENCODE), "X509_NAME_ENCODE"},
-        {ERR_FUNC(ASN1_F_X509_NAME_EX_D2I), "X509_NAME_EX_D2I"},
-        {ERR_FUNC(ASN1_F_X509_NAME_EX_NEW), "X509_NAME_EX_NEW"},
-        {ERR_FUNC(ASN1_F_X509_NEW), "X509_NEW"},
-        {ERR_FUNC(ASN1_F_X509_PKEY_NEW), "X509_PKEY_new"},
-        {0, NULL}
-};
-
-static ERR_STRING_DATA ASN1_str_reasons[] = {
-        {ERR_REASON(ASN1_R_ADDING_OBJECT)        , "adding object"},
-        {ERR_REASON(ASN1_R_ASN1_PARSE_ERROR)     , "asn1 parse error"},
-        {ERR_REASON(ASN1_R_ASN1_SIG_PARSE_ERROR) , "asn1 sig parse error"},
-        {ERR_REASON(ASN1_R_AUX_ERROR)            , "aux error"},
-        {ERR_REASON(ASN1_R_BAD_CLASS)            , "bad class"},
-        {ERR_REASON(ASN1_R_BAD_OBJECT_HEADER)    , "bad object header"},
-        {ERR_REASON(ASN1_R_BAD_PASSWORD_READ)    , "bad password read"},
-        {ERR_REASON(ASN1_R_BAD_TAG)              , "bad tag"},
-        {ERR_REASON(ASN1_R_BMPSTRING_IS_WRONG_LENGTH), "bmpstring is wrong length"},
-        {ERR_REASON(ASN1_R_BN_LIB)               , "bn lib"},
-        {ERR_REASON(ASN1_R_BOOLEAN_IS_WRONG_LENGTH), "boolean is wrong length"},
-        {ERR_REASON(ASN1_R_BUFFER_TOO_SMALL)     , "buffer too small"},
-        {ERR_REASON(ASN1_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER), "cipher has no object identifier"},
-        {ERR_REASON(ASN1_R_CONTEXT_NOT_INITIALISED), "context not initialised"},
-        {ERR_REASON(ASN1_R_DATA_IS_WRONG)        , "data is wrong"},
-        {ERR_REASON(ASN1_R_DECODE_ERROR)         , "decode error"},
-        {ERR_REASON(ASN1_R_DECODING_ERROR)       , "decoding error"},
-        {ERR_REASON(ASN1_R_DEPTH_EXCEEDED)       , "depth exceeded"},
-        {ERR_REASON(ASN1_R_DIGEST_AND_KEY_TYPE_NOT_SUPPORTED), "digest and key type not supported"},
-        {ERR_REASON(ASN1_R_ENCODE_ERROR)         , "encode error"},
-        {ERR_REASON(ASN1_R_ERROR_GETTING_TIME)   , "error getting time"},
-        {ERR_REASON(ASN1_R_ERROR_LOADING_SECTION), "error loading section"},
-        {ERR_REASON(ASN1_R_ERROR_PARSING_SET_ELEMENT), "error parsing set element"},
-        {ERR_REASON(ASN1_R_ERROR_SETTING_CIPHER_PARAMS), "error setting cipher params"},
-        {ERR_REASON(ASN1_R_EXPECTING_AN_INTEGER) , "expecting an integer"},
-        {ERR_REASON(ASN1_R_EXPECTING_AN_OBJECT)  , "expecting an object"},
-        {ERR_REASON(ASN1_R_EXPECTING_A_BOOLEAN)  , "expecting a boolean"},
-        {ERR_REASON(ASN1_R_EXPECTING_A_TIME)     , "expecting a time"},
-        {ERR_REASON(ASN1_R_EXPLICIT_LENGTH_MISMATCH), "explicit length mismatch"},
-        {ERR_REASON(ASN1_R_EXPLICIT_TAG_NOT_CONSTRUCTED), "explicit tag not constructed"},
-        {ERR_REASON(ASN1_R_FIELD_MISSING)        , "field missing"},
-        {ERR_REASON(ASN1_R_FIRST_NUM_TOO_LARGE)  , "first num too large"},
-        {ERR_REASON(ASN1_R_HEADER_TOO_LONG)      , "header too long"},
-        {ERR_REASON(ASN1_R_ILLEGAL_BITSTRING_FORMAT), "illegal bitstring format"},
-        {ERR_REASON(ASN1_R_ILLEGAL_BOOLEAN)      , "illegal boolean"},
-        {ERR_REASON(ASN1_R_ILLEGAL_CHARACTERS)   , "illegal characters"},
-        {ERR_REASON(ASN1_R_ILLEGAL_FORMAT)       , "illegal format"},
-        {ERR_REASON(ASN1_R_ILLEGAL_HEX)          , "illegal hex"},
-        {ERR_REASON(ASN1_R_ILLEGAL_IMPLICIT_TAG) , "illegal implicit tag"},
-        {ERR_REASON(ASN1_R_ILLEGAL_INTEGER)      , "illegal integer"},
-        {ERR_REASON(ASN1_R_ILLEGAL_NESTED_TAGGING), "illegal nested tagging"},
-        {ERR_REASON(ASN1_R_ILLEGAL_NULL)         , "illegal null"},
-        {ERR_REASON(ASN1_R_ILLEGAL_NULL_VALUE)   , "illegal null value"},
-        {ERR_REASON(ASN1_R_ILLEGAL_OBJECT)       , "illegal object"},
-        {ERR_REASON(ASN1_R_ILLEGAL_OPTIONAL_ANY) , "illegal optional any"},
-        {ERR_REASON(ASN1_R_ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE), "illegal options on item template"},
-        {ERR_REASON(ASN1_R_ILLEGAL_TAGGED_ANY)   , "illegal tagged any"},
-        {ERR_REASON(ASN1_R_ILLEGAL_TIME_VALUE)   , "illegal time value"},
-        {ERR_REASON(ASN1_R_INTEGER_NOT_ASCII_FORMAT), "integer not ascii format"},
-        {ERR_REASON(ASN1_R_INTEGER_TOO_LARGE_FOR_LONG), "integer too large for long"},
-        {ERR_REASON(ASN1_R_INVALID_BIT_STRING_BITS_LEFT), "invalid bit string bits left"},
-        {ERR_REASON(ASN1_R_INVALID_BMPSTRING_LENGTH), "invalid bmpstring length"},
-        {ERR_REASON(ASN1_R_INVALID_DIGIT)        , "invalid digit"},
-        {ERR_REASON(ASN1_R_INVALID_MIME_TYPE)    , "invalid mime type"},
-        {ERR_REASON(ASN1_R_INVALID_MODIFIER)     , "invalid modifier"},
-        {ERR_REASON(ASN1_R_INVALID_NUMBER)       , "invalid number"},
-        {ERR_REASON(ASN1_R_INVALID_OBJECT_ENCODING), "invalid object encoding"},
-        {ERR_REASON(ASN1_R_INVALID_SEPARATOR)    , "invalid separator"},
-        {ERR_REASON(ASN1_R_INVALID_TIME_FORMAT)  , "invalid time format"},
-        {ERR_REASON(ASN1_R_INVALID_UNIVERSALSTRING_LENGTH), "invalid universalstring length"},
-        {ERR_REASON(ASN1_R_INVALID_UTF8STRING)   , "invalid utf8string"},
-        {ERR_REASON(ASN1_R_IV_TOO_LARGE)         , "iv too large"},
-        {ERR_REASON(ASN1_R_LENGTH_ERROR)         , "length error"},
-        {ERR_REASON(ASN1_R_LIST_ERROR)           , "list error"},
-        {ERR_REASON(ASN1_R_MIME_NO_CONTENT_TYPE) , "mime no content type"},
-        {ERR_REASON(ASN1_R_MIME_PARSE_ERROR)     , "mime parse error"},
-        {ERR_REASON(ASN1_R_MIME_SIG_PARSE_ERROR) , "mime sig parse error"},
-        {ERR_REASON(ASN1_R_MISSING_EOC)          , "missing eoc"},
-        {ERR_REASON(ASN1_R_MISSING_SECOND_NUMBER), "missing second number"},
-        {ERR_REASON(ASN1_R_MISSING_VALUE)        , "missing value"},
-        {ERR_REASON(ASN1_R_MSTRING_NOT_UNIVERSAL), "mstring not universal"},
-        {ERR_REASON(ASN1_R_MSTRING_WRONG_TAG)    , "mstring wrong tag"},
-        {ERR_REASON(ASN1_R_NESTED_ASN1_STRING)   , "nested asn1 string"},
-        {ERR_REASON(ASN1_R_NON_HEX_CHARACTERS)   , "non hex characters"},
-        {ERR_REASON(ASN1_R_NOT_ASCII_FORMAT)     , "not ascii format"},
-        {ERR_REASON(ASN1_R_NOT_ENOUGH_DATA)      , "not enough data"},
-        {ERR_REASON(ASN1_R_NO_CONTENT_TYPE)      , "no content type"},
-        {ERR_REASON(ASN1_R_NO_DEFAULT_DIGEST)    , "no default digest"},
-        {ERR_REASON(ASN1_R_NO_MATCHING_CHOICE_TYPE), "no matching choice type"},
-        {ERR_REASON(ASN1_R_NO_MULTIPART_BODY_FAILURE), "no multipart body failure"},
-        {ERR_REASON(ASN1_R_NO_MULTIPART_BOUNDARY), "no multipart boundary"},
-        {ERR_REASON(ASN1_R_NO_SIG_CONTENT_TYPE)  , "no sig content type"},
-        {ERR_REASON(ASN1_R_NULL_IS_WRONG_LENGTH) , "null is wrong length"},
-        {ERR_REASON(ASN1_R_OBJECT_NOT_ASCII_FORMAT), "object not ascii format"},
-        {ERR_REASON(ASN1_R_ODD_NUMBER_OF_CHARS)  , "odd number of chars"},
-        {ERR_REASON(ASN1_R_PRIVATE_KEY_HEADER_MISSING), "private key header missing"},
-        {ERR_REASON(ASN1_R_SECOND_NUMBER_TOO_LARGE), "second number too large"},
-        {ERR_REASON(ASN1_R_SEQUENCE_LENGTH_MISMATCH), "sequence length mismatch"},
-        {ERR_REASON(ASN1_R_SEQUENCE_NOT_CONSTRUCTED), "sequence not constructed"},
-        {ERR_REASON(ASN1_R_SEQUENCE_OR_SET_NEEDS_CONFIG), "sequence or set needs config"},
-        {ERR_REASON(ASN1_R_SHORT_LINE)           , "short line"},
-        {ERR_REASON(ASN1_R_SIG_INVALID_MIME_TYPE), "sig invalid mime type"},
-        {ERR_REASON(ASN1_R_STREAMING_NOT_SUPPORTED), "streaming not supported"},
-        {ERR_REASON(ASN1_R_STRING_TOO_LONG)      , "string too long"},
-        {ERR_REASON(ASN1_R_STRING_TOO_SHORT)     , "string too short"},
-        {ERR_REASON(ASN1_R_TAG_VALUE_TOO_HIGH)   , "tag value too high"},
-        {ERR_REASON(ASN1_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD), "the asn1 object identifier is not known for this md"},
-        {ERR_REASON(ASN1_R_TIME_NOT_ASCII_FORMAT), "time not ascii format"},
-        {ERR_REASON(ASN1_R_TOO_LONG)             , "too long"},
-        {ERR_REASON(ASN1_R_TYPE_NOT_CONSTRUCTED) , "type not constructed"},
-        {ERR_REASON(ASN1_R_UNABLE_TO_DECODE_RSA_KEY), "unable to decode rsa key"},
-        {ERR_REASON(ASN1_R_UNABLE_TO_DECODE_RSA_PRIVATE_KEY), "unable to decode rsa private key"},
-        {ERR_REASON(ASN1_R_UNEXPECTED_EOC)       , "unexpected eoc"},
-        {ERR_REASON(ASN1_R_UNIVERSALSTRING_IS_WRONG_LENGTH), "universalstring is wrong length"},
-        {ERR_REASON(ASN1_R_UNKNOWN_FORMAT)       , "unknown format"},
-        {ERR_REASON(ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM), "unknown message digest algorithm"},
-        {ERR_REASON(ASN1_R_UNKNOWN_OBJECT_TYPE)  , "unknown object type"},
-        {ERR_REASON(ASN1_R_UNKNOWN_PUBLIC_KEY_TYPE), "unknown public key type"},
-        {ERR_REASON(ASN1_R_UNKNOWN_SIGNATURE_ALGORITHM), "unknown signature algorithm"},
-        {ERR_REASON(ASN1_R_UNKNOWN_TAG)          , "unknown tag"},
-        {ERR_REASON(ASN1_R_UNKOWN_FORMAT)        , "unknown format"},
-        {ERR_REASON(ASN1_R_UNSUPPORTED_ANY_DEFINED_BY_TYPE), "unsupported any defined by type"},
-        {ERR_REASON(ASN1_R_UNSUPPORTED_CIPHER)   , "unsupported cipher"},
-        {ERR_REASON(ASN1_R_UNSUPPORTED_ENCRYPTION_ALGORITHM), "unsupported encryption algorithm"},
-        {ERR_REASON(ASN1_R_UNSUPPORTED_PUBLIC_KEY_TYPE), "unsupported public key type"},
-        {ERR_REASON(ASN1_R_UNSUPPORTED_TYPE)     , "unsupported type"},
-        {ERR_REASON(ASN1_R_WRONG_PUBLIC_KEY_TYPE), "wrong public key type"},
-        {ERR_REASON(ASN1_R_WRONG_TAG)            , "wrong tag"},
-        {ERR_REASON(ASN1_R_WRONG_TYPE)           , "wrong type"},
-        {0, NULL}
-};
-
-#endif
-
-void
-ERR_load_ASN1_strings(void)
-{
-#ifndef OPENSSL_NO_ERR
-        if (ERR_func_error_string(ASN1_str_functs[0].error) == NULL) {
-                ERR_load_strings(0, ASN1_str_functs);
-                ERR_load_strings(0, ASN1_str_reasons);
-        }
-#endif
-}
diff --git a/src/lib/libcrypto/asn1/asn1_gen.c b/src/lib/libcrypto/asn1/asn1_gen.c
deleted file mode 100644
index 08a5dec4a6..0000000000
--- a/src/lib/libcrypto/asn1/asn1_gen.c
+++ /dev/null
@@ -1,811 +0,0 @@
-/* $OpenBSD: asn1_gen.c,v 1.14 2015/07/18 14:40:59 miod Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 2002.
- */
-/* ====================================================================
- * Copyright (c) 2002 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <string.h>
-
-#include <openssl/asn1.h>
-#include <openssl/err.h>
-#include <openssl/x509v3.h>
-
-#define ASN1_GEN_FLAG           0x10000
-#define ASN1_GEN_FLAG_IMP       (ASN1_GEN_FLAG|1)
-#define ASN1_GEN_FLAG_EXP       (ASN1_GEN_FLAG|2)
-#define ASN1_GEN_FLAG_TAG       (ASN1_GEN_FLAG|3)
-#define ASN1_GEN_FLAG_BITWRAP   (ASN1_GEN_FLAG|4)
-#define ASN1_GEN_FLAG_OCTWRAP   (ASN1_GEN_FLAG|5)
-#define ASN1_GEN_FLAG_SEQWRAP   (ASN1_GEN_FLAG|6)
-#define ASN1_GEN_FLAG_SETWRAP   (ASN1_GEN_FLAG|7)
-#define ASN1_GEN_FLAG_FORMAT    (ASN1_GEN_FLAG|8)
-
-#define ASN1_GEN_STR(str,val){str, sizeof(str) - 1, val}
-
-#define ASN1_FLAG_EXP_MAX       20
-
-/* Input formats */
-
-/* ASCII: default */
-#define ASN1_GEN_FORMAT_ASCII   1
-/* UTF8 */
-#define ASN1_GEN_FORMAT_UTF8    2
-/* Hex */
-#define ASN1_GEN_FORMAT_HEX     3
-/* List of bits */
-#define ASN1_GEN_FORMAT_BITLIST 4
-
-struct tag_name_st {
-        const char *strnam;
-        int len;
-        int tag;
-};
-
-typedef struct {
-        int exp_tag;
-        int exp_class;
-        int exp_constructed;
-        int exp_pad;
-        long exp_len;
-} tag_exp_type;
-
-typedef struct {
-        int imp_tag;
-        int imp_class;
-        int utype;
-        int format;
-        const char *str;
-        tag_exp_type exp_list[ASN1_FLAG_EXP_MAX];
-        int exp_count;
-} tag_exp_arg;
-
-static int bitstr_cb(const char *elem, int len, void *bitstr);
-static int asn1_cb(const char *elem, int len, void *bitstr);
-static int append_exp(tag_exp_arg *arg, int exp_tag, int exp_class,
-    int exp_constructed, int exp_pad, int imp_ok);
-static int parse_tagging(const char *vstart, int vlen, int *ptag, int *pclass);
-static ASN1_TYPE *asn1_multi(int utype, const char *section, X509V3_CTX *cnf);
-static ASN1_TYPE *asn1_str2type(const char *str, int format, int utype);
-static int asn1_str2tag(const char *tagstr, int len);
-
-ASN1_TYPE *
-ASN1_generate_nconf(char *str, CONF *nconf)
-{
-        X509V3_CTX cnf;
-
-        if (!nconf)
-                return ASN1_generate_v3(str, NULL);
-
-        X509V3_set_nconf(&cnf, nconf);
-        return ASN1_generate_v3(str, &cnf);
-}
-
-ASN1_TYPE *
-ASN1_generate_v3(char *str, X509V3_CTX *cnf)
-{
-        ASN1_TYPE *ret;
-        tag_exp_arg asn1_tags;
-        tag_exp_type *etmp;
-
-        int i, len;
-
-        unsigned char *orig_der = NULL, *new_der = NULL;
-        const unsigned char *cpy_start;
-        unsigned char *p;
-        const unsigned char *cp;
-        int cpy_len;
-        long hdr_len;
-        int hdr_constructed = 0, hdr_tag, hdr_class;
-        int r;
-
-        asn1_tags.imp_tag = -1;
-        asn1_tags.imp_class = -1;
-        asn1_tags.format = ASN1_GEN_FORMAT_ASCII;
-        asn1_tags.exp_count = 0;
-        if (CONF_parse_list(str, ',', 1, asn1_cb, &asn1_tags) != 0)
-                return NULL;
-
-        if ((asn1_tags.utype == V_ASN1_SEQUENCE) ||
-            (asn1_tags.utype == V_ASN1_SET)) {
-                if (!cnf) {
-                        ASN1err(ASN1_F_ASN1_GENERATE_V3,
-                            ASN1_R_SEQUENCE_OR_SET_NEEDS_CONFIG);
-                        return NULL;
-                }
-                ret = asn1_multi(asn1_tags.utype, asn1_tags.str, cnf);
-        } else
-                ret = asn1_str2type(asn1_tags.str, asn1_tags.format,
-                    asn1_tags.utype);
-
-        if (!ret)
-                return NULL;
-
-        /* If no tagging return base type */
-        if ((asn1_tags.imp_tag == -1) && (asn1_tags.exp_count == 0))
-                return ret;
-
-        /* Generate the encoding */
-        cpy_len = i2d_ASN1_TYPE(ret, &orig_der);
-        ASN1_TYPE_free(ret);
-        ret = NULL;
-        /* Set point to start copying for modified encoding */
-        cpy_start = orig_der;
-
-        /* Do we need IMPLICIT tagging? */
-        if (asn1_tags.imp_tag != -1) {
-                /* If IMPLICIT we will replace the underlying tag */
-                /* Skip existing tag+len */
-                r = ASN1_get_object(&cpy_start, &hdr_len, &hdr_tag,
-                    &hdr_class, cpy_len);
-                if (r & 0x80)
-                        goto err;
-                /* Update copy length */
-                cpy_len -= cpy_start - orig_der;
-                /* For IMPLICIT tagging the length should match the
-                 * original length and constructed flag should be
-                 * consistent.
-                 */
-                if (r & 0x1) {
-                        /* Indefinite length constructed */
-                        hdr_constructed = 2;
-                        hdr_len = 0;
-                } else
-                        /* Just retain constructed flag */
-                        hdr_constructed = r & V_ASN1_CONSTRUCTED;
-                /* Work out new length with IMPLICIT tag: ignore constructed
-                 * because it will mess up if indefinite length
-                 */
-                len = ASN1_object_size(0, hdr_len, asn1_tags.imp_tag);
-        } else
-                len = cpy_len;
-
-        /* Work out length in any EXPLICIT, starting from end */
-
-        for (i = 0, etmp = asn1_tags.exp_list + asn1_tags.exp_count - 1;
-            i < asn1_tags.exp_count; i++, etmp--) {
-                /* Content length: number of content octets + any padding */
-                len += etmp->exp_pad;
-                etmp->exp_len = len;
-                /* Total object length: length including new header */
-                len = ASN1_object_size(0, len, etmp->exp_tag);
-        }
-
-        /* Allocate buffer for new encoding */
-
-        new_der = malloc(len);
-        if (!new_der)
-                goto err;
-
-        /* Generate tagged encoding */
-        p = new_der;
-
-        /* Output explicit tags first */
-        for (i = 0, etmp = asn1_tags.exp_list; i < asn1_tags.exp_count;
-            i++, etmp++) {
-                ASN1_put_object(&p, etmp->exp_constructed, etmp->exp_len,
-                    etmp->exp_tag, etmp->exp_class);
-                if (etmp->exp_pad)
-                        *p++ = 0;
-        }
-
-        /* If IMPLICIT, output tag */
-
-        if (asn1_tags.imp_tag != -1) {
-                if (asn1_tags.imp_class == V_ASN1_UNIVERSAL &&
-                    (asn1_tags.imp_tag == V_ASN1_SEQUENCE ||
-                    asn1_tags.imp_tag == V_ASN1_SET))
-                        hdr_constructed = V_ASN1_CONSTRUCTED;
-                ASN1_put_object(&p, hdr_constructed, hdr_len,
-                    asn1_tags.imp_tag, asn1_tags.imp_class);
-        }
-
-        /* Copy across original encoding */
-        memcpy(p, cpy_start, cpy_len);
-
-        cp = new_der;
-
-        /* Obtain new ASN1_TYPE structure */
-        ret = d2i_ASN1_TYPE(NULL, &cp, len);
-
-err:
-        free(orig_der);
-        free(new_der);
-
-        return ret;
-}
-
-static int
-asn1_cb(const char *elem, int len, void *bitstr)
-{
-        tag_exp_arg *arg = bitstr;
-        int i;
-        int utype;
-        int vlen = 0;
-        const char *p, *vstart = NULL;
-
-        int tmp_tag, tmp_class;
-
-        for (i = 0, p = elem; i < len; p++, i++) {
-                /* Look for the ':' in name value pairs */
-                if (*p == ':') {
-                        vstart = p + 1;
-                        vlen = len - (vstart - elem);
-                        len = p - elem;
-                        break;
-                }
-        }
-
-        utype = asn1_str2tag(elem, len);
-
-        if (utype == -1) {
-                ASN1err(ASN1_F_ASN1_CB, ASN1_R_UNKNOWN_TAG);
-                ERR_asprintf_error_data("tag=%s", elem);
-                return -1;
-        }
-
-        /* If this is not a modifier mark end of string and exit */
-        if (!(utype & ASN1_GEN_FLAG)) {
-                arg->utype = utype;
-                arg->str = vstart;
-                /* If no value and not end of string, error */
-                if (!vstart && elem[len]) {
-                        ASN1err(ASN1_F_ASN1_CB, ASN1_R_MISSING_VALUE);
-                        return -1;
-                }
-                return 0;
-        }
-
-        switch (utype) {
-
-        case ASN1_GEN_FLAG_IMP:
-                /* Check for illegal multiple IMPLICIT tagging */
-                if (arg->imp_tag != -1) {
-                        ASN1err(ASN1_F_ASN1_CB, ASN1_R_ILLEGAL_NESTED_TAGGING);
-                        return -1;
-                }
-                if (!parse_tagging(vstart, vlen, &arg->imp_tag,
-                    &arg->imp_class))
-                        return -1;
-                break;
-
-        case ASN1_GEN_FLAG_EXP:
-                if (!parse_tagging(vstart, vlen, &tmp_tag, &tmp_class))
-                        return -1;
-                if (!append_exp(arg, tmp_tag, tmp_class, 1, 0, 0))
-                        return -1;
-                break;
-
-        case ASN1_GEN_FLAG_SEQWRAP:
-                if (!append_exp(arg, V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL, 1, 0, 1))
-                        return -1;
-                break;
-
-        case ASN1_GEN_FLAG_SETWRAP:
-                if (!append_exp(arg, V_ASN1_SET, V_ASN1_UNIVERSAL, 1, 0, 1))
-                        return -1;
-                break;
-
-        case ASN1_GEN_FLAG_BITWRAP:
-                if (!append_exp(arg, V_ASN1_BIT_STRING, V_ASN1_UNIVERSAL, 0, 1, 1))
-                        return -1;
-                break;
-
-        case ASN1_GEN_FLAG_OCTWRAP:
-                if (!append_exp(arg, V_ASN1_OCTET_STRING, V_ASN1_UNIVERSAL, 0, 0, 1))
-                        return -1;
-                break;
-
-        case ASN1_GEN_FLAG_FORMAT:
-                if (vstart == NULL) {
-                        ASN1err(ASN1_F_ASN1_CB, ASN1_R_ILLEGAL_FORMAT);
-                        return -1;
-                }
-                if (!strncmp(vstart, "ASCII", 5))
-                        arg->format = ASN1_GEN_FORMAT_ASCII;
-                else if (!strncmp(vstart, "UTF8", 4))
-                        arg->format = ASN1_GEN_FORMAT_UTF8;
-                else if (!strncmp(vstart, "HEX", 3))
-                        arg->format = ASN1_GEN_FORMAT_HEX;
-                else if (!strncmp(vstart, "BITLIST", 7))
-                        arg->format = ASN1_GEN_FORMAT_BITLIST;
-                else {
-                        ASN1err(ASN1_F_ASN1_CB, ASN1_R_UNKOWN_FORMAT);
-                        return -1;
-                }
-                break;
-
-        }
-
-        return 1;
-}
-
-static int
-parse_tagging(const char *vstart, int vlen, int *ptag, int *pclass)
-{
-        long tag_num;
-        char *eptr;
-
-        if (!vstart)
-                return 0;
-        tag_num = strtoul(vstart, &eptr, 10);
-        /* Check we haven't gone past max length: should be impossible */
-        if (eptr && *eptr && (eptr > vstart + vlen))
-                return 0;
-        if (tag_num < 0) {
-                ASN1err(ASN1_F_PARSE_TAGGING, ASN1_R_INVALID_NUMBER);
-                return 0;
-        }
-        *ptag = tag_num;
-        /* If we have non numeric characters, parse them */
-        if (eptr)
-                vlen -= eptr - vstart;
-        else
-                vlen = 0;
-        if (vlen) {
-                switch (*eptr) {
-
-                case 'U':
-                        *pclass = V_ASN1_UNIVERSAL;
-                        break;
-
-                case 'A':
-                        *pclass = V_ASN1_APPLICATION;
-                        break;
-
-                case 'P':
-                        *pclass = V_ASN1_PRIVATE;
-                        break;
-
-                case 'C':
-                        *pclass = V_ASN1_CONTEXT_SPECIFIC;
-                        break;
-
-                default:
-                        ASN1err(ASN1_F_PARSE_TAGGING, ASN1_R_INVALID_MODIFIER);
-                        ERR_asprintf_error_data("Char=%c", *eptr);
-                        return 0;
-                        break;
-
-                }
-        } else
-                *pclass = V_ASN1_CONTEXT_SPECIFIC;
-
-        return 1;
-
-}
-
-/* Handle multiple types: SET and SEQUENCE */
-
-static ASN1_TYPE *
-asn1_multi(int utype, const char *section, X509V3_CTX *cnf)
-{
-        ASN1_TYPE *ret = NULL;
-        STACK_OF(ASN1_TYPE) *sk = NULL;
-        STACK_OF(CONF_VALUE) *sect = NULL;
-        unsigned char *der = NULL;
-        int derlen;
-        int i;
-        sk = sk_ASN1_TYPE_new_null();
-        if (!sk)
-                goto bad;
-        if (section) {
-                if (!cnf)
-                        goto bad;
-                sect = X509V3_get_section(cnf, (char *)section);
-                if (!sect)
-                        goto bad;
-                for (i = 0; i < sk_CONF_VALUE_num(sect); i++) {
-                        ASN1_TYPE *typ = ASN1_generate_v3(
-                            sk_CONF_VALUE_value(sect, i)->value, cnf);
-                        if (!typ)
-                                goto bad;
-                        if (!sk_ASN1_TYPE_push(sk, typ))
-                                goto bad;
-                }
-        }
-
-        /* Now we has a STACK of the components, convert to the correct form */
-
-        if (utype == V_ASN1_SET)
-                derlen = i2d_ASN1_SET_ANY(sk, &der);
-        else
-                derlen = i2d_ASN1_SEQUENCE_ANY(sk, &der);
-
-        if (derlen < 0)
-                goto bad;
-
-        if (!(ret = ASN1_TYPE_new()))
-                goto bad;
-
-        if (!(ret->value.asn1_string = ASN1_STRING_type_new(utype)))
-                goto bad;
-
-        ret->type = utype;
-
-        ret->value.asn1_string->data = der;
-        ret->value.asn1_string->length = derlen;
-
-        der = NULL;
-
-bad:
-        free(der);
-        if (sk)
-                sk_ASN1_TYPE_pop_free(sk, ASN1_TYPE_free);
-        if (sect)
-                X509V3_section_free(cnf, sect);
-
-        return ret;
-}
-
-static int
-append_exp(tag_exp_arg *arg, int exp_tag, int exp_class, int exp_constructed,
-    int exp_pad, int imp_ok)
-{
-        tag_exp_type *exp_tmp;
-
-        /* Can only have IMPLICIT if permitted */
-        if ((arg->imp_tag != -1) && !imp_ok) {
-                ASN1err(ASN1_F_APPEND_EXP, ASN1_R_ILLEGAL_IMPLICIT_TAG);
-                return 0;
-        }
-
-        if (arg->exp_count == ASN1_FLAG_EXP_MAX) {
-                ASN1err(ASN1_F_APPEND_EXP, ASN1_R_DEPTH_EXCEEDED);
-                return 0;
-        }
-
-        exp_tmp = &arg->exp_list[arg->exp_count++];
-
-        /* If IMPLICIT set tag to implicit value then
-         * reset implicit tag since it has been used.
-         */
-        if (arg->imp_tag != -1) {
-                exp_tmp->exp_tag = arg->imp_tag;
-                exp_tmp->exp_class = arg->imp_class;
-                arg->imp_tag = -1;
-                arg->imp_class = -1;
-        } else {
-                exp_tmp->exp_tag = exp_tag;
-                exp_tmp->exp_class = exp_class;
-        }
-        exp_tmp->exp_constructed = exp_constructed;
-        exp_tmp->exp_pad = exp_pad;
-
-        return 1;
-}
-
-static int
-asn1_str2tag(const char *tagstr, int len)
-{
-        unsigned int i;
-        static const struct tag_name_st *tntmp, tnst [] = {
-                ASN1_GEN_STR("BOOL", V_ASN1_BOOLEAN),
-                ASN1_GEN_STR("BOOLEAN", V_ASN1_BOOLEAN),
-                ASN1_GEN_STR("NULL", V_ASN1_NULL),
-                ASN1_GEN_STR("INT", V_ASN1_INTEGER),
-                ASN1_GEN_STR("INTEGER", V_ASN1_INTEGER),
-                ASN1_GEN_STR("ENUM", V_ASN1_ENUMERATED),
-                ASN1_GEN_STR("ENUMERATED", V_ASN1_ENUMERATED),
-                ASN1_GEN_STR("OID", V_ASN1_OBJECT),
-                ASN1_GEN_STR("OBJECT", V_ASN1_OBJECT),
-                ASN1_GEN_STR("UTCTIME", V_ASN1_UTCTIME),
-                ASN1_GEN_STR("UTC", V_ASN1_UTCTIME),
-                ASN1_GEN_STR("GENERALIZEDTIME", V_ASN1_GENERALIZEDTIME),
-                ASN1_GEN_STR("GENTIME", V_ASN1_GENERALIZEDTIME),
-                ASN1_GEN_STR("OCT", V_ASN1_OCTET_STRING),
-                ASN1_GEN_STR("OCTETSTRING", V_ASN1_OCTET_STRING),
-                ASN1_GEN_STR("BITSTR", V_ASN1_BIT_STRING),
-                ASN1_GEN_STR("BITSTRING", V_ASN1_BIT_STRING),
-                ASN1_GEN_STR("UNIVERSALSTRING", V_ASN1_UNIVERSALSTRING),
-                ASN1_GEN_STR("UNIV", V_ASN1_UNIVERSALSTRING),
-                ASN1_GEN_STR("IA5", V_ASN1_IA5STRING),
-                ASN1_GEN_STR("IA5STRING", V_ASN1_IA5STRING),
-                ASN1_GEN_STR("UTF8", V_ASN1_UTF8STRING),
-                ASN1_GEN_STR("UTF8String", V_ASN1_UTF8STRING),
-                ASN1_GEN_STR("BMP", V_ASN1_BMPSTRING),
-                ASN1_GEN_STR("BMPSTRING", V_ASN1_BMPSTRING),
-                ASN1_GEN_STR("VISIBLESTRING", V_ASN1_VISIBLESTRING),
-                ASN1_GEN_STR("VISIBLE", V_ASN1_VISIBLESTRING),
-                ASN1_GEN_STR("PRINTABLESTRING", V_ASN1_PRINTABLESTRING),
-                ASN1_GEN_STR("PRINTABLE", V_ASN1_PRINTABLESTRING),
-                ASN1_GEN_STR("T61", V_ASN1_T61STRING),
-                ASN1_GEN_STR("T61STRING", V_ASN1_T61STRING),
-                ASN1_GEN_STR("TELETEXSTRING", V_ASN1_T61STRING),
-                ASN1_GEN_STR("GeneralString", V_ASN1_GENERALSTRING),
-                ASN1_GEN_STR("GENSTR", V_ASN1_GENERALSTRING),
-                ASN1_GEN_STR("NUMERIC", V_ASN1_NUMERICSTRING),
-                ASN1_GEN_STR("NUMERICSTRING", V_ASN1_NUMERICSTRING),
-
-                /* Special cases */
-                ASN1_GEN_STR("SEQUENCE", V_ASN1_SEQUENCE),
-                ASN1_GEN_STR("SEQ", V_ASN1_SEQUENCE),
-                ASN1_GEN_STR("SET", V_ASN1_SET),
-                /* type modifiers */
-                /* Explicit tag */
-                ASN1_GEN_STR("EXP", ASN1_GEN_FLAG_EXP),
-                ASN1_GEN_STR("EXPLICIT", ASN1_GEN_FLAG_EXP),
-                /* Implicit tag */
-                ASN1_GEN_STR("IMP", ASN1_GEN_FLAG_IMP),
-                ASN1_GEN_STR("IMPLICIT", ASN1_GEN_FLAG_IMP),
-                /* OCTET STRING wrapper */
-                ASN1_GEN_STR("OCTWRAP", ASN1_GEN_FLAG_OCTWRAP),
-                /* SEQUENCE wrapper */
-                ASN1_GEN_STR("SEQWRAP", ASN1_GEN_FLAG_SEQWRAP),
-                /* SET wrapper */
-                ASN1_GEN_STR("SETWRAP", ASN1_GEN_FLAG_SETWRAP),
-                /* BIT STRING wrapper */
-                ASN1_GEN_STR("BITWRAP", ASN1_GEN_FLAG_BITWRAP),
-                ASN1_GEN_STR("FORM", ASN1_GEN_FLAG_FORMAT),
-                ASN1_GEN_STR("FORMAT", ASN1_GEN_FLAG_FORMAT),
-        };
-
-        if (len == -1)
-                len = strlen(tagstr);
-
-        tntmp = tnst;
-        for (i = 0; i < sizeof(tnst) / sizeof(struct tag_name_st);
-            i++, tntmp++) {
-                if ((len == tntmp->len) && !strncmp(tntmp->strnam, tagstr, len))
-                        return tntmp->tag;
-        }
-
-        return -1;
-}
-
-static ASN1_TYPE *
-asn1_str2type(const char *str, int format, int utype)
-{
-        ASN1_TYPE *atmp = NULL;
-        CONF_VALUE vtmp;
-        unsigned char *rdata;
-        long rdlen;
-        int no_unused = 1;
-
-        if (!(atmp = ASN1_TYPE_new())) {
-                ASN1err(ASN1_F_ASN1_STR2TYPE, ERR_R_MALLOC_FAILURE);
-                return NULL;
-        }
-
-        if (!str)
-                str = "";
-
-        switch (utype) {
-
-        case V_ASN1_NULL:
-                if (str && *str) {
-                        ASN1err(ASN1_F_ASN1_STR2TYPE,
-                            ASN1_R_ILLEGAL_NULL_VALUE);
-                        goto bad_form;
-                }
-                break;
-
-        case V_ASN1_BOOLEAN:
-                if (format != ASN1_GEN_FORMAT_ASCII) {
-                        ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_NOT_ASCII_FORMAT);
-                        goto bad_form;
-                }
-                vtmp.name = NULL;
-                vtmp.section = NULL;
-                vtmp.value = (char *)str;
-                if (!X509V3_get_value_bool(&vtmp, &atmp->value.boolean)) {
-                        ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_ILLEGAL_BOOLEAN);
-                        goto bad_str;
-                }
-                break;
-
-        case V_ASN1_INTEGER:
-        case V_ASN1_ENUMERATED:
-                if (format != ASN1_GEN_FORMAT_ASCII) {
-                        ASN1err(ASN1_F_ASN1_STR2TYPE,
-                            ASN1_R_INTEGER_NOT_ASCII_FORMAT);
-                        goto bad_form;
-                }
-                if (!(atmp->value.integer =
-                    s2i_ASN1_INTEGER(NULL, (char *)str))) {
-                        ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_ILLEGAL_INTEGER);
-                        goto bad_str;
-                }
-                break;
-
-        case V_ASN1_OBJECT:
-                if (format != ASN1_GEN_FORMAT_ASCII) {
-                        ASN1err(ASN1_F_ASN1_STR2TYPE,
-                            ASN1_R_OBJECT_NOT_ASCII_FORMAT);
-                        goto bad_form;
-                }
-                if (!(atmp->value.object = OBJ_txt2obj(str, 0))) {
-                        ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_ILLEGAL_OBJECT);
-                        goto bad_str;
-                }
-                break;
-
-        case V_ASN1_UTCTIME:
-        case V_ASN1_GENERALIZEDTIME:
-                if (format != ASN1_GEN_FORMAT_ASCII) {
-                        ASN1err(ASN1_F_ASN1_STR2TYPE,
-                            ASN1_R_TIME_NOT_ASCII_FORMAT);
-                        goto bad_form;
-                }
-                if (!(atmp->value.asn1_string = ASN1_STRING_new())) {
-                        ASN1err(ASN1_F_ASN1_STR2TYPE, ERR_R_MALLOC_FAILURE);
-                        goto bad_str;
-                }
-                if (!ASN1_STRING_set(atmp->value.asn1_string, str, -1)) {
-                        ASN1err(ASN1_F_ASN1_STR2TYPE, ERR_R_MALLOC_FAILURE);
-                        goto bad_str;
-                }
-                atmp->value.asn1_string->type = utype;
-                if (!ASN1_TIME_check(atmp->value.asn1_string)) {
-                        ASN1err(ASN1_F_ASN1_STR2TYPE,
-                            ASN1_R_ILLEGAL_TIME_VALUE);
-                        goto bad_str;
-                }
-                break;
-
-        case V_ASN1_BMPSTRING:
-        case V_ASN1_PRINTABLESTRING:
-        case V_ASN1_IA5STRING:
-        case V_ASN1_T61STRING:
-        case V_ASN1_UTF8STRING:
-        case V_ASN1_VISIBLESTRING:
-        case V_ASN1_UNIVERSALSTRING:
-        case V_ASN1_GENERALSTRING:
-        case V_ASN1_NUMERICSTRING:
-
-                if (format == ASN1_GEN_FORMAT_ASCII)
-                        format = MBSTRING_ASC;
-                else if (format == ASN1_GEN_FORMAT_UTF8)
-                        format = MBSTRING_UTF8;
-                else {
-                        ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_ILLEGAL_FORMAT);
-                        goto bad_form;
-                }
-
-                if (ASN1_mbstring_copy(&atmp->value.asn1_string,
-                    (unsigned char *)str, -1, format,
-                    ASN1_tag2bit(utype)) <= 0) {
-                        ASN1err(ASN1_F_ASN1_STR2TYPE, ERR_R_MALLOC_FAILURE);
-                        goto bad_str;
-                }
-                break;
-
-        case V_ASN1_BIT_STRING:
-        case V_ASN1_OCTET_STRING:
-                if (!(atmp->value.asn1_string = ASN1_STRING_new())) {
-                        ASN1err(ASN1_F_ASN1_STR2TYPE, ERR_R_MALLOC_FAILURE);
-                        goto bad_form;
-                }
-
-                if (format == ASN1_GEN_FORMAT_HEX) {
-
-                        if (!(rdata = string_to_hex((char *)str, &rdlen))) {
-                                ASN1err(ASN1_F_ASN1_STR2TYPE,
-                                    ASN1_R_ILLEGAL_HEX);
-                                goto bad_str;
-                        }
-
-                        atmp->value.asn1_string->data = rdata;
-                        atmp->value.asn1_string->length = rdlen;
-                        atmp->value.asn1_string->type = utype;
-
-                } else if (format == ASN1_GEN_FORMAT_ASCII) {
-                        if (ASN1_STRING_set(atmp->value.asn1_string, str,
-                            -1) == 0) {
-                                ASN1err(ASN1_F_ASN1_STR2TYPE,
-                                    ERR_R_MALLOC_FAILURE);
-                                goto bad_str;
-                        }
-                } else if ((format == ASN1_GEN_FORMAT_BITLIST) &&
-                    (utype == V_ASN1_BIT_STRING)) {
-                        if (!CONF_parse_list(str, ',', 1, bitstr_cb,
-                            atmp->value.bit_string)) {
-                                ASN1err(ASN1_F_ASN1_STR2TYPE,
-                                    ASN1_R_LIST_ERROR);
-                                goto bad_str;
-                        }
-                        no_unused = 0;
-
-                } else {
-                        ASN1err(ASN1_F_ASN1_STR2TYPE,
-                            ASN1_R_ILLEGAL_BITSTRING_FORMAT);
-                        goto bad_form;
-                }
-
-                if ((utype == V_ASN1_BIT_STRING) && no_unused) {
-                        atmp->value.asn1_string->flags &=
-                            ~(ASN1_STRING_FLAG_BITS_LEFT | 0x07);
-                        atmp->value.asn1_string->flags |=
-                            ASN1_STRING_FLAG_BITS_LEFT;
-                }
-
-                break;
-
-        default:
-                ASN1err(ASN1_F_ASN1_STR2TYPE, ASN1_R_UNSUPPORTED_TYPE);
-                goto bad_str;
-                break;
-        }
-
-        atmp->type = utype;
-        return atmp;
-
-bad_str:
-        ERR_asprintf_error_data("string=%s", str);
-bad_form:
-        ASN1_TYPE_free(atmp);
-        return NULL;
-}
-
-static int
-bitstr_cb(const char *elem, int len, void *bitstr)
-{
-        long bitnum;
-        char *eptr;
-
-        if (!elem)
-                return 0;
-        bitnum = strtoul(elem, &eptr, 10);
-        if (eptr && *eptr && (eptr != elem + len))
-                return 0;
-        if (bitnum < 0) {
-                ASN1err(ASN1_F_BITSTR_CB, ASN1_R_INVALID_NUMBER);
-                return 0;
-        }
-        if (!ASN1_BIT_STRING_set_bit(bitstr, bitnum, 1)) {
-                ASN1err(ASN1_F_BITSTR_CB, ERR_R_MALLOC_FAILURE);
-                return 0;
-        }
-        return 1;
-}
diff --git a/src/lib/libcrypto/asn1/asn1_lib.c b/src/lib/libcrypto/asn1/asn1_lib.c
deleted file mode 100644
index 5d14a2780f..0000000000
--- a/src/lib/libcrypto/asn1/asn1_lib.c
+++ /dev/null
@@ -1,486 +0,0 @@
-/* $OpenBSD: asn1_lib.c,v 1.36 2015/07/29 14:53:20 jsing Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <limits.h>
-#include <stdio.h>
-#include <string.h>
-
-#include <openssl/asn1.h>
-#include <openssl/err.h>
-
-static int asn1_get_length(const unsigned char **pp, int *inf, long *rl, int max);
-static void asn1_put_length(unsigned char **pp, int length);
-
-static int
-_asn1_check_infinite_end(const unsigned char **p, long len)
-{
-        /* If there is 0 or 1 byte left, the length check should pick
-         * things up */
-        if (len <= 0)
-                return (1);
-        else if ((len >= 2) && ((*p)[0] == 0) && ((*p)[1] == 0)) {
-                (*p) += 2;
-                return (1);
-        }
-        return (0);
-}
-
-int
-ASN1_check_infinite_end(unsigned char **p, long len)
-{
-        return _asn1_check_infinite_end((const unsigned char **)p, len);
-}
-
-int
-ASN1_const_check_infinite_end(const unsigned char **p, long len)
-{
-        return _asn1_check_infinite_end(p, len);
-}
-
-int
-ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
-    int *pclass, long omax)
-{
-        int i, ret;
-        long l;
-        const unsigned char *p= *pp;
-        int tag, xclass, inf;
-        long max = omax;
-
-        if (!max)
-                goto err;
-        ret = (*p & V_ASN1_CONSTRUCTED);
-        xclass = (*p & V_ASN1_PRIVATE);
-        i= *p & V_ASN1_PRIMITIVE_TAG;
-        if (i == V_ASN1_PRIMITIVE_TAG) {                /* high-tag */
-                p++;
-                if (--max == 0)
-                        goto err;
-                l = 0;
-                while (*p & 0x80) {
-                        l <<= 7L;
-                        l |= *(p++) & 0x7f;
-                        if (--max == 0)
-                                goto err;
-                        if (l > (INT_MAX >> 7L))
-                                goto err;
-                }
-                l <<= 7L;
-                l |= *(p++) & 0x7f;
-                tag = (int)l;
-                if (--max == 0)
-                        goto err;
-        } else {
-                tag = i;
-                p++;
-                if (--max == 0)
-                        goto err;
-        }
-        *ptag = tag;
-        *pclass = xclass;
-        if (!asn1_get_length(&p, &inf, plength, (int)max))
-                goto err;
-
-        if (inf && !(ret & V_ASN1_CONSTRUCTED))
-                goto err;
-
-        if (*plength > (omax - (p - *pp))) {
-                ASN1err(ASN1_F_ASN1_GET_OBJECT, ASN1_R_TOO_LONG);
-                /* Set this so that even if things are not long enough
-                 * the values are set correctly */
-                ret |= 0x80;
-        }
-        *pp = p;
-        return (ret | inf);
-
-err:
-        ASN1err(ASN1_F_ASN1_GET_OBJECT, ASN1_R_HEADER_TOO_LONG);
-        return (0x80);
-}
-
-static int
-asn1_get_length(const unsigned char **pp, int *inf, long *rl, int max)
-{
-        const unsigned char *p= *pp;
-        unsigned long ret = 0;
-        unsigned int i;
-
-        if (max-- < 1)
-                return (0);
-        if (*p == 0x80) {
-                *inf = 1;
-                ret = 0;
-                p++;
-        } else {
-                *inf = 0;
-                i= *p & 0x7f;
-                if (*(p++) & 0x80) {
-                        if (max < (int)i)
-                                return (0);
-                        /* skip leading zeroes */
-                        while (i && *p == 0) {
-                                p++;
-                                i--;
-                        }
-                        if (i > sizeof(long))
-                                return 0;
-                        while (i-- > 0) {
-                                ret <<= 8L;
-                                ret |= *(p++);
-                        }
-                } else
-                        ret = i;
-        }
-        if (ret > LONG_MAX)
-                return 0;
-        *pp = p;
-        *rl = (long)ret;
-        return (1);
-}
-
-/* class 0 is constructed
- * constructed == 2 for indefinite length constructed */
-void
-ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
-    int xclass)
-{
-        unsigned char *p= *pp;
-        int i, ttag;
-
-        i = (constructed) ? V_ASN1_CONSTRUCTED : 0;
-        i |= (xclass & V_ASN1_PRIVATE);
-        if (tag < 31)
-                *(p++) = i | (tag & V_ASN1_PRIMITIVE_TAG);
-        else {
-                *(p++) = i | V_ASN1_PRIMITIVE_TAG;
-                for(i = 0, ttag = tag; ttag > 0; i++)
-                        ttag >>= 7;
-                ttag = i;
-                while (i-- > 0) {
-                        p[i] = tag & 0x7f;
-                        if (i != (ttag - 1))
-                                p[i] |= 0x80;
-                        tag >>= 7;
-                }
-                p += ttag;
-        }
-        if (constructed == 2)
-                *(p++) = 0x80;
-        else
-                asn1_put_length(&p, length);
-        *pp = p;
-}
-
-int
-ASN1_put_eoc(unsigned char **pp)
-{
-        unsigned char *p = *pp;
-
-        *p++ = 0;
-        *p++ = 0;
-        *pp = p;
-        return 2;
-}
-
-static void
-asn1_put_length(unsigned char **pp, int length)
-{
-        unsigned char *p= *pp;
-
-        int i, l;
-        if (length <= 127)
-                *(p++) = (unsigned char)length;
-        else {
-                l = length;
-                for (i = 0; l > 0; i++)
-                        l >>= 8;
-                *(p++) = i | 0x80;
-                l = i;
-                while (i-- > 0) {
-                        p[i] = length & 0xff;
-                        length >>= 8;
-                }
-                p += l;
-        }
-        *pp = p;
-}
-
-int
-ASN1_object_size(int constructed, int length, int tag)
-{
-        int ret;
-
-        ret = length;
-        ret++;
-        if (tag >= 31) {
-                while (tag > 0) {
-                        tag >>= 7;
-                        ret++;
-                }
-        }
-        if (constructed == 2)
-                return ret + 3;
-        ret++;
-        if (length > 127) {
-                while (length > 0) {
-                        length >>= 8;
-                        ret++;
-                }
-        }
-        return (ret);
-}
-
-static int
-_asn1_Finish(ASN1_const_CTX *c)
-{
-        if ((c->inf == (1|V_ASN1_CONSTRUCTED)) && (!c->eos)) {
-                if (!ASN1_const_check_infinite_end(&c->p, c->slen)) {
-                        c->error = ERR_R_MISSING_ASN1_EOS;
-                        return (0);
-                }
-        }
-        if (((c->slen != 0) && !(c->inf & 1)) ||
-            ((c->slen < 0) && (c->inf & 1))) {
-                c->error = ERR_R_ASN1_LENGTH_MISMATCH;
-                return (0);
-        }
-        return (1);
-}
-
-int
-asn1_Finish(ASN1_CTX *c)
-{
-        return _asn1_Finish((ASN1_const_CTX *)c);
-}
-
-int
-asn1_const_Finish(ASN1_const_CTX *c)
-{
-        return _asn1_Finish(c);
-}
-
-int
-asn1_GetSequence(ASN1_const_CTX *c, long *length)
-{
-        const unsigned char *q;
-
-        q = c->p;
-        c->inf = ASN1_get_object(&(c->p), &(c->slen), &(c->tag), &(c->xclass),
-            *length);
-        if (c->inf & 0x80) {
-                c->error = ERR_R_BAD_GET_ASN1_OBJECT_CALL;
-                return (0);
-        }
-        if (c->tag != V_ASN1_SEQUENCE) {
-                c->error = ERR_R_EXPECTING_AN_ASN1_SEQUENCE;
-                return (0);
-        }
-        (*length) -= (c->p - q);
-        if (c->max && (*length < 0)) {
-                c->error = ERR_R_ASN1_LENGTH_MISMATCH;
-                return (0);
-        }
-        if (c->inf == (1|V_ASN1_CONSTRUCTED))
-                c->slen= *length+ *(c->pp) - c->p;
-        c->eos = 0;
-        return (1);
-}
-
-int
-ASN1_STRING_copy(ASN1_STRING *dst, const ASN1_STRING *str)
-{
-        if (str == NULL)
-                return 0;
-        dst->type = str->type;
-        if (!ASN1_STRING_set(dst, str->data, str->length))
-                return 0;
-        dst->flags = str->flags;
-        return 1;
-}
-
-ASN1_STRING *
-ASN1_STRING_dup(const ASN1_STRING *str)
-{
-        ASN1_STRING *ret;
-
-        if (!str)
-                return NULL;
-        ret = ASN1_STRING_new();
-        if (!ret)
-                return NULL;
-        if (!ASN1_STRING_copy(ret, str)) {
-                ASN1_STRING_free(ret);
-                return NULL;
-        }
-        return ret;
-}
-
-int
-ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)
-{
-        const char *data = _data;
-
-        if (len < 0) {
-                if (data == NULL)
-                        return (0);
-                else
-                        len = strlen(data);
-        }
-        if ((str->length < len) || (str->data == NULL)) {
-                unsigned char *tmp;
-                tmp = realloc(str->data, len + 1);
-                if (tmp == NULL) {
-                        ASN1err(ASN1_F_ASN1_STRING_SET, ERR_R_MALLOC_FAILURE);
-                        return (0);
-                }
-                str->data = tmp;
-        }
-        str->length = len;
-        if (data != NULL) {
-                memmove(str->data, data, len);
-        }
-        str->data[str->length]='\0';
-        return (1);
-}
-
-void
-ASN1_STRING_set0(ASN1_STRING *str, void *data, int len)
-{
-        free(str->data);
-        str->data = data;
-        str->length = len;
-}
-
-ASN1_STRING *
-ASN1_STRING_new(void)
-{
-        return (ASN1_STRING_type_new(V_ASN1_OCTET_STRING));
-}
-
-ASN1_STRING *
-ASN1_STRING_type_new(int type)
-{
-        ASN1_STRING *ret;
-
-        ret = malloc(sizeof(ASN1_STRING));
-        if (ret == NULL) {
-                ASN1err(ASN1_F_ASN1_STRING_TYPE_NEW, ERR_R_MALLOC_FAILURE);
-                return (NULL);
-        }
-        ret->length = 0;
-        ret->type = type;
-        ret->data = NULL;
-        ret->flags = 0;
-        return (ret);
-}
-
-void
-ASN1_STRING_free(ASN1_STRING *a)
-{
-        if (a == NULL)
-                return;
-        if (a->data && !(a->flags & ASN1_STRING_FLAG_NDEF))
-                free(a->data);
-        free(a);
-}
-
-int
-ASN1_STRING_cmp(const ASN1_STRING *a, const ASN1_STRING *b)
-{
-        int i;
-
-        i = (a->length - b->length);
-        if (i == 0) {
-                i = memcmp(a->data, b->data, a->length);
-                if (i == 0)
-                        return (a->type - b->type);
-                else
-                        return (i);
-        } else
-                return (i);
-}
-
-void
-asn1_add_error(const unsigned char *address, int offset)
-{
-        ERR_asprintf_error_data("offset=%d", offset);
-}
-
-int
-ASN1_STRING_length(const ASN1_STRING *x)
-{
-        return (x->length);
-}
-
-void
-ASN1_STRING_length_set(ASN1_STRING *x, int len)
-{
-        x->length = len;
-}
-
-int
-ASN1_STRING_type(ASN1_STRING *x)
-{
-        return (x->type);
-}
-
-unsigned char *
-ASN1_STRING_data(ASN1_STRING *x)
-{
-        return (x->data);
-}
diff --git a/src/lib/libcrypto/asn1/asn1_locl.h b/src/lib/libcrypto/asn1/asn1_locl.h
deleted file mode 100644
index c6c80aa6aa..0000000000
--- a/src/lib/libcrypto/asn1/asn1_locl.h
+++ /dev/null
@@ -1,151 +0,0 @@
-/* $OpenBSD: asn1_locl.h,v 1.5 2014/06/12 15:49:27 deraadt Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 2006.
- */
-/* ====================================================================
- * Copyright (c) 2006 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-/* Internal ASN1 structures and functions: not for application use */
-
-/* ASN1 print context structure */
-
-struct asn1_pctx_st {
-        unsigned long flags;
-        unsigned long nm_flags;
-        unsigned long cert_flags;
-        unsigned long oid_flags;
-        unsigned long str_flags;
-} /* ASN1_PCTX */;
-
-/* ASN1 public key method structure */
-
-struct evp_pkey_asn1_method_st {
-        int pkey_id;
-        int pkey_base_id;
-        unsigned long pkey_flags;
-
-        char *pem_str;
-        char *info;
-
-        int (*pub_decode)(EVP_PKEY *pk, X509_PUBKEY *pub);
-        int (*pub_encode)(X509_PUBKEY *pub, const EVP_PKEY *pk);
-        int (*pub_cmp)(const EVP_PKEY *a, const EVP_PKEY *b);
-        int (*pub_print)(BIO *out, const EVP_PKEY *pkey, int indent,
-            ASN1_PCTX *pctx);
-
-        int (*priv_decode)(EVP_PKEY *pk, PKCS8_PRIV_KEY_INFO *p8inf);
-        int (*priv_encode)(PKCS8_PRIV_KEY_INFO *p8, const EVP_PKEY *pk);
-        int (*priv_print)(BIO *out, const EVP_PKEY *pkey, int indent,
-            ASN1_PCTX *pctx);
-
-        int (*pkey_size)(const EVP_PKEY *pk);
-        int (*pkey_bits)(const EVP_PKEY *pk);
-
-        int (*param_decode)(EVP_PKEY *pkey, const unsigned char **pder,
-            int derlen);
-        int (*param_encode)(const EVP_PKEY *pkey, unsigned char **pder);
-        int (*param_missing)(const EVP_PKEY *pk);
-        int (*param_copy)(EVP_PKEY *to, const EVP_PKEY *from);
-        int (*param_cmp)(const EVP_PKEY *a, const EVP_PKEY *b);
-        int (*param_print)(BIO *out, const EVP_PKEY *pkey, int indent,
-            ASN1_PCTX *pctx);
-        int (*sig_print)(BIO *out, const X509_ALGOR *sigalg,
-            const ASN1_STRING *sig, int indent, ASN1_PCTX *pctx);
-
-        void (*pkey_free)(EVP_PKEY *pkey);
-        int (*pkey_ctrl)(EVP_PKEY *pkey, int op, long arg1, void *arg2);
-
-        /* Legacy functions for old PEM */
-
-        int (*old_priv_decode)(EVP_PKEY *pkey, const unsigned char **pder,
-            int derlen);
-        int (*old_priv_encode)(const EVP_PKEY *pkey, unsigned char **pder);
-        /* Custom ASN1 signature verification */
-        int (*item_verify)(EVP_MD_CTX *ctx, const ASN1_ITEM *it, void *asn,
-            X509_ALGOR *a, ASN1_BIT_STRING *sig, EVP_PKEY *pkey);
-        int (*item_sign)(EVP_MD_CTX *ctx, const ASN1_ITEM *it, void *asn,
-            X509_ALGOR *alg1, X509_ALGOR *alg2, ASN1_BIT_STRING *sig);
-
-} /* EVP_PKEY_ASN1_METHOD */;
-
-/* Method to handle CRL access.
- * In general a CRL could be very large (several Mb) and can consume large
- * amounts of resources if stored in memory by multiple processes.
- * This method allows general CRL operations to be redirected to more
- * efficient callbacks: for example a CRL entry database.
- */
-
-#define X509_CRL_METHOD_DYNAMIC         1
-
-struct x509_crl_method_st {
-        int flags;
-        int (*crl_init)(X509_CRL *crl);
-        int (*crl_free)(X509_CRL *crl);
-        int (*crl_lookup)(X509_CRL *crl, X509_REVOKED **ret,
-            ASN1_INTEGER *ser, X509_NAME *issuer);
-        int (*crl_verify)(X509_CRL *crl, EVP_PKEY *pk);
-};
-
-/*
- * Unicode codepoint constants
- */
-#define UNICODE_MAX             0x10FFFF
-#define UNICODE_SURROGATE_MIN   0x00D800
-#define UNICODE_SURROGATE_MAX   0x00DFFF
-
-#define UNICODE_IS_SURROGATE(x) \
-        ((x) >= UNICODE_SURROGATE_MIN && (x) <= UNICODE_SURROGATE_MAX)
-
-int UTF8_getc(const unsigned char *str, int len, unsigned long *val);
-int UTF8_putc(unsigned char *str, int len, unsigned long value);
diff --git a/src/lib/libcrypto/asn1/asn1_mac.h b/src/lib/libcrypto/asn1/asn1_mac.h
deleted file mode 100644
index fd524dc21c..0000000000
--- a/src/lib/libcrypto/asn1/asn1_mac.h
+++ /dev/null
@@ -1,426 +0,0 @@
-/* $OpenBSD: asn1_mac.h,v 1.14 2014/06/27 04:41:09 miod Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#ifndef HEADER_ASN1_MAC_H
-#define HEADER_ASN1_MAC_H
-
-#include <openssl/asn1.h>
-
-#ifdef  __cplusplus
-extern "C" {
-#endif
-
-#ifndef ASN1_MAC_ERR_LIB
-#define ASN1_MAC_ERR_LIB        ERR_LIB_ASN1
-#endif
-
-#define ASN1_MAC_H_err(f,r,line) \
-        ERR_PUT_error(ASN1_MAC_ERR_LIB,(f),(r),__FILE__,(line))
-
-#define M_ASN1_D2I_vars(a,type,func) \
-        ASN1_const_CTX c; \
-        type ret=NULL; \
-        \
-        c.pp=(const unsigned char **)pp; \
-        c.q= *(const unsigned char **)pp; \
-        c.error=ERR_R_NESTED_ASN1_ERROR; \
-        if ((a == NULL) || ((*a) == NULL)) \
-                { if ((ret=(type)func()) == NULL) \
-                        { c.line=__LINE__; goto err; } } \
-        else    ret=(*a);
-
-#define M_ASN1_D2I_Init() \
-        c.p= *(const unsigned char **)pp; \
-        c.max=(length == 0)?0:(c.p+length);
-
-#define M_ASN1_D2I_Finish_2(a) \
-        if (!asn1_const_Finish(&c)) \
-                { c.line=__LINE__; goto err; } \
-        *(const unsigned char **)pp=c.p; \
-        if (a != NULL) (*a)=ret; \
-        return(ret);
-
-#define M_ASN1_D2I_Finish(a,func,e) \
-        M_ASN1_D2I_Finish_2(a); \
-err:\
-        ASN1_MAC_H_err((e),c.error,c.line); \
-        asn1_add_error(*(const unsigned char **)pp,(int)(c.q- *pp)); \
-        if ((ret != NULL) && ((a == NULL) || (*a != ret))) func(ret); \
-        return(NULL)
-
-#define M_ASN1_D2I_start_sequence() \
-        if (!asn1_GetSequence(&c,&length)) \
-                { c.line=__LINE__; goto err; }
-/* Begin reading ASN1 without a surrounding sequence */
-#define M_ASN1_D2I_begin() \
-        c.slen = length;
-
-/* End reading ASN1 with no check on length */
-#define M_ASN1_D2I_Finish_nolen(a, func, e) \
-        *pp=c.p; \
-        if (a != NULL) (*a)=ret; \
-        return(ret); \
-err:\
-        ASN1_MAC_H_err((e),c.error,c.line); \
-        asn1_add_error(*pp,(int)(c.q- *pp)); \
-        if ((ret != NULL) && ((a == NULL) || (*a != ret))) func(ret); \
-        return(NULL)
-
-#define M_ASN1_D2I_end_sequence() \
-        (((c.inf&1) == 0)?(c.slen <= 0): \
-                (c.eos=ASN1_const_check_infinite_end(&c.p,c.slen)))
-
-/* Don't use this with d2i_ASN1_BOOLEAN() */
-#define M_ASN1_D2I_get(b, func) \
-        c.q=c.p; \
-        if (func(&(b),&c.p,c.slen) == NULL) \
-                {c.line=__LINE__; goto err; } \
-        c.slen-=(c.p-c.q);
-
-/* Don't use this with d2i_ASN1_BOOLEAN() */
-#define M_ASN1_D2I_get_x(type,b,func) \
-        c.q=c.p; \
-        if (((D2I_OF(type))func)(&(b),&c.p,c.slen) == NULL) \
-                {c.line=__LINE__; goto err; } \
-        c.slen-=(c.p-c.q);
-
-/* use this instead () */
-#define M_ASN1_D2I_get_int(b,func) \
-        c.q=c.p; \
-        if (func(&(b),&c.p,c.slen) < 0) \
-                {c.line=__LINE__; goto err; } \
-        c.slen-=(c.p-c.q);
-
-#define M_ASN1_D2I_get_opt(b,func,type) \
-        if ((c.slen != 0) && ((M_ASN1_next & (~V_ASN1_CONSTRUCTED)) \
-                == (V_ASN1_UNIVERSAL|(type)))) \
-                { \
-                M_ASN1_D2I_get(b,func); \
-                }
-
-#define M_ASN1_D2I_get_int_opt(b,func,type) \
-        if ((c.slen != 0) && ((M_ASN1_next & (~V_ASN1_CONSTRUCTED)) \
-                == (V_ASN1_UNIVERSAL|(type)))) \
-                { \
-                M_ASN1_D2I_get_int(b,func); \
-                }
-
-#define M_ASN1_D2I_get_imp(b,func, type) \
-        M_ASN1_next=(_tmp& V_ASN1_CONSTRUCTED)|type; \
-        c.q=c.p; \
-        if (func(&(b),&c.p,c.slen) == NULL) \
-                {c.line=__LINE__; M_ASN1_next_prev = _tmp; goto err; } \
-        c.slen-=(c.p-c.q);\
-        M_ASN1_next_prev=_tmp;
-
-#define M_ASN1_D2I_get_IMP_opt(b,func,tag,type) \
-        if ((c.slen != 0) && ((M_ASN1_next & (~V_ASN1_CONSTRUCTED)) == \
-                (V_ASN1_CONTEXT_SPECIFIC|(tag)))) \
-                { \
-                unsigned char _tmp = M_ASN1_next; \
-                M_ASN1_D2I_get_imp(b,func, type);\
-                }
-
-#define M_ASN1_D2I_get_set_type(type,r,func,free_func) \
-                M_ASN1_D2I_get_imp_set_type(type,r,func,free_func, \
-                        V_ASN1_SET,V_ASN1_UNIVERSAL);
-
-#define M_ASN1_D2I_get_set_opt_type(type,r,func,free_func) \
-        if ((c.slen != 0) && (M_ASN1_next == (V_ASN1_UNIVERSAL| \
-                V_ASN1_CONSTRUCTED|V_ASN1_SET)))\
-                { M_ASN1_D2I_get_set_type(type,r,func,free_func); }
-
-#define M_ASN1_I2D_len_SET_opt(a,f) \
-        if ((a != NULL) && (sk_num(a) != 0)) \
-                M_ASN1_I2D_len_SET(a,f);
-
-#define M_ASN1_I2D_put_SET_opt(a,f) \
-        if ((a != NULL) && (sk_num(a) != 0)) \
-                M_ASN1_I2D_put_SET(a,f);
-
-#define M_ASN1_I2D_put_SEQUENCE_opt(a,f) \
-        if ((a != NULL) && (sk_num(a) != 0)) \
-                M_ASN1_I2D_put_SEQUENCE(a,f);
-
-#define M_ASN1_I2D_put_SEQUENCE_opt_type(type,a,f) \
-        if ((a != NULL) && (sk_##type##_num(a) != 0)) \
-                M_ASN1_I2D_put_SEQUENCE_type(type,a,f);
-
-#define M_ASN1_D2I_get_IMP_set_opt_type(type,b,func,free_func,tag) \
-        if ((c.slen != 0) && \
-                (M_ASN1_next == \
-                (V_ASN1_CONTEXT_SPECIFIC|V_ASN1_CONSTRUCTED|(tag))))\
-                { \
-                M_ASN1_D2I_get_imp_set_type(type,b,func,free_func,\
-                        tag,V_ASN1_CONTEXT_SPECIFIC); \
-                }
-
-#define M_ASN1_D2I_get_seq_type(type,r,func,free_func) \
-                M_ASN1_D2I_get_imp_set_type(type,r,func,free_func,\
-                                            V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL)
-
-#define M_ASN1_D2I_get_seq_opt_type(type,r,func,free_func) \
-        if ((c.slen != 0) && (M_ASN1_next == (V_ASN1_UNIVERSAL| \
-                V_ASN1_CONSTRUCTED|V_ASN1_SEQUENCE)))\
-                { M_ASN1_D2I_get_seq_type(type,r,func,free_func); }
-
-#define M_ASN1_D2I_get_IMP_set_type(type,r,func,free_func,x) \
-                M_ASN1_D2I_get_imp_set_type(type,r,func,free_func,\
-                        x,V_ASN1_CONTEXT_SPECIFIC);
-
-#define M_ASN1_D2I_get_imp_set_type(type,r,func,free_func,a,b) \
-        c.q=c.p; \
-        if (d2i_ASN1_SET_OF_##type(&(r),&c.p,c.slen,func,\
-                                   free_func,a,b) == NULL) \
-                { c.line=__LINE__; goto err; } \
-        c.slen-=(c.p-c.q);
-
-#define M_ASN1_D2I_get_set_strings(r,func,a,b) \
-        c.q=c.p; \
-        if (d2i_ASN1_STRING_SET(&(r),&c.p,c.slen,a,b) == NULL) \
-                { c.line=__LINE__; goto err; } \
-        c.slen-=(c.p-c.q);
-
-#define M_ASN1_D2I_get_EXP_opt(r,func,tag) \
-        if ((c.slen != 0L) && (M_ASN1_next == \
-                (V_ASN1_CONSTRUCTED|V_ASN1_CONTEXT_SPECIFIC|tag))) \
-                { \
-                int Tinf,Ttag,Tclass; \
-                long Tlen; \
-                \
-                c.q=c.p; \
-                Tinf=ASN1_get_object(&c.p,&Tlen,&Ttag,&Tclass,c.slen); \
-                if (Tinf & 0x80) \
-                        { c.error=ERR_R_BAD_ASN1_OBJECT_HEADER; \
-                        c.line=__LINE__; goto err; } \
-                if (Tinf == (V_ASN1_CONSTRUCTED+1)) \
-                                        Tlen = c.slen - (c.p - c.q) - 2; \
-                if (func(&(r),&c.p,Tlen) == NULL) \
-                        { c.line=__LINE__; goto err; } \
-                if (Tinf == (V_ASN1_CONSTRUCTED+1)) { \
-                        Tlen = c.slen - (c.p - c.q); \
-                        if(!ASN1_const_check_infinite_end(&c.p, Tlen)) \
-                                { c.error=ERR_R_MISSING_ASN1_EOS; \
-                                c.line=__LINE__; goto err; } \
-                }\
-                c.slen-=(c.p-c.q); \
-                }
-
-#define M_ASN1_D2I_get_EXP_set_opt_type(type,r,func,free_func,tag,b) \
-        if ((c.slen != 0) && (M_ASN1_next == \
-                (V_ASN1_CONSTRUCTED|V_ASN1_CONTEXT_SPECIFIC|tag))) \
-                { \
-                int Tinf,Ttag,Tclass; \
-                long Tlen; \
-                \
-                c.q=c.p; \
-                Tinf=ASN1_get_object(&c.p,&Tlen,&Ttag,&Tclass,c.slen); \
-                if (Tinf & 0x80) \
-                        { c.error=ERR_R_BAD_ASN1_OBJECT_HEADER; \
-                        c.line=__LINE__; goto err; } \
-                if (Tinf == (V_ASN1_CONSTRUCTED+1)) \
-                                        Tlen = c.slen - (c.p - c.q) - 2; \
-                if (d2i_ASN1_SET_OF_##type(&(r),&c.p,Tlen,func, \
-                        free_func,b,V_ASN1_UNIVERSAL) == NULL) \
-                        { c.line=__LINE__; goto err; } \
-                if (Tinf == (V_ASN1_CONSTRUCTED+1)) { \
-                        Tlen = c.slen - (c.p - c.q); \
-                        if(!ASN1_check_infinite_end(&c.p, Tlen)) \
-                                { c.error=ERR_R_MISSING_ASN1_EOS; \
-                                c.line=__LINE__; goto err; } \
-                }\
-                c.slen-=(c.p-c.q); \
-                }
-
-/* BIG UGLY WARNING!  This is so damn ugly I wanna puke.  Unfortunately,
-   some macros that use ASN1_const_CTX still insist on writing in the input
-   stream.  ARGH!  ARGH!  ARGH!  Let's get rid of this macro package.
-   Please?                                              -- Richard Levitte */
-#define M_ASN1_next             (*((unsigned char *)(c.p)))
-#define M_ASN1_next_prev        (*((unsigned char *)(c.q)))
-
-/*************************************************/
-
-#define M_ASN1_I2D_vars(a)      int r=0,ret=0; \
-                                unsigned char *p; \
-                                if (a == NULL) return(0)
-
-/* Length Macros */
-#define M_ASN1_I2D_len(a,f)     ret+=f(a,NULL)
-#define M_ASN1_I2D_len_IMP_opt(a,f)     if (a != NULL) M_ASN1_I2D_len(a,f)
-
-#define M_ASN1_I2D_len_SET_type(type,a,f) \
-                ret+=i2d_ASN1_SET_OF_##type(a,NULL,f,V_ASN1_SET, \
-                                            V_ASN1_UNIVERSAL,IS_SET);
-
-#define M_ASN1_I2D_len_SEQUENCE_type(type,a,f) \
-                ret+=i2d_ASN1_SET_OF_##type(a,NULL,f,V_ASN1_SEQUENCE, \
-                                            V_ASN1_UNIVERSAL,IS_SEQUENCE)
-
-#define M_ASN1_I2D_len_SEQUENCE_opt(a,f) \
-                if ((a != NULL) && (sk_num(a) != 0)) \
-                        M_ASN1_I2D_len_SEQUENCE(a,f);
-
-#define M_ASN1_I2D_len_SEQUENCE_opt_type(type,a,f) \
-                if ((a != NULL) && (sk_##type##_num(a) != 0)) \
-                        M_ASN1_I2D_len_SEQUENCE_type(type,a,f);
-
-#define M_ASN1_I2D_len_IMP_SET_type(type,a,f,x) \
-                ret+=i2d_ASN1_SET_OF_##type(a,NULL,f,x, \
-                                            V_ASN1_CONTEXT_SPECIFIC,IS_SET);
-
-#define M_ASN1_I2D_len_IMP_SET_opt_type(type,a,f,x) \
-                if ((a != NULL) && (sk_##type##_num(a) != 0)) \
-                        ret+=i2d_ASN1_SET_OF_##type(a,NULL,f,x, \
-                                               V_ASN1_CONTEXT_SPECIFIC,IS_SET);
-
-#define M_ASN1_I2D_len_IMP_SEQUENCE_opt_type(type,a,f,x) \
-                if ((a != NULL) && (sk_##type##_num(a) != 0)) \
-                        ret+=i2d_ASN1_SET_OF_##type(a,NULL,f,x, \
-                                                    V_ASN1_CONTEXT_SPECIFIC, \
-                                                    IS_SEQUENCE);
-
-#define M_ASN1_I2D_len_EXP_opt(a,f,mtag,v) \
-                if (a != NULL)\
-                        { \
-                        v=f(a,NULL); \
-                        ret+=ASN1_object_size(1,v,mtag); \
-                        }
-
-#define M_ASN1_I2D_len_EXP_SEQUENCE_opt_type(type,a,f,mtag,tag,v) \
-                if ((a != NULL) && (sk_##type##_num(a) != 0))\
-                        { \
-                        v=i2d_ASN1_SET_OF_##type(a,NULL,f,tag, \
-                                                 V_ASN1_UNIVERSAL, \
-                                                 IS_SEQUENCE); \
-                        ret+=ASN1_object_size(1,v,mtag); \
-                        }
-
-/* Put Macros */
-#define M_ASN1_I2D_put(a,f)     f(a,&p)
-
-#define M_ASN1_I2D_put_IMP_opt(a,f,t)   \
-                if (a != NULL) \
-                        { \
-                        unsigned char *q=p; \
-                        f(a,&p); \
-                        *q=(V_ASN1_CONTEXT_SPECIFIC|t|(*q&V_ASN1_CONSTRUCTED));\
-                        }
-
-#define M_ASN1_I2D_put_SET_type(type,a,f) \
-     i2d_ASN1_SET_OF_##type(a,&p,f,V_ASN1_SET,V_ASN1_UNIVERSAL,IS_SET)
-#define M_ASN1_I2D_put_IMP_SET_type(type,a,f,x) \
-     i2d_ASN1_SET_OF_##type(a,&p,f,x,V_ASN1_CONTEXT_SPECIFIC,IS_SET)
-
-#define M_ASN1_I2D_put_SEQUENCE_type(type,a,f) \
-     i2d_ASN1_SET_OF_##type(a,&p,f,V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL, \
-                            IS_SEQUENCE)
-
-#define M_ASN1_I2D_put_SEQUENCE_opt(a,f) \
-                if ((a != NULL) && (sk_num(a) != 0)) \
-                        M_ASN1_I2D_put_SEQUENCE(a,f);
-
-#define M_ASN1_I2D_put_IMP_SET_opt_type(type,a,f,x) \
-                if ((a != NULL) && (sk_##type##_num(a) != 0)) \
-                        { i2d_ASN1_SET_OF_##type(a,&p,f,x, \
-                                                 V_ASN1_CONTEXT_SPECIFIC, \
-                                                 IS_SET); }
-
-#define M_ASN1_I2D_put_IMP_SEQUENCE_opt_type(type,a,f,x) \
-                if ((a != NULL) && (sk_##type##_num(a) != 0)) \
-                        { i2d_ASN1_SET_OF_##type(a,&p,f,x, \
-                                                 V_ASN1_CONTEXT_SPECIFIC, \
-                                                 IS_SEQUENCE); }
-
-#define M_ASN1_I2D_put_EXP_opt(a,f,tag,v) \
-                if (a != NULL) \
-                        { \
-                        ASN1_put_object(&p,1,v,tag,V_ASN1_CONTEXT_SPECIFIC); \
-                        f(a,&p); \
-                        }
-
-#define M_ASN1_I2D_put_EXP_SEQUENCE_opt_type(type,a,f,mtag,tag,v) \
-                if ((a != NULL) && (sk_##type##_num(a) != 0)) \
-                        { \
-                        ASN1_put_object(&p,1,v,mtag,V_ASN1_CONTEXT_SPECIFIC); \
-                        i2d_ASN1_SET_OF_##type(a,&p,f,tag,V_ASN1_UNIVERSAL, \
-                                               IS_SEQUENCE); \
-                        }
-
-#define M_ASN1_I2D_seq_total() \
-                r=ASN1_object_size(1,ret,V_ASN1_SEQUENCE); \
-                if (pp == NULL) return(r); \
-                p= *pp; \
-                ASN1_put_object(&p,1,ret,V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL)
-
-#define M_ASN1_I2D_INF_seq_start(tag,ctx) \
-                *(p++)=(V_ASN1_CONSTRUCTED|(tag)|(ctx)); \
-                *(p++)=0x80
-
-#define M_ASN1_I2D_INF_seq_end() *(p++)=0x00; *(p++)=0x00
-
-#define M_ASN1_I2D_finish()     *pp=p; \
-                                return(r);
-
-int asn1_GetSequence(ASN1_const_CTX *c, long *length);
-void asn1_add_error(const unsigned char *address, int offset);
-#ifdef  __cplusplus
-}
-#endif
-
-#endif
diff --git a/src/lib/libcrypto/asn1/asn1_par.c b/src/lib/libcrypto/asn1/asn1_par.c
deleted file mode 100644
index b5742fe97d..0000000000
--- a/src/lib/libcrypto/asn1/asn1_par.c
+++ /dev/null
@@ -1,397 +0,0 @@
-/* $OpenBSD: asn1_par.c,v 1.22 2015/02/07 13:19:15 doug Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-
-#include <openssl/asn1.h>
-#include <openssl/buffer.h>
-#include <openssl/objects.h>
-
-static int asn1_print_info(BIO *bp, int tag, int xclass, int constructed,
-    int indent);
-static int asn1_parse2(BIO *bp, const unsigned char **pp, long length,
-    int offset, int depth, int indent, int dump);
-
-static int
-asn1_print_info(BIO *bp, int tag, int xclass, int constructed,
-    int indent)
-{
-        char str[128];
-        const char *p;
-
-        if (constructed & V_ASN1_CONSTRUCTED)
-                p="cons: ";
-        else
-                p="prim: ";
-        if (BIO_write(bp, p, 6) < 6)
-                goto err;
-        BIO_indent(bp, indent, 128);
-
-        p = str;
-        if ((xclass & V_ASN1_PRIVATE) == V_ASN1_PRIVATE)
-                snprintf(str, sizeof str, "priv [ %d ] ", tag);
-        else if ((xclass & V_ASN1_CONTEXT_SPECIFIC) == V_ASN1_CONTEXT_SPECIFIC)
-                snprintf(str, sizeof str, "cont [ %d ]", tag);
-        else if ((xclass & V_ASN1_APPLICATION) == V_ASN1_APPLICATION)
-                snprintf(str, sizeof str, "appl [ %d ]", tag);
-        else if (tag > 30)
-                snprintf(str, sizeof str, "<ASN1 %d>", tag);
-        else
-                p = ASN1_tag2str(tag);
-
-        if (BIO_printf(bp, "%-18s", p) <= 0)
-                goto err;
-        return (1);
-err:
-        return (0);
-}
-
-int
-ASN1_parse(BIO *bp, const unsigned char *pp, long len, int indent)
-{
-        return (asn1_parse2(bp, &pp, len, 0, 0, indent, 0));
-}
-
-int
-ASN1_parse_dump(BIO *bp, const unsigned char *pp, long len, int indent, int dump)
-{
-        return (asn1_parse2(bp, &pp, len, 0, 0, indent, dump));
-}
-
-static int
-asn1_parse2(BIO *bp, const unsigned char **pp, long length, int offset,
-    int depth, int indent, int dump)
-{
-        const unsigned char *p, *ep, *tot, *op, *opp;
-        long len;
-        int tag, xclass, ret = 0;
-        int nl, hl, j, r;
-        ASN1_OBJECT *o = NULL;
-        ASN1_OCTET_STRING *os = NULL;
-        /* ASN1_BMPSTRING *bmp=NULL;*/
-        int dump_indent;
-
-        dump_indent = 6;        /* Because we know BIO_dump_indent() */
-        p = *pp;
-        tot = p + length;
-        op = p - 1;
-        while ((p < tot) && (op < p)) {
-                op = p;
-                j = ASN1_get_object(&p, &len, &tag, &xclass, length);
-
-                if (j & 0x80) {
-                        if (BIO_write(bp, "Error in encoding\n", 18) <= 0)
-                                goto end;
-                        ret = 0;
-                        goto end;
-                }
-                hl = (p - op);
-                length -= hl;
-                /* if j == 0x21 it is a constructed indefinite length object */
-                if (BIO_printf(bp, "%5ld:", (long)offset +
-                    (long)(op - *pp)) <= 0)
-                    goto end;
-
-                if (j != (V_ASN1_CONSTRUCTED | 1)) {
-                        if (BIO_printf(bp, "d=%-2d hl=%ld l=%4ld ",
-                            depth, (long)hl, len) <= 0)
-                                goto end;
-                } else {
-                        if (BIO_printf(bp, "d=%-2d hl=%ld l=inf  ",
-                            depth, (long)hl) <= 0)
-                                goto end;
-                }
-                if (!asn1_print_info(bp, tag, xclass, j, (indent) ? depth : 0))
-                        goto end;
-                if (j & V_ASN1_CONSTRUCTED) {
-                        ep = p + len;
-                        if (BIO_write(bp, "\n", 1) <= 0)
-                                goto end;
-                        if (len > length) {
-                                BIO_printf(bp, "length is greater than %ld\n",
-                                    length);
-                                ret = 0;
-                                goto end;
-                        }
-                        if ((j == 0x21) && (len == 0)) {
-                                for (;;) {
-                                        r = asn1_parse2(bp, &p, (long)(tot - p),
-                                            offset + (p - *pp), depth + 1,
-                                            indent, dump);
-                                        if (r == 0) {
-                                                ret = 0;
-                                                goto end;
-                                        }
-                                        if ((r == 2) || (p >= tot))
-                                                break;
-                                }
-                        } else
-                                while (p < ep) {
-                                        r = asn1_parse2(bp, &p, (long)len,
-                                            offset + (p - *pp), depth + 1,
-                                            indent, dump);
-                                        if (r == 0) {
-                                                ret = 0;
-                                                goto end;
-                                        }
-                                }
-                } else if (xclass != 0) {
-                        p += len;
-                        if (BIO_write(bp, "\n", 1) <= 0)
-                                goto end;
-                } else {
-                        nl = 0;
-                        if ((tag == V_ASN1_PRINTABLESTRING) ||
-                            (tag == V_ASN1_T61STRING) ||
-                            (tag == V_ASN1_IA5STRING) ||
-                            (tag == V_ASN1_VISIBLESTRING) ||
-                            (tag == V_ASN1_NUMERICSTRING) ||
-                            (tag == V_ASN1_UTF8STRING) ||
-                            (tag == V_ASN1_UTCTIME) ||
-                            (tag == V_ASN1_GENERALIZEDTIME)) {
-                                if (BIO_write(bp, ":", 1) <= 0)
-                                        goto end;
-                                if ((len > 0) &&
-                                    BIO_write(bp, (const char *)p, (int)len) !=
-                                    (int)len)
-                                        goto end;
-                        } else if (tag == V_ASN1_OBJECT) {
-                                opp = op;
-                                if (d2i_ASN1_OBJECT(&o, &opp, len + hl) !=
-                                    NULL) {
-                                        if (BIO_write(bp, ":", 1) <= 0)
-                                                goto end;
-                                        i2a_ASN1_OBJECT(bp, o);
-                                } else {
-                                        if (BIO_write(bp, ":BAD OBJECT",
-                                            11) <= 0)
-                                                goto end;
-                                }
-                        } else if (tag == V_ASN1_BOOLEAN) {
-                                int ii;
-
-                                opp = op;
-                                ii = d2i_ASN1_BOOLEAN(NULL, &opp, len + hl);
-                                if (ii < 0) {
-                                        if (BIO_write(bp, "Bad boolean\n",
-                                            12) <= 0)
-                                                goto end;
-                                }
-                                BIO_printf(bp, ":%d", ii);
-                        } else if (tag == V_ASN1_BMPSTRING) {
-                                /* do the BMP thang */
-                        } else if (tag == V_ASN1_OCTET_STRING) {
-                                int i, printable = 1;
-
-                                opp = op;
-                                os = d2i_ASN1_OCTET_STRING(NULL, &opp, len + hl);
-                                if (os != NULL && os->length > 0) {
-                                        opp = os->data;
-                                        /* testing whether the octet string is
-                                         * printable */
-                                        for (i = 0; i < os->length; i++) {
-                                                if (((opp[i] < ' ') &&
-                                                    (opp[i] != '\n') &&
-                                                    (opp[i] != '\r') &&
-                                                    (opp[i] != '\t')) ||
-                                                    (opp[i] > '~')) {
-                                                        printable = 0;
-                                                        break;
-                                                }
-                                        }
-                                        if (printable) {
-                                                /* printable string */
-                                                if (BIO_write(bp, ":", 1) <= 0)
-                                                        goto end;
-                                                if (BIO_write(bp, (const char *)opp,
-                                                            os->length) <= 0)
-                                                        goto end;
-                                        } else if (!dump) {
-                                                /* not printable => print octet string
-                                                 * as hex dump */
-                                                if (BIO_write(bp, "[HEX DUMP]:", 11) <= 0)
-                                                        goto end;
-                                                for (i = 0; i < os->length; i++) {
-                                                        if (BIO_printf(bp,
-                                                            "%02X", opp[i]) <= 0)
-                                                                goto end;
-                                                }
-                                        } else {
-                                                /* print the normal dump */
-                                                if (!nl) {
-                                                        if (BIO_write(bp, "\n", 1) <= 0)
-                                                                goto end;
-                                                }
-                                                if (BIO_dump_indent(bp,
-                                                    (const char *)opp,
-                                                    ((dump == -1 || dump >
-                                                    os->length) ? os->length : dump),
-                                                    dump_indent) <= 0)
-                                                        goto end;
-                                                nl = 1;
-                                        }
-                                }
-                                M_ASN1_OCTET_STRING_free(os);
-                                os = NULL;
-                        } else if (tag == V_ASN1_INTEGER) {
-                                ASN1_INTEGER *bs;
-                                int i;
-
-                                opp = op;
-                                bs = d2i_ASN1_INTEGER(NULL, &opp, len + hl);
-                                if (bs != NULL) {
-                                        if (BIO_write(bp, ":", 1) <= 0)
-                                                goto end;
-                                        if (bs->type == V_ASN1_NEG_INTEGER)
-                                                if (BIO_write(bp, "-", 1) <= 0)
-                                                        goto end;
-                                        for (i = 0; i < bs->length; i++) {
-                                                if (BIO_printf(bp, "%02X",
-                                                    bs->data[i]) <= 0)
-                                                        goto end;
-                                        }
-                                        if (bs->length == 0) {
-                                                if (BIO_write(bp, "00", 2) <= 0)
-                                                        goto end;
-                                        }
-                                } else {
-                                        if (BIO_write(bp, "BAD INTEGER", 11) <= 0)
-                                                goto end;
-                                }
-                                M_ASN1_INTEGER_free(bs);
-                        } else if (tag == V_ASN1_ENUMERATED) {
-                                ASN1_ENUMERATED *bs;
-                                int i;
-
-                                opp = op;
-                                bs = d2i_ASN1_ENUMERATED(NULL, &opp, len + hl);
-                                if (bs != NULL) {
-                                        if (BIO_write(bp, ":", 1) <= 0)
-                                                goto end;
-                                        if (bs->type == V_ASN1_NEG_ENUMERATED)
-                                                if (BIO_write(bp, "-", 1) <= 0)
-                                                        goto end;
-                                        for (i = 0; i < bs->length; i++) {
-                                                if (BIO_printf(bp, "%02X",
-                                                    bs->data[i]) <= 0)
-                                                        goto end;
-                                        }
-                                        if (bs->length == 0) {
-                                                if (BIO_write(bp, "00", 2) <= 0)
-                                                        goto end;
-                                        }
-                                } else {
-                                        if (BIO_write(bp, "BAD ENUMERATED", 14) <= 0)
-                                                goto end;
-                                }
-                                M_ASN1_ENUMERATED_free(bs);
-                        } else if (len > 0 && dump) {
-                                if (!nl) {
-                                        if (BIO_write(bp, "\n", 1) <= 0)
-                                                goto end;
-                                }
-                                if (BIO_dump_indent(bp, (const char *)p,
-                                    ((dump == -1 || dump > len) ? len : dump),
-                                    dump_indent) <= 0)
-                                        goto end;
-                                nl = 1;
-                        }
-
-                        if (!nl) {
-                                if (BIO_write(bp, "\n", 1) <= 0)
-                                        goto end;
-                        }
-                        p += len;
-                        if ((tag == V_ASN1_EOC) && (xclass == 0)) {
-                                ret = 2; /* End of sequence */
-                                goto end;
-                        }
-                }
-                length -= len;
-        }
-        ret = 1;
-
-end:
-        if (o != NULL)
-                ASN1_OBJECT_free(o);
-        M_ASN1_OCTET_STRING_free(os);
-        *pp = p;
-        return (ret);
-}
-
-const char *
-ASN1_tag2str(int tag)
-{
-        static const char * const tag2str[] = {
-                "EOC", "BOOLEAN", "INTEGER", "BIT STRING", "OCTET STRING", /* 0-4 */
-                "NULL", "OBJECT", "OBJECT DESCRIPTOR", "EXTERNAL", "REAL", /* 5-9 */
-                "ENUMERATED", "<ASN1 11>", "UTF8STRING", "<ASN1 13>",       /* 10-13 */
-                "<ASN1 14>", "<ASN1 15>", "SEQUENCE", "SET",                /* 15-17 */
-                "NUMERICSTRING", "PRINTABLESTRING", "T61STRING",            /* 18-20 */
-                "VIDEOTEXSTRING", "IA5STRING", "UTCTIME", "GENERALIZEDTIME", /* 21-24 */
-                "GRAPHICSTRING", "VISIBLESTRING", "GENERALSTRING",          /* 25-27 */
-                "UNIVERSALSTRING", "<ASN1 29>", "BMPSTRING"                 /* 28-30 */
-        };
-
-        if ((tag == V_ASN1_NEG_INTEGER) || (tag == V_ASN1_NEG_ENUMERATED))
-                tag &= ~0x100;
-
-        if (tag < 0 || tag > 30)
-                return "(unknown)";
-        return tag2str[tag];
-}
diff --git a/src/lib/libcrypto/asn1/asn1t.h b/src/lib/libcrypto/asn1/asn1t.h
deleted file mode 100644
index 27f591c464..0000000000
--- a/src/lib/libcrypto/asn1/asn1t.h
+++ /dev/null
@@ -1,880 +0,0 @@
-/* $OpenBSD: asn1t.h,v 1.13 2015/07/25 17:20:02 jsing Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 2000.
- */
-/* ====================================================================
- * Copyright (c) 2000-2005 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer. 
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-#ifndef HEADER_ASN1T_H
-#define HEADER_ASN1T_H
-
-#include <stddef.h>
-
-#include <openssl/opensslconf.h>
-
-#include <openssl/asn1.h>
-
-/* ASN1 template defines, structures and functions */
-
-#ifdef  __cplusplus
-extern "C" {
-#endif
-
-#ifndef LIBRESSL_INTERNAL
-
-/* Macro to obtain ASN1_ADB pointer from a type (only used internally) */
-#define ASN1_ADB_ptr(iptr) ((const ASN1_ADB *)(iptr))
-
-
-/* Macros for start and end of ASN1_ITEM definition */
-
-#define ASN1_ITEM_start(itname) \
-        const ASN1_ITEM itname##_it = {
-
-#define ASN1_ITEM_end(itname) \
-                };
-
-
-
-/* Macros to aid ASN1 template writing */
-
-#define ASN1_ITEM_TEMPLATE(tname) \
-        static const ASN1_TEMPLATE tname##_item_tt 
-
-#define ASN1_ITEM_TEMPLATE_END(tname) \
-        ;\
-        ASN1_ITEM_start(tname) \
-                ASN1_ITYPE_PRIMITIVE,\
-                -1,\
-                &tname##_item_tt,\
-                0,\
-                NULL,\
-                0,\
-                #tname \
-        ASN1_ITEM_end(tname)
-
-
-/* This is a ASN1 type which just embeds a template */
- 
-/* This pair helps declare a SEQUENCE. We can do:
- *
- *      ASN1_SEQUENCE(stname) = {
- *              ... SEQUENCE components ...
- *      } ASN1_SEQUENCE_END(stname)
- *
- *      This will produce an ASN1_ITEM called stname_it
- *      for a structure called stname.
- *
- *      If you want the same structure but a different
- *      name then use:
- *
- *      ASN1_SEQUENCE(itname) = {
- *              ... SEQUENCE components ...
- *      } ASN1_SEQUENCE_END_name(stname, itname)
- *
- *      This will create an item called itname_it using
- *      a structure called stname.
- */
-
-#define ASN1_SEQUENCE(tname) \
-        static const ASN1_TEMPLATE tname##_seq_tt[] 
-
-#define ASN1_SEQUENCE_END(stname) ASN1_SEQUENCE_END_name(stname, stname)
-
-#define ASN1_SEQUENCE_END_name(stname, tname) \
-        ;\
-        ASN1_ITEM_start(tname) \
-                ASN1_ITYPE_SEQUENCE,\
-                V_ASN1_SEQUENCE,\
-                tname##_seq_tt,\
-                sizeof(tname##_seq_tt) / sizeof(ASN1_TEMPLATE),\
-                NULL,\
-                sizeof(stname),\
-                #stname \
-        ASN1_ITEM_end(tname)
-
-#define ASN1_NDEF_SEQUENCE(tname) \
-        ASN1_SEQUENCE(tname)
-
-#define ASN1_NDEF_SEQUENCE_cb(tname, cb) \
-        ASN1_SEQUENCE_cb(tname, cb)
-
-#define ASN1_SEQUENCE_cb(tname, cb) \
-        static const ASN1_AUX tname##_aux = {NULL, 0, 0, 0, cb, 0}; \
-        ASN1_SEQUENCE(tname)
-
-#define ASN1_BROKEN_SEQUENCE(tname) \
-        static const ASN1_AUX tname##_aux = {NULL, ASN1_AFLG_BROKEN, 0, 0, 0, 0}; \
-        ASN1_SEQUENCE(tname)
-
-#define ASN1_SEQUENCE_ref(tname, cb, lck) \
-        static const ASN1_AUX tname##_aux = {NULL, ASN1_AFLG_REFCOUNT, offsetof(tname, references), lck, cb, 0}; \
-        ASN1_SEQUENCE(tname)
-
-#define ASN1_SEQUENCE_enc(tname, enc, cb) \
-        static const ASN1_AUX tname##_aux = {NULL, ASN1_AFLG_ENCODING, 0, 0, cb, offsetof(tname, enc)}; \
-        ASN1_SEQUENCE(tname)
-
-#define ASN1_NDEF_SEQUENCE_END(tname) \
-        ;\
-        ASN1_ITEM_start(tname) \
-                ASN1_ITYPE_NDEF_SEQUENCE,\
-                V_ASN1_SEQUENCE,\
-                tname##_seq_tt,\
-                sizeof(tname##_seq_tt) / sizeof(ASN1_TEMPLATE),\
-                NULL,\
-                sizeof(tname),\
-                #tname \
-        ASN1_ITEM_end(tname)
-
-#define ASN1_BROKEN_SEQUENCE_END(stname) ASN1_SEQUENCE_END_ref(stname, stname)
-
-#define ASN1_SEQUENCE_END_enc(stname, tname) ASN1_SEQUENCE_END_ref(stname, tname)
-
-#define ASN1_SEQUENCE_END_cb(stname, tname) ASN1_SEQUENCE_END_ref(stname, tname)
-
-#define ASN1_SEQUENCE_END_ref(stname, tname) \
-        ;\
-        ASN1_ITEM_start(tname) \
-                ASN1_ITYPE_SEQUENCE,\
-                V_ASN1_SEQUENCE,\
-                tname##_seq_tt,\
-                sizeof(tname##_seq_tt) / sizeof(ASN1_TEMPLATE),\
-                &tname##_aux,\
-                sizeof(stname),\
-                #stname \
-        ASN1_ITEM_end(tname)
-
-#define ASN1_NDEF_SEQUENCE_END_cb(stname, tname) \
-        ;\
-        ASN1_ITEM_start(tname) \
-                ASN1_ITYPE_NDEF_SEQUENCE,\
-                V_ASN1_SEQUENCE,\
-                tname##_seq_tt,\
-                sizeof(tname##_seq_tt) / sizeof(ASN1_TEMPLATE),\
-                &tname##_aux,\
-                sizeof(stname),\
-                #stname \
-        ASN1_ITEM_end(tname)
-
-
-/* This pair helps declare a CHOICE type. We can do:
- *
- *      ASN1_CHOICE(chname) = {
- *              ... CHOICE options ...
- *      ASN1_CHOICE_END(chname)
- *
- *      This will produce an ASN1_ITEM called chname_it
- *      for a structure called chname. The structure
- *      definition must look like this:
- *      typedef struct {
- *              int type;
- *              union {
- *                      ASN1_SOMETHING *opt1;
- *                      ASN1_SOMEOTHER *opt2;
- *              } value;
- *      } chname;
- *      
- *      the name of the selector must be 'type'.
- *      to use an alternative selector name use the
- *      ASN1_CHOICE_END_selector() version.
- */
-
-#define ASN1_CHOICE(tname) \
-        static const ASN1_TEMPLATE tname##_ch_tt[] 
-
-#define ASN1_CHOICE_cb(tname, cb) \
-        static const ASN1_AUX tname##_aux = {NULL, 0, 0, 0, cb, 0}; \
-        ASN1_CHOICE(tname)
-
-#define ASN1_CHOICE_END(stname) ASN1_CHOICE_END_name(stname, stname)
-
-#define ASN1_CHOICE_END_name(stname, tname) ASN1_CHOICE_END_selector(stname, tname, type)
-
-#define ASN1_CHOICE_END_selector(stname, tname, selname) \
-        ;\
-        ASN1_ITEM_start(tname) \
-                ASN1_ITYPE_CHOICE,\
-                offsetof(stname,selname) ,\
-                tname##_ch_tt,\
-                sizeof(tname##_ch_tt) / sizeof(ASN1_TEMPLATE),\
-                NULL,\
-                sizeof(stname),\
-                #stname \
-        ASN1_ITEM_end(tname)
-
-#define ASN1_CHOICE_END_cb(stname, tname, selname) \
-        ;\
-        ASN1_ITEM_start(tname) \
-                ASN1_ITYPE_CHOICE,\
-                offsetof(stname,selname) ,\
-                tname##_ch_tt,\
-                sizeof(tname##_ch_tt) / sizeof(ASN1_TEMPLATE),\
-                &tname##_aux,\
-                sizeof(stname),\
-                #stname \
-        ASN1_ITEM_end(tname)
-
-/* This helps with the template wrapper form of ASN1_ITEM */
-
-#define ASN1_EX_TEMPLATE_TYPE(flags, tag, name, type) { \
-        (flags), (tag), 0,\
-        #name, ASN1_ITEM_ref(type) }
-
-/* These help with SEQUENCE or CHOICE components */
-
-/* used to declare other types */
-
-#define ASN1_EX_TYPE(flags, tag, stname, field, type) { \
-        (flags), (tag), offsetof(stname, field),\
-        #field, ASN1_ITEM_ref(type) }
-
-/* used when the structure is combined with the parent */
-
-#define ASN1_EX_COMBINE(flags, tag, type) { \
-        (flags)|ASN1_TFLG_COMBINE, (tag), 0, NULL, ASN1_ITEM_ref(type) }
-
-/* implicit and explicit helper macros */
-
-#define ASN1_IMP_EX(stname, field, type, tag, ex) \
-                ASN1_EX_TYPE(ASN1_TFLG_IMPLICIT | ex, tag, stname, field, type)
-
-#define ASN1_EXP_EX(stname, field, type, tag, ex) \
-                ASN1_EX_TYPE(ASN1_TFLG_EXPLICIT | ex, tag, stname, field, type)
-
-/* Any defined by macros: the field used is in the table itself */
-
-#define ASN1_ADB_OBJECT(tblname) { ASN1_TFLG_ADB_OID, -1, 0, #tblname, (const ASN1_ITEM *)&(tblname##_adb) }
-#define ASN1_ADB_INTEGER(tblname) { ASN1_TFLG_ADB_INT, -1, 0, #tblname, (const ASN1_ITEM *)&(tblname##_adb) }
-/* Plain simple type */
-#define ASN1_SIMPLE(stname, field, type) ASN1_EX_TYPE(0,0, stname, field, type)
-
-/* OPTIONAL simple type */
-#define ASN1_OPT(stname, field, type) ASN1_EX_TYPE(ASN1_TFLG_OPTIONAL, 0, stname, field, type)
-
-/* IMPLICIT tagged simple type */
-#define ASN1_IMP(stname, field, type, tag) ASN1_IMP_EX(stname, field, type, tag, 0)
-
-/* IMPLICIT tagged OPTIONAL simple type */
-#define ASN1_IMP_OPT(stname, field, type, tag) ASN1_IMP_EX(stname, field, type, tag, ASN1_TFLG_OPTIONAL)
-
-/* Same as above but EXPLICIT */
-
-#define ASN1_EXP(stname, field, type, tag) ASN1_EXP_EX(stname, field, type, tag, 0)
-#define ASN1_EXP_OPT(stname, field, type, tag) ASN1_EXP_EX(stname, field, type, tag, ASN1_TFLG_OPTIONAL)
-
-/* SEQUENCE OF type */
-#define ASN1_SEQUENCE_OF(stname, field, type) \
-                ASN1_EX_TYPE(ASN1_TFLG_SEQUENCE_OF, 0, stname, field, type)
-
-/* OPTIONAL SEQUENCE OF */
-#define ASN1_SEQUENCE_OF_OPT(stname, field, type) \
-                ASN1_EX_TYPE(ASN1_TFLG_SEQUENCE_OF|ASN1_TFLG_OPTIONAL, 0, stname, field, type)
-
-/* Same as above but for SET OF */
-
-#define ASN1_SET_OF(stname, field, type) \
-                ASN1_EX_TYPE(ASN1_TFLG_SET_OF, 0, stname, field, type)
-
-#define ASN1_SET_OF_OPT(stname, field, type) \
-                ASN1_EX_TYPE(ASN1_TFLG_SET_OF|ASN1_TFLG_OPTIONAL, 0, stname, field, type)
-
-/* Finally compound types of SEQUENCE, SET, IMPLICIT, EXPLICIT and OPTIONAL */
-
-#define ASN1_IMP_SET_OF(stname, field, type, tag) \
-                        ASN1_IMP_EX(stname, field, type, tag, ASN1_TFLG_SET_OF)
-
-#define ASN1_EXP_SET_OF(stname, field, type, tag) \
-                        ASN1_EXP_EX(stname, field, type, tag, ASN1_TFLG_SET_OF)
-
-#define ASN1_IMP_SET_OF_OPT(stname, field, type, tag) \
-                        ASN1_IMP_EX(stname, field, type, tag, ASN1_TFLG_SET_OF|ASN1_TFLG_OPTIONAL)
-
-#define ASN1_EXP_SET_OF_OPT(stname, field, type, tag) \
-                        ASN1_EXP_EX(stname, field, type, tag, ASN1_TFLG_SET_OF|ASN1_TFLG_OPTIONAL)
-
-#define ASN1_IMP_SEQUENCE_OF(stname, field, type, tag) \
-                        ASN1_IMP_EX(stname, field, type, tag, ASN1_TFLG_SEQUENCE_OF)
-
-#define ASN1_IMP_SEQUENCE_OF_OPT(stname, field, type, tag) \
-                        ASN1_IMP_EX(stname, field, type, tag, ASN1_TFLG_SEQUENCE_OF|ASN1_TFLG_OPTIONAL)
-
-#define ASN1_EXP_SEQUENCE_OF(stname, field, type, tag) \
-                        ASN1_EXP_EX(stname, field, type, tag, ASN1_TFLG_SEQUENCE_OF)
-
-#define ASN1_EXP_SEQUENCE_OF_OPT(stname, field, type, tag) \
-                        ASN1_EXP_EX(stname, field, type, tag, ASN1_TFLG_SEQUENCE_OF|ASN1_TFLG_OPTIONAL)
-
-/* EXPLICIT using indefinite length constructed form */
-#define ASN1_NDEF_EXP(stname, field, type, tag) \
-                        ASN1_EXP_EX(stname, field, type, tag, ASN1_TFLG_NDEF)
-
-/* EXPLICIT OPTIONAL using indefinite length constructed form */
-#define ASN1_NDEF_EXP_OPT(stname, field, type, tag) \
-                        ASN1_EXP_EX(stname, field, type, tag, ASN1_TFLG_OPTIONAL|ASN1_TFLG_NDEF)
-
-/* Macros for the ASN1_ADB structure */
-
-#define ASN1_ADB(name) \
-        static const ASN1_ADB_TABLE name##_adbtbl[] 
-
-
-#define ASN1_ADB_END(name, flags, field, app_table, def, none) \
-        ;\
-        static const ASN1_ADB name##_adb = {\
-                flags,\
-                offsetof(name, field),\
-                app_table,\
-                name##_adbtbl,\
-                sizeof(name##_adbtbl) / sizeof(ASN1_ADB_TABLE),\
-                def,\
-                none\
-        }
-
-
-#define ADB_ENTRY(val, template) {val, template}
-
-#define ASN1_ADB_TEMPLATE(name) \
-        static const ASN1_TEMPLATE name##_tt 
-
-#endif /* !LIBRESSL_INTERNAL */
-
-/* This is the ASN1 template structure that defines
- * a wrapper round the actual type. It determines the
- * actual position of the field in the value structure,
- * various flags such as OPTIONAL and the field name.
- */
-
-struct ASN1_TEMPLATE_st {
-unsigned long flags;            /* Various flags */
-long tag;                       /* tag, not used if no tagging */
-unsigned long offset;           /* Offset of this field in structure */
-#ifndef NO_ASN1_FIELD_NAMES
-const char *field_name;         /* Field name */
-#endif
-ASN1_ITEM_EXP *item;            /* Relevant ASN1_ITEM or ASN1_ADB */
-};
-
-/* Macro to extract ASN1_ITEM and ASN1_ADB pointer from ASN1_TEMPLATE */
-
-#define ASN1_TEMPLATE_item(t) (t->item_ptr)
-#define ASN1_TEMPLATE_adb(t) (t->item_ptr)
-
-typedef struct ASN1_ADB_TABLE_st ASN1_ADB_TABLE;
-typedef struct ASN1_ADB_st ASN1_ADB;
-
-struct ASN1_ADB_st {
-        unsigned long flags;    /* Various flags */
-        unsigned long offset;   /* Offset of selector field */
-        STACK_OF(ASN1_ADB_TABLE) **app_items; /* Application defined items */
-        const ASN1_ADB_TABLE *tbl;      /* Table of possible types */
-        long tblcount;          /* Number of entries in tbl */
-        const ASN1_TEMPLATE *default_tt;  /* Type to use if no match */
-        const ASN1_TEMPLATE *null_tt;  /* Type to use if selector is NULL */
-};
-
-struct ASN1_ADB_TABLE_st {
-        long value;             /* NID for an object or value for an int */
-        const ASN1_TEMPLATE tt;         /* item for this value */
-};
-
-/* template flags */
-
-/* Field is optional */
-#define ASN1_TFLG_OPTIONAL      (0x1)
-
-/* Field is a SET OF */
-#define ASN1_TFLG_SET_OF        (0x1 << 1)
-
-/* Field is a SEQUENCE OF */
-#define ASN1_TFLG_SEQUENCE_OF   (0x2 << 1)
-
-/* Special case: this refers to a SET OF that
- * will be sorted into DER order when encoded *and*
- * the corresponding STACK will be modified to match
- * the new order.
- */
-#define ASN1_TFLG_SET_ORDER     (0x3 << 1)
-
-/* Mask for SET OF or SEQUENCE OF */
-#define ASN1_TFLG_SK_MASK       (0x3 << 1)
-
-/* These flags mean the tag should be taken from the
- * tag field. If EXPLICIT then the underlying type
- * is used for the inner tag.
- */
-
-/* IMPLICIT tagging */
-#define ASN1_TFLG_IMPTAG        (0x1 << 3)
-
-
-/* EXPLICIT tagging, inner tag from underlying type */
-#define ASN1_TFLG_EXPTAG        (0x2 << 3)
-
-#define ASN1_TFLG_TAG_MASK      (0x3 << 3)
-
-/* context specific IMPLICIT */
-#define ASN1_TFLG_IMPLICIT      ASN1_TFLG_IMPTAG|ASN1_TFLG_CONTEXT
-
-/* context specific EXPLICIT */
-#define ASN1_TFLG_EXPLICIT      ASN1_TFLG_EXPTAG|ASN1_TFLG_CONTEXT
-
-/* If tagging is in force these determine the
- * type of tag to use. Otherwise the tag is
- * determined by the underlying type. These 
- * values reflect the actual octet format.
- */
-
-/* Universal tag */ 
-#define ASN1_TFLG_UNIVERSAL     (0x0<<6)
-/* Application tag */ 
-#define ASN1_TFLG_APPLICATION   (0x1<<6)
-/* Context specific tag */ 
-#define ASN1_TFLG_CONTEXT       (0x2<<6)
-/* Private tag */ 
-#define ASN1_TFLG_PRIVATE       (0x3<<6)
-
-#define ASN1_TFLG_TAG_CLASS     (0x3<<6)
-
-/* These are for ANY DEFINED BY type. In this case
- * the 'item' field points to an ASN1_ADB structure
- * which contains a table of values to decode the
- * relevant type
- */
-
-#define ASN1_TFLG_ADB_MASK      (0x3<<8)
-
-#define ASN1_TFLG_ADB_OID       (0x1<<8)
-
-#define ASN1_TFLG_ADB_INT       (0x1<<9)
-
-/* This flag means a parent structure is passed
- * instead of the field: this is useful is a
- * SEQUENCE is being combined with a CHOICE for
- * example. Since this means the structure and
- * item name will differ we need to use the
- * ASN1_CHOICE_END_name() macro for example.
- */
-
-#define ASN1_TFLG_COMBINE       (0x1<<10)
-
-/* This flag when present in a SEQUENCE OF, SET OF
- * or EXPLICIT causes indefinite length constructed
- * encoding to be used if required.
- */
-
-#define ASN1_TFLG_NDEF          (0x1<<11)
-
-/* This is the actual ASN1 item itself */
-
-struct ASN1_ITEM_st {
-char itype;                     /* The item type, primitive, SEQUENCE, CHOICE or extern */
-long utype;                     /* underlying type */
-const ASN1_TEMPLATE *templates; /* If SEQUENCE or CHOICE this contains the contents */
-long tcount;                    /* Number of templates if SEQUENCE or CHOICE */
-const void *funcs;              /* functions that handle this type */
-long size;                      /* Structure size (usually)*/
-#ifndef NO_ASN1_FIELD_NAMES
-const char *sname;              /* Structure name */
-#endif
-};
-
-/* These are values for the itype field and
- * determine how the type is interpreted.
- *
- * For PRIMITIVE types the underlying type
- * determines the behaviour if items is NULL.
- *
- * Otherwise templates must contain a single 
- * template and the type is treated in the
- * same way as the type specified in the template.
- *
- * For SEQUENCE types the templates field points
- * to the members, the size field is the
- * structure size.
- *
- * For CHOICE types the templates field points
- * to each possible member (typically a union)
- * and the 'size' field is the offset of the
- * selector.
- *
- * The 'funcs' field is used for application
- * specific functions. 
- *
- * The EXTERN type uses a new style d2i/i2d.
- * The new style should be used where possible
- * because it avoids things like the d2i IMPLICIT
- * hack.
- *
- * MSTRING is a multiple string type, it is used
- * for a CHOICE of character strings where the
- * actual strings all occupy an ASN1_STRING
- * structure. In this case the 'utype' field
- * has a special meaning, it is used as a mask
- * of acceptable types using the B_ASN1 constants.
- *
- * NDEF_SEQUENCE is the same as SEQUENCE except
- * that it will use indefinite length constructed
- * encoding if requested.
- *
- */
-
-#define ASN1_ITYPE_PRIMITIVE            0x0
-
-#define ASN1_ITYPE_SEQUENCE             0x1
-
-#define ASN1_ITYPE_CHOICE               0x2
-
-#define ASN1_ITYPE_EXTERN               0x4
-
-#define ASN1_ITYPE_MSTRING              0x5
-
-#define ASN1_ITYPE_NDEF_SEQUENCE        0x6
-
-/* Cache for ASN1 tag and length, so we
- * don't keep re-reading it for things
- * like CHOICE
- */
-
-struct ASN1_TLC_st{
-        char valid;     /* Values below are valid */
-        int ret;        /* return value */
-        long plen;      /* length */
-        int ptag;       /* class value */
-        int pclass;     /* class value */
-        int hdrlen;     /* header length */
-};
-
-/* Typedefs for ASN1 function pointers */
-
-typedef ASN1_VALUE * ASN1_new_func(void);
-typedef void ASN1_free_func(ASN1_VALUE *a);
-typedef ASN1_VALUE * ASN1_d2i_func(ASN1_VALUE **a, const unsigned char ** in, long length);
-typedef int ASN1_i2d_func(ASN1_VALUE * a, unsigned char **in);
-
-typedef int ASN1_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len, const ASN1_ITEM *it,
-                                        int tag, int aclass, char opt, ASN1_TLC *ctx);
-
-typedef int ASN1_ex_i2d(ASN1_VALUE **pval, unsigned char **out, const ASN1_ITEM *it, int tag, int aclass);
-typedef int ASN1_ex_new_func(ASN1_VALUE **pval, const ASN1_ITEM *it);
-typedef void ASN1_ex_free_func(ASN1_VALUE **pval, const ASN1_ITEM *it);
-
-typedef int ASN1_ex_print_func(BIO *out, ASN1_VALUE **pval, 
-                                                int indent, const char *fname, 
-                                                const ASN1_PCTX *pctx);
-
-typedef int ASN1_primitive_i2c(ASN1_VALUE **pval, unsigned char *cont, int *putype, const ASN1_ITEM *it);
-typedef int ASN1_primitive_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len, int utype, char *free_cont, const ASN1_ITEM *it);
-typedef int ASN1_primitive_print(BIO *out, ASN1_VALUE **pval, const ASN1_ITEM *it, int indent, const ASN1_PCTX *pctx);
-
-typedef struct ASN1_EXTERN_FUNCS_st {
-        void *app_data;
-        ASN1_ex_new_func *asn1_ex_new;
-        ASN1_ex_free_func *asn1_ex_free;
-        ASN1_ex_free_func *asn1_ex_clear;
-        ASN1_ex_d2i *asn1_ex_d2i;
-        ASN1_ex_i2d *asn1_ex_i2d;
-        ASN1_ex_print_func *asn1_ex_print;
-} ASN1_EXTERN_FUNCS;
-
-typedef struct ASN1_PRIMITIVE_FUNCS_st {
-        void *app_data;
-        unsigned long flags;
-        ASN1_ex_new_func *prim_new;
-        ASN1_ex_free_func *prim_free;
-        ASN1_ex_free_func *prim_clear;
-        ASN1_primitive_c2i *prim_c2i;
-        ASN1_primitive_i2c *prim_i2c;
-        ASN1_primitive_print *prim_print;
-} ASN1_PRIMITIVE_FUNCS;
-
-/* This is the ASN1_AUX structure: it handles various
- * miscellaneous requirements. For example the use of
- * reference counts and an informational callback.
- *
- * The "informational callback" is called at various
- * points during the ASN1 encoding and decoding. It can
- * be used to provide minor customisation of the structures
- * used. This is most useful where the supplied routines
- * *almost* do the right thing but need some extra help
- * at a few points. If the callback returns zero then
- * it is assumed a fatal error has occurred and the 
- * main operation should be abandoned.
- *
- * If major changes in the default behaviour are required
- * then an external type is more appropriate.
- */
-
-typedef int ASN1_aux_cb(int operation, ASN1_VALUE **in, const ASN1_ITEM *it,
-                                void *exarg);
-
-typedef struct ASN1_AUX_st {
-        void *app_data;
-        int flags;
-        int ref_offset;         /* Offset of reference value */
-        int ref_lock;           /* Lock type to use */
-        ASN1_aux_cb *asn1_cb;
-        int enc_offset;         /* Offset of ASN1_ENCODING structure */
-} ASN1_AUX;
-
-/* For print related callbacks exarg points to this structure */
-typedef struct ASN1_PRINT_ARG_st {
-        BIO *out;
-        int indent;
-        const ASN1_PCTX *pctx;
-} ASN1_PRINT_ARG;
-
-/* For streaming related callbacks exarg points to this structure */
-typedef struct ASN1_STREAM_ARG_st {
-        /* BIO to stream through */
-        BIO *out;
-        /* BIO with filters appended */
-        BIO *ndef_bio;
-        /* Streaming I/O boundary */
-        unsigned char **boundary;
-} ASN1_STREAM_ARG;
-
-/* Flags in ASN1_AUX */
-
-/* Use a reference count */
-#define ASN1_AFLG_REFCOUNT      1
-/* Save the encoding of structure (useful for signatures) */
-#define ASN1_AFLG_ENCODING      2
-/* The Sequence length is invalid */
-#define ASN1_AFLG_BROKEN        4
-
-/* operation values for asn1_cb */
-
-#define ASN1_OP_NEW_PRE         0
-#define ASN1_OP_NEW_POST        1
-#define ASN1_OP_FREE_PRE        2
-#define ASN1_OP_FREE_POST       3
-#define ASN1_OP_D2I_PRE         4
-#define ASN1_OP_D2I_POST        5
-#define ASN1_OP_I2D_PRE         6
-#define ASN1_OP_I2D_POST        7
-#define ASN1_OP_PRINT_PRE       8
-#define ASN1_OP_PRINT_POST      9
-#define ASN1_OP_STREAM_PRE      10
-#define ASN1_OP_STREAM_POST     11
-#define ASN1_OP_DETACHED_PRE    12
-#define ASN1_OP_DETACHED_POST   13
-
-#ifndef LIBRESSL_INTERNAL
-
-/* Macro to implement a primitive type */
-#define IMPLEMENT_ASN1_TYPE(stname) IMPLEMENT_ASN1_TYPE_ex(stname, stname, 0)
-#define IMPLEMENT_ASN1_TYPE_ex(itname, vname, ex) \
-                                ASN1_ITEM_start(itname) \
-                                        ASN1_ITYPE_PRIMITIVE, V_##vname, NULL, 0, NULL, ex, #itname \
-                                ASN1_ITEM_end(itname)
-
-/* Macro to implement a multi string type */
-#define IMPLEMENT_ASN1_MSTRING(itname, mask) \
-                                ASN1_ITEM_start(itname) \
-                                        ASN1_ITYPE_MSTRING, mask, NULL, 0, NULL, sizeof(ASN1_STRING), #itname \
-                                ASN1_ITEM_end(itname)
-#define IMPLEMENT_EXTERN_ASN1(sname, tag, fptrs) \
-        ASN1_ITEM_start(sname) \
-                ASN1_ITYPE_EXTERN, \
-                tag, \
-                NULL, \
-                0, \
-                &fptrs, \
-                0, \
-                #sname \
-        ASN1_ITEM_end(sname)
-
-/* Macro to implement standard functions in terms of ASN1_ITEM structures */
-
-#define IMPLEMENT_ASN1_FUNCTIONS(stname) IMPLEMENT_ASN1_FUNCTIONS_fname(stname, stname, stname)
-
-#define IMPLEMENT_ASN1_FUNCTIONS_name(stname, itname) IMPLEMENT_ASN1_FUNCTIONS_fname(stname, itname, itname)
-
-#define IMPLEMENT_ASN1_FUNCTIONS_ENCODE_name(stname, itname) \
-                        IMPLEMENT_ASN1_FUNCTIONS_ENCODE_fname(stname, itname, itname)
-
-#define IMPLEMENT_STATIC_ASN1_ALLOC_FUNCTIONS(stname) \
-                IMPLEMENT_ASN1_ALLOC_FUNCTIONS_pfname(static, stname, stname, stname)
-
-#define IMPLEMENT_ASN1_ALLOC_FUNCTIONS(stname) \
-                IMPLEMENT_ASN1_ALLOC_FUNCTIONS_fname(stname, stname, stname)
-
-#define IMPLEMENT_ASN1_ALLOC_FUNCTIONS_pfname(pre, stname, itname, fname) \
-        pre stname *fname##_new(void) \
-        { \
-                return (stname *)ASN1_item_new(ASN1_ITEM_rptr(itname)); \
-        } \
-        pre void fname##_free(stname *a) \
-        { \
-                ASN1_item_free((ASN1_VALUE *)a, ASN1_ITEM_rptr(itname)); \
-        }
-
-#define IMPLEMENT_ASN1_ALLOC_FUNCTIONS_fname(stname, itname, fname) \
-        stname *fname##_new(void) \
-        { \
-                return (stname *)ASN1_item_new(ASN1_ITEM_rptr(itname)); \
-        } \
-        void fname##_free(stname *a) \
-        { \
-                ASN1_item_free((ASN1_VALUE *)a, ASN1_ITEM_rptr(itname)); \
-        }
-
-#define IMPLEMENT_ASN1_FUNCTIONS_fname(stname, itname, fname) \
-        IMPLEMENT_ASN1_ENCODE_FUNCTIONS_fname(stname, itname, fname) \
-        IMPLEMENT_ASN1_ALLOC_FUNCTIONS_fname(stname, itname, fname)
-
-#define IMPLEMENT_ASN1_ENCODE_FUNCTIONS_fname(stname, itname, fname) \
-        stname *d2i_##fname(stname **a, const unsigned char **in, long len) \
-        { \
-                return (stname *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, ASN1_ITEM_rptr(itname));\
-        } \
-        int i2d_##fname(stname *a, unsigned char **out) \
-        { \
-                return ASN1_item_i2d((ASN1_VALUE *)a, out, ASN1_ITEM_rptr(itname));\
-        } 
-
-#define IMPLEMENT_ASN1_NDEF_FUNCTION(stname) \
-        int i2d_##stname##_NDEF(stname *a, unsigned char **out) \
-        { \
-                return ASN1_item_ndef_i2d((ASN1_VALUE *)a, out, ASN1_ITEM_rptr(stname));\
-        } 
-
-/* This includes evil casts to remove const: they will go away when full
- * ASN1 constification is done.
- */
-#define IMPLEMENT_ASN1_ENCODE_FUNCTIONS_const_fname(stname, itname, fname) \
-        stname *d2i_##fname(stname **a, const unsigned char **in, long len) \
-        { \
-                return (stname *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, ASN1_ITEM_rptr(itname));\
-        } \
-        int i2d_##fname(const stname *a, unsigned char **out) \
-        { \
-                return ASN1_item_i2d((ASN1_VALUE *)a, out, ASN1_ITEM_rptr(itname));\
-        } 
-
-#define IMPLEMENT_ASN1_DUP_FUNCTION(stname) \
-        stname * stname##_dup(stname *x) \
-        { \
-        return ASN1_item_dup(ASN1_ITEM_rptr(stname), x); \
-        }
-
-#define IMPLEMENT_ASN1_PRINT_FUNCTION(stname) \
-        IMPLEMENT_ASN1_PRINT_FUNCTION_fname(stname, stname, stname)
-
-#define IMPLEMENT_ASN1_PRINT_FUNCTION_fname(stname, itname, fname) \
-        int fname##_print_ctx(BIO *out, stname *x, int indent, \
-                                                const ASN1_PCTX *pctx) \
-        { \
-                return ASN1_item_print(out, (ASN1_VALUE *)x, indent, \
-                        ASN1_ITEM_rptr(itname), pctx); \
-        } 
-
-#define IMPLEMENT_ASN1_FUNCTIONS_const(name) \
-                IMPLEMENT_ASN1_FUNCTIONS_const_fname(name, name, name)
-
-#define IMPLEMENT_ASN1_FUNCTIONS_const_fname(stname, itname, fname) \
-        IMPLEMENT_ASN1_ENCODE_FUNCTIONS_const_fname(stname, itname, fname) \
-        IMPLEMENT_ASN1_ALLOC_FUNCTIONS_fname(stname, itname, fname)
-
-#endif /* !LIBRESSL_INTERNAL */
-
-/* external definitions for primitive types */
-
-DECLARE_ASN1_ITEM(ASN1_BOOLEAN)
-DECLARE_ASN1_ITEM(ASN1_TBOOLEAN)
-DECLARE_ASN1_ITEM(ASN1_FBOOLEAN)
-DECLARE_ASN1_ITEM(ASN1_SEQUENCE)
-DECLARE_ASN1_ITEM(CBIGNUM)
-DECLARE_ASN1_ITEM(BIGNUM)
-DECLARE_ASN1_ITEM(LONG)
-DECLARE_ASN1_ITEM(ZLONG)
-
-DECLARE_STACK_OF(ASN1_VALUE)
-
-/* Functions used internally by the ASN1 code */
-
-int ASN1_item_ex_new(ASN1_VALUE **pval, const ASN1_ITEM *it);
-void ASN1_item_ex_free(ASN1_VALUE **pval, const ASN1_ITEM *it);
-int ASN1_template_new(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt);
-int ASN1_primitive_new(ASN1_VALUE **pval, const ASN1_ITEM *it);
-
-void ASN1_template_free(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt);
-int ASN1_template_d2i(ASN1_VALUE **pval, const unsigned char **in, long len, const ASN1_TEMPLATE *tt);
-int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len, const ASN1_ITEM *it,
-                                int tag, int aclass, char opt, ASN1_TLC *ctx);
-
-int ASN1_item_ex_i2d(ASN1_VALUE **pval, unsigned char **out, const ASN1_ITEM *it, int tag, int aclass);
-int ASN1_template_i2d(ASN1_VALUE **pval, unsigned char **out, const ASN1_TEMPLATE *tt);
-void ASN1_primitive_free(ASN1_VALUE **pval, const ASN1_ITEM *it);
-
-int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len, int utype, char *free_cont, const ASN1_ITEM *it);
-
-int asn1_get_choice_selector(ASN1_VALUE **pval, const ASN1_ITEM *it);
-int asn1_set_choice_selector(ASN1_VALUE **pval, int value, const ASN1_ITEM *it);
-
-ASN1_VALUE ** asn1_get_field_ptr(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt);
-
-const ASN1_TEMPLATE *asn1_do_adb(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt, int nullerr);
-
-int asn1_do_lock(ASN1_VALUE **pval, int op, const ASN1_ITEM *it);
-
-void asn1_enc_init(ASN1_VALUE **pval, const ASN1_ITEM *it);
-void asn1_enc_free(ASN1_VALUE **pval, const ASN1_ITEM *it);
-int asn1_enc_restore(int *len, unsigned char **out, ASN1_VALUE **pval, const ASN1_ITEM *it);
-int asn1_enc_save(ASN1_VALUE **pval, const unsigned char *in, int inlen, const ASN1_ITEM *it);
-
-#ifdef  __cplusplus
-}
-#endif
-#endif
diff --git a/src/lib/libcrypto/asn1/asn_mime.c b/src/lib/libcrypto/asn1/asn_mime.c
deleted file mode 100644
index 1d82f1a76f..0000000000
--- a/src/lib/libcrypto/asn1/asn_mime.c
+++ /dev/null
@@ -1,1019 +0,0 @@
-/* $OpenBSD: asn_mime.c,v 1.26 2015/02/22 15:19:56 jsing Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project.
- */
-/* ====================================================================
- * Copyright (c) 1999-2008 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- */
-
-#include <ctype.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-#include <openssl/asn1.h>
-#include <openssl/asn1t.h>
-#include <openssl/err.h>
-#include <openssl/x509.h>
-
-#include "asn1_locl.h"
-
-/* Generalised MIME like utilities for streaming ASN1. Although many
- * have a PKCS7/CMS like flavour others are more general purpose.
- */
-
-/* MIME format structures
- * Note that all are translated to lower case apart from
- * parameter values. Quotes are stripped off
- */
-
-typedef struct {
-        char *param_name;               /* Param name e.g. "micalg" */
-        char *param_value;              /* Param value e.g. "sha1" */
-} MIME_PARAM;
-
-DECLARE_STACK_OF(MIME_PARAM)
-
-typedef struct {
-        char *name;                     /* Name of line e.g. "content-type" */
-        char *value;                    /* Value of line e.g. "text/plain" */
-        STACK_OF(MIME_PARAM) *params;   /* Zero or more parameters */
-} MIME_HEADER;
-
-DECLARE_STACK_OF(MIME_HEADER)
-
-static int asn1_output_data(BIO *out, BIO *data, ASN1_VALUE *val, int flags,
-    const ASN1_ITEM *it);
-static char * strip_ends(char *name);
-static char * strip_start(char *name);
-static char * strip_end(char *name);
-static MIME_HEADER *mime_hdr_new(char *name, char *value);
-static int mime_hdr_addparam(MIME_HEADER *mhdr, char *name, char *value);
-static STACK_OF(MIME_HEADER) *mime_parse_hdr(BIO *bio);
-static int mime_hdr_cmp(const MIME_HEADER * const *a,
-    const MIME_HEADER * const *b);
-static int mime_param_cmp(const MIME_PARAM * const *a,
-    const MIME_PARAM * const *b);
-static void mime_param_free(MIME_PARAM *param);
-static int mime_bound_check(char *line, int linelen, char *bound, int blen);
-static int multi_split(BIO *bio, char *bound, STACK_OF(BIO) **ret);
-static int strip_eol(char *linebuf, int *plen);
-static MIME_HEADER *mime_hdr_find(STACK_OF(MIME_HEADER) *hdrs, char *name);
-static MIME_PARAM *mime_param_find(MIME_HEADER *hdr, char *name);
-static void mime_hdr_free(MIME_HEADER *hdr);
-
-#define MAX_SMLEN 1024
-#define mime_debug(x) /* x */
-
-/* Output an ASN1 structure in BER format streaming if necessary */
-
-int
-i2d_ASN1_bio_stream(BIO *out, ASN1_VALUE *val, BIO *in, int flags,
-    const ASN1_ITEM *it)
-{
-        /* If streaming create stream BIO and copy all content through it */
-        if (flags & SMIME_STREAM) {
-                BIO *bio, *tbio;
-                bio = BIO_new_NDEF(out, val, it);
-                if (!bio) {
-                        ASN1err(ASN1_F_I2D_ASN1_BIO_STREAM,
-                            ERR_R_MALLOC_FAILURE);
-                        return 0;
-                }
-                SMIME_crlf_copy(in, bio, flags);
-                (void)BIO_flush(bio);
-                /* Free up successive BIOs until we hit the old output BIO */
-                do {
-                        tbio = BIO_pop(bio);
-                        BIO_free(bio);
-                        bio = tbio;
-                } while (bio != out);
-        }
-        /* else just write out ASN1 structure which will have all content
-         * stored internally
-         */
-        else
-                ASN1_item_i2d_bio(it, out, val);
-        return 1;
-}
-
-/* Base 64 read and write of ASN1 structure */
-
-static int
-B64_write_ASN1(BIO *out, ASN1_VALUE *val, BIO *in, int flags,
-    const ASN1_ITEM *it)
-{
-        BIO *b64;
-        int r;
-
-        b64 = BIO_new(BIO_f_base64());
-        if (!b64) {
-                ASN1err(ASN1_F_B64_WRITE_ASN1, ERR_R_MALLOC_FAILURE);
-                return 0;
-        }
-        /* prepend the b64 BIO so all data is base64 encoded.
-         */
-        out = BIO_push(b64, out);
-        r = i2d_ASN1_bio_stream(out, val, in, flags, it);
-        (void)BIO_flush(out);
-        BIO_pop(out);
-        BIO_free(b64);
-        return r;
-}
-
-/* Streaming ASN1 PEM write */
-
-int
-PEM_write_bio_ASN1_stream(BIO *out, ASN1_VALUE *val, BIO *in, int flags,
-    const char *hdr, const ASN1_ITEM *it)
-{
-        int r;
-
-        BIO_printf(out, "-----BEGIN %s-----\n", hdr);
-        r = B64_write_ASN1(out, val, in, flags, it);
-        BIO_printf(out, "-----END %s-----\n", hdr);
-        return r;
-}
-
-static ASN1_VALUE *
-b64_read_asn1(BIO *bio, const ASN1_ITEM *it)
-{
-        BIO *b64;
-        ASN1_VALUE *val;
-        if (!(b64 = BIO_new(BIO_f_base64()))) {
-                ASN1err(ASN1_F_B64_READ_ASN1, ERR_R_MALLOC_FAILURE);
-                return 0;
-        }
-        bio = BIO_push(b64, bio);
-        val = ASN1_item_d2i_bio(it, bio, NULL);
-        if (!val)
-                ASN1err(ASN1_F_B64_READ_ASN1, ASN1_R_DECODE_ERROR);
-        (void)BIO_flush(bio);
-        bio = BIO_pop(bio);
-        BIO_free(b64);
-        return val;
-}
-
-/* Generate the MIME "micalg" parameter from RFC3851, RFC4490 */
-
-static int
-asn1_write_micalg(BIO *out, STACK_OF(X509_ALGOR) *mdalgs)
-{
-        const EVP_MD *md;
-        int i, have_unknown = 0, write_comma, ret = 0, md_nid;
-
-        have_unknown = 0;
-        write_comma = 0;
-        for (i = 0; i < sk_X509_ALGOR_num(mdalgs); i++) {
-                if (write_comma)
-                        BIO_write(out, ",", 1);
-                write_comma = 1;
-                md_nid = OBJ_obj2nid(sk_X509_ALGOR_value(mdalgs, i)->algorithm);
-                md = EVP_get_digestbynid(md_nid);
-                if (md && md->md_ctrl) {
-                        int rv;
-                        char *micstr;
-                        rv = md->md_ctrl(NULL, EVP_MD_CTRL_MICALG, 0, &micstr);
-                        if (rv > 0) {
-                                BIO_puts(out, micstr);
-                                free(micstr);
-                                continue;
-                        }
-                        if (rv != -2)
-                                goto err;
-                }
-                switch (md_nid) {
-                case NID_sha1:
-                        BIO_puts(out, "sha1");
-                        break;
-
-                case NID_md5:
-                        BIO_puts(out, "md5");
-                        break;
-
-                case NID_sha256:
-                        BIO_puts(out, "sha-256");
-                        break;
-
-                case NID_sha384:
-                        BIO_puts(out, "sha-384");
-                        break;
-
-                case NID_sha512:
-                        BIO_puts(out, "sha-512");
-                        break;
-
-                case NID_id_GostR3411_94:
-                        BIO_puts(out, "gostr3411-94");
-                        goto err;
-                        break;
-
-                default:
-                        if (have_unknown)
-                                write_comma = 0;
-                        else {
-                                BIO_puts(out, "unknown");
-                                have_unknown = 1;
-                        }
-                        break;
-
-                }
-        }
-
-        ret = 1;
-
-err:
-        return ret;
-}
-
-/* SMIME sender */
-
-int
-SMIME_write_ASN1(BIO *bio, ASN1_VALUE *val, BIO *data, int flags,
-    int ctype_nid, int econt_nid, STACK_OF(X509_ALGOR) *mdalgs,
-    const ASN1_ITEM *it)
-{
-        char bound[33], c;
-        int i;
-        const char *mime_prefix, *mime_eol, *cname = "smime.p7m";
-        const char *msg_type = NULL;
-
-        if (flags & SMIME_OLDMIME)
-                mime_prefix = "application/x-pkcs7-";
-        else
-                mime_prefix = "application/pkcs7-";
-
-        if (flags & SMIME_CRLFEOL)
-                mime_eol = "\r\n";
-        else
-                mime_eol = "\n";
-        if ((flags & SMIME_DETACHED) && data) {
-                /* We want multipart/signed */
-                /* Generate a random boundary */
-                arc4random_buf(bound, 32);
-                for (i = 0; i < 32; i++) {
-                        c = bound[i] & 0xf;
-                        if (c < 10)
-                                c += '0';
-                        else
-                                c += 'A' - 10;
-                        bound[i] = c;
-                }
-                bound[32] = 0;
-                BIO_printf(bio, "MIME-Version: 1.0%s", mime_eol);
-                BIO_printf(bio, "Content-Type: multipart/signed;");
-                BIO_printf(bio, " protocol=\"%ssignature\";", mime_prefix);
-                BIO_puts(bio, " micalg=\"");
-                asn1_write_micalg(bio, mdalgs);
-                BIO_printf(bio, "\"; boundary=\"----%s\"%s%s",
-                    bound, mime_eol, mime_eol);
-                BIO_printf(bio, "This is an S/MIME signed message%s%s",
-                    mime_eol, mime_eol);
-                /* Now write out the first part */
-                BIO_printf(bio, "------%s%s", bound, mime_eol);
-                if (!asn1_output_data(bio, data, val, flags, it))
-                        return 0;
-                BIO_printf(bio, "%s------%s%s", mime_eol, bound, mime_eol);
-
-                /* Headers for signature */
-
-                BIO_printf(bio, "Content-Type: %ssignature;", mime_prefix);
-                BIO_printf(bio, " name=\"smime.p7s\"%s", mime_eol);
-                BIO_printf(bio, "Content-Transfer-Encoding: base64%s",
-                    mime_eol);
-                BIO_printf(bio, "Content-Disposition: attachment;");
-                BIO_printf(bio, " filename=\"smime.p7s\"%s%s",
-                    mime_eol, mime_eol);
-                B64_write_ASN1(bio, val, NULL, 0, it);
-                BIO_printf(bio, "%s------%s--%s%s", mime_eol, bound,
-                    mime_eol, mime_eol);
-                return 1;
-        }
-
-        /* Determine smime-type header */
-
-        if (ctype_nid == NID_pkcs7_enveloped)
-                msg_type = "enveloped-data";
-        else if (ctype_nid == NID_pkcs7_signed) {
-                if (econt_nid == NID_id_smime_ct_receipt)
-                        msg_type = "signed-receipt";
-                else if (sk_X509_ALGOR_num(mdalgs) >= 0)
-                        msg_type = "signed-data";
-                else
-                        msg_type = "certs-only";
-        } else if (ctype_nid == NID_id_smime_ct_compressedData) {
-                msg_type = "compressed-data";
-                cname = "smime.p7z";
-        }
-        /* MIME headers */
-        BIO_printf(bio, "MIME-Version: 1.0%s", mime_eol);
-        BIO_printf(bio, "Content-Disposition: attachment;");
-        BIO_printf(bio, " filename=\"%s\"%s", cname, mime_eol);
-        BIO_printf(bio, "Content-Type: %smime;", mime_prefix);
-        if (msg_type)
-                BIO_printf(bio, " smime-type=%s;", msg_type);
-        BIO_printf(bio, " name=\"%s\"%s", cname, mime_eol);
-        BIO_printf(bio, "Content-Transfer-Encoding: base64%s%s",
-            mime_eol, mime_eol);
-        if (!B64_write_ASN1(bio, val, data, flags, it))
-                return 0;
-        BIO_printf(bio, "%s", mime_eol);
-        return 1;
-}
-
-/* Handle output of ASN1 data */
-
-
-static int
-asn1_output_data(BIO *out, BIO *data, ASN1_VALUE *val, int flags,
-    const ASN1_ITEM *it)
-{
-        BIO *tmpbio;
-        const ASN1_AUX *aux = it->funcs;
-        ASN1_STREAM_ARG sarg;
-        int rv = 1;
-
-        /* If data is not deteched or resigning then the output BIO is
-         * already set up to finalise when it is written through.
-         */
-        if (!(flags & SMIME_DETACHED) || (flags & PKCS7_REUSE_DIGEST)) {
-                SMIME_crlf_copy(data, out, flags);
-                return 1;
-        }
-
-        if (!aux || !aux->asn1_cb) {
-                ASN1err(ASN1_F_ASN1_OUTPUT_DATA,
-                    ASN1_R_STREAMING_NOT_SUPPORTED);
-                return 0;
-        }
-
-        sarg.out = out;
-        sarg.ndef_bio = NULL;
-        sarg.boundary = NULL;
-
-        /* Let ASN1 code prepend any needed BIOs */
-
-        if (aux->asn1_cb(ASN1_OP_DETACHED_PRE, &val, it, &sarg) <= 0)
-                return 0;
-
-        /* Copy data across, passing through filter BIOs for processing */
-        SMIME_crlf_copy(data, sarg.ndef_bio, flags);
-
-        /* Finalize structure */
-        if (aux->asn1_cb(ASN1_OP_DETACHED_POST, &val, it, &sarg) <= 0)
-                rv = 0;
-
-        /* Now remove any digests prepended to the BIO */
-
-        while (sarg.ndef_bio != out) {
-                tmpbio = BIO_pop(sarg.ndef_bio);
-                BIO_free(sarg.ndef_bio);
-                sarg.ndef_bio = tmpbio;
-        }
-
-        return rv;
-}
-
-/* SMIME reader: handle multipart/signed and opaque signing.
- * in multipart case the content is placed in a memory BIO
- * pointed to by "bcont". In opaque this is set to NULL
- */
-
-ASN1_VALUE *
-SMIME_read_ASN1(BIO *bio, BIO **bcont, const ASN1_ITEM *it)
-{
-        BIO *asnin;
-        STACK_OF(MIME_HEADER) *headers = NULL;
-        STACK_OF(BIO) *parts = NULL;
-        MIME_HEADER *hdr;
-        MIME_PARAM *prm;
-        ASN1_VALUE *val;
-        int ret;
-
-        if (bcont)
-                *bcont = NULL;
-
-        if (!(headers = mime_parse_hdr(bio))) {
-                ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_MIME_PARSE_ERROR);
-                return NULL;
-        }
-
-        if (!(hdr = mime_hdr_find(headers, "content-type")) || !hdr->value) {
-                sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
-                ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_NO_CONTENT_TYPE);
-                return NULL;
-        }
-
-        /* Handle multipart/signed */
-
-        if (!strcmp(hdr->value, "multipart/signed")) {
-                /* Split into two parts */
-                prm = mime_param_find(hdr, "boundary");
-                if (!prm || !prm->param_value) {
-                        sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
-                        ASN1err(ASN1_F_SMIME_READ_ASN1,
-                            ASN1_R_NO_MULTIPART_BOUNDARY);
-                        return NULL;
-                }
-                ret = multi_split(bio, prm->param_value, &parts);
-                sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
-                if (!ret || (sk_BIO_num(parts) != 2) ) {
-                        ASN1err(ASN1_F_SMIME_READ_ASN1,
-                            ASN1_R_NO_MULTIPART_BODY_FAILURE);
-                        sk_BIO_pop_free(parts, BIO_vfree);
-                        return NULL;
-                }
-
-                /* Parse the signature piece */
-                asnin = sk_BIO_value(parts, 1);
-
-                if (!(headers = mime_parse_hdr(asnin))) {
-                        ASN1err(ASN1_F_SMIME_READ_ASN1,
-                            ASN1_R_MIME_SIG_PARSE_ERROR);
-                        sk_BIO_pop_free(parts, BIO_vfree);
-                        return NULL;
-                }
-
-                /* Get content type */
-
-                if (!(hdr = mime_hdr_find(headers, "content-type")) ||
-                    !hdr->value) {
-                        sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
-                        sk_BIO_pop_free(parts, BIO_vfree);
-                        ASN1err(ASN1_F_SMIME_READ_ASN1,
-                            ASN1_R_NO_SIG_CONTENT_TYPE);
-                        return NULL;
-                }
-
-                if (strcmp(hdr->value, "application/x-pkcs7-signature") &&
-                    strcmp(hdr->value, "application/pkcs7-signature")) {
-                        ASN1err(ASN1_F_SMIME_READ_ASN1,
-                            ASN1_R_SIG_INVALID_MIME_TYPE);
-                        ERR_asprintf_error_data("type: %s", hdr->value);
-                        sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
-                        sk_BIO_pop_free(parts, BIO_vfree);
-                        return NULL;
-                }
-                sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
-                /* Read in ASN1 */
-                if (!(val = b64_read_asn1(asnin, it))) {
-                        ASN1err(ASN1_F_SMIME_READ_ASN1,
-                            ASN1_R_ASN1_SIG_PARSE_ERROR);
-                        sk_BIO_pop_free(parts, BIO_vfree);
-                        return NULL;
-                }
-
-                if (bcont) {
-                        *bcont = sk_BIO_value(parts, 0);
-                        BIO_free(asnin);
-                        sk_BIO_free(parts);
-                } else sk_BIO_pop_free(parts, BIO_vfree);
-                        return val;
-        }
-
-        /* OK, if not multipart/signed try opaque signature */
-
-        if (strcmp (hdr->value, "application/x-pkcs7-mime") &&
-            strcmp (hdr->value, "application/pkcs7-mime")) {
-                ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_INVALID_MIME_TYPE);
-                ERR_asprintf_error_data("type: %s", hdr->value);
-                sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
-                return NULL;
-        }
-
-        sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
-
-        if (!(val = b64_read_asn1(bio, it))) {
-                ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_ASN1_PARSE_ERROR);
-                return NULL;
-        }
-        return val;
-}
-
-/* Copy text from one BIO to another making the output CRLF at EOL */
-int
-SMIME_crlf_copy(BIO *in, BIO *out, int flags)
-{
-        BIO *bf;
-        char eol;
-        int len;
-        char linebuf[MAX_SMLEN];
-
-        /* Buffer output so we don't write one line at a time. This is
-         * useful when streaming as we don't end up with one OCTET STRING
-         * per line.
-         */
-        bf = BIO_new(BIO_f_buffer());
-        if (!bf)
-                return 0;
-        out = BIO_push(bf, out);
-        if (flags & SMIME_BINARY) {
-                while ((len = BIO_read(in, linebuf, MAX_SMLEN)) > 0)
-                        BIO_write(out, linebuf, len);
-        } else {
-                if (flags & SMIME_TEXT)
-                        BIO_printf(out, "Content-Type: text/plain\r\n\r\n");
-                while ((len = BIO_gets(in, linebuf, MAX_SMLEN)) > 0) {
-                        eol = strip_eol(linebuf, &len);
-                        if (len)
-                                BIO_write(out, linebuf, len);
-                        if (eol)
-                                BIO_write(out, "\r\n", 2);
-                }
-        }
-        (void)BIO_flush(out);
-        BIO_pop(out);
-        BIO_free(bf);
-        return 1;
-}
-
-/* Strip off headers if they are text/plain */
-int
-SMIME_text(BIO *in, BIO *out)
-{
-        char iobuf[4096];
-        int len;
-        STACK_OF(MIME_HEADER) *headers;
-        MIME_HEADER *hdr;
-
-        if (!(headers = mime_parse_hdr(in))) {
-                ASN1err(ASN1_F_SMIME_TEXT, ASN1_R_MIME_PARSE_ERROR);
-                return 0;
-        }
-        if (!(hdr = mime_hdr_find(headers, "content-type")) || !hdr->value) {
-                ASN1err(ASN1_F_SMIME_TEXT, ASN1_R_MIME_NO_CONTENT_TYPE);
-                sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
-                return 0;
-        }
-        if (strcmp (hdr->value, "text/plain")) {
-                ASN1err(ASN1_F_SMIME_TEXT, ASN1_R_INVALID_MIME_TYPE);
-                ERR_asprintf_error_data("type: %s", hdr->value);
-                sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
-                return 0;
-        }
-        sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
-        while ((len = BIO_read(in, iobuf, sizeof(iobuf))) > 0)
-                BIO_write(out, iobuf, len);
-        if (len < 0)
-                return 0;
-        return 1;
-}
-
-/*
- * Split a multipart/XXX message body into component parts: result is
- * canonical parts in a STACK of bios
- */
-static int
-multi_split(BIO *bio, char *bound, STACK_OF(BIO) **ret)
-{
-        char linebuf[MAX_SMLEN];
-        int len, blen;
-        int eol = 0, next_eol = 0;
-        BIO *bpart = NULL;
-        STACK_OF(BIO) *parts;
-        char state, part, first;
-
-        blen = strlen(bound);
-        part = 0;
-        state = 0;
-        first = 1;
-        parts = sk_BIO_new_null();
-        *ret = parts;
-        if (parts == NULL)
-                return 0;
-        while ((len = BIO_gets(bio, linebuf, MAX_SMLEN)) > 0) {
-                state = mime_bound_check(linebuf, len, bound, blen);
-                if (state == 1) {
-                        first = 1;
-                        part++;
-                } else if (state == 2) {
-                        if (sk_BIO_push(parts, bpart) == 0)
-                                return 0;
-                        return 1;
-                } else if (part) {
-                        /* Strip CR+LF from linebuf */
-                        next_eol = strip_eol(linebuf, &len);
-                        if (first) {
-                                first = 0;
-                                if (bpart != NULL) {
-                                        if (sk_BIO_push(parts, bpart) == 0)
-                                                return 0;
-                                }
-                                bpart = BIO_new(BIO_s_mem());
-                                if (bpart == NULL)
-                                        return 0;
-                                BIO_set_mem_eof_return(bpart, 0);
-                        } else if (eol)
-                                BIO_write(bpart, "\r\n", 2);
-                        eol = next_eol;
-                        if (len)
-                                BIO_write(bpart, linebuf, len);
-                }
-        }
-        BIO_free(bpart);
-        return 0;
-}
-
-/* This is the big one: parse MIME header lines up to message body */
-
-#define MIME_INVALID    0
-#define MIME_START      1
-#define MIME_TYPE       2
-#define MIME_NAME       3
-#define MIME_VALUE      4
-#define MIME_QUOTE      5
-#define MIME_COMMENT    6
-
-
-static
-STACK_OF(MIME_HEADER) *mime_parse_hdr(BIO *bio)
-{
-        char *p, *q, c;
-        char *ntmp;
-        char linebuf[MAX_SMLEN];
-        MIME_HEADER *mhdr = NULL;
-        STACK_OF(MIME_HEADER) *headers;
-        int len, state, save_state = 0;
-
-        headers = sk_MIME_HEADER_new(mime_hdr_cmp);
-        if (!headers)
-                return NULL;
-        while ((len = BIO_gets(bio, linebuf, MAX_SMLEN)) > 0) {
-                /* If whitespace at line start then continuation line */
-                if (mhdr && isspace((unsigned char)linebuf[0]))
-                        state = MIME_NAME;
-                else
-                        state = MIME_START;
-                ntmp = NULL;
-
-                /* Go through all characters */
-                for (p = linebuf, q = linebuf;
-                    (c = *p) && (c != '\r') && (c != '\n'); p++) {
-
-                        /* State machine to handle MIME headers
-                         * if this looks horrible that's because it *is*
-                         */
-
-                        switch (state) {
-                        case MIME_START:
-                                if (c == ':') {
-                                        state = MIME_TYPE;
-                                        *p = 0;
-                                        ntmp = strip_ends(q);
-                                        q = p + 1;
-                                }
-                                break;
-
-                        case MIME_TYPE:
-                                if (c == ';') {
-                                        mime_debug("Found End Value\n");
-                                        *p = 0;
-                                        mhdr = mime_hdr_new(ntmp,
-                                            strip_ends(q));
-                                        if (mhdr == NULL)
-                                                goto merr;
-                                        if (sk_MIME_HEADER_push(headers,
-                                            mhdr) == 0)
-                                                goto merr;
-                                        ntmp = NULL;
-                                        q = p + 1;
-                                        state = MIME_NAME;
-                                } else if (c == '(') {
-                                        save_state = state;
-                                        state = MIME_COMMENT;
-                                }
-                                break;
-
-                        case MIME_COMMENT:
-                                if (c == ')') {
-                                        state = save_state;
-                                }
-                                break;
-
-                        case MIME_NAME:
-                                if (c == '=') {
-                                        state = MIME_VALUE;
-                                        *p = 0;
-                                        ntmp = strip_ends(q);
-                                        q = p + 1;
-                                }
-                                break;
-
-                        case MIME_VALUE:
-                                if (c == ';') {
-                                        state = MIME_NAME;
-                                        *p = 0;
-                                        mime_hdr_addparam(mhdr, ntmp,
-                                            strip_ends(q));
-                                        ntmp = NULL;
-                                        q = p + 1;
-                                } else if (c == '"') {
-                                        mime_debug("Found Quote\n");
-                                        state = MIME_QUOTE;
-                                } else if (c == '(') {
-                                        save_state = state;
-                                        state = MIME_COMMENT;
-                                }
-                                break;
-
-                        case MIME_QUOTE:
-                                if (c == '"') {
-                                        mime_debug("Found Match Quote\n");
-                                        state = MIME_VALUE;
-                                }
-                                break;
-                        }
-                }
-
-                if (state == MIME_TYPE) {
-                        mhdr = mime_hdr_new(ntmp, strip_ends(q));
-                        if (mhdr == NULL)
-                                goto merr;
-                        if (sk_MIME_HEADER_push(headers, mhdr) == 0)
-                                goto merr;
-                } else if (state == MIME_VALUE)
-                        mime_hdr_addparam(mhdr, ntmp, strip_ends(q));
-
-                if (p == linebuf)
-                        break;  /* Blank line means end of headers */
-        }
-
-        return headers;
-
-merr:
-        if (mhdr != NULL)
-                mime_hdr_free(mhdr);
-        sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
-        return NULL;
-}
-
-static char *
-strip_ends(char *name)
-{
-        return strip_end(strip_start(name));
-}
-
-/* Strip a parameter of whitespace from start of param */
-static char *
-strip_start(char *name)
-{
-        char *p, c;
-
-        /* Look for first non white space or quote */
-        for (p = name; (c = *p); p++) {
-                if (c == '"') {
-                        /* Next char is start of string if non null */
-                        if (p[1])
-                                return p + 1;
-                        /* Else null string */
-                        return NULL;
-                }
-                if (!isspace((unsigned char)c))
-                        return p;
-        }
-        return NULL;
-}
-
-/* As above but strip from end of string : maybe should handle brackets? */
-static char *
-strip_end(char *name)
-{
-        char *p, c;
-
-        if (!name)
-                return NULL;
-
-        /* Look for first non white space or quote */
-        for (p = name + strlen(name) - 1; p >= name; p--) {
-                c = *p;
-                if (c == '"') {
-                        if (p - 1 == name)
-                                return NULL;
-                        *p = 0;
-                        return name;
-                }
-                if (isspace((unsigned char)c))
-                        *p = 0;
-                else
-                        return name;
-        }
-        return NULL;
-}
-
-static MIME_HEADER *
-mime_hdr_new(char *name, char *value)
-{
-        MIME_HEADER *mhdr;
-        char *tmpname = NULL, *tmpval = NULL, *p;
-
-        if (name) {
-                if (!(tmpname = strdup(name)))
-                        goto err;
-                for (p = tmpname; *p; p++)
-                        *p = tolower((unsigned char)*p);
-        }
-        if (value) {
-                if (!(tmpval = strdup(value)))
-                        goto err;
-                for (p = tmpval; *p; p++)
-                        *p = tolower((unsigned char)*p);
-        }
-        mhdr = malloc(sizeof(MIME_HEADER));
-        if (!mhdr)
-                goto err;
-        mhdr->name = tmpname;
-        mhdr->value = tmpval;
-        if (!(mhdr->params = sk_MIME_PARAM_new(mime_param_cmp))) {
-                free(mhdr);
-                goto err;
-        }
-        return mhdr;
-err:
-        free(tmpname);
-        free(tmpval);
-        return NULL;
-}
-
-static int
-mime_hdr_addparam(MIME_HEADER *mhdr, char *name, char *value)
-{
-        char *tmpname = NULL, *tmpval = NULL, *p;
-        MIME_PARAM *mparam;
-
-        if (name) {
-                tmpname = strdup(name);
-                if (!tmpname)
-                        goto err;
-                for (p = tmpname; *p; p++)
-                        *p = tolower((unsigned char)*p);
-        }
-        if (value) {
-                tmpval = strdup(value);
-                if (!tmpval)
-                        goto err;
-        }
-        /* Parameter values are case sensitive so leave as is */
-        mparam = malloc(sizeof(MIME_PARAM));
-        if (!mparam)
-                goto err;
-        mparam->param_name = tmpname;
-        mparam->param_value = tmpval;
-        if (sk_MIME_PARAM_push(mhdr->params, mparam) == 0) {
-                free(mparam);
-                goto err;
-        }
-        return 1;
-err:
-        free(tmpname);
-        free(tmpval);
-        return 0;
-}
-
-static int
-mime_hdr_cmp(const MIME_HEADER * const *a, const MIME_HEADER * const *b)
-{
-        if (!(*a)->name || !(*b)->name)
-                return !!(*a)->name - !!(*b)->name;
-        return (strcmp((*a)->name, (*b)->name));
-}
-
-static int
-mime_param_cmp(const MIME_PARAM * const *a, const MIME_PARAM * const *b)
-{
-        if (!(*a)->param_name || !(*b)->param_name)
-                return !!(*a)->param_name - !!(*b)->param_name;
-        return (strcmp((*a)->param_name, (*b)->param_name));
-}
-
-/* Find a header with a given name (if possible) */
-
-static MIME_HEADER *
-mime_hdr_find(STACK_OF(MIME_HEADER) *hdrs, char *name)
-{
-        MIME_HEADER htmp;
-        int idx;
-        htmp.name = name;
-        idx = sk_MIME_HEADER_find(hdrs, &htmp);
-        if (idx < 0)
-                return NULL;
-        return sk_MIME_HEADER_value(hdrs, idx);
-}
-
-static MIME_PARAM *
-mime_param_find(MIME_HEADER *hdr, char *name)
-{
-        MIME_PARAM param;
-        int idx;
-        param.param_name = name;
-        idx = sk_MIME_PARAM_find(hdr->params, &param);
-        if (idx < 0)
-                return NULL;
-        return sk_MIME_PARAM_value(hdr->params, idx);
-}
-
-static void
-mime_hdr_free(MIME_HEADER *hdr)
-{
-        free(hdr->name);
-        free(hdr->value);
-        if (hdr->params)
-                sk_MIME_PARAM_pop_free(hdr->params, mime_param_free);
-        free(hdr);
-}
-
-static void
-mime_param_free(MIME_PARAM *param)
-{
-        free(param->param_name);
-        free(param->param_value);
-        free(param);
-}
-
-/* Check for a multipart boundary. Returns:
- * 0 : no boundary
- * 1 : part boundary
- * 2 : final boundary
- */
-static int
-mime_bound_check(char *line, int linelen, char *bound, int blen)
-{
-        if (linelen == -1)
-                linelen = strlen(line);
-        if (blen == -1)
-                blen = strlen(bound);
-        /* Quickly eliminate if line length too short */
-        if (blen + 2 > linelen)
-                return 0;
-        /* Check for part boundary */
-        if (!strncmp(line, "--", 2) && !strncmp(line + 2, bound, blen)) {
-                if (!strncmp(line + blen + 2, "--", 2))
-                        return 2;
-                else
-                        return 1;
-        }
-        return 0;
-}
-
-static int
-strip_eol(char *linebuf, int *plen)
-{
-        int len = *plen;
-        char *p, c;
-        int is_eol = 0;
-
-        for (p = linebuf + len - 1; len > 0; len--, p--) {
-                c = *p;
-                if (c == '\n')
-                        is_eol = 1;
-                else if (c != '\r')
-                        break;
-        }
-        *plen = len;
-        return is_eol;
-}
diff --git a/src/lib/libcrypto/asn1/asn_moid.c b/src/lib/libcrypto/asn1/asn_moid.c
deleted file mode 100644
index 76b6405212..0000000000
--- a/src/lib/libcrypto/asn1/asn_moid.c
+++ /dev/null
@@ -1,158 +0,0 @@
-/* $OpenBSD: asn_moid.c,v 1.12 2014/07/11 08:44:47 jsing Exp $ */
-/* Written by Stephen Henson (steve@openssl.org) for the OpenSSL
- * project 2001.
- */
-/* ====================================================================
- * Copyright (c) 2001-2004 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <ctype.h>
-#include <stdio.h>
-#include <string.h>
-
-#include <openssl/err.h>
-#include <openssl/conf.h>
-#include <openssl/crypto.h>
-#include <openssl/x509.h>
-
-/* Simple ASN1 OID module: add all objects in a given section */
-
-static int do_create(char *value, char *name);
-
-static int
-oid_module_init(CONF_IMODULE *md, const CONF *cnf)
-{
-        int i;
-        const char *oid_section;
-        STACK_OF(CONF_VALUE) *sktmp;
-        CONF_VALUE *oval;
-
-        oid_section = CONF_imodule_get_value(md);
-        if (!(sktmp = NCONF_get_section(cnf, oid_section))) {
-                ASN1err(ASN1_F_OID_MODULE_INIT, ASN1_R_ERROR_LOADING_SECTION);
-                return 0;
-        }
-        for (i = 0; i < sk_CONF_VALUE_num(sktmp); i++) {
-                oval = sk_CONF_VALUE_value(sktmp, i);
-                if (!do_create(oval->value, oval->name)) {
-                        ASN1err(ASN1_F_OID_MODULE_INIT, ASN1_R_ADDING_OBJECT);
-                        return 0;
-                }
-        }
-        return 1;
-}
-
-static void
-oid_module_finish(CONF_IMODULE *md)
-{
-        OBJ_cleanup();
-}
-
-void
-ASN1_add_oid_module(void)
-{
-        CONF_module_add("oid_section", oid_module_init, oid_module_finish);
-}
-
-/* Create an OID based on a name value pair. Accept two formats.
- * shortname = 1.2.3.4
- * shortname = some long name, 1.2.3.4
- */
-
-static int
-do_create(char *value, char *name)
-{
-        int nid;
-        ASN1_OBJECT *oid;
-        char *ln, *ostr, *p, *lntmp;
-
-        p = strrchr(value, ',');
-        if (!p) {
-                ln = name;
-                ostr = value;
-        } else {
-                ln = NULL;
-                ostr = p + 1;
-                if (!*ostr)
-                        return 0;
-                while (isspace((unsigned char)*ostr))
-                        ostr++;
-        }
-
-        nid = OBJ_create(ostr, name, ln);
-
-        if (nid == NID_undef)
-                return 0;
-
-        if (p) {
-                ln = value;
-                while (isspace((unsigned char)*ln))
-                        ln++;
-                p--;
-                while (isspace((unsigned char)*p)) {
-                        if (p == ln)
-                                return 0;
-                        p--;
-                }
-                p++;
-                lntmp = malloc((p - ln) + 1);
-                if (lntmp == NULL)
-                        return 0;
-                memcpy(lntmp, ln, p - ln);
-                lntmp[p - ln] = 0;
-                oid = OBJ_nid2obj(nid);
-                oid->ln = lntmp;
-        }
-
-        return 1;
-}
diff --git a/src/lib/libcrypto/asn1/asn_pack.c b/src/lib/libcrypto/asn1/asn_pack.c
deleted file mode 100644
index f010f87bbd..0000000000
--- a/src/lib/libcrypto/asn1/asn_pack.c
+++ /dev/null
@@ -1,217 +0,0 @@
-/* $OpenBSD: asn_pack.c,v 1.14 2014/07/11 13:41:59 miod Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 1999.
- */
-/* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <stdio.h>
-
-#include <openssl/asn1.h>
-#include <openssl/err.h>
-
-#ifndef NO_ASN1_OLD
-
-/* ASN1 packing and unpacking functions */
-
-/* Turn an ASN1 encoded SEQUENCE OF into a STACK of structures */
-
-STACK_OF(OPENSSL_BLOCK) *
-ASN1_seq_unpack(const unsigned char *buf, int len, d2i_of_void *d2i,
-    void (*free_func)(OPENSSL_BLOCK))
-{
-        STACK_OF(OPENSSL_BLOCK) *sk;
-        const unsigned char *pbuf;
-
-        pbuf = buf;
-        if (!(sk = d2i_ASN1_SET(NULL, &pbuf, len, d2i, free_func,
-                                        V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL)))
-                ASN1err(ASN1_F_ASN1_SEQ_UNPACK,ASN1_R_DECODE_ERROR);
-        return sk;
-}
-
-/* Turn a STACK structures into an ASN1 encoded SEQUENCE OF structure in a
- * OPENSSL_malloc'ed buffer
- */
-
-unsigned char *
-ASN1_seq_pack(STACK_OF(OPENSSL_BLOCK) *safes, i2d_of_void *i2d,
-    unsigned char **buf, int *len)
-{
-        int safelen;
-        unsigned char *safe, *p;
-
-        if (!(safelen = i2d_ASN1_SET(safes, NULL, i2d, V_ASN1_SEQUENCE,
-                                              V_ASN1_UNIVERSAL, IS_SEQUENCE))) {
-                ASN1err(ASN1_F_ASN1_SEQ_PACK,ASN1_R_ENCODE_ERROR);
-                return NULL;
-        }
-        if (!(safe = malloc(safelen))) {
-                ASN1err(ASN1_F_ASN1_SEQ_PACK,ERR_R_MALLOC_FAILURE);
-                return NULL;
-        }
-        p = safe;
-        i2d_ASN1_SET(safes, &p, i2d, V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL,
-                                                                 IS_SEQUENCE);
-        if (len)
-                *len = safelen;
-        if (buf)
-                *buf = safe;
-        return safe;
-}
-
-/* Extract an ASN1 object from an ASN1_STRING */
-
-void *
-ASN1_unpack_string(ASN1_STRING *oct, d2i_of_void *d2i)
-{
-        const unsigned char *p;
-        char *ret;
-
-        p = oct->data;
-        if (!(ret = d2i(NULL, &p, oct->length)))
-                ASN1err(ASN1_F_ASN1_UNPACK_STRING,ASN1_R_DECODE_ERROR);
-        return ret;
-}
-
-/* Pack an ASN1 object into an ASN1_STRING */
-
-ASN1_STRING *
-ASN1_pack_string(void *obj, i2d_of_void *i2d, ASN1_STRING **oct)
-{
-        unsigned char *p;
-        ASN1_STRING *octmp;
-
-        if (!oct || !*oct) {
-                if (!(octmp = ASN1_STRING_new())) {
-                        ASN1err(ASN1_F_ASN1_PACK_STRING,ERR_R_MALLOC_FAILURE);
-                        return NULL;
-                }
-        } else
-                octmp = *oct;
-                
-        if (!(octmp->length = i2d(obj, NULL))) {
-                ASN1err(ASN1_F_ASN1_PACK_STRING,ASN1_R_ENCODE_ERROR);
-                goto err;
-        }
-        if (!(p = malloc (octmp->length))) {
-                ASN1err(ASN1_F_ASN1_PACK_STRING,ERR_R_MALLOC_FAILURE);
-                goto err;
-        }
-        octmp->data = p;
-        i2d (obj, &p);
-        if (oct)
-                *oct = octmp;
-        return octmp;
-err:
-        if (!oct || octmp != *oct) {
-                ASN1_STRING_free(octmp);
-                if (oct)
-                        *oct = NULL;
-        }
-        return NULL;
-}
-
-#endif
-
-/* ASN1_ITEM versions of the above */
-
-ASN1_STRING *
-ASN1_item_pack(void *obj, const ASN1_ITEM *it, ASN1_STRING **oct)
-{
-        ASN1_STRING *octmp;
-
-        if (!oct || !*oct) {
-                if (!(octmp = ASN1_STRING_new ())) {
-                        ASN1err(ASN1_F_ASN1_ITEM_PACK, ERR_R_MALLOC_FAILURE);
-                        return NULL;
-                }
-        } else
-                octmp = *oct;
-
-        if (octmp->data) {
-                free(octmp->data);
-                octmp->data = NULL;
-        }
-
-        if (!(octmp->length = ASN1_item_i2d(obj, &octmp->data, it))) {
-                ASN1err(ASN1_F_ASN1_ITEM_PACK, ASN1_R_ENCODE_ERROR);
-                goto err;
-        }
-        if (!octmp->data) {
-                ASN1err(ASN1_F_ASN1_ITEM_PACK, ERR_R_MALLOC_FAILURE);
-                goto err;
-        }
-        if (oct)
-                *oct = octmp;
-        return octmp;
-err:
-        if (!oct || octmp != *oct)
-                ASN1_STRING_free(octmp);
-        return NULL;
-}
-
-/* Extract an ASN1 object from an ASN1_STRING */
-
-void *
-ASN1_item_unpack(ASN1_STRING *oct, const ASN1_ITEM *it)
-{
-        const unsigned char *p;
-        void *ret;
-
-        p = oct->data;
-        if (!(ret = ASN1_item_d2i(NULL, &p, oct->length, it)))
-                ASN1err(ASN1_F_ASN1_ITEM_UNPACK, ASN1_R_DECODE_ERROR);
-        return ret;
-}
diff --git a/src/lib/libcrypto/asn1/bio_asn1.c b/src/lib/libcrypto/asn1/bio_asn1.c
deleted file mode 100644
index 219810db82..0000000000
--- a/src/lib/libcrypto/asn1/bio_asn1.c
+++ /dev/null
@@ -1,496 +0,0 @@
-/* $OpenBSD: bio_asn1.c,v 1.11 2015/02/10 09:52:35 miod Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project.
- */
-/* ====================================================================
- * Copyright (c) 2006 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-/* Experimental ASN1 BIO. When written through the data is converted
- * to an ASN1 string type: default is OCTET STRING. Additional functions
- * can be provided to add prefix and suffix data.
- */
-
-#include <stdlib.h>
-#include <string.h>
-
-#include <openssl/bio.h>
-#include <openssl/asn1.h>
-
-/* Must be large enough for biggest tag+length */
-#define DEFAULT_ASN1_BUF_SIZE 20
-
-typedef enum {
-        ASN1_STATE_START,
-        ASN1_STATE_PRE_COPY,
-        ASN1_STATE_HEADER,
-        ASN1_STATE_HEADER_COPY,
-        ASN1_STATE_DATA_COPY,
-        ASN1_STATE_POST_COPY,
-        ASN1_STATE_DONE
-} asn1_bio_state_t;
-
-typedef struct BIO_ASN1_EX_FUNCS_st {
-        asn1_ps_func    *ex_func;
-        asn1_ps_func    *ex_free_func;
-} BIO_ASN1_EX_FUNCS;
-
-typedef struct BIO_ASN1_BUF_CTX_t {
-        /* Internal state */
-        asn1_bio_state_t state;
-        /* Internal buffer */
-        unsigned char *buf;
-        /* Size of buffer */
-        int bufsize;
-        /* Current position in buffer */
-        int bufpos;
-        /* Current buffer length */
-        int buflen;
-        /* Amount of data to copy */
-        int copylen;
-        /* Class and tag to use */
-        int asn1_class, asn1_tag;
-        asn1_ps_func *prefix, *prefix_free, *suffix, *suffix_free;
-        /* Extra buffer for prefix and suffix data */
-        unsigned char *ex_buf;
-        int ex_len;
-        int ex_pos;
-        void *ex_arg;
-} BIO_ASN1_BUF_CTX;
-
-
-static int asn1_bio_write(BIO *h, const char *buf, int num);
-static int asn1_bio_read(BIO *h, char *buf, int size);
-static int asn1_bio_puts(BIO *h, const char *str);
-static int asn1_bio_gets(BIO *h, char *str, int size);
-static long asn1_bio_ctrl(BIO *h, int cmd, long arg1, void *arg2);
-static int asn1_bio_new(BIO *h);
-static int asn1_bio_free(BIO *data);
-static long asn1_bio_callback_ctrl(BIO *h, int cmd, bio_info_cb *fp);
-
-static int asn1_bio_init(BIO_ASN1_BUF_CTX *ctx, int size);
-static int asn1_bio_flush_ex(BIO *b, BIO_ASN1_BUF_CTX *ctx,
-    asn1_ps_func *cleanup, asn1_bio_state_t next);
-static int asn1_bio_setup_ex(BIO *b, BIO_ASN1_BUF_CTX *ctx,
-    asn1_ps_func *setup, asn1_bio_state_t ex_state,
-    asn1_bio_state_t other_state);
-
-static BIO_METHOD methods_asn1 = {
-        .type = BIO_TYPE_ASN1,
-        .name = "asn1",
-        .bwrite = asn1_bio_write,
-        .bread = asn1_bio_read,
-        .bputs = asn1_bio_puts,
-        .bgets = asn1_bio_gets,
-        .ctrl = asn1_bio_ctrl,
-        .create = asn1_bio_new,
-        .destroy = asn1_bio_free,
-        .callback_ctrl = asn1_bio_callback_ctrl
-};
-
-BIO_METHOD *
-BIO_f_asn1(void)
-{
-        return (&methods_asn1);
-}
-
-static int
-asn1_bio_new(BIO *b)
-{
-        BIO_ASN1_BUF_CTX *ctx;
-        ctx = malloc(sizeof(BIO_ASN1_BUF_CTX));
-        if (!ctx)
-                return 0;
-        if (!asn1_bio_init(ctx, DEFAULT_ASN1_BUF_SIZE)) {
-                free(ctx);
-                return 0;
-        }
-        b->init = 1;
-        b->ptr = (char *)ctx;
-        b->flags = 0;
-        return 1;
-}
-
-static int
-asn1_bio_init(BIO_ASN1_BUF_CTX *ctx, int size)
-{
-        ctx->buf = malloc(size);
-        if (!ctx->buf)
-                return 0;
-        ctx->bufsize = size;
-        ctx->bufpos = 0;
-        ctx->buflen = 0;
-        ctx->copylen = 0;
-        ctx->asn1_class = V_ASN1_UNIVERSAL;
-        ctx->asn1_tag = V_ASN1_OCTET_STRING;
-        ctx->ex_buf = 0;
-        ctx->ex_pos = 0;
-        ctx->ex_len = 0;
-        ctx->state = ASN1_STATE_START;
-        return 1;
-}
-
-static int
-asn1_bio_free(BIO *b)
-{
-        BIO_ASN1_BUF_CTX *ctx;
-
-        ctx = (BIO_ASN1_BUF_CTX *) b->ptr;
-        if (ctx == NULL)
-                return 0;
-        free(ctx->buf);
-        free(ctx);
-        b->init = 0;
-        b->ptr = NULL;
-        b->flags = 0;
-        return 1;
-}
-
-static int
-asn1_bio_write(BIO *b, const char *in , int inl)
-{
-        BIO_ASN1_BUF_CTX *ctx;
-        int wrmax, wrlen, ret, buflen;
-        unsigned char *p;
-
-        if (!in || (inl < 0) || (b->next_bio == NULL))
-                return 0;
-        ctx = (BIO_ASN1_BUF_CTX *) b->ptr;
-        if (ctx == NULL)
-                return 0;
-
-        wrlen = 0;
-        ret = -1;
-
-        for (;;) {
-                switch (ctx->state) {
-
-                        /* Setup prefix data, call it */
-                case ASN1_STATE_START:
-                        if (!asn1_bio_setup_ex(b, ctx, ctx->prefix,
-                                    ASN1_STATE_PRE_COPY, ASN1_STATE_HEADER))
-                                return 0;
-                        break;
-
-                        /* Copy any pre data first */
-                case ASN1_STATE_PRE_COPY:
-                        ret = asn1_bio_flush_ex(b, ctx, ctx->prefix_free,
-                            ASN1_STATE_HEADER);
-                        if (ret <= 0)
-                                goto done;
-                        break;
-
-                case ASN1_STATE_HEADER:
-                        buflen = ASN1_object_size(0, inl, ctx->asn1_tag) - inl;
-                        if (buflen <= 0 || buflen > ctx->bufsize)
-                                return -1;
-                        ctx->buflen = buflen;
-                        p = ctx->buf;
-                        ASN1_put_object(&p, 0, inl,
-                            ctx->asn1_tag, ctx->asn1_class);
-                        ctx->copylen = inl;
-                        ctx->state = ASN1_STATE_HEADER_COPY;
-                        break;
-
-                case ASN1_STATE_HEADER_COPY:
-                        ret = BIO_write(b->next_bio,
-                            ctx->buf + ctx->bufpos, ctx->buflen);
-                        if (ret <= 0)
-                                goto done;
-
-                        ctx->buflen -= ret;
-                        if (ctx->buflen)
-                                ctx->bufpos += ret;
-                        else {
-                                ctx->bufpos = 0;
-                                ctx->state = ASN1_STATE_DATA_COPY;
-                        }
-                        break;
-
-                case ASN1_STATE_DATA_COPY:
-
-                        if (inl > ctx->copylen)
-                                wrmax = ctx->copylen;
-                        else
-                                wrmax = inl;
-                        ret = BIO_write(b->next_bio, in, wrmax);
-                        if (ret <= 0)
-                                break;
-                        wrlen += ret;
-                        ctx->copylen -= ret;
-                        in += ret;
-                        inl -= ret;
-
-                        if (ctx->copylen == 0)
-                                ctx->state = ASN1_STATE_HEADER;
-                        if (inl == 0)
-                                goto done;
-                        break;
-
-                default:
-                        BIO_clear_retry_flags(b);
-                        return 0;
-                }
-
-        }
-
-done:
-        BIO_clear_retry_flags(b);
-        BIO_copy_next_retry(b);
-
-        return (wrlen > 0) ? wrlen : ret;
-}
-
-static int
-asn1_bio_flush_ex(BIO *b, BIO_ASN1_BUF_CTX *ctx, asn1_ps_func *cleanup,
-    asn1_bio_state_t next)
-{
-        int ret;
-
-        if (ctx->ex_len <= 0)
-                return 1;
-        for (;;) {
-                ret = BIO_write(b->next_bio, ctx->ex_buf + ctx->ex_pos,
-                    ctx->ex_len);
-                if (ret <= 0)
-                        break;
-                ctx->ex_len -= ret;
-                if (ctx->ex_len > 0)
-                        ctx->ex_pos += ret;
-                else {
-                        if (cleanup)
-                                cleanup(b, &ctx->ex_buf, &ctx->ex_len,
-                                    &ctx->ex_arg);
-                        ctx->state = next;
-                        ctx->ex_pos = 0;
-                        break;
-                }
-        }
-        return ret;
-}
-
-static int
-asn1_bio_setup_ex(BIO *b, BIO_ASN1_BUF_CTX *ctx, asn1_ps_func *setup,
-    asn1_bio_state_t ex_state, asn1_bio_state_t other_state)
-{
-        if (setup && !setup(b, &ctx->ex_buf, &ctx->ex_len, &ctx->ex_arg)) {
-                BIO_clear_retry_flags(b);
-                return 0;
-        }
-        if (ctx->ex_len > 0)
-                ctx->state = ex_state;
-        else
-                ctx->state = other_state;
-        return 1;
-}
-
-static int
-asn1_bio_read(BIO *b, char *in , int inl)
-{
-        if (!b->next_bio)
-                return 0;
-        return BIO_read(b->next_bio, in , inl);
-}
-
-static int
-asn1_bio_puts(BIO *b, const char *str)
-{
-        return asn1_bio_write(b, str, strlen(str));
-}
-
-static int
-asn1_bio_gets(BIO *b, char *str, int size)
-{
-        if (!b->next_bio)
-                return 0;
-        return BIO_gets(b->next_bio, str , size);
-}
-
-static long
-asn1_bio_callback_ctrl(BIO *b, int cmd, bio_info_cb *fp)
-{
-        if (b->next_bio == NULL)
-                return (0);
-        return BIO_callback_ctrl(b->next_bio, cmd, fp);
-}
-
-static long
-asn1_bio_ctrl(BIO *b, int cmd, long arg1, void *arg2)
-{
-        BIO_ASN1_BUF_CTX *ctx;
-        BIO_ASN1_EX_FUNCS *ex_func;
-        long ret = 1;
-
-        ctx = (BIO_ASN1_BUF_CTX *) b->ptr;
-        if (ctx == NULL)
-                return 0;
-        switch (cmd) {
-
-        case BIO_C_SET_PREFIX:
-                ex_func = arg2;
-                ctx->prefix = ex_func->ex_func;
-                ctx->prefix_free = ex_func->ex_free_func;
-                break;
-
-        case BIO_C_GET_PREFIX:
-                ex_func = arg2;
-                ex_func->ex_func = ctx->prefix;
-                ex_func->ex_free_func = ctx->prefix_free;
-                break;
-
-        case BIO_C_SET_SUFFIX:
-                ex_func = arg2;
-                ctx->suffix = ex_func->ex_func;
-                ctx->suffix_free = ex_func->ex_free_func;
-                break;
-
-        case BIO_C_GET_SUFFIX:
-                ex_func = arg2;
-                ex_func->ex_func = ctx->suffix;
-                ex_func->ex_free_func = ctx->suffix_free;
-                break;
-
-        case BIO_C_SET_EX_ARG:
-                ctx->ex_arg = arg2;
-                break;
-
-        case BIO_C_GET_EX_ARG:
-                *(void **)arg2 = ctx->ex_arg;
-                break;
-
-        case BIO_CTRL_FLUSH:
-                if (!b->next_bio)
-                        return 0;
-
-                /* Call post function if possible */
-                if (ctx->state == ASN1_STATE_HEADER) {
-                        if (!asn1_bio_setup_ex(b, ctx, ctx->suffix,
-                            ASN1_STATE_POST_COPY, ASN1_STATE_DONE))
-                                return 0;
-                }
-
-                if (ctx->state == ASN1_STATE_POST_COPY) {
-                        ret = asn1_bio_flush_ex(b, ctx, ctx->suffix_free,
-                            ASN1_STATE_DONE);
-                        if (ret <= 0)
-                                return ret;
-                }
-
-                if (ctx->state == ASN1_STATE_DONE)
-                        return BIO_ctrl(b->next_bio, cmd, arg1, arg2);
-                else {
-                        BIO_clear_retry_flags(b);
-                        return 0;
-                }
-                break;
-
-
-        default:
-                if (!b->next_bio)
-                        return 0;
-                return BIO_ctrl(b->next_bio, cmd, arg1, arg2);
-
-        }
-
-        return ret;
-}
-
-static int
-asn1_bio_set_ex(BIO *b, int cmd, asn1_ps_func *ex_func, asn1_ps_func
-    *ex_free_func)
-{
-        BIO_ASN1_EX_FUNCS extmp;
-
-        extmp.ex_func = ex_func;
-        extmp.ex_free_func = ex_free_func;
-        return BIO_ctrl(b, cmd, 0, &extmp);
-}
-
-static int
-asn1_bio_get_ex(BIO *b, int cmd, asn1_ps_func **ex_func,
-    asn1_ps_func **ex_free_func)
-{
-        BIO_ASN1_EX_FUNCS extmp;
-        int ret;
-
-        ret = BIO_ctrl(b, cmd, 0, &extmp);
-        if (ret > 0) {
-                *ex_func = extmp.ex_func;
-                *ex_free_func = extmp.ex_free_func;
-        }
-        return ret;
-}
-
-int
-BIO_asn1_set_prefix(BIO *b, asn1_ps_func *prefix, asn1_ps_func *prefix_free)
-{
-        return asn1_bio_set_ex(b, BIO_C_SET_PREFIX, prefix, prefix_free);
-}
-
-int
-BIO_asn1_get_prefix(BIO *b, asn1_ps_func **pprefix, asn1_ps_func **pprefix_free)
-{
-        return asn1_bio_get_ex(b, BIO_C_GET_PREFIX, pprefix, pprefix_free);
-}
-
-int
-BIO_asn1_set_suffix(BIO *b, asn1_ps_func *suffix, asn1_ps_func *suffix_free)
-{
-        return asn1_bio_set_ex(b, BIO_C_SET_SUFFIX, suffix, suffix_free);
-}
-
-int
-BIO_asn1_get_suffix(BIO *b, asn1_ps_func **psuffix, asn1_ps_func **psuffix_free)
-{
-        return asn1_bio_get_ex(b, BIO_C_GET_SUFFIX, psuffix, psuffix_free);
-}
diff --git a/src/lib/libcrypto/asn1/bio_ndef.c b/src/lib/libcrypto/asn1/bio_ndef.c
deleted file mode 100644
index 1a23c27d04..0000000000
--- a/src/lib/libcrypto/asn1/bio_ndef.c
+++ /dev/null
@@ -1,243 +0,0 @@
-/* $OpenBSD: bio_ndef.c,v 1.9 2014/07/25 06:05:32 doug Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project.
- */
-/* ====================================================================
- * Copyright (c) 2008 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- */
-
-#include <openssl/asn1.h>
-#include <openssl/asn1t.h>
-#include <openssl/bio.h>
-#include <openssl/err.h>
-
-#include <stdio.h>
-
-/* Experimental NDEF ASN1 BIO support routines */
-
-/* The usage is quite simple, initialize an ASN1 structure,
- * get a BIO from it then any data written through the BIO
- * will end up translated to approptiate format on the fly.
- * The data is streamed out and does *not* need to be
- * all held in memory at once.
- *
- * When the BIO is flushed the output is finalized and any
- * signatures etc written out.
- *
- * The BIO is a 'proper' BIO and can handle non blocking I/O
- * correctly.
- *
- * The usage is simple. The implementation is *not*...
- */
-
-/* BIO support data stored in the ASN1 BIO ex_arg */
-
-typedef struct ndef_aux_st {
-        /* ASN1 structure this BIO refers to */
-        ASN1_VALUE *val;
-        const ASN1_ITEM *it;
-        /* Top of the BIO chain */
-        BIO *ndef_bio;
-        /* Output BIO */
-        BIO *out;
-        /* Boundary where content is inserted */
-        unsigned char **boundary;
-        /* DER buffer start */
-        unsigned char *derbuf;
-} NDEF_SUPPORT;
-
-static int ndef_prefix(BIO *b, unsigned char **pbuf, int *plen, void *parg);
-static int ndef_prefix_free(BIO *b, unsigned char **pbuf, int *plen, void *parg);
-static int ndef_suffix(BIO *b, unsigned char **pbuf, int *plen, void *parg);
-static int ndef_suffix_free(BIO *b, unsigned char **pbuf, int *plen, void *parg);
-
-BIO *
-BIO_new_NDEF(BIO *out, ASN1_VALUE *val, const ASN1_ITEM *it)
-{
-        NDEF_SUPPORT *ndef_aux = NULL;
-        BIO *asn_bio = NULL;
-        const ASN1_AUX *aux = it->funcs;
-        ASN1_STREAM_ARG sarg;
-
-        if (!aux || !aux->asn1_cb) {
-                ASN1err(ASN1_F_BIO_NEW_NDEF, ASN1_R_STREAMING_NOT_SUPPORTED);
-                return NULL;
-        }
-        ndef_aux = malloc(sizeof(NDEF_SUPPORT));
-        asn_bio = BIO_new(BIO_f_asn1());
-
-        /* ASN1 bio needs to be next to output BIO */
-
-        out = BIO_push(asn_bio, out);
-
-        if (!ndef_aux || !asn_bio || !out)
-                goto err;
-
-        BIO_asn1_set_prefix(asn_bio, ndef_prefix, ndef_prefix_free);
-        BIO_asn1_set_suffix(asn_bio, ndef_suffix, ndef_suffix_free);
-
-        /* Now let callback prepend any digest, cipher etc BIOs
-         * ASN1 structure needs.
-         */
-
-        sarg.out = out;
-        sarg.ndef_bio = NULL;
-        sarg.boundary = NULL;
-
-        if (aux->asn1_cb(ASN1_OP_STREAM_PRE, &val, it, &sarg) <= 0)
-                goto err;
-
-        ndef_aux->val = val;
-        ndef_aux->it = it;
-        ndef_aux->ndef_bio = sarg.ndef_bio;
-        ndef_aux->boundary = sarg.boundary;
-        ndef_aux->out = out;
-
-        BIO_ctrl(asn_bio, BIO_C_SET_EX_ARG, 0, ndef_aux);
-
-        return sarg.ndef_bio;
-
-err:
-        BIO_free(asn_bio);
-        free(ndef_aux);
-        return NULL;
-}
-
-static int
-ndef_prefix(BIO *b, unsigned char **pbuf, int *plen, void *parg)
-{
-        NDEF_SUPPORT *ndef_aux;
-        unsigned char *p;
-        int derlen;
-
-        if (!parg)
-                return 0;
-
-        ndef_aux = *(NDEF_SUPPORT **)parg;
-
-        derlen = ASN1_item_ndef_i2d(ndef_aux->val, NULL, ndef_aux->it);
-        p = malloc(derlen);
-        ndef_aux->derbuf = p;
-        *pbuf = p;
-        derlen = ASN1_item_ndef_i2d(ndef_aux->val, &p, ndef_aux->it);
-
-        if (!*ndef_aux->boundary)
-                return 0;
-
-        *plen = *ndef_aux->boundary - *pbuf;
-
-        return 1;
-}
-
-static int
-ndef_prefix_free(BIO *b, unsigned char **pbuf, int *plen, void *parg)
-{
-        NDEF_SUPPORT *ndef_aux;
-
-        if (!parg)
-                return 0;
-
-        ndef_aux = *(NDEF_SUPPORT **)parg;
-
-        free(ndef_aux->derbuf);
-
-        ndef_aux->derbuf = NULL;
-        *pbuf = NULL;
-        *plen = 0;
-        return 1;
-}
-
-static int
-ndef_suffix_free(BIO *b, unsigned char **pbuf, int *plen, void *parg)
-{
-        NDEF_SUPPORT **pndef_aux = (NDEF_SUPPORT **)parg;
-        if (!ndef_prefix_free(b, pbuf, plen, parg))
-                return 0;
-        free(*pndef_aux);
-        *pndef_aux = NULL;
-        return 1;
-}
-
-static int
-ndef_suffix(BIO *b, unsigned char **pbuf, int *plen, void *parg)
-{
-        NDEF_SUPPORT *ndef_aux;
-        unsigned char *p;
-        int derlen;
-        const ASN1_AUX *aux;
-        ASN1_STREAM_ARG sarg;
-
-        if (!parg)
-                return 0;
-
-        ndef_aux = *(NDEF_SUPPORT **)parg;
-
-        aux = ndef_aux->it->funcs;
-
-        /* Finalize structures */
-        sarg.ndef_bio = ndef_aux->ndef_bio;
-        sarg.out = ndef_aux->out;
-        sarg.boundary = ndef_aux->boundary;
-        if (aux->asn1_cb(ASN1_OP_STREAM_POST,
-            &ndef_aux->val, ndef_aux->it, &sarg) <= 0)
-                return 0;
-
-        derlen = ASN1_item_ndef_i2d(ndef_aux->val, NULL, ndef_aux->it);
-        p = malloc(derlen);
-        ndef_aux->derbuf = p;
-        *pbuf = p;
-        derlen = ASN1_item_ndef_i2d(ndef_aux->val, &p, ndef_aux->it);
-
-        if (!*ndef_aux->boundary)
-                return 0;
-        *pbuf = *ndef_aux->boundary;
-        *plen = derlen - (*ndef_aux->boundary - ndef_aux->derbuf);
-
-        return 1;
-}
diff --git a/src/lib/libcrypto/asn1/charmap.h b/src/lib/libcrypto/asn1/charmap.h
deleted file mode 100644
index d9397bf826..0000000000
--- a/src/lib/libcrypto/asn1/charmap.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/* $OpenBSD: charmap.h,v 1.4 2014/06/12 15:49:27 deraadt Exp $ */
-/* Auto generated with chartype.pl script.
- * Mask of various character properties
- */
-
-static const unsigned char char_type[] = {
-        2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2,
-        2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2,
-        120, 0, 1, 40, 0, 0, 0, 16, 16, 16, 0, 25, 25, 16, 16, 16,
-        16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 9, 9, 16, 9, 16,
-        0, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16,
-        16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 0, 1, 0, 0, 0,
-        0, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16,
-        16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 16, 0, 0, 0, 0, 2
-};
diff --git a/src/lib/libcrypto/asn1/charmap.pl b/src/lib/libcrypto/asn1/charmap.pl
deleted file mode 100644
index 2875c59867..0000000000
--- a/src/lib/libcrypto/asn1/charmap.pl
+++ /dev/null
@@ -1,80 +0,0 @@
-#!/usr/local/bin/perl -w
-
-use strict;
-
-my ($i, @arr);
-
-# Set up an array with the type of ASCII characters
-# Each set bit represents a character property.
-
-# RFC2253 character properties
-my $RFC2253_ESC = 1;    # Character escaped with \
-my $ESC_CTRL    = 2;    # Escaped control character
-# These are used with RFC1779 quoting using "
-my $NOESC_QUOTE = 8;    # Not escaped if quoted
-my $PSTRING_CHAR = 0x10;        # Valid PrintableString character
-my $RFC2253_FIRST_ESC = 0x20; # Escaped with \ if first character
-my $RFC2253_LAST_ESC = 0x40;  # Escaped with \ if last character
-
-for($i = 0; $i < 128; $i++) {
-        # Set the RFC2253 escape characters (control)
-        $arr[$i] = 0;
-        if(($i < 32) || ($i > 126)) {
-                $arr[$i] |= $ESC_CTRL;
-        }
-
-        # Some PrintableString characters
-        if(                ( ( $i >= ord("a")) && ( $i <= ord("z")) )
-                        || (  ( $i >= ord("A")) && ( $i <= ord("Z")) )
-                        || (  ( $i >= ord("0")) && ( $i <= ord("9")) )  ) {
-                $arr[$i] |= $PSTRING_CHAR;
-        }
-}
-
-# Now setup the rest
-
-# Remaining RFC2253 escaped characters
-
-$arr[ord(" ")] |= $NOESC_QUOTE | $RFC2253_FIRST_ESC | $RFC2253_LAST_ESC;
-$arr[ord("#")] |= $NOESC_QUOTE | $RFC2253_FIRST_ESC;
-
-$arr[ord(",")] |= $NOESC_QUOTE | $RFC2253_ESC;
-$arr[ord("+")] |= $NOESC_QUOTE | $RFC2253_ESC;
-$arr[ord("\"")] |= $RFC2253_ESC;
-$arr[ord("\\")] |= $RFC2253_ESC;
-$arr[ord("<")] |= $NOESC_QUOTE | $RFC2253_ESC;
-$arr[ord(">")] |= $NOESC_QUOTE | $RFC2253_ESC;
-$arr[ord(";")] |= $NOESC_QUOTE | $RFC2253_ESC;
-
-# Remaining PrintableString characters
-
-$arr[ord(" ")] |= $PSTRING_CHAR;
-$arr[ord("'")] |= $PSTRING_CHAR;
-$arr[ord("(")] |= $PSTRING_CHAR;
-$arr[ord(")")] |= $PSTRING_CHAR;
-$arr[ord("+")] |= $PSTRING_CHAR;
-$arr[ord(",")] |= $PSTRING_CHAR;
-$arr[ord("-")] |= $PSTRING_CHAR;
-$arr[ord(".")] |= $PSTRING_CHAR;
-$arr[ord("/")] |= $PSTRING_CHAR;
-$arr[ord(":")] |= $PSTRING_CHAR;
-$arr[ord("=")] |= $PSTRING_CHAR;
-$arr[ord("?")] |= $PSTRING_CHAR;
-
-# Now generate the C code
-
-print <<EOF;
-/* Auto generated with chartype.pl script.
- * Mask of various character properties
- */
-
-static unsigned char char_type[] = {
-EOF
-
-for($i = 0; $i < 128; $i++) {
-        print("\n") if($i && (($i % 16) == 0));
-        printf("%2d", $arr[$i]);
-        print(",") if ($i != 127);
-}
-print("\n};\n\n");
-
diff --git a/src/lib/libcrypto/asn1/d2i_pr.c b/src/lib/libcrypto/asn1/d2i_pr.c
deleted file mode 100644
index 68d02177c4..0000000000
--- a/src/lib/libcrypto/asn1/d2i_pr.c
+++ /dev/null
@@ -1,170 +0,0 @@
-/* $OpenBSD: d2i_pr.c,v 1.14 2015/03/19 14:00:22 tedu Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-
-#include <openssl/opensslconf.h>
-
-#include <openssl/asn1.h>
-#include <openssl/bn.h>
-#include <openssl/err.h>
-#include <openssl/evp.h>
-#include <openssl/objects.h>
-#include <openssl/x509.h>
-
-#ifndef OPENSSL_NO_ENGINE
-#include <openssl/engine.h>
-#endif
-
-#include "asn1_locl.h"
-
-EVP_PKEY *
-d2i_PrivateKey(int type, EVP_PKEY **a, const unsigned char **pp, long length)
-{
-        EVP_PKEY *ret;
-
-        if ((a == NULL) || (*a == NULL)) {
-                if ((ret = EVP_PKEY_new()) == NULL) {
-                        ASN1err(ASN1_F_D2I_PRIVATEKEY, ERR_R_EVP_LIB);
-                        return (NULL);
-                }
-        } else {
-                ret = *a;
-#ifndef OPENSSL_NO_ENGINE
-                if (ret->engine) {
-                        ENGINE_finish(ret->engine);
-                        ret->engine = NULL;
-                }
-#endif
-        }
-
-        if (!EVP_PKEY_set_type(ret, type)) {
-                ASN1err(ASN1_F_D2I_PRIVATEKEY, ASN1_R_UNKNOWN_PUBLIC_KEY_TYPE);
-                goto err;
-        }
-
-        if (!ret->ameth->old_priv_decode ||
-            !ret->ameth->old_priv_decode(ret, pp, length)) {
-                if (ret->ameth->priv_decode) {
-                        PKCS8_PRIV_KEY_INFO *p8 = NULL;
-                        p8 = d2i_PKCS8_PRIV_KEY_INFO(NULL, pp, length);
-                        if (!p8)
-                                goto err;
-                        EVP_PKEY_free(ret);
-                        ret = EVP_PKCS82PKEY(p8);
-                        PKCS8_PRIV_KEY_INFO_free(p8);
-                } else {
-                        ASN1err(ASN1_F_D2I_PRIVATEKEY, ERR_R_ASN1_LIB);
-                        goto err;
-                }
-        }
-        if (a != NULL)
-                (*a) = ret;
-        return (ret);
-
-err:
-        if (a == NULL || *a != ret)
-                EVP_PKEY_free(ret);
-        return (NULL);
-}
-
-/* This works like d2i_PrivateKey() except it automatically works out the type */
-
-EVP_PKEY *
-d2i_AutoPrivateKey(EVP_PKEY **a, const unsigned char **pp, long length)
-{
-        STACK_OF(ASN1_TYPE) *inkey;
-        const unsigned char *p;
-        int keytype;
-
-        p = *pp;
-        /* Dirty trick: read in the ASN1 data into a STACK_OF(ASN1_TYPE):
-         * by analyzing it we can determine the passed structure: this
-         * assumes the input is surrounded by an ASN1 SEQUENCE.
-         */
-        inkey = d2i_ASN1_SEQUENCE_ANY(NULL, &p, length);
-        /* Since we only need to discern "traditional format" RSA and DSA
-         * keys we can just count the elements.
-         */
-        if (sk_ASN1_TYPE_num(inkey) == 6)
-                keytype = EVP_PKEY_DSA;
-        else if (sk_ASN1_TYPE_num(inkey) == 4)
-                keytype = EVP_PKEY_EC;
-        else if (sk_ASN1_TYPE_num(inkey) == 3)  {
-                /* This seems to be PKCS8, not traditional format */
-                PKCS8_PRIV_KEY_INFO *p8 = d2i_PKCS8_PRIV_KEY_INFO(
-                    NULL, pp, length);
-                EVP_PKEY *ret;
-
-                sk_ASN1_TYPE_pop_free(inkey, ASN1_TYPE_free);
-                if (!p8) {
-                        ASN1err(ASN1_F_D2I_AUTOPRIVATEKEY,
-                            ASN1_R_UNSUPPORTED_PUBLIC_KEY_TYPE);
-                        return NULL;
-                }
-                ret = EVP_PKCS82PKEY(p8);
-                PKCS8_PRIV_KEY_INFO_free(p8);
-                if (a) {
-                        *a = ret;
-                }
-                return ret;
-        } else
-                keytype = EVP_PKEY_RSA;
-        sk_ASN1_TYPE_pop_free(inkey, ASN1_TYPE_free);
-        return d2i_PrivateKey(keytype, a, pp, length);
-}
diff --git a/src/lib/libcrypto/asn1/d2i_pu.c b/src/lib/libcrypto/asn1/d2i_pu.c
deleted file mode 100644
index e917356254..0000000000
--- a/src/lib/libcrypto/asn1/d2i_pu.c
+++ /dev/null
@@ -1,136 +0,0 @@
-/* $OpenBSD: d2i_pu.c,v 1.13 2015/03/19 14:00:22 tedu Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-
-#include <openssl/opensslconf.h>
-
-#include <openssl/asn1.h>
-#include <openssl/bn.h>
-#include <openssl/err.h>
-#include <openssl/evp.h>
-#include <openssl/objects.h>
-
-#ifndef OPENSSL_NO_DSA
-#include <openssl/dsa.h>
-#endif
-#ifndef OPENSSL_NO_EC
-#include <openssl/ec.h>
-#endif
-#ifndef OPENSSL_NO_RSA
-#include <openssl/rsa.h>
-#endif
-
-EVP_PKEY *
-d2i_PublicKey(int type, EVP_PKEY **a, const unsigned char **pp, long length)
-{
-        EVP_PKEY *ret;
-
-        if ((a == NULL) || (*a == NULL)) {
-                if ((ret = EVP_PKEY_new()) == NULL) {
-                        ASN1err(ASN1_F_D2I_PUBLICKEY, ERR_R_EVP_LIB);
-                        return (NULL);
-                }
-        } else
-                ret = *a;
-
-        if (!EVP_PKEY_set_type(ret, type)) {
-                ASN1err(ASN1_F_D2I_PUBLICKEY, ERR_R_EVP_LIB);
-                goto err;
-        }
-
-        switch (EVP_PKEY_id(ret)) {
-#ifndef OPENSSL_NO_RSA
-        case EVP_PKEY_RSA:
-                if ((ret->pkey.rsa = d2i_RSAPublicKey(NULL, pp, length)) ==
-                    NULL) {
-                        ASN1err(ASN1_F_D2I_PUBLICKEY, ERR_R_ASN1_LIB);
-                        goto err;
-                }
-                break;
-#endif
-#ifndef OPENSSL_NO_DSA
-        case EVP_PKEY_DSA:
-                if (!d2i_DSAPublicKey(&(ret->pkey.dsa), pp, length)) {
-                        ASN1err(ASN1_F_D2I_PUBLICKEY, ERR_R_ASN1_LIB);
-                        goto err;
-                }
-                break;
-#endif
-#ifndef OPENSSL_NO_EC
-        case EVP_PKEY_EC:
-                if (!o2i_ECPublicKey(&(ret->pkey.ec), pp, length)) {
-                        ASN1err(ASN1_F_D2I_PUBLICKEY, ERR_R_ASN1_LIB);
-                        goto err;
-                }
-                break;
-#endif
-        default:
-                ASN1err(ASN1_F_D2I_PUBLICKEY, ASN1_R_UNKNOWN_PUBLIC_KEY_TYPE);
-                goto err;
-                /* break; */
-        }
-        if (a != NULL)
-                (*a) = ret;
-        return (ret);
-
-err:
-        if (a == NULL || *a != ret)
-                EVP_PKEY_free(ret);
-        return (NULL);
-}
diff --git a/src/lib/libcrypto/asn1/evp_asn1.c b/src/lib/libcrypto/asn1/evp_asn1.c
deleted file mode 100644
index 5ee4751763..0000000000
--- a/src/lib/libcrypto/asn1/evp_asn1.c
+++ /dev/null
@@ -1,199 +0,0 @@
-/* $OpenBSD: evp_asn1.c,v 1.14 2015/07/29 14:58:34 jsing Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-#include <string.h>
-
-#include <openssl/asn1.h>
-#include <openssl/asn1_mac.h>
-#include <openssl/err.h>
-
-int
-ASN1_TYPE_set_octetstring(ASN1_TYPE *a, unsigned char *data, int len)
-{
-        ASN1_STRING *os;
-
-        if ((os = M_ASN1_OCTET_STRING_new()) == NULL)
-                return (0);
-        if (!ASN1_STRING_set(os, data, len)) {
-                M_ASN1_OCTET_STRING_free(os);
-                return (0);
-        }
-        ASN1_TYPE_set(a, V_ASN1_OCTET_STRING, os);
-        return (1);
-}
-
-/* int max_len:  for returned value    */
-int
-ASN1_TYPE_get_octetstring(ASN1_TYPE *a, unsigned char *data, int max_len)
-{
-        int ret, num;
-        unsigned char *p;
-
-        if ((a->type != V_ASN1_OCTET_STRING) ||
-            (a->value.octet_string == NULL)) {
-                ASN1err(ASN1_F_ASN1_TYPE_GET_OCTETSTRING, ASN1_R_DATA_IS_WRONG);
-                return (-1);
-        }
-        p = M_ASN1_STRING_data(a->value.octet_string);
-        ret = M_ASN1_STRING_length(a->value.octet_string);
-        if (ret < max_len)
-                num = ret;
-        else
-                num = max_len;
-        memcpy(data, p, num);
-        return (ret);
-}
-
-int
-ASN1_TYPE_set_int_octetstring(ASN1_TYPE *a, long num, unsigned char *data,
-    int len)
-{
-        int n, size;
-        ASN1_OCTET_STRING os, *osp;
-        ASN1_INTEGER in;
-        unsigned char *p;
-        unsigned char buf[32]; /* when they have 256bit longs,
-                                * I'll be in trouble */
-        in.data = buf;
-        in.length = 32;
-        os.data = data;
-        os.type = V_ASN1_OCTET_STRING;
-        os.length = len;
-        ASN1_INTEGER_set(&in, num);
-        n = i2d_ASN1_INTEGER(&in, NULL);
-        n += M_i2d_ASN1_OCTET_STRING(&os, NULL);
-
-        size = ASN1_object_size(1, n, V_ASN1_SEQUENCE);
-
-        if ((osp = ASN1_STRING_new()) == NULL)
-                return (0);
-        /* Grow the 'string' */
-        if (!ASN1_STRING_set(osp, NULL, size)) {
-                ASN1_STRING_free(osp);
-                return (0);
-        }
-
-        M_ASN1_STRING_length_set(osp, size);
-        p = M_ASN1_STRING_data(osp);
-
-        ASN1_put_object(&p, 1,n, V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);
-        i2d_ASN1_INTEGER(&in, &p);
-        M_i2d_ASN1_OCTET_STRING(&os, &p);
-
-        ASN1_TYPE_set(a, V_ASN1_SEQUENCE, osp);
-        return (1);
-}
-
-/* we return the actual length..., num may be missing, in which
- * case, set it to zero */
-/* int max_len:  for returned value    */
-int
-ASN1_TYPE_get_int_octetstring(ASN1_TYPE *a, long *num, unsigned char *data,
-    int max_len)
-{
-        int ret = -1, n;
-        ASN1_INTEGER *ai = NULL;
-        ASN1_OCTET_STRING *os = NULL;
-        const unsigned char *p;
-        long length;
-        ASN1_const_CTX c;
-
-        if ((a->type != V_ASN1_SEQUENCE) || (a->value.sequence == NULL)) {
-                goto err;
-        }
-        p = M_ASN1_STRING_data(a->value.sequence);
-        length = M_ASN1_STRING_length(a->value.sequence);
-
-        c.pp = &p;
-        c.p = p;
-        c.max = p + length;
-        c.error = ASN1_R_DATA_IS_WRONG;
-
-        M_ASN1_D2I_start_sequence();
-        c.q = c.p;
-        if ((ai = d2i_ASN1_INTEGER(NULL, &c.p, c.slen)) == NULL)
-                goto err;
-        c.slen -= (c.p - c.q);
-        c.q = c.p;
-        if ((os = d2i_ASN1_OCTET_STRING(NULL, &c.p, c.slen)) == NULL)
-                goto err;
-        c.slen -= (c.p - c.q);
-        if (!M_ASN1_D2I_end_sequence())
-                goto err;
-
-        if (num != NULL)
-                *num = ASN1_INTEGER_get(ai);
-
-        ret = M_ASN1_STRING_length(os);
-        if (max_len > ret)
-                n = ret;
-        else
-                n = max_len;
-
-        if (data != NULL)
-                memcpy(data, M_ASN1_STRING_data(os), n);
-        if (0) {
-err:
-                ASN1err(ASN1_F_ASN1_TYPE_GET_INT_OCTETSTRING,
-                    ASN1_R_DATA_IS_WRONG);
-        }
-        M_ASN1_OCTET_STRING_free(os);
-        M_ASN1_INTEGER_free(ai);
-        return (ret);
-}
diff --git a/src/lib/libcrypto/asn1/f_enum.c b/src/lib/libcrypto/asn1/f_enum.c
deleted file mode 100644
index 7f064edb04..0000000000
--- a/src/lib/libcrypto/asn1/f_enum.c
+++ /dev/null
@@ -1,201 +0,0 @@
-/* $OpenBSD: f_enum.c,v 1.14 2014/07/11 08:44:47 jsing Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-
-#include <openssl/asn1.h>
-#include <openssl/buffer.h>
-#include <openssl/err.h>
-
-/* Based on a_int.c: equivalent ENUMERATED functions */
-
-int
-i2a_ASN1_ENUMERATED(BIO *bp, ASN1_ENUMERATED *a)
-{
-        int i, n = 0;
-        static const char h[] = "0123456789ABCDEF";
-        char buf[2];
-
-        if (a == NULL)
-                return (0);
-
-        if (a->length == 0) {
-                if (BIO_write(bp, "00", 2) != 2)
-                        goto err;
-                n = 2;
-        } else {
-                for (i = 0; i < a->length; i++) {
-                        if ((i != 0) && (i % 35 == 0)) {
-                                if (BIO_write(bp, "\\\n", 2) != 2)
-                                        goto err;
-                                n += 2;
-                        }
-                        buf[0] = h[((unsigned char)a->data[i] >> 4) & 0x0f];
-                        buf[1] = h[((unsigned char)a->data[i]) & 0x0f];
-                        if (BIO_write(bp, buf, 2) != 2)
-                                goto err;
-                        n += 2;
-                }
-        }
-        return (n);
-
-err:
-        return (-1);
-}
-
-int
-a2i_ASN1_ENUMERATED(BIO *bp, ASN1_ENUMERATED *bs, char *buf, int size)
-{
-        int ret = 0;
-        int i, j,k, m,n, again, bufsize;
-        unsigned char *s = NULL, *sp;
-        unsigned char *bufp;
-        int first = 1;
-        size_t num = 0, slen = 0;
-
-        bs->type = V_ASN1_ENUMERATED;
-
-        bufsize = BIO_gets(bp, buf, size);
-        for (;;) {
-                if (bufsize < 1)
-                        goto err_sl;
-                i = bufsize;
-                if (buf[i-1] == '\n')
-                        buf[--i] = '\0';
-                if (i == 0)
-                        goto err_sl;
-                if (buf[i-1] == '\r')
-                        buf[--i] = '\0';
-                if (i == 0)
-                        goto err_sl;
-                again = (buf[i - 1] == '\\');
-
-                for (j = 0; j < i; j++) {
-                        if (!(((buf[j] >= '0') && (buf[j] <= '9')) ||
-                            ((buf[j] >= 'a') && (buf[j] <= 'f')) ||
-                            ((buf[j] >= 'A') && (buf[j] <= 'F')))) {
-                                i = j;
-                                break;
-                        }
-                }
-                buf[i] = '\0';
-                /* We have now cleared all the crap off the end of the
-                 * line */
-                if (i < 2)
-                        goto err_sl;
-
-                bufp = (unsigned char *)buf;
-                if (first) {
-                        first = 0;
-                        if ((bufp[0] == '0') && (buf[1] == '0')) {
-                                bufp += 2;
-                                i -= 2;
-                        }
-                }
-                k = 0;
-                i -= again;
-                if (i % 2 != 0) {
-                        ASN1err(ASN1_F_A2I_ASN1_ENUMERATED,
-                            ASN1_R_ODD_NUMBER_OF_CHARS);
-                        goto err;
-                }
-                i /= 2;
-                if (num + i > slen) {
-                        sp = realloc(s, num + i);
-                        if (sp == NULL) {
-                                ASN1err(ASN1_F_A2I_ASN1_ENUMERATED,
-                                    ERR_R_MALLOC_FAILURE);
-                                goto err;
-                        }
-                        s = sp;
-                        slen = num + i;
-                }
-                for (j = 0; j < i; j++, k += 2) {
-                        for (n = 0; n < 2; n++) {
-                                m = bufp[k + n];
-                                if ((m >= '0') && (m <= '9'))
-                                        m -= '0';
-                                else if ((m >= 'a') && (m <= 'f'))
-                                        m = m - 'a' + 10;
-                                else if ((m >= 'A') && (m <= 'F'))
-                                        m = m - 'A' + 10;
-                                else {
-                                        ASN1err(ASN1_F_A2I_ASN1_ENUMERATED,
-                                            ASN1_R_NON_HEX_CHARACTERS);
-                                        goto err;
-                                }
-                                s[num + j] <<= 4;
-                                s[num + j] |= m;
-                        }
-                }
-                num += i;
-                if (again)
-                        bufsize = BIO_gets(bp, buf, size);
-                else
-                        break;
-        }
-        bs->length = num;
-        bs->data = s;
-        return (1);
-
-err_sl:
-        ASN1err(ASN1_F_A2I_ASN1_ENUMERATED, ASN1_R_SHORT_LINE);
-err:
-        free(s);
-        return (ret);
-}
diff --git a/src/lib/libcrypto/asn1/f_int.c b/src/lib/libcrypto/asn1/f_int.c
deleted file mode 100644
index 0ec29f5769..0000000000
--- a/src/lib/libcrypto/asn1/f_int.c
+++ /dev/null
@@ -1,204 +0,0 @@
-/* $OpenBSD: f_int.c,v 1.17 2014/07/11 08:44:47 jsing Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-
-#include <openssl/asn1.h>
-#include <openssl/buffer.h>
-#include <openssl/err.h>
-
-int
-i2a_ASN1_INTEGER(BIO *bp, ASN1_INTEGER *a)
-{
-        int i, n = 0;
-        static const char h[] = "0123456789ABCDEF";
-        char buf[2];
-
-        if (a == NULL)
-                return (0);
-
-        if (a->type & V_ASN1_NEG) {
-                if (BIO_write(bp, "-", 1) != 1)
-                        goto err;
-                n = 1;
-        }
-
-        if (a->length == 0) {
-                if (BIO_write(bp, "00", 2) != 2)
-                        goto err;
-                n += 2;
-        } else {
-                for (i = 0; i < a->length; i++) {
-                        if ((i != 0) && (i % 35 == 0)) {
-                                if (BIO_write(bp, "\\\n", 2) != 2)
-                                        goto err;
-                                n += 2;
-                        }
-                        buf[0] = h[((unsigned char)a->data[i] >> 4) & 0x0f];
-                        buf[1] = h[((unsigned char)a->data[i]) & 0x0f];
-                        if (BIO_write(bp, buf, 2) != 2)
-                                goto err;
-                        n += 2;
-                }
-        }
-        return (n);
-
-err:
-        return (-1);
-}
-
-int
-a2i_ASN1_INTEGER(BIO *bp, ASN1_INTEGER *bs, char *buf, int size)
-{
-        int ret = 0;
-        int i, j,k, m,n, again, bufsize;
-        unsigned char *s = NULL, *sp;
-        unsigned char *bufp;
-        int num = 0, slen = 0, first = 1;
-
-        bs->type = V_ASN1_INTEGER;
-
-        bufsize = BIO_gets(bp, buf, size);
-        for (;;) {
-                if (bufsize < 1)
-                        goto err_sl;
-                i = bufsize;
-                if (buf[i - 1] == '\n')
-                        buf[--i] = '\0';
-                if (i == 0)
-                        goto err_sl;
-                if (buf[i - 1] == '\r')
-                        buf[--i] = '\0';
-                if (i == 0)
-                        goto err_sl;
-                again = (buf[i - 1] == '\\');
-
-                for (j = 0; j < i; j++) {
-                        if (!(((buf[j] >= '0') && (buf[j] <= '9')) ||
-                            ((buf[j] >= 'a') && (buf[j] <= 'f')) ||
-                            ((buf[j] >= 'A') && (buf[j] <= 'F')))) {
-                                i = j;
-                                break;
-                        }
-                }
-                buf[i] = '\0';
-                /* We have now cleared all the crap off the end of the
-                 * line */
-                if (i < 2)
-                        goto err_sl;
-
-                bufp = (unsigned char *)buf;
-                if (first) {
-                        first = 0;
-                        if ((bufp[0] == '0') && (buf[1] == '0')) {
-                                bufp += 2;
-                                i -= 2;
-                        }
-                }
-                k = 0;
-                i -= again;
-                if (i % 2 != 0) {
-                        ASN1err(ASN1_F_A2I_ASN1_INTEGER,
-                            ASN1_R_ODD_NUMBER_OF_CHARS);
-                        goto err;
-                }
-                i /= 2;
-                if (num + i > slen) {
-                        sp = OPENSSL_realloc_clean(s, slen, num + i);
-                        if (sp == NULL) {
-                                ASN1err(ASN1_F_A2I_ASN1_INTEGER,
-                                    ERR_R_MALLOC_FAILURE);
-                                goto err;
-                        }
-                        s = sp;
-                        slen = num + i;
-                }
-                for (j = 0; j < i; j++, k += 2) {
-                        for (n = 0; n < 2; n++) {
-                                m = bufp[k + n];
-                                if ((m >= '0') && (m <= '9'))
-                                        m -= '0';
-                                else if ((m >= 'a') && (m <= 'f'))
-                                        m = m - 'a' + 10;
-                                else if ((m >= 'A') && (m <= 'F'))
-                                        m = m - 'A' + 10;
-                                else {
-                                        ASN1err(ASN1_F_A2I_ASN1_INTEGER,
-                                            ASN1_R_NON_HEX_CHARACTERS);
-                                        goto err;
-                                }
-                                s[num + j] <<= 4;
-                                s[num + j] |= m;
-                        }
-                }
-                num += i;
-                if (again)
-                        bufsize = BIO_gets(bp, buf, size);
-                else
-                        break;
-        }
-        bs->length = num;
-        bs->data = s;
-        return (1);
-
-err_sl:
-        ASN1err(ASN1_F_A2I_ASN1_INTEGER, ASN1_R_SHORT_LINE);
-err:
-        free(s);
-        return (ret);
-}
diff --git a/src/lib/libcrypto/asn1/f_string.c b/src/lib/libcrypto/asn1/f_string.c
deleted file mode 100644
index 14cd1a906a..0000000000
--- a/src/lib/libcrypto/asn1/f_string.c
+++ /dev/null
@@ -1,197 +0,0 @@
-/* $OpenBSD: f_string.c,v 1.16 2014/07/11 08:44:47 jsing Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-
-#include <openssl/asn1.h>
-#include <openssl/buffer.h>
-#include <openssl/err.h>
-
-int
-i2a_ASN1_STRING(BIO *bp, ASN1_STRING *a, int type)
-{
-        int i, n = 0;
-        static const char h[] = "0123456789ABCDEF";
-        char buf[2];
-
-        if (a == NULL)
-                return (0);
-
-        if (a->length == 0) {
-                if (BIO_write(bp, "0", 1) != 1)
-                        goto err;
-                n = 1;
-        } else {
-                for (i = 0; i < a->length; i++) {
-                        if ((i != 0) && (i % 35 == 0)) {
-                                if (BIO_write(bp, "\\\n", 2) != 2)
-                                        goto err;
-                                n += 2;
-                        }
-                        buf[0] = h[((unsigned char)a->data[i] >> 4) & 0x0f];
-                        buf[1] = h[((unsigned char)a->data[i]) & 0x0f];
-                        if (BIO_write(bp, buf, 2) != 2)
-                                goto err;
-                        n += 2;
-                }
-        }
-        return (n);
-
-err:
-        return (-1);
-}
-
-int
-a2i_ASN1_STRING(BIO *bp, ASN1_STRING *bs, char *buf, int size)
-{
-        int ret = 0;
-        int i, j, k, m, n, again, bufsize;
-        unsigned char *s = NULL, *sp;
-        unsigned char *bufp;
-        int first = 1;
-        size_t num = 0, slen = 0;
-
-        bufsize = BIO_gets(bp, buf, size);
-        for (;;) {
-                if (bufsize < 1) {
-                        if (first)
-                                break;
-                        else
-                                goto err_sl;
-                }
-                first = 0;
-
-                i = bufsize;
-                if (buf[i-1] == '\n')
-                        buf[--i] = '\0';
-                if (i == 0)
-                        goto err_sl;
-                if (buf[i-1] == '\r')
-                        buf[--i] = '\0';
-                if (i == 0)
-                        goto err_sl;
-                again = (buf[i - 1] == '\\');
-
-                for (j = i - 1; j > 0; j--) {
-                        if (!(((buf[j] >= '0') && (buf[j] <= '9')) ||
-                            ((buf[j] >= 'a') && (buf[j] <= 'f')) ||
-                            ((buf[j] >= 'A') && (buf[j] <= 'F')))) {
-                                i = j;
-                                break;
-                        }
-                }
-                buf[i] = '\0';
-                /* We have now cleared all the crap off the end of the
-                 * line */
-                if (i < 2)
-                        goto err_sl;
-
-                bufp = (unsigned char *)buf;
-
-                k = 0;
-                i -= again;
-                if (i % 2 != 0) {
-                        ASN1err(ASN1_F_A2I_ASN1_STRING,
-                            ASN1_R_ODD_NUMBER_OF_CHARS);
-                        goto err;
-                }
-                i /= 2;
-                if (num + i > slen) {
-                        sp = realloc(s, num + i);
-                        if (sp == NULL) {
-                                ASN1err(ASN1_F_A2I_ASN1_STRING,
-                                    ERR_R_MALLOC_FAILURE);
-                                goto err;
-                        }
-                        s = sp;
-                        slen = num + i;
-                }
-                for (j = 0; j < i; j++, k += 2) {
-                        for (n = 0; n < 2; n++) {
-                                m = bufp[k + n];
-                                if ((m >= '0') && (m <= '9'))
-                                        m -= '0';
-                                else if ((m >= 'a') && (m <= 'f'))
-                                        m = m - 'a' + 10;
-                                else if ((m >= 'A') && (m <= 'F'))
-                                        m = m - 'A' + 10;
-                                else {
-                                        ASN1err(ASN1_F_A2I_ASN1_STRING,
-                                            ASN1_R_NON_HEX_CHARACTERS);
-                                        goto err;
-                                }
-                                s[num + j] <<= 4;
-                                s[num + j] |= m;
-                        }
-                }
-                num += i;
-                if (again)
-                        bufsize = BIO_gets(bp, buf, size);
-                else
-                        break;
-        }
-        bs->length = num;
-        bs->data = s;
-        return (1);
-
-err_sl:
-        ASN1err(ASN1_F_A2I_ASN1_STRING, ASN1_R_SHORT_LINE);
-err:
-        free(s);
-        return (ret);
-}
diff --git a/src/lib/libcrypto/asn1/i2d_pr.c b/src/lib/libcrypto/asn1/i2d_pr.c
deleted file mode 100644
index 5fa34678b6..0000000000
--- a/src/lib/libcrypto/asn1/i2d_pr.c
+++ /dev/null
@@ -1,81 +0,0 @@
-/* $OpenBSD: i2d_pr.c,v 1.10 2014/07/11 08:44:47 jsing Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-
-#include <openssl/err.h>
-#include <openssl/evp.h>
-#include <openssl/x509.h>
-
-#include "asn1_locl.h"
-
-int
-i2d_PrivateKey(EVP_PKEY *a, unsigned char **pp)
-{
-        if (a->ameth && a->ameth->old_priv_encode) {
-                return a->ameth->old_priv_encode(a, pp);
-        }
-        if (a->ameth && a->ameth->priv_encode) {
-                PKCS8_PRIV_KEY_INFO *p8 = EVP_PKEY2PKCS8(a);
-                int ret = i2d_PKCS8_PRIV_KEY_INFO(p8, pp);
-                PKCS8_PRIV_KEY_INFO_free(p8);
-                return ret;
-        }
-        ASN1err(ASN1_F_I2D_PRIVATEKEY, ASN1_R_UNSUPPORTED_PUBLIC_KEY_TYPE);
-        return (-1);
-}
diff --git a/src/lib/libcrypto/asn1/i2d_pu.c b/src/lib/libcrypto/asn1/i2d_pu.c
deleted file mode 100644
index 6e485ea325..0000000000
--- a/src/lib/libcrypto/asn1/i2d_pu.c
+++ /dev/null
@@ -1,98 +0,0 @@
-/* $OpenBSD: i2d_pu.c,v 1.10 2014/07/11 08:44:47 jsing Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-
-#include <openssl/opensslconf.h>
-
-#include <openssl/bn.h>
-#include <openssl/err.h>
-#include <openssl/evp.h>
-#include <openssl/objects.h>
-
-#ifndef OPENSSL_NO_DSA
-#include <openssl/dsa.h>
-#endif
-#ifndef OPENSSL_NO_EC
-#include <openssl/ec.h>
-#endif
-#ifndef OPENSSL_NO_RSA
-#include <openssl/rsa.h>
-#endif
-
-int
-i2d_PublicKey(EVP_PKEY *a, unsigned char **pp)
-{
-        switch (a->type) {
-#ifndef OPENSSL_NO_RSA
-        case EVP_PKEY_RSA:
-                return (i2d_RSAPublicKey(a->pkey.rsa, pp));
-#endif
-#ifndef OPENSSL_NO_DSA
-        case EVP_PKEY_DSA:
-                return (i2d_DSAPublicKey(a->pkey.dsa, pp));
-#endif
-#ifndef OPENSSL_NO_EC
-        case EVP_PKEY_EC:
-                return (i2o_ECPublicKey(a->pkey.ec, pp));
-#endif
-        default:
-                ASN1err(ASN1_F_I2D_PUBLICKEY, ASN1_R_UNSUPPORTED_PUBLIC_KEY_TYPE);
-                return (-1);
-        }
-}
diff --git a/src/lib/libcrypto/asn1/n_pkey.c b/src/lib/libcrypto/asn1/n_pkey.c
deleted file mode 100644
index d3a7431356..0000000000
--- a/src/lib/libcrypto/asn1/n_pkey.c
+++ /dev/null
@@ -1,430 +0,0 @@
-/* $OpenBSD: n_pkey.c,v 1.26 2015/03/19 14:00:22 tedu Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-#include <string.h>
-
-#include <openssl/opensslconf.h>
-
-#ifndef OPENSSL_NO_RSA
-#include <openssl/asn1t.h>
-#include <openssl/err.h>
-#include <openssl/evp.h>
-#include <openssl/objects.h>
-#include <openssl/rsa.h>
-#include <openssl/x509.h>
-
-#ifndef OPENSSL_NO_RC4
-
-typedef struct netscape_pkey_st {
-        long version;
-        X509_ALGOR *algor;
-        ASN1_OCTET_STRING *private_key;
-} NETSCAPE_PKEY;
-
-typedef struct netscape_encrypted_pkey_st {
-        ASN1_OCTET_STRING *os;
-        /* This is the same structure as DigestInfo so use it:
-         * although this isn't really anything to do with
-         * digests.
-         */
-        X509_SIG *enckey;
-} NETSCAPE_ENCRYPTED_PKEY;
-
-
-static const ASN1_AUX NETSCAPE_ENCRYPTED_PKEY_aux = {
-        .flags = ASN1_AFLG_BROKEN,
-};
-static const ASN1_TEMPLATE NETSCAPE_ENCRYPTED_PKEY_seq_tt[] = {
-        {
-                .offset = offsetof(NETSCAPE_ENCRYPTED_PKEY, os),
-                .field_name = "os",
-                .item = &ASN1_OCTET_STRING_it,
-        },
-        {
-                .offset = offsetof(NETSCAPE_ENCRYPTED_PKEY, enckey),
-                .field_name = "enckey",
-                .item = &X509_SIG_it,
-        },
-};
-
-const ASN1_ITEM NETSCAPE_ENCRYPTED_PKEY_it = {
-        .itype = ASN1_ITYPE_SEQUENCE,
-        .utype = V_ASN1_SEQUENCE,
-        .templates = NETSCAPE_ENCRYPTED_PKEY_seq_tt,
-        .tcount = sizeof(NETSCAPE_ENCRYPTED_PKEY_seq_tt) / sizeof(ASN1_TEMPLATE),
-        .funcs = &NETSCAPE_ENCRYPTED_PKEY_aux,
-        .size = sizeof(NETSCAPE_ENCRYPTED_PKEY),
-        .sname = "NETSCAPE_ENCRYPTED_PKEY",
-};
-
-DECLARE_ASN1_FUNCTIONS_const(NETSCAPE_ENCRYPTED_PKEY)
-DECLARE_ASN1_ENCODE_FUNCTIONS_const(NETSCAPE_ENCRYPTED_PKEY, NETSCAPE_ENCRYPTED_PKEY)
-
-NETSCAPE_ENCRYPTED_PKEY *
-d2i_NETSCAPE_ENCRYPTED_PKEY(NETSCAPE_ENCRYPTED_PKEY **a, const unsigned char **in, long len)
-{
-        return (NETSCAPE_ENCRYPTED_PKEY *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &NETSCAPE_ENCRYPTED_PKEY_it);
-}
-
-int
-i2d_NETSCAPE_ENCRYPTED_PKEY(const NETSCAPE_ENCRYPTED_PKEY *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &NETSCAPE_ENCRYPTED_PKEY_it);
-}
-
-NETSCAPE_ENCRYPTED_PKEY *
-NETSCAPE_ENCRYPTED_PKEY_new(void)
-{
-        return (NETSCAPE_ENCRYPTED_PKEY *)ASN1_item_new(&NETSCAPE_ENCRYPTED_PKEY_it);
-}
-
-void
-NETSCAPE_ENCRYPTED_PKEY_free(NETSCAPE_ENCRYPTED_PKEY *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &NETSCAPE_ENCRYPTED_PKEY_it);
-}
-
-static const ASN1_TEMPLATE NETSCAPE_PKEY_seq_tt[] = {
-        {
-                .offset = offsetof(NETSCAPE_PKEY, version),
-                .field_name = "version",
-                .item = &LONG_it,
-        },
-        {
-                .offset = offsetof(NETSCAPE_PKEY, algor),
-                .field_name = "algor",
-                .item = &X509_ALGOR_it,
-        },
-        {
-                .offset = offsetof(NETSCAPE_PKEY, private_key),
-                .field_name = "private_key",
-                .item = &ASN1_OCTET_STRING_it,
-        },
-};
-
-const ASN1_ITEM NETSCAPE_PKEY_it = {
-        .itype = ASN1_ITYPE_SEQUENCE,
-        .utype = V_ASN1_SEQUENCE,
-        .templates = NETSCAPE_PKEY_seq_tt,
-        .tcount = sizeof(NETSCAPE_PKEY_seq_tt) / sizeof(ASN1_TEMPLATE),
-        .size = sizeof(NETSCAPE_PKEY),
-        .sname = "NETSCAPE_PKEY",
-};
-
-DECLARE_ASN1_FUNCTIONS_const(NETSCAPE_PKEY)
-DECLARE_ASN1_ENCODE_FUNCTIONS_const(NETSCAPE_PKEY, NETSCAPE_PKEY)
-
-NETSCAPE_PKEY *
-d2i_NETSCAPE_PKEY(NETSCAPE_PKEY **a, const unsigned char **in, long len)
-{
-        return (NETSCAPE_PKEY *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &NETSCAPE_PKEY_it);
-}
-
-int
-i2d_NETSCAPE_PKEY(const NETSCAPE_PKEY *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &NETSCAPE_PKEY_it);
-}
-
-NETSCAPE_PKEY *
-NETSCAPE_PKEY_new(void)
-{
-        return (NETSCAPE_PKEY *)ASN1_item_new(&NETSCAPE_PKEY_it);
-}
-
-void
-NETSCAPE_PKEY_free(NETSCAPE_PKEY *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &NETSCAPE_PKEY_it);
-}
-
-static RSA *d2i_RSA_NET_2(RSA **a, ASN1_OCTET_STRING *os,
-    int (*cb)(char *buf, int len, const char *prompt, int verify), int sgckey);
-
-int
-i2d_Netscape_RSA(const RSA *a, unsigned char **pp,
-    int (*cb)(char *buf, int len, const char *prompt, int verify))
-{
-        return i2d_RSA_NET(a, pp, cb, 0);
-}
-
-int
-i2d_RSA_NET(const RSA *a, unsigned char **pp,
-    int (*cb)(char *buf, int len, const char *prompt, int verify), int sgckey)
-{
-        int i, j, ret = 0;
-        int rsalen, pkeylen, olen;
-        NETSCAPE_PKEY *pkey = NULL;
-        NETSCAPE_ENCRYPTED_PKEY *enckey = NULL;
-        unsigned char buf[256], *zz;
-        unsigned char key[EVP_MAX_KEY_LENGTH];
-        EVP_CIPHER_CTX ctx;
-        EVP_CIPHER_CTX_init(&ctx);
-
-        if (a == NULL)
-                return (0);
-
-        if ((pkey = NETSCAPE_PKEY_new()) == NULL)
-                goto err;
-        if ((enckey = NETSCAPE_ENCRYPTED_PKEY_new()) == NULL)
-                goto err;
-        pkey->version = 0;
-
-        pkey->algor->algorithm = OBJ_nid2obj(NID_rsaEncryption);
-        if ((pkey->algor->parameter = ASN1_TYPE_new()) == NULL)
-                goto err;
-        pkey->algor->parameter->type = V_ASN1_NULL;
-
-        rsalen = i2d_RSAPrivateKey(a, NULL);
-
-        /* Fake some octet strings just for the initial length
-         * calculation.
-         */
-        pkey->private_key->length = rsalen;
-        pkeylen = i2d_NETSCAPE_PKEY(pkey, NULL);
-        enckey->enckey->digest->length = pkeylen;
-        enckey->os->length = 11;        /* "private-key" */
-        enckey->enckey->algor->algorithm = OBJ_nid2obj(NID_rc4);
-        if ((enckey->enckey->algor->parameter = ASN1_TYPE_new()) == NULL)
-                goto err;
-        enckey->enckey->algor->parameter->type = V_ASN1_NULL;
-
-        if (pp == NULL) {
-                olen = i2d_NETSCAPE_ENCRYPTED_PKEY(enckey, NULL);
-                NETSCAPE_PKEY_free(pkey);
-                NETSCAPE_ENCRYPTED_PKEY_free(enckey);
-                return olen;
-        }
-
-        /* Since its RC4 encrypted length is actual length */
-        if ((zz = malloc(rsalen)) == NULL) {
-                ASN1err(ASN1_F_I2D_RSA_NET, ERR_R_MALLOC_FAILURE);
-                goto err;
-        }
-
-        pkey->private_key->data = zz;
-        /* Write out private key encoding */
-        i2d_RSAPrivateKey(a, &zz);
-
-        if ((zz = malloc(pkeylen)) == NULL) {
-                ASN1err(ASN1_F_I2D_RSA_NET, ERR_R_MALLOC_FAILURE);
-                goto err;
-        }
-
-        if (!ASN1_STRING_set(enckey->os, "private-key", -1)) {
-                ASN1err(ASN1_F_I2D_RSA_NET, ERR_R_MALLOC_FAILURE);
-                goto err;
-        }
-        enckey->enckey->digest->data = zz;
-        i2d_NETSCAPE_PKEY(pkey, &zz);
-
-        /* Wipe the private key encoding */
-        OPENSSL_cleanse(pkey->private_key->data, rsalen);
-
-        if (cb == NULL)
-                cb = EVP_read_pw_string;
-        i = cb((char *)buf, sizeof(buf), "Enter Private Key password:", 1);
-        if (i != 0) {
-                ASN1err(ASN1_F_I2D_RSA_NET, ASN1_R_BAD_PASSWORD_READ);
-                goto err;
-        }
-        i = strlen((char *)buf);
-        /* If the key is used for SGC the algorithm is modified a little. */
-        if (sgckey) {
-                if (!EVP_Digest(buf, i, buf, NULL, EVP_md5(), NULL))
-                        goto err;
-                memcpy(buf + 16, "SGCKEYSALT", 10);
-                i = 26;
-        }
-
-        if (!EVP_BytesToKey(EVP_rc4(), EVP_md5(), NULL, buf, i,1, key, NULL))
-                goto err;
-        OPENSSL_cleanse(buf, sizeof(buf));
-
-        /* Encrypt private key in place */
-        zz = enckey->enckey->digest->data;
-        if (!EVP_EncryptInit_ex(&ctx, EVP_rc4(), NULL, key, NULL))
-                goto err;
-        if (!EVP_EncryptUpdate(&ctx, zz, &i, zz, pkeylen))
-                goto err;
-        if (!EVP_EncryptFinal_ex(&ctx, zz + i, &j))
-                goto err;
-
-        ret = i2d_NETSCAPE_ENCRYPTED_PKEY(enckey, pp);
-err:
-        EVP_CIPHER_CTX_cleanup(&ctx);
-        NETSCAPE_ENCRYPTED_PKEY_free(enckey);
-        NETSCAPE_PKEY_free(pkey);
-        return (ret);
-}
-
-
-RSA *
-d2i_Netscape_RSA(RSA **a, const unsigned char **pp, long length,
-    int (*cb)(char *buf, int len, const char *prompt, int verify))
-{
-        return d2i_RSA_NET(a, pp, length, cb, 0);
-}
-
-RSA *
-d2i_RSA_NET(RSA **a, const unsigned char **pp, long length,
-    int (*cb)(char *buf, int len, const char *prompt, int verify), int sgckey)
-{
-        RSA *ret = NULL;
-        const unsigned char *p;
-        NETSCAPE_ENCRYPTED_PKEY *enckey = NULL;
-
-        p = *pp;
-
-        enckey = d2i_NETSCAPE_ENCRYPTED_PKEY(NULL, &p, length);
-        if (!enckey) {
-                ASN1err(ASN1_F_D2I_RSA_NET, ASN1_R_DECODING_ERROR);
-                return NULL;
-        }
-
-        /* XXX 11 == strlen("private-key") */
-        if (enckey->os->length != 11 ||
-            memcmp("private-key", enckey->os->data, 11) != 0) {
-                ASN1err(ASN1_F_D2I_RSA_NET, ASN1_R_PRIVATE_KEY_HEADER_MISSING);
-                goto err;
-        }
-        if (OBJ_obj2nid(enckey->enckey->algor->algorithm) != NID_rc4) {
-                ASN1err(ASN1_F_D2I_RSA_NET,
-                    ASN1_R_UNSUPPORTED_ENCRYPTION_ALGORITHM);
-                goto err;
-        }
-        if (cb == NULL)
-                cb = EVP_read_pw_string;
-        if ((ret = d2i_RSA_NET_2(a, enckey->enckey->digest, cb,
-            sgckey)) == NULL)
-                goto err;
-
-        *pp = p;
-
-err:
-        NETSCAPE_ENCRYPTED_PKEY_free(enckey);
-        return ret;
-
-}
-
-static RSA *
-d2i_RSA_NET_2(RSA **a, ASN1_OCTET_STRING *os,
-    int (*cb)(char *buf, int len, const char *prompt, int verify), int sgckey)
-{
-        NETSCAPE_PKEY *pkey = NULL;
-        RSA *ret = NULL;
-        int i, j;
-        unsigned char buf[256];
-        const unsigned char *zz;
-        unsigned char key[EVP_MAX_KEY_LENGTH];
-        EVP_CIPHER_CTX ctx;
-        EVP_CIPHER_CTX_init(&ctx);
-
-        i=cb((char *)buf, sizeof(buf), "Enter Private Key password:",0);
-        if (i != 0) {
-                ASN1err(ASN1_F_D2I_RSA_NET_2, ASN1_R_BAD_PASSWORD_READ);
-                goto err;
-        }
-
-        i = strlen((char *)buf);
-        if (sgckey){
-                if (!EVP_Digest(buf, i, buf, NULL, EVP_md5(), NULL))
-                        goto err;
-                memcpy(buf + 16, "SGCKEYSALT", 10);
-                i = 26;
-        }
-
-        if (!EVP_BytesToKey(EVP_rc4(), EVP_md5(), NULL, buf, i,1, key, NULL))
-                goto err;
-        OPENSSL_cleanse(buf, sizeof(buf));
-
-        if (!EVP_DecryptInit_ex(&ctx, EVP_rc4(), NULL, key, NULL))
-                goto err;
-        if (!EVP_DecryptUpdate(&ctx, os->data, &i, os->data, os->length))
-                goto err;
-        if (!EVP_DecryptFinal_ex(&ctx, &(os->data[i]), &j))
-                goto err;
-        os->length = i + j;
-
-        zz = os->data;
-
-        if ((pkey = d2i_NETSCAPE_PKEY(NULL, &zz, os->length)) == NULL) {
-                ASN1err(ASN1_F_D2I_RSA_NET_2,
-                    ASN1_R_UNABLE_TO_DECODE_RSA_PRIVATE_KEY);
-                goto err;
-        }
-
-        zz = pkey->private_key->data;
-        if ((ret = d2i_RSAPrivateKey(a, &zz,
-            pkey->private_key->length)) == NULL) {
-                ASN1err(ASN1_F_D2I_RSA_NET_2, ASN1_R_UNABLE_TO_DECODE_RSA_KEY);
-                goto err;
-        }
-
-err:
-        EVP_CIPHER_CTX_cleanup(&ctx);
-        NETSCAPE_PKEY_free(pkey);
-        return (ret);
-}
-
-#endif /* OPENSSL_NO_RC4 */
-
-#endif
diff --git a/src/lib/libcrypto/asn1/nsseq.c b/src/lib/libcrypto/asn1/nsseq.c
deleted file mode 100644
index 8b39278692..0000000000
--- a/src/lib/libcrypto/asn1/nsseq.c
+++ /dev/null
@@ -1,129 +0,0 @@
-/* $OpenBSD: nsseq.c,v 1.10 2015/02/11 04:00:39 jsing Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 1999.
- */
-/* ====================================================================
- * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <openssl/asn1t.h>
-#include <openssl/x509.h>
-#include <openssl/objects.h>
-
-static int
-nsseq_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it, void *exarg)
-{
-        if (operation == ASN1_OP_NEW_POST) {
-                NETSCAPE_CERT_SEQUENCE *nsseq;
-                nsseq = (NETSCAPE_CERT_SEQUENCE *)*pval;
-                nsseq->type = OBJ_nid2obj(NID_netscape_cert_sequence);
-        }
-        return 1;
-}
-
-/* Netscape certificate sequence structure */
-
-static const ASN1_AUX NETSCAPE_CERT_SEQUENCE_aux = {
-        .asn1_cb = nsseq_cb,
-};
-static const ASN1_TEMPLATE NETSCAPE_CERT_SEQUENCE_seq_tt[] = {
-        {
-                .offset = offsetof(NETSCAPE_CERT_SEQUENCE, type),
-                .field_name = "type",
-                .item = &ASN1_OBJECT_it,
-        },
-        {
-                .flags = ASN1_TFLG_EXPLICIT | ASN1_TFLG_SEQUENCE_OF | ASN1_TFLG_OPTIONAL,
-                .offset = offsetof(NETSCAPE_CERT_SEQUENCE, certs),
-                .field_name = "certs",
-                .item = &X509_it,
-        },
-};
-
-const ASN1_ITEM NETSCAPE_CERT_SEQUENCE_it = {
-        .itype = ASN1_ITYPE_SEQUENCE,
-        .utype = V_ASN1_SEQUENCE,
-        .templates = NETSCAPE_CERT_SEQUENCE_seq_tt,
-        .tcount = sizeof(NETSCAPE_CERT_SEQUENCE_seq_tt) / sizeof(ASN1_TEMPLATE),
-        .funcs = &NETSCAPE_CERT_SEQUENCE_aux,
-        .size = sizeof(NETSCAPE_CERT_SEQUENCE),
-        .sname = "NETSCAPE_CERT_SEQUENCE",
-};
-
-
-NETSCAPE_CERT_SEQUENCE *
-d2i_NETSCAPE_CERT_SEQUENCE(NETSCAPE_CERT_SEQUENCE **a, const unsigned char **in, long len)
-{
-        return (NETSCAPE_CERT_SEQUENCE *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &NETSCAPE_CERT_SEQUENCE_it);
-}
-
-int
-i2d_NETSCAPE_CERT_SEQUENCE(NETSCAPE_CERT_SEQUENCE *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &NETSCAPE_CERT_SEQUENCE_it);
-}
-
-NETSCAPE_CERT_SEQUENCE *
-NETSCAPE_CERT_SEQUENCE_new(void)
-{
-        return (NETSCAPE_CERT_SEQUENCE *)ASN1_item_new(&NETSCAPE_CERT_SEQUENCE_it);
-}
-
-void
-NETSCAPE_CERT_SEQUENCE_free(NETSCAPE_CERT_SEQUENCE *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &NETSCAPE_CERT_SEQUENCE_it);
-}
diff --git a/src/lib/libcrypto/asn1/p5_pbe.c b/src/lib/libcrypto/asn1/p5_pbe.c
deleted file mode 100644
index 3e7057bb24..0000000000
--- a/src/lib/libcrypto/asn1/p5_pbe.c
+++ /dev/null
@@ -1,186 +0,0 @@
-/* $OpenBSD: p5_pbe.c,v 1.20 2015/02/11 04:00:39 jsing Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 1999.
- */
-/* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-#include <openssl/asn1t.h>
-#include <openssl/err.h>
-#include <openssl/x509.h>
-
-/* PKCS#5 password based encryption structure */
-
-static const ASN1_TEMPLATE PBEPARAM_seq_tt[] = {
-        {
-                .offset = offsetof(PBEPARAM, salt),
-                .field_name = "salt",
-                .item = &ASN1_OCTET_STRING_it,
-        },
-        {
-                .offset = offsetof(PBEPARAM, iter),
-                .field_name = "iter",
-                .item = &ASN1_INTEGER_it,
-        },
-};
-
-const ASN1_ITEM PBEPARAM_it = {
-        .itype = ASN1_ITYPE_SEQUENCE,
-        .utype = V_ASN1_SEQUENCE,
-        .templates = PBEPARAM_seq_tt,
-        .tcount = sizeof(PBEPARAM_seq_tt) / sizeof(ASN1_TEMPLATE),
-        .size = sizeof(PBEPARAM),
-        .sname = "PBEPARAM",
-};
-
-
-PBEPARAM *
-d2i_PBEPARAM(PBEPARAM **a, const unsigned char **in, long len)
-{
-        return (PBEPARAM *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &PBEPARAM_it);
-}
-
-int
-i2d_PBEPARAM(PBEPARAM *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &PBEPARAM_it);
-}
-
-PBEPARAM *
-PBEPARAM_new(void)
-{
-        return (PBEPARAM *)ASN1_item_new(&PBEPARAM_it);
-}
-
-void
-PBEPARAM_free(PBEPARAM *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &PBEPARAM_it);
-}
-
-
-/* Set an algorithm identifier for a PKCS#5 PBE algorithm */
-
-int
-PKCS5_pbe_set0_algor(X509_ALGOR *algor, int alg, int iter,
-    const unsigned char *salt, int saltlen)
-{
-        PBEPARAM *pbe = NULL;
-        ASN1_STRING *pbe_str = NULL;
-        unsigned char *sstr;
-
-        pbe = PBEPARAM_new();
-        if (!pbe) {
-                ASN1err(ASN1_F_PKCS5_PBE_SET0_ALGOR, ERR_R_MALLOC_FAILURE);
-                goto err;
-        }
-        if (iter <= 0)
-                iter = PKCS5_DEFAULT_ITER;
-        if (!ASN1_INTEGER_set(pbe->iter, iter)) {
-                ASN1err(ASN1_F_PKCS5_PBE_SET0_ALGOR, ERR_R_MALLOC_FAILURE);
-                goto err;
-        }
-        if (!saltlen)
-                saltlen = PKCS5_SALT_LEN;
-        if (!ASN1_STRING_set(pbe->salt, NULL, saltlen)) {
-                ASN1err(ASN1_F_PKCS5_PBE_SET0_ALGOR, ERR_R_MALLOC_FAILURE);
-                goto err;
-        }
-        sstr = ASN1_STRING_data(pbe->salt);
-        if (salt)
-                memcpy(sstr, salt, saltlen);
-        else
-                arc4random_buf(sstr, saltlen);
-
-        if (!ASN1_item_pack(pbe, ASN1_ITEM_rptr(PBEPARAM), &pbe_str)) {
-                ASN1err(ASN1_F_PKCS5_PBE_SET0_ALGOR, ERR_R_MALLOC_FAILURE);
-                goto err;
-        }
-
-        PBEPARAM_free(pbe);
-        pbe = NULL;
-
-        if (X509_ALGOR_set0(algor, OBJ_nid2obj(alg), V_ASN1_SEQUENCE, pbe_str))
-                return 1;
-
-err:
-        if (pbe != NULL)
-                PBEPARAM_free(pbe);
-        ASN1_STRING_free(pbe_str);
-        return 0;
-}
-
-/* Return an algorithm identifier for a PKCS#5 PBE algorithm */
-
-X509_ALGOR *
-PKCS5_pbe_set(int alg, int iter, const unsigned char *salt, int saltlen)
-{
-        X509_ALGOR *ret;
-        ret = X509_ALGOR_new();
-        if (!ret) {
-                ASN1err(ASN1_F_PKCS5_PBE_SET, ERR_R_MALLOC_FAILURE);
-                return NULL;
-        }
-
-        if (PKCS5_pbe_set0_algor(ret, alg, iter, salt, saltlen))
-                return ret;
-
-        X509_ALGOR_free(ret);
-        return NULL;
-}
diff --git a/src/lib/libcrypto/asn1/p5_pbev2.c b/src/lib/libcrypto/asn1/p5_pbev2.c
deleted file mode 100644
index 795721fad2..0000000000
--- a/src/lib/libcrypto/asn1/p5_pbev2.c
+++ /dev/null
@@ -1,374 +0,0 @@
-/* $OpenBSD: p5_pbev2.c,v 1.21 2015/02/11 04:00:39 jsing Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 1999-2004.
- */
-/* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-
-#include <openssl/asn1t.h>
-#include <openssl/err.h>
-#include <openssl/x509.h>
-
-/* PKCS#5 v2.0 password based encryption structures */
-
-static const ASN1_TEMPLATE PBE2PARAM_seq_tt[] = {
-        {
-                .offset = offsetof(PBE2PARAM, keyfunc),
-                .field_name = "keyfunc",
-                .item = &X509_ALGOR_it,
-        },
-        {
-                .offset = offsetof(PBE2PARAM, encryption),
-                .field_name = "encryption",
-                .item = &X509_ALGOR_it,
-        },
-};
-
-const ASN1_ITEM PBE2PARAM_it = {
-        .itype = ASN1_ITYPE_SEQUENCE,
-        .utype = V_ASN1_SEQUENCE,
-        .templates = PBE2PARAM_seq_tt,
-        .tcount = sizeof(PBE2PARAM_seq_tt) / sizeof(ASN1_TEMPLATE),
-        .size = sizeof(PBE2PARAM),
-        .sname = "PBE2PARAM",
-};
-
-
-PBE2PARAM *
-d2i_PBE2PARAM(PBE2PARAM **a, const unsigned char **in, long len)
-{
-        return (PBE2PARAM *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &PBE2PARAM_it);
-}
-
-int
-i2d_PBE2PARAM(PBE2PARAM *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &PBE2PARAM_it);
-}
-
-PBE2PARAM *
-PBE2PARAM_new(void)
-{
-        return (PBE2PARAM *)ASN1_item_new(&PBE2PARAM_it);
-}
-
-void
-PBE2PARAM_free(PBE2PARAM *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &PBE2PARAM_it);
-}
-
-static const ASN1_TEMPLATE PBKDF2PARAM_seq_tt[] = {
-        {
-                .offset = offsetof(PBKDF2PARAM, salt),
-                .field_name = "salt",
-                .item = &ASN1_ANY_it,
-        },
-        {
-                .offset = offsetof(PBKDF2PARAM, iter),
-                .field_name = "iter",
-                .item = &ASN1_INTEGER_it,
-        },
-        {
-                .flags = ASN1_TFLG_OPTIONAL,
-                .offset = offsetof(PBKDF2PARAM, keylength),
-                .field_name = "keylength",
-                .item = &ASN1_INTEGER_it,
-        },
-        {
-                .flags = ASN1_TFLG_OPTIONAL,
-                .offset = offsetof(PBKDF2PARAM, prf),
-                .field_name = "prf",
-                .item = &X509_ALGOR_it,
-        },
-};
-
-const ASN1_ITEM PBKDF2PARAM_it = {
-        .itype = ASN1_ITYPE_SEQUENCE,
-        .utype = V_ASN1_SEQUENCE,
-        .templates = PBKDF2PARAM_seq_tt,
-        .tcount = sizeof(PBKDF2PARAM_seq_tt) / sizeof(ASN1_TEMPLATE),
-        .size = sizeof(PBKDF2PARAM),
-        .sname = "PBKDF2PARAM",
-};
-
-
-PBKDF2PARAM *
-d2i_PBKDF2PARAM(PBKDF2PARAM **a, const unsigned char **in, long len)
-{
-        return (PBKDF2PARAM *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &PBKDF2PARAM_it);
-}
-
-int
-i2d_PBKDF2PARAM(PBKDF2PARAM *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &PBKDF2PARAM_it);
-}
-
-PBKDF2PARAM *
-PBKDF2PARAM_new(void)
-{
-        return (PBKDF2PARAM *)ASN1_item_new(&PBKDF2PARAM_it);
-}
-
-void
-PBKDF2PARAM_free(PBKDF2PARAM *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &PBKDF2PARAM_it);
-}
-
-/* Return an algorithm identifier for a PKCS#5 v2.0 PBE algorithm:
- * yes I know this is horrible!
- *
- * Extended version to allow application supplied PRF NID and IV.
- */
-
-X509_ALGOR *
-PKCS5_pbe2_set_iv(const EVP_CIPHER *cipher, int iter, unsigned char *salt,
-    int saltlen, unsigned char *aiv, int prf_nid)
-{
-        X509_ALGOR *scheme = NULL, *kalg = NULL, *ret = NULL;
-        int alg_nid, keylen;
-        EVP_CIPHER_CTX ctx;
-        unsigned char iv[EVP_MAX_IV_LENGTH];
-        PBE2PARAM *pbe2 = NULL;
-        ASN1_OBJECT *obj;
-
-        alg_nid = EVP_CIPHER_type(cipher);
-        if (alg_nid == NID_undef) {
-                ASN1err(ASN1_F_PKCS5_PBE2_SET_IV,
-                ASN1_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER);
-                goto err;
-        }
-        obj = OBJ_nid2obj(alg_nid);
-
-        if (!(pbe2 = PBE2PARAM_new()))
-                goto merr;
-
-        /* Setup the AlgorithmIdentifier for the encryption scheme */
-        scheme = pbe2->encryption;
-
-        scheme->algorithm = obj;
-        if (!(scheme->parameter = ASN1_TYPE_new()))
-                goto merr;
-
-        /* Create random IV */
-        if (EVP_CIPHER_iv_length(cipher)) {
-                if (aiv)
-                        memcpy(iv, aiv, EVP_CIPHER_iv_length(cipher));
-                else
-                        arc4random_buf(iv, EVP_CIPHER_iv_length(cipher));
-        }
-
-        EVP_CIPHER_CTX_init(&ctx);
-
-        /* Dummy cipherinit to just setup the IV, and PRF */
-        if (!EVP_CipherInit_ex(&ctx, cipher, NULL, NULL, iv, 0))
-                goto err;
-        if (EVP_CIPHER_param_to_asn1(&ctx, scheme->parameter) < 0) {
-                ASN1err(ASN1_F_PKCS5_PBE2_SET_IV,
-                ASN1_R_ERROR_SETTING_CIPHER_PARAMS);
-                EVP_CIPHER_CTX_cleanup(&ctx);
-                goto err;
-        }
-        /* If prf NID unspecified see if cipher has a preference.
-         * An error is OK here: just means use default PRF.
-         */
-        if ((prf_nid == -1) &&
-            EVP_CIPHER_CTX_ctrl(&ctx, EVP_CTRL_PBE_PRF_NID, 0, &prf_nid) <= 0) {
-                ERR_clear_error();
-                prf_nid = NID_hmacWithSHA1;
-        }
-        EVP_CIPHER_CTX_cleanup(&ctx);
-
-        /* If its RC2 then we'd better setup the key length */
-
-        if (alg_nid == NID_rc2_cbc)
-                keylen = EVP_CIPHER_key_length(cipher);
-        else
-                keylen = -1;
-
-        /* Setup keyfunc */
-
-        X509_ALGOR_free(pbe2->keyfunc);
-
-        pbe2->keyfunc = PKCS5_pbkdf2_set(iter, salt, saltlen, prf_nid, keylen);
-
-        if (!pbe2->keyfunc)
-                goto merr;
-
-        /* Now set up top level AlgorithmIdentifier */
-
-        if (!(ret = X509_ALGOR_new()))
-                goto merr;
-        if (!(ret->parameter = ASN1_TYPE_new()))
-                goto merr;
-
-        ret->algorithm = OBJ_nid2obj(NID_pbes2);
-
-        /* Encode PBE2PARAM into parameter */
-
-        if (!ASN1_item_pack(pbe2, ASN1_ITEM_rptr(PBE2PARAM),
-                &ret->parameter->value.sequence)) goto merr;
-        ret->parameter->type = V_ASN1_SEQUENCE;
-
-        PBE2PARAM_free(pbe2);
-        pbe2 = NULL;
-
-        return ret;
-
-merr:
-        ASN1err(ASN1_F_PKCS5_PBE2_SET_IV, ERR_R_MALLOC_FAILURE);
-
-err:
-        PBE2PARAM_free(pbe2);
-        /* Note 'scheme' is freed as part of pbe2 */
-        X509_ALGOR_free(kalg);
-        X509_ALGOR_free(ret);
-
-        return NULL;
-}
-
-X509_ALGOR *
-PKCS5_pbe2_set(const EVP_CIPHER *cipher, int iter, unsigned char *salt,
-    int saltlen)
-{
-        return PKCS5_pbe2_set_iv(cipher, iter, salt, saltlen, NULL, -1);
-}
-
-X509_ALGOR *
-PKCS5_pbkdf2_set(int iter, unsigned char *salt, int saltlen, int prf_nid,
-    int keylen)
-{
-        X509_ALGOR *keyfunc = NULL;
-        PBKDF2PARAM *kdf = NULL;
-        ASN1_OCTET_STRING *osalt = NULL;
-
-        if (!(kdf = PBKDF2PARAM_new()))
-                goto merr;
-        if (!(osalt = M_ASN1_OCTET_STRING_new()))
-                goto merr;
-
-        kdf->salt->value.octet_string = osalt;
-        kdf->salt->type = V_ASN1_OCTET_STRING;
-
-        if (!saltlen)
-                saltlen = PKCS5_SALT_LEN;
-        if (!(osalt->data = malloc (saltlen)))
-                goto merr;
-
-        osalt->length = saltlen;
-
-        if (salt)
-                memcpy (osalt->data, salt, saltlen);
-        else
-                arc4random_buf(osalt->data, saltlen);
-
-        if (iter <= 0)
-                iter = PKCS5_DEFAULT_ITER;
-
-        if (!ASN1_INTEGER_set(kdf->iter, iter))
-                goto merr;
-
-        /* If have a key len set it up */
-
-        if (keylen > 0) {
-                if (!(kdf->keylength = M_ASN1_INTEGER_new()))
-                        goto merr;
-                if (!ASN1_INTEGER_set (kdf->keylength, keylen))
-                        goto merr;
-        }
-
-        /* prf can stay NULL if we are using hmacWithSHA1 */
-        if (prf_nid > 0 && prf_nid != NID_hmacWithSHA1) {
-                kdf->prf = X509_ALGOR_new();
-                if (!kdf->prf)
-                        goto merr;
-                X509_ALGOR_set0(kdf->prf, OBJ_nid2obj(prf_nid),
-                V_ASN1_NULL, NULL);
-        }
-
-        /* Finally setup the keyfunc structure */
-
-        keyfunc = X509_ALGOR_new();
-        if (!keyfunc)
-                goto merr;
-
-        keyfunc->algorithm = OBJ_nid2obj(NID_id_pbkdf2);
-
-        /* Encode PBKDF2PARAM into parameter of pbe2 */
-
-        if (!(keyfunc->parameter = ASN1_TYPE_new()))
-                goto merr;
-
-        if (!ASN1_item_pack(kdf, ASN1_ITEM_rptr(PBKDF2PARAM),
-                &keyfunc->parameter->value.sequence))
-                goto merr;
-        keyfunc->parameter->type = V_ASN1_SEQUENCE;
-
-        PBKDF2PARAM_free(kdf);
-        return keyfunc;
-
-merr:
-        ASN1err(ASN1_F_PKCS5_PBKDF2_SET, ERR_R_MALLOC_FAILURE);
-        PBKDF2PARAM_free(kdf);
-        X509_ALGOR_free(keyfunc);
-        return NULL;
-}
diff --git a/src/lib/libcrypto/asn1/p8_pkey.c b/src/lib/libcrypto/asn1/p8_pkey.c
deleted file mode 100644
index 2f7a469673..0000000000
--- a/src/lib/libcrypto/asn1/p8_pkey.c
+++ /dev/null
@@ -1,200 +0,0 @@
-/* $OpenBSD: p8_pkey.c,v 1.16 2015/07/16 18:21:57 miod Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 1999.
- */
-/* ====================================================================
- * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <stdio.h>
-
-#include <openssl/asn1t.h>
-#include <openssl/x509.h>
-
-/* Minor tweak to operation: zero private key data */
-static int
-pkey_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it, void *exarg)
-{
-        /* Since the structure must still be valid use ASN1_OP_FREE_PRE */
-        if (operation == ASN1_OP_FREE_PRE) {
-                PKCS8_PRIV_KEY_INFO *key = (PKCS8_PRIV_KEY_INFO *)*pval;
-                if (key->pkey != NULL &&
-                    key->pkey->type == V_ASN1_OCTET_STRING &&
-                    key->pkey->value.octet_string != NULL)
-                        OPENSSL_cleanse(key->pkey->value.octet_string->data,
-                            key->pkey->value.octet_string->length);
-        }
-        return 1;
-}
-
-static const ASN1_AUX PKCS8_PRIV_KEY_INFO_aux = {
-        .asn1_cb = pkey_cb,
-};
-static const ASN1_TEMPLATE PKCS8_PRIV_KEY_INFO_seq_tt[] = {
-        {
-                .offset = offsetof(PKCS8_PRIV_KEY_INFO, version),
-                .field_name = "version",
-                .item = &ASN1_INTEGER_it,
-        },
-        {
-                .offset = offsetof(PKCS8_PRIV_KEY_INFO, pkeyalg),
-                .field_name = "pkeyalg",
-                .item = &X509_ALGOR_it,
-        },
-        {
-                .offset = offsetof(PKCS8_PRIV_KEY_INFO, pkey),
-                .field_name = "pkey",
-                .item = &ASN1_ANY_it,
-        },
-        {
-                .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_SET_OF | ASN1_TFLG_OPTIONAL,
-                .offset = offsetof(PKCS8_PRIV_KEY_INFO, attributes),
-                .field_name = "attributes",
-                .item = &X509_ATTRIBUTE_it,
-        },
-};
-
-const ASN1_ITEM PKCS8_PRIV_KEY_INFO_it = {
-        .itype = ASN1_ITYPE_SEQUENCE,
-        .utype = V_ASN1_SEQUENCE,
-        .templates = PKCS8_PRIV_KEY_INFO_seq_tt,
-        .tcount = sizeof(PKCS8_PRIV_KEY_INFO_seq_tt) / sizeof(ASN1_TEMPLATE),
-        .funcs = &PKCS8_PRIV_KEY_INFO_aux,
-        .size = sizeof(PKCS8_PRIV_KEY_INFO),
-        .sname = "PKCS8_PRIV_KEY_INFO",
-};
-
-
-PKCS8_PRIV_KEY_INFO *
-d2i_PKCS8_PRIV_KEY_INFO(PKCS8_PRIV_KEY_INFO **a, const unsigned char **in, long len)
-{
-        return (PKCS8_PRIV_KEY_INFO *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &PKCS8_PRIV_KEY_INFO_it);
-}
-
-int
-i2d_PKCS8_PRIV_KEY_INFO(PKCS8_PRIV_KEY_INFO *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &PKCS8_PRIV_KEY_INFO_it);
-}
-
-PKCS8_PRIV_KEY_INFO *
-PKCS8_PRIV_KEY_INFO_new(void)
-{
-        return (PKCS8_PRIV_KEY_INFO *)ASN1_item_new(&PKCS8_PRIV_KEY_INFO_it);
-}
-
-void
-PKCS8_PRIV_KEY_INFO_free(PKCS8_PRIV_KEY_INFO *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &PKCS8_PRIV_KEY_INFO_it);
-}
-
-int
-PKCS8_pkey_set0(PKCS8_PRIV_KEY_INFO *priv, ASN1_OBJECT *aobj, int version,
-    int ptype, void *pval, unsigned char *penc, int penclen)
-{
-        unsigned char **ppenc = NULL;
-
-        if (version >= 0) {
-                if (!ASN1_INTEGER_set(priv->version, version))
-                        return 0;
-        }
-        if (penc) {
-                int pmtype;
-                ASN1_OCTET_STRING *oct;
-                oct = ASN1_OCTET_STRING_new();
-                if (!oct)
-                        return 0;
-                oct->data = penc;
-                ppenc = &oct->data;
-                oct->length = penclen;
-                if (priv->broken == PKCS8_NO_OCTET)
-                        pmtype = V_ASN1_SEQUENCE;
-                else
-                        pmtype = V_ASN1_OCTET_STRING;
-                ASN1_TYPE_set(priv->pkey, pmtype, oct);
-        }
-        if (!X509_ALGOR_set0(priv->pkeyalg, aobj, ptype, pval)) {
-                /* If call fails do not swallow 'enc' */
-                if (ppenc)
-                        *ppenc = NULL;
-                return 0;
-        }
-        return 1;
-}
-
-int
-PKCS8_pkey_get0(ASN1_OBJECT **ppkalg, const unsigned char **pk, int *ppklen,
-    X509_ALGOR **pa, PKCS8_PRIV_KEY_INFO *p8)
-{
-        if (ppkalg)
-                *ppkalg = p8->pkeyalg->algorithm;
-        if (p8->pkey->type == V_ASN1_OCTET_STRING) {
-                p8->broken = PKCS8_OK;
-                if (pk) {
-                        *pk = p8->pkey->value.octet_string->data;
-                        *ppklen = p8->pkey->value.octet_string->length;
-                }
-        } else if (p8->pkey->type == V_ASN1_SEQUENCE) {
-                p8->broken = PKCS8_NO_OCTET;
-                if (pk) {
-                        *pk = p8->pkey->value.sequence->data;
-                        *ppklen = p8->pkey->value.sequence->length;
-                }
-        } else
-                return 0;
-        if (pa)
-                *pa = p8->pkeyalg;
-        return 1;
-}
diff --git a/src/lib/libcrypto/asn1/t_bitst.c b/src/lib/libcrypto/asn1/t_bitst.c
deleted file mode 100644
index ea4138e0fb..0000000000
--- a/src/lib/libcrypto/asn1/t_bitst.c
+++ /dev/null
@@ -1,112 +0,0 @@
-/* $OpenBSD: t_bitst.c,v 1.7 2014/07/11 08:44:47 jsing Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 1999.
- */
-/* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <stdio.h>
-#include <string.h>
-
-#include <openssl/conf.h>
-#include <openssl/x509v3.h>
-
-int
-ASN1_BIT_STRING_name_print(BIO *out, ASN1_BIT_STRING *bs,
-    BIT_STRING_BITNAME *tbl, int indent)
-{
-        BIT_STRING_BITNAME *bnam;
-        char first = 1;
-
-        BIO_printf(out, "%*s", indent, "");
-        for (bnam = tbl; bnam->lname; bnam++) {
-                if (ASN1_BIT_STRING_get_bit(bs, bnam->bitnum)) {
-                        if (!first)
-                                BIO_puts(out, ", ");
-                        BIO_puts(out, bnam->lname);
-                        first = 0;
-                }
-        }
-        BIO_puts(out, "\n");
-        return 1;
-}
-
-int
-ASN1_BIT_STRING_set_asc(ASN1_BIT_STRING *bs, char *name, int value,
-    BIT_STRING_BITNAME *tbl)
-{
-        int bitnum;
-
-        bitnum = ASN1_BIT_STRING_num_asc(name, tbl);
-        if (bitnum < 0)
-                return 0;
-        if (bs) {
-                if (!ASN1_BIT_STRING_set_bit(bs, bitnum, value))
-                        return 0;
-        }
-        return 1;
-}
-
-int
-ASN1_BIT_STRING_num_asc(char *name, BIT_STRING_BITNAME *tbl)
-{
-        BIT_STRING_BITNAME *bnam;
-
-        for (bnam = tbl; bnam->lname; bnam++) {
-                if (!strcmp(bnam->sname, name) ||
-                    !strcmp(bnam->lname, name))
-                        return bnam->bitnum;
-        }
-        return -1;
-}
diff --git a/src/lib/libcrypto/asn1/t_crl.c b/src/lib/libcrypto/asn1/t_crl.c
deleted file mode 100644
index 67116361a5..0000000000
--- a/src/lib/libcrypto/asn1/t_crl.c
+++ /dev/null
@@ -1,140 +0,0 @@
-/* $OpenBSD: t_crl.c,v 1.16 2014/07/12 16:33:25 miod Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 1999.
- */
-/* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <stdio.h>
-
-#include <openssl/bn.h>
-#include <openssl/buffer.h>
-#include <openssl/err.h>
-#include <openssl/objects.h>
-#include <openssl/x509.h>
-#include <openssl/x509v3.h>
-
-int
-X509_CRL_print_fp(FILE *fp, X509_CRL *x)
-{
-        BIO *b;
-        int ret;
-
-        if ((b = BIO_new(BIO_s_file())) == NULL) {
-                X509err(X509_F_X509_CRL_PRINT_FP, ERR_R_BUF_LIB);
-                return (0);
-        }
-        BIO_set_fp(b, fp, BIO_NOCLOSE);
-        ret = X509_CRL_print(b, x);
-        BIO_free(b);
-        return (ret);
-}
-
-int
-X509_CRL_print(BIO *out, X509_CRL *x)
-{
-        STACK_OF(X509_REVOKED) *rev;
-        X509_REVOKED *r;
-        long l;
-        int i;
-        char *p;
-
-        BIO_printf(out, "Certificate Revocation List (CRL):\n");
-        l = X509_CRL_get_version(x);
-        BIO_printf(out, "%8sVersion %lu (0x%lx)\n", "", l + 1, l);
-        i = OBJ_obj2nid(x->sig_alg->algorithm);
-        if (X509_signature_print(out, x->sig_alg, NULL) == 0)
-                goto err;
-        p = X509_NAME_oneline(X509_CRL_get_issuer(x), NULL, 0);
-        if (p == NULL)
-                goto err;
-        BIO_printf(out, "%8sIssuer: %s\n", "", p);
-        free(p);
-        BIO_printf(out, "%8sLast Update: ", "");
-        ASN1_TIME_print(out, X509_CRL_get_lastUpdate(x));
-        BIO_printf(out, "\n%8sNext Update: ", "");
-        if (X509_CRL_get_nextUpdate(x))
-                ASN1_TIME_print(out, X509_CRL_get_nextUpdate(x));
-        else
-                BIO_printf(out, "NONE");
-        BIO_printf(out, "\n");
-
-        X509V3_extensions_print(out, "CRL extensions",
-            x->crl->extensions, 0, 8);
-
-        rev = X509_CRL_get_REVOKED(x);
-
-        if (sk_X509_REVOKED_num(rev) > 0)
-                BIO_printf(out, "Revoked Certificates:\n");
-        else
-                BIO_printf(out, "No Revoked Certificates.\n");
-
-        for (i = 0; i < sk_X509_REVOKED_num(rev); i++) {
-                r = sk_X509_REVOKED_value(rev, i);
-                BIO_printf(out, "    Serial Number: ");
-                i2a_ASN1_INTEGER(out, r->serialNumber);
-                BIO_printf(out, "\n        Revocation Date: ");
-                ASN1_TIME_print(out, r->revocationDate);
-                BIO_printf(out, "\n");
-                X509V3_extensions_print(out, "CRL entry extensions",
-                    r->extensions, 0, 8);
-        }
-        if (X509_signature_print(out, x->sig_alg, x->signature) == 0)
-                goto err;
-
-        return 1;
-
-err:
-        return 0;
-}
diff --git a/src/lib/libcrypto/asn1/t_pkey.c b/src/lib/libcrypto/asn1/t_pkey.c
deleted file mode 100644
index b3f7d084c5..0000000000
--- a/src/lib/libcrypto/asn1/t_pkey.c
+++ /dev/null
@@ -1,114 +0,0 @@
-/* $OpenBSD: t_pkey.c,v 1.16 2014/07/11 08:44:47 jsing Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-
-#include <openssl/bn.h>
-#include <openssl/buffer.h>
-#include <openssl/objects.h>
-
-int
-ASN1_bn_print(BIO *bp, const char *number, const BIGNUM *num,
-    unsigned char *buf, int off)
-{
-        int n, i;
-        const char *neg;
-
-        if (num == NULL)
-                return (1);
-        neg = (BN_is_negative(num)) ? "-" : "";
-        if (!BIO_indent(bp, off, 128))
-                return 0;
-        if (BN_is_zero(num)) {
-                if (BIO_printf(bp, "%s 0\n", number) <= 0)
-                        return 0;
-                return 1;
-        }
-
-        if (BN_num_bytes(num) <= BN_BYTES) {
-                if (BIO_printf(bp, "%s %s%lu (%s0x%lx)\n", number, neg,
-                    (unsigned long)num->d[0], neg,
-                    (unsigned long)num->d[0]) <= 0)
-                        return (0);
-        } else {
-                buf[0] = 0;
-                if (BIO_printf(bp, "%s%s", number,
-                    (neg[0] == '-') ? " (Negative)" : "") <= 0)
-                        return (0);
-                n = BN_bn2bin(num, &buf[1]);
-
-                if (buf[1] & 0x80)
-                        n++;
-                else
-                        buf++;
-
-                for (i = 0; i < n; i++) {
-                        if ((i % 15) == 0) {
-                                if (BIO_puts(bp, "\n") <= 0 ||
-                                    !BIO_indent(bp, off + 4, 128))
-                                        return 0;
-                        }
-                        if (BIO_printf(bp, "%02x%s", buf[i],
-                            ((i + 1) == n) ? "" : ":") <= 0)
-                                return (0);
-                }
-                if (BIO_write(bp, "\n", 1) <= 0)
-                        return (0);
-        }
-        return (1);
-}
diff --git a/src/lib/libcrypto/asn1/t_req.c b/src/lib/libcrypto/asn1/t_req.c
deleted file mode 100644
index 8db456708a..0000000000
--- a/src/lib/libcrypto/asn1/t_req.c
+++ /dev/null
@@ -1,267 +0,0 @@
-/* $OpenBSD: t_req.c,v 1.18 2015/07/29 14:58:34 jsing Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-
-#include <openssl/opensslconf.h>
-
-#include <openssl/bn.h>
-#include <openssl/buffer.h>
-#include <openssl/err.h>
-#include <openssl/objects.h>
-#include <openssl/x509.h>
-#include <openssl/x509v3.h>
-
-#ifndef OPENSSL_NO_DSA
-#include <openssl/dsa.h>
-#endif
-#ifndef OPENSSL_NO_RSA
-#include <openssl/rsa.h>
-#endif
-
-int
-X509_REQ_print_fp(FILE *fp, X509_REQ *x)
-{
-        BIO *b;
-        int ret;
-
-        if ((b = BIO_new(BIO_s_file())) == NULL) {
-                X509err(X509_F_X509_REQ_PRINT_FP, ERR_R_BUF_LIB);
-                return (0);
-        }
-        BIO_set_fp(b, fp, BIO_NOCLOSE);
-        ret = X509_REQ_print(b, x);
-        BIO_free(b);
-        return (ret);
-}
-
-int
-X509_REQ_print_ex(BIO *bp, X509_REQ *x, unsigned long nmflags,
-    unsigned long cflag)
-{
-        unsigned long l;
-        int i;
-        const char *neg;
-        X509_REQ_INFO *ri;
-        EVP_PKEY *pkey;
-        STACK_OF(X509_ATTRIBUTE) *sk;
-        STACK_OF(X509_EXTENSION) *exts;
-        char mlch = ' ';
-        int nmindent = 0;
-
-        if ((nmflags & XN_FLAG_SEP_MASK) == XN_FLAG_SEP_MULTILINE) {
-                mlch = '\n';
-                nmindent = 12;
-        }
-
-        if (nmflags == X509_FLAG_COMPAT)
-                nmindent = 16;
-
-        ri = x->req_info;
-        if (!(cflag & X509_FLAG_NO_HEADER)) {
-                if (BIO_write(bp, "Certificate Request:\n", 21) <= 0)
-                        goto err;
-                if (BIO_write(bp, "    Data:\n", 10) <= 0)
-
-                        goto err;
-        }
-        if (!(cflag & X509_FLAG_NO_VERSION)) {
-                neg = (ri->version->type == V_ASN1_NEG_INTEGER) ? "-" : "";
-                l = 0;
-                for (i = 0; i < ri->version->length; i++) {
-                        l <<= 8;
-                        l += ri->version->data[i];
-                }
-                if (BIO_printf(bp, "%8sVersion: %s%lu (%s0x%lx)\n", "", neg,
-                    l, neg, l) <= 0)
-                        goto err;
-        }
-        if (!(cflag & X509_FLAG_NO_SUBJECT)) {
-                if (BIO_printf(bp, "        Subject:%c", mlch) <= 0)
-                        goto err;
-                if (X509_NAME_print_ex(bp, ri->subject, nmindent, nmflags) < 0)
-                        goto err;
-                if (BIO_write(bp, "\n", 1) <= 0)
-                        goto err;
-        }
-        if (!(cflag & X509_FLAG_NO_PUBKEY)) {
-                if (BIO_write(bp, "        Subject Public Key Info:\n",
-                    33) <= 0)
-                        goto err;
-                if (BIO_printf(bp, "%12sPublic Key Algorithm: ", "") <= 0)
-                        goto err;
-                if (i2a_ASN1_OBJECT(bp, ri->pubkey->algor->algorithm) <= 0)
-                        goto err;
-                if (BIO_puts(bp, "\n") <= 0)
-                        goto err;
-
-                pkey = X509_REQ_get_pubkey(x);
-                if (pkey == NULL) {
-                        BIO_printf(bp, "%12sUnable to load Public Key\n", "");
-                        ERR_print_errors(bp);
-                } else {
-                        EVP_PKEY_print_public(bp, pkey, 16, NULL);
-                        EVP_PKEY_free(pkey);
-                }
-        }
-
-        if (!(cflag & X509_FLAG_NO_ATTRIBUTES)) {
-                /* may not be */
-                if (BIO_printf(bp, "%8sAttributes:\n", "") <= 0)
-                        goto err;
-
-                sk = x->req_info->attributes;
-                if (sk_X509_ATTRIBUTE_num(sk) == 0) {
-                        if (BIO_printf(bp, "%12sa0:00\n", "") <= 0)
-                                goto err;
-                } else {
-                        for (i = 0; i < sk_X509_ATTRIBUTE_num(sk); i++) {
-                                ASN1_TYPE *at;
-                                X509_ATTRIBUTE *a;
-                                ASN1_BIT_STRING *bs = NULL;
-                                ASN1_TYPE *t;
-                                int j, type = 0, count = 1, ii = 0;
-
-                                a = sk_X509_ATTRIBUTE_value(sk, i);
-                                if (X509_REQ_extension_nid(
-                                    OBJ_obj2nid(a->object)))
-                                        continue;
-                                if (BIO_printf(bp, "%12s", "") <= 0)
-                                        goto err;
-                                if ((j = i2a_ASN1_OBJECT(bp, a->object)) > 0) {
-                                        if (a->single) {
-                                                t = a->value.single;
-                                                type = t->type;
-                                                bs = t->value.bit_string;
-                                        } else {
-                                                ii = 0;
-                                                count = sk_ASN1_TYPE_num(
-                                                    a->value.set);
-get_next:
-                                                at = sk_ASN1_TYPE_value(
-                                                    a->value.set, ii);
-                                                type = at->type;
-                                                bs = at->value.asn1_string;
-                                        }
-                                }
-                                for (j = 25 - j; j > 0; j--)
-                                        if (BIO_write(bp, " ", 1) != 1)
-                                                goto err;
-                                if (BIO_puts(bp, ":") <= 0)
-                                        goto err;
-                                if ((type == V_ASN1_PRINTABLESTRING) ||
-                                    (type == V_ASN1_T61STRING) ||
-                                    (type == V_ASN1_IA5STRING)) {
-                                        if (BIO_write(bp, (char *)bs->data,
-                                            bs->length) != bs->length)
-                                                goto err;
-                                        BIO_puts(bp, "\n");
-                                } else {
-                                        BIO_puts(bp,
-                                            "unable to print attribute\n");
-                                }
-                                if (++ii < count)
-                                        goto get_next;
-                        }
-                }
-        }
-        if (!(cflag & X509_FLAG_NO_EXTENSIONS)) {
-                exts = X509_REQ_get_extensions(x);
-                if (exts) {
-                        BIO_printf(bp, "%8sRequested Extensions:\n", "");
-                        for (i = 0; i < sk_X509_EXTENSION_num(exts); i++) {
-                                ASN1_OBJECT *obj;
-                                X509_EXTENSION *ex;
-                                int j;
-                                ex = sk_X509_EXTENSION_value(exts, i);
-                                if (BIO_printf(bp, "%12s", "") <= 0)
-                                        goto err;
-                                obj = X509_EXTENSION_get_object(ex);
-                                i2a_ASN1_OBJECT(bp, obj);
-                                j = X509_EXTENSION_get_critical(ex);
-                                if (BIO_printf(bp, ": %s\n",
-                                    j ? "critical" : "") <= 0)
-                                        goto err;
-                                if (!X509V3_EXT_print(bp, ex, cflag, 16)) {
-                                        BIO_printf(bp, "%16s", "");
-                                        ASN1_STRING_print(bp, ex->value);
-                                }
-                                if (BIO_write(bp, "\n", 1) <= 0)
-                                        goto err;
-                        }
-                        sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
-                }
-        }
-
-        if (!(cflag & X509_FLAG_NO_SIGDUMP)) {
-                if (!X509_signature_print(bp, x->sig_alg, x->signature))
-                        goto err;
-        }
-
-        return (1);
-
-err:
-        X509err(X509_F_X509_REQ_PRINT_EX, ERR_R_BUF_LIB);
-        return (0);
-}
-
-int
-X509_REQ_print(BIO *bp, X509_REQ *x)
-{
-        return X509_REQ_print_ex(bp, x, XN_FLAG_COMPAT, X509_FLAG_COMPAT);
-}
diff --git a/src/lib/libcrypto/asn1/t_spki.c b/src/lib/libcrypto/asn1/t_spki.c
deleted file mode 100644
index 39ff0670b6..0000000000
--- a/src/lib/libcrypto/asn1/t_spki.c
+++ /dev/null
@@ -1,112 +0,0 @@
-/* $OpenBSD: t_spki.c,v 1.11 2014/07/11 08:44:47 jsing Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 1999.
- */
-/* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <stdio.h>
-
-#include <openssl/opensslconf.h>
-
-#include <openssl/asn1.h>
-#include <openssl/bn.h>
-#include <openssl/x509.h>
-
-#ifndef OPENSSL_NO_DSA
-#include <openssl/dsa.h>
-#endif
-#ifndef OPENSSL_NO_RSA
-#include <openssl/rsa.h>
-#endif
-
-/* Print out an SPKI */
-
-int
-NETSCAPE_SPKI_print(BIO *out, NETSCAPE_SPKI *spki)
-{
-        EVP_PKEY *pkey;
-        ASN1_IA5STRING *chal;
-        int i, n;
-        char *s;
-
-        BIO_printf(out, "Netscape SPKI:\n");
-        i = OBJ_obj2nid(spki->spkac->pubkey->algor->algorithm);
-        BIO_printf(out, "  Public Key Algorithm: %s\n",
-            (i == NID_undef) ? "UNKNOWN" : OBJ_nid2ln(i));
-        pkey = X509_PUBKEY_get(spki->spkac->pubkey);
-        if (!pkey)
-                BIO_printf(out, "  Unable to load public key\n");
-        else {
-                EVP_PKEY_print_public(out, pkey, 4, NULL);
-                EVP_PKEY_free(pkey);
-        }
-        chal = spki->spkac->challenge;
-        if (chal->length)
-                BIO_printf(out, "  Challenge String: %s\n", chal->data);
-        i = OBJ_obj2nid(spki->sig_algor->algorithm);
-        BIO_printf(out, "  Signature Algorithm: %s",
-            (i == NID_undef) ? "UNKNOWN" : OBJ_nid2ln(i));
-
-        n = spki->signature->length;
-        s = (char *)spki->signature->data;
-        for (i = 0; i < n; i++) {
-                if ((i % 18) == 0)
-                        BIO_write(out, "\n      ", 7);
-                BIO_printf(out, "%02x%s", (unsigned char)s[i],
-                    ((i + 1) == n) ? "" : ":");
-        }
-        BIO_write(out, "\n", 1);
-        return 1;
-}
diff --git a/src/lib/libcrypto/asn1/t_x509.c b/src/lib/libcrypto/asn1/t_x509.c
deleted file mode 100644
index 1c83fc5608..0000000000
--- a/src/lib/libcrypto/asn1/t_x509.c
+++ /dev/null
@@ -1,537 +0,0 @@
-/* $OpenBSD: t_x509.c,v 1.26 2015/02/07 13:19:15 doug Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-
-#include <openssl/opensslconf.h>
-
-#include <openssl/bn.h>
-#include <openssl/buffer.h>
-#include <openssl/err.h>
-#include <openssl/objects.h>
-#include <openssl/x509.h>
-#include <openssl/x509v3.h>
-
-#ifndef OPENSSL_NO_DSA
-#include <openssl/dsa.h>
-#endif
-#ifndef OPENSSL_NO_EC
-#include <openssl/ec.h>
-#endif
-#ifndef OPENSSL_NO_RSA
-#include <openssl/rsa.h>
-#endif
-
-#include "asn1_locl.h"
-
-int
-X509_print_fp(FILE *fp, X509 *x)
-{
-        return X509_print_ex_fp(fp, x, XN_FLAG_COMPAT, X509_FLAG_COMPAT);
-}
-
-int
-X509_print_ex_fp(FILE *fp, X509 *x, unsigned long nmflag, unsigned long cflag)
-{
-        BIO *b;
-        int ret;
-
-        if ((b = BIO_new(BIO_s_file())) == NULL) {
-                X509err(X509_F_X509_PRINT_EX_FP, ERR_R_BUF_LIB);
-                return (0);
-        }
-        BIO_set_fp(b, fp, BIO_NOCLOSE);
-        ret = X509_print_ex(b, x, nmflag, cflag);
-        BIO_free(b);
-        return (ret);
-}
-
-int
-X509_print(BIO *bp, X509 *x)
-{
-        return X509_print_ex(bp, x, XN_FLAG_COMPAT, X509_FLAG_COMPAT);
-}
-
-int
-X509_print_ex(BIO *bp, X509 *x, unsigned long nmflags, unsigned long cflag)
-{
-        long l;
-        int ret = 0, i;
-        char *m = NULL, mlch = ' ';
-        int nmindent = 0;
-        X509_CINF *ci;
-        ASN1_INTEGER *bs;
-        EVP_PKEY *pkey = NULL;
-        const char *neg;
-
-        if ((nmflags & XN_FLAG_SEP_MASK) == XN_FLAG_SEP_MULTILINE) {
-                mlch = '\n';
-                nmindent = 12;
-        }
-
-        if (nmflags == X509_FLAG_COMPAT)
-                nmindent = 16;
-
-        ci = x->cert_info;
-        if (!(cflag & X509_FLAG_NO_HEADER)) {
-                if (BIO_write(bp, "Certificate:\n", 13) <= 0)
-                        goto err;
-                if (BIO_write(bp, "    Data:\n", 10) <= 0)
-                        goto err;
-        }
-        if (!(cflag & X509_FLAG_NO_VERSION)) {
-                l = X509_get_version(x);
-                if (BIO_printf(bp, "%8sVersion: %lu (0x%lx)\n",
-                    "", l + 1, l) <= 0)
-                        goto err;
-        }
-        if (!(cflag & X509_FLAG_NO_SERIAL)) {
-                if (BIO_write(bp, "        Serial Number:", 22) <= 0)
-                        goto err;
-
-                bs = X509_get_serialNumber(x);
-                if (bs->length <= (int)sizeof(long)) {
-                        l = ASN1_INTEGER_get(bs);
-                        if (bs->type == V_ASN1_NEG_INTEGER) {
-                                l = -l;
-                                neg = "-";
-                        } else
-                                neg = "";
-                        if (BIO_printf(bp, " %s%lu (%s0x%lx)\n",
-                            neg, l, neg, l) <= 0)
-                                goto err;
-                } else {
-                        neg = (bs->type == V_ASN1_NEG_INTEGER) ?
-                            " (Negative)" : "";
-                        if (BIO_printf(bp, "\n%12s%s", "", neg) <= 0)
-                                goto err;
-                        for (i = 0; i < bs->length; i++) {
-                                if (BIO_printf(bp, "%02x%c", bs->data[i],
-                                    ((i + 1 == bs->length) ? '\n' : ':')) <= 0)
-                                        goto err;
-                        }
-                }
-
-        }
-
-        if (!(cflag & X509_FLAG_NO_SIGNAME)) {
-                if (X509_signature_print(bp, x->sig_alg, NULL) <= 0)
-                        goto err;
-        }
-
-        if (!(cflag & X509_FLAG_NO_ISSUER)) {
-                if (BIO_printf(bp, "        Issuer:%c", mlch) <= 0)
-                        goto err;
-                if (X509_NAME_print_ex(bp, X509_get_issuer_name(x),
-                    nmindent, nmflags) < 0)
-                        goto err;
-                if (BIO_write(bp, "\n", 1) <= 0)
-                        goto err;
-        }
-        if (!(cflag & X509_FLAG_NO_VALIDITY)) {
-                if (BIO_write(bp, "        Validity\n", 17) <= 0)
-                        goto err;
-                if (BIO_write(bp, "            Not Before: ", 24) <= 0)
-                        goto err;
-                if (!ASN1_TIME_print(bp, X509_get_notBefore(x)))
-                        goto err;
-                if (BIO_write(bp, "\n            Not After : ", 25) <= 0)
-                        goto err;
-                if (!ASN1_TIME_print(bp, X509_get_notAfter(x)))
-                        goto err;
-                if (BIO_write(bp, "\n", 1) <= 0)
-                        goto err;
-        }
-        if (!(cflag & X509_FLAG_NO_SUBJECT)) {
-                if (BIO_printf(bp, "        Subject:%c", mlch) <= 0)
-                        goto err;
-                if (X509_NAME_print_ex(bp, X509_get_subject_name(x),
-                    nmindent, nmflags) < 0)
-                        goto err;
-                if (BIO_write(bp, "\n", 1) <= 0)
-                        goto err;
-        }
-        if (!(cflag & X509_FLAG_NO_PUBKEY)) {
-                if (BIO_write(bp, "        Subject Public Key Info:\n",
-                    33) <= 0)
-                        goto err;
-                if (BIO_printf(bp, "%12sPublic Key Algorithm: ", "") <= 0)
-                        goto err;
-                if (i2a_ASN1_OBJECT(bp, ci->key->algor->algorithm) <= 0)
-                        goto err;
-                if (BIO_puts(bp, "\n") <= 0)
-                        goto err;
-
-                pkey = X509_get_pubkey(x);
-                if (pkey == NULL) {
-                        BIO_printf(bp, "%12sUnable to load Public Key\n", "");
-                        ERR_print_errors(bp);
-                } else {
-                        EVP_PKEY_print_public(bp, pkey, 16, NULL);
-                        EVP_PKEY_free(pkey);
-                }
-        }
-
-        if (!(cflag & X509_FLAG_NO_EXTENSIONS))
-                X509V3_extensions_print(bp, "X509v3 extensions",
-                    ci->extensions, cflag, 8);
-
-        if (!(cflag & X509_FLAG_NO_SIGDUMP)) {
-                if (X509_signature_print(bp, x->sig_alg, x->signature) <= 0)
-                        goto err;
-        }
-        if (!(cflag & X509_FLAG_NO_AUX)) {
-                if (!X509_CERT_AUX_print(bp, x->aux, 0))
-                        goto err;
-        }
-        ret = 1;
-
-err:
-        free(m);
-        return (ret);
-}
-
-int X509_ocspid_print (BIO *bp, X509 *x)
-{
-        unsigned char *der = NULL;
-        unsigned char *dertmp;
-        int derlen;
-        int i;
-        unsigned char SHA1md[SHA_DIGEST_LENGTH];
-
-        /* display the hash of the subject as it would appear
-           in OCSP requests */
-        if (BIO_printf(bp, "        Subject OCSP hash: ") <= 0)
-                goto err;
-        derlen = i2d_X509_NAME(x->cert_info->subject, NULL);
-        if ((der = dertmp = malloc(derlen)) == NULL)
-                goto err;
-        i2d_X509_NAME(x->cert_info->subject, &dertmp);
-
-        if (!EVP_Digest(der, derlen, SHA1md, NULL, EVP_sha1(), NULL))
-                goto err;
-        for (i = 0; i < SHA_DIGEST_LENGTH; i++) {
-                if (BIO_printf(bp, "%02X", SHA1md[i]) <= 0)
-                        goto err;
-        }
-        free (der);
-        der = NULL;
-
-        /* display the hash of the public key as it would appear
-           in OCSP requests */
-        if (BIO_printf(bp, "\n        Public key OCSP hash: ") <= 0)
-                goto err;
-
-        if (!EVP_Digest(x->cert_info->key->public_key->data,
-            x->cert_info->key->public_key->length,
-            SHA1md, NULL, EVP_sha1(), NULL))
-                goto err;
-        for (i = 0; i < SHA_DIGEST_LENGTH; i++) {
-                if (BIO_printf(bp, "%02X", SHA1md[i]) <= 0)
-                        goto err;
-        }
-        BIO_printf(bp, "\n");
-
-        return (1);
-
-err:
-        free(der);
-        return (0);
-}
-
-int
-X509_signature_dump(BIO *bp, const ASN1_STRING *sig, int indent)
-{
-        const unsigned char *s;
-        int i, n;
-
-        n = sig->length;
-        s = sig->data;
-        for (i = 0; i < n; i++) {
-                if ((i % 18) == 0) {
-                        if (BIO_write(bp, "\n", 1) <= 0)
-                                return 0;
-                        if (BIO_indent(bp, indent, indent) <= 0)
-                                return 0;
-                }
-                if (BIO_printf(bp, "%02x%s", s[i],
-                    ((i + 1) == n) ? "" : ":") <= 0)
-                        return 0;
-        }
-        if (BIO_write(bp, "\n", 1) != 1)
-                return 0;
-
-        return 1;
-}
-
-int
-X509_signature_print(BIO *bp, X509_ALGOR *sigalg, ASN1_STRING *sig)
-{
-        int sig_nid;
-        if (BIO_puts(bp, "    Signature Algorithm: ") <= 0)
-                return 0;
-        if (i2a_ASN1_OBJECT(bp, sigalg->algorithm) <= 0)
-                return 0;
-
-        sig_nid = OBJ_obj2nid(sigalg->algorithm);
-        if (sig_nid != NID_undef) {
-                int pkey_nid, dig_nid;
-                const EVP_PKEY_ASN1_METHOD *ameth;
-                if (OBJ_find_sigid_algs(sig_nid, &dig_nid, &pkey_nid)) {
-                        ameth = EVP_PKEY_asn1_find(NULL, pkey_nid);
-                        if (ameth && ameth->sig_print)
-                                return ameth->sig_print(bp, sigalg, sig, 9, 0);
-                }
-        }
-        if (sig)
-                return X509_signature_dump(bp, sig, 9);
-        else if (BIO_puts(bp, "\n") <= 0)
-                return 0;
-        return 1;
-}
-
-int
-ASN1_STRING_print(BIO *bp, const ASN1_STRING *v)
-{
-        int i, n;
-        char buf[80];
-        const char *p;
-
-        if (v == NULL)
-                return (0);
-        n = 0;
-        p = (const char *)v->data;
-        for (i = 0; i < v->length; i++) {
-                if ((p[i] > '~') || ((p[i] < ' ') &&
-                    (p[i] != '\n') && (p[i] != '\r')))
-                        buf[n] = '.';
-                else
-                        buf[n] = p[i];
-                n++;
-                if (n >= 80) {
-                        if (BIO_write(bp, buf, n) <= 0)
-                                return (0);
-                        n = 0;
-                }
-        }
-        if (n > 0)
-                if (BIO_write(bp, buf, n) <= 0)
-                        return (0);
-        return (1);
-}
-
-int
-ASN1_TIME_print(BIO *bp, const ASN1_TIME *tm)
-{
-        if (tm->type == V_ASN1_UTCTIME)
-                return ASN1_UTCTIME_print(bp, tm);
-        if (tm->type == V_ASN1_GENERALIZEDTIME)
-                return ASN1_GENERALIZEDTIME_print(bp, tm);
-        BIO_write(bp, "Bad time value", 14);
-        return (0);
-}
-
-static const char *mon[12] = {
-        "Jan", "Feb", "Mar", "Apr", "May", "Jun", 
-        "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"
-};
-
-int
-ASN1_GENERALIZEDTIME_print(BIO *bp, const ASN1_GENERALIZEDTIME *tm)
-{
-        char *v;
-        int gmt = 0;
-        int i;
-        int y = 0, M = 0, d = 0, h = 0, m = 0, s = 0;
-        char *f = NULL;
-        int f_len = 0;
-
-        i = tm->length;
-        v = (char *)tm->data;
-
-        if (i < 12)
-                goto err;
-        if (v[i-1] == 'Z')
-                gmt = 1;
-        for (i = 0; i < 12; i++)
-                if ((v[i] > '9') || (v[i] < '0'))
-                        goto err;
-        y = (v[0] - '0') * 1000 + (v[1] - '0') * 100 +
-            (v[2] - '0') * 10 + (v[3] - '0');
-        M = (v[4] - '0') * 10 + (v[5] - '0');
-        if ((M > 12) || (M < 1))
-                goto err;
-        d = (v[6] - '0') * 10 + (v[7] - '0');
-        h = (v[8] - '0') * 10 + (v[9] - '0');
-        m = (v[10] - '0') * 10 + (v[11] - '0');
-        if (tm->length >= 14 &&
-            (v[12] >= '0') && (v[12] <= '9') &&
-            (v[13] >= '0') && (v[13] <= '9')) {
-                s =  (v[12] - '0') * 10 + (v[13] - '0');
-                /* Check for fractions of seconds. */
-                if (tm->length >= 15 && v[14] == '.') {
-                        int l = tm->length;
-                        f = &v[14];     /* The decimal point. */
-                        f_len = 1;
-                        while (14 + f_len < l && f[f_len] >= '0' &&
-                            f[f_len] <= '9')
-                                ++f_len;
-                }
-        }
-
-        if (BIO_printf(bp, "%s %2d %02d:%02d:%02d%.*s %d%s",
-            mon[M - 1], d, h, m, s, f_len, f, y, (gmt) ? " GMT" : "") <= 0)
-                return (0);
-        else
-                return (1);
-
-err:
-        BIO_write(bp, "Bad time value", 14);
-        return (0);
-}
-
-int
-ASN1_UTCTIME_print(BIO *bp, const ASN1_UTCTIME *tm)
-{
-        const char *v;
-        int gmt = 0;
-        int i;
-        int y = 0, M = 0, d = 0, h = 0, m = 0, s = 0;
-
-        i = tm->length;
-        v = (const char *)tm->data;
-
-        if (i < 10)
-                goto err;
-        if (v[i-1] == 'Z')
-                gmt = 1;
-        for (i = 0; i < 10; i++)
-                if ((v[i] > '9') || (v[i] < '0'))
-                        goto err;
-        y = (v[0] - '0') * 10 + (v[1] - '0');
-        if (y < 50)
-                y += 100;
-        M = (v[2] - '0') * 10 + (v[3] - '0');
-        if ((M > 12) || (M < 1))
-                goto err;
-        d = (v[4] - '0') * 10 + (v[5] - '0');
-        h = (v[6] - '0') * 10 + (v[7] - '0');
-        m = (v[8] - '0') * 10 + (v[9] - '0');
-        if (tm->length >=12 &&
-            (v[10] >= '0') && (v[10] <= '9') &&
-            (v[11] >= '0') && (v[11] <= '9'))
-                s = (v[10] - '0') * 10 + (v[11] - '0');
-
-        if (BIO_printf(bp, "%s %2d %02d:%02d:%02d %d%s",
-            mon[M - 1], d, h, m, s, y + 1900, (gmt) ? " GMT" : "") <= 0)
-                return (0);
-        else
-                return (1);
-
-err:
-        BIO_write(bp, "Bad time value", 14);
-        return (0);
-}
-
-int
-X509_NAME_print(BIO *bp, X509_NAME *name, int obase)
-{
-        char *s, *c, *b;
-        int ret = 0, l, i;
-
-        l = 80 - 2 - obase;
-
-        b = X509_NAME_oneline(name, NULL, 0);
-        if (b == NULL)
-                return 0;
-        if (*b == '\0') {
-                free(b);
-                return 1;
-        }
-        s = b + 1; /* skip the first slash */
-
-        c = s;
-        for (;;) {
-                if (((*s == '/') &&
-                    ((s[1] >= 'A') && (s[1] <= 'Z') &&
-                    ((s[2] == '=') || ((s[2] >= 'A') && (s[2] <= 'Z') &&
-                    (s[3] == '='))))) || (*s == '\0')) {
-                        i = s - c;
-                        if (BIO_write(bp, c, i) != i)
-                                goto err;
-                        c = s + 1;      /* skip following slash */
-                        if (*s != '\0') {
-                                if (BIO_write(bp, ", ", 2) != 2)
-                                        goto err;
-                        }
-                        l--;
-                }
-                if (*s == '\0')
-                        break;
-                s++;
-                l--;
-        }
-
-        ret = 1;
-        if (0) {
-err:
-                X509err(X509_F_X509_NAME_PRINT, ERR_R_BUF_LIB);
-        }
-        free(b);
-        return (ret);
-}
diff --git a/src/lib/libcrypto/asn1/t_x509a.c b/src/lib/libcrypto/asn1/t_x509a.c
deleted file mode 100644
index fd68211b84..0000000000
--- a/src/lib/libcrypto/asn1/t_x509a.c
+++ /dev/null
@@ -1,118 +0,0 @@
-/* $OpenBSD: t_x509a.c,v 1.8 2014/07/11 08:44:47 jsing Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 1999.
- */
-/* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <stdio.h>
-
-#include <openssl/asn1.h>
-#include <openssl/evp.h>
-#include <openssl/x509.h>
-
-/* X509_CERT_AUX and string set routines
- */
-
-int
-X509_CERT_AUX_print(BIO *out, X509_CERT_AUX *aux, int indent)
-{
-        char oidstr[80], first;
-        int i;
-        if (!aux)
-                return 1;
-        if (aux->trust) {
-                first = 1;
-                BIO_printf(out, "%*sTrusted Uses:\n%*s",
-                    indent, "", indent + 2, "");
-                for (i = 0; i < sk_ASN1_OBJECT_num(aux->trust); i++) {
-                        if (!first)
-                                BIO_puts(out, ", ");
-                        else
-                                first = 0;
-                        OBJ_obj2txt(oidstr, sizeof oidstr,
-                            sk_ASN1_OBJECT_value(aux->trust, i), 0);
-                        BIO_puts(out, oidstr);
-                }
-                BIO_puts(out, "\n");
-        } else
-                BIO_printf(out, "%*sNo Trusted Uses.\n", indent, "");
-        if (aux->reject) {
-                first = 1;
-                BIO_printf(out, "%*sRejected Uses:\n%*s",
-                    indent, "", indent + 2, "");
-                for (i = 0; i < sk_ASN1_OBJECT_num(aux->reject); i++) {
-                        if (!first)
-                                BIO_puts(out, ", ");
-                        else
-                                first = 0;
-                        OBJ_obj2txt(oidstr, sizeof oidstr,
-                            sk_ASN1_OBJECT_value(aux->reject, i), 0);
-                        BIO_puts(out, oidstr);
-                }
-                BIO_puts(out, "\n");
-        } else
-                BIO_printf(out, "%*sNo Rejected Uses.\n", indent, "");
-        if (aux->alias)
-                BIO_printf(out, "%*sAlias: %s\n", indent, "",
-                    aux->alias->data);
-        if (aux->keyid) {
-                BIO_printf(out, "%*sKey Id: ", indent, "");
-                for (i = 0; i < aux->keyid->length; i++)
-                        BIO_printf(out, "%s%02X", i ? ":" : "",
-                            aux->keyid->data[i]);
-                BIO_write(out, "\n", 1);
-        }
-        return 1;
-}
diff --git a/src/lib/libcrypto/asn1/tasn_dec.c b/src/lib/libcrypto/asn1/tasn_dec.c
deleted file mode 100644
index f08514dc83..0000000000
--- a/src/lib/libcrypto/asn1/tasn_dec.c
+++ /dev/null
@@ -1,1184 +0,0 @@
-/* $OpenBSD: tasn_dec.c,v 1.27 2015/07/20 15:41:48 miod Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 2000.
- */
-/* ====================================================================
- * Copyright (c) 2000-2005 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-
-#include <stddef.h>
-#include <string.h>
-#include <openssl/asn1.h>
-#include <openssl/asn1t.h>
-#include <openssl/objects.h>
-#include <openssl/buffer.h>
-#include <openssl/err.h>
-
-static int asn1_check_eoc(const unsigned char **in, long len);
-static int asn1_find_end(const unsigned char **in, long len, char inf);
-
-static int asn1_collect(BUF_MEM *buf, const unsigned char **in, long len,
-    char inf, int tag, int aclass, int depth);
-
-static int collect_data(BUF_MEM *buf, const unsigned char **p, long plen);
-
-static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass,
-    char *inf, char *cst, const unsigned char **in, long len, int exptag,
-    int expclass, char opt, ASN1_TLC *ctx);
-
-static int asn1_template_ex_d2i(ASN1_VALUE **pval, const unsigned char **in,
-    long len, const ASN1_TEMPLATE *tt, char opt, ASN1_TLC *ctx);
-static int asn1_template_noexp_d2i(ASN1_VALUE **val, const unsigned char **in,
-    long len, const ASN1_TEMPLATE *tt, char opt, ASN1_TLC *ctx);
-static int asn1_d2i_ex_primitive(ASN1_VALUE **pval, const unsigned char **in,
-    long len, const ASN1_ITEM *it, int tag, int aclass, char opt,
-    ASN1_TLC *ctx);
-
-/* Table to convert tags to bit values, used for MSTRING type */
-static const unsigned long tag2bit[32] = {
-        0,      0,      0,      B_ASN1_BIT_STRING,      /* tags  0 -  3 */
-        B_ASN1_OCTET_STRING,    0,      0,              B_ASN1_UNKNOWN,/* tags  4- 7 */
-        B_ASN1_UNKNOWN, B_ASN1_UNKNOWN, B_ASN1_UNKNOWN, B_ASN1_UNKNOWN,/* tags  8-11 */
-        B_ASN1_UTF8STRING,B_ASN1_UNKNOWN,B_ASN1_UNKNOWN,B_ASN1_UNKNOWN,/* tags 12-15 */
-        B_ASN1_SEQUENCE,0,B_ASN1_NUMERICSTRING,B_ASN1_PRINTABLESTRING, /* tags 16-19 */
-        B_ASN1_T61STRING,B_ASN1_VIDEOTEXSTRING,B_ASN1_IA5STRING,       /* tags 20-22 */
-        B_ASN1_UTCTIME, B_ASN1_GENERALIZEDTIME,                        /* tags 23-24 */
-        B_ASN1_GRAPHICSTRING,B_ASN1_ISO64STRING,B_ASN1_GENERALSTRING,  /* tags 25-27 */
-        B_ASN1_UNIVERSALSTRING,B_ASN1_UNKNOWN,B_ASN1_BMPSTRING,B_ASN1_UNKNOWN, /* tags 28-31 */
-};
-
-unsigned long
-ASN1_tag2bit(int tag)
-{
-        if ((tag < 0) || (tag > 30))
-                return 0;
-        return tag2bit[tag];
-}
-
-/* Macro to initialize and invalidate the cache */
-
-#define asn1_tlc_clear(c)       if (c) (c)->valid = 0
-/* Version to avoid compiler warning about 'c' always non-NULL */
-#define asn1_tlc_clear_nc(c)    (c)->valid = 0
-
-/* Decode an ASN1 item, this currently behaves just
- * like a standard 'd2i' function. 'in' points to
- * a buffer to read the data from, in future we will
- * have more advanced versions that can input data
- * a piece at a time and this will simply be a special
- * case.
- */
-
-ASN1_VALUE *
-ASN1_item_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
-    const ASN1_ITEM *it)
-{
-        ASN1_TLC c;
-        ASN1_VALUE *ptmpval = NULL;
-
-        if (!pval)
-                pval = &ptmpval;
-        asn1_tlc_clear_nc(&c);
-        if (ASN1_item_ex_d2i(pval, in, len, it, -1, 0, 0, &c) > 0)
-                return *pval;
-        return NULL;
-}
-
-int
-ASN1_template_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
-    const ASN1_TEMPLATE *tt)
-{
-        ASN1_TLC c;
-
-        asn1_tlc_clear_nc(&c);
-        return asn1_template_ex_d2i(pval, in, len, tt, 0, &c);
-}
-
-
-/* Decode an item, taking care of IMPLICIT tagging, if any.
- * If 'opt' set and tag mismatch return -1 to handle OPTIONAL
- */
-
-int
-ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
-    const ASN1_ITEM *it, int tag, int aclass, char opt, ASN1_TLC *ctx)
-{
-        const ASN1_TEMPLATE *tt, *errtt = NULL;
-        const ASN1_EXTERN_FUNCS *ef;
-        const ASN1_AUX *aux = it->funcs;
-        ASN1_aux_cb *asn1_cb;
-        const unsigned char *p = NULL, *q;
-        unsigned char oclass;
-        char seq_eoc, seq_nolen, cst, isopt;
-        long tmplen;
-        int i;
-        int otag;
-        int ret = 0;
-        ASN1_VALUE **pchptr;
-
-        if (!pval)
-                return 0;
-
-        if (aux && aux->asn1_cb)
-                asn1_cb = aux->asn1_cb;
-        else
-                asn1_cb = 0;
-
-        switch (it->itype) {
-        case ASN1_ITYPE_PRIMITIVE:
-                if (it->templates) {
-                        /* tagging or OPTIONAL is currently illegal on an item
-                         * template because the flags can't get passed down.
-                         * In practice this isn't a problem: we include the
-                         * relevant flags from the item template in the
-                         * template itself.
-                         */
-                        if ((tag != -1) || opt) {
-                                ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
-                                    ASN1_R_ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE);
-                                goto err;
-                        }
-                        return asn1_template_ex_d2i(pval, in, len,
-                            it->templates, opt, ctx);
-                }
-                return asn1_d2i_ex_primitive(pval, in, len, it,
-                    tag, aclass, opt, ctx);
-                break;
-
-        case ASN1_ITYPE_MSTRING:
-                p = *in;
-                /* Just read in tag and class */
-                ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,
-                    &p, len, -1, 0, 1, ctx);
-                if (!ret) {
-                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
-                            ERR_R_NESTED_ASN1_ERROR);
-                        goto err;
-                }
-
-                /* Must be UNIVERSAL class */
-                if (oclass != V_ASN1_UNIVERSAL) {
-                        /* If OPTIONAL, assume this is OK */
-                        if (opt)
-                                return -1;
-                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
-                            ASN1_R_MSTRING_NOT_UNIVERSAL);
-                        goto err;
-                }
-                /* Check tag matches bit map */
-                if (!(ASN1_tag2bit(otag) & it->utype)) {
-                        /* If OPTIONAL, assume this is OK */
-                        if (opt)
-                                return -1;
-                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
-                            ASN1_R_MSTRING_WRONG_TAG);
-                        goto err;
-                }
-                return asn1_d2i_ex_primitive(pval, in, len,
-                    it, otag, 0, 0, ctx);
-
-        case ASN1_ITYPE_EXTERN:
-                /* Use new style d2i */
-                ef = it->funcs;
-                return ef->asn1_ex_d2i(pval, in, len,
-                    it, tag, aclass, opt, ctx);
-
-        case ASN1_ITYPE_CHOICE:
-                if (asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it, NULL))
-                        goto auxerr;
-
-                if (*pval) {
-                        /* Free up and zero CHOICE value if initialised */
-                        i = asn1_get_choice_selector(pval, it);
-                        if ((i >= 0) && (i < it->tcount)) {
-                                tt = it->templates + i;
-                                pchptr = asn1_get_field_ptr(pval, tt);
-                                ASN1_template_free(pchptr, tt);
-                                asn1_set_choice_selector(pval, -1, it);
-                        }
-                } else if (!ASN1_item_ex_new(pval, it)) {
-                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
-                            ERR_R_NESTED_ASN1_ERROR);
-                        goto err;
-                }
-                /* CHOICE type, try each possibility in turn */
-                p = *in;
-                for (i = 0, tt = it->templates; i < it->tcount; i++, tt++) {
-                        pchptr = asn1_get_field_ptr(pval, tt);
-                        /* We mark field as OPTIONAL so its absence
-                         * can be recognised.
-                         */
-                        ret = asn1_template_ex_d2i(pchptr, &p, len, tt, 1, ctx);
-                        /* If field not present, try the next one */
-                        if (ret == -1)
-                                continue;
-                        /* If positive return, read OK, break loop */
-                        if (ret > 0)
-                                break;
-                        /* Otherwise must be an ASN1 parsing error */
-                        errtt = tt;
-                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
-                            ERR_R_NESTED_ASN1_ERROR);
-                        goto err;
-                }
-
-                /* Did we fall off the end without reading anything? */
-                if (i == it->tcount) {
-                        /* If OPTIONAL, this is OK */
-                        if (opt) {
-                                /* Free and zero it */
-                                ASN1_item_ex_free(pval, it);
-                                return -1;
-                        }
-                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
-                            ASN1_R_NO_MATCHING_CHOICE_TYPE);
-                        goto err;
-                }
-
-                asn1_set_choice_selector(pval, i, it);
-                *in = p;
-                if (asn1_cb && !asn1_cb(ASN1_OP_D2I_POST, pval, it, NULL))
-                        goto auxerr;
-                return 1;
-
-        case ASN1_ITYPE_NDEF_SEQUENCE:
-        case ASN1_ITYPE_SEQUENCE:
-                p = *in;
-                tmplen = len;
-
-                /* If no IMPLICIT tagging set to SEQUENCE, UNIVERSAL */
-                if (tag == -1) {
-                        tag = V_ASN1_SEQUENCE;
-                        aclass = V_ASN1_UNIVERSAL;
-                }
-                /* Get SEQUENCE length and update len, p */
-                ret = asn1_check_tlen(&len, NULL, NULL, &seq_eoc, &cst,
-                    &p, len, tag, aclass, opt, ctx);
-                if (!ret) {
-                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
-                            ERR_R_NESTED_ASN1_ERROR);
-                        goto err;
-                } else if (ret == -1)
-                        return -1;
-                if (aux && (aux->flags & ASN1_AFLG_BROKEN)) {
-                        len = tmplen - (p - *in);
-                        seq_nolen = 1;
-                }
-                /* If indefinite we don't do a length check */
-                else
-                        seq_nolen = seq_eoc;
-                if (!cst) {
-                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
-                            ASN1_R_SEQUENCE_NOT_CONSTRUCTED);
-                        goto err;
-                }
-
-                if (!*pval && !ASN1_item_ex_new(pval, it)) {
-                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
-                            ERR_R_NESTED_ASN1_ERROR);
-                        goto err;
-                }
-
-                if (asn1_cb && !asn1_cb(ASN1_OP_D2I_PRE, pval, it, NULL))
-                        goto auxerr;
-
-                /* Free up and zero any ADB found */
-                for (i = 0, tt = it->templates; i < it->tcount; i++, tt++) {
-                        if (tt->flags & ASN1_TFLG_ADB_MASK) {
-                                const ASN1_TEMPLATE *seqtt;
-                                ASN1_VALUE **pseqval;
-                                seqtt = asn1_do_adb(pval, tt, 1);
-                                if (!seqtt)
-                                        goto err;
-                                pseqval = asn1_get_field_ptr(pval, seqtt);
-                                ASN1_template_free(pseqval, seqtt);
-                        }
-                }
-
-                /* Get each field entry */
-                for (i = 0, tt = it->templates; i < it->tcount; i++, tt++) {
-                        const ASN1_TEMPLATE *seqtt;
-                        ASN1_VALUE **pseqval;
-                        seqtt = asn1_do_adb(pval, tt, 1);
-                        if (!seqtt)
-                                goto err;
-                        pseqval = asn1_get_field_ptr(pval, seqtt);
-                        /* Have we ran out of data? */
-                        if (!len)
-                                break;
-                        q = p;
-                        if (asn1_check_eoc(&p, len)) {
-                                if (!seq_eoc) {
-                                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
-                                            ASN1_R_UNEXPECTED_EOC);
-                                        goto err;
-                                }
-                                len -= p - q;
-                                seq_eoc = 0;
-                                q = p;
-                                break;
-                        }
-                        /* This determines the OPTIONAL flag value. The field
-                         * cannot be omitted if it is the last of a SEQUENCE
-                         * and there is still data to be read. This isn't
-                         * strictly necessary but it increases efficiency in
-                         * some cases.
-                         */
-                        if (i == (it->tcount - 1))
-                                isopt = 0;
-                        else
-                                isopt = (char)(seqtt->flags & ASN1_TFLG_OPTIONAL);
-                        /* attempt to read in field, allowing each to be
-                         * OPTIONAL */
-
-                        ret = asn1_template_ex_d2i(pseqval, &p, len,
-                            seqtt, isopt, ctx);
-                        if (!ret) {
-                                errtt = seqtt;
-                                goto err;
-                        } else if (ret == -1) {
-                                /* OPTIONAL component absent.
-                                 * Free and zero the field.
-                                 */
-                                ASN1_template_free(pseqval, seqtt);
-                                continue;
-                        }
-                        /* Update length */
-                        len -= p - q;
-                }
-
-                /* Check for EOC if expecting one */
-                if (seq_eoc && !asn1_check_eoc(&p, len)) {
-                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ASN1_R_MISSING_EOC);
-                        goto err;
-                }
-                /* Check all data read */
-                if (!seq_nolen && len) {
-                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
-                            ASN1_R_SEQUENCE_LENGTH_MISMATCH);
-                        goto err;
-                }
-
-                /* If we get here we've got no more data in the SEQUENCE,
-                 * however we may not have read all fields so check all
-                 * remaining are OPTIONAL and clear any that are.
-                 */
-                for (; i < it->tcount; tt++, i++) {
-                        const ASN1_TEMPLATE *seqtt;
-                        seqtt = asn1_do_adb(pval, tt, 1);
-                        if (!seqtt)
-                                goto err;
-                        if (seqtt->flags & ASN1_TFLG_OPTIONAL) {
-                                ASN1_VALUE **pseqval;
-                                pseqval = asn1_get_field_ptr(pval, seqtt);
-                                ASN1_template_free(pseqval, seqtt);
-                        } else {
-                                errtt = seqtt;
-                                ASN1err(ASN1_F_ASN1_ITEM_EX_D2I,
-                                    ASN1_R_FIELD_MISSING);
-                                goto err;
-                        }
-                }
-                /* Save encoding */
-                if (!asn1_enc_save(pval, *in, p - *in, it)) {
-                        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ERR_R_MALLOC_FAILURE);
-                        goto auxerr;
-                }
-                *in = p;
-                if (asn1_cb && !asn1_cb(ASN1_OP_D2I_POST, pval, it, NULL))
-                        goto auxerr;
-                return 1;
-
-        default:
-                return 0;
-        }
-
-auxerr:
-        ASN1err(ASN1_F_ASN1_ITEM_EX_D2I, ASN1_R_AUX_ERROR);
-err:
-        ASN1_item_ex_free(pval, it);
-        if (errtt)
-                ERR_asprintf_error_data("Field=%s, Type=%s", errtt->field_name,
-                    it->sname);
-        else
-                ERR_asprintf_error_data("Type=%s", it->sname);
-        return 0;
-}
-
-/* Templates are handled with two separate functions.
- * One handles any EXPLICIT tag and the other handles the rest.
- */
-
-static int
-asn1_template_ex_d2i(ASN1_VALUE **val, const unsigned char **in, long inlen,
-    const ASN1_TEMPLATE *tt, char opt, ASN1_TLC *ctx)
-{
-        int flags, aclass;
-        int ret;
-        long len;
-        const unsigned char *p, *q;
-        char exp_eoc;
-
-        if (!val)
-                return 0;
-        flags = tt->flags;
-        aclass = flags & ASN1_TFLG_TAG_CLASS;
-
-        p = *in;
-
-        /* Check if EXPLICIT tag expected */
-        if (flags & ASN1_TFLG_EXPTAG) {
-                char cst;
-                /* Need to work out amount of data available to the inner
-                 * content and where it starts: so read in EXPLICIT header to
-                 * get the info.
-                 */
-                ret = asn1_check_tlen(&len, NULL, NULL, &exp_eoc, &cst,
-                    &p, inlen, tt->tag, aclass, opt, ctx);
-                q = p;
-                if (!ret) {
-                        ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I,
-                            ERR_R_NESTED_ASN1_ERROR);
-                        return 0;
-                } else if (ret == -1)
-                        return -1;
-                if (!cst) {
-                        ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I,
-                            ASN1_R_EXPLICIT_TAG_NOT_CONSTRUCTED);
-                        return 0;
-                }
-                /* We've found the field so it can't be OPTIONAL now */
-                ret = asn1_template_noexp_d2i(val, &p, len, tt, 0, ctx);
-                if (!ret) {
-                        ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I,
-                            ERR_R_NESTED_ASN1_ERROR);
-                        return 0;
-                }
-                /* We read the field in OK so update length */
-                len -= p - q;
-                if (exp_eoc) {
-                        /* If NDEF we must have an EOC here */
-                        if (!asn1_check_eoc(&p, len)) {
-                                ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I,
-                                    ASN1_R_MISSING_EOC);
-                                goto err;
-                        }
-                } else {
-                        /* Otherwise we must hit the EXPLICIT tag end or its
-                         * an error */
-                        if (len) {
-                                ASN1err(ASN1_F_ASN1_TEMPLATE_EX_D2I,
-                                    ASN1_R_EXPLICIT_LENGTH_MISMATCH);
-                                goto err;
-                        }
-                }
-        } else
-                return asn1_template_noexp_d2i(val, in, inlen, tt, opt, ctx);
-
-        *in = p;
-        return 1;
-
-err:
-        ASN1_template_free(val, tt);
-        return 0;
-}
-
-static int
-asn1_template_noexp_d2i(ASN1_VALUE **val, const unsigned char **in, long len,
-    const ASN1_TEMPLATE *tt, char opt, ASN1_TLC *ctx)
-{
-        int flags, aclass;
-        int ret;
-        const unsigned char *p, *q;
-
-        if (!val)
-                return 0;
-        flags = tt->flags;
-        aclass = flags & ASN1_TFLG_TAG_CLASS;
-
-        p = *in;
-        q = p;
-
-        if (flags & ASN1_TFLG_SK_MASK) {
-                /* SET OF, SEQUENCE OF */
-                int sktag, skaclass;
-                char sk_eoc;
-                /* First work out expected inner tag value */
-                if (flags & ASN1_TFLG_IMPTAG) {
-                        sktag = tt->tag;
-                        skaclass = aclass;
-                } else {
-                        skaclass = V_ASN1_UNIVERSAL;
-                        if (flags & ASN1_TFLG_SET_OF)
-                                sktag = V_ASN1_SET;
-                        else
-                                sktag = V_ASN1_SEQUENCE;
-                }
-                /* Get the tag */
-                ret = asn1_check_tlen(&len, NULL, NULL, &sk_eoc, NULL,
-                    &p, len, sktag, skaclass, opt, ctx);
-                if (!ret) {
-                        ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I,
-                            ERR_R_NESTED_ASN1_ERROR);
-                        return 0;
-                } else if (ret == -1)
-                        return -1;
-                if (!*val)
-                        *val = (ASN1_VALUE *)sk_new_null();
-                else {
-                        /* We've got a valid STACK: free up any items present */
-                        STACK_OF(ASN1_VALUE) *sktmp =
-                            (STACK_OF(ASN1_VALUE) *)*val;
-                        ASN1_VALUE *vtmp;
-                        while (sk_ASN1_VALUE_num(sktmp) > 0) {
-                                vtmp = sk_ASN1_VALUE_pop(sktmp);
-                                ASN1_item_ex_free(&vtmp,
-                                    ASN1_ITEM_ptr(tt->item));
-                        }
-                }
-
-                if (!*val) {
-                        ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I,
-                            ERR_R_MALLOC_FAILURE);
-                        goto err;
-                }
-
-                /* Read as many items as we can */
-                while (len > 0) {
-                        ASN1_VALUE *skfield;
-                        q = p;
-                        /* See if EOC found */
-                        if (asn1_check_eoc(&p, len)) {
-                                if (!sk_eoc) {
-                                        ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I,
-                                            ASN1_R_UNEXPECTED_EOC);
-                                        goto err;
-                                }
-                                len -= p - q;
-                                sk_eoc = 0;
-                                break;
-                        }
-                        skfield = NULL;
-                        if (!ASN1_item_ex_d2i(&skfield, &p, len,
-                            ASN1_ITEM_ptr(tt->item), -1, 0, 0, ctx)) {
-                                ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I,
-                                    ERR_R_NESTED_ASN1_ERROR);
-                                goto err;
-                        }
-                        len -= p - q;
-                        if (!sk_ASN1_VALUE_push((STACK_OF(ASN1_VALUE) *)*val,
-                            skfield)) {
-                                ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I,
-                                    ERR_R_MALLOC_FAILURE);
-                                goto err;
-                        }
-                }
-                if (sk_eoc) {
-                        ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I,
-                            ASN1_R_MISSING_EOC);
-                        goto err;
-                }
-        } else if (flags & ASN1_TFLG_IMPTAG) {
-                /* IMPLICIT tagging */
-                ret = ASN1_item_ex_d2i(val, &p, len,
-                    ASN1_ITEM_ptr(tt->item), tt->tag, aclass, opt, ctx);
-                if (!ret) {
-                        ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I,
-                            ERR_R_NESTED_ASN1_ERROR);
-                        goto err;
-                } else if (ret == -1)
-                        return -1;
-        } else {
-                /* Nothing special */
-                ret = ASN1_item_ex_d2i(val, &p, len, ASN1_ITEM_ptr(tt->item),
-                    -1, 0, opt, ctx);
-                if (!ret) {
-                        ASN1err(ASN1_F_ASN1_TEMPLATE_NOEXP_D2I,
-                            ERR_R_NESTED_ASN1_ERROR);
-                        goto err;
-                } else if (ret == -1)
-                        return -1;
-        }
-
-        *in = p;
-        return 1;
-
-err:
-        ASN1_template_free(val, tt);
-        return 0;
-}
-
-static int
-asn1_d2i_ex_primitive(ASN1_VALUE **pval, const unsigned char **in, long inlen,
-    const ASN1_ITEM *it, int tag, int aclass, char opt, ASN1_TLC *ctx)
-{
-        int ret = 0, utype;
-        long plen;
-        char cst, inf, free_cont = 0;
-        const unsigned char *p;
-        BUF_MEM buf;
-        const unsigned char *cont = NULL;
-        long len;
-
-        if (!pval) {
-                ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ASN1_R_ILLEGAL_NULL);
-                return 0; /* Should never happen */
-        }
-
-        if (it->itype == ASN1_ITYPE_MSTRING) {
-                utype = tag;
-                tag = -1;
-        } else
-                utype = it->utype;
-
-        if (utype == V_ASN1_ANY) {
-                /* If type is ANY need to figure out type from tag */
-                unsigned char oclass;
-                if (tag >= 0) {
-                        ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE,
-                            ASN1_R_ILLEGAL_TAGGED_ANY);
-                        return 0;
-                }
-                if (opt) {
-                        ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE,
-                            ASN1_R_ILLEGAL_OPTIONAL_ANY);
-                        return 0;
-                }
-                p = *in;
-                ret = asn1_check_tlen(NULL, &utype, &oclass, NULL, NULL,
-                    &p, inlen, -1, 0, 0, ctx);
-                if (!ret) {
-                        ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE,
-                            ERR_R_NESTED_ASN1_ERROR);
-                        return 0;
-                }
-                if (oclass != V_ASN1_UNIVERSAL)
-                        utype = V_ASN1_OTHER;
-        }
-        if (tag == -1) {
-                tag = utype;
-                aclass = V_ASN1_UNIVERSAL;
-        }
-        p = *in;
-        /* Check header */
-        ret = asn1_check_tlen(&plen, NULL, NULL, &inf, &cst,
-            &p, inlen, tag, aclass, opt, ctx);
-        if (!ret) {
-                ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE, ERR_R_NESTED_ASN1_ERROR);
-                return 0;
-        } else if (ret == -1)
-                return -1;
-        ret = 0;
-        /* SEQUENCE, SET and "OTHER" are left in encoded form */
-        if ((utype == V_ASN1_SEQUENCE) || (utype == V_ASN1_SET) ||
-            (utype == V_ASN1_OTHER)) {
-                /* Clear context cache for type OTHER because the auto clear
-                 * when we have a exact match wont work
-                 */
-                if (utype == V_ASN1_OTHER) {
-                        asn1_tlc_clear(ctx);
-                }
-                /* SEQUENCE and SET must be constructed */
-                else if (!cst) {
-                        ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE,
-                            ASN1_R_TYPE_NOT_CONSTRUCTED);
-                        return 0;
-                }
-
-                cont = *in;
-                /* If indefinite length constructed find the real end */
-                if (inf) {
-                        if (!asn1_find_end(&p, plen, inf))
-                                goto err;
-                        len = p - cont;
-                } else {
-                        len = p - cont + plen;
-                        p += plen;
-                        buf.data = NULL;
-                }
-        } else if (cst) {
-                buf.length = 0;
-                buf.max = 0;
-                buf.data = NULL;
-                /* Should really check the internal tags are correct but
-                 * some things may get this wrong. The relevant specs
-                 * say that constructed string types should be OCTET STRINGs
-                 * internally irrespective of the type. So instead just check
-                 * for UNIVERSAL class and ignore the tag.
-                 */
-                if (!asn1_collect(&buf, &p, plen, inf, -1, V_ASN1_UNIVERSAL, 0)) {
-                        free_cont = 1;
-                        goto err;
-                }
-                len = buf.length;
-                /* Append a final null to string */
-                if (!BUF_MEM_grow_clean(&buf, len + 1)) {
-                        ASN1err(ASN1_F_ASN1_D2I_EX_PRIMITIVE,
-                            ERR_R_MALLOC_FAILURE);
-                        return 0;
-                }
-                buf.data[len] = 0;
-                cont = (const unsigned char *)buf.data;
-                free_cont = 1;
-        } else {
-                cont = p;
-                len = plen;
-                p += plen;
-        }
-
-        /* We now have content length and type: translate into a structure */
-        if (!asn1_ex_c2i(pval, cont, len, utype, &free_cont, it))
-                goto err;
-
-        *in = p;
-        ret = 1;
-
-err:
-        if (free_cont && buf.data)
-                free(buf.data);
-        return ret;
-}
-
-/* Translate ASN1 content octets into a structure */
-
-int
-asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len, int utype,
-    char *free_cont, const ASN1_ITEM *it)
-{
-        ASN1_VALUE **opval = NULL;
-        ASN1_STRING *stmp;
-        ASN1_TYPE *typ = NULL;
-        int ret = 0;
-        const ASN1_PRIMITIVE_FUNCS *pf;
-        ASN1_INTEGER **tint;
-
-        pf = it->funcs;
-
-        if (pf && pf->prim_c2i)
-                return pf->prim_c2i(pval, cont, len, utype, free_cont, it);
-        /* If ANY type clear type and set pointer to internal value */
-        if (it->utype == V_ASN1_ANY) {
-                if (!*pval) {
-                        typ = ASN1_TYPE_new();
-                        if (typ == NULL)
-                                goto err;
-                        *pval = (ASN1_VALUE *)typ;
-                } else
-                        typ = (ASN1_TYPE *)*pval;
-
-                if (utype != typ->type)
-                        ASN1_TYPE_set(typ, utype, NULL);
-                opval = pval;
-                pval = &typ->value.asn1_value;
-        }
-        switch (utype) {
-        case V_ASN1_OBJECT:
-                if (!c2i_ASN1_OBJECT((ASN1_OBJECT **)pval, &cont, len))
-                        goto err;
-                break;
-
-        case V_ASN1_NULL:
-                if (len) {
-                        ASN1err(ASN1_F_ASN1_EX_C2I,
-                            ASN1_R_NULL_IS_WRONG_LENGTH);
-                        goto err;
-                }
-                *pval = (ASN1_VALUE *)1;
-                break;
-
-        case V_ASN1_BOOLEAN:
-                if (len != 1) {
-                        ASN1err(ASN1_F_ASN1_EX_C2I,
-                            ASN1_R_BOOLEAN_IS_WRONG_LENGTH);
-                        goto err;
-                } else {
-                        ASN1_BOOLEAN *tbool;
-                        tbool = (ASN1_BOOLEAN *)pval;
-                        *tbool = *cont;
-                }
-                break;
-
-        case V_ASN1_BIT_STRING:
-                if (!c2i_ASN1_BIT_STRING((ASN1_BIT_STRING **)pval, &cont, len))
-                        goto err;
-                break;
-
-        case V_ASN1_INTEGER:
-        case V_ASN1_NEG_INTEGER:
-        case V_ASN1_ENUMERATED:
-        case V_ASN1_NEG_ENUMERATED:
-                tint = (ASN1_INTEGER **)pval;
-                if (!c2i_ASN1_INTEGER(tint, &cont, len))
-                        goto err;
-                /* Fixup type to match the expected form */
-                (*tint)->type = utype | ((*tint)->type & V_ASN1_NEG);
-                break;
-
-        case V_ASN1_OCTET_STRING:
-        case V_ASN1_NUMERICSTRING:
-        case V_ASN1_PRINTABLESTRING:
-        case V_ASN1_T61STRING:
-        case V_ASN1_VIDEOTEXSTRING:
-        case V_ASN1_IA5STRING:
-        case V_ASN1_UTCTIME:
-        case V_ASN1_GENERALIZEDTIME:
-        case V_ASN1_GRAPHICSTRING:
-        case V_ASN1_VISIBLESTRING:
-        case V_ASN1_GENERALSTRING:
-        case V_ASN1_UNIVERSALSTRING:
-        case V_ASN1_BMPSTRING:
-        case V_ASN1_UTF8STRING:
-        case V_ASN1_OTHER:
-        case V_ASN1_SET:
-        case V_ASN1_SEQUENCE:
-        default:
-                if (utype == V_ASN1_BMPSTRING && (len & 1)) {
-                        ASN1err(ASN1_F_ASN1_EX_C2I,
-                            ASN1_R_BMPSTRING_IS_WRONG_LENGTH);
-                        goto err;
-                }
-                if (utype == V_ASN1_UNIVERSALSTRING && (len & 3)) {
-                        ASN1err(ASN1_F_ASN1_EX_C2I,
-                            ASN1_R_UNIVERSALSTRING_IS_WRONG_LENGTH);
-                        goto err;
-                }
-                /* All based on ASN1_STRING and handled the same */
-                if (!*pval) {
-                        stmp = ASN1_STRING_type_new(utype);
-                        if (!stmp) {
-                                ASN1err(ASN1_F_ASN1_EX_C2I,
-                                    ERR_R_MALLOC_FAILURE);
-                                goto err;
-                        }
-                        *pval = (ASN1_VALUE *)stmp;
-                } else {
-                        stmp = (ASN1_STRING *)*pval;
-                        stmp->type = utype;
-                }
-                /* If we've already allocated a buffer use it */
-                if (*free_cont) {
-                        free(stmp->data);
-                        stmp->data = (unsigned char *)cont; /* UGLY CAST! RL */
-                        stmp->length = len;
-                        *free_cont = 0;
-                } else {
-                        if (!ASN1_STRING_set(stmp, cont, len)) {
-                                ASN1err(ASN1_F_ASN1_EX_C2I,
-                                    ERR_R_MALLOC_FAILURE);
-                                ASN1_STRING_free(stmp);
-                                *pval = NULL;
-                                goto err;
-                        }
-                }
-                break;
-        }
-        /* If ASN1_ANY and NULL type fix up value */
-        if (typ && (utype == V_ASN1_NULL))
-                typ->value.ptr = NULL;
-
-        ret = 1;
-
-err:
-        if (!ret) {
-                ASN1_TYPE_free(typ);
-                if (opval)
-                        *opval = NULL;
-        }
-        return ret;
-}
-
-
-/* This function finds the end of an ASN1 structure when passed its maximum
- * length, whether it is indefinite length and a pointer to the content.
- * This is more efficient than calling asn1_collect because it does not
- * recurse on each indefinite length header.
- */
-
-static int
-asn1_find_end(const unsigned char **in, long len, char inf)
-{
-        int expected_eoc;
-        long plen;
-        const unsigned char *p = *in, *q;
-
-        /* If not indefinite length constructed just add length */
-        if (inf == 0) {
-                *in += len;
-                return 1;
-        }
-        expected_eoc = 1;
-        /* Indefinite length constructed form. Find the end when enough EOCs
-         * are found. If more indefinite length constructed headers
-         * are encountered increment the expected eoc count otherwise just
-         * skip to the end of the data.
-         */
-        while (len > 0) {
-                if (asn1_check_eoc(&p, len)) {
-                        expected_eoc--;
-                        if (expected_eoc == 0)
-                                break;
-                        len -= 2;
-                        continue;
-                }
-                q = p;
-                /* Just read in a header: only care about the length */
-                if (!asn1_check_tlen(&plen, NULL, NULL, &inf, NULL, &p, len,
-                    -1, 0, 0, NULL)) {
-                        ASN1err(ASN1_F_ASN1_FIND_END, ERR_R_NESTED_ASN1_ERROR);
-                        return 0;
-                }
-                if (inf)
-                        expected_eoc++;
-                else
-                        p += plen;
-                len -= p - q;
-        }
-        if (expected_eoc) {
-                ASN1err(ASN1_F_ASN1_FIND_END, ASN1_R_MISSING_EOC);
-                return 0;
-        }
-        *in = p;
-        return 1;
-}
-/* This function collects the asn1 data from a constructred string
- * type into a buffer. The values of 'in' and 'len' should refer
- * to the contents of the constructed type and 'inf' should be set
- * if it is indefinite length.
- */
-
-#ifndef ASN1_MAX_STRING_NEST
-/* This determines how many levels of recursion are permitted in ASN1
- * string types. If it is not limited stack overflows can occur. If set
- * to zero no recursion is allowed at all. Although zero should be adequate
- * examples exist that require a value of 1. So 5 should be more than enough.
- */
-#define ASN1_MAX_STRING_NEST 5
-#endif
-
-static int
-asn1_collect(BUF_MEM *buf, const unsigned char **in, long len, char inf,
-    int tag, int aclass, int depth)
-{
-        const unsigned char *p, *q;
-        long plen;
-        char cst, ininf;
-
-        p = *in;
-        inf &= 1;
-        /* If no buffer and not indefinite length constructed just pass over
-         * the encoded data */
-        if (!buf && !inf) {
-                *in += len;
-                return 1;
-        }
-        while (len > 0) {
-                q = p;
-                /* Check for EOC */
-                if (asn1_check_eoc(&p, len)) {
-                        /* EOC is illegal outside indefinite length
-                         * constructed form */
-                        if (!inf) {
-                                ASN1err(ASN1_F_ASN1_COLLECT,
-                                    ASN1_R_UNEXPECTED_EOC);
-                                return 0;
-                        }
-                        inf = 0;
-                        break;
-                }
-
-                if (!asn1_check_tlen(&plen, NULL, NULL, &ininf, &cst, &p,
-                    len, tag, aclass, 0, NULL)) {
-                        ASN1err(ASN1_F_ASN1_COLLECT, ERR_R_NESTED_ASN1_ERROR);
-                        return 0;
-                }
-
-                /* If indefinite length constructed update max length */
-                if (cst) {
-                        if (depth >= ASN1_MAX_STRING_NEST) {
-                                ASN1err(ASN1_F_ASN1_COLLECT,
-                                    ASN1_R_NESTED_ASN1_STRING);
-                                return 0;
-                        }
-                        if (!asn1_collect(buf, &p, plen, ininf, tag, aclass,
-                            depth + 1))
-                                return 0;
-                } else if (plen && !collect_data(buf, &p, plen))
-                        return 0;
-                len -= p - q;
-        }
-        if (inf) {
-                ASN1err(ASN1_F_ASN1_COLLECT, ASN1_R_MISSING_EOC);
-                return 0;
-        }
-        *in = p;
-        return 1;
-}
-
-static int
-collect_data(BUF_MEM *buf, const unsigned char **p, long plen)
-{
-        int len;
-        if (buf) {
-                len = buf->length;
-                if (!BUF_MEM_grow_clean(buf, len + plen)) {
-                        ASN1err(ASN1_F_COLLECT_DATA, ERR_R_MALLOC_FAILURE);
-                        return 0;
-                }
-                memcpy(buf->data + len, *p, plen);
-        }
-        *p += plen;
-        return 1;
-}
-
-/* Check for ASN1 EOC and swallow it if found */
-
-static int
-asn1_check_eoc(const unsigned char **in, long len)
-{
-        const unsigned char *p;
-
-        if (len < 2)
-                return 0;
-        p = *in;
-        if (!p[0] && !p[1]) {
-                *in += 2;
-                return 1;
-        }
-        return 0;
-}
-
-/* Check an ASN1 tag and length: a bit like ASN1_get_object
- * but it sets the length for indefinite length constructed
- * form, we don't know the exact length but we can set an
- * upper bound to the amount of data available minus the
- * header length just read.
- */
-
-static int
-asn1_check_tlen(long *olen, int *otag, unsigned char *oclass, char *inf,
-    char *cst, const unsigned char **in, long len, int exptag, int expclass,
-    char opt, ASN1_TLC *ctx)
-{
-        int i;
-        int ptag, pclass;
-        long plen;
-        const unsigned char *p, *q;
-
-        p = *in;
-        q = p;
-
-        if (ctx && ctx->valid) {
-                i = ctx->ret;
-                plen = ctx->plen;
-                pclass = ctx->pclass;
-                ptag = ctx->ptag;
-                p += ctx->hdrlen;
-        } else {
-                i = ASN1_get_object(&p, &plen, &ptag, &pclass, len);
-                if (ctx) {
-                        ctx->ret = i;
-                        ctx->plen = plen;
-                        ctx->pclass = pclass;
-                        ctx->ptag = ptag;
-                        ctx->hdrlen = p - q;
-                        ctx->valid = 1;
-                        /* If definite length, and no error, length +
-                         * header can't exceed total amount of data available.
-                         */
-                        if (!(i & 0x81) && ((plen + ctx->hdrlen) > len)) {
-                                ASN1err(ASN1_F_ASN1_CHECK_TLEN,
-                                    ASN1_R_TOO_LONG);
-                                asn1_tlc_clear(ctx);
-                                return 0;
-                        }
-                }
-        }
-
-        if (i & 0x80) {
-                ASN1err(ASN1_F_ASN1_CHECK_TLEN, ASN1_R_BAD_OBJECT_HEADER);
-                asn1_tlc_clear(ctx);
-                return 0;
-        }
-        if (exptag >= 0) {
-                if ((exptag != ptag) || (expclass != pclass)) {
-                        /* If type is OPTIONAL, not an error:
-                         * indicate missing type.
-                         */
-                        if (opt)
-                                return -1;
-                        asn1_tlc_clear(ctx);
-                        ASN1err(ASN1_F_ASN1_CHECK_TLEN, ASN1_R_WRONG_TAG);
-                        return 0;
-                }
-                /* We have a tag and class match:
-                 * assume we are going to do something with it */
-                asn1_tlc_clear(ctx);
-        }
-
-        if (i & 1)
-                plen = len - (p - q);
-        if (inf)
-                *inf = i & 1;
-        if (cst)
-                *cst = i & V_ASN1_CONSTRUCTED;
-        if (olen)
-                *olen = plen;
-        if (oclass)
-                *oclass = pclass;
-        if (otag)
-                *otag = ptag;
-
-        *in = p;
-        return 1;
-}
diff --git a/src/lib/libcrypto/asn1/tasn_enc.c b/src/lib/libcrypto/asn1/tasn_enc.c
deleted file mode 100644
index c59033e54d..0000000000
--- a/src/lib/libcrypto/asn1/tasn_enc.c
+++ /dev/null
@@ -1,654 +0,0 @@
-/* $OpenBSD: tasn_enc.c,v 1.16 2015/02/14 15:23:57 miod Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 2000.
- */
-/* ====================================================================
- * Copyright (c) 2000-2004 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <stddef.h>
-#include <string.h>
-
-#include <openssl/asn1.h>
-#include <openssl/asn1t.h>
-#include <openssl/objects.h>
-
-static int asn1_i2d_ex_primitive(ASN1_VALUE **pval, unsigned char **out,
-    const ASN1_ITEM *it, int tag, int aclass);
-static int asn1_set_seq_out(STACK_OF(ASN1_VALUE) *sk, unsigned char **out,
-    int skcontlen, const ASN1_ITEM *item, int do_sort, int iclass);
-static int asn1_template_ex_i2d(ASN1_VALUE **pval, unsigned char **out,
-    const ASN1_TEMPLATE *tt, int tag, int aclass);
-static int asn1_item_flags_i2d(ASN1_VALUE *val, unsigned char **out,
-    const ASN1_ITEM *it, int flags);
-static int asn1_ex_i2c(ASN1_VALUE **pval, unsigned char *cout, int *putype,
-    const ASN1_ITEM *it);
-
-/* Top level i2d equivalents: the 'ndef' variant instructs the encoder
- * to use indefinite length constructed encoding, where appropriate
- */
-
-int
-ASN1_item_ndef_i2d(ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it)
-{
-        return asn1_item_flags_i2d(val, out, it, ASN1_TFLG_NDEF);
-}
-
-int
-ASN1_item_i2d(ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it)
-{
-        return asn1_item_flags_i2d(val, out, it, 0);
-}
-
-/* Encode an ASN1 item, this is use by the
- * standard 'i2d' function. 'out' points to
- * a buffer to output the data to.
- *
- * The new i2d has one additional feature. If the output
- * buffer is NULL (i.e. *out == NULL) then a buffer is
- * allocated and populated with the encoding.
- */
-
-static int
-asn1_item_flags_i2d(ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it,
-    int flags)
-{
-        if (out && !*out) {
-                unsigned char *p, *buf;
-                int len;
-                len = ASN1_item_ex_i2d(&val, NULL, it, -1, flags);
-                if (len <= 0)
-                        return len;
-                buf = malloc(len);
-                if (!buf)
-                        return -1;
-                p = buf;
-                ASN1_item_ex_i2d(&val, &p, it, -1, flags);
-                *out = buf;
-                return len;
-        }
-
-        return ASN1_item_ex_i2d(&val, out, it, -1, flags);
-}
-
-/* Encode an item, taking care of IMPLICIT tagging (if any).
- * This function performs the normal item handling: it can be
- * used in external types.
- */
-
-int
-ASN1_item_ex_i2d(ASN1_VALUE **pval, unsigned char **out, const ASN1_ITEM *it,
-    int tag, int aclass)
-{
-        const ASN1_TEMPLATE *tt = NULL;
-        int i, seqcontlen, seqlen, ndef = 1;
-        const ASN1_EXTERN_FUNCS *ef;
-        const ASN1_AUX *aux = it->funcs;
-        ASN1_aux_cb *asn1_cb = 0;
-
-        if ((it->itype != ASN1_ITYPE_PRIMITIVE) && !*pval)
-                return 0;
-
-        if (aux && aux->asn1_cb)
-                asn1_cb = aux->asn1_cb;
-
-        switch (it->itype) {
-
-        case ASN1_ITYPE_PRIMITIVE:
-                if (it->templates)
-                        return asn1_template_ex_i2d(pval, out, it->templates,
-                            tag, aclass);
-                return asn1_i2d_ex_primitive(pval, out, it, tag, aclass);
-                break;
-
-        case ASN1_ITYPE_MSTRING:
-                return asn1_i2d_ex_primitive(pval, out, it, -1, aclass);
-
-        case ASN1_ITYPE_CHOICE:
-                if (asn1_cb && !asn1_cb(ASN1_OP_I2D_PRE, pval, it, NULL))
-                        return 0;
-                i = asn1_get_choice_selector(pval, it);
-                if ((i >= 0) && (i < it->tcount)) {
-                        ASN1_VALUE **pchval;
-                        const ASN1_TEMPLATE *chtt;
-                        chtt = it->templates + i;
-                        pchval = asn1_get_field_ptr(pval, chtt);
-                        return asn1_template_ex_i2d(pchval, out, chtt,
-                            -1, aclass);
-                }
-                /* Fixme: error condition if selector out of range */
-                if (asn1_cb && !asn1_cb(ASN1_OP_I2D_POST, pval, it, NULL))
-                        return 0;
-                break;
-
-        case ASN1_ITYPE_EXTERN:
-                /* If new style i2d it does all the work */
-                ef = it->funcs;
-                return ef->asn1_ex_i2d(pval, out, it, tag, aclass);
-
-        case ASN1_ITYPE_NDEF_SEQUENCE:
-                /* Use indefinite length constructed if requested */
-                if (aclass & ASN1_TFLG_NDEF)
-                        ndef = 2;
-                /* fall through */
-
-        case ASN1_ITYPE_SEQUENCE:
-                i = asn1_enc_restore(&seqcontlen, out, pval, it);
-                /* An error occurred */
-                if (i < 0)
-                        return 0;
-                /* We have a valid cached encoding... */
-                if (i > 0)
-                        return seqcontlen;
-                /* Otherwise carry on */
-                seqcontlen = 0;
-                /* If no IMPLICIT tagging set to SEQUENCE, UNIVERSAL */
-                if (tag == -1) {
-                        tag = V_ASN1_SEQUENCE;
-                        /* Retain any other flags in aclass */
-                        aclass = (aclass & ~ASN1_TFLG_TAG_CLASS) |
-                            V_ASN1_UNIVERSAL;
-                }
-                if (asn1_cb && !asn1_cb(ASN1_OP_I2D_PRE, pval, it, NULL))
-                        return 0;
-                /* First work out sequence content length */
-                for (i = 0, tt = it->templates; i < it->tcount; tt++, i++) {
-                        const ASN1_TEMPLATE *seqtt;
-                        ASN1_VALUE **pseqval;
-                        seqtt = asn1_do_adb(pval, tt, 1);
-                        if (!seqtt)
-                                return 0;
-                        pseqval = asn1_get_field_ptr(pval, seqtt);
-                        /* FIXME: check for errors in enhanced version */
-                        seqcontlen += asn1_template_ex_i2d(pseqval, NULL, seqtt,
-                            -1, aclass);
-                }
-
-                seqlen = ASN1_object_size(ndef, seqcontlen, tag);
-                if (!out)
-                        return seqlen;
-                /* Output SEQUENCE header */
-                ASN1_put_object(out, ndef, seqcontlen, tag, aclass);
-                for (i = 0, tt = it->templates; i < it->tcount; tt++, i++) {
-                        const ASN1_TEMPLATE *seqtt;
-                        ASN1_VALUE **pseqval;
-                        seqtt = asn1_do_adb(pval, tt, 1);
-                        if (!seqtt)
-                                return 0;
-                        pseqval = asn1_get_field_ptr(pval, seqtt);
-                        /* FIXME: check for errors in enhanced version */
-                        asn1_template_ex_i2d(pseqval, out, seqtt, -1, aclass);
-                }
-                if (ndef == 2)
-                        ASN1_put_eoc(out);
-                if (asn1_cb && !asn1_cb(ASN1_OP_I2D_POST, pval, it, NULL))
-                        return 0;
-                return seqlen;
-
-        default:
-                return 0;
-
-        }
-        return 0;
-}
-
-int
-ASN1_template_i2d(ASN1_VALUE **pval, unsigned char **out,
-    const ASN1_TEMPLATE *tt)
-{
-        return asn1_template_ex_i2d(pval, out, tt, -1, 0);
-}
-
-static int
-asn1_template_ex_i2d(ASN1_VALUE **pval, unsigned char **out,
-    const ASN1_TEMPLATE *tt, int tag, int iclass)
-{
-        int i, ret, flags, ttag, tclass, ndef;
-        flags = tt->flags;
-        /* Work out tag and class to use: tagging may come
-         * either from the template or the arguments, not both
-         * because this would create ambiguity. Additionally
-         * the iclass argument may contain some additional flags
-         * which should be noted and passed down to other levels.
-         */
-        if (flags & ASN1_TFLG_TAG_MASK) {
-                /* Error if argument and template tagging */
-                if (tag != -1)
-                        /* FIXME: error code here */
-                        return -1;
-                /* Get tagging from template */
-                ttag = tt->tag;
-                tclass = flags & ASN1_TFLG_TAG_CLASS;
-        } else if (tag != -1) {
-                /* No template tagging, get from arguments */
-                ttag = tag;
-                tclass = iclass & ASN1_TFLG_TAG_CLASS;
-        } else {
-                ttag = -1;
-                tclass = 0;
-        }
-        /*
-         * Remove any class mask from iflag.
-         */
-        iclass &= ~ASN1_TFLG_TAG_CLASS;
-
-        /* At this point 'ttag' contains the outer tag to use,
-         * 'tclass' is the class and iclass is any flags passed
-         * to this function.
-         */
-
-        /* if template and arguments require ndef, use it */
-        if ((flags & ASN1_TFLG_NDEF) && (iclass & ASN1_TFLG_NDEF))
-                ndef = 2;
-        else
-                ndef = 1;
-
-        if (flags & ASN1_TFLG_SK_MASK) {
-                /* SET OF, SEQUENCE OF */
-                STACK_OF(ASN1_VALUE) *sk = (STACK_OF(ASN1_VALUE) *)*pval;
-                int isset, sktag, skaclass;
-                int skcontlen, sklen;
-                ASN1_VALUE *skitem;
-
-                if (!*pval)
-                        return 0;
-
-                if (flags & ASN1_TFLG_SET_OF) {
-                        isset = 1;
-                        /* 2 means we reorder */
-                        if (flags & ASN1_TFLG_SEQUENCE_OF)
-                                isset = 2;
-                } else
-                        isset = 0;
-
-                /* Work out inner tag value: if EXPLICIT
-                 * or no tagging use underlying type.
-                 */
-                if ((ttag != -1) && !(flags & ASN1_TFLG_EXPTAG)) {
-                        sktag = ttag;
-                        skaclass = tclass;
-                } else {
-                        skaclass = V_ASN1_UNIVERSAL;
-                        if (isset)
-                                sktag = V_ASN1_SET;
-                        else
-                                sktag = V_ASN1_SEQUENCE;
-                }
-
-                /* Determine total length of items */
-                skcontlen = 0;
-                for (i = 0; i < sk_ASN1_VALUE_num(sk); i++) {
-                        skitem = sk_ASN1_VALUE_value(sk, i);
-                        skcontlen += ASN1_item_ex_i2d(&skitem, NULL,
-                            ASN1_ITEM_ptr(tt->item), -1, iclass);
-                }
-                sklen = ASN1_object_size(ndef, skcontlen, sktag);
-                /* If EXPLICIT need length of surrounding tag */
-                if (flags & ASN1_TFLG_EXPTAG)
-                        ret = ASN1_object_size(ndef, sklen, ttag);
-                else
-                        ret = sklen;
-
-                if (!out)
-                        return ret;
-
-                /* Now encode this lot... */
-                /* EXPLICIT tag */
-                if (flags & ASN1_TFLG_EXPTAG)
-                        ASN1_put_object(out, ndef, sklen, ttag, tclass);
-                /* SET or SEQUENCE and IMPLICIT tag */
-                ASN1_put_object(out, ndef, skcontlen, sktag, skaclass);
-                /* And the stuff itself */
-                asn1_set_seq_out(sk, out, skcontlen, ASN1_ITEM_ptr(tt->item),
-                    isset, iclass);
-                if (ndef == 2) {
-                        ASN1_put_eoc(out);
-                        if (flags & ASN1_TFLG_EXPTAG)
-                                ASN1_put_eoc(out);
-                }
-
-                return ret;
-        }
-
-        if (flags & ASN1_TFLG_EXPTAG) {
-                /* EXPLICIT tagging */
-                /* Find length of tagged item */
-                i = ASN1_item_ex_i2d(pval, NULL, ASN1_ITEM_ptr(tt->item),
-                    -1, iclass);
-                if (!i)
-                        return 0;
-                /* Find length of EXPLICIT tag */
-                ret = ASN1_object_size(ndef, i, ttag);
-                if (out) {
-                        /* Output tag and item */
-                        ASN1_put_object(out, ndef, i, ttag, tclass);
-                        ASN1_item_ex_i2d(pval, out, ASN1_ITEM_ptr(tt->item),
-                            -1, iclass);
-                        if (ndef == 2)
-                                ASN1_put_eoc(out);
-                }
-                return ret;
-        }
-
-        /* Either normal or IMPLICIT tagging: combine class and flags */
-        return ASN1_item_ex_i2d(pval, out, ASN1_ITEM_ptr(tt->item),
-            ttag, tclass | iclass);
-}
-
-/* Temporary structure used to hold DER encoding of items for SET OF */
-
-typedef struct {
-        unsigned char *data;
-        int length;
-        ASN1_VALUE *field;
-} DER_ENC;
-
-static int
-der_cmp(const void *a, const void *b)
-{
-        const DER_ENC *d1 = a, *d2 = b;
-        int cmplen, i;
-
-        cmplen = (d1->length < d2->length) ? d1->length : d2->length;
-        i = memcmp(d1->data, d2->data, cmplen);
-        if (i)
-                return i;
-        return d1->length - d2->length;
-}
-
-/* Output the content octets of SET OF or SEQUENCE OF */
-
-static int
-asn1_set_seq_out(STACK_OF(ASN1_VALUE) *sk, unsigned char **out, int skcontlen,
-    const ASN1_ITEM *item, int do_sort, int iclass)
-{
-        int i;
-        ASN1_VALUE *skitem;
-        unsigned char *tmpdat = NULL, *p = NULL;
-        DER_ENC *derlst = NULL, *tder;
-
-        if (do_sort) {
-                /* Don't need to sort less than 2 items */
-                if (sk_ASN1_VALUE_num(sk) < 2)
-                        do_sort = 0;
-                else {
-                        derlst = reallocarray(NULL, sk_ASN1_VALUE_num(sk),
-                            sizeof(*derlst));
-                        tmpdat = malloc(skcontlen);
-                        if (!derlst || !tmpdat) {
-                                free(derlst);
-                                free(tmpdat);
-                                return 0;
-                        }
-                }
-        }
-        /* If not sorting just output each item */
-        if (!do_sort) {
-                for (i = 0; i < sk_ASN1_VALUE_num(sk); i++) {
-                        skitem = sk_ASN1_VALUE_value(sk, i);
-                        ASN1_item_ex_i2d(&skitem, out, item, -1, iclass);
-                }
-                return 1;
-        }
-        p = tmpdat;
-
-        /* Doing sort: build up a list of each member's DER encoding */
-        for (i = 0, tder = derlst; i < sk_ASN1_VALUE_num(sk); i++, tder++) {
-                skitem = sk_ASN1_VALUE_value(sk, i);
-                tder->data = p;
-                tder->length = ASN1_item_ex_i2d(&skitem, &p, item, -1, iclass);
-                tder->field = skitem;
-        }
-
-        /* Now sort them */
-        qsort(derlst, sk_ASN1_VALUE_num(sk), sizeof(*derlst), der_cmp);
-        /* Output sorted DER encoding */
-        p = *out;
-        for (i = 0, tder = derlst; i < sk_ASN1_VALUE_num(sk); i++, tder++) {
-                memcpy(p, tder->data, tder->length);
-                p += tder->length;
-        }
-        *out = p;
-        /* If do_sort is 2 then reorder the STACK */
-        if (do_sort == 2) {
-                for (i = 0, tder = derlst; i < sk_ASN1_VALUE_num(sk); i++, tder++)
-                        (void)sk_ASN1_VALUE_set(sk, i, tder->field);
-        }
-        free(derlst);
-        free(tmpdat);
-        return 1;
-}
-
-static int
-asn1_i2d_ex_primitive(ASN1_VALUE **pval, unsigned char **out,
-    const ASN1_ITEM *it, int tag, int aclass)
-{
-        int len;
-        int utype;
-        int usetag;
-        int ndef = 0;
-
-        utype = it->utype;
-
-        /* Get length of content octets and maybe find
-         * out the underlying type.
-         */
-
-        len = asn1_ex_i2c(pval, NULL, &utype, it);
-
-        /* If SEQUENCE, SET or OTHER then header is
-         * included in pseudo content octets so don't
-         * include tag+length. We need to check here
-         * because the call to asn1_ex_i2c() could change
-         * utype.
-         */
-        if ((utype == V_ASN1_SEQUENCE) || (utype == V_ASN1_SET) ||
-            (utype == V_ASN1_OTHER))
-                usetag = 0;
-        else
-                usetag = 1;
-
-        /* -1 means omit type */
-        if (len == -1)
-                return 0;
-
-        /* -2 return is special meaning use ndef */
-        if (len == -2) {
-                ndef = 2;
-                len = 0;
-        }
-
-        /* If not implicitly tagged get tag from underlying type */
-        if (tag == -1)
-                tag = utype;
-
-        /* Output tag+length followed by content octets */
-        if (out) {
-                if (usetag)
-                        ASN1_put_object(out, ndef, len, tag, aclass);
-                asn1_ex_i2c(pval, *out, &utype, it);
-                if (ndef)
-                        ASN1_put_eoc(out);
-                else
-                        *out += len;
-        }
-
-        if (usetag)
-                return ASN1_object_size(ndef, len, tag);
-        return len;
-}
-
-/* Produce content octets from a structure */
-
-static int
-asn1_ex_i2c(ASN1_VALUE **pval, unsigned char *cout, int *putype,
-    const ASN1_ITEM *it)
-{
-        ASN1_BOOLEAN *tbool = NULL;
-        ASN1_STRING *strtmp;
-        ASN1_OBJECT *otmp;
-        int utype;
-        const unsigned char *cont;
-        unsigned char c;
-        int len;
-        const ASN1_PRIMITIVE_FUNCS *pf;
-
-        pf = it->funcs;
-        if (pf && pf->prim_i2c)
-                return pf->prim_i2c(pval, cout, putype, it);
-
-        /* Should type be omitted? */
-        if ((it->itype != ASN1_ITYPE_PRIMITIVE) ||
-            (it->utype != V_ASN1_BOOLEAN)) {
-                if (!*pval)
-                        return -1;
-        }
-
-        if (it->itype == ASN1_ITYPE_MSTRING) {
-                /* If MSTRING type set the underlying type */
-                strtmp = (ASN1_STRING *)*pval;
-                utype = strtmp->type;
-                *putype = utype;
-        } else if (it->utype == V_ASN1_ANY) {
-                /* If ANY set type and pointer to value */
-                ASN1_TYPE *typ;
-                typ = (ASN1_TYPE *)*pval;
-                utype = typ->type;
-                *putype = utype;
-                pval = &typ->value.asn1_value;
-        } else
-                utype = *putype;
-
-        switch (utype) {
-        case V_ASN1_OBJECT:
-                otmp = (ASN1_OBJECT *)*pval;
-                cont = otmp->data;
-                len = otmp->length;
-                break;
-
-        case V_ASN1_NULL:
-                cont = NULL;
-                len = 0;
-                break;
-
-        case V_ASN1_BOOLEAN:
-                tbool = (ASN1_BOOLEAN *)pval;
-                if (*tbool == -1)
-                        return -1;
-                if (it->utype != V_ASN1_ANY) {
-                        /* Default handling if value == size field then omit */
-                        if (*tbool && (it->size > 0))
-                                return -1;
-                        if (!*tbool && !it->size)
-                                return -1;
-                }
-                c = (unsigned char)*tbool;
-                cont = &c;
-                len = 1;
-                break;
-
-        case V_ASN1_BIT_STRING:
-                return i2c_ASN1_BIT_STRING((ASN1_BIT_STRING *)*pval,
-                    cout ? &cout : NULL);
-                break;
-
-        case V_ASN1_INTEGER:
-        case V_ASN1_NEG_INTEGER:
-        case V_ASN1_ENUMERATED:
-        case V_ASN1_NEG_ENUMERATED:
-                /* These are all have the same content format
-                 * as ASN1_INTEGER
-                 */
-                return i2c_ASN1_INTEGER((ASN1_INTEGER *)*pval,
-                    cout ? &cout : NULL);
-                break;
-
-        case V_ASN1_OCTET_STRING:
-        case V_ASN1_NUMERICSTRING:
-        case V_ASN1_PRINTABLESTRING:
-        case V_ASN1_T61STRING:
-        case V_ASN1_VIDEOTEXSTRING:
-        case V_ASN1_IA5STRING:
-        case V_ASN1_UTCTIME:
-        case V_ASN1_GENERALIZEDTIME:
-        case V_ASN1_GRAPHICSTRING:
-        case V_ASN1_VISIBLESTRING:
-        case V_ASN1_GENERALSTRING:
-        case V_ASN1_UNIVERSALSTRING:
-        case V_ASN1_BMPSTRING:
-        case V_ASN1_UTF8STRING:
-        case V_ASN1_SEQUENCE:
-        case V_ASN1_SET:
-        default:
-                /* All based on ASN1_STRING and handled the same */
-                strtmp = (ASN1_STRING *)*pval;
-                /* Special handling for NDEF */
-                if ((it->size == ASN1_TFLG_NDEF) &&
-                    (strtmp->flags & ASN1_STRING_FLAG_NDEF)) {
-                        if (cout) {
-                                strtmp->data = cout;
-                                strtmp->length = 0;
-                        }
-                        /* Special return code */
-                        return -2;
-                }
-                cont = strtmp->data;
-                len = strtmp->length;
-
-                break;
-
-        }
-        if (cout && len)
-                memcpy(cout, cont, len);
-        return len;
-}
diff --git a/src/lib/libcrypto/asn1/tasn_fre.c b/src/lib/libcrypto/asn1/tasn_fre.c
deleted file mode 100644
index 30d68786b1..0000000000
--- a/src/lib/libcrypto/asn1/tasn_fre.c
+++ /dev/null
@@ -1,243 +0,0 @@
-/* $OpenBSD: tasn_fre.c,v 1.14 2015/02/14 15:23:57 miod Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 2000.
- */
-/* ====================================================================
- * Copyright (c) 2000 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-
-#include <stddef.h>
-#include <openssl/asn1.h>
-#include <openssl/asn1t.h>
-#include <openssl/objects.h>
-
-static void asn1_item_combine_free(ASN1_VALUE **pval, const ASN1_ITEM *it,
-    int combine);
-
-/* Free up an ASN1 structure */
-
-void
-ASN1_item_free(ASN1_VALUE *val, const ASN1_ITEM *it)
-{
-        asn1_item_combine_free(&val, it, 0);
-}
-
-void
-ASN1_item_ex_free(ASN1_VALUE **pval, const ASN1_ITEM *it)
-{
-        asn1_item_combine_free(pval, it, 0);
-}
-
-static void
-asn1_item_combine_free(ASN1_VALUE **pval, const ASN1_ITEM *it, int combine)
-{
-        const ASN1_TEMPLATE *tt = NULL, *seqtt;
-        const ASN1_EXTERN_FUNCS *ef;
-        const ASN1_AUX *aux = it->funcs;
-        ASN1_aux_cb *asn1_cb = NULL;
-        int i;
-
-        if (pval == NULL || *pval == NULL)
-                return;
-
-        if (aux != NULL && aux->asn1_cb != NULL)
-                asn1_cb = aux->asn1_cb;
-
-        switch (it->itype) {
-        case ASN1_ITYPE_PRIMITIVE:
-                if (it->templates)
-                        ASN1_template_free(pval, it->templates);
-                else
-                        ASN1_primitive_free(pval, it);
-                break;
-
-        case ASN1_ITYPE_MSTRING:
-                ASN1_primitive_free(pval, it);
-                break;
-
-        case ASN1_ITYPE_CHOICE:
-                if (asn1_cb) {
-                        i = asn1_cb(ASN1_OP_FREE_PRE, pval, it, NULL);
-                        if (i == 2)
-                                return;
-                }
-                i = asn1_get_choice_selector(pval, it);
-                if ((i >= 0) && (i < it->tcount)) {
-                        ASN1_VALUE **pchval;
-                        tt = it->templates + i;
-                        pchval = asn1_get_field_ptr(pval, tt);
-                        ASN1_template_free(pchval, tt);
-                }
-                if (asn1_cb)
-                        asn1_cb(ASN1_OP_FREE_POST, pval, it, NULL);
-                if (!combine) {
-                        free(*pval);
-                        *pval = NULL;
-                }
-                break;
-
-        case ASN1_ITYPE_EXTERN:
-                ef = it->funcs;
-                if (ef && ef->asn1_ex_free)
-                        ef->asn1_ex_free(pval, it);
-                break;
-
-        case ASN1_ITYPE_NDEF_SEQUENCE:
-        case ASN1_ITYPE_SEQUENCE:
-                if (asn1_do_lock(pval, -1, it) > 0)
-                        return;
-                if (asn1_cb) {
-                        i = asn1_cb(ASN1_OP_FREE_PRE, pval, it, NULL);
-                        if (i == 2)
-                                return;
-                }
-                asn1_enc_free(pval, it);
-                /* If we free up as normal we will invalidate any
-                 * ANY DEFINED BY field and we wont be able to
-                 * determine the type of the field it defines. So
-                 * free up in reverse order.
-                 */
-                tt = it->templates + it->tcount - 1;
-                for (i = 0; i < it->tcount; tt--, i++) {
-                        ASN1_VALUE **pseqval;
-                        seqtt = asn1_do_adb(pval, tt, 0);
-                        if (!seqtt)
-                                continue;
-                        pseqval = asn1_get_field_ptr(pval, seqtt);
-                        ASN1_template_free(pseqval, seqtt);
-                }
-                if (asn1_cb)
-                        asn1_cb(ASN1_OP_FREE_POST, pval, it, NULL);
-                if (!combine) {
-                        free(*pval);
-                        *pval = NULL;
-                }
-                break;
-        }
-}
-
-void
-ASN1_template_free(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt)
-{
-        int i;
-        if (tt->flags & ASN1_TFLG_SK_MASK) {
-                STACK_OF(ASN1_VALUE) *sk = (STACK_OF(ASN1_VALUE) *)*pval;
-                for (i = 0; i < sk_ASN1_VALUE_num(sk); i++) {
-                        ASN1_VALUE *vtmp;
-                        vtmp = sk_ASN1_VALUE_value(sk, i);
-                        asn1_item_combine_free(&vtmp, ASN1_ITEM_ptr(tt->item),
-                            0);
-                }
-                sk_ASN1_VALUE_free(sk);
-                *pval = NULL;
-        } else
-                asn1_item_combine_free(pval, ASN1_ITEM_ptr(tt->item),
-                    tt->flags & ASN1_TFLG_COMBINE);
-}
-
-void
-ASN1_primitive_free(ASN1_VALUE **pval, const ASN1_ITEM *it)
-{
-        int utype;
-        if (it) {
-                const ASN1_PRIMITIVE_FUNCS *pf;
-                pf = it->funcs;
-                if (pf && pf->prim_free) {
-                        pf->prim_free(pval, it);
-                        return;
-                }
-        }
-        /* Special case: if 'it' is NULL free contents of ASN1_TYPE */
-        if (!it) {
-                ASN1_TYPE *typ = (ASN1_TYPE *)*pval;
-                utype = typ->type;
-                pval = &typ->value.asn1_value;
-                if (!*pval)
-                        return;
-        } else if (it->itype == ASN1_ITYPE_MSTRING) {
-                utype = -1;
-                if (!*pval)
-                        return;
-        } else {
-                utype = it->utype;
-                if ((utype != V_ASN1_BOOLEAN) && !*pval)
-                        return;
-        }
-
-        switch (utype) {
-        case V_ASN1_OBJECT:
-                ASN1_OBJECT_free((ASN1_OBJECT *)*pval);
-                break;
-
-        case V_ASN1_BOOLEAN:
-                if (it)
-                        *(ASN1_BOOLEAN *)pval = it->size;
-                else
-                        *(ASN1_BOOLEAN *)pval = -1;
-                return;
-
-        case V_ASN1_NULL:
-                break;
-
-        case V_ASN1_ANY:
-                ASN1_primitive_free(pval, NULL);
-                free(*pval);
-                break;
-
-        default:
-                ASN1_STRING_free((ASN1_STRING *)*pval);
-                break;
-        }
-        *pval = NULL;
-}
diff --git a/src/lib/libcrypto/asn1/tasn_new.c b/src/lib/libcrypto/asn1/tasn_new.c
deleted file mode 100644
index 986e5811b6..0000000000
--- a/src/lib/libcrypto/asn1/tasn_new.c
+++ /dev/null
@@ -1,374 +0,0 @@
-/* $OpenBSD: tasn_new.c,v 1.15 2015/07/20 15:43:23 miod Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 2000.
- */
-/* ====================================================================
- * Copyright (c) 2000-2004 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-
-#include <stddef.h>
-#include <openssl/asn1.h>
-#include <openssl/objects.h>
-#include <openssl/err.h>
-#include <openssl/asn1t.h>
-#include <string.h>
-
-static int asn1_item_ex_combine_new(ASN1_VALUE **pval, const ASN1_ITEM *it,
-    int combine);
-static void asn1_item_clear(ASN1_VALUE **pval, const ASN1_ITEM *it);
-static void asn1_template_clear(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt);
-static void asn1_primitive_clear(ASN1_VALUE **pval, const ASN1_ITEM *it);
-
-ASN1_VALUE *
-ASN1_item_new(const ASN1_ITEM *it)
-{
-        ASN1_VALUE *ret = NULL;
-        if (ASN1_item_ex_new(&ret, it) > 0)
-                return ret;
-        return NULL;
-}
-
-/* Allocate an ASN1 structure */
-
-int
-ASN1_item_ex_new(ASN1_VALUE **pval, const ASN1_ITEM *it)
-{
-        return asn1_item_ex_combine_new(pval, it, 0);
-}
-
-static int
-asn1_item_ex_combine_new(ASN1_VALUE **pval, const ASN1_ITEM *it, int combine)
-{
-        const ASN1_TEMPLATE *tt = NULL;
-        const ASN1_EXTERN_FUNCS *ef;
-        const ASN1_AUX *aux = it->funcs;
-        ASN1_aux_cb *asn1_cb = NULL;
-        ASN1_VALUE **pseqval;
-        int i;
-
-        if (aux != NULL && aux->asn1_cb != NULL)
-                asn1_cb = aux->asn1_cb;
-
-        if (!combine)
-                *pval = NULL;
-
-#ifdef CRYPTO_MDEBUG
-        if (it->sname)
-                CRYPTO_push_info(it->sname);
-#endif
-
-        switch (it->itype) {
-        case ASN1_ITYPE_EXTERN:
-                ef = it->funcs;
-                if (ef && ef->asn1_ex_new) {
-                        if (!ef->asn1_ex_new(pval, it))
-                                goto memerr;
-                }
-                break;
-
-        case ASN1_ITYPE_PRIMITIVE:
-                if (it->templates) {
-                        if (!ASN1_template_new(pval, it->templates))
-                                goto memerr;
-                } else if (!ASN1_primitive_new(pval, it))
-                        goto memerr;
-                break;
-
-        case ASN1_ITYPE_MSTRING:
-                if (!ASN1_primitive_new(pval, it))
-                        goto memerr;
-                break;
-
-        case ASN1_ITYPE_CHOICE:
-                if (asn1_cb) {
-                        i = asn1_cb(ASN1_OP_NEW_PRE, pval, it, NULL);
-                        if (!i)
-                                goto auxerr;
-                        if (i == 2) {
-#ifdef CRYPTO_MDEBUG
-                                if (it->sname)
-                                        CRYPTO_pop_info();
-#endif
-                                return 1;
-                        }
-                }
-                if (!combine) {
-                        *pval = calloc(1, it->size);
-                        if (!*pval)
-                                goto memerr;
-                }
-                asn1_set_choice_selector(pval, -1, it);
-                if (asn1_cb && !asn1_cb(ASN1_OP_NEW_POST, pval, it, NULL))
-                        goto auxerr;
-                break;
-
-        case ASN1_ITYPE_NDEF_SEQUENCE:
-        case ASN1_ITYPE_SEQUENCE:
-                if (asn1_cb) {
-                        i = asn1_cb(ASN1_OP_NEW_PRE, pval, it, NULL);
-                        if (!i)
-                                goto auxerr;
-                        if (i == 2) {
-#ifdef CRYPTO_MDEBUG
-                                if (it->sname)
-                                        CRYPTO_pop_info();
-#endif
-                                return 1;
-                        }
-                }
-                if (!combine) {
-                        *pval = calloc(1, it->size);
-                        if (!*pval)
-                                goto memerr;
-                        asn1_do_lock(pval, 0, it);
-                        asn1_enc_init(pval, it);
-                }
-                for (i = 0, tt = it->templates; i < it->tcount; tt++, i++) {
-                        pseqval = asn1_get_field_ptr(pval, tt);
-                        if (!ASN1_template_new(pseqval, tt))
-                                goto memerr;
-                }
-                if (asn1_cb && !asn1_cb(ASN1_OP_NEW_POST, pval, it, NULL))
-                        goto auxerr;
-                break;
-        }
-#ifdef CRYPTO_MDEBUG
-        if (it->sname)
-                CRYPTO_pop_info();
-#endif
-        return 1;
-
-memerr:
-        ASN1err(ASN1_F_ASN1_ITEM_EX_COMBINE_NEW, ERR_R_MALLOC_FAILURE);
-#ifdef CRYPTO_MDEBUG
-        if (it->sname)
-                CRYPTO_pop_info();
-#endif
-        return 0;
-
-auxerr:
-        ASN1err(ASN1_F_ASN1_ITEM_EX_COMBINE_NEW, ASN1_R_AUX_ERROR);
-        ASN1_item_ex_free(pval, it);
-#ifdef CRYPTO_MDEBUG
-        if (it->sname)
-                CRYPTO_pop_info();
-#endif
-        return 0;
-
-}
-
-static void
-asn1_item_clear(ASN1_VALUE **pval, const ASN1_ITEM *it)
-{
-        const ASN1_EXTERN_FUNCS *ef;
-
-        switch (it->itype) {
-        case ASN1_ITYPE_EXTERN:
-                ef = it->funcs;
-                if (ef && ef->asn1_ex_clear)
-                        ef->asn1_ex_clear(pval, it);
-                else
-                        *pval = NULL;
-                break;
-
-        case ASN1_ITYPE_PRIMITIVE:
-                if (it->templates)
-                        asn1_template_clear(pval, it->templates);
-                else
-                        asn1_primitive_clear(pval, it);
-                break;
-
-        case ASN1_ITYPE_MSTRING:
-                asn1_primitive_clear(pval, it);
-                break;
-
-        case ASN1_ITYPE_CHOICE:
-        case ASN1_ITYPE_SEQUENCE:
-        case ASN1_ITYPE_NDEF_SEQUENCE:
-                *pval = NULL;
-                break;
-        }
-}
-
-int
-ASN1_template_new(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt)
-{
-        const ASN1_ITEM *it = ASN1_ITEM_ptr(tt->item);
-        int ret;
-
-        if (tt->flags & ASN1_TFLG_OPTIONAL) {
-                asn1_template_clear(pval, tt);
-                return 1;
-        }
-        /* If ANY DEFINED BY nothing to do */
-
-        if (tt->flags & ASN1_TFLG_ADB_MASK) {
-                *pval = NULL;
-                return 1;
-        }
-#ifdef CRYPTO_MDEBUG
-        if (tt->field_name)
-                CRYPTO_push_info(tt->field_name);
-#endif
-        /* If SET OF or SEQUENCE OF, its a STACK */
-        if (tt->flags & ASN1_TFLG_SK_MASK) {
-                STACK_OF(ASN1_VALUE) *skval;
-                skval = sk_ASN1_VALUE_new_null();
-                if (!skval) {
-                        ASN1err(ASN1_F_ASN1_TEMPLATE_NEW, ERR_R_MALLOC_FAILURE);
-                        ret = 0;
-                        goto done;
-                }
-                *pval = (ASN1_VALUE *)skval;
-                ret = 1;
-                goto done;
-        }
-        /* Otherwise pass it back to the item routine */
-        ret = asn1_item_ex_combine_new(pval, it, tt->flags & ASN1_TFLG_COMBINE);
-done:
-#ifdef CRYPTO_MDEBUG
-        if (it->sname)
-                CRYPTO_pop_info();
-#endif
-        return ret;
-}
-
-static void
-asn1_template_clear(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt)
-{
-        /* If ADB or STACK just NULL the field */
-        if (tt->flags & (ASN1_TFLG_ADB_MASK|ASN1_TFLG_SK_MASK))
-                *pval = NULL;
-        else
-                asn1_item_clear(pval, ASN1_ITEM_ptr(tt->item));
-}
-
-
-/* NB: could probably combine most of the real XXX_new() behaviour and junk
- * all the old functions.
- */
-
-int
-ASN1_primitive_new(ASN1_VALUE **pval, const ASN1_ITEM *it)
-{
-        ASN1_TYPE *typ;
-        ASN1_STRING *str;
-        int utype;
-
-        if (it && it->funcs) {
-                const ASN1_PRIMITIVE_FUNCS *pf = it->funcs;
-                if (pf->prim_new)
-                        return pf->prim_new(pval, it);
-        }
-
-        if (!it || (it->itype == ASN1_ITYPE_MSTRING))
-                utype = V_ASN1_UNDEF;
-        else
-                utype = it->utype;
-        switch (utype) {
-        case V_ASN1_OBJECT:
-                *pval = (ASN1_VALUE *)OBJ_nid2obj(NID_undef);
-                return 1;
-
-        case V_ASN1_BOOLEAN:
-                *(ASN1_BOOLEAN *)pval = it->size;
-                return 1;
-
-        case V_ASN1_NULL:
-                *pval = (ASN1_VALUE *)1;
-                return 1;
-
-        case V_ASN1_ANY:
-                typ = malloc(sizeof(ASN1_TYPE));
-                if (typ != NULL) {
-                        typ->value.ptr = NULL;
-                        typ->type = V_ASN1_UNDEF;
-                }
-                *pval = (ASN1_VALUE *)typ;
-                break;
-
-        default:
-                str = ASN1_STRING_type_new(utype);
-                if (it != NULL && it->itype == ASN1_ITYPE_MSTRING &&
-                    str != NULL)
-                        str->flags |= ASN1_STRING_FLAG_MSTRING;
-                *pval = (ASN1_VALUE *)str;
-                break;
-        }
-        if (*pval)
-                return 1;
-        return 0;
-}
-
-static void
-asn1_primitive_clear(ASN1_VALUE **pval, const ASN1_ITEM *it)
-{
-        int utype;
-        if (it && it->funcs) {
-                const ASN1_PRIMITIVE_FUNCS *pf = it->funcs;
-                if (pf->prim_clear)
-                        pf->prim_clear(pval, it);
-                else
-                        *pval = NULL;
-                return;
-        }
-        if (!it || (it->itype == ASN1_ITYPE_MSTRING))
-                utype = V_ASN1_UNDEF;
-        else
-                utype = it->utype;
-        if (utype == V_ASN1_BOOLEAN)
-                *(ASN1_BOOLEAN *)pval = it->size;
-        else
-                *pval = NULL;
-}
diff --git a/src/lib/libcrypto/asn1/tasn_prn.c b/src/lib/libcrypto/asn1/tasn_prn.c
deleted file mode 100644
index c9fde96789..0000000000
--- a/src/lib/libcrypto/asn1/tasn_prn.c
+++ /dev/null
@@ -1,596 +0,0 @@
-/* $OpenBSD: tasn_prn.c,v 1.13 2015/02/14 15:15:27 miod Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 2000.
- */
-/* ====================================================================
- * Copyright (c) 2000,2005 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <stddef.h>
-
-#include <openssl/asn1.h>
-#include <openssl/asn1t.h>
-#include <openssl/buffer.h>
-#include <openssl/err.h>
-#include <openssl/objects.h>
-#include <openssl/x509v3.h>
-
-#include "asn1_locl.h"
-
-/* Print routines.
- */
-
-/* ASN1_PCTX routines */
-
-ASN1_PCTX default_pctx = {
-        ASN1_PCTX_FLAGS_SHOW_ABSENT,    /* flags */
-        0,                              /* nm_flags */
-        0,                              /* cert_flags */
-        0,                              /* oid_flags */
-        0                               /* str_flags */
-};
-
-
-ASN1_PCTX *
-ASN1_PCTX_new(void)
-{
-        ASN1_PCTX *ret;
-        ret = malloc(sizeof(ASN1_PCTX));
-        if (ret == NULL) {
-                ASN1err(ASN1_F_ASN1_PCTX_NEW, ERR_R_MALLOC_FAILURE);
-                return NULL;
-        }
-        ret->flags = 0;
-        ret->nm_flags = 0;
-        ret->cert_flags = 0;
-        ret->oid_flags = 0;
-        ret->str_flags = 0;
-        return ret;
-}
-
-void
-ASN1_PCTX_free(ASN1_PCTX *p)
-{
-        free(p);
-}
-
-unsigned long
-ASN1_PCTX_get_flags(ASN1_PCTX *p)
-{
-        return p->flags;
-}
-
-void
-ASN1_PCTX_set_flags(ASN1_PCTX *p, unsigned long flags)
-{
-        p->flags = flags;
-}
-
-unsigned long
-ASN1_PCTX_get_nm_flags(ASN1_PCTX *p)
-{
-        return p->nm_flags;
-}
-
-void
-ASN1_PCTX_set_nm_flags(ASN1_PCTX *p, unsigned long flags)
-{
-        p->nm_flags = flags;
-}
-
-unsigned long
-ASN1_PCTX_get_cert_flags(ASN1_PCTX *p)
-{
-        return p->cert_flags;
-}
-
-void
-ASN1_PCTX_set_cert_flags(ASN1_PCTX *p, unsigned long flags)
-{
-        p->cert_flags = flags;
-}
-
-unsigned long
-ASN1_PCTX_get_oid_flags(ASN1_PCTX *p)
-{
-        return p->oid_flags;
-}
-
-void
-ASN1_PCTX_set_oid_flags(ASN1_PCTX *p, unsigned long flags)
-{
-        p->oid_flags = flags;
-}
-
-unsigned long
-ASN1_PCTX_get_str_flags(ASN1_PCTX *p)
-{
-        return p->str_flags;
-}
-
-void
-ASN1_PCTX_set_str_flags(ASN1_PCTX *p, unsigned long flags)
-{
-        p->str_flags = flags;
-}
-
-/* Main print routines */
-
-static int asn1_item_print_ctx(BIO *out, ASN1_VALUE **fld, int indent,
-    const ASN1_ITEM *it, const char *fname, const char *sname, int nohdr,
-    const ASN1_PCTX *pctx);
-
-int asn1_template_print_ctx(BIO *out, ASN1_VALUE **fld, int indent,
-    const ASN1_TEMPLATE *tt, const ASN1_PCTX *pctx);
-
-static int asn1_primitive_print(BIO *out, ASN1_VALUE **fld,
-    const ASN1_ITEM *it, int indent, const char *fname, const char *sname,
-    const ASN1_PCTX *pctx);
-
-static int asn1_print_fsname(BIO *out, int indent, const char *fname,
-    const char *sname, const ASN1_PCTX *pctx);
-
-int
-ASN1_item_print(BIO *out, ASN1_VALUE *ifld, int indent, const ASN1_ITEM *it,
-    const ASN1_PCTX *pctx)
-{
-        const char *sname;
-
-        if (pctx == NULL)
-                pctx = &default_pctx;
-        if (pctx->flags & ASN1_PCTX_FLAGS_NO_STRUCT_NAME)
-                sname = NULL;
-        else
-                sname = it->sname;
-        return asn1_item_print_ctx(out, &ifld, indent, it, NULL, sname,
-            0, pctx);
-}
-
-static int
-asn1_item_print_ctx(BIO *out, ASN1_VALUE **fld, int indent, const ASN1_ITEM *it,
-    const char *fname, const char *sname, int nohdr, const ASN1_PCTX *pctx)
-{
-        const ASN1_TEMPLATE *tt;
-        const ASN1_EXTERN_FUNCS *ef;
-        ASN1_VALUE **tmpfld;
-        const ASN1_AUX *aux = it->funcs;
-        ASN1_aux_cb *asn1_cb;
-        ASN1_PRINT_ARG parg;
-        int i;
-
-        if (aux && aux->asn1_cb) {
-                parg.out = out;
-                parg.indent = indent;
-                parg.pctx = pctx;
-                asn1_cb = aux->asn1_cb;
-        } else
-                asn1_cb = 0;
-
-        if (*fld == NULL) {
-                if (pctx->flags & ASN1_PCTX_FLAGS_SHOW_ABSENT) {
-                        if (!nohdr &&
-                            !asn1_print_fsname(out, indent, fname, sname, pctx))
-                                return 0;
-                        if (BIO_puts(out, "<ABSENT>\n") <= 0)
-                                return 0;
-                }
-                return 1;
-        }
-
-        switch (it->itype) {
-        case ASN1_ITYPE_PRIMITIVE:
-                if (it->templates) {
-                        if (!asn1_template_print_ctx(out, fld, indent,
-                            it->templates, pctx))
-                                return 0;
-                }
-                /* fall thru */
-        case ASN1_ITYPE_MSTRING:
-                if (!asn1_primitive_print(out, fld, it,
-                    indent, fname, sname, pctx))
-                        return 0;
-                break;
-
-        case ASN1_ITYPE_EXTERN:
-                if (!nohdr &&
-                    !asn1_print_fsname(out, indent, fname, sname, pctx))
-                        return 0;
-                /* Use new style print routine if possible */
-                ef = it->funcs;
-                if (ef && ef->asn1_ex_print) {
-                        i = ef->asn1_ex_print(out, fld, indent, "", pctx);
-                        if (!i)
-                                return 0;
-                        if ((i == 2) && (BIO_puts(out, "\n") <= 0))
-                                return 0;
-                        return 1;
-                } else if (sname &&
-                    BIO_printf(out, ":EXTERNAL TYPE %s\n", sname) <= 0)
-                        return 0;
-                break;
-
-        case ASN1_ITYPE_CHOICE:
-                /* CHOICE type, get selector */
-                i = asn1_get_choice_selector(fld, it);
-                /* This should never happen... */
-                if ((i < 0) || (i >= it->tcount)) {
-                        if (BIO_printf(out,
-                            "ERROR: selector [%d] invalid\n", i) <= 0)
-                                return 0;
-                        return 1;
-                }
-                tt = it->templates + i;
-                tmpfld = asn1_get_field_ptr(fld, tt);
-                if (!asn1_template_print_ctx(out, tmpfld, indent, tt, pctx))
-                        return 0;
-                break;
-
-        case ASN1_ITYPE_SEQUENCE:
-        case ASN1_ITYPE_NDEF_SEQUENCE:
-                if (!nohdr &&
-                    !asn1_print_fsname(out, indent, fname, sname, pctx))
-                        return 0;
-                if (fname || sname) {
-                        if (pctx->flags & ASN1_PCTX_FLAGS_SHOW_SEQUENCE) {
-                                if (BIO_puts(out, " {\n") <= 0)
-                                        return 0;
-                        } else {
-                                if (BIO_puts(out, "\n") <= 0)
-                                        return 0;
-                        }
-                }
-
-                if (asn1_cb) {
-                        i = asn1_cb(ASN1_OP_PRINT_PRE, fld, it, &parg);
-                        if (i == 0)
-                                return 0;
-                        if (i == 2)
-                                return 1;
-                }
-
-                /* Print each field entry */
-                for (i = 0, tt = it->templates; i < it->tcount; i++, tt++) {
-                        const ASN1_TEMPLATE *seqtt;
-
-                        seqtt = asn1_do_adb(fld, tt, 1);
-                        if (seqtt == NULL)
-                                return 0;
-                        tmpfld = asn1_get_field_ptr(fld, seqtt);
-                        if (!asn1_template_print_ctx(out, tmpfld, indent + 2,
-                            seqtt, pctx))
-                                return 0;
-                }
-                if (pctx->flags & ASN1_PCTX_FLAGS_SHOW_SEQUENCE) {
-                        if (BIO_printf(out, "%*s}\n", indent, "") < 0)
-                                return 0;
-                }
-
-                if (asn1_cb) {
-                        i = asn1_cb(ASN1_OP_PRINT_POST, fld, it, &parg);
-                        if (i == 0)
-                                return 0;
-                }
-                break;
-
-        default:
-                BIO_printf(out, "Unprocessed type %d\n", it->itype);
-                return 0;
-        }
-
-        return 1;
-}
-
-int
-asn1_template_print_ctx(BIO *out, ASN1_VALUE **fld, int indent,
-    const ASN1_TEMPLATE *tt, const ASN1_PCTX *pctx)
-{
-        int i, flags;
-        const char *sname, *fname;
-
-        flags = tt->flags;
-        if (pctx->flags & ASN1_PCTX_FLAGS_SHOW_FIELD_STRUCT_NAME)
-                sname = ASN1_ITEM_ptr(tt->item)->sname;
-        else
-                sname = NULL;
-        if (pctx->flags & ASN1_PCTX_FLAGS_NO_FIELD_NAME)
-                fname = NULL;
-        else
-                fname = tt->field_name;
-        if (flags & ASN1_TFLG_SK_MASK) {
-                char *tname;
-                ASN1_VALUE *skitem;
-                STACK_OF(ASN1_VALUE) *stack;
-
-                /* SET OF, SEQUENCE OF */
-                if (fname) {
-                        if (pctx->flags & ASN1_PCTX_FLAGS_SHOW_SSOF) {
-                                if (flags & ASN1_TFLG_SET_OF)
-                                        tname = "SET";
-                                else
-                                        tname = "SEQUENCE";
-                                if (BIO_printf(out, "%*s%s OF %s {\n",
-                                    indent, "", tname, tt->field_name) <= 0)
-                                        return 0;
-                        } else if (BIO_printf(out, "%*s%s:\n", indent, "",
-                            fname) <= 0)
-                                return 0;
-                }
-                stack = (STACK_OF(ASN1_VALUE) *)*fld;
-                for (i = 0; i < sk_ASN1_VALUE_num(stack); i++) {
-                        if ((i > 0) && (BIO_puts(out, "\n") <= 0))
-                                return 0;
-                        skitem = sk_ASN1_VALUE_value(stack, i);
-                        if (!asn1_item_print_ctx(out, &skitem, indent + 2,
-                            ASN1_ITEM_ptr(tt->item), NULL, NULL, 1, pctx))
-                                return 0;
-                }
-                if (!i && BIO_printf(out, "%*s<EMPTY>\n", indent + 2, "") <= 0)
-                        return 0;
-                if (pctx->flags & ASN1_PCTX_FLAGS_SHOW_SEQUENCE) {
-                        if (BIO_printf(out, "%*s}\n", indent, "") <= 0)
-                                return 0;
-                }
-                return 1;
-        }
-        return asn1_item_print_ctx(out, fld, indent, ASN1_ITEM_ptr(tt->item),
-            fname, sname, 0, pctx);
-}
-
-static int
-asn1_print_fsname(BIO *out, int indent, const char *fname, const char *sname,
-    const ASN1_PCTX *pctx)
-{
-        static char spaces[] = "                    ";
-        const int nspaces = sizeof(spaces) - 1;
-
-        while (indent > nspaces) {
-                if (BIO_write(out, spaces, nspaces) != nspaces)
-                        return 0;
-                indent -= nspaces;
-        }
-        if (BIO_write(out, spaces, indent) != indent)
-                return 0;
-        if (pctx->flags & ASN1_PCTX_FLAGS_NO_STRUCT_NAME)
-                sname = NULL;
-        if (pctx->flags & ASN1_PCTX_FLAGS_NO_FIELD_NAME)
-                fname = NULL;
-        if (!sname && !fname)
-                return 1;
-        if (fname) {
-                if (BIO_puts(out, fname) <= 0)
-                        return 0;
-        }
-        if (sname) {
-                if (fname) {
-                        if (BIO_printf(out, " (%s)", sname) <= 0)
-                                return 0;
-                } else {
-                        if (BIO_puts(out, sname) <= 0)
-                                return 0;
-                }
-        }
-        if (BIO_write(out, ": ", 2) != 2)
-                return 0;
-        return 1;
-}
-
-static int
-asn1_print_boolean_ctx(BIO *out, int boolval, const ASN1_PCTX *pctx)
-{
-        const char *str;
-        switch (boolval) {
-        case -1:
-                str = "BOOL ABSENT";
-                break;
-
-        case 0:
-                str = "FALSE";
-                break;
-
-        default:
-                str = "TRUE";
-                break;
-
-        }
-
-        if (BIO_puts(out, str) <= 0)
-                return 0;
-        return 1;
-
-}
-
-static int
-asn1_print_integer_ctx(BIO *out, ASN1_INTEGER *str, const ASN1_PCTX *pctx)
-{
-        char *s;
-        int ret = 1;
-        s = i2s_ASN1_INTEGER(NULL, str);
-        if (BIO_puts(out, s) <= 0)
-                ret = 0;
-        free(s);
-        return ret;
-}
-
-static int
-asn1_print_oid_ctx(BIO *out, const ASN1_OBJECT *oid, const ASN1_PCTX *pctx)
-{
-        char objbuf[80];
-        const char *ln;
-        ln = OBJ_nid2ln(OBJ_obj2nid(oid));
-        if (!ln)
-                ln = "";
-        OBJ_obj2txt(objbuf, sizeof objbuf, oid, 1);
-        if (BIO_printf(out, "%s (%s)", ln, objbuf) <= 0)
-                return 0;
-        return 1;
-}
-
-static int
-asn1_print_obstring_ctx(BIO *out, ASN1_STRING *str, int indent,
-    const ASN1_PCTX *pctx)
-{
-        if (str->type == V_ASN1_BIT_STRING) {
-                if (BIO_printf(out, " (%ld unused bits)\n",
-                    str->flags & 0x7) <= 0)
-                        return 0;
-        } else if (BIO_puts(out, "\n") <= 0)
-                return 0;
-        if ((str->length > 0) &&
-            BIO_dump_indent(out, (char *)str->data, str->length,
-            indent + 2) <= 0)
-                return 0;
-        return 1;
-}
-
-static int
-asn1_primitive_print(BIO *out, ASN1_VALUE **fld, const ASN1_ITEM *it,
-    int indent, const char *fname, const char *sname, const ASN1_PCTX *pctx)
-{
-        long utype;
-        ASN1_STRING *str;
-        int ret = 1, needlf = 1;
-        const char *pname;
-        const ASN1_PRIMITIVE_FUNCS *pf;
-
-        pf = it->funcs;
-        if (!asn1_print_fsname(out, indent, fname, sname, pctx))
-                return 0;
-        if (pf && pf->prim_print)
-                return pf->prim_print(out, fld, it, indent, pctx);
-        str = (ASN1_STRING *)*fld;
-        if (it->itype == ASN1_ITYPE_MSTRING)
-                utype = str->type & ~V_ASN1_NEG;
-        else
-                utype = it->utype;
-        if (utype == V_ASN1_ANY) {
-                ASN1_TYPE *atype = (ASN1_TYPE *)*fld;
-                utype = atype->type;
-                fld = &atype->value.asn1_value;
-                str = (ASN1_STRING *)*fld;
-                if (pctx->flags & ASN1_PCTX_FLAGS_NO_ANY_TYPE)
-                        pname = NULL;
-                else
-                        pname = ASN1_tag2str(utype);
-        } else {
-                if (pctx->flags & ASN1_PCTX_FLAGS_SHOW_TYPE)
-                        pname = ASN1_tag2str(utype);
-                else
-                        pname = NULL;
-        }
-
-        if (utype == V_ASN1_NULL) {
-                if (BIO_puts(out, "NULL\n") <= 0)
-                        return 0;
-                return 1;
-        }
-
-        if (pname) {
-                if (BIO_puts(out, pname) <= 0)
-                        return 0;
-                if (BIO_puts(out, ":") <= 0)
-                        return 0;
-        }
-
-        switch (utype) {
-        case V_ASN1_BOOLEAN:
-                {
-                        int boolval = *(int *)fld;
-                        if (boolval == -1)
-                                boolval = it->size;
-                        ret = asn1_print_boolean_ctx(out, boolval, pctx);
-                }
-                break;
-
-        case V_ASN1_INTEGER:
-        case V_ASN1_ENUMERATED:
-                ret = asn1_print_integer_ctx(out, str, pctx);
-                break;
-
-        case V_ASN1_UTCTIME:
-                ret = ASN1_UTCTIME_print(out, str);
-                break;
-
-        case V_ASN1_GENERALIZEDTIME:
-                ret = ASN1_GENERALIZEDTIME_print(out, str);
-                break;
-
-        case V_ASN1_OBJECT:
-                ret = asn1_print_oid_ctx(out, (const ASN1_OBJECT *)*fld, pctx);
-                break;
-
-        case V_ASN1_OCTET_STRING:
-        case V_ASN1_BIT_STRING:
-                ret = asn1_print_obstring_ctx(out, str, indent, pctx);
-                needlf = 0;
-                break;
-
-        case V_ASN1_SEQUENCE:
-        case V_ASN1_SET:
-        case V_ASN1_OTHER:
-                if (BIO_puts(out, "\n") <= 0)
-                        return 0;
-                if (ASN1_parse_dump(out, str->data, str->length,
-                    indent, 0) <= 0)
-                        ret = 0;
-                needlf = 0;
-                break;
-
-        default:
-                ret = ASN1_STRING_print_ex(out, str, pctx->str_flags);
-        }
-        if (!ret)
-                return 0;
-        if (needlf && BIO_puts(out, "\n") <= 0)
-                return 0;
-        return 1;
-}
diff --git a/src/lib/libcrypto/asn1/tasn_typ.c b/src/lib/libcrypto/asn1/tasn_typ.c
deleted file mode 100644
index 542713aa09..0000000000
--- a/src/lib/libcrypto/asn1/tasn_typ.c
+++ /dev/null
@@ -1,799 +0,0 @@
-/* $OpenBSD: tasn_typ.c,v 1.13 2015/07/24 15:09:52 jsing Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 2000.
- */
-/* ====================================================================
- * Copyright (c) 2000 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-#include <stdio.h>
-#include <openssl/asn1.h>
-#include <openssl/asn1t.h>
-
-/* Declarations for string types */
-
-const ASN1_ITEM ASN1_INTEGER_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = V_ASN1_INTEGER,
-        .sname = "ASN1_INTEGER",
-};
-
-ASN1_INTEGER *
-d2i_ASN1_INTEGER(ASN1_INTEGER **a, const unsigned char **in, long len)
-{
-        return (ASN1_INTEGER *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &ASN1_INTEGER_it);
-}
-
-int
-i2d_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &ASN1_INTEGER_it);
-}
-
-ASN1_INTEGER *
-ASN1_INTEGER_new(void)
-{
-        return (ASN1_INTEGER *)ASN1_item_new(&ASN1_INTEGER_it);
-}
-
-void
-ASN1_INTEGER_free(ASN1_INTEGER *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &ASN1_INTEGER_it);
-}
-
-
-const ASN1_ITEM ASN1_ENUMERATED_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = V_ASN1_ENUMERATED,
-        .sname = "ASN1_ENUMERATED",
-};
-
-ASN1_ENUMERATED *
-d2i_ASN1_ENUMERATED(ASN1_ENUMERATED **a, const unsigned char **in, long len)
-{
-        return (ASN1_ENUMERATED *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &ASN1_ENUMERATED_it);
-}
-
-int
-i2d_ASN1_ENUMERATED(ASN1_ENUMERATED *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &ASN1_ENUMERATED_it);
-}
-
-ASN1_ENUMERATED *
-ASN1_ENUMERATED_new(void)
-{
-        return (ASN1_ENUMERATED *)ASN1_item_new(&ASN1_ENUMERATED_it);
-}
-
-void
-ASN1_ENUMERATED_free(ASN1_ENUMERATED *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &ASN1_ENUMERATED_it);
-}
-
-
-const ASN1_ITEM ASN1_BIT_STRING_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = V_ASN1_BIT_STRING,
-        .sname = "ASN1_BIT_STRING",
-};
-
-ASN1_BIT_STRING *
-d2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a, const unsigned char **in, long len)
-{
-        return (ASN1_BIT_STRING *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &ASN1_BIT_STRING_it);
-}
-
-int
-i2d_ASN1_BIT_STRING(ASN1_BIT_STRING *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &ASN1_BIT_STRING_it);
-}
-
-ASN1_BIT_STRING *
-ASN1_BIT_STRING_new(void)
-{
-        return (ASN1_BIT_STRING *)ASN1_item_new(&ASN1_BIT_STRING_it);
-}
-
-void
-ASN1_BIT_STRING_free(ASN1_BIT_STRING *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &ASN1_BIT_STRING_it);
-}
-
-
-const ASN1_ITEM ASN1_OCTET_STRING_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = V_ASN1_OCTET_STRING,
-        .sname = "ASN1_OCTET_STRING",
-};
-
-ASN1_OCTET_STRING *
-d2i_ASN1_OCTET_STRING(ASN1_OCTET_STRING **a, const unsigned char **in, long len)
-{
-        return (ASN1_OCTET_STRING *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &ASN1_OCTET_STRING_it);
-}
-
-int
-i2d_ASN1_OCTET_STRING(ASN1_OCTET_STRING *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &ASN1_OCTET_STRING_it);
-}
-
-ASN1_OCTET_STRING *
-ASN1_OCTET_STRING_new(void)
-{
-        return (ASN1_OCTET_STRING *)ASN1_item_new(&ASN1_OCTET_STRING_it);
-}
-
-void
-ASN1_OCTET_STRING_free(ASN1_OCTET_STRING *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &ASN1_OCTET_STRING_it);
-}
-
-
-const ASN1_ITEM ASN1_NULL_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = V_ASN1_NULL,
-        .sname = "ASN1_NULL",
-};
-
-ASN1_NULL *
-d2i_ASN1_NULL(ASN1_NULL **a, const unsigned char **in, long len)
-{
-        return (ASN1_NULL *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &ASN1_NULL_it);
-}
-
-int
-i2d_ASN1_NULL(ASN1_NULL *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &ASN1_NULL_it);
-}
-
-ASN1_NULL *
-ASN1_NULL_new(void)
-{
-        return (ASN1_NULL *)ASN1_item_new(&ASN1_NULL_it);
-}
-
-void
-ASN1_NULL_free(ASN1_NULL *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &ASN1_NULL_it);
-}
-
-
-const ASN1_ITEM ASN1_OBJECT_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = V_ASN1_OBJECT,
-        .sname = "ASN1_OBJECT",
-};
-
-
-const ASN1_ITEM ASN1_UTF8STRING_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = V_ASN1_UTF8STRING,
-        .sname = "ASN1_UTF8STRING",
-};
-
-ASN1_UTF8STRING *
-d2i_ASN1_UTF8STRING(ASN1_UTF8STRING **a, const unsigned char **in, long len)
-{
-        return (ASN1_UTF8STRING *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &ASN1_UTF8STRING_it);
-}
-
-int
-i2d_ASN1_UTF8STRING(ASN1_UTF8STRING *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &ASN1_UTF8STRING_it);
-}
-
-ASN1_UTF8STRING *
-ASN1_UTF8STRING_new(void)
-{
-        return (ASN1_UTF8STRING *)ASN1_item_new(&ASN1_UTF8STRING_it);
-}
-
-void
-ASN1_UTF8STRING_free(ASN1_UTF8STRING *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &ASN1_UTF8STRING_it);
-}
-
-
-const ASN1_ITEM ASN1_PRINTABLESTRING_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = V_ASN1_PRINTABLESTRING,
-        .sname = "ASN1_PRINTABLESTRING",
-};
-
-ASN1_PRINTABLESTRING *
-d2i_ASN1_PRINTABLESTRING(ASN1_PRINTABLESTRING **a, const unsigned char **in,
-    long len)
-{
-        return (ASN1_PRINTABLESTRING *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &ASN1_PRINTABLESTRING_it);
-}
-
-int
-i2d_ASN1_PRINTABLESTRING(ASN1_PRINTABLESTRING *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &ASN1_PRINTABLESTRING_it);
-}
-
-ASN1_PRINTABLESTRING *
-ASN1_PRINTABLESTRING_new(void)
-{
-        return (ASN1_PRINTABLESTRING *)ASN1_item_new(&ASN1_PRINTABLESTRING_it);
-}
-
-void
-ASN1_PRINTABLESTRING_free(ASN1_PRINTABLESTRING *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &ASN1_PRINTABLESTRING_it);
-}
-
-
-const ASN1_ITEM ASN1_T61STRING_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = V_ASN1_T61STRING,
-        .sname = "ASN1_T61STRING",
-};
-
-ASN1_T61STRING *
-d2i_ASN1_T61STRING(ASN1_T61STRING **a, const unsigned char **in, long len)
-{
-        return (ASN1_T61STRING *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &ASN1_T61STRING_it);
-}
-
-int
-i2d_ASN1_T61STRING(ASN1_T61STRING *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &ASN1_T61STRING_it);
-}
-
-ASN1_T61STRING *
-ASN1_T61STRING_new(void)
-{
-        return (ASN1_T61STRING *)ASN1_item_new(&ASN1_T61STRING_it);
-}
-
-void
-ASN1_T61STRING_free(ASN1_T61STRING *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &ASN1_T61STRING_it);
-}
-
-
-const ASN1_ITEM ASN1_IA5STRING_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = V_ASN1_IA5STRING,
-        .sname = "ASN1_IA5STRING",
-};
-
-ASN1_IA5STRING *
-d2i_ASN1_IA5STRING(ASN1_IA5STRING **a, const unsigned char **in, long len)
-{
-        return (ASN1_IA5STRING *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &ASN1_IA5STRING_it);
-}
-
-int
-i2d_ASN1_IA5STRING(ASN1_IA5STRING *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &ASN1_IA5STRING_it);
-}
-
-ASN1_IA5STRING *
-ASN1_IA5STRING_new(void)
-{
-        return (ASN1_IA5STRING *)ASN1_item_new(&ASN1_IA5STRING_it);
-}
-
-void
-ASN1_IA5STRING_free(ASN1_IA5STRING *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &ASN1_IA5STRING_it);
-}
-
-
-const ASN1_ITEM ASN1_GENERALSTRING_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = V_ASN1_GENERALSTRING,
-        .sname = "ASN1_GENERALSTRING",
-};
-
-ASN1_GENERALSTRING *
-d2i_ASN1_GENERALSTRING(ASN1_GENERALSTRING **a, const unsigned char **in,
-    long len)
-{
-        return (ASN1_GENERALSTRING *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &ASN1_GENERALSTRING_it);
-}
-
-int
-i2d_ASN1_GENERALSTRING(ASN1_GENERALSTRING *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &ASN1_GENERALSTRING_it);
-}
-
-ASN1_GENERALSTRING *
-ASN1_GENERALSTRING_new(void)
-{
-        return (ASN1_GENERALSTRING *)ASN1_item_new(&ASN1_GENERALSTRING_it);
-}
-
-void
-ASN1_GENERALSTRING_free(ASN1_GENERALSTRING *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &ASN1_GENERALSTRING_it);
-}
-
-
-const ASN1_ITEM ASN1_UTCTIME_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = V_ASN1_UTCTIME,
-        .sname = "ASN1_UTCTIME",
-};
-
-ASN1_UTCTIME *
-d2i_ASN1_UTCTIME(ASN1_UTCTIME **a, const unsigned char **in, long len)
-{
-        return (ASN1_UTCTIME *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &ASN1_UTCTIME_it);
-}
-
-int
-i2d_ASN1_UTCTIME(ASN1_UTCTIME *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &ASN1_UTCTIME_it);
-}
-
-ASN1_UTCTIME *
-ASN1_UTCTIME_new(void)
-{
-        return (ASN1_UTCTIME *)ASN1_item_new(&ASN1_UTCTIME_it);
-}
-
-void
-ASN1_UTCTIME_free(ASN1_UTCTIME *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &ASN1_UTCTIME_it);
-}
-
-
-const ASN1_ITEM ASN1_GENERALIZEDTIME_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = V_ASN1_GENERALIZEDTIME,
-        .sname = "ASN1_GENERALIZEDTIME",
-};
-
-ASN1_GENERALIZEDTIME *
-d2i_ASN1_GENERALIZEDTIME(ASN1_GENERALIZEDTIME **a, const unsigned char **in,
-    long len)
-{
-        return (ASN1_GENERALIZEDTIME *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &ASN1_GENERALIZEDTIME_it);
-}
-
-int
-i2d_ASN1_GENERALIZEDTIME(ASN1_GENERALIZEDTIME *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &ASN1_GENERALIZEDTIME_it);
-}
-
-ASN1_GENERALIZEDTIME *
-ASN1_GENERALIZEDTIME_new(void)
-{
-        return (ASN1_GENERALIZEDTIME *)ASN1_item_new(&ASN1_GENERALIZEDTIME_it);
-}
-
-void
-ASN1_GENERALIZEDTIME_free(ASN1_GENERALIZEDTIME *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &ASN1_GENERALIZEDTIME_it);
-}
-
-
-const ASN1_ITEM ASN1_VISIBLESTRING_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = V_ASN1_VISIBLESTRING,
-        .sname = "ASN1_VISIBLESTRING",
-};
-
-ASN1_VISIBLESTRING *
-d2i_ASN1_VISIBLESTRING(ASN1_VISIBLESTRING **a, const unsigned char **in,
-    long len)
-{
-        return (ASN1_VISIBLESTRING *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &ASN1_VISIBLESTRING_it);
-}
-
-int
-i2d_ASN1_VISIBLESTRING(ASN1_VISIBLESTRING *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &ASN1_VISIBLESTRING_it);
-}
-
-ASN1_VISIBLESTRING *
-ASN1_VISIBLESTRING_new(void)
-{
-        return (ASN1_VISIBLESTRING *)ASN1_item_new(&ASN1_VISIBLESTRING_it);
-}
-
-void
-ASN1_VISIBLESTRING_free(ASN1_VISIBLESTRING *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &ASN1_VISIBLESTRING_it);
-}
-
-
-const ASN1_ITEM ASN1_UNIVERSALSTRING_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = V_ASN1_UNIVERSALSTRING,
-        .sname = "ASN1_UNIVERSALSTRING",
-};
-
-ASN1_UNIVERSALSTRING *
-d2i_ASN1_UNIVERSALSTRING(ASN1_UNIVERSALSTRING **a, const unsigned char **in,
-    long len)
-{
-        return (ASN1_UNIVERSALSTRING *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &ASN1_UNIVERSALSTRING_it);
-}
-
-int
-i2d_ASN1_UNIVERSALSTRING(ASN1_UNIVERSALSTRING *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &ASN1_UNIVERSALSTRING_it);
-}
-
-ASN1_UNIVERSALSTRING *
-ASN1_UNIVERSALSTRING_new(void)
-{
-        return (ASN1_UNIVERSALSTRING *)ASN1_item_new(&ASN1_UNIVERSALSTRING_it);
-}
-
-void
-ASN1_UNIVERSALSTRING_free(ASN1_UNIVERSALSTRING *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &ASN1_UNIVERSALSTRING_it);
-}
-
-
-const ASN1_ITEM ASN1_BMPSTRING_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = V_ASN1_BMPSTRING,
-        .sname = "ASN1_BMPSTRING",
-};
-
-ASN1_BMPSTRING *
-d2i_ASN1_BMPSTRING(ASN1_BMPSTRING **a, const unsigned char **in, long len)
-{
-        return (ASN1_BMPSTRING *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &ASN1_BMPSTRING_it);
-}
-
-int
-i2d_ASN1_BMPSTRING(ASN1_BMPSTRING *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &ASN1_BMPSTRING_it);
-}
-
-ASN1_BMPSTRING *
-ASN1_BMPSTRING_new(void)
-{
-        return (ASN1_BMPSTRING *)ASN1_item_new(&ASN1_BMPSTRING_it);
-}
-
-void
-ASN1_BMPSTRING_free(ASN1_BMPSTRING *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &ASN1_BMPSTRING_it);
-}
-
-
-const ASN1_ITEM ASN1_ANY_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = V_ASN1_ANY,
-        .sname = "ASN1_ANY",
-};
-
-/* Just swallow an ASN1_SEQUENCE in an ASN1_STRING */
-
-const ASN1_ITEM ASN1_SEQUENCE_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = V_ASN1_SEQUENCE,
-        .sname = "ASN1_SEQUENCE",
-};
-
-
-ASN1_TYPE *
-d2i_ASN1_TYPE(ASN1_TYPE **a, const unsigned char **in, long len)
-{
-        return (ASN1_TYPE *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &ASN1_ANY_it);
-}
-
-int
-i2d_ASN1_TYPE(ASN1_TYPE *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &ASN1_ANY_it);
-}
-
-ASN1_TYPE *
-ASN1_TYPE_new(void)
-{
-        return (ASN1_TYPE *)ASN1_item_new(&ASN1_ANY_it);
-}
-
-void
-ASN1_TYPE_free(ASN1_TYPE *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &ASN1_ANY_it);
-}
-
-/* Multistring types */
-
-
-const ASN1_ITEM ASN1_PRINTABLE_it = {
-        .itype = ASN1_ITYPE_MSTRING,
-        .utype = B_ASN1_PRINTABLE,
-        .templates = NULL,
-        .tcount = 0,
-        .funcs = NULL,
-        .size = sizeof(ASN1_STRING),
-        .sname = "ASN1_PRINTABLE",
-};
-
-ASN1_STRING *
-d2i_ASN1_PRINTABLE(ASN1_STRING **a, const unsigned char **in, long len)
-{
-        return (ASN1_STRING *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &ASN1_PRINTABLE_it);
-}
-
-int
-i2d_ASN1_PRINTABLE(ASN1_STRING *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &ASN1_PRINTABLE_it);
-}
-
-ASN1_STRING *
-ASN1_PRINTABLE_new(void)
-{
-        return (ASN1_STRING *)ASN1_item_new(&ASN1_PRINTABLE_it);
-}
-
-void
-ASN1_PRINTABLE_free(ASN1_STRING *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &ASN1_PRINTABLE_it);
-}
-
-
-const ASN1_ITEM DISPLAYTEXT_it = {
-        .itype = ASN1_ITYPE_MSTRING,
-        .utype = B_ASN1_DISPLAYTEXT,
-        .templates = NULL,
-        .tcount = 0,
-        .funcs = NULL,
-        .size = sizeof(ASN1_STRING),
-        .sname = "DISPLAYTEXT",
-};
-
-ASN1_STRING *
-d2i_DISPLAYTEXT(ASN1_STRING **a, const unsigned char **in, long len)
-{
-        return (ASN1_STRING *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &DISPLAYTEXT_it);
-}
-
-int
-i2d_DISPLAYTEXT(ASN1_STRING *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &DISPLAYTEXT_it);
-}
-
-ASN1_STRING *
-DISPLAYTEXT_new(void)
-{
-        return (ASN1_STRING *)ASN1_item_new(&DISPLAYTEXT_it);
-}
-
-void
-DISPLAYTEXT_free(ASN1_STRING *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &DISPLAYTEXT_it);
-}
-
-
-const ASN1_ITEM DIRECTORYSTRING_it = {
-        .itype = ASN1_ITYPE_MSTRING,
-        .utype = B_ASN1_DIRECTORYSTRING,
-        .templates = NULL,
-        .tcount = 0,
-        .funcs = NULL,
-        .size = sizeof(ASN1_STRING),
-        .sname = "DIRECTORYSTRING",
-};
-
-ASN1_STRING *
-d2i_DIRECTORYSTRING(ASN1_STRING **a, const unsigned char **in, long len)
-{
-        return (ASN1_STRING *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &DIRECTORYSTRING_it);
-}
-
-int
-i2d_DIRECTORYSTRING(ASN1_STRING *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &DIRECTORYSTRING_it);
-}
-
-ASN1_STRING *
-DIRECTORYSTRING_new(void)
-{
-        return (ASN1_STRING *)ASN1_item_new(&DIRECTORYSTRING_it);
-}
-
-void
-DIRECTORYSTRING_free(ASN1_STRING *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &DIRECTORYSTRING_it);
-}
-
-/* Three separate BOOLEAN type: normal, DEFAULT TRUE and DEFAULT FALSE */
-
-const ASN1_ITEM ASN1_BOOLEAN_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = V_ASN1_BOOLEAN,
-        .size = -1,
-        .sname = "ASN1_BOOLEAN",
-};
-
-const ASN1_ITEM ASN1_TBOOLEAN_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = V_ASN1_BOOLEAN,
-        .size = 1,
-        .sname = "ASN1_TBOOLEAN",
-};
-
-const ASN1_ITEM ASN1_FBOOLEAN_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = V_ASN1_BOOLEAN,
-        .size = 0,
-        .sname = "ASN1_FBOOLEAN",
-};
-
-/* Special, OCTET STRING with indefinite length constructed support */
-
-const ASN1_ITEM ASN1_OCTET_STRING_NDEF_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = V_ASN1_OCTET_STRING,
-        .size = ASN1_TFLG_NDEF,
-        .sname = "ASN1_OCTET_STRING_NDEF",
-};
-
-static const ASN1_TEMPLATE ASN1_SEQUENCE_ANY_item_tt = {
-        .flags = ASN1_TFLG_SEQUENCE_OF,
-        .tag = 0,
-        .offset = 0,
-        .field_name = "ASN1_SEQUENCE_ANY",
-        .item = &ASN1_ANY_it,
-};
-
-const ASN1_ITEM ASN1_SEQUENCE_ANY_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = -1,
-        .templates = &ASN1_SEQUENCE_ANY_item_tt,
-        .tcount = 0,
-        .funcs = NULL,
-        .size = 0,
-        .sname = "ASN1_SEQUENCE_ANY",
-};
-
-static const ASN1_TEMPLATE ASN1_SET_ANY_item_tt = {
-        .flags = ASN1_TFLG_SET_OF,
-        .tag = 0,
-        .offset = 0,
-        .field_name = "ASN1_SET_ANY",
-        .item = &ASN1_ANY_it,
-};
-
-const ASN1_ITEM ASN1_SET_ANY_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = -1,
-        .templates = &ASN1_SET_ANY_item_tt,
-        .tcount = 0,
-        .funcs = NULL,
-        .size = 0,
-        .sname = "ASN1_SET_ANY",
-};
-
-
-ASN1_SEQUENCE_ANY *
-d2i_ASN1_SEQUENCE_ANY(ASN1_SEQUENCE_ANY **a, const unsigned char **in, long len)
-{
-        return (ASN1_SEQUENCE_ANY *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &ASN1_SEQUENCE_ANY_it);
-}
-
-int
-i2d_ASN1_SEQUENCE_ANY(const ASN1_SEQUENCE_ANY *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &ASN1_SEQUENCE_ANY_it);
-}
-
-ASN1_SEQUENCE_ANY *
-d2i_ASN1_SET_ANY(ASN1_SEQUENCE_ANY **a, const unsigned char **in, long len)
-{
-        return (ASN1_SEQUENCE_ANY *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &ASN1_SET_ANY_it);
-}
-
-int
-i2d_ASN1_SET_ANY(const ASN1_SEQUENCE_ANY *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &ASN1_SET_ANY_it);
-}
diff --git a/src/lib/libcrypto/asn1/tasn_utl.c b/src/lib/libcrypto/asn1/tasn_utl.c
deleted file mode 100644
index 529aaf6116..0000000000
--- a/src/lib/libcrypto/asn1/tasn_utl.c
+++ /dev/null
@@ -1,281 +0,0 @@
-/* $OpenBSD: tasn_utl.c,v 1.11 2015/07/25 17:07:17 jsing Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 2000.
- */
-/* ====================================================================
- * Copyright (c) 2000-2004 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <stddef.h>
-#include <string.h>
-#include <openssl/asn1.h>
-#include <openssl/asn1t.h>
-#include <openssl/objects.h>
-#include <openssl/err.h>
-
-/* Utility functions for manipulating fields and offsets */
-
-/* Add 'offset' to 'addr' */
-#define offset2ptr(addr, offset) (void *)(((char *) addr) + offset)
-
-/* Given an ASN1_ITEM CHOICE type return
- * the selector value
- */
-
-int
-asn1_get_choice_selector(ASN1_VALUE **pval, const ASN1_ITEM *it)
-{
-        int *sel = offset2ptr(*pval, it->utype);
-        return *sel;
-}
-
-/* Given an ASN1_ITEM CHOICE type set
- * the selector value, return old value.
- */
-
-int
-asn1_set_choice_selector(ASN1_VALUE **pval, int value, const ASN1_ITEM *it)
-{
-        int *sel, ret;
-        sel = offset2ptr(*pval, it->utype);
-        ret = *sel;
-        *sel = value;
-        return ret;
-}
-
-/* Do reference counting. The value 'op' decides what to do.
- * if it is +1 then the count is incremented. If op is 0 count is
- * set to 1. If op is -1 count is decremented and the return value
- * is the current refrence count or 0 if no reference count exists.
- */
-
-int
-asn1_do_lock(ASN1_VALUE **pval, int op, const ASN1_ITEM *it)
-{
-        const ASN1_AUX *aux;
-        int *lck, ret;
-
-        if ((it->itype != ASN1_ITYPE_SEQUENCE) &&
-            (it->itype != ASN1_ITYPE_NDEF_SEQUENCE))
-                return 0;
-        aux = it->funcs;
-        if (!aux || !(aux->flags & ASN1_AFLG_REFCOUNT))
-                return 0;
-        lck = offset2ptr(*pval, aux->ref_offset);
-        if (op == 0) {
-                *lck = 1;
-                return 1;
-        }
-        ret = CRYPTO_add(lck, op, aux->ref_lock);
-        return ret;
-}
-
-static ASN1_ENCODING *
-asn1_get_enc_ptr(ASN1_VALUE **pval, const ASN1_ITEM *it)
-{
-        const ASN1_AUX *aux;
-
-        if (!pval || !*pval)
-                return NULL;
-        aux = it->funcs;
-        if (!aux || !(aux->flags & ASN1_AFLG_ENCODING))
-                return NULL;
-        return offset2ptr(*pval, aux->enc_offset);
-}
-
-void
-asn1_enc_init(ASN1_VALUE **pval, const ASN1_ITEM *it)
-{
-        ASN1_ENCODING *enc;
-
-        enc = asn1_get_enc_ptr(pval, it);
-        if (enc) {
-                enc->enc = NULL;
-                enc->len = 0;
-                enc->modified = 1;
-        }
-}
-
-void
-asn1_enc_free(ASN1_VALUE **pval, const ASN1_ITEM *it)
-{
-        ASN1_ENCODING *enc;
-
-        enc = asn1_get_enc_ptr(pval, it);
-        if (enc) {
-                free(enc->enc);
-                enc->enc = NULL;
-                enc->len = 0;
-                enc->modified = 1;
-        }
-}
-
-int
-asn1_enc_save(ASN1_VALUE **pval, const unsigned char *in, int inlen,
-    const ASN1_ITEM *it)
-{
-        ASN1_ENCODING *enc;
-
-        enc = asn1_get_enc_ptr(pval, it);
-        if (!enc)
-                return 1;
-
-        free(enc->enc);
-        enc->enc = malloc(inlen);
-        if (!enc->enc)
-                return 0;
-        memcpy(enc->enc, in, inlen);
-        enc->len = inlen;
-        enc->modified = 0;
-
-        return 1;
-}
-
-int
-asn1_enc_restore(int *len, unsigned char **out, ASN1_VALUE **pval,
-    const ASN1_ITEM *it)
-{
-        ASN1_ENCODING *enc;
-
-        enc = asn1_get_enc_ptr(pval, it);
-        if (!enc || enc->modified)
-                return 0;
-        if (out) {
-                memcpy(*out, enc->enc, enc->len);
-                *out += enc->len;
-        }
-        if (len)
-                *len = enc->len;
-        return 1;
-}
-
-/* Given an ASN1_TEMPLATE get a pointer to a field */
-ASN1_VALUE **
-asn1_get_field_ptr(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt)
-{
-        ASN1_VALUE **pvaltmp;
-
-        if (tt->flags & ASN1_TFLG_COMBINE)
-                return pval;
-        pvaltmp = offset2ptr(*pval, tt->offset);
-        /* NOTE for BOOLEAN types the field is just a plain
-         * int so we can't return int **, so settle for
-         * (int *).
-         */
-        return pvaltmp;
-}
-
-/* Handle ANY DEFINED BY template, find the selector, look up
- * the relevant ASN1_TEMPLATE in the table and return it.
- */
-
-const ASN1_TEMPLATE *
-asn1_do_adb(ASN1_VALUE **pval, const ASN1_TEMPLATE *tt, int nullerr)
-{
-        const ASN1_ADB *adb;
-        const ASN1_ADB_TABLE *atbl;
-        long selector;
-        ASN1_VALUE **sfld;
-        int i;
-
-        if (!(tt->flags & ASN1_TFLG_ADB_MASK))
-                return tt;
-
-        /* Else ANY DEFINED BY ... get the table */
-        adb = (const ASN1_ADB *)tt->item;
-
-        /* Get the selector field */
-        sfld = offset2ptr(*pval, adb->offset);
-
-        /* Check if NULL */
-        if (!sfld) {
-                if (!adb->null_tt)
-                        goto err;
-                return adb->null_tt;
-        }
-
-        /* Convert type to a long:
-         * NB: don't check for NID_undef here because it
-         * might be a legitimate value in the table
-         */
-        if (tt->flags & ASN1_TFLG_ADB_OID)
-                selector = OBJ_obj2nid((ASN1_OBJECT *)*sfld);
-        else
-                selector = ASN1_INTEGER_get((ASN1_INTEGER *)*sfld);
-
-        /* Try to find matching entry in table
-         * Maybe should check application types first to
-         * allow application override? Might also be useful
-         * to have a flag which indicates table is sorted and
-         * we can do a binary search. For now stick to a
-         * linear search.
-         */
-
-        for (atbl = adb->tbl, i = 0; i < adb->tblcount; i++, atbl++)
-                if (atbl->value == selector)
-                        return &atbl->tt;
-
-        /* FIXME: need to search application table too */
-
-        /* No match, return default type */
-        if (!adb->default_tt)
-                goto err;
-        return adb->default_tt;
-
-err:
-        /* FIXME: should log the value or OID of unsupported type */
-        if (nullerr)
-                ASN1err(ASN1_F_ASN1_DO_ADB,
-                    ASN1_R_UNSUPPORTED_ANY_DEFINED_BY_TYPE);
-        return NULL;
-}
diff --git a/src/lib/libcrypto/asn1/x_algor.c b/src/lib/libcrypto/asn1/x_algor.c
deleted file mode 100644
index 27405a2bfb..0000000000
--- a/src/lib/libcrypto/asn1/x_algor.c
+++ /dev/null
@@ -1,222 +0,0 @@
-/* $OpenBSD: x_algor.c,v 1.21 2015/07/24 15:09:52 jsing Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 2000.
- */
-/* ====================================================================
- * Copyright (c) 2000 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <stddef.h>
-#include <openssl/x509.h>
-#include <openssl/asn1.h>
-#include <openssl/asn1t.h>
-
-static const ASN1_TEMPLATE X509_ALGOR_seq_tt[] = {
-        {
-                .offset = offsetof(X509_ALGOR, algorithm),
-                .field_name = "algorithm",
-                .item = &ASN1_OBJECT_it,
-        },
-        {
-                .flags = ASN1_TFLG_OPTIONAL,
-                .offset = offsetof(X509_ALGOR, parameter),
-                .field_name = "parameter",
-                .item = &ASN1_ANY_it,
-        },
-};
-
-const ASN1_ITEM X509_ALGOR_it = {
-        .itype = ASN1_ITYPE_SEQUENCE,
-        .utype = V_ASN1_SEQUENCE,
-        .templates = X509_ALGOR_seq_tt,
-        .tcount = sizeof(X509_ALGOR_seq_tt) / sizeof(ASN1_TEMPLATE),
-        .size = sizeof(X509_ALGOR),
-        .sname = "X509_ALGOR",
-};
-
-static const ASN1_TEMPLATE X509_ALGORS_item_tt = {
-        .flags = ASN1_TFLG_SEQUENCE_OF,
-        .tag = 0,
-        .offset = 0,
-        .field_name = "algorithms",
-        .item = &X509_ALGOR_it,
-};
-
-const ASN1_ITEM X509_ALGORS_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = -1,
-        .templates = &X509_ALGORS_item_tt,
-        .tcount = 0,
-        .funcs = NULL,
-        .size = 0,
-        .sname = "X509_ALGORS",
-};
-
-
-X509_ALGOR *
-d2i_X509_ALGOR(X509_ALGOR **a, const unsigned char **in, long len)
-{
-        return (X509_ALGOR *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &X509_ALGOR_it);
-}
-
-int
-i2d_X509_ALGOR(X509_ALGOR *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &X509_ALGOR_it);
-}
-
-X509_ALGOR *
-X509_ALGOR_new(void)
-{
-        return (X509_ALGOR *)ASN1_item_new(&X509_ALGOR_it);
-}
-
-void
-X509_ALGOR_free(X509_ALGOR *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &X509_ALGOR_it);
-}
-
-X509_ALGORS *
-d2i_X509_ALGORS(X509_ALGORS **a, const unsigned char **in, long len)
-{
-        return (X509_ALGORS *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &X509_ALGORS_it);
-}
-
-int
-i2d_X509_ALGORS(X509_ALGORS *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &X509_ALGORS_it);
-}
-
-X509_ALGOR *
-X509_ALGOR_dup(X509_ALGOR *x)
-{
-        return ASN1_item_dup(&X509_ALGOR_it, x);
-}
-
-int
-X509_ALGOR_set0(X509_ALGOR *alg, ASN1_OBJECT *aobj, int ptype, void *pval)
-{
-        if (!alg)
-                return 0;
-        if (ptype != V_ASN1_UNDEF) {
-                if (alg->parameter == NULL)
-                        alg->parameter = ASN1_TYPE_new();
-                if (alg->parameter == NULL)
-                        return 0;
-        }
-        if (alg) {
-                if (alg->algorithm)
-                        ASN1_OBJECT_free(alg->algorithm);
-                alg->algorithm = aobj;
-        }
-        if (ptype == 0)
-                return 1;
-        if (ptype == V_ASN1_UNDEF) {
-                if (alg->parameter) {
-                        ASN1_TYPE_free(alg->parameter);
-                        alg->parameter = NULL;
-                }
-        } else
-                ASN1_TYPE_set(alg->parameter, ptype, pval);
-        return 1;
-}
-
-void
-X509_ALGOR_get0(ASN1_OBJECT **paobj, int *pptype, void **ppval,
-    X509_ALGOR *algor)
-{
-        if (paobj)
-                *paobj = algor->algorithm;
-        if (pptype) {
-                if (algor->parameter == NULL) {
-                        *pptype = V_ASN1_UNDEF;
-                        return;
-                } else
-                        *pptype = algor->parameter->type;
-                if (ppval)
-                        *ppval = algor->parameter->value.ptr;
-        }
-}
-
-/* Set up an X509_ALGOR DigestAlgorithmIdentifier from an EVP_MD */
-
-void
-X509_ALGOR_set_md(X509_ALGOR *alg, const EVP_MD *md)
-{
-        int param_type;
-
-        if (md->flags & EVP_MD_FLAG_DIGALGID_ABSENT)
-                param_type = V_ASN1_UNDEF;
-        else
-                param_type = V_ASN1_NULL;
-
-        X509_ALGOR_set0(alg, OBJ_nid2obj(EVP_MD_type(md)), param_type, NULL);
-}
-
-/* Returns 0 if they are equal, != 0 otherwise. */
-int
-X509_ALGOR_cmp(const X509_ALGOR *a, const X509_ALGOR *b)
-{
-        int rv = OBJ_cmp(a->algorithm, b->algorithm);
-        if (!rv) {
-                if (!a->parameter && !b->parameter)
-                        rv = 0;
-                else
-                        rv = ASN1_TYPE_cmp(a->parameter, b->parameter);
-        }
-        return(rv);
-}
diff --git a/src/lib/libcrypto/asn1/x_attrib.c b/src/lib/libcrypto/asn1/x_attrib.c
deleted file mode 100644
index bb74a1b6c7..0000000000
--- a/src/lib/libcrypto/asn1/x_attrib.c
+++ /dev/null
@@ -1,198 +0,0 @@
-/* $OpenBSD: x_attrib.c,v 1.13 2015/02/14 14:56:45 jsing Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-
-#include <openssl/asn1t.h>
-#include <openssl/objects.h>
-#include <openssl/x509.h>
-
-/* X509_ATTRIBUTE: this has the following form:
- *
- * typedef struct x509_attributes_st
- *      {
- *      ASN1_OBJECT *object;
- *      int single;
- *      union   {
- *              char            *ptr;
- *              STACK_OF(ASN1_TYPE) *set;
- *              ASN1_TYPE       *single;
- *              } value;
- *      } X509_ATTRIBUTE;
- *
- * this needs some extra thought because the CHOICE type is
- * merged with the main structure and because the value can
- * be anything at all we *must* try the SET OF first because
- * the ASN1_ANY type will swallow anything including the whole
- * SET OF structure.
- */
-
-static const ASN1_TEMPLATE X509_ATTRIBUTE_SET_ch_tt[] = {
-        {
-                .flags = ASN1_TFLG_SET_OF,
-                .tag = 0,
-                .offset = offsetof(X509_ATTRIBUTE, value.set),
-                .field_name = "value.set",
-                .item = &ASN1_ANY_it,
-        },
-        {
-                .flags = 0,
-                .tag = 0,
-                .offset = offsetof(X509_ATTRIBUTE, value.single),
-                .field_name = "value.single",
-                .item = &ASN1_ANY_it,
-        },
-};
-
-const ASN1_ITEM X509_ATTRIBUTE_SET_it = {
-        .itype = ASN1_ITYPE_CHOICE,
-        .utype = offsetof(X509_ATTRIBUTE, single),
-        .templates = X509_ATTRIBUTE_SET_ch_tt,
-        .tcount = sizeof(X509_ATTRIBUTE_SET_ch_tt) / sizeof(ASN1_TEMPLATE),
-        .funcs = NULL,
-        .size = sizeof(X509_ATTRIBUTE),
-        .sname = "X509_ATTRIBUTE",
-};
-
-static const ASN1_TEMPLATE X509_ATTRIBUTE_seq_tt[] = {
-        {
-                .flags = 0,
-                .tag = 0,
-                .offset = offsetof(X509_ATTRIBUTE, object),
-                .field_name = "object",
-                .item = &ASN1_OBJECT_it,
-        },
-        /* CHOICE type merged with parent */
-        {
-                .flags = 0 | ASN1_TFLG_COMBINE,
-                .tag = 0,
-                .offset = 0,
-                .field_name = NULL,
-                .item = &X509_ATTRIBUTE_SET_it,
-        },
-};
-
-const ASN1_ITEM X509_ATTRIBUTE_it = {
-        .itype = ASN1_ITYPE_SEQUENCE,
-        .utype = V_ASN1_SEQUENCE,
-        .templates = X509_ATTRIBUTE_seq_tt,
-        .tcount = sizeof(X509_ATTRIBUTE_seq_tt) / sizeof(ASN1_TEMPLATE),
-        .funcs = NULL,
-        .size = sizeof(X509_ATTRIBUTE),
-        .sname = "X509_ATTRIBUTE",
-};
-
-
-X509_ATTRIBUTE *
-d2i_X509_ATTRIBUTE(X509_ATTRIBUTE **a, const unsigned char **in, long len)
-{
-        return (X509_ATTRIBUTE *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &X509_ATTRIBUTE_it);
-}
-
-int
-i2d_X509_ATTRIBUTE(X509_ATTRIBUTE *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &X509_ATTRIBUTE_it);
-}
-
-X509_ATTRIBUTE *
-X509_ATTRIBUTE_new(void)
-{
-        return (X509_ATTRIBUTE *)ASN1_item_new(&X509_ATTRIBUTE_it);
-}
-
-void
-X509_ATTRIBUTE_free(X509_ATTRIBUTE *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &X509_ATTRIBUTE_it);
-}
-
-X509_ATTRIBUTE *
-X509_ATTRIBUTE_dup(X509_ATTRIBUTE *x)
-{
-        return ASN1_item_dup(&X509_ATTRIBUTE_it, x);
-}
-
-X509_ATTRIBUTE *
-X509_ATTRIBUTE_create(int nid, int atrtype, void *value)
-{
-        X509_ATTRIBUTE *ret = NULL;
-        ASN1_TYPE *val = NULL;
-
-        if ((ret = X509_ATTRIBUTE_new()) == NULL)
-                return (NULL);
-        ret->object = OBJ_nid2obj(nid);
-        ret->single = 0;
-        if ((ret->value.set = sk_ASN1_TYPE_new_null()) == NULL)
-                goto err;
-        if ((val = ASN1_TYPE_new()) == NULL)
-                goto err;
-        if (!sk_ASN1_TYPE_push(ret->value.set, val))
-                goto err;
-
-        ASN1_TYPE_set(val, atrtype, value);
-        return (ret);
-
-err:
-        if (ret != NULL)
-                X509_ATTRIBUTE_free(ret);
-        if (val != NULL)
-                ASN1_TYPE_free(val);
-        return (NULL);
-}
diff --git a/src/lib/libcrypto/asn1/x_bignum.c b/src/lib/libcrypto/asn1/x_bignum.c
deleted file mode 100644
index 73f0f73c1c..0000000000
--- a/src/lib/libcrypto/asn1/x_bignum.c
+++ /dev/null
@@ -1,167 +0,0 @@
-/* $OpenBSD: x_bignum.c,v 1.8 2015/07/25 17:07:17 jsing Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 2000.
- */
-/* ====================================================================
- * Copyright (c) 2000 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <stdio.h>
-
-#include <openssl/asn1t.h>
-#include <openssl/bn.h>
-
-/*
- * Custom primitive type for BIGNUM handling. This reads in an ASN1_INTEGER as a
- * BIGNUM directly. Currently it ignores the sign which isn't a problem since
- * all BIGNUMs used are non negative and anything that looks negative is
- * normally due to an encoding error.
- */
-
-static int bn_new(ASN1_VALUE **pval, const ASN1_ITEM *it);
-static void bn_free(ASN1_VALUE **pval, const ASN1_ITEM *it);
-
-static int bn_i2c(ASN1_VALUE **pval, unsigned char *cont, int *putype,
-    const ASN1_ITEM *it);
-static int bn_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
-    int utype, char *free_cont, const ASN1_ITEM *it);
-
-static ASN1_PRIMITIVE_FUNCS bignum_pf = {
-        NULL,
-        0,
-        bn_new,
-        bn_free,
-        0,
-        bn_c2i,
-        bn_i2c
-};
-
-const ASN1_ITEM BIGNUM_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = V_ASN1_INTEGER,
-        .templates = NULL,
-        .tcount = 0,
-        .funcs = &bignum_pf,
-        .size = 0,
-        .sname = "BIGNUM",
-};
-
-const ASN1_ITEM CBIGNUM_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = V_ASN1_INTEGER,
-        .templates = NULL,
-        .tcount = 0,
-        .funcs = &bignum_pf,
-        .size = 0,
-        .sname = "BIGNUM",
-};
-
-static int
-bn_new(ASN1_VALUE **pval, const ASN1_ITEM *it)
-{
-        *pval = (ASN1_VALUE *)BN_new();
-        if (*pval)
-                return 1;
-        else
-                return 0;
-}
-
-static void
-bn_free(ASN1_VALUE **pval, const ASN1_ITEM *it)
-{
-        if (*pval == NULL)
-                return;
-        BN_clear_free((BIGNUM *)*pval);
-        *pval = NULL;
-}
-
-static int
-bn_i2c(ASN1_VALUE **pval, unsigned char *cont, int *putype, const ASN1_ITEM *it)
-{
-        BIGNUM *bn;
-        int pad, len;
-
-        if (*pval == NULL)
-                return -1;
-        bn = (BIGNUM *)*pval;
-        /* If MSB set in an octet we need a padding byte */
-        if (BN_num_bits(bn) & 0x7)
-                pad = 0;
-        else
-                pad = 1;
-        if (cont) {
-                if (pad)
-                        *cont++ = 0;
-                len = BN_bn2bin(bn, cont);
-        } else
-                len = BN_num_bytes(bn);
-        return pad + len;
-}
-
-static int
-bn_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len, int utype,
-    char *free_cont, const ASN1_ITEM *it)
-{
-        BIGNUM *bn;
-
-        if (*pval == NULL) {
-                if (bn_new(pval, it) == 0)
-                        return 0;
-        }
-        bn = (BIGNUM *)*pval;
-        if (!BN_bin2bn(cont, len, bn)) {
-                bn_free(pval, it);
-                return 0;
-        }
-        return 1;
-}
diff --git a/src/lib/libcrypto/asn1/x_crl.c b/src/lib/libcrypto/asn1/x_crl.c
deleted file mode 100644
index 6062587ed4..0000000000
--- a/src/lib/libcrypto/asn1/x_crl.c
+++ /dev/null
@@ -1,687 +0,0 @@
-/* $OpenBSD: x_crl.c,v 1.25 2015/07/20 15:29:13 miod Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-
-#include <openssl/opensslconf.h>
-
-#include <openssl/asn1t.h>
-#include <openssl/err.h>
-#include <openssl/x509.h>
-#include <openssl/x509v3.h>
-
-#include "asn1_locl.h"
-
-static int X509_REVOKED_cmp(const X509_REVOKED * const *a,
-    const X509_REVOKED * const *b);
-static void setup_idp(X509_CRL *crl, ISSUING_DIST_POINT *idp);
-
-static const ASN1_TEMPLATE X509_REVOKED_seq_tt[] = {
-        {
-                .offset = offsetof(X509_REVOKED, serialNumber),
-                .field_name = "serialNumber",
-                .item = &ASN1_INTEGER_it,
-        },
-        {
-                .offset = offsetof(X509_REVOKED, revocationDate),
-                .field_name = "revocationDate",
-                .item = &ASN1_TIME_it,
-        },
-        {
-                .flags = ASN1_TFLG_SEQUENCE_OF | ASN1_TFLG_OPTIONAL,
-                .offset = offsetof(X509_REVOKED, extensions),
-                .field_name = "extensions",
-                .item = &X509_EXTENSION_it,
-        },
-};
-
-const ASN1_ITEM X509_REVOKED_it = {
-        .itype = ASN1_ITYPE_SEQUENCE,
-        .utype = V_ASN1_SEQUENCE,
-        .templates = X509_REVOKED_seq_tt,
-        .tcount = sizeof(X509_REVOKED_seq_tt) / sizeof(ASN1_TEMPLATE),
-        .size = sizeof(X509_REVOKED),
-        .sname = "X509_REVOKED",
-};
-
-static int def_crl_verify(X509_CRL *crl, EVP_PKEY *r);
-static int def_crl_lookup(X509_CRL *crl, X509_REVOKED **ret,
-    ASN1_INTEGER *serial, X509_NAME *issuer);
-
-static X509_CRL_METHOD int_crl_meth = {
-        .crl_lookup = def_crl_lookup,
-        .crl_verify = def_crl_verify
-};
-
-static const X509_CRL_METHOD *default_crl_method = &int_crl_meth;
-
-/* The X509_CRL_INFO structure needs a bit of customisation.
- * Since we cache the original encoding the signature wont be affected by
- * reordering of the revoked field.
- */
-static int
-crl_inf_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it, void *exarg)
-{
-        X509_CRL_INFO *a = (X509_CRL_INFO *)*pval;
-
-        if (!a || !a->revoked)
-                return 1;
-        switch (operation) {
-                /* Just set cmp function here. We don't sort because that
-                 * would affect the output of X509_CRL_print().
-                 */
-        case ASN1_OP_D2I_POST:
-                (void)sk_X509_REVOKED_set_cmp_func(a->revoked, X509_REVOKED_cmp);
-                break;
-        }
-        return 1;
-}
-
-
-static const ASN1_AUX X509_CRL_INFO_aux = {
-        .flags = ASN1_AFLG_ENCODING,
-        .asn1_cb = crl_inf_cb,
-        .enc_offset = offsetof(X509_CRL_INFO, enc),
-};
-static const ASN1_TEMPLATE X509_CRL_INFO_seq_tt[] = {
-        {
-                .flags = ASN1_TFLG_OPTIONAL,
-                .offset = offsetof(X509_CRL_INFO, version),
-                .field_name = "version",
-                .item = &ASN1_INTEGER_it,
-        },
-        {
-                .offset = offsetof(X509_CRL_INFO, sig_alg),
-                .field_name = "sig_alg",
-                .item = &X509_ALGOR_it,
-        },
-        {
-                .offset = offsetof(X509_CRL_INFO, issuer),
-                .field_name = "issuer",
-                .item = &X509_NAME_it,
-        },
-        {
-                .offset = offsetof(X509_CRL_INFO, lastUpdate),
-                .field_name = "lastUpdate",
-                .item = &ASN1_TIME_it,
-        },
-        {
-                .flags = ASN1_TFLG_OPTIONAL,
-                .offset = offsetof(X509_CRL_INFO, nextUpdate),
-                .field_name = "nextUpdate",
-                .item = &ASN1_TIME_it,
-        },
-        {
-                .flags = ASN1_TFLG_SEQUENCE_OF | ASN1_TFLG_OPTIONAL,
-                .offset = offsetof(X509_CRL_INFO, revoked),
-                .field_name = "revoked",
-                .item = &X509_REVOKED_it,
-        },
-        {
-                .flags = ASN1_TFLG_EXPLICIT | ASN1_TFLG_SEQUENCE_OF | ASN1_TFLG_OPTIONAL,
-                .offset = offsetof(X509_CRL_INFO, extensions),
-                .field_name = "extensions",
-                .item = &X509_EXTENSION_it,
-        },
-};
-
-const ASN1_ITEM X509_CRL_INFO_it = {
-        .itype = ASN1_ITYPE_SEQUENCE,
-        .utype = V_ASN1_SEQUENCE,
-        .templates = X509_CRL_INFO_seq_tt,
-        .tcount = sizeof(X509_CRL_INFO_seq_tt) / sizeof(ASN1_TEMPLATE),
-        .funcs = &X509_CRL_INFO_aux,
-        .size = sizeof(X509_CRL_INFO),
-        .sname = "X509_CRL_INFO",
-};
-
-/* Set CRL entry issuer according to CRL certificate issuer extension.
- * Check for unhandled critical CRL entry extensions.
- */
-
-static int
-crl_set_issuers(X509_CRL *crl)
-{
-        int i, j;
-        GENERAL_NAMES *gens, *gtmp;
-        STACK_OF(X509_REVOKED) *revoked;
-
-        revoked = X509_CRL_get_REVOKED(crl);
-
-        gens = NULL;
-        for (i = 0; i < sk_X509_REVOKED_num(revoked); i++) {
-                X509_REVOKED *rev = sk_X509_REVOKED_value(revoked, i);
-                STACK_OF(X509_EXTENSION) *exts;
-                ASN1_ENUMERATED *reason;
-                X509_EXTENSION *ext;
-                gtmp = X509_REVOKED_get_ext_d2i(rev, NID_certificate_issuer,
-                    &j, NULL);
-                if (!gtmp && (j != -1)) {
-                        crl->flags |= EXFLAG_INVALID;
-                        return 1;
-                }
-
-                if (gtmp) {
-                        gens = gtmp;
-                        if (!crl->issuers) {
-                                crl->issuers = sk_GENERAL_NAMES_new_null();
-                                if (!crl->issuers)
-                                        return 0;
-                        }
-                        if (!sk_GENERAL_NAMES_push(crl->issuers, gtmp))
-                                return 0;
-                }
-                rev->issuer = gens;
-
-                reason = X509_REVOKED_get_ext_d2i(rev, NID_crl_reason,
-                    &j, NULL);
-                if (!reason && (j != -1)) {
-                        crl->flags |= EXFLAG_INVALID;
-                        return 1;
-                }
-
-                if (reason) {
-                        rev->reason = ASN1_ENUMERATED_get(reason);
-                        ASN1_ENUMERATED_free(reason);
-                } else
-                        rev->reason = CRL_REASON_NONE;
-
-                /* Check for critical CRL entry extensions */
-
-                exts = rev->extensions;
-
-                for (j = 0; j < sk_X509_EXTENSION_num(exts); j++) {
-                        ext = sk_X509_EXTENSION_value(exts, j);
-                        if (ext->critical > 0) {
-                                if (OBJ_obj2nid(ext->object) ==
-                                    NID_certificate_issuer)
-                                        continue;
-                                crl->flags |= EXFLAG_CRITICAL;
-                                break;
-                        }
-                }
-        }
-
-        return 1;
-}
-
-/* The X509_CRL structure needs a bit of customisation. Cache some extensions
- * and hash of the whole CRL.
- */
-static int
-crl_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it, void *exarg)
-{
-        X509_CRL *crl = (X509_CRL *)*pval;
-        STACK_OF(X509_EXTENSION) *exts;
-        X509_EXTENSION *ext;
-        int idx;
-        int rc = 1;
-
-        switch (operation) {
-        case ASN1_OP_NEW_POST:
-                crl->idp = NULL;
-                crl->akid = NULL;
-                crl->flags = 0;
-                crl->idp_flags = 0;
-                crl->idp_reasons = CRLDP_ALL_REASONS;
-                crl->meth = default_crl_method;
-                crl->meth_data = NULL;
-                crl->issuers = NULL;
-                crl->crl_number = NULL;
-                crl->base_crl_number = NULL;
-                break;
-
-        case ASN1_OP_D2I_POST:
-#ifndef OPENSSL_NO_SHA
-                X509_CRL_digest(crl, EVP_sha1(), crl->sha1_hash, NULL);
-#endif
-                crl->idp = X509_CRL_get_ext_d2i(crl,
-                    NID_issuing_distribution_point, NULL, NULL);
-                if (crl->idp)
-                        setup_idp(crl, crl->idp);
-
-                crl->akid = X509_CRL_get_ext_d2i(crl,
-                    NID_authority_key_identifier, NULL, NULL);
-
-                crl->crl_number = X509_CRL_get_ext_d2i(crl,
-                    NID_crl_number, NULL, NULL);
-
-                crl->base_crl_number = X509_CRL_get_ext_d2i(crl,
-                    NID_delta_crl, NULL, NULL);
-                /* Delta CRLs must have CRL number */
-                if (crl->base_crl_number && !crl->crl_number)
-                        crl->flags |= EXFLAG_INVALID;
-
-                /* See if we have any unhandled critical CRL extensions and
-                 * indicate this in a flag. We only currently handle IDP,
-                 * AKID and deltas, so anything else critical sets the flag.
-                 *
-                 * This code accesses the X509_CRL structure directly:
-                 * applications shouldn't do this.
-                 */
-
-                exts = crl->crl->extensions;
-
-                for (idx = 0; idx < sk_X509_EXTENSION_num(exts); idx++) {
-                        int nid;
-                        ext = sk_X509_EXTENSION_value(exts, idx);
-                        nid = OBJ_obj2nid(ext->object);
-                        if (nid == NID_freshest_crl)
-                                crl->flags |= EXFLAG_FRESHEST;
-                        if (ext->critical > 0) {
-                                /* We handle IDP, AKID and deltas */
-                                if (nid == NID_issuing_distribution_point ||
-                                    nid == NID_authority_key_identifier ||
-                                    nid == NID_delta_crl)
-                                        break;
-                                crl->flags |= EXFLAG_CRITICAL;
-                                break;
-                        }
-                }
-
-                if (!crl_set_issuers(crl))
-                        return 0;
-
-                if (crl->meth->crl_init) {
-                        if (crl->meth->crl_init(crl) == 0)
-                                return 0;
-                }
-                break;
-
-        case ASN1_OP_FREE_POST:
-                if (crl->meth->crl_free) {
-                        if (!crl->meth->crl_free(crl))
-                                rc = 0;
-                }
-                if (crl->akid)
-                        AUTHORITY_KEYID_free(crl->akid);
-                if (crl->idp)
-                        ISSUING_DIST_POINT_free(crl->idp);
-                ASN1_INTEGER_free(crl->crl_number);
-                ASN1_INTEGER_free(crl->base_crl_number);
-                sk_GENERAL_NAMES_pop_free(crl->issuers, GENERAL_NAMES_free);
-                break;
-        }
-        return rc;
-}
-
-/* Convert IDP into a more convenient form */
-
-static void
-setup_idp(X509_CRL *crl, ISSUING_DIST_POINT *idp)
-{
-        int idp_only = 0;
-
-        /* Set various flags according to IDP */
-        crl->idp_flags |= IDP_PRESENT;
-        if (idp->onlyuser > 0) {
-                idp_only++;
-                crl->idp_flags |= IDP_ONLYUSER;
-        }
-        if (idp->onlyCA > 0) {
-                idp_only++;
-                crl->idp_flags |= IDP_ONLYCA;
-        }
-        if (idp->onlyattr > 0) {
-                idp_only++;
-                crl->idp_flags |= IDP_ONLYATTR;
-        }
-
-        if (idp_only > 1)
-                crl->idp_flags |= IDP_INVALID;
-
-        if (idp->indirectCRL > 0)
-                crl->idp_flags |= IDP_INDIRECT;
-
-        if (idp->onlysomereasons) {
-                crl->idp_flags |= IDP_REASONS;
-                if (idp->onlysomereasons->length > 0)
-                        crl->idp_reasons = idp->onlysomereasons->data[0];
-                if (idp->onlysomereasons->length > 1)
-                        crl->idp_reasons |=
-                            (idp->onlysomereasons->data[1] << 8);
-                crl->idp_reasons &= CRLDP_ALL_REASONS;
-        }
-
-        DIST_POINT_set_dpname(idp->distpoint, X509_CRL_get_issuer(crl));
-}
-
-static const ASN1_AUX X509_CRL_aux = {
-        .app_data = NULL,
-        .flags = ASN1_AFLG_REFCOUNT,
-        .ref_offset = offsetof(X509_CRL, references),
-        .ref_lock = CRYPTO_LOCK_X509_CRL,
-        .asn1_cb = crl_cb,
-};
-static const ASN1_TEMPLATE X509_CRL_seq_tt[] = {
-        {
-                .offset = offsetof(X509_CRL, crl),
-                .field_name = "crl",
-                .item = &X509_CRL_INFO_it,
-        },
-        {
-                .offset = offsetof(X509_CRL, sig_alg),
-                .field_name = "sig_alg",
-                .item = &X509_ALGOR_it,
-        },
-        {
-                .offset = offsetof(X509_CRL, signature),
-                .field_name = "signature",
-                .item = &ASN1_BIT_STRING_it,
-        },
-};
-
-const ASN1_ITEM X509_CRL_it = {
-        .itype = ASN1_ITYPE_SEQUENCE,
-        .utype = V_ASN1_SEQUENCE,
-        .templates = X509_CRL_seq_tt,
-        .tcount = sizeof(X509_CRL_seq_tt) / sizeof(ASN1_TEMPLATE),
-        .funcs = &X509_CRL_aux,
-        .size = sizeof(X509_CRL),
-        .sname = "X509_CRL",
-};
-
-
-X509_REVOKED *
-d2i_X509_REVOKED(X509_REVOKED **a, const unsigned char **in, long len)
-{
-        return (X509_REVOKED *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &X509_REVOKED_it);
-}
-
-int
-i2d_X509_REVOKED(X509_REVOKED *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &X509_REVOKED_it);
-}
-
-X509_REVOKED *
-X509_REVOKED_new(void)
-{
-        return (X509_REVOKED *)ASN1_item_new(&X509_REVOKED_it);
-}
-
-void
-X509_REVOKED_free(X509_REVOKED *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &X509_REVOKED_it);
-}
-
-X509_CRL_INFO *
-d2i_X509_CRL_INFO(X509_CRL_INFO **a, const unsigned char **in, long len)
-{
-        return (X509_CRL_INFO *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &X509_CRL_INFO_it);
-}
-
-int
-i2d_X509_CRL_INFO(X509_CRL_INFO *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &X509_CRL_INFO_it);
-}
-
-X509_CRL_INFO *
-X509_CRL_INFO_new(void)
-{
-        return (X509_CRL_INFO *)ASN1_item_new(&X509_CRL_INFO_it);
-}
-
-void
-X509_CRL_INFO_free(X509_CRL_INFO *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &X509_CRL_INFO_it);
-}
-
-X509_CRL *
-d2i_X509_CRL(X509_CRL **a, const unsigned char **in, long len)
-{
-        return (X509_CRL *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &X509_CRL_it);
-}
-
-int
-i2d_X509_CRL(X509_CRL *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &X509_CRL_it);
-}
-
-X509_CRL *
-X509_CRL_new(void)
-{
-        return (X509_CRL *)ASN1_item_new(&X509_CRL_it);
-}
-
-void
-X509_CRL_free(X509_CRL *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &X509_CRL_it);
-}
-
-X509_CRL *
-X509_CRL_dup(X509_CRL *x)
-{
-        return ASN1_item_dup(&X509_CRL_it, x);
-}
-
-static int
-X509_REVOKED_cmp(const X509_REVOKED * const *a, const X509_REVOKED * const *b)
-{
-        return(ASN1_STRING_cmp(
-            (ASN1_STRING *)(*a)->serialNumber,
-            (ASN1_STRING *)(*b)->serialNumber));
-}
-
-int
-X509_CRL_add0_revoked(X509_CRL *crl, X509_REVOKED *rev)
-{
-        X509_CRL_INFO *inf;
-
-        inf = crl->crl;
-        if (!inf->revoked)
-                inf->revoked = sk_X509_REVOKED_new(X509_REVOKED_cmp);
-        if (!inf->revoked || !sk_X509_REVOKED_push(inf->revoked, rev)) {
-                ASN1err(ASN1_F_X509_CRL_ADD0_REVOKED, ERR_R_MALLOC_FAILURE);
-                return 0;
-        }
-        inf->enc.modified = 1;
-        return 1;
-}
-
-int
-X509_CRL_verify(X509_CRL *crl, EVP_PKEY *r)
-{
-        if (crl->meth->crl_verify)
-                return crl->meth->crl_verify(crl, r);
-        return 0;
-}
-
-int
-X509_CRL_get0_by_serial(X509_CRL *crl, X509_REVOKED **ret,
-    ASN1_INTEGER *serial)
-{
-        if (crl->meth->crl_lookup)
-                return crl->meth->crl_lookup(crl, ret, serial, NULL);
-        return 0;
-}
-
-int
-X509_CRL_get0_by_cert(X509_CRL *crl, X509_REVOKED **ret, X509 *x)
-{
-        if (crl->meth->crl_lookup)
-                return crl->meth->crl_lookup(crl, ret,
-                    X509_get_serialNumber(x), X509_get_issuer_name(x));
-        return 0;
-}
-
-static int
-def_crl_verify(X509_CRL *crl, EVP_PKEY *r)
-{
-        return(ASN1_item_verify(ASN1_ITEM_rptr(X509_CRL_INFO),
-            crl->sig_alg, crl->signature, crl->crl, r));
-}
-
-static int
-crl_revoked_issuer_match(X509_CRL *crl, X509_NAME *nm, X509_REVOKED *rev)
-{
-        int i;
-
-        if (!rev->issuer) {
-                if (!nm)
-                        return 1;
-                if (!X509_NAME_cmp(nm, X509_CRL_get_issuer(crl)))
-                        return 1;
-                return 0;
-        }
-
-        if (!nm)
-                nm = X509_CRL_get_issuer(crl);
-
-        for (i = 0; i < sk_GENERAL_NAME_num(rev->issuer); i++) {
-                GENERAL_NAME *gen = sk_GENERAL_NAME_value(rev->issuer, i);
-                if (gen->type != GEN_DIRNAME)
-                        continue;
-                if (!X509_NAME_cmp(nm, gen->d.directoryName))
-                        return 1;
-        }
-        return 0;
-
-}
-
-static int
-def_crl_lookup(X509_CRL *crl, X509_REVOKED **ret, ASN1_INTEGER *serial,
-    X509_NAME *issuer)
-{
-        X509_REVOKED rtmp, *rev;
-        int idx;
-
-        rtmp.serialNumber = serial;
-        /* Sort revoked into serial number order if not already sorted.
-         * Do this under a lock to avoid race condition.
-         */
-        if (!sk_X509_REVOKED_is_sorted(crl->crl->revoked)) {
-                CRYPTO_w_lock(CRYPTO_LOCK_X509_CRL);
-                sk_X509_REVOKED_sort(crl->crl->revoked);
-                CRYPTO_w_unlock(CRYPTO_LOCK_X509_CRL);
-        }
-        idx = sk_X509_REVOKED_find(crl->crl->revoked, &rtmp);
-        if (idx < 0)
-                return 0;
-        /* Need to look for matching name */
-        for (; idx < sk_X509_REVOKED_num(crl->crl->revoked); idx++) {
-                rev = sk_X509_REVOKED_value(crl->crl->revoked, idx);
-                if (ASN1_INTEGER_cmp(rev->serialNumber, serial))
-                        return 0;
-                if (crl_revoked_issuer_match(crl, issuer, rev)) {
-                        if (ret)
-                                *ret = rev;
-                        if (rev->reason == CRL_REASON_REMOVE_FROM_CRL)
-                                return 2;
-                        return 1;
-                }
-        }
-        return 0;
-}
-
-void
-X509_CRL_set_default_method(const X509_CRL_METHOD *meth)
-{
-        if (meth == NULL)
-                default_crl_method = &int_crl_meth;
-        else
-                default_crl_method = meth;
-}
-
-X509_CRL_METHOD *
-X509_CRL_METHOD_new(int (*crl_init)(X509_CRL *crl),
-    int (*crl_free)(X509_CRL *crl),
-    int (*crl_lookup)(X509_CRL *crl, X509_REVOKED **ret,
-    ASN1_INTEGER *ser, X509_NAME *issuer),
-    int (*crl_verify)(X509_CRL *crl, EVP_PKEY *pk))
-{
-        X509_CRL_METHOD *m;
-
-        m = malloc(sizeof(X509_CRL_METHOD));
-        if (!m)
-                return NULL;
-        m->crl_init = crl_init;
-        m->crl_free = crl_free;
-        m->crl_lookup = crl_lookup;
-        m->crl_verify = crl_verify;
-        m->flags = X509_CRL_METHOD_DYNAMIC;
-        return m;
-}
-
-void
-X509_CRL_METHOD_free(X509_CRL_METHOD *m)
-{
-        if (!(m->flags & X509_CRL_METHOD_DYNAMIC))
-                return;
-        free(m);
-}
-
-void
-X509_CRL_set_meth_data(X509_CRL *crl, void *dat)
-{
-        crl->meth_data = dat;
-}
-
-void *
-X509_CRL_get_meth_data(X509_CRL *crl)
-{
-        return crl->meth_data;
-}
diff --git a/src/lib/libcrypto/asn1/x_exten.c b/src/lib/libcrypto/asn1/x_exten.c
deleted file mode 100644
index bb3dffc821..0000000000
--- a/src/lib/libcrypto/asn1/x_exten.c
+++ /dev/null
@@ -1,153 +0,0 @@
-/* $OpenBSD: x_exten.c,v 1.16 2015/07/24 15:09:52 jsing Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 2000.
- */
-/* ====================================================================
- * Copyright (c) 2000 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <stddef.h>
-#include <openssl/x509.h>
-#include <openssl/asn1.h>
-#include <openssl/asn1t.h>
-
-static const ASN1_TEMPLATE X509_EXTENSION_seq_tt[] = {
-        {
-                .offset = offsetof(X509_EXTENSION, object),
-                .field_name = "object",
-                .item = &ASN1_OBJECT_it,
-        },
-        {
-                .flags = ASN1_TFLG_OPTIONAL,
-                .offset = offsetof(X509_EXTENSION, critical),
-                .field_name = "critical",
-                .item = &ASN1_BOOLEAN_it,
-        },
-        {
-                .offset = offsetof(X509_EXTENSION, value),
-                .field_name = "value",
-                .item = &ASN1_OCTET_STRING_it,
-        },
-};
-
-const ASN1_ITEM X509_EXTENSION_it = {
-        .itype = ASN1_ITYPE_SEQUENCE,
-        .utype = V_ASN1_SEQUENCE,
-        .templates = X509_EXTENSION_seq_tt,
-        .tcount = sizeof(X509_EXTENSION_seq_tt) / sizeof(ASN1_TEMPLATE),
-        .size = sizeof(X509_EXTENSION),
-        .sname = "X509_EXTENSION",
-};
-
-static const ASN1_TEMPLATE X509_EXTENSIONS_item_tt = {
-        .flags = ASN1_TFLG_SEQUENCE_OF,
-        .tag = 0,
-        .offset = 0,
-        .field_name = "Extension",
-        .item = &X509_EXTENSION_it,
-};
-
-const ASN1_ITEM X509_EXTENSIONS_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = -1,
-        .templates = &X509_EXTENSIONS_item_tt,
-        .tcount = 0,
-        .funcs = NULL,
-        .size = 0,
-        .sname = "X509_EXTENSIONS",
-};
-
-
-X509_EXTENSION *
-d2i_X509_EXTENSION(X509_EXTENSION **a, const unsigned char **in, long len)
-{
-        return (X509_EXTENSION *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &X509_EXTENSION_it);
-}
-
-int
-i2d_X509_EXTENSION(X509_EXTENSION *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &X509_EXTENSION_it);
-}
-
-X509_EXTENSION *
-X509_EXTENSION_new(void)
-{
-        return (X509_EXTENSION *)ASN1_item_new(&X509_EXTENSION_it);
-}
-
-void
-X509_EXTENSION_free(X509_EXTENSION *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &X509_EXTENSION_it);
-}
-
-X509_EXTENSIONS *
-d2i_X509_EXTENSIONS(X509_EXTENSIONS **a, const unsigned char **in, long len)
-{
-        return (X509_EXTENSIONS *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &X509_EXTENSIONS_it);
-}
-
-int
-i2d_X509_EXTENSIONS(X509_EXTENSIONS *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &X509_EXTENSIONS_it);
-}
-
-X509_EXTENSION *
-X509_EXTENSION_dup(X509_EXTENSION *x)
-{
-        return ASN1_item_dup(&X509_EXTENSION_it, x);
-}
diff --git a/src/lib/libcrypto/asn1/x_info.c b/src/lib/libcrypto/asn1/x_info.c
deleted file mode 100644
index 466deaf6ce..0000000000
--- a/src/lib/libcrypto/asn1/x_info.c
+++ /dev/null
@@ -1,108 +0,0 @@
-/* $OpenBSD: x_info.c,v 1.15 2015/02/10 11:22:21 jsing Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-
-#include <openssl/asn1.h>
-#include <openssl/err.h>
-#include <openssl/evp.h>
-#include <openssl/x509.h>
-
-X509_INFO *
-X509_INFO_new(void)
-{
-        X509_INFO *ret = NULL;
-
-        ret = malloc(sizeof(X509_INFO));
-        if (ret == NULL) {
-                ASN1err(ASN1_F_X509_INFO_NEW, ERR_R_MALLOC_FAILURE);
-                return (NULL);
-        }
-
-        ret->enc_cipher.cipher = NULL;
-        ret->enc_len = 0;
-        ret->enc_data = NULL;
-
-        ret->references = 1;
-        ret->x509 = NULL;
-        ret->crl = NULL;
-        ret->x_pkey = NULL;
-        return (ret);
-}
-
-void
-X509_INFO_free(X509_INFO *x)
-{
-        int i;
-
-        if (x == NULL)
-                return;
-
-        i = CRYPTO_add(&x->references, -1, CRYPTO_LOCK_X509_INFO);
-        if (i > 0)
-                return;
-
-        if (x->x509 != NULL)
-                X509_free(x->x509);
-        if (x->crl != NULL)
-                X509_CRL_free(x->crl);
-        if (x->x_pkey != NULL)
-                X509_PKEY_free(x->x_pkey);
-        free(x->enc_data);
-        free(x);
-}
diff --git a/src/lib/libcrypto/asn1/x_long.c b/src/lib/libcrypto/asn1/x_long.c
deleted file mode 100644
index 90a41129bc..0000000000
--- a/src/lib/libcrypto/asn1/x_long.c
+++ /dev/null
@@ -1,210 +0,0 @@
-/* $OpenBSD: x_long.c,v 1.10 2015/07/25 17:07:17 jsing Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 2000.
- */
-/* ====================================================================
- * Copyright (c) 2000 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <stdio.h>
-#include <string.h>
-
-#include <openssl/asn1t.h>
-#include <openssl/bn.h>
-#include <openssl/err.h>
-
-/* Custom primitive type for long handling. This converts between an ASN1_INTEGER
- * and a long directly.
- */
-
-
-static int long_new(ASN1_VALUE **pval, const ASN1_ITEM *it);
-static void long_free(ASN1_VALUE **pval, const ASN1_ITEM *it);
-
-static int long_i2c(ASN1_VALUE **pval, unsigned char *cont, int *putype, const ASN1_ITEM *it);
-static int long_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len, int utype, char *free_cont, const ASN1_ITEM *it);
-static int long_print(BIO *out, ASN1_VALUE **pval, const ASN1_ITEM *it, int indent, const ASN1_PCTX *pctx);
-
-static ASN1_PRIMITIVE_FUNCS long_pf = {
-        NULL, 0,
-        long_new,
-        long_free,
-        long_free,      /* Clear should set to initial value */
-        long_c2i,
-        long_i2c,
-        long_print
-};
-
-const ASN1_ITEM LONG_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = V_ASN1_INTEGER,
-        .templates = NULL,
-        .tcount = 0,
-        .funcs = &long_pf,
-        .size = ASN1_LONG_UNDEF,
-        .sname = "LONG",
-};
-
-const ASN1_ITEM ZLONG_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = V_ASN1_INTEGER,
-        .templates = NULL,
-        .tcount = 0,
-        .funcs = &long_pf,
-        .size = 0,
-        .sname = "ZLONG",
-};
-
-static int
-long_new(ASN1_VALUE **pval, const ASN1_ITEM *it)
-{
-        *(long *)pval = it->size;
-        return 1;
-}
-
-static void
-long_free(ASN1_VALUE **pval, const ASN1_ITEM *it)
-{
-        *(long *)pval = it->size;
-}
-
-static int
-long_i2c(ASN1_VALUE **pval, unsigned char *cont, int *putype,
-    const ASN1_ITEM *it)
-{
-        long ltmp;
-        unsigned long utmp;
-        int clen, pad, i;
-        /* this exists to bypass broken gcc optimization */
-        char *cp = (char *)pval;
-
-        /* use memcpy, because we may not be long aligned */
-        memcpy(&ltmp, cp, sizeof(long));
-
-        if (ltmp == it->size)
-                return -1;
-        /* Convert the long to positive: we subtract one if negative so
-         * we can cleanly handle the padding if only the MSB of the leading
-         * octet is set.
-         */
-        if (ltmp < 0)
-                utmp = -ltmp - 1;
-        else
-                utmp = ltmp;
-        clen = BN_num_bits_word(utmp);
-        /* If MSB of leading octet set we need to pad */
-        if (!(clen & 0x7))
-                pad = 1;
-        else
-                pad = 0;
-
-        /* Convert number of bits to number of octets */
-        clen = (clen + 7) >> 3;
-
-        if (cont) {
-                if (pad)
-                        *cont++ = (ltmp < 0) ? 0xff : 0;
-                for (i = clen - 1; i >= 0; i--) {
-                        cont[i] = (unsigned char)(utmp & 0xff);
-                        if (ltmp < 0)
-                                cont[i] ^= 0xff;
-                        utmp >>= 8;
-                }
-        }
-        return clen + pad;
-}
-
-static int
-long_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len, int utype,
-    char *free_cont, const ASN1_ITEM *it)
-{
-        int neg, i;
-        long ltmp;
-        unsigned long utmp = 0;
-        char *cp = (char *)pval;
-        if (len > (int)sizeof(long)) {
-                ASN1err(ASN1_F_LONG_C2I, ASN1_R_INTEGER_TOO_LARGE_FOR_LONG);
-                return 0;
-        }
-        /* Is it negative? */
-        if (len && (cont[0] & 0x80))
-                neg = 1;
-        else
-                neg = 0;
-        utmp = 0;
-        for (i = 0; i < len; i++) {
-                utmp <<= 8;
-                if (neg)
-                        utmp |= cont[i] ^ 0xff;
-                else
-                        utmp |= cont[i];
-        }
-        ltmp = (long)utmp;
-        if (neg) {
-                ltmp++;
-                ltmp = -ltmp;
-        }
-        if (ltmp == it->size) {
-                ASN1err(ASN1_F_LONG_C2I, ASN1_R_INTEGER_TOO_LARGE_FOR_LONG);
-                return 0;
-        }
-        memcpy(cp, &ltmp, sizeof(long));
-        return 1;
-}
-
-static int
-long_print(BIO *out, ASN1_VALUE **pval, const ASN1_ITEM *it, int indent,
-    const ASN1_PCTX *pctx)
-{
-        return BIO_printf(out, "%ld\n", *(long *)pval);
-}
diff --git a/src/lib/libcrypto/asn1/x_name.c b/src/lib/libcrypto/asn1/x_name.c
deleted file mode 100644
index be936318d8..0000000000
--- a/src/lib/libcrypto/asn1/x_name.c
+++ /dev/null
@@ -1,642 +0,0 @@
-/* $OpenBSD: x_name.c,v 1.31 2015/07/24 15:09:52 jsing Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <ctype.h>
-#include <stdio.h>
-#include <string.h>
-
-#include <openssl/asn1t.h>
-#include <openssl/err.h>
-#include <openssl/x509.h>
-
-#include "asn1_locl.h"
-
-typedef STACK_OF(X509_NAME_ENTRY) STACK_OF_X509_NAME_ENTRY;
-DECLARE_STACK_OF(STACK_OF_X509_NAME_ENTRY)
-
-static int x509_name_ex_d2i(ASN1_VALUE **val, const unsigned char **in,
-    long len, const ASN1_ITEM *it, int tag, int aclass, char opt,
-    ASN1_TLC *ctx);
-
-static int x509_name_ex_i2d(ASN1_VALUE **val, unsigned char **out,
-    const ASN1_ITEM *it, int tag, int aclass);
-static int x509_name_ex_new(ASN1_VALUE **val, const ASN1_ITEM *it);
-static void x509_name_ex_free(ASN1_VALUE **val, const ASN1_ITEM *it);
-
-static int x509_name_encode(X509_NAME *a);
-static int x509_name_canon(X509_NAME *a);
-static int asn1_string_canon(ASN1_STRING *out, ASN1_STRING *in);
-static int i2d_name_canon(STACK_OF(STACK_OF_X509_NAME_ENTRY) *intname,
-    unsigned char **in);
-
-static int x509_name_ex_print(BIO *out, ASN1_VALUE **pval, int indent,
-    const char *fname, const ASN1_PCTX *pctx);
-
-static const ASN1_TEMPLATE X509_NAME_ENTRY_seq_tt[] = {
-        {
-                .offset = offsetof(X509_NAME_ENTRY, object),
-                .field_name = "object",
-                .item = &ASN1_OBJECT_it,
-        },
-        {
-                .offset = offsetof(X509_NAME_ENTRY, value),
-                .field_name = "value",
-                .item = &ASN1_PRINTABLE_it,
-        },
-};
-
-const ASN1_ITEM X509_NAME_ENTRY_it = {
-        .itype = ASN1_ITYPE_SEQUENCE,
-        .utype = V_ASN1_SEQUENCE,
-        .templates = X509_NAME_ENTRY_seq_tt,
-        .tcount = sizeof(X509_NAME_ENTRY_seq_tt) / sizeof(ASN1_TEMPLATE),
-        .size = sizeof(X509_NAME_ENTRY),
-        .sname = "X509_NAME_ENTRY",
-};
-
-
-X509_NAME_ENTRY *
-d2i_X509_NAME_ENTRY(X509_NAME_ENTRY **a, const unsigned char **in, long len)
-{
-        return (X509_NAME_ENTRY *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &X509_NAME_ENTRY_it);
-}
-
-int
-i2d_X509_NAME_ENTRY(X509_NAME_ENTRY *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &X509_NAME_ENTRY_it);
-}
-
-X509_NAME_ENTRY *
-X509_NAME_ENTRY_new(void)
-{
-        return (X509_NAME_ENTRY *)ASN1_item_new(&X509_NAME_ENTRY_it);
-}
-
-void
-X509_NAME_ENTRY_free(X509_NAME_ENTRY *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &X509_NAME_ENTRY_it);
-}
-
-X509_NAME_ENTRY *
-X509_NAME_ENTRY_dup(X509_NAME_ENTRY *x)
-{
-        return ASN1_item_dup(&X509_NAME_ENTRY_it, x);
-}
-
-/* For the "Name" type we need a SEQUENCE OF { SET OF X509_NAME_ENTRY }
- * so declare two template wrappers for this
- */
-
-static const ASN1_TEMPLATE X509_NAME_ENTRIES_item_tt = {
-        .flags = ASN1_TFLG_SET_OF,
-        .tag = 0,
-        .offset = 0,
-        .field_name = "RDNS",
-        .item = &X509_NAME_ENTRY_it,
-};
-
-const ASN1_ITEM X509_NAME_ENTRIES_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = -1,
-        .templates = &X509_NAME_ENTRIES_item_tt,
-        .tcount = 0,
-        .funcs = NULL,
-        .size = 0,
-        .sname = "X509_NAME_ENTRIES",
-};
-
-static const ASN1_TEMPLATE X509_NAME_INTERNAL_item_tt = {
-        .flags = ASN1_TFLG_SEQUENCE_OF,
-        .tag = 0,
-        .offset = 0,
-        .field_name = "Name",
-        .item = &X509_NAME_ENTRIES_it,
-};
-
-const ASN1_ITEM X509_NAME_INTERNAL_it = {
-        .itype = ASN1_ITYPE_PRIMITIVE,
-        .utype = -1,
-        .templates = &X509_NAME_INTERNAL_item_tt,
-        .tcount = 0,
-        .funcs = NULL,
-        .size = 0,
-        .sname = "X509_NAME_INTERNAL",
-};
-
-/* Normally that's where it would end: we'd have two nested STACK structures
- * representing the ASN1. Unfortunately X509_NAME uses a completely different
- * form and caches encodings so we have to process the internal form and convert
- * to the external form.
- */
-
-const ASN1_EXTERN_FUNCS x509_name_ff = {
-        NULL,
-        x509_name_ex_new,
-        x509_name_ex_free,
-        0,      /* Default clear behaviour is OK */
-        x509_name_ex_d2i,
-        x509_name_ex_i2d,
-        x509_name_ex_print
-};
-
-const ASN1_ITEM X509_NAME_it = {
-        .itype = ASN1_ITYPE_EXTERN,
-        .utype = V_ASN1_SEQUENCE,
-        .templates = NULL,
-        .tcount = 0,
-        .funcs = &x509_name_ff,
-        .size = 0,
-        .sname = "X509_NAME",
-};
-
-X509_NAME *
-d2i_X509_NAME(X509_NAME **a, const unsigned char **in, long len)
-{
-        return (X509_NAME *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &X509_NAME_it);
-}
-
-int
-i2d_X509_NAME(X509_NAME *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &X509_NAME_it);
-}
-
-X509_NAME *
-X509_NAME_new(void)
-{
-        return (X509_NAME *)ASN1_item_new(&X509_NAME_it);
-}
-
-void
-X509_NAME_free(X509_NAME *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &X509_NAME_it);
-}
-
-X509_NAME *
-X509_NAME_dup(X509_NAME *x)
-{
-        return ASN1_item_dup(&X509_NAME_it, x);
-}
-
-static int
-x509_name_ex_new(ASN1_VALUE **val, const ASN1_ITEM *it)
-{
-        X509_NAME *ret = NULL;
-
-        ret = malloc(sizeof(X509_NAME));
-        if (!ret)
-                goto memerr;
-        if ((ret->entries = sk_X509_NAME_ENTRY_new_null()) == NULL)
-                goto memerr;
-        if ((ret->bytes = BUF_MEM_new()) == NULL)
-                goto memerr;
-        ret->canon_enc = NULL;
-        ret->canon_enclen = 0;
-        ret->modified = 1;
-        *val = (ASN1_VALUE *)ret;
-        return 1;
-
-memerr:
-        ASN1err(ASN1_F_X509_NAME_EX_NEW, ERR_R_MALLOC_FAILURE);
-        if (ret) {
-                if (ret->entries)
-                        sk_X509_NAME_ENTRY_free(ret->entries);
-                free(ret);
-        }
-        return 0;
-}
-
-static void
-x509_name_ex_free(ASN1_VALUE **pval, const ASN1_ITEM *it)
-{
-        X509_NAME *a;
-
-        if (!pval || !*pval)
-                return;
-        a = (X509_NAME *)*pval;
-
-        BUF_MEM_free(a->bytes);
-        sk_X509_NAME_ENTRY_pop_free(a->entries, X509_NAME_ENTRY_free);
-        free(a->canon_enc);
-        free(a);
-        *pval = NULL;
-}
-
-static int
-x509_name_ex_d2i(ASN1_VALUE **val, const unsigned char **in, long len,
-    const ASN1_ITEM *it, int tag, int aclass, char opt, ASN1_TLC *ctx)
-{
-        const unsigned char *p = *in, *q;
-        union {
-                STACK_OF(STACK_OF_X509_NAME_ENTRY) *s;
-                ASN1_VALUE *a;
-        } intname = {NULL};
-        union {
-                X509_NAME *x;
-                ASN1_VALUE *a;
-        } nm = {NULL};
-        int i, j, ret;
-        STACK_OF(X509_NAME_ENTRY) *entries;
-        X509_NAME_ENTRY *entry;
-        q = p;
-
-        /* Get internal representation of Name */
-        ret = ASN1_item_ex_d2i(&intname.a, &p, len,
-            ASN1_ITEM_rptr(X509_NAME_INTERNAL), tag, aclass, opt, ctx);
-
-        if (ret <= 0)
-                return ret;
-
-        if (*val)
-                x509_name_ex_free(val, NULL);
-        if (!x509_name_ex_new(&nm.a, NULL))
-                goto err;
-        /* We've decoded it: now cache encoding */
-        if (!BUF_MEM_grow(nm.x->bytes, p - q))
-                goto err;
-        memcpy(nm.x->bytes->data, q, p - q);
-
-        /* Convert internal representation to X509_NAME structure */
-        for (i = 0; i < sk_STACK_OF_X509_NAME_ENTRY_num(intname.s); i++) {
-                entries = sk_STACK_OF_X509_NAME_ENTRY_value(intname.s, i);
-                for (j = 0; j < sk_X509_NAME_ENTRY_num(entries); j++) {
-                        entry = sk_X509_NAME_ENTRY_value(entries, j);
-                        entry->set = i;
-                        if (!sk_X509_NAME_ENTRY_push(nm.x->entries, entry))
-                                goto err;
-                }
-                sk_X509_NAME_ENTRY_free(entries);
-        }
-        sk_STACK_OF_X509_NAME_ENTRY_free(intname.s);
-        ret = x509_name_canon(nm.x);
-        if (!ret)
-                goto err;
-        nm.x->modified = 0;
-        *val = nm.a;
-        *in = p;
-        return ret;
-
-err:
-        if (nm.x != NULL)
-                X509_NAME_free(nm.x);
-        ASN1err(ASN1_F_X509_NAME_EX_D2I, ERR_R_NESTED_ASN1_ERROR);
-        return 0;
-}
-
-static int
-x509_name_ex_i2d(ASN1_VALUE **val, unsigned char **out, const ASN1_ITEM *it,
-    int tag, int aclass)
-{
-        int ret;
-        X509_NAME *a = (X509_NAME *)*val;
-
-        if (a->modified) {
-                ret = x509_name_encode(a);
-                if (ret < 0)
-                        return ret;
-                ret = x509_name_canon(a);
-                if (ret < 0)
-                        return ret;
-        }
-        ret = a->bytes->length;
-        if (out != NULL) {
-                memcpy(*out, a->bytes->data, ret);
-                *out += ret;
-        }
-        return ret;
-}
-
-static void
-local_sk_X509_NAME_ENTRY_free(STACK_OF(X509_NAME_ENTRY) *ne)
-{
-        sk_X509_NAME_ENTRY_free(ne);
-}
-
-static void
-local_sk_X509_NAME_ENTRY_pop_free(STACK_OF(X509_NAME_ENTRY) *ne)
-{
-        sk_X509_NAME_ENTRY_pop_free(ne, X509_NAME_ENTRY_free);
-}
-
-static int
-x509_name_encode(X509_NAME *a)
-{
-        union {
-                STACK_OF(STACK_OF_X509_NAME_ENTRY) *s;
-                ASN1_VALUE *a;
-        } intname = {NULL};
-        int len;
-        unsigned char *p;
-        STACK_OF(X509_NAME_ENTRY) *entries = NULL;
-        X509_NAME_ENTRY *entry;
-        int i, set = -1;
-
-        intname.s = sk_STACK_OF_X509_NAME_ENTRY_new_null();
-        if (!intname.s)
-                goto memerr;
-        for (i = 0; i < sk_X509_NAME_ENTRY_num(a->entries); i++) {
-                entry = sk_X509_NAME_ENTRY_value(a->entries, i);
-                if (entry->set != set) {
-                        entries = sk_X509_NAME_ENTRY_new_null();
-                        if (!entries)
-                                goto memerr;
-                        if (!sk_STACK_OF_X509_NAME_ENTRY_push(intname.s,
-                            entries))
-                                goto memerr;
-                        set = entry->set;
-                }
-                if (entries == NULL /* if entry->set is bogusly -1 */ ||
-                    !sk_X509_NAME_ENTRY_push(entries, entry))
-                        goto memerr;
-        }
-        len = ASN1_item_ex_i2d(&intname.a, NULL,
-            ASN1_ITEM_rptr(X509_NAME_INTERNAL), -1, -1);
-        if (!BUF_MEM_grow(a->bytes, len))
-                goto memerr;
-        p = (unsigned char *)a->bytes->data;
-        ASN1_item_ex_i2d(&intname.a, &p, ASN1_ITEM_rptr(X509_NAME_INTERNAL),
-            -1, -1);
-        sk_STACK_OF_X509_NAME_ENTRY_pop_free(intname.s,
-            local_sk_X509_NAME_ENTRY_free);
-        a->modified = 0;
-        return len;
-
-memerr:
-        sk_STACK_OF_X509_NAME_ENTRY_pop_free(intname.s,
-            local_sk_X509_NAME_ENTRY_free);
-        ASN1err(ASN1_F_X509_NAME_ENCODE, ERR_R_MALLOC_FAILURE);
-        return -1;
-}
-
-static int
-x509_name_ex_print(BIO *out, ASN1_VALUE **pval, int indent, const char *fname,
-    const ASN1_PCTX *pctx)
-{
-        if (X509_NAME_print_ex(out, (X509_NAME *)*pval, indent,
-            pctx->nm_flags) <= 0)
-                return 0;
-        return 2;
-}
-
-/* This function generates the canonical encoding of the Name structure.
- * In it all strings are converted to UTF8, leading, trailing and
- * multiple spaces collapsed, converted to lower case and the leading
- * SEQUENCE header removed.
- *
- * In future we could also normalize the UTF8 too.
- *
- * By doing this comparison of Name structures can be rapidly
- * performed by just using memcmp() of the canonical encoding.
- * By omitting the leading SEQUENCE name constraints of type
- * dirName can also be checked with a simple memcmp().
- */
-
-static int
-x509_name_canon(X509_NAME *a)
-{
-        unsigned char *p;
-        STACK_OF(STACK_OF_X509_NAME_ENTRY) *intname = NULL;
-        STACK_OF(X509_NAME_ENTRY) *entries = NULL;
-        X509_NAME_ENTRY *entry, *tmpentry = NULL;
-        int i, len, set = -1, ret = 0;
-
-        if (a->canon_enc) {
-                free(a->canon_enc);
-                a->canon_enc = NULL;
-        }
-        /* Special case: empty X509_NAME => null encoding */
-        if (sk_X509_NAME_ENTRY_num(a->entries) == 0) {
-                a->canon_enclen = 0;
-                return 1;
-        }
-        intname = sk_STACK_OF_X509_NAME_ENTRY_new_null();
-        if (!intname)
-                goto err;
-        for (i = 0; i < sk_X509_NAME_ENTRY_num(a->entries); i++) {
-                entry = sk_X509_NAME_ENTRY_value(a->entries, i);
-                if (entry->set != set) {
-                        entries = sk_X509_NAME_ENTRY_new_null();
-                        if (!entries)
-                                goto err;
-                        if (sk_STACK_OF_X509_NAME_ENTRY_push(intname,
-                            entries) == 0) {
-                                sk_X509_NAME_ENTRY_free(entries);
-                                goto err;
-                        }
-                        set = entry->set;
-                }
-                tmpentry = X509_NAME_ENTRY_new();
-                if (tmpentry == NULL)
-                        goto err;
-                tmpentry->object = OBJ_dup(entry->object);
-                if (tmpentry->object == NULL)
-                        goto err;
-                if (!asn1_string_canon(tmpentry->value, entry->value))
-                        goto err;
-                if (entries == NULL /* if entry->set is bogusly -1 */ ||
-                    !sk_X509_NAME_ENTRY_push(entries, tmpentry))
-                        goto err;
-                tmpentry = NULL;
-        }
-
-        /* Finally generate encoding */
-        len = i2d_name_canon(intname, NULL);
-        if (len < 0)
-                goto err;
-        p = malloc(len);
-        if (p == NULL)
-                goto err;
-        a->canon_enc = p;
-        a->canon_enclen = len;
-        i2d_name_canon(intname, &p);
-        ret = 1;
-
-err:
-        if (tmpentry)
-                X509_NAME_ENTRY_free(tmpentry);
-        if (intname)
-                sk_STACK_OF_X509_NAME_ENTRY_pop_free(intname,
-                    local_sk_X509_NAME_ENTRY_pop_free);
-        return ret;
-}
-
-/* Bitmap of all the types of string that will be canonicalized. */
-
-#define ASN1_MASK_CANON \
-        (B_ASN1_UTF8STRING | B_ASN1_BMPSTRING | B_ASN1_UNIVERSALSTRING \
-        | B_ASN1_PRINTABLESTRING | B_ASN1_T61STRING | B_ASN1_IA5STRING \
-        | B_ASN1_VISIBLESTRING)
-
-
-static int
-asn1_string_canon(ASN1_STRING *out, ASN1_STRING *in)
-{
-        unsigned char *to, *from;
-        int len, i;
-
-        /* If type not in bitmask just copy string across */
-        if (!(ASN1_tag2bit(in->type) & ASN1_MASK_CANON)) {
-                if (!ASN1_STRING_copy(out, in))
-                        return 0;
-                return 1;
-        }
-
-        out->type = V_ASN1_UTF8STRING;
-        out->length = ASN1_STRING_to_UTF8(&out->data, in);
-        if (out->length == -1)
-                return 0;
-
-        to = out->data;
-        from = to;
-
-        len = out->length;
-
-        /* Convert string in place to canonical form.
-         * Ultimately we may need to handle a wider range of characters
-         * but for now ignore anything with MSB set and rely on the
-         * isspace() and tolower() functions.
-         */
-
-        /* Ignore leading spaces */
-        while ((len > 0) && !(*from & 0x80) && isspace(*from)) {
-                from++;
-                len--;
-        }
-
-        to = from + len - 1;
-
-        /* Ignore trailing spaces */
-        while ((len > 0) && !(*to & 0x80) && isspace(*to)) {
-                to--;
-                len--;
-        }
-
-        to = out->data;
-
-        i = 0;
-        while (i < len) {
-                /* If MSB set just copy across */
-                if (*from & 0x80) {
-                        *to++ = *from++;
-                        i++;
-                }
-                /* Collapse multiple spaces */
-                else if (isspace(*from)) {
-                        /* Copy one space across */
-                        *to++ = ' ';
-                        /* Ignore subsequent spaces. Note: don't need to
-                         * check len here because we know the last
-                         * character is a non-space so we can't overflow.
-                         */
-                        do {
-                                from++;
-                                i++;
-                        } while (!(*from & 0x80) && isspace(*from));
-                } else {
-                        *to++ = tolower(*from);
-                        from++;
-                        i++;
-                }
-        }
-
-        out->length = to - out->data;
-
-        return 1;
-}
-
-static int
-i2d_name_canon(STACK_OF(STACK_OF_X509_NAME_ENTRY) *_intname, unsigned char **in)
-{
-        int i, len, ltmp;
-        ASN1_VALUE *v;
-        STACK_OF(ASN1_VALUE) *intname = (STACK_OF(ASN1_VALUE) *)_intname;
-
-        len = 0;
-        for (i = 0; i < sk_ASN1_VALUE_num(intname); i++) {
-                v = sk_ASN1_VALUE_value(intname, i);
-                ltmp = ASN1_item_ex_i2d(&v, in,
-                    ASN1_ITEM_rptr(X509_NAME_ENTRIES), -1, -1);
-                if (ltmp < 0)
-                        return ltmp;
-                len += ltmp;
-        }
-        return len;
-}
-
-int
-X509_NAME_set(X509_NAME **xn, X509_NAME *name)
-{
-        X509_NAME *in;
-
-        if (!xn || !name)
-                return (0);
-
-        if (*xn != name) {
-                in = X509_NAME_dup(name);
-                if (in != NULL) {
-                        X509_NAME_free(*xn);
-                        *xn = in;
-                }
-        }
-        return (*xn != NULL);
-}
diff --git a/src/lib/libcrypto/asn1/x_nx509.c b/src/lib/libcrypto/asn1/x_nx509.c
deleted file mode 100644
index 7e18be8c79..0000000000
--- a/src/lib/libcrypto/asn1/x_nx509.c
+++ /dev/null
@@ -1,113 +0,0 @@
-/* $OpenBSD: x_nx509.c,v 1.6 2015/02/11 04:00:39 jsing Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 2005.
- */
-/* ====================================================================
- * Copyright (c) 2005 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <stddef.h>
-#include <openssl/x509.h>
-#include <openssl/asn1.h>
-#include <openssl/asn1t.h>
-
-/* Old netscape certificate wrapper format */
-
-static const ASN1_TEMPLATE NETSCAPE_X509_seq_tt[] = {
-        {
-                .offset = offsetof(NETSCAPE_X509, header),
-                .field_name = "header",
-                .item = &ASN1_OCTET_STRING_it,
-        },
-        {
-                .flags = ASN1_TFLG_OPTIONAL,
-                .offset = offsetof(NETSCAPE_X509, cert),
-                .field_name = "cert",
-                .item = &X509_it,
-        },
-};
-
-const ASN1_ITEM NETSCAPE_X509_it = {
-        .itype = ASN1_ITYPE_SEQUENCE,
-        .utype = V_ASN1_SEQUENCE,
-        .templates = NETSCAPE_X509_seq_tt,
-        .tcount = sizeof(NETSCAPE_X509_seq_tt) / sizeof(ASN1_TEMPLATE),
-        .size = sizeof(NETSCAPE_X509),
-        .sname = "NETSCAPE_X509",
-};
-
-
-NETSCAPE_X509 *
-d2i_NETSCAPE_X509(NETSCAPE_X509 **a, const unsigned char **in, long len)
-{
-        return (NETSCAPE_X509 *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &NETSCAPE_X509_it);
-}
-
-int
-i2d_NETSCAPE_X509(NETSCAPE_X509 *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &NETSCAPE_X509_it);
-}
-
-NETSCAPE_X509 *
-NETSCAPE_X509_new(void)
-{
-        return (NETSCAPE_X509 *)ASN1_item_new(&NETSCAPE_X509_it);
-}
-
-void
-NETSCAPE_X509_free(NETSCAPE_X509 *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &NETSCAPE_X509_it);
-}
diff --git a/src/lib/libcrypto/asn1/x_pkey.c b/src/lib/libcrypto/asn1/x_pkey.c
deleted file mode 100644
index 28e79858b5..0000000000
--- a/src/lib/libcrypto/asn1/x_pkey.c
+++ /dev/null
@@ -1,121 +0,0 @@
-/* $OpenBSD: x_pkey.c,v 1.18 2015/07/27 12:53:56 jsing Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-#include <string.h>
-
-#include <openssl/err.h>
-#include <openssl/evp.h>
-#include <openssl/objects.h>
-#include <openssl/x509.h>
-
-X509_PKEY *
-X509_PKEY_new(void)
-{
-        X509_PKEY *ret = NULL;
-
-        if ((ret = malloc(sizeof(X509_PKEY))) == NULL) {
-                ASN1err(ASN1_F_X509_PKEY_NEW, ERR_R_MALLOC_FAILURE);
-                goto err;
-        }
-        ret->version = 0;
-        if ((ret->enc_algor = X509_ALGOR_new()) == NULL) {
-                ASN1err(ASN1_F_X509_PKEY_NEW, ERR_R_MALLOC_FAILURE);
-                goto err;
-        }
-        if ((ret->enc_pkey = M_ASN1_OCTET_STRING_new()) == NULL) {
-                ASN1err(ASN1_F_X509_PKEY_NEW, ERR_R_MALLOC_FAILURE);
-                goto err;
-        }
-        ret->dec_pkey = NULL;
-        ret->key_length = 0;
-        ret->key_data = NULL;
-        ret->key_free = 0;
-        ret->cipher.cipher = NULL;
-        memset(ret->cipher.iv, 0, EVP_MAX_IV_LENGTH);
-        ret->references = 1;
-        return (ret);
-
-err:
-        if (ret) {
-                X509_ALGOR_free(ret->enc_algor);
-                free(ret);
-        }
-        return NULL;
-}
-
-void
-X509_PKEY_free(X509_PKEY *x)
-{
-        int i;
-
-        if (x == NULL)
-                return;
-
-        i = CRYPTO_add(&x->references, -1, CRYPTO_LOCK_X509_PKEY);
-        if (i > 0)
-                return;
-
-        if (x->enc_algor != NULL)
-                X509_ALGOR_free(x->enc_algor);
-        M_ASN1_OCTET_STRING_free(x->enc_pkey);
-        EVP_PKEY_free(x->dec_pkey);
-        if ((x->key_data != NULL) && (x->key_free))
-                free(x->key_data);
-        free(x);
-}
diff --git a/src/lib/libcrypto/asn1/x_pubkey.c b/src/lib/libcrypto/asn1/x_pubkey.c
deleted file mode 100644
index 3bdbb5a536..0000000000
--- a/src/lib/libcrypto/asn1/x_pubkey.c
+++ /dev/null
@@ -1,430 +0,0 @@
-/* $OpenBSD: x_pubkey.c,v 1.25 2015/02/11 04:00:39 jsing Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-
-#include <openssl/opensslconf.h>
-
-#include <openssl/asn1t.h>
-#include <openssl/err.h>
-#include <openssl/x509.h>
-
-#ifndef OPENSSL_NO_DSA
-#include <openssl/dsa.h>
-#endif
-#ifndef OPENSSL_NO_RSA
-#include <openssl/rsa.h>
-#endif
-
-#include "asn1_locl.h"
-
-/* Minor tweak to operation: free up EVP_PKEY */
-static int
-pubkey_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it, void *exarg)
-{
-        if (operation == ASN1_OP_FREE_POST) {
-                X509_PUBKEY *pubkey = (X509_PUBKEY *)*pval;
-                EVP_PKEY_free(pubkey->pkey);
-        }
-        return 1;
-}
-
-static const ASN1_AUX X509_PUBKEY_aux = {
-        .asn1_cb = pubkey_cb,
-};
-static const ASN1_TEMPLATE X509_PUBKEY_seq_tt[] = {
-        {
-                .offset = offsetof(X509_PUBKEY, algor),
-                .field_name = "algor",
-                .item = &X509_ALGOR_it,
-        },
-        {
-                .offset = offsetof(X509_PUBKEY, public_key),
-                .field_name = "public_key",
-                .item = &ASN1_BIT_STRING_it,
-        },
-};
-
-const ASN1_ITEM X509_PUBKEY_it = {
-        .itype = ASN1_ITYPE_SEQUENCE,
-        .utype = V_ASN1_SEQUENCE,
-        .templates = X509_PUBKEY_seq_tt,
-        .tcount = sizeof(X509_PUBKEY_seq_tt) / sizeof(ASN1_TEMPLATE),
-        .funcs = &X509_PUBKEY_aux,
-        .size = sizeof(X509_PUBKEY),
-        .sname = "X509_PUBKEY",
-};
-
-
-X509_PUBKEY *
-d2i_X509_PUBKEY(X509_PUBKEY **a, const unsigned char **in, long len)
-{
-        return (X509_PUBKEY *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &X509_PUBKEY_it);
-}
-
-int
-i2d_X509_PUBKEY(X509_PUBKEY *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &X509_PUBKEY_it);
-}
-
-X509_PUBKEY *
-X509_PUBKEY_new(void)
-{
-        return (X509_PUBKEY *)ASN1_item_new(&X509_PUBKEY_it);
-}
-
-void
-X509_PUBKEY_free(X509_PUBKEY *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &X509_PUBKEY_it);
-}
-
-int
-X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey)
-{
-        X509_PUBKEY *pk = NULL;
-
-        if (x == NULL)
-                return (0);
-        if ((pk = X509_PUBKEY_new()) == NULL)
-                goto error;
-
-        if (pkey->ameth) {
-                if (pkey->ameth->pub_encode) {
-                        if (!pkey->ameth->pub_encode(pk, pkey)) {
-                                X509err(X509_F_X509_PUBKEY_SET,
-                                    X509_R_PUBLIC_KEY_ENCODE_ERROR);
-                                goto error;
-                        }
-                } else {
-                        X509err(X509_F_X509_PUBKEY_SET,
-                            X509_R_METHOD_NOT_SUPPORTED);
-                        goto error;
-                }
-        } else {
-                X509err(X509_F_X509_PUBKEY_SET, X509_R_UNSUPPORTED_ALGORITHM);
-                goto error;
-        }
-
-        if (*x != NULL)
-                X509_PUBKEY_free(*x);
-
-        *x = pk;
-
-        return 1;
-
-error:
-        if (pk != NULL)
-                X509_PUBKEY_free(pk);
-        return 0;
-}
-
-EVP_PKEY *
-X509_PUBKEY_get(X509_PUBKEY *key)
-{
-        EVP_PKEY *ret = NULL;
-
-        if (key == NULL)
-                goto error;
-
-        if (key->pkey != NULL) {
-                CRYPTO_add(&key->pkey->references, 1, CRYPTO_LOCK_EVP_PKEY);
-                return key->pkey;
-        }
-
-        if (key->public_key == NULL)
-                goto error;
-
-        if ((ret = EVP_PKEY_new()) == NULL) {
-                X509err(X509_F_X509_PUBKEY_GET, ERR_R_MALLOC_FAILURE);
-                goto error;
-        }
-
-        if (!EVP_PKEY_set_type(ret, OBJ_obj2nid(key->algor->algorithm))) {
-                X509err(X509_F_X509_PUBKEY_GET, X509_R_UNSUPPORTED_ALGORITHM);
-                goto error;
-        }
-
-        if (ret->ameth->pub_decode) {
-                if (!ret->ameth->pub_decode(ret, key)) {
-                        X509err(X509_F_X509_PUBKEY_GET,
-                            X509_R_PUBLIC_KEY_DECODE_ERROR);
-                        goto error;
-                }
-        } else {
-                X509err(X509_F_X509_PUBKEY_GET, X509_R_METHOD_NOT_SUPPORTED);
-                goto error;
-        }
-
-        /* Check to see if another thread set key->pkey first */
-        CRYPTO_w_lock(CRYPTO_LOCK_EVP_PKEY);
-        if (key->pkey) {
-                CRYPTO_w_unlock(CRYPTO_LOCK_EVP_PKEY);
-                EVP_PKEY_free(ret);
-                ret = key->pkey;
-        } else {
-                key->pkey = ret;
-                CRYPTO_w_unlock(CRYPTO_LOCK_EVP_PKEY);
-        }
-        CRYPTO_add(&ret->references, 1, CRYPTO_LOCK_EVP_PKEY);
-
-        return ret;
-
-error:
-        EVP_PKEY_free(ret);
-        return (NULL);
-}
-
-/* Now two pseudo ASN1 routines that take an EVP_PKEY structure
- * and encode or decode as X509_PUBKEY
- */
-
-EVP_PKEY *
-d2i_PUBKEY(EVP_PKEY **a, const unsigned char **pp, long length)
-{
-        X509_PUBKEY *xpk;
-        EVP_PKEY *pktmp;
-        xpk = d2i_X509_PUBKEY(NULL, pp, length);
-        if (!xpk)
-                return NULL;
-        pktmp = X509_PUBKEY_get(xpk);
-        X509_PUBKEY_free(xpk);
-        if (!pktmp)
-                return NULL;
-        if (a) {
-                EVP_PKEY_free(*a);
-                *a = pktmp;
-        }
-        return pktmp;
-}
-
-int
-i2d_PUBKEY(EVP_PKEY *a, unsigned char **pp)
-{
-        X509_PUBKEY *xpk = NULL;
-        int ret;
-        if (!a)
-                return 0;
-        if (!X509_PUBKEY_set(&xpk, a))
-                return 0;
-        ret = i2d_X509_PUBKEY(xpk, pp);
-        X509_PUBKEY_free(xpk);
-        return ret;
-}
-
-/* The following are equivalents but which return RSA and DSA
- * keys
- */
-#ifndef OPENSSL_NO_RSA
-RSA *
-d2i_RSA_PUBKEY(RSA **a, const unsigned char **pp, long length)
-{
-        EVP_PKEY *pkey;
-        RSA *key;
-        const unsigned char *q;
-        q = *pp;
-        pkey = d2i_PUBKEY(NULL, &q, length);
-        if (!pkey)
-                return NULL;
-        key = EVP_PKEY_get1_RSA(pkey);
-        EVP_PKEY_free(pkey);
-        if (!key)
-                return NULL;
-        *pp = q;
-        if (a) {
-                RSA_free(*a);
-                *a = key;
-        }
-        return key;
-}
-
-int
-i2d_RSA_PUBKEY(RSA *a, unsigned char **pp)
-{
-        EVP_PKEY *pktmp;
-        int ret;
-        if (!a)
-                return 0;
-        pktmp = EVP_PKEY_new();
-        if (!pktmp) {
-                ASN1err(ASN1_F_I2D_RSA_PUBKEY, ERR_R_MALLOC_FAILURE);
-                return 0;
-        }
-        EVP_PKEY_set1_RSA(pktmp, a);
-        ret = i2d_PUBKEY(pktmp, pp);
-        EVP_PKEY_free(pktmp);
-        return ret;
-}
-#endif
-
-#ifndef OPENSSL_NO_DSA
-DSA *
-d2i_DSA_PUBKEY(DSA **a, const unsigned char **pp, long length)
-{
-        EVP_PKEY *pkey;
-        DSA *key;
-        const unsigned char *q;
-        q = *pp;
-        pkey = d2i_PUBKEY(NULL, &q, length);
-        if (!pkey)
-                return NULL;
-        key = EVP_PKEY_get1_DSA(pkey);
-        EVP_PKEY_free(pkey);
-        if (!key)
-                return NULL;
-        *pp = q;
-        if (a) {
-                DSA_free(*a);
-                *a = key;
-        }
-        return key;
-}
-
-int
-i2d_DSA_PUBKEY(DSA *a, unsigned char **pp)
-{
-        EVP_PKEY *pktmp;
-        int ret;
-        if (!a)
-                return 0;
-        pktmp = EVP_PKEY_new();
-        if (!pktmp) {
-                ASN1err(ASN1_F_I2D_DSA_PUBKEY, ERR_R_MALLOC_FAILURE);
-                return 0;
-        }
-        EVP_PKEY_set1_DSA(pktmp, a);
-        ret = i2d_PUBKEY(pktmp, pp);
-        EVP_PKEY_free(pktmp);
-        return ret;
-}
-#endif
-
-#ifndef OPENSSL_NO_EC
-EC_KEY *
-d2i_EC_PUBKEY(EC_KEY **a, const unsigned char **pp, long length)
-{
-        EVP_PKEY *pkey;
-        EC_KEY *key;
-        const unsigned char *q;
-        q = *pp;
-        pkey = d2i_PUBKEY(NULL, &q, length);
-        if (!pkey)
-                return (NULL);
-        key = EVP_PKEY_get1_EC_KEY(pkey);
-        EVP_PKEY_free(pkey);
-        if (!key)
-                return (NULL);
-        *pp = q;
-        if (a) {
-                EC_KEY_free(*a);
-                *a = key;
-        }
-        return (key);
-}
-
-int
-i2d_EC_PUBKEY(EC_KEY *a, unsigned char **pp)
-{
-        EVP_PKEY *pktmp;
-        int ret;
-        if (!a)
-                return (0);
-        if ((pktmp = EVP_PKEY_new()) == NULL) {
-                ASN1err(ASN1_F_I2D_EC_PUBKEY, ERR_R_MALLOC_FAILURE);
-                return (0);
-        }
-        EVP_PKEY_set1_EC_KEY(pktmp, a);
-        ret = i2d_PUBKEY(pktmp, pp);
-        EVP_PKEY_free(pktmp);
-        return (ret);
-}
-#endif
-
-int
-X509_PUBKEY_set0_param(X509_PUBKEY *pub, ASN1_OBJECT *aobj, int ptype,
-    void *pval, unsigned char *penc, int penclen)
-{
-        if (!X509_ALGOR_set0(pub->algor, aobj, ptype, pval))
-                return 0;
-        if (penc) {
-                free(pub->public_key->data);
-                pub->public_key->data = penc;
-                pub->public_key->length = penclen;
-                /* Set number of unused bits to zero */
-                pub->public_key->flags&= ~(ASN1_STRING_FLAG_BITS_LEFT|0x07);
-                pub->public_key->flags |= ASN1_STRING_FLAG_BITS_LEFT;
-        }
-        return 1;
-}
-
-int
-X509_PUBKEY_get0_param(ASN1_OBJECT **ppkalg, const unsigned char **pk,
-    int *ppklen, X509_ALGOR **pa, X509_PUBKEY *pub)
-{
-        if (ppkalg)
-                *ppkalg = pub->algor->algorithm;
-        if (pk) {
-                *pk = pub->public_key->data;
-                *ppklen = pub->public_key->length;
-        }
-        if (pa)
-                *pa = pub->algor;
-        return 1;
-}
diff --git a/src/lib/libcrypto/asn1/x_req.c b/src/lib/libcrypto/asn1/x_req.c
deleted file mode 100644
index 5ffa11e2dd..0000000000
--- a/src/lib/libcrypto/asn1/x_req.c
+++ /dev/null
@@ -1,227 +0,0 @@
-/* $OpenBSD: x_req.c,v 1.15 2015/02/11 04:00:39 jsing Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-
-#include <openssl/asn1t.h>
-#include <openssl/x509.h>
-
-/* X509_REQ_INFO is handled in an unusual way to get round
- * invalid encodings. Some broken certificate requests don't
- * encode the attributes field if it is empty. This is in
- * violation of PKCS#10 but we need to tolerate it. We do
- * this by making the attributes field OPTIONAL then using
- * the callback to initialise it to an empty STACK.
- *
- * This means that the field will be correctly encoded unless
- * we NULL out the field.
- *
- * As a result we no longer need the req_kludge field because
- * the information is now contained in the attributes field:
- * 1. If it is NULL then it's the invalid omission.
- * 2. If it is empty it is the correct encoding.
- * 3. If it is not empty then some attributes are present.
- *
- */
-
-static int
-rinf_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it, void *exarg)
-{
-        X509_REQ_INFO *rinf = (X509_REQ_INFO *)*pval;
-
-        if (operation == ASN1_OP_NEW_POST) {
-                rinf->attributes = sk_X509_ATTRIBUTE_new_null();
-                if (!rinf->attributes)
-                        return 0;
-        }
-        return 1;
-}
-
-static const ASN1_AUX X509_REQ_INFO_aux = {
-        .flags = ASN1_AFLG_ENCODING,
-        .asn1_cb = rinf_cb,
-        .enc_offset = offsetof(X509_REQ_INFO, enc),
-};
-static const ASN1_TEMPLATE X509_REQ_INFO_seq_tt[] = {
-        {
-                .offset = offsetof(X509_REQ_INFO, version),
-                .field_name = "version",
-                .item = &ASN1_INTEGER_it,
-        },
-        {
-                .offset = offsetof(X509_REQ_INFO, subject),
-                .field_name = "subject",
-                .item = &X509_NAME_it,
-        },
-        {
-                .offset = offsetof(X509_REQ_INFO, pubkey),
-                .field_name = "pubkey",
-                .item = &X509_PUBKEY_it,
-        },
-        /* This isn't really OPTIONAL but it gets round invalid
-         * encodings
-         */
-        {
-                .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_SET_OF | ASN1_TFLG_OPTIONAL,
-                .offset = offsetof(X509_REQ_INFO, attributes),
-                .field_name = "attributes",
-                .item = &X509_ATTRIBUTE_it,
-        },
-};
-
-const ASN1_ITEM X509_REQ_INFO_it = {
-        .itype = ASN1_ITYPE_SEQUENCE,
-        .utype = V_ASN1_SEQUENCE,
-        .templates = X509_REQ_INFO_seq_tt,
-        .tcount = sizeof(X509_REQ_INFO_seq_tt) / sizeof(ASN1_TEMPLATE),
-        .funcs = &X509_REQ_INFO_aux,
-        .size = sizeof(X509_REQ_INFO),
-        .sname = "X509_REQ_INFO",
-};
-
-
-X509_REQ_INFO *
-d2i_X509_REQ_INFO(X509_REQ_INFO **a, const unsigned char **in, long len)
-{
-        return (X509_REQ_INFO *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &X509_REQ_INFO_it);
-}
-
-int
-i2d_X509_REQ_INFO(X509_REQ_INFO *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &X509_REQ_INFO_it);
-}
-
-X509_REQ_INFO *
-X509_REQ_INFO_new(void)
-{
-        return (X509_REQ_INFO *)ASN1_item_new(&X509_REQ_INFO_it);
-}
-
-void
-X509_REQ_INFO_free(X509_REQ_INFO *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &X509_REQ_INFO_it);
-}
-
-static const ASN1_AUX X509_REQ_aux = {
-        .app_data = NULL,
-        .flags = ASN1_AFLG_REFCOUNT,
-        .ref_offset = offsetof(X509_REQ, references),
-        .ref_lock = CRYPTO_LOCK_X509_REQ,
-};
-static const ASN1_TEMPLATE X509_REQ_seq_tt[] = {
-        {
-                .offset = offsetof(X509_REQ, req_info),
-                .field_name = "req_info",
-                .item = &X509_REQ_INFO_it,
-        },
-        {
-                .offset = offsetof(X509_REQ, sig_alg),
-                .field_name = "sig_alg",
-                .item = &X509_ALGOR_it,
-        },
-        {
-                .offset = offsetof(X509_REQ, signature),
-                .field_name = "signature",
-                .item = &ASN1_BIT_STRING_it,
-        },
-};
-
-const ASN1_ITEM X509_REQ_it = {
-        .itype = ASN1_ITYPE_SEQUENCE,
-        .utype = V_ASN1_SEQUENCE,
-        .templates = X509_REQ_seq_tt,
-        .tcount = sizeof(X509_REQ_seq_tt) / sizeof(ASN1_TEMPLATE),
-        .funcs = &X509_REQ_aux,
-        .size = sizeof(X509_REQ),
-        .sname = "X509_REQ",
-};
-
-
-X509_REQ *
-d2i_X509_REQ(X509_REQ **a, const unsigned char **in, long len)
-{
-        return (X509_REQ *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &X509_REQ_it);
-}
-
-int
-i2d_X509_REQ(X509_REQ *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &X509_REQ_it);
-}
-
-X509_REQ *
-X509_REQ_new(void)
-{
-        return (X509_REQ *)ASN1_item_new(&X509_REQ_it);
-}
-
-void
-X509_REQ_free(X509_REQ *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &X509_REQ_it);
-}
-
-X509_REQ *
-X509_REQ_dup(X509_REQ *x)
-{
-        return ASN1_item_dup(&X509_REQ_it, x);
-}
diff --git a/src/lib/libcrypto/asn1/x_sig.c b/src/lib/libcrypto/asn1/x_sig.c
deleted file mode 100644
index 702bc40e55..0000000000
--- a/src/lib/libcrypto/asn1/x_sig.c
+++ /dev/null
@@ -1,110 +0,0 @@
-/* $OpenBSD: x_sig.c,v 1.11 2015/02/11 04:00:39 jsing Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-
-#include <openssl/asn1t.h>
-#include <openssl/x509.h>
-
-static const ASN1_TEMPLATE X509_SIG_seq_tt[] = {
-        {
-                .offset = offsetof(X509_SIG, algor),
-                .field_name = "algor",
-                .item = &X509_ALGOR_it,
-        },
-        {
-                .offset = offsetof(X509_SIG, digest),
-                .field_name = "digest",
-                .item = &ASN1_OCTET_STRING_it,
-        },
-};
-
-const ASN1_ITEM X509_SIG_it = {
-        .itype = ASN1_ITYPE_SEQUENCE,
-        .utype = V_ASN1_SEQUENCE,
-        .templates = X509_SIG_seq_tt,
-        .tcount = sizeof(X509_SIG_seq_tt) / sizeof(ASN1_TEMPLATE),
-        .size = sizeof(X509_SIG),
-        .sname = "X509_SIG",
-};
-
-
-X509_SIG *
-d2i_X509_SIG(X509_SIG **a, const unsigned char **in, long len)
-{
-        return (X509_SIG *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &X509_SIG_it);
-}
-
-int
-i2d_X509_SIG(X509_SIG *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &X509_SIG_it);
-}
-
-X509_SIG *
-X509_SIG_new(void)
-{
-        return (X509_SIG *)ASN1_item_new(&X509_SIG_it);
-}
-
-void
-X509_SIG_free(X509_SIG *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &X509_SIG_it);
-}
diff --git a/src/lib/libcrypto/asn1/x_spki.c b/src/lib/libcrypto/asn1/x_spki.c
deleted file mode 100644
index 2aa860feb9..0000000000
--- a/src/lib/libcrypto/asn1/x_spki.c
+++ /dev/null
@@ -1,174 +0,0 @@
-/* $OpenBSD: x_spki.c,v 1.11 2015/02/11 04:00:39 jsing Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
- /* This module was send to me my Pat Richards <patr@x509.com> who
-  * wrote it.  It is under my Copyright with his permission
-  */
-
-#include <stdio.h>
-
-#include <openssl/x509.h>
-#include <openssl/asn1t.h>
-
-static const ASN1_TEMPLATE NETSCAPE_SPKAC_seq_tt[] = {
-        {
-                .offset = offsetof(NETSCAPE_SPKAC, pubkey),
-                .field_name = "pubkey",
-                .item = &X509_PUBKEY_it,
-        },
-        {
-                .offset = offsetof(NETSCAPE_SPKAC, challenge),
-                .field_name = "challenge",
-                .item = &ASN1_IA5STRING_it,
-        },
-};
-
-const ASN1_ITEM NETSCAPE_SPKAC_it = {
-        .itype = ASN1_ITYPE_SEQUENCE,
-        .utype = V_ASN1_SEQUENCE,
-        .templates = NETSCAPE_SPKAC_seq_tt,
-        .tcount = sizeof(NETSCAPE_SPKAC_seq_tt) / sizeof(ASN1_TEMPLATE),
-        .size = sizeof(NETSCAPE_SPKAC),
-        .sname = "NETSCAPE_SPKAC",
-};
-
-
-NETSCAPE_SPKAC *
-d2i_NETSCAPE_SPKAC(NETSCAPE_SPKAC **a, const unsigned char **in, long len)
-{
-        return (NETSCAPE_SPKAC *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &NETSCAPE_SPKAC_it);
-}
-
-int
-i2d_NETSCAPE_SPKAC(NETSCAPE_SPKAC *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &NETSCAPE_SPKAC_it);
-}
-
-NETSCAPE_SPKAC *
-NETSCAPE_SPKAC_new(void)
-{
-        return (NETSCAPE_SPKAC *)ASN1_item_new(&NETSCAPE_SPKAC_it);
-}
-
-void
-NETSCAPE_SPKAC_free(NETSCAPE_SPKAC *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &NETSCAPE_SPKAC_it);
-}
-
-static const ASN1_TEMPLATE NETSCAPE_SPKI_seq_tt[] = {
-        {
-                .flags = 0,
-                .tag = 0,
-                .offset = offsetof(NETSCAPE_SPKI, spkac),
-                .field_name = "spkac",
-                .item = &NETSCAPE_SPKAC_it,
-        },
-        {
-                .flags = 0,
-                .tag = 0,
-                .offset = offsetof(NETSCAPE_SPKI, sig_algor),
-                .field_name = "sig_algor",
-                .item = &X509_ALGOR_it,
-        },
-        {
-                .flags = 0,
-                .tag = 0,
-                .offset = offsetof(NETSCAPE_SPKI, signature),
-                .field_name = "signature",
-                .item = &ASN1_BIT_STRING_it,
-        },
-};
-
-const ASN1_ITEM NETSCAPE_SPKI_it = {
-        .itype = ASN1_ITYPE_SEQUENCE,
-        .utype = V_ASN1_SEQUENCE,
-        .templates = NETSCAPE_SPKI_seq_tt,
-        .tcount = sizeof(NETSCAPE_SPKI_seq_tt) / sizeof(ASN1_TEMPLATE),
-        .funcs = NULL,
-        .size = sizeof(NETSCAPE_SPKI),
-        .sname = "NETSCAPE_SPKI",
-};
-
-
-NETSCAPE_SPKI *
-d2i_NETSCAPE_SPKI(NETSCAPE_SPKI **a, const unsigned char **in, long len)
-{
-        return (NETSCAPE_SPKI *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &NETSCAPE_SPKI_it);
-}
-
-int
-i2d_NETSCAPE_SPKI(NETSCAPE_SPKI *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &NETSCAPE_SPKI_it);
-}
-
-NETSCAPE_SPKI *
-NETSCAPE_SPKI_new(void)
-{
-        return (NETSCAPE_SPKI *)ASN1_item_new(&NETSCAPE_SPKI_it);
-}
-
-void
-NETSCAPE_SPKI_free(NETSCAPE_SPKI *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &NETSCAPE_SPKI_it);
-}
diff --git a/src/lib/libcrypto/asn1/x_val.c b/src/lib/libcrypto/asn1/x_val.c
deleted file mode 100644
index eb2ba783bb..0000000000
--- a/src/lib/libcrypto/asn1/x_val.c
+++ /dev/null
@@ -1,110 +0,0 @@
-/* $OpenBSD: x_val.c,v 1.11 2015/02/11 04:00:39 jsing Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-
-#include <openssl/asn1t.h>
-#include <openssl/x509.h>
-
-static const ASN1_TEMPLATE X509_VAL_seq_tt[] = {
-        {
-                .offset = offsetof(X509_VAL, notBefore),
-                .field_name = "notBefore",
-                .item = &ASN1_TIME_it,
-        },
-        {
-                .offset = offsetof(X509_VAL, notAfter),
-                .field_name = "notAfter",
-                .item = &ASN1_TIME_it,
-        },
-};
-
-const ASN1_ITEM X509_VAL_it = {
-        .itype = ASN1_ITYPE_SEQUENCE,
-        .utype = V_ASN1_SEQUENCE,
-        .templates = X509_VAL_seq_tt,
-        .tcount = sizeof(X509_VAL_seq_tt) / sizeof(ASN1_TEMPLATE),
-        .size = sizeof(X509_VAL),
-        .sname = "X509_VAL",
-};
-
-
-X509_VAL *
-d2i_X509_VAL(X509_VAL **a, const unsigned char **in, long len)
-{
-        return (X509_VAL *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &X509_VAL_it);
-}
-
-int
-i2d_X509_VAL(X509_VAL *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &X509_VAL_it);
-}
-
-X509_VAL *
-X509_VAL_new(void)
-{
-        return (X509_VAL *)ASN1_item_new(&X509_VAL_it);
-}
-
-void
-X509_VAL_free(X509_VAL *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &X509_VAL_it);
-}
diff --git a/src/lib/libcrypto/asn1/x_x509.c b/src/lib/libcrypto/asn1/x_x509.c
deleted file mode 100644
index 168c2c0fcd..0000000000
--- a/src/lib/libcrypto/asn1/x_x509.c
+++ /dev/null
@@ -1,346 +0,0 @@
-/* $OpenBSD: x_x509.c,v 1.24 2015/03/19 14:00:22 tedu Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-
-#include <openssl/opensslconf.h>
-
-#include <openssl/asn1t.h>
-#include <openssl/evp.h>
-#include <openssl/x509.h>
-#include <openssl/x509v3.h>
-
-static const ASN1_AUX X509_CINF_aux = {
-        .flags = ASN1_AFLG_ENCODING,
-        .enc_offset = offsetof(X509_CINF, enc),
-};
-static const ASN1_TEMPLATE X509_CINF_seq_tt[] = {
-        {
-                .flags = ASN1_TFLG_EXPLICIT | ASN1_TFLG_OPTIONAL,
-                .offset = offsetof(X509_CINF, version),
-                .field_name = "version",
-                .item = &ASN1_INTEGER_it,
-        },
-        {
-                .offset = offsetof(X509_CINF, serialNumber),
-                .field_name = "serialNumber",
-                .item = &ASN1_INTEGER_it,
-        },
-        {
-                .offset = offsetof(X509_CINF, signature),
-                .field_name = "signature",
-                .item = &X509_ALGOR_it,
-        },
-        {
-                .offset = offsetof(X509_CINF, issuer),
-                .field_name = "issuer",
-                .item = &X509_NAME_it,
-        },
-        {
-                .offset = offsetof(X509_CINF, validity),
-                .field_name = "validity",
-                .item = &X509_VAL_it,
-        },
-        {
-                .offset = offsetof(X509_CINF, subject),
-                .field_name = "subject",
-                .item = &X509_NAME_it,
-        },
-        {
-                .offset = offsetof(X509_CINF, key),
-                .field_name = "key",
-                .item = &X509_PUBKEY_it,
-        },
-        {
-                .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_OPTIONAL,
-                .tag = 1,
-                .offset = offsetof(X509_CINF, issuerUID),
-                .field_name = "issuerUID",
-                .item = &ASN1_BIT_STRING_it,
-        },
-        {
-                .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_OPTIONAL,
-                .tag = 2,
-                .offset = offsetof(X509_CINF, subjectUID),
-                .field_name = "subjectUID",
-                .item = &ASN1_BIT_STRING_it,
-        },
-        {
-                .flags = ASN1_TFLG_EXPLICIT | ASN1_TFLG_SEQUENCE_OF |
-                    ASN1_TFLG_OPTIONAL,
-                .tag = 3,
-                .offset = offsetof(X509_CINF, extensions),
-                .field_name = "extensions",
-                .item = &X509_EXTENSION_it,
-        },
-};
-
-const ASN1_ITEM X509_CINF_it = {
-        .itype = ASN1_ITYPE_SEQUENCE,
-        .utype = V_ASN1_SEQUENCE,
-        .templates = X509_CINF_seq_tt,
-        .tcount = sizeof(X509_CINF_seq_tt) / sizeof(ASN1_TEMPLATE),
-        .funcs = &X509_CINF_aux,
-        .size = sizeof(X509_CINF),
-        .sname = "X509_CINF",
-};
-
-
-X509_CINF *
-d2i_X509_CINF(X509_CINF **a, const unsigned char **in, long len)
-{
-        return (X509_CINF *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &X509_CINF_it);
-}
-
-int
-i2d_X509_CINF(X509_CINF *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &X509_CINF_it);
-}
-
-X509_CINF *
-X509_CINF_new(void)
-{
-        return (X509_CINF *)ASN1_item_new(&X509_CINF_it);
-}
-
-void
-X509_CINF_free(X509_CINF *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &X509_CINF_it);
-}
-/* X509 top level structure needs a bit of customisation */
-
-extern void policy_cache_free(X509_POLICY_CACHE *cache);
-
-static int
-x509_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it, void *exarg)
-{
-        X509 *ret = (X509 *)*pval;
-
-        switch (operation) {
-
-        case ASN1_OP_NEW_POST:
-                ret->valid = 0;
-                ret->name = NULL;
-                ret->ex_flags = 0;
-                ret->ex_pathlen = -1;
-                ret->skid = NULL;
-                ret->akid = NULL;
-                ret->aux = NULL;
-                ret->crldp = NULL;
-                CRYPTO_new_ex_data(CRYPTO_EX_INDEX_X509, ret, &ret->ex_data);
-                break;
-
-        case ASN1_OP_D2I_POST:
-                free(ret->name);
-                ret->name = X509_NAME_oneline(ret->cert_info->subject, NULL, 0);
-                break;
-
-        case ASN1_OP_FREE_POST:
-                CRYPTO_free_ex_data(CRYPTO_EX_INDEX_X509, ret, &ret->ex_data);
-                X509_CERT_AUX_free(ret->aux);
-                ASN1_OCTET_STRING_free(ret->skid);
-                AUTHORITY_KEYID_free(ret->akid);
-                CRL_DIST_POINTS_free(ret->crldp);
-                policy_cache_free(ret->policy_cache);
-                GENERAL_NAMES_free(ret->altname);
-                NAME_CONSTRAINTS_free(ret->nc);
-                free(ret->name);
-                ret->name = NULL;
-                break;
-        }
-
-        return 1;
-}
-
-static const ASN1_AUX X509_aux = {
-        .app_data = NULL,
-        .flags = ASN1_AFLG_REFCOUNT,
-        .ref_offset = offsetof(X509, references),
-        .ref_lock = CRYPTO_LOCK_X509,
-        .asn1_cb = x509_cb,
-};
-static const ASN1_TEMPLATE X509_seq_tt[] = {
-        {
-                .offset = offsetof(X509, cert_info),
-                .field_name = "cert_info",
-                .item = &X509_CINF_it,
-        },
-        {
-                .offset = offsetof(X509, sig_alg),
-                .field_name = "sig_alg",
-                .item = &X509_ALGOR_it,
-        },
-        {
-                .offset = offsetof(X509, signature),
-                .field_name = "signature",
-                .item = &ASN1_BIT_STRING_it,
-        },
-};
-
-const ASN1_ITEM X509_it = {
-        .itype = ASN1_ITYPE_SEQUENCE,
-        .utype = V_ASN1_SEQUENCE,
-        .templates = X509_seq_tt,
-        .tcount = sizeof(X509_seq_tt) / sizeof(ASN1_TEMPLATE),
-        .funcs = &X509_aux,
-        .size = sizeof(X509),
-        .sname = "X509",
-};
-
-
-X509 *
-d2i_X509(X509 **a, const unsigned char **in, long len)
-{
-        return (X509 *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &X509_it);
-}
-
-int
-i2d_X509(X509 *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &X509_it);
-}
-
-X509 *
-X509_new(void)
-{
-        return (X509 *)ASN1_item_new(&X509_it);
-}
-
-void
-X509_free(X509 *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &X509_it);
-}
-
-X509 *
-X509_dup(X509 *x)
-{
-        return ASN1_item_dup(&X509_it, x);
-}
-
-int
-X509_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
-    CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
-{
-        return CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_X509, argl, argp,
-            new_func, dup_func, free_func);
-}
-
-int
-X509_set_ex_data(X509 *r, int idx, void *arg)
-{
-        return (CRYPTO_set_ex_data(&r->ex_data, idx, arg));
-}
-
-void *
-X509_get_ex_data(X509 *r, int idx)
-{
-        return (CRYPTO_get_ex_data(&r->ex_data, idx));
-}
-
-/* X509_AUX ASN1 routines. X509_AUX is the name given to
- * a certificate with extra info tagged on the end. Since these
- * functions set how a certificate is trusted they should only
- * be used when the certificate comes from a reliable source
- * such as local storage.
- *
- */
-
-X509 *
-d2i_X509_AUX(X509 **a, const unsigned char **pp, long length)
-{
-        const unsigned char *q;
-        X509 *ret;
-
-        /* Save start position */
-        q = *pp;
-        ret = d2i_X509(NULL, pp, length);
-        /* If certificate unreadable then forget it */
-        if (!ret)
-                return NULL;
-        /* update length */
-        length -= *pp - q;
-        if (length > 0) {
-                if (!d2i_X509_CERT_AUX(&ret->aux, pp, length))
-                        goto err;
-        }
-        if (a != NULL) {
-                X509_free(*a);
-                *a = ret;
-        }
-        return ret;
-
-err:
-        X509_free(ret);
-        return NULL;
-}
-
-int
-i2d_X509_AUX(X509 *a, unsigned char **pp)
-{
-        int length;
-
-        length = i2d_X509(a, pp);
-        if (a)
-                length += i2d_X509_CERT_AUX(a->aux, pp);
-        return length;
-}
diff --git a/src/lib/libcrypto/asn1/x_x509a.c b/src/lib/libcrypto/asn1/x_x509a.c
deleted file mode 100644
index 29817915b6..0000000000
--- a/src/lib/libcrypto/asn1/x_x509a.c
+++ /dev/null
@@ -1,325 +0,0 @@
-/* $OpenBSD: x_x509a.c,v 1.14 2015/02/14 15:28:39 miod Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 1999.
- */
-/* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <stdio.h>
-
-#include <openssl/asn1t.h>
-#include <openssl/evp.h>
-#include <openssl/x509.h>
-
-/* X509_CERT_AUX routines. These are used to encode additional
- * user modifiable data about a certificate. This data is
- * appended to the X509 encoding when the *_X509_AUX routines
- * are used. This means that the "traditional" X509 routines
- * will simply ignore the extra data.
- */
-
-static X509_CERT_AUX *aux_get(X509 *x);
-
-static const ASN1_TEMPLATE X509_CERT_AUX_seq_tt[] = {
-        {
-                .flags = ASN1_TFLG_SEQUENCE_OF | ASN1_TFLG_OPTIONAL,
-                .offset = offsetof(X509_CERT_AUX, trust),
-                .field_name = "trust",
-                .item = &ASN1_OBJECT_it,
-        },
-        {
-                .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_SEQUENCE_OF |
-                    ASN1_TFLG_OPTIONAL,
-                .tag = 0,
-                .offset = offsetof(X509_CERT_AUX, reject),
-                .field_name = "reject",
-                .item = &ASN1_OBJECT_it,
-        },
-        {
-                .flags = ASN1_TFLG_OPTIONAL,
-                .offset = offsetof(X509_CERT_AUX, alias),
-                .field_name = "alias",
-                .item = &ASN1_UTF8STRING_it,
-        },
-        {
-                .flags = ASN1_TFLG_OPTIONAL,
-                .offset = offsetof(X509_CERT_AUX, keyid),
-                .field_name = "keyid",
-                .item = &ASN1_OCTET_STRING_it,
-        },
-        {
-                .flags = ASN1_TFLG_IMPLICIT | ASN1_TFLG_SEQUENCE_OF |
-                    ASN1_TFLG_OPTIONAL,
-                .tag = 1,
-                .offset = offsetof(X509_CERT_AUX, other),
-                .field_name = "other",
-                .item = &X509_ALGOR_it,
-        },
-};
-
-const ASN1_ITEM X509_CERT_AUX_it = {
-        .itype = ASN1_ITYPE_SEQUENCE,
-        .utype = V_ASN1_SEQUENCE,
-        .templates = X509_CERT_AUX_seq_tt,
-        .tcount = sizeof(X509_CERT_AUX_seq_tt) / sizeof(ASN1_TEMPLATE),
-        .size = sizeof(X509_CERT_AUX),
-        .sname = "X509_CERT_AUX",
-};
-
-
-X509_CERT_AUX *
-d2i_X509_CERT_AUX(X509_CERT_AUX **a, const unsigned char **in, long len)
-{
-        return (X509_CERT_AUX *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &X509_CERT_AUX_it);
-}
-
-int
-i2d_X509_CERT_AUX(X509_CERT_AUX *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &X509_CERT_AUX_it);
-}
-
-X509_CERT_AUX *
-X509_CERT_AUX_new(void)
-{
-        return (X509_CERT_AUX *)ASN1_item_new(&X509_CERT_AUX_it);
-}
-
-void
-X509_CERT_AUX_free(X509_CERT_AUX *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &X509_CERT_AUX_it);
-}
-
-static X509_CERT_AUX *
-aux_get(X509 *x)
-{
-        if (!x)
-                return NULL;
-        if (!x->aux && !(x->aux = X509_CERT_AUX_new()))
-                return NULL;
-        return x->aux;
-}
-
-int
-X509_alias_set1(X509 *x, unsigned char *name, int len)
-{
-        X509_CERT_AUX *aux;
-        if (!name) {
-                if (!x || !x->aux || !x->aux->alias)
-                        return 1;
-                ASN1_UTF8STRING_free(x->aux->alias);
-                x->aux->alias = NULL;
-                return 1;
-        }
-        if (!(aux = aux_get(x)))
-                return 0;
-        if (!aux->alias && !(aux->alias = ASN1_UTF8STRING_new()))
-                return 0;
-        return ASN1_STRING_set(aux->alias, name, len);
-}
-
-int
-X509_keyid_set1(X509 *x, unsigned char *id, int len)
-{
-        X509_CERT_AUX *aux;
-        if (!id) {
-                if (!x || !x->aux || !x->aux->keyid)
-                        return 1;
-                ASN1_OCTET_STRING_free(x->aux->keyid);
-                x->aux->keyid = NULL;
-                return 1;
-        }
-        if (!(aux = aux_get(x)))
-                return 0;
-        if (!aux->keyid && !(aux->keyid = ASN1_OCTET_STRING_new()))
-                return 0;
-        return ASN1_STRING_set(aux->keyid, id, len);
-}
-
-unsigned char *
-X509_alias_get0(X509 *x, int *len)
-{
-        if (!x->aux || !x->aux->alias)
-                return NULL;
-        if (len)
-                *len = x->aux->alias->length;
-        return x->aux->alias->data;
-}
-
-unsigned char *
-X509_keyid_get0(X509 *x, int *len)
-{
-        if (!x->aux || !x->aux->keyid)
-                return NULL;
-        if (len)
-                *len = x->aux->keyid->length;
-        return x->aux->keyid->data;
-}
-
-int
-X509_add1_trust_object(X509 *x, ASN1_OBJECT *obj)
-{
-        X509_CERT_AUX *aux;
-        ASN1_OBJECT *objtmp;
-        int rc;
-
-        if (!(objtmp = OBJ_dup(obj)))
-                return 0;
-        if (!(aux = aux_get(x)))
-                goto err;
-        if (!aux->trust && !(aux->trust = sk_ASN1_OBJECT_new_null()))
-                goto err;
-        rc = sk_ASN1_OBJECT_push(aux->trust, objtmp);
-        if (rc != 0)
-                return rc;
-
-err:
-        ASN1_OBJECT_free(objtmp);
-        return 0;
-}
-
-int
-X509_add1_reject_object(X509 *x, ASN1_OBJECT *obj)
-{
-        X509_CERT_AUX *aux;
-        ASN1_OBJECT *objtmp;
-        int rc;
-
-        if (!(objtmp = OBJ_dup(obj)))
-                return 0;
-        if (!(aux = aux_get(x)))
-                goto err;
-        if (!aux->reject && !(aux->reject = sk_ASN1_OBJECT_new_null()))
-                goto err;
-        rc = sk_ASN1_OBJECT_push(aux->reject, objtmp);
-        if (rc != 0)
-                return rc;
-
-err:
-        ASN1_OBJECT_free(objtmp);
-        return 0;
-}
-
-void
-X509_trust_clear(X509 *x)
-{
-        if (x->aux && x->aux->trust) {
-                sk_ASN1_OBJECT_pop_free(x->aux->trust, ASN1_OBJECT_free);
-                x->aux->trust = NULL;
-        }
-}
-
-void
-X509_reject_clear(X509 *x)
-{
-        if (x->aux && x->aux->reject) {
-                sk_ASN1_OBJECT_pop_free(x->aux->reject, ASN1_OBJECT_free);
-                x->aux->reject = NULL;
-        }
-}
-
-static const ASN1_TEMPLATE X509_CERT_PAIR_seq_tt[] = {
-        {
-                .flags = ASN1_TFLG_EXPLICIT | ASN1_TFLG_OPTIONAL,
-                .tag = 0,
-                .offset = offsetof(X509_CERT_PAIR, forward),
-                .field_name = "forward",
-                .item = &X509_it,
-        },
-        {
-                .flags = ASN1_TFLG_EXPLICIT | ASN1_TFLG_OPTIONAL,
-                .tag = 1,
-                .offset = offsetof(X509_CERT_PAIR, reverse),
-                .field_name = "reverse",
-                .item = &X509_it,
-        },
-};
-
-const ASN1_ITEM X509_CERT_PAIR_it = {
-        .itype = ASN1_ITYPE_SEQUENCE,
-        .utype = V_ASN1_SEQUENCE,
-        .templates = X509_CERT_PAIR_seq_tt,
-        .tcount = sizeof(X509_CERT_PAIR_seq_tt) / sizeof(ASN1_TEMPLATE),
-        .funcs = NULL,
-        .size = sizeof(X509_CERT_PAIR),
-        .sname = "X509_CERT_PAIR",
-};
-
-
-X509_CERT_PAIR *
-d2i_X509_CERT_PAIR(X509_CERT_PAIR **a, const unsigned char **in, long len)
-{
-        return (X509_CERT_PAIR *)ASN1_item_d2i((ASN1_VALUE **)a, in, len,
-            &X509_CERT_PAIR_it);
-}
-
-int
-i2d_X509_CERT_PAIR(X509_CERT_PAIR *a, unsigned char **out)
-{
-        return ASN1_item_i2d((ASN1_VALUE *)a, out, &X509_CERT_PAIR_it);
-}
-
-X509_CERT_PAIR *
-X509_CERT_PAIR_new(void)
-{
-        return (X509_CERT_PAIR *)ASN1_item_new(&X509_CERT_PAIR_it);
-}
-
-void
-X509_CERT_PAIR_free(X509_CERT_PAIR *a)
-{
-        ASN1_item_free((ASN1_VALUE *)a, &X509_CERT_PAIR_it);
-}