import openssl-0.9.7d

12 files changed, 90 insertions, 55 deletions

diff --git a/src/lib/libssl/LICENSE b/src/lib/libssl/LICENSE
index dddb07842b..40277883a5 100644
--- a/src/lib/libssl/LICENSE
+++ b/src/lib/libssl/LICENSE
@@ -12,7 +12,7 @@
   ---------------
 
 /* ====================================================================
- * Copyright (c) 1998-2003 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1998-2004 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/src/lib/libssl/doc/openssl.cnf b/src/lib/libssl/doc/openssl.cnf
index eca51c3322..854d1f164e 100644
--- a/src/lib/libssl/doc/openssl.cnf
+++ b/src/lib/libssl/doc/openssl.cnf
@@ -38,10 +38,14 @@ dir		= ./demoCA		# Where everything is kept
 certs           = $dir/certs            # Where the issued certs are kept
 crl_dir         = $dir/crl              # Where the issued crl are kept
 database        = $dir/index.txt        # database index file.
+#unique_subject = no                    # Set to 'no' to allow creation of
+                                        # several ctificates with same subject.
 new_certs_dir   = $dir/newcerts         # default place for new certs.
 
 certificate     = $dir/cacert.pem       # The CA certificate
 serial          = $dir/serial           # The current serial number
+#crlnumber      = $dir/crlnumber        # the current crl number
+                                        # must be commented out to leave a V1 CRL
 crl             = $dir/crl.pem          # The current CRL
 private_key     = $dir/private/cakey.pem# The private key
 RANDFILE        = $dir/private/.rand    # private random number file
@@ -58,6 +62,7 @@ cert_opt 	= ca_default		# Certificate field options
 
 # Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs
 # so this is commented out by default to leave a V1 CRL.
+# crlnumber must also be commented out to leave a V1 CRL.
 # crl_extensions        = crl_ext
 
 default_days    = 365                   # how long to certify for
diff --git a/src/lib/libssl/s3_clnt.c b/src/lib/libssl/s3_clnt.c
index eb7daebfdf..26ce0cb963 100644
--- a/src/lib/libssl/s3_clnt.c
+++ b/src/lib/libssl/s3_clnt.c
@@ -117,7 +117,6 @@
 #include <openssl/objects.h>
 #include <openssl/evp.h>
 #include <openssl/md5.h>
-#include "cryptlib.h"
 
 static SSL_METHOD *ssl3_get_client_method(int ver);
 static int ssl3_client_hello(SSL *s);
@@ -1947,7 +1946,7 @@ static int ssl3_check_cert_and_algorithm(SSL *s)
                 if (algs & SSL_kRSA)
                         {
                         if (rsa == NULL
-                            || RSA_size(rsa) > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher))
+                            || RSA_size(rsa)*8 > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher))
                                 {
                                 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_EXPORT_TMP_RSA_KEY);
                                 goto f_err;
@@ -1959,7 +1958,7 @@ static int ssl3_check_cert_and_algorithm(SSL *s)
                         if (algs & (SSL_kEDH|SSL_kDHr|SSL_kDHd))
                             {
                             if (dh == NULL
-                                || DH_size(dh) > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher))
+                                || DH_size(dh)*8 > SSL_C_EXPORT_PKEYLENGTH(s->s3->tmp.new_cipher))
                                 {
                                 SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM,SSL_R_MISSING_EXPORT_TMP_DH_KEY);
                                 goto f_err;
diff --git a/src/lib/libssl/s3_lib.c b/src/lib/libssl/s3_lib.c
index 896b12fc4f..d04096016c 100644
--- a/src/lib/libssl/s3_lib.c
+++ b/src/lib/libssl/s3_lib.c
@@ -271,6 +271,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_ALL_STRENGTHS,
         },
 /* Cipher 07 */
+#ifndef OPENSSL_NO_IDEA
         {
         1,
         SSL3_TXT_RSA_IDEA_128_SHA,
@@ -283,6 +284,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
         SSL_ALL_CIPHERS,
         SSL_ALL_STRENGTHS,
         },
+#endif
 /* Cipher 08 */
         {
         1,
diff --git a/src/lib/libssl/s3_pkt.c b/src/lib/libssl/s3_pkt.c
index 3f88429e79..9f3e5139ad 100644
--- a/src/lib/libssl/s3_pkt.c
+++ b/src/lib/libssl/s3_pkt.c
@@ -1085,6 +1085,14 @@ start:
                         goto err;
                         }
 
+                /* Check we have a cipher to change to */
+                if (s->s3->tmp.new_cipher == NULL)
+                        {
+                        i=SSL_AD_UNEXPECTED_MESSAGE;
+                        SSLerr(SSL_F_SSL3_GET_CERT_VERIFY,SSL_R_CCS_RECEIVED_EARLY);
+                        goto err;
+                        }
+
                 rr->length=0;
 
                 if (s->msg_callback)
diff --git a/src/lib/libssl/s3_srvr.c b/src/lib/libssl/s3_srvr.c
index 881f68b998..deb3cffabe 100644
--- a/src/lib/libssl/s3_srvr.c
+++ b/src/lib/libssl/s3_srvr.c
@@ -121,9 +121,10 @@
 #include <openssl/objects.h>
 #include <openssl/evp.h>
 #include <openssl/x509.h>
+#ifndef OPENSSL_NO_KRB5
 #include <openssl/krb5_asn.h>
+#endif
 #include <openssl/md5.h>
-#include "cryptlib.h"
 
 static SSL_METHOD *ssl3_get_server_method(int ver);
 static int ssl3_get_client_hello(SSL *s);
@@ -1587,11 +1588,27 @@ static int ssl3_get_client_key_exchange(SSL *s)
 
                 n2s(p,i);
                 enc_ticket.length = i;
+
+                if (n < enc_ticket.length + 6)
+                        {
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                                SSL_R_DATA_LENGTH_TOO_LONG);
+                        goto err;
+                        }
+
                 enc_ticket.data = (char *)p;
                 p+=enc_ticket.length;
 
                 n2s(p,i);
                 authenticator.length = i;
+
+                if (n < enc_ticket.length + authenticator.length + 6)
+                        {
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+                                SSL_R_DATA_LENGTH_TOO_LONG);
+                        goto err;
+                        }
+
                 authenticator.data = (char *)p;
                 p+=authenticator.length;
 
diff --git a/src/lib/libssl/ssl.h b/src/lib/libssl/ssl.h
index 4ae8458259..913bd40eea 100644
--- a/src/lib/libssl/ssl.h
+++ b/src/lib/libssl/ssl.h
@@ -1357,8 +1357,8 @@ const char *SSL_alert_type_string(int value);
 const char *SSL_alert_desc_string_long(int value);
 const char *SSL_alert_desc_string(int value);
 
-void SSL_set_client_CA_list(SSL *s, STACK_OF(X509_NAME) *list);
-void SSL_CTX_set_client_CA_list(SSL_CTX *ctx, STACK_OF(X509_NAME) *list);
+void SSL_set_client_CA_list(SSL *s, STACK_OF(X509_NAME) *name_list);
+void SSL_CTX_set_client_CA_list(SSL_CTX *ctx, STACK_OF(X509_NAME) *name_list);
 STACK_OF(X509_NAME) *SSL_get_client_CA_list(SSL *s);
 STACK_OF(X509_NAME) *SSL_CTX_get_client_CA_list(SSL_CTX *s);
 int SSL_add_client_CA(SSL *ssl,X509 *x);
diff --git a/src/lib/libssl/ssl_asn1.c b/src/lib/libssl/ssl_asn1.c
index 16bc11b559..d8ff8fc4a3 100644
--- a/src/lib/libssl/ssl_asn1.c
+++ b/src/lib/libssl/ssl_asn1.c
@@ -62,7 +62,6 @@
 #include <openssl/asn1_mac.h>
 #include <openssl/objects.h>
 #include <openssl/x509.h>
-#include "cryptlib.h"
 
 typedef struct ssl_session_asn1_st
         {
diff --git a/src/lib/libssl/ssl_cert.c b/src/lib/libssl/ssl_cert.c
index da90078a37..2cfb615878 100644
--- a/src/lib/libssl/ssl_cert.c
+++ b/src/lib/libssl/ssl_cert.c
@@ -505,12 +505,12 @@ int ssl_verify_cert_chain(SSL *s,STACK_OF(X509) *sk)
         return(i);
         }
 
-static void set_client_CA_list(STACK_OF(X509_NAME) **ca_list,STACK_OF(X509_NAME) *list)
+static void set_client_CA_list(STACK_OF(X509_NAME) **ca_list,STACK_OF(X509_NAME) *name_list)
         {
         if (*ca_list != NULL)
                 sk_X509_NAME_pop_free(*ca_list,X509_NAME_free);
 
-        *ca_list=list;
+        *ca_list=name_list;
         }
 
 STACK_OF(X509_NAME) *SSL_dup_CA_list(STACK_OF(X509_NAME) *sk)
@@ -532,14 +532,14 @@ STACK_OF(X509_NAME) *SSL_dup_CA_list(STACK_OF(X509_NAME) *sk)
         return(ret);
         }
 
-void SSL_set_client_CA_list(SSL *s,STACK_OF(X509_NAME) *list)
+void SSL_set_client_CA_list(SSL *s,STACK_OF(X509_NAME) *name_list)
         {
-        set_client_CA_list(&(s->client_CA),list);
+        set_client_CA_list(&(s->client_CA),name_list);
         }
 
-void SSL_CTX_set_client_CA_list(SSL_CTX *ctx,STACK_OF(X509_NAME) *list)
+void SSL_CTX_set_client_CA_list(SSL_CTX *ctx,STACK_OF(X509_NAME) *name_list)
         {
-        set_client_CA_list(&(ctx->client_CA),list);
+        set_client_CA_list(&(ctx->client_CA),name_list);
         }
 
 STACK_OF(X509_NAME) *SSL_CTX_get_client_CA_list(SSL_CTX *ctx)
diff --git a/src/lib/libssl/ssl_ciph.c b/src/lib/libssl/ssl_ciph.c
index 888b667fa1..44c503eb04 100644
--- a/src/lib/libssl/ssl_ciph.c
+++ b/src/lib/libssl/ssl_ciph.c
@@ -125,7 +125,9 @@ static const SSL_CIPHER cipher_aliases[]={
         {0,SSL_TXT_3DES,0,SSL_3DES,  0,0,0,0,SSL_ENC_MASK,0},
         {0,SSL_TXT_RC4, 0,SSL_RC4,   0,0,0,0,SSL_ENC_MASK,0},
         {0,SSL_TXT_RC2, 0,SSL_RC2,   0,0,0,0,SSL_ENC_MASK,0},
+#ifndef OPENSSL_NO_IDEA
         {0,SSL_TXT_IDEA,0,SSL_IDEA,  0,0,0,0,SSL_ENC_MASK,0},
+#endif
         {0,SSL_TXT_eNULL,0,SSL_eNULL,0,0,0,0,SSL_ENC_MASK,0},
         {0,SSL_TXT_eFZA,0,SSL_eFZA,  0,0,0,0,SSL_ENC_MASK,0},
         {0,SSL_TXT_AES, 0,SSL_AES,   0,0,0,0,SSL_ENC_MASK,0},
@@ -166,8 +168,12 @@ static void load_ciphers(void)
                 EVP_get_cipherbyname(SN_rc4);
         ssl_cipher_methods[SSL_ENC_RC2_IDX]= 
                 EVP_get_cipherbyname(SN_rc2_cbc);
+#ifndef OPENSSL_NO_IDEA
         ssl_cipher_methods[SSL_ENC_IDEA_IDX]= 
                 EVP_get_cipherbyname(SN_idea_cbc);
+#else
+        ssl_cipher_methods[SSL_ENC_IDEA_IDX]= NULL;
+#endif
         ssl_cipher_methods[SSL_ENC_AES128_IDX]=
           EVP_get_cipherbyname(SN_aes_128_cbc);
         ssl_cipher_methods[SSL_ENC_AES256_IDX]=
@@ -334,10 +340,10 @@ static unsigned long ssl_cipher_get_disabled(void)
         }
 
 static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method,
-                int num_of_ciphers, unsigned long mask, CIPHER_ORDER *list,
+                int num_of_ciphers, unsigned long mask, CIPHER_ORDER *co_list,
                 CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p)
         {
-        int i, list_num;
+        int i, co_list_num;
         SSL_CIPHER *c;
 
         /*
@@ -348,18 +354,18 @@ static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method,
          */
 
         /* Get the initial list of ciphers */
-        list_num = 0;   /* actual count of ciphers */
+        co_list_num = 0;        /* actual count of ciphers */
         for (i = 0; i < num_of_ciphers; i++)
                 {
                 c = ssl_method->get_cipher(i);
                 /* drop those that use any of that is not available */
                 if ((c != NULL) && c->valid && !(c->algorithms & mask))
                         {
-                        list[list_num].cipher = c;
-                        list[list_num].next = NULL;
-                        list[list_num].prev = NULL;
-                        list[list_num].active = 0;
-                        list_num++;
+                        co_list[co_list_num].cipher = c;
+                        co_list[co_list_num].next = NULL;
+                        co_list[co_list_num].prev = NULL;
+                        co_list[co_list_num].active = 0;
+                        co_list_num++;
 #ifdef KSSL_DEBUG
                         printf("\t%d: %s %lx %lx\n",i,c->name,c->id,c->algorithms);
 #endif  /* KSSL_DEBUG */
@@ -372,18 +378,18 @@ static void ssl_cipher_collect_ciphers(const SSL_METHOD *ssl_method,
         /*
          * Prepare linked list from list entries
          */     
-        for (i = 1; i < list_num - 1; i++)
+        for (i = 1; i < co_list_num - 1; i++)
                 {
-                list[i].prev = &(list[i-1]);
-                list[i].next = &(list[i+1]);
+                co_list[i].prev = &(co_list[i-1]);
+                co_list[i].next = &(co_list[i+1]);
                 }
-        if (list_num > 0)
+        if (co_list_num > 0)
                 {
-                (*head_p) = &(list[0]);
+                (*head_p) = &(co_list[0]);
                 (*head_p)->prev = NULL;
-                (*head_p)->next = &(list[1]);
-                (*tail_p) = &(list[list_num - 1]);
-                (*tail_p)->prev = &(list[list_num - 2]);
+                (*head_p)->next = &(co_list[1]);
+                (*tail_p) = &(co_list[co_list_num - 1]);
+                (*tail_p)->prev = &(co_list[co_list_num - 2]);
                 (*tail_p)->next = NULL;
                 }
         }
@@ -429,7 +435,7 @@ static void ssl_cipher_collect_aliases(SSL_CIPHER **ca_list,
 
 static void ssl_cipher_apply_rule(unsigned long algorithms, unsigned long mask,
                 unsigned long algo_strength, unsigned long mask_strength,
-                int rule, int strength_bits, CIPHER_ORDER *list,
+                int rule, int strength_bits, CIPHER_ORDER *co_list,
                 CIPHER_ORDER **head_p, CIPHER_ORDER **tail_p)
         {
         CIPHER_ORDER *head, *tail, *curr, *curr2, *tail2;
@@ -524,8 +530,9 @@ static void ssl_cipher_apply_rule(unsigned long algorithms, unsigned long mask,
         *tail_p = tail;
         }
 
-static int ssl_cipher_strength_sort(CIPHER_ORDER *list, CIPHER_ORDER **head_p,
-                                     CIPHER_ORDER **tail_p)
+static int ssl_cipher_strength_sort(CIPHER_ORDER *co_list,
+                                    CIPHER_ORDER **head_p,
+                                    CIPHER_ORDER **tail_p)
         {
         int max_strength_bits, i, *number_uses;
         CIPHER_ORDER *curr;
@@ -570,14 +577,14 @@ static int ssl_cipher_strength_sort(CIPHER_ORDER *list, CIPHER_ORDER **head_p,
         for (i = max_strength_bits; i >= 0; i--)
                 if (number_uses[i] > 0)
                         ssl_cipher_apply_rule(0, 0, 0, 0, CIPHER_ORD, i,
-                                        list, head_p, tail_p);
+                                        co_list, head_p, tail_p);
 
         OPENSSL_free(number_uses);
         return(1);
         }
 
 static int ssl_cipher_process_rulestr(const char *rule_str,
-                CIPHER_ORDER *list, CIPHER_ORDER **head_p,
+                CIPHER_ORDER *co_list, CIPHER_ORDER **head_p,
                 CIPHER_ORDER **tail_p, SSL_CIPHER **ca_list)
         {
         unsigned long algorithms, mask, algo_strength, mask_strength;
@@ -702,7 +709,7 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
                         ok = 0;
                         if ((buflen == 8) &&
                                 !strncmp(buf, "STRENGTH", 8))
-                                ok = ssl_cipher_strength_sort(list,
+                                ok = ssl_cipher_strength_sort(co_list,
                                         head_p, tail_p);
                         else
                                 SSLerr(SSL_F_SSL_CIPHER_PROCESS_RULESTR,
@@ -722,7 +729,7 @@ static int ssl_cipher_process_rulestr(const char *rule_str,
                         {
                         ssl_cipher_apply_rule(algorithms, mask,
                                 algo_strength, mask_strength, rule, -1,
-                                list, head_p, tail_p);
+                                co_list, head_p, tail_p);
                         }
                 else
                         {
@@ -744,7 +751,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
         unsigned long disabled_mask;
         STACK_OF(SSL_CIPHER) *cipherstack;
         const char *rule_p;
-        CIPHER_ORDER *list = NULL, *head = NULL, *tail = NULL, *curr;
+        CIPHER_ORDER *co_list = NULL, *head = NULL, *tail = NULL, *curr;
         SSL_CIPHER **ca_list = NULL;
 
         /*
@@ -774,15 +781,15 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
 #ifdef KSSL_DEBUG
         printf("ssl_create_cipher_list() for %d ciphers\n", num_of_ciphers);
 #endif    /* KSSL_DEBUG */
-        list = (CIPHER_ORDER *)OPENSSL_malloc(sizeof(CIPHER_ORDER) * num_of_ciphers);
-        if (list == NULL)
+        co_list = (CIPHER_ORDER *)OPENSSL_malloc(sizeof(CIPHER_ORDER) * num_of_ciphers);
+        if (co_list == NULL)
                 {
                 SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE);
                 return(NULL);   /* Failure */
                 }
 
         ssl_cipher_collect_ciphers(ssl_method, num_of_ciphers, disabled_mask,
-                                   list, &head, &tail);
+                                   co_list, &head, &tail);
 
         /*
          * We also need cipher aliases for selecting based on the rule_str.
@@ -798,7 +805,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
                 (SSL_CIPHER **)OPENSSL_malloc(sizeof(SSL_CIPHER *) * num_of_alias_max);
         if (ca_list == NULL)
                 {
-                OPENSSL_free(list);
+                OPENSSL_free(co_list);
                 SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE);
                 return(NULL);   /* Failure */
                 }
@@ -814,21 +821,21 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
         if (strncmp(rule_str,"DEFAULT",7) == 0)
                 {
                 ok = ssl_cipher_process_rulestr(SSL_DEFAULT_CIPHER_LIST,
-                        list, &head, &tail, ca_list);
+                        co_list, &head, &tail, ca_list);
                 rule_p += 7;
                 if (*rule_p == ':')
                         rule_p++;
                 }
 
         if (ok && (strlen(rule_p) > 0))
-                ok = ssl_cipher_process_rulestr(rule_p, list, &head, &tail,
+                ok = ssl_cipher_process_rulestr(rule_p, co_list, &head, &tail,
                                                 ca_list);
 
         OPENSSL_free(ca_list);  /* Not needed anymore */
 
         if (!ok)
                 {       /* Rule processing failure */
-                OPENSSL_free(list);
+                OPENSSL_free(co_list);
                 return(NULL);
                 }
         /*
@@ -837,7 +844,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
          */
         if ((cipherstack = sk_SSL_CIPHER_new_null()) == NULL)
                 {
-                OPENSSL_free(list);
+                OPENSSL_free(co_list);
                 return(NULL);
                 }
 
@@ -855,7 +862,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
 #endif
                         }
                 }
-        OPENSSL_free(list);     /* Not needed any longer */
+        OPENSSL_free(co_list);  /* Not needed any longer */
 
         /*
          * The following passage is a little bit odd. If pointer variables
@@ -905,7 +912,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
 char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len)
         {
         int is_export,pkl,kl;
-        char *ver,*exp;
+        char *ver,*exp_str;
         char *kx,*au,*enc,*mac;
         unsigned long alg,alg2,alg_s;
 #ifdef KSSL_DEBUG
@@ -921,7 +928,7 @@ char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len)
         is_export=SSL_C_IS_EXPORT(cipher);
         pkl=SSL_C_EXPORT_PKEYLENGTH(cipher);
         kl=SSL_C_EXPORT_KEYLENGTH(cipher);
-        exp=is_export?" export":"";
+        exp_str=is_export?" export":"";
 
         if (alg & SSL_SSLV2)
                 ver="SSLv2";
@@ -1040,9 +1047,9 @@ char *SSL_CIPHER_description(SSL_CIPHER *cipher, char *buf, int len)
                 return("Buffer too small");
 
 #ifdef KSSL_DEBUG
-        BIO_snprintf(buf,len,format,cipher->name,ver,kx,au,enc,mac,exp,alg);
+        BIO_snprintf(buf,len,format,cipher->name,ver,kx,au,enc,mac,exp_str,alg);
 #else
-        BIO_snprintf(buf,len,format,cipher->name,ver,kx,au,enc,mac,exp);
+        BIO_snprintf(buf,len,format,cipher->name,ver,kx,au,enc,mac,exp_str);
 #endif /* KSSL_DEBUG */
         return(buf);
         }
@@ -1129,11 +1136,11 @@ int SSL_COMP_add_compression_method(int id, COMP_METHOD *cm)
                 {
                 MemCheck_on();
                 SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD,ERR_R_MALLOC_FAILURE);
-                return(0);
+                return(1);
                 }
         else
                 {
                 MemCheck_on();
-                return(1);
+                return(0);
                 }
         }
diff --git a/src/lib/libssl/ssl_lib.c b/src/lib/libssl/ssl_lib.c
index 6d69890688..ee9a82d586 100644
--- a/src/lib/libssl/ssl_lib.c
+++ b/src/lib/libssl/ssl_lib.c
@@ -121,7 +121,6 @@
 #include <openssl/objects.h>
 #include <openssl/lhash.h>
 #include <openssl/x509v3.h>
-#include "cryptlib.h"
 
 const char *SSL_version_str=OPENSSL_VERSION_TEXT;
 
diff --git a/src/lib/libssl/ssl_sess.c b/src/lib/libssl/ssl_sess.c
index fabcdefa6e..7016c87d3b 100644
--- a/src/lib/libssl/ssl_sess.c
+++ b/src/lib/libssl/ssl_sess.c
@@ -60,7 +60,6 @@
 #include <openssl/lhash.h>
 #include <openssl/rand.h>
 #include "ssl_locl.h"
-#include "cryptlib.h"
 
 static void SSL_SESSION_list_remove(SSL_CTX *ctx, SSL_SESSION *s);
 static void SSL_SESSION_list_add(SSL_CTX *ctx,SSL_SESSION *s);